To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 518.1.7
- compare with another revision
- download diff
- download tarball
- view history from revision 518.1.7
- Committer: Teddy Hogeborn
- Date: 2011-11-26 19:17:31 UTC
- mto: (518.2.5 persistent-state-gpgme)
- mto: This revision was merged to the branch mainline in revision 524.
- Revision ID: teddy@recompile.se-20111126191731-738srhvt9wdkxbbc
* mandos: Break long lines and fix some more white space.
- files added:
- DBUS-API
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
# Contact the authors at <mandos@recompile.se>.
32
32
#
33
33
34
from __future__ import division, with_statement, absolute_import
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
35
36
36
import SocketServer
37
import SocketServer as socketserver
37
38
import socket
38
import optparse
39
import argparse
39
40
import datetime
40
41
import errno
41
42
import gnutls.crypto
44
45
import gnutls.library.functions
45
46
import gnutls.library.constants
46
47
import gnutls.library.types
47
import ConfigParser
48
import ConfigParser as configparser
48
49
import sys
49
50
import re
50
51
import os
51
52
import signal
52
from sets import Set
53
53
import subprocess
54
54
import atexit
55
55
import stat
56
56
import logging
57
57
import logging.handlers
58
58
import pwd
59
from contextlib import closing
59
import contextlib
60
import struct
61
import fcntl
62
import functools
63
import cPickle as pickle
64
import multiprocessing
65
import types
66
import hashlib
60
67
61
68
import dbus
62
69
import dbus.service
65
72
from dbus.mainloop.glib import DBusGMainLoop
66
73
import ctypes
67
74
import ctypes.util
68
69
version = "1.0.5"
70
71
logger = logging.Logger('mandos')
75
import xml.dom.minidom
76
import inspect
77
import Crypto.Cipher.AES
78
79
try:
80
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
81
except AttributeError:
82
try:
83
from IN import SO_BINDTODEVICE
84
except ImportError:
85
SO_BINDTODEVICE = None
86
87
88
version = "1.4.1"
89
stored_state_path = "/var/lib/mandos/clients.pickle"
90
91
logger = logging.getLogger()
72
92
syslogger = (logging.handlers.SysLogHandler
73
93
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
74
address = "/dev/log"))
75
syslogger.setFormatter(logging.Formatter
76
('Mandos [%(process)d]: %(levelname)s:'
77
' %(message)s'))
78
logger.addHandler(syslogger)
79
80
console = logging.StreamHandler()
81
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
82
' %(levelname)s: %(message)s'))
83
logger.addHandler(console)
94
address = str("/dev/log")))
95
96
try:
97
if_nametoindex = (ctypes.cdll.LoadLibrary
98
(ctypes.util.find_library("c"))
99
.if_nametoindex)
100
except (OSError, AttributeError):
101
def if_nametoindex(interface):
102
"Get an interface index the hard way, i.e. using fcntl()"
103
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
104
with contextlib.closing(socket.socket()) as s:
105
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
106
struct.pack(str("16s16x"),
107
interface))
108
interface_index = struct.unpack(str("I"),
109
ifreq[16:20])[0]
110
return interface_index
111
112
113
def initlogger(level=logging.WARNING):
114
"""init logger and add loglevel"""
115
116
syslogger.setFormatter(logging.Formatter
117
('Mandos [%(process)d]: %(levelname)s:'
118
' %(message)s'))
119
logger.addHandler(syslogger)
120
121
console = logging.StreamHandler()
122
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
123
' [%(process)d]:'
124
' %(levelname)s:'
125
' %(message)s'))
126
logger.addHandler(console)
127
logger.setLevel(level)
128
84
129
85
130
class AvahiError(Exception):
86
131
def __init__(self, value, *args, **kwargs):
98
143
99
144
class AvahiService(object):
100
145
"""An Avahi (Zeroconf) service.
146
101
147
Attributes:
102
148
interface: integer; avahi.IF_UNSPEC or an interface index.
103
149
Used to optionally bind to the specified interface.
111
157
max_renames: integer; maximum number of renames
112
158
rename_count: integer; counter so we only rename after collisions
113
159
a sensible number of times
160
group: D-Bus Entry Group
161
server: D-Bus Server
162
bus: dbus.SystemBus()
114
163
"""
115
164
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
116
165
servicetype = None, port = None, TXT = None,
117
domain = "", host = "", max_renames = 32768):
166
domain = "", host = "", max_renames = 32768,
167
protocol = avahi.PROTO_UNSPEC, bus = None):
118
168
self.interface = interface
119
169
self.name = name
120
170
self.type = servicetype
124
174
self.host = host
125
175
self.rename_count = 0
126
176
self.max_renames = max_renames
177
self.protocol = protocol
178
self.group = None # our entry group
179
self.server = None
180
self.bus = bus
181
self.entry_group_state_changed_match = None
127
182
def rename(self):
128
183
"""Derived from the Avahi example code"""
129
184
if self.rename_count >= self.max_renames:
130
logger.critical(u"No suitable Zeroconf service name found"
131
u" after %i retries, exiting.",
185
logger.critical("No suitable Zeroconf service name found"
186
" after %i retries, exiting.",
132
187
self.rename_count)
133
raise AvahiServiceError(u"Too many renames")
134
self.name = server.GetAlternativeServiceName(self.name)
135
logger.info(u"Changing Zeroconf service name to %r ...",
136
str(self.name))
137
syslogger.setFormatter(logging.Formatter
138
('Mandos (%s): %%(levelname)s:'
139
' %%(message)s' % self.name))
188
raise AvahiServiceError("Too many renames")
189
self.name = unicode(self.server
190
.GetAlternativeServiceName(self.name))
191
logger.info("Changing Zeroconf service name to %r ...",
192
self.name)
140
193
self.remove()
141
self.add()
194
try:
195
self.add()
196
except dbus.exceptions.DBusException as error:
197
logger.critical("DBusException: %s", error)
198
self.cleanup()
199
os._exit(1)
142
200
self.rename_count += 1
143
201
def remove(self):
144
202
"""Derived from the Avahi example code"""
145
if group is not None:
146
group.Reset()
203
if self.entry_group_state_changed_match is not None:
204
self.entry_group_state_changed_match.remove()
205
self.entry_group_state_changed_match = None
206
if self.group is not None:
207
self.group.Reset()
147
208
def add(self):
148
209
"""Derived from the Avahi example code"""
149
global group
150
if group is None:
151
group = dbus.Interface(bus.get_object
152
(avahi.DBUS_NAME,
153
server.EntryGroupNew()),
154
avahi.DBUS_INTERFACE_ENTRY_GROUP)
155
group.connect_to_signal('StateChanged',
156
entry_group_state_changed)
157
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
158
service.name, service.type)
159
group.AddService(
160
self.interface, # interface
161
avahi.PROTO_INET6, # protocol
162
dbus.UInt32(0), # flags
163
self.name, self.type,
164
self.domain, self.host,
165
dbus.UInt16(self.port),
166
avahi.string_array_to_txt_array(self.TXT))
167
group.Commit()
168
169
# From the Avahi example code:
170
group = None # our entry group
171
# End of Avahi example code
172
173
174
def _datetime_to_dbus(dt, variant_level=0):
175
"""Convert a UTC datetime.datetime() to a D-Bus type."""
176
return dbus.String(dt.isoformat(), variant_level=variant_level)
177
178
179
class Client(dbus.service.Object):
210
self.remove()
211
if self.group is None:
212
self.group = dbus.Interface(
213
self.bus.get_object(avahi.DBUS_NAME,
214
self.server.EntryGroupNew()),
215
avahi.DBUS_INTERFACE_ENTRY_GROUP)
216
self.entry_group_state_changed_match = (
217
self.group.connect_to_signal(
218
'StateChanged', self.entry_group_state_changed))
219
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
220
self.name, self.type)
221
self.group.AddService(
222
self.interface,
223
self.protocol,
224
dbus.UInt32(0), # flags
225
self.name, self.type,
226
self.domain, self.host,
227
dbus.UInt16(self.port),
228
avahi.string_array_to_txt_array(self.TXT))
229
self.group.Commit()
230
def entry_group_state_changed(self, state, error):
231
"""Derived from the Avahi example code"""
232
logger.debug("Avahi entry group state change: %i", state)
233
234
if state == avahi.ENTRY_GROUP_ESTABLISHED:
235
logger.debug("Zeroconf service established.")
236
elif state == avahi.ENTRY_GROUP_COLLISION:
237
logger.info("Zeroconf service name collision.")
238
self.rename()
239
elif state == avahi.ENTRY_GROUP_FAILURE:
240
logger.critical("Avahi: Error in group state changed %s",
241
unicode(error))
242
raise AvahiGroupError("State changed: %s"
243
% unicode(error))
244
def cleanup(self):
245
"""Derived from the Avahi example code"""
246
if self.group is not None:
247
try:
248
self.group.Free()
249
except (dbus.exceptions.UnknownMethodException,
250
dbus.exceptions.DBusException):
251
pass
252
self.group = None
253
self.remove()
254
def server_state_changed(self, state, error=None):
255
"""Derived from the Avahi example code"""
256
logger.debug("Avahi server state change: %i", state)
257
bad_states = { avahi.SERVER_INVALID:
258
"Zeroconf server invalid",
259
avahi.SERVER_REGISTERING: None,
260
avahi.SERVER_COLLISION:
261
"Zeroconf server name collision",
262
avahi.SERVER_FAILURE:
263
"Zeroconf server failure" }
264
if state in bad_states:
265
if bad_states[state] is not None:
266
if error is None:
267
logger.error(bad_states[state])
268
else:
269
logger.error(bad_states[state] + ": %r", error)
270
self.cleanup()
271
elif state == avahi.SERVER_RUNNING:
272
self.add()
273
else:
274
if error is None:
275
logger.debug("Unknown state: %r", state)
276
else:
277
logger.debug("Unknown state: %r: %r", state, error)
278
def activate(self):
279
"""Derived from the Avahi example code"""
280
if self.server is None:
281
self.server = dbus.Interface(
282
self.bus.get_object(avahi.DBUS_NAME,
283
avahi.DBUS_PATH_SERVER,
284
follow_name_owner_changes=True),
285
avahi.DBUS_INTERFACE_SERVER)
286
self.server.connect_to_signal("StateChanged",
287
self.server_state_changed)
288
self.server_state_changed(self.server.GetState())
289
290
class AvahiServiceToSyslog(AvahiService):
291
def rename(self):
292
"""Add the new name to the syslog messages"""
293
ret = AvahiService.rename(self)
294
syslogger.setFormatter(logging.Formatter
295
('Mandos (%s) [%%(process)d]:'
296
' %%(levelname)s: %%(message)s'
297
% self.name))
298
return ret
299
300
def _timedelta_to_milliseconds(td):
301
"Convert a datetime.timedelta() to milliseconds"
302
return ((td.days * 24 * 60 * 60 * 1000)
303
+ (td.seconds * 1000)
304
+ (td.microseconds // 1000))
305
306
class Client(object):
180
307
"""A representation of a client host served by this server.
308
181
309
Attributes:
182
name: string; from the config file, used in log messages and
183
D-Bus identifiers
310
_approved: bool(); 'None' if not yet approved/disapproved
311
approval_delay: datetime.timedelta(); Time to wait for approval
312
approval_duration: datetime.timedelta(); Duration of one approval
313
checker: subprocess.Popen(); a running checker process used
314
to see if the client lives.
315
'None' if no process is running.
316
checker_callback_tag: a gobject event source tag, or None
317
checker_command: string; External command which is run to check
318
if client lives. %() expansions are done at
319
runtime with vars(self) as dict, so that for
320
instance %(name)s can be used in the command.
321
checker_initiator_tag: a gobject event source tag, or None
322
created: datetime.datetime(); (UTC) object creation
323
client_structure: Object describing what attributes a client has
324
and is used for storing the client at exit
325
current_checker_command: string; current running checker_command
326
disable_initiator_tag: a gobject event source tag, or None
327
enabled: bool()
184
328
fingerprint: string (40 or 32 hexadecimal digits); used to
185
329
uniquely identify the client
186
secret: bytestring; sent verbatim (over TLS) to client
187
330
host: string; available for use by the checker command
188
created: datetime.datetime(); (UTC) object creation
331
interval: datetime.timedelta(); How often to start a new checker
332
last_approval_request: datetime.datetime(); (UTC) or None
333
last_checked_ok: datetime.datetime(); (UTC) or None
334
335
last_checker_status: integer between 0 and 255 reflecting exit
336
status of last checker. -1 reflects crashed
337
checker, or None.
189
338
last_enabled: datetime.datetime(); (UTC)
190
enabled: bool()
191
last_checked_ok: datetime.datetime(); (UTC) or None
339
name: string; from the config file, used in log messages and
340
D-Bus identifiers
341
secret: bytestring; sent verbatim (over TLS) to client
192
342
timeout: datetime.timedelta(); How long from last_checked_ok
193
until this client is invalid
194
interval: datetime.timedelta(); How often to start a new checker
195
disable_hook: If set, called by disable() as disable_hook(self)
196
checker: subprocess.Popen(); a running checker process used
197
to see if the client lives.
198
'None' if no process is running.
199
checker_initiator_tag: a gobject event source tag, or None
200
disable_initiator_tag: - '' -
201
checker_callback_tag: - '' -
202
checker_command: string; External command which is run to check if
203
client lives. %() expansions are done at
204
runtime with vars(self) as dict, so that for
205
instance %(name)s can be used in the command.
206
use_dbus: bool(); Whether to provide D-Bus interface and signals
207
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
343
until this client is disabled
344
extended_timeout: extra long timeout when password has been sent
345
runtime_expansions: Allowed attributes for runtime expansion.
346
expires: datetime.datetime(); time (UTC) when a client will be
347
disabled, or None
208
348
"""
349
350
runtime_expansions = ("approval_delay", "approval_duration",
351
"created", "enabled", "fingerprint",
352
"host", "interval", "last_checked_ok",
353
"last_enabled", "name", "timeout")
354
209
355
def timeout_milliseconds(self):
210
356
"Return the 'timeout' attribute in milliseconds"
211
return ((self.timeout.days * 24 * 60 * 60 * 1000)
212
+ (self.timeout.seconds * 1000)
213
+ (self.timeout.microseconds // 1000))
357
return _timedelta_to_milliseconds(self.timeout)
358
359
def extended_timeout_milliseconds(self):
360
"Return the 'extended_timeout' attribute in milliseconds"
361
return _timedelta_to_milliseconds(self.extended_timeout)
214
362
215
363
def interval_milliseconds(self):
216
364
"Return the 'interval' attribute in milliseconds"
217
return ((self.interval.days * 24 * 60 * 60 * 1000)
218
+ (self.interval.seconds * 1000)
219
+ (self.interval.microseconds // 1000))
220
221
def __init__(self, name = None, disable_hook=None, config=None,
222
use_dbus=True):
365
return _timedelta_to_milliseconds(self.interval)
366
367
def approval_delay_milliseconds(self):
368
return _timedelta_to_milliseconds(self.approval_delay)
369
370
def __init__(self, name = None, config=None):
223
371
"""Note: the 'checker' key in 'config' sets the
224
372
'checker_command' attribute and *not* the 'checker'
225
373
attribute."""
226
374
self.name = name
227
375
if config is None:
228
376
config = {}
229
logger.debug(u"Creating client %r", self.name)
230
self.use_dbus = False # During __init__
377
logger.debug("Creating client %r", self.name)
231
378
# Uppercase and remove spaces from fingerprint for later
232
379
# comparison purposes with return value from the fingerprint()
233
380
# function
234
381
self.fingerprint = (config["fingerprint"].upper()
235
.replace(u" ", u""))
236
logger.debug(u" Fingerprint: %s", self.fingerprint)
382
.replace(" ", ""))
383
logger.debug(" Fingerprint: %s", self.fingerprint)
237
384
if "secret" in config:
238
self.secret = config["secret"].decode(u"base64")
385
self.secret = config["secret"].decode("base64")
239
386
elif "secfile" in config:
240
with closing(open(os.path.expanduser
241
(os.path.expandvars
242
(config["secfile"])))) as secfile:
387
with open(os.path.expanduser(os.path.expandvars
388
(config["secfile"])),
389
"rb") as secfile:
243
390
self.secret = secfile.read()
244
391
else:
245
raise TypeError(u"No secret or secfile for client %s"
392
raise TypeError("No secret or secfile for client %s"
246
393
% self.name)
247
394
self.host = config.get("host", "")
248
395
self.created = datetime.datetime.utcnow()
249
self.enabled = False
250
self.last_enabled = None
396
self.enabled = True
397
self.last_approval_request = None
398
self.last_enabled = datetime.datetime.utcnow()
251
399
self.last_checked_ok = None
400
self.last_checker_status = None
252
401
self.timeout = string_to_delta(config["timeout"])
402
self.extended_timeout = string_to_delta(config
403
["extended_timeout"])
253
404
self.interval = string_to_delta(config["interval"])
254
self.disable_hook = disable_hook
255
405
self.checker = None
256
406
self.checker_initiator_tag = None
257
407
self.disable_initiator_tag = None
408
self.expires = datetime.datetime.utcnow() + self.timeout
258
409
self.checker_callback_tag = None
259
410
self.checker_command = config["checker"]
260
self.last_connect = None
261
# Only now, when this client is initialized, can it show up on
262
# the D-Bus
263
self.use_dbus = use_dbus
264
if self.use_dbus:
265
self.dbus_object_path = (dbus.ObjectPath
266
("/clients/"
267
+ self.name.replace(".", "_")))
268
dbus.service.Object.__init__(self, bus,
269
self.dbus_object_path)
411
self.current_checker_command = None
412
self._approved = None
413
self.approved_by_default = config.get("approved_by_default",
414
True)
415
self.approvals_pending = 0
416
self.approval_delay = string_to_delta(
417
config["approval_delay"])
418
self.approval_duration = string_to_delta(
419
config["approval_duration"])
420
self.changedstate = (multiprocessing_manager
421
.Condition(multiprocessing_manager
422
.Lock()))
423
self.client_structure = [attr for attr in
424
self.__dict__.iterkeys()
425
if not attr.startswith("_")]
426
self.client_structure.append("client_structure")
427
428
for name, t in inspect.getmembers(type(self),
429
lambda obj:
430
isinstance(obj,
431
property)):
432
if not name.startswith("_"):
433
self.client_structure.append(name)
434
435
# Send notice to process children that client state has changed
436
def send_changedstate(self):
437
with self.changedstate:
438
self.changedstate.notify_all()
270
439
271
440
def enable(self):
272
441
"""Start this client's checker and timeout hooks"""
442
if getattr(self, "enabled", False):
443
# Already enabled
444
return
445
self.send_changedstate()
446
self.expires = datetime.datetime.utcnow() + self.timeout
447
self.enabled = True
273
448
self.last_enabled = datetime.datetime.utcnow()
274
# Schedule a new checker to be started an 'interval' from now,
275
# and every interval from then on.
276
self.checker_initiator_tag = (gobject.timeout_add
277
(self.interval_milliseconds(),
278
self.start_checker))
279
# Also start a new checker *right now*.
280
self.start_checker()
281
# Schedule a disable() when 'timeout' has passed
282
self.disable_initiator_tag = (gobject.timeout_add
283
(self.timeout_milliseconds(),
284
self.disable))
285
self.enabled = True
286
if self.use_dbus:
287
# Emit D-Bus signals
288
self.PropertyChanged(dbus.String(u"enabled"),
289
dbus.Boolean(True, variant_level=1))
290
self.PropertyChanged(dbus.String(u"last_enabled"),
291
(_datetime_to_dbus(self.last_enabled,
292
variant_level=1)))
449
self.init_checker()
293
450
294
def disable(self):
451
def disable(self, quiet=True):
295
452
"""Disable this client."""
296
453
if not getattr(self, "enabled", False):
297
454
return False
298
logger.info(u"Disabling client %s", self.name)
455
if not quiet:
456
self.send_changedstate()
457
if not quiet:
458
logger.info("Disabling client %s", self.name)
299
459
if getattr(self, "disable_initiator_tag", False):
300
460
gobject.source_remove(self.disable_initiator_tag)
301
461
self.disable_initiator_tag = None
462
self.expires = None
302
463
if getattr(self, "checker_initiator_tag", False):
303
464
gobject.source_remove(self.checker_initiator_tag)
304
465
self.checker_initiator_tag = None
305
466
self.stop_checker()
306
if self.disable_hook:
307
self.disable_hook(self)
308
467
self.enabled = False
309
if self.use_dbus:
310
# Emit D-Bus signal
311
self.PropertyChanged(dbus.String(u"enabled"),
312
dbus.Boolean(False, variant_level=1))
313
468
# Do not run this again if called by a gobject.timeout_add
314
469
return False
315
470
316
471
def __del__(self):
317
self.disable_hook = None
318
472
self.disable()
319
473
474
def init_checker(self):
475
# Schedule a new checker to be started an 'interval' from now,
476
# and every interval from then on.
477
self.checker_initiator_tag = (gobject.timeout_add
478
(self.interval_milliseconds(),
479
self.start_checker))
480
# Schedule a disable() when 'timeout' has passed
481
self.disable_initiator_tag = (gobject.timeout_add
482
(self.timeout_milliseconds(),
483
self.disable))
484
# Also start a new checker *right now*.
485
self.start_checker()
486
320
487
def checker_callback(self, pid, condition, command):
321
488
"""The checker has completed, so take appropriate actions."""
322
489
self.checker_callback_tag = None
323
490
self.checker = None
324
if self.use_dbus:
325
# Emit D-Bus signal
326
self.PropertyChanged(dbus.String(u"checker_running"),
327
dbus.Boolean(False, variant_level=1))
328
491
if os.WIFEXITED(condition):
329
exitstatus = os.WEXITSTATUS(condition)
330
if exitstatus == 0:
331
logger.info(u"Checker for %(name)s succeeded",
492
self.last_checker_status = os.WEXITSTATUS(condition)
493
if self.last_checker_status == 0:
494
logger.info("Checker for %(name)s succeeded",
332
495
vars(self))
333
496
self.checked_ok()
334
497
else:
335
logger.info(u"Checker for %(name)s failed",
498
logger.info("Checker for %(name)s failed",
336
499
vars(self))
337
if self.use_dbus:
338
# Emit D-Bus signal
339
self.CheckerCompleted(dbus.Int16(exitstatus),
340
dbus.Int64(condition),
341
dbus.String(command))
342
500
else:
343
logger.warning(u"Checker for %(name)s crashed?",
501
self.last_checker_status = -1
502
logger.warning("Checker for %(name)s crashed?",
344
503
vars(self))
345
if self.use_dbus:
346
# Emit D-Bus signal
347
self.CheckerCompleted(dbus.Int16(-1),
348
dbus.Int64(condition),
349
dbus.String(command))
350
504
351
def checked_ok(self):
505
def checked_ok(self, timeout=None):
352
506
"""Bump up the timeout for this client.
507
353
508
This should only be called when the client has been seen,
354
509
alive and well.
355
510
"""
511
if timeout is None:
512
timeout = self.timeout
356
513
self.last_checked_ok = datetime.datetime.utcnow()
357
gobject.source_remove(self.disable_initiator_tag)
358
self.disable_initiator_tag = (gobject.timeout_add
359
(self.timeout_milliseconds(),
360
self.disable))
361
if self.use_dbus:
362
# Emit D-Bus signal
363
self.PropertyChanged(
364
dbus.String(u"last_checked_ok"),
365
(_datetime_to_dbus(self.last_checked_ok,
366
variant_level=1)))
514
if self.disable_initiator_tag is not None:
515
gobject.source_remove(self.disable_initiator_tag)
516
if getattr(self, "enabled", False):
517
self.disable_initiator_tag = (gobject.timeout_add
518
(_timedelta_to_milliseconds
519
(timeout), self.disable))
520
self.expires = datetime.datetime.utcnow() + timeout
521
522
def need_approval(self):
523
self.last_approval_request = datetime.datetime.utcnow()
367
524
368
525
def start_checker(self):
369
526
"""Start a new checker subprocess if one is not running.
527
370
528
If a checker already exists, leave it running and do
371
529
nothing."""
372
530
# The reason for not killing a running checker is that if we
375
533
# client would inevitably timeout, since no checker would get
376
534
# a chance to run to completion. If we instead leave running
377
535
# checkers alone, the checker would have to take more time
378
# than 'timeout' for the client to be declared invalid, which
379
# is as it should be.
536
# than 'timeout' for the client to be disabled, which is as it
537
# should be.
538
539
# If a checker exists, make sure it is not a zombie
540
try:
541
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
542
except (AttributeError, OSError) as error:
543
if (isinstance(error, OSError)
544
and error.errno != errno.ECHILD):
545
raise error
546
else:
547
if pid:
548
logger.warning("Checker was a zombie")
549
gobject.source_remove(self.checker_callback_tag)
550
self.checker_callback(pid, status,
551
self.current_checker_command)
552
# Start a new checker if needed
380
553
if self.checker is None:
381
554
try:
382
555
# In case checker_command has exactly one % operator
383
556
command = self.checker_command % self.host
384
557
except TypeError:
385
558
# Escape attributes for the shell
386
escaped_attrs = dict((key, re.escape(str(val)))
387
for key, val in
388
vars(self).iteritems())
559
escaped_attrs = dict(
560
(attr,
561
re.escape(unicode(str(getattr(self, attr, "")),
562
errors=
563
'replace')))
564
for attr in
565
self.runtime_expansions)
566
389
567
try:
390
568
command = self.checker_command % escaped_attrs
391
except TypeError, error:
392
logger.error(u'Could not format string "%s":'
393
u' %s', self.checker_command, error)
569
except TypeError as error:
570
logger.error('Could not format string "%s":'
571
' %s', self.checker_command, error)
394
572
return True # Try again later
573
self.current_checker_command = command
395
574
try:
396
logger.info(u"Starting checker %r for %s",
575
logger.info("Starting checker %r for %s",
397
576
command, self.name)
398
577
# We don't need to redirect stdout and stderr, since
399
578
# in normal mode, that is already done by daemon(),
402
581
self.checker = subprocess.Popen(command,
403
582
close_fds=True,
404
583
shell=True, cwd="/")
405
if self.use_dbus:
406
# Emit D-Bus signal
407
self.CheckerStarted(command)
408
self.PropertyChanged(
409
dbus.String("checker_running"),
410
dbus.Boolean(True, variant_level=1))
411
584
self.checker_callback_tag = (gobject.child_watch_add
412
585
(self.checker.pid,
413
586
self.checker_callback,
418
591
if pid:
419
592
gobject.source_remove(self.checker_callback_tag)
420
593
self.checker_callback(pid, status, command)
421
except OSError, error:
422
logger.error(u"Failed to start subprocess: %s",
594
except OSError as error:
595
logger.error("Failed to start subprocess: %s",
423
596
error)
424
597
# Re-run this periodically if run by gobject.timeout_add
425
598
return True
431
604
self.checker_callback_tag = None
432
605
if getattr(self, "checker", None) is None:
433
606
return
434
logger.debug(u"Stopping checker for %(name)s", vars(self))
607
logger.debug("Stopping checker for %(name)s", vars(self))
435
608
try:
436
609
os.kill(self.checker.pid, signal.SIGTERM)
437
#os.sleep(0.5)
610
#time.sleep(0.5)
438
611
#if self.checker.poll() is None:
439
612
# os.kill(self.checker.pid, signal.SIGKILL)
440
except OSError, error:
613
except OSError as error:
441
614
if error.errno != errno.ESRCH: # No such process
442
615
raise
443
616
self.checker = None
444
if self.use_dbus:
445
self.PropertyChanged(dbus.String(u"checker_running"),
446
dbus.Boolean(False, variant_level=1))
447
448
def still_valid(self):
449
"""Has the timeout not yet passed for this client?"""
450
if not getattr(self, "enabled", False):
451
return False
452
now = datetime.datetime.utcnow()
453
if self.last_checked_ok is None:
454
return now < (self.created + self.timeout)
455
else:
456
return now < (self.last_checked_ok + self.timeout)
457
458
## D-Bus methods & signals
459
_interface = u"se.bsnet.fukt.Mandos.Client"
460
461
# CheckedOK - method
462
CheckedOK = dbus.service.method(_interface)(checked_ok)
463
CheckedOK.__name__ = "CheckedOK"
617
618
# Encrypts a client secret and stores it in a varible
619
# encrypted_secret
620
def encrypt_secret(self, key):
621
# Encryption-key need to be of a specific size, so we hash
622
# inputed key
623
hasheng = hashlib.sha256()
624
hasheng.update(key)
625
encryptionkey = hasheng.digest()
626
627
# Create validation hash so we know at decryption if it was
628
# sucessful
629
hasheng = hashlib.sha256()
630
hasheng.update(self.secret)
631
validationhash = hasheng.digest()
632
633
# Encrypt secret
634
iv = os.urandom(Crypto.Cipher.AES.block_size)
635
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
636
Crypto.Cipher.AES.MODE_CFB,
637
iv)
638
ciphertext = ciphereng.encrypt(validationhash+self.secret)
639
self.encrypted_secret = (ciphertext, iv)
640
641
# Decrypt a encrypted client secret
642
def decrypt_secret(self, key):
643
# Decryption-key need to be of a specific size, so we hash inputed key
644
hasheng = hashlib.sha256()
645
hasheng.update(key)
646
encryptionkey = hasheng.digest()
647
648
# Decrypt encrypted secret
649
ciphertext, iv = self.encrypted_secret
650
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
651
Crypto.Cipher.AES.MODE_CFB,
652
iv)
653
plain = ciphereng.decrypt(ciphertext)
654
655
# Validate decrypted secret to know if it was succesful
656
hasheng = hashlib.sha256()
657
validationhash = plain[:hasheng.digest_size]
658
secret = plain[hasheng.digest_size:]
659
hasheng.update(secret)
660
661
# if validation fails, we use key as new secret. Otherwhise,
662
# we use the decrypted secret
663
if hasheng.digest() == validationhash:
664
self.secret = secret
665
else:
666
self.secret = key
667
del self.encrypted_secret
668
669
670
def dbus_service_property(dbus_interface, signature="v",
671
access="readwrite", byte_arrays=False):
672
"""Decorators for marking methods of a DBusObjectWithProperties to
673
become properties on the D-Bus.
674
675
The decorated method will be called with no arguments by "Get"
676
and with one argument by "Set".
677
678
The parameters, where they are supported, are the same as
679
dbus.service.method, except there is only "signature", since the
680
type from Get() and the type sent to Set() is the same.
681
"""
682
# Encoding deeply encoded byte arrays is not supported yet by the
683
# "Set" method, so we fail early here:
684
if byte_arrays and signature != "ay":
685
raise ValueError("Byte arrays not supported for non-'ay'"
686
" signature %r" % signature)
687
def decorator(func):
688
func._dbus_is_property = True
689
func._dbus_interface = dbus_interface
690
func._dbus_signature = signature
691
func._dbus_access = access
692
func._dbus_name = func.__name__
693
if func._dbus_name.endswith("_dbus_property"):
694
func._dbus_name = func._dbus_name[:-14]
695
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
696
return func
697
return decorator
698
699
700
class DBusPropertyException(dbus.exceptions.DBusException):
701
"""A base class for D-Bus property-related exceptions
702
"""
703
def __unicode__(self):
704
return unicode(str(self))
705
706
707
class DBusPropertyAccessException(DBusPropertyException):
708
"""A property's access permissions disallows an operation.
709
"""
710
pass
711
712
713
class DBusPropertyNotFound(DBusPropertyException):
714
"""An attempt was made to access a non-existing property.
715
"""
716
pass
717
718
719
class DBusObjectWithProperties(dbus.service.Object):
720
"""A D-Bus object with properties.
721
722
Classes inheriting from this can use the dbus_service_property
723
decorator to expose methods as D-Bus properties. It exposes the
724
standard Get(), Set(), and GetAll() methods on the D-Bus.
725
"""
726
727
@staticmethod
728
def _is_dbus_property(obj):
729
return getattr(obj, "_dbus_is_property", False)
730
731
def _get_all_dbus_properties(self):
732
"""Returns a generator of (name, attribute) pairs
733
"""
734
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
735
for cls in self.__class__.__mro__
736
for name, prop in
737
inspect.getmembers(cls, self._is_dbus_property))
738
739
def _get_dbus_property(self, interface_name, property_name):
740
"""Returns a bound method if one exists which is a D-Bus
741
property with the specified name and interface.
742
"""
743
for cls in self.__class__.__mro__:
744
for name, value in (inspect.getmembers
745
(cls, self._is_dbus_property)):
746
if (value._dbus_name == property_name
747
and value._dbus_interface == interface_name):
748
return value.__get__(self)
749
750
# No such property
751
raise DBusPropertyNotFound(self.dbus_object_path + ":"
752
+ interface_name + "."
753
+ property_name)
754
755
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
756
out_signature="v")
757
def Get(self, interface_name, property_name):
758
"""Standard D-Bus property Get() method, see D-Bus standard.
759
"""
760
prop = self._get_dbus_property(interface_name, property_name)
761
if prop._dbus_access == "write":
762
raise DBusPropertyAccessException(property_name)
763
value = prop()
764
if not hasattr(value, "variant_level"):
765
return value
766
return type(value)(value, variant_level=value.variant_level+1)
767
768
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
769
def Set(self, interface_name, property_name, value):
770
"""Standard D-Bus property Set() method, see D-Bus standard.
771
"""
772
prop = self._get_dbus_property(interface_name, property_name)
773
if prop._dbus_access == "read":
774
raise DBusPropertyAccessException(property_name)
775
if prop._dbus_get_args_options["byte_arrays"]:
776
# The byte_arrays option is not supported yet on
777
# signatures other than "ay".
778
if prop._dbus_signature != "ay":
779
raise ValueError
780
value = dbus.ByteArray(''.join(unichr(byte)
781
for byte in value))
782
prop(value)
783
784
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
785
out_signature="a{sv}")
786
def GetAll(self, interface_name):
787
"""Standard D-Bus property GetAll() method, see D-Bus
788
standard.
789
790
Note: Will not include properties with access="write".
791
"""
792
properties = {}
793
for name, prop in self._get_all_dbus_properties():
794
if (interface_name
795
and interface_name != prop._dbus_interface):
796
# Interface non-empty but did not match
797
continue
798
# Ignore write-only properties
799
if prop._dbus_access == "write":
800
continue
801
value = prop()
802
if not hasattr(value, "variant_level"):
803
properties[name] = value
804
continue
805
properties[name] = type(value)(value, variant_level=
806
value.variant_level+1)
807
return dbus.Dictionary(properties, signature="sv")
808
809
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
810
out_signature="s",
811
path_keyword='object_path',
812
connection_keyword='connection')
813
def Introspect(self, object_path, connection):
814
"""Standard D-Bus method, overloaded to insert property tags.
815
"""
816
xmlstring = dbus.service.Object.Introspect(self, object_path,
817
connection)
818
try:
819
document = xml.dom.minidom.parseString(xmlstring)
820
def make_tag(document, name, prop):
821
e = document.createElement("property")
822
e.setAttribute("name", name)
823
e.setAttribute("type", prop._dbus_signature)
824
e.setAttribute("access", prop._dbus_access)
825
return e
826
for if_tag in document.getElementsByTagName("interface"):
827
for tag in (make_tag(document, name, prop)
828
for name, prop
829
in self._get_all_dbus_properties()
830
if prop._dbus_interface
831
== if_tag.getAttribute("name")):
832
if_tag.appendChild(tag)
833
# Add the names to the return values for the
834
# "org.freedesktop.DBus.Properties" methods
835
if (if_tag.getAttribute("name")
836
== "org.freedesktop.DBus.Properties"):
837
for cn in if_tag.getElementsByTagName("method"):
838
if cn.getAttribute("name") == "Get":
839
for arg in cn.getElementsByTagName("arg"):
840
if (arg.getAttribute("direction")
841
== "out"):
842
arg.setAttribute("name", "value")
843
elif cn.getAttribute("name") == "GetAll":
844
for arg in cn.getElementsByTagName("arg"):
845
if (arg.getAttribute("direction")
846
== "out"):
847
arg.setAttribute("name", "props")
848
xmlstring = document.toxml("utf-8")
849
document.unlink()
850
except (AttributeError, xml.dom.DOMException,
851
xml.parsers.expat.ExpatError) as error:
852
logger.error("Failed to override Introspection method",
853
error)
854
return xmlstring
855
856
857
def datetime_to_dbus (dt, variant_level=0):
858
"""Convert a UTC datetime.datetime() to a D-Bus type."""
859
if dt is None:
860
return dbus.String("", variant_level = variant_level)
861
return dbus.String(dt.isoformat(),
862
variant_level=variant_level)
863
864
865
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
866
.__metaclass__):
867
"""Applied to an empty subclass of a D-Bus object, this metaclass
868
will add additional D-Bus attributes matching a certain pattern.
869
"""
870
def __new__(mcs, name, bases, attr):
871
# Go through all the base classes which could have D-Bus
872
# methods, signals, or properties in them
873
for base in (b for b in bases
874
if issubclass(b, dbus.service.Object)):
875
# Go though all attributes of the base class
876
for attrname, attribute in inspect.getmembers(base):
877
# Ignore non-D-Bus attributes, and D-Bus attributes
878
# with the wrong interface name
879
if (not hasattr(attribute, "_dbus_interface")
880
or not attribute._dbus_interface
881
.startswith("se.recompile.Mandos")):
882
continue
883
# Create an alternate D-Bus interface name based on
884
# the current name
885
alt_interface = (attribute._dbus_interface
886
.replace("se.recompile.Mandos",
887
"se.bsnet.fukt.Mandos"))
888
# Is this a D-Bus signal?
889
if getattr(attribute, "_dbus_is_signal", False):
890
# Extract the original non-method function by
891
# black magic
892
nonmethod_func = (dict(
893
zip(attribute.func_code.co_freevars,
894
attribute.__closure__))["func"]
895
.cell_contents)
896
# Create a new, but exactly alike, function
897
# object, and decorate it to be a new D-Bus signal
898
# with the alternate D-Bus interface name
899
new_function = (dbus.service.signal
900
(alt_interface,
901
attribute._dbus_signature)
902
(types.FunctionType(
903
nonmethod_func.func_code,
904
nonmethod_func.func_globals,
905
nonmethod_func.func_name,
906
nonmethod_func.func_defaults,
907
nonmethod_func.func_closure)))
908
# Define a creator of a function to call both the
909
# old and new functions, so both the old and new
910
# signals gets sent when the function is called
911
def fixscope(func1, func2):
912
"""This function is a scope container to pass
913
func1 and func2 to the "call_both" function
914
outside of its arguments"""
915
def call_both(*args, **kwargs):
916
"""This function will emit two D-Bus
917
signals by calling func1 and func2"""
918
func1(*args, **kwargs)
919
func2(*args, **kwargs)
920
return call_both
921
# Create the "call_both" function and add it to
922
# the class
923
attr[attrname] = fixscope(attribute,
924
new_function)
925
# Is this a D-Bus method?
926
elif getattr(attribute, "_dbus_is_method", False):
927
# Create a new, but exactly alike, function
928
# object. Decorate it to be a new D-Bus method
929
# with the alternate D-Bus interface name. Add it
930
# to the class.
931
attr[attrname] = (dbus.service.method
932
(alt_interface,
933
attribute._dbus_in_signature,
934
attribute._dbus_out_signature)
935
(types.FunctionType
936
(attribute.func_code,
937
attribute.func_globals,
938
attribute.func_name,
939
attribute.func_defaults,
940
attribute.func_closure)))
941
# Is this a D-Bus property?
942
elif getattr(attribute, "_dbus_is_property", False):
943
# Create a new, but exactly alike, function
944
# object, and decorate it to be a new D-Bus
945
# property with the alternate D-Bus interface
946
# name. Add it to the class.
947
attr[attrname] = (dbus_service_property
948
(alt_interface,
949
attribute._dbus_signature,
950
attribute._dbus_access,
951
attribute
952
._dbus_get_args_options
953
["byte_arrays"])
954
(types.FunctionType
955
(attribute.func_code,
956
attribute.func_globals,
957
attribute.func_name,
958
attribute.func_defaults,
959
attribute.func_closure)))
960
return type.__new__(mcs, name, bases, attr)
961
962
963
class ClientDBus(Client, DBusObjectWithProperties):
964
"""A Client class using D-Bus
965
966
Attributes:
967
dbus_object_path: dbus.ObjectPath
968
bus: dbus.SystemBus()
969
"""
970
971
runtime_expansions = (Client.runtime_expansions
972
+ ("dbus_object_path",))
973
974
# dbus.service.Object doesn't use super(), so we can't either.
975
976
def __init__(self, bus = None, *args, **kwargs):
977
self.bus = bus
978
Client.__init__(self, *args, **kwargs)
979
980
self._approvals_pending = 0
981
# Only now, when this client is initialized, can it show up on
982
# the D-Bus
983
client_object_name = unicode(self.name).translate(
984
{ord("."): ord("_"),
985
ord("-"): ord("_")})
986
self.dbus_object_path = (dbus.ObjectPath
987
("/clients/" + client_object_name))
988
DBusObjectWithProperties.__init__(self, self.bus,
989
self.dbus_object_path)
990
991
def notifychangeproperty(transform_func,
992
dbus_name, type_func=lambda x: x,
993
variant_level=1):
994
""" Modify a variable so that it's a property which announces
995
its changes to DBus.
996
997
transform_fun: Function that takes a value and a variant_level
998
and transforms it to a D-Bus type.
999
dbus_name: D-Bus name of the variable
1000
type_func: Function that transform the value before sending it
1001
to the D-Bus. Default: no transform
1002
variant_level: D-Bus variant level. Default: 1
1003
"""
1004
attrname = "_{0}".format(dbus_name)
1005
def setter(self, value):
1006
if hasattr(self, "dbus_object_path"):
1007
if (not hasattr(self, attrname) or
1008
type_func(getattr(self, attrname, None))
1009
!= type_func(value)):
1010
dbus_value = transform_func(type_func(value),
1011
variant_level
1012
=variant_level)
1013
self.PropertyChanged(dbus.String(dbus_name),
1014
dbus_value)
1015
setattr(self, attrname, value)
1016
1017
return property(lambda self: getattr(self, attrname), setter)
1018
1019
1020
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1021
approvals_pending = notifychangeproperty(dbus.Boolean,
1022
"ApprovalPending",
1023
type_func = bool)
1024
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1025
last_enabled = notifychangeproperty(datetime_to_dbus,
1026
"LastEnabled")
1027
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1028
type_func = lambda checker:
1029
checker is not None)
1030
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1031
"LastCheckedOK")
1032
last_approval_request = notifychangeproperty(
1033
datetime_to_dbus, "LastApprovalRequest")
1034
approved_by_default = notifychangeproperty(dbus.Boolean,
1035
"ApprovedByDefault")
1036
approval_delay = notifychangeproperty(dbus.UInt16,
1037
"ApprovalDelay",
1038
type_func =
1039
_timedelta_to_milliseconds)
1040
approval_duration = notifychangeproperty(
1041
dbus.UInt16, "ApprovalDuration",
1042
type_func = _timedelta_to_milliseconds)
1043
host = notifychangeproperty(dbus.String, "Host")
1044
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1045
type_func =
1046
_timedelta_to_milliseconds)
1047
extended_timeout = notifychangeproperty(
1048
dbus.UInt16, "ExtendedTimeout",
1049
type_func = _timedelta_to_milliseconds)
1050
interval = notifychangeproperty(dbus.UInt16,
1051
"Interval",
1052
type_func =
1053
_timedelta_to_milliseconds)
1054
checker_command = notifychangeproperty(dbus.String, "Checker")
1055
1056
del notifychangeproperty
1057
1058
def __del__(self, *args, **kwargs):
1059
try:
1060
self.remove_from_connection()
1061
except LookupError:
1062
pass
1063
if hasattr(DBusObjectWithProperties, "__del__"):
1064
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1065
Client.__del__(self, *args, **kwargs)
1066
1067
def checker_callback(self, pid, condition, command,
1068
*args, **kwargs):
1069
self.checker_callback_tag = None
1070
self.checker = None
1071
if os.WIFEXITED(condition):
1072
exitstatus = os.WEXITSTATUS(condition)
1073
# Emit D-Bus signal
1074
self.CheckerCompleted(dbus.Int16(exitstatus),
1075
dbus.Int64(condition),
1076
dbus.String(command))
1077
else:
1078
# Emit D-Bus signal
1079
self.CheckerCompleted(dbus.Int16(-1),
1080
dbus.Int64(condition),
1081
dbus.String(command))
1082
1083
return Client.checker_callback(self, pid, condition, command,
1084
*args, **kwargs)
1085
1086
def start_checker(self, *args, **kwargs):
1087
old_checker = self.checker
1088
if self.checker is not None:
1089
old_checker_pid = self.checker.pid
1090
else:
1091
old_checker_pid = None
1092
r = Client.start_checker(self, *args, **kwargs)
1093
# Only if new checker process was started
1094
if (self.checker is not None
1095
and old_checker_pid != self.checker.pid):
1096
# Emit D-Bus signal
1097
self.CheckerStarted(self.current_checker_command)
1098
return r
1099
1100
def _reset_approved(self):
1101
self._approved = None
1102
return False
1103
1104
def approve(self, value=True):
1105
self.send_changedstate()
1106
self._approved = value
1107
gobject.timeout_add(_timedelta_to_milliseconds
1108
(self.approval_duration),
1109
self._reset_approved)
1110
1111
1112
## D-Bus methods, signals & properties
1113
_interface = "se.recompile.Mandos.Client"
1114
1115
## Signals
464
1116
465
1117
# CheckerCompleted - signal
466
1118
@dbus.service.signal(_interface, signature="nxs")
474
1126
"D-Bus signal"
475
1127
pass
476
1128
477
# GetAllProperties - method
478
@dbus.service.method(_interface, out_signature="a{sv}")
479
def GetAllProperties(self):
480
"D-Bus method"
481
return dbus.Dictionary({
482
dbus.String("name"):
483
dbus.String(self.name, variant_level=1),
484
dbus.String("fingerprint"):
485
dbus.String(self.fingerprint, variant_level=1),
486
dbus.String("host"):
487
dbus.String(self.host, variant_level=1),
488
dbus.String("created"):
489
_datetime_to_dbus(self.created, variant_level=1),
490
dbus.String("last_enabled"):
491
(_datetime_to_dbus(self.last_enabled,
492
variant_level=1)
493
if self.last_enabled is not None
494
else dbus.Boolean(False, variant_level=1)),
495
dbus.String("enabled"):
496
dbus.Boolean(self.enabled, variant_level=1),
497
dbus.String("last_checked_ok"):
498
(_datetime_to_dbus(self.last_checked_ok,
499
variant_level=1)
500
if self.last_checked_ok is not None
501
else dbus.Boolean (False, variant_level=1)),
502
dbus.String("timeout"):
503
dbus.UInt64(self.timeout_milliseconds(),
504
variant_level=1),
505
dbus.String("interval"):
506
dbus.UInt64(self.interval_milliseconds(),
507
variant_level=1),
508
dbus.String("checker"):
509
dbus.String(self.checker_command,
510
variant_level=1),
511
dbus.String("checker_running"):
512
dbus.Boolean(self.checker is not None,
513
variant_level=1),
514
dbus.String("object_path"):
515
dbus.ObjectPath(self.dbus_object_path,
516
variant_level=1)
517
}, signature="sv")
518
519
# IsStillValid - method
520
IsStillValid = (dbus.service.method(_interface, out_signature="b")
521
(still_valid))
522
IsStillValid.__name__ = "IsStillValid"
523
524
1129
# PropertyChanged - signal
525
1130
@dbus.service.signal(_interface, signature="sv")
526
1131
def PropertyChanged(self, property, value):
527
1132
"D-Bus signal"
528
1133
pass
529
1134
530
# SetChecker - method
531
@dbus.service.method(_interface, in_signature="s")
532
def SetChecker(self, checker):
533
"D-Bus setter method"
534
self.checker_command = checker
535
# Emit D-Bus signal
536
self.PropertyChanged(dbus.String(u"checker"),
537
dbus.String(self.checker_command,
538
variant_level=1))
539
540
# SetHost - method
541
@dbus.service.method(_interface, in_signature="s")
542
def SetHost(self, host):
543
"D-Bus setter method"
544
self.host = host
545
# Emit D-Bus signal
546
self.PropertyChanged(dbus.String(u"host"),
547
dbus.String(self.host, variant_level=1))
548
549
# SetInterval - method
550
@dbus.service.method(_interface, in_signature="t")
551
def SetInterval(self, milliseconds):
552
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
553
# Emit D-Bus signal
554
self.PropertyChanged(dbus.String(u"interval"),
555
(dbus.UInt64(self.interval_milliseconds(),
556
variant_level=1)))
557
558
# SetSecret - method
559
@dbus.service.method(_interface, in_signature="ay",
560
byte_arrays=True)
561
def SetSecret(self, secret):
562
"D-Bus setter method"
563
self.secret = str(secret)
564
565
# SetTimeout - method
566
@dbus.service.method(_interface, in_signature="t")
567
def SetTimeout(self, milliseconds):
568
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
569
# Emit D-Bus signal
570
self.PropertyChanged(dbus.String(u"timeout"),
571
(dbus.UInt64(self.timeout_milliseconds(),
572
variant_level=1)))
1135
# GotSecret - signal
1136
@dbus.service.signal(_interface)
1137
def GotSecret(self):
1138
"""D-Bus signal
1139
Is sent after a successful transfer of secret from the Mandos
1140
server to mandos-client
1141
"""
1142
pass
1143
1144
# Rejected - signal
1145
@dbus.service.signal(_interface, signature="s")
1146
def Rejected(self, reason):
1147
"D-Bus signal"
1148
pass
1149
1150
# NeedApproval - signal
1151
@dbus.service.signal(_interface, signature="tb")
1152
def NeedApproval(self, timeout, default):
1153
"D-Bus signal"
1154
return self.need_approval()
1155
1156
# NeRwequest - signal
1157
@dbus.service.signal(_interface, signature="s")
1158
def NewRequest(self, ip):
1159
"""D-Bus signal
1160
Is sent after a client request a password.
1161
"""
1162
pass
1163
1164
## Methods
1165
1166
# Approve - method
1167
@dbus.service.method(_interface, in_signature="b")
1168
def Approve(self, value):
1169
self.approve(value)
1170
1171
# CheckedOK - method
1172
@dbus.service.method(_interface)
1173
def CheckedOK(self):
1174
self.checked_ok()
573
1175
574
1176
# Enable - method
575
Enable = dbus.service.method(_interface)(enable)
576
Enable.__name__ = "Enable"
1177
@dbus.service.method(_interface)
1178
def Enable(self):
1179
"D-Bus method"
1180
self.enable()
577
1181
578
1182
# StartChecker - method
579
1183
@dbus.service.method(_interface)
588
1192
self.disable()
589
1193
590
1194
# StopChecker - method
591
StopChecker = dbus.service.method(_interface)(stop_checker)
592
StopChecker.__name__ = "StopChecker"
1195
@dbus.service.method(_interface)
1196
def StopChecker(self):
1197
self.stop_checker()
1198
1199
## Properties
1200
1201
# ApprovalPending - property
1202
@dbus_service_property(_interface, signature="b", access="read")
1203
def ApprovalPending_dbus_property(self):
1204
return dbus.Boolean(bool(self.approvals_pending))
1205
1206
# ApprovedByDefault - property
1207
@dbus_service_property(_interface, signature="b",
1208
access="readwrite")
1209
def ApprovedByDefault_dbus_property(self, value=None):
1210
if value is None: # get
1211
return dbus.Boolean(self.approved_by_default)
1212
self.approved_by_default = bool(value)
1213
1214
# ApprovalDelay - property
1215
@dbus_service_property(_interface, signature="t",
1216
access="readwrite")
1217
def ApprovalDelay_dbus_property(self, value=None):
1218
if value is None: # get
1219
return dbus.UInt64(self.approval_delay_milliseconds())
1220
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1221
1222
# ApprovalDuration - property
1223
@dbus_service_property(_interface, signature="t",
1224
access="readwrite")
1225
def ApprovalDuration_dbus_property(self, value=None):
1226
if value is None: # get
1227
return dbus.UInt64(_timedelta_to_milliseconds(
1228
self.approval_duration))
1229
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1230
1231
# Name - property
1232
@dbus_service_property(_interface, signature="s", access="read")
1233
def Name_dbus_property(self):
1234
return dbus.String(self.name)
1235
1236
# Fingerprint - property
1237
@dbus_service_property(_interface, signature="s", access="read")
1238
def Fingerprint_dbus_property(self):
1239
return dbus.String(self.fingerprint)
1240
1241
# Host - property
1242
@dbus_service_property(_interface, signature="s",
1243
access="readwrite")
1244
def Host_dbus_property(self, value=None):
1245
if value is None: # get
1246
return dbus.String(self.host)
1247
self.host = value
1248
1249
# Created - property
1250
@dbus_service_property(_interface, signature="s", access="read")
1251
def Created_dbus_property(self):
1252
return dbus.String(datetime_to_dbus(self.created))
1253
1254
# LastEnabled - property
1255
@dbus_service_property(_interface, signature="s", access="read")
1256
def LastEnabled_dbus_property(self):
1257
return datetime_to_dbus(self.last_enabled)
1258
1259
# Enabled - property
1260
@dbus_service_property(_interface, signature="b",
1261
access="readwrite")
1262
def Enabled_dbus_property(self, value=None):
1263
if value is None: # get
1264
return dbus.Boolean(self.enabled)
1265
if value:
1266
self.enable()
1267
else:
1268
self.disable()
1269
1270
# LastCheckedOK - property
1271
@dbus_service_property(_interface, signature="s",
1272
access="readwrite")
1273
def LastCheckedOK_dbus_property(self, value=None):
1274
if value is not None:
1275
self.checked_ok()
1276
return
1277
return datetime_to_dbus(self.last_checked_ok)
1278
1279
# Expires - property
1280
@dbus_service_property(_interface, signature="s", access="read")
1281
def Expires_dbus_property(self):
1282
return datetime_to_dbus(self.expires)
1283
1284
# LastApprovalRequest - property
1285
@dbus_service_property(_interface, signature="s", access="read")
1286
def LastApprovalRequest_dbus_property(self):
1287
return datetime_to_dbus(self.last_approval_request)
1288
1289
# Timeout - property
1290
@dbus_service_property(_interface, signature="t",
1291
access="readwrite")
1292
def Timeout_dbus_property(self, value=None):
1293
if value is None: # get
1294
return dbus.UInt64(self.timeout_milliseconds())
1295
self.timeout = datetime.timedelta(0, 0, 0, value)
1296
if getattr(self, "disable_initiator_tag", None) is None:
1297
return
1298
# Reschedule timeout
1299
gobject.source_remove(self.disable_initiator_tag)
1300
self.disable_initiator_tag = None
1301
self.expires = None
1302
time_to_die = _timedelta_to_milliseconds((self
1303
.last_checked_ok
1304
+ self.timeout)
1305
- datetime.datetime
1306
.utcnow())
1307
if time_to_die <= 0:
1308
# The timeout has passed
1309
self.disable()
1310
else:
1311
self.expires = (datetime.datetime.utcnow()
1312
+ datetime.timedelta(milliseconds =
1313
time_to_die))
1314
self.disable_initiator_tag = (gobject.timeout_add
1315
(time_to_die, self.disable))
1316
1317
# ExtendedTimeout - property
1318
@dbus_service_property(_interface, signature="t",
1319
access="readwrite")
1320
def ExtendedTimeout_dbus_property(self, value=None):
1321
if value is None: # get
1322
return dbus.UInt64(self.extended_timeout_milliseconds())
1323
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1324
1325
# Interval - property
1326
@dbus_service_property(_interface, signature="t",
1327
access="readwrite")
1328
def Interval_dbus_property(self, value=None):
1329
if value is None: # get
1330
return dbus.UInt64(self.interval_milliseconds())
1331
self.interval = datetime.timedelta(0, 0, 0, value)
1332
if getattr(self, "checker_initiator_tag", None) is None:
1333
return
1334
# Reschedule checker run
1335
gobject.source_remove(self.checker_initiator_tag)
1336
self.checker_initiator_tag = (gobject.timeout_add
1337
(value, self.start_checker))
1338
self.start_checker() # Start one now, too
1339
1340
# Checker - property
1341
@dbus_service_property(_interface, signature="s",
1342
access="readwrite")
1343
def Checker_dbus_property(self, value=None):
1344
if value is None: # get
1345
return dbus.String(self.checker_command)
1346
self.checker_command = value
1347
1348
# CheckerRunning - property
1349
@dbus_service_property(_interface, signature="b",
1350
access="readwrite")
1351
def CheckerRunning_dbus_property(self, value=None):
1352
if value is None: # get
1353
return dbus.Boolean(self.checker is not None)
1354
if value:
1355
self.start_checker()
1356
else:
1357
self.stop_checker()
1358
1359
# ObjectPath - property
1360
@dbus_service_property(_interface, signature="o", access="read")
1361
def ObjectPath_dbus_property(self):
1362
return self.dbus_object_path # is already a dbus.ObjectPath
1363
1364
# Secret = property
1365
@dbus_service_property(_interface, signature="ay",
1366
access="write", byte_arrays=True)
1367
def Secret_dbus_property(self, value):
1368
self.secret = str(value)
593
1369
594
1370
del _interface
595
1371
596
1372
597
def peer_certificate(session):
598
"Return the peer's OpenPGP certificate as a bytestring"
599
# If not an OpenPGP certificate...
600
if (gnutls.library.functions
601
.gnutls_certificate_type_get(session._c_object)
602
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
603
# ...do the normal thing
604
return session.peer_certificate
605
list_size = ctypes.c_uint(1)
606
cert_list = (gnutls.library.functions
607
.gnutls_certificate_get_peers
608
(session._c_object, ctypes.byref(list_size)))
609
if not bool(cert_list) and list_size.value != 0:
610
raise gnutls.errors.GNUTLSError("error getting peer"
611
" certificate")
612
if list_size.value == 0:
613
return None
614
cert = cert_list[0]
615
return ctypes.string_at(cert.data, cert.size)
616
617
618
def fingerprint(openpgp):
619
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
620
# New GnuTLS "datum" with the OpenPGP public key
621
datum = (gnutls.library.types
622
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
623
ctypes.POINTER
624
(ctypes.c_ubyte)),
625
ctypes.c_uint(len(openpgp))))
626
# New empty GnuTLS certificate
627
crt = gnutls.library.types.gnutls_openpgp_crt_t()
628
(gnutls.library.functions
629
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
630
# Import the OpenPGP public key into the certificate
631
(gnutls.library.functions
632
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
633
gnutls.library.constants
634
.GNUTLS_OPENPGP_FMT_RAW))
635
# Verify the self signature in the key
636
crtverify = ctypes.c_uint()
637
(gnutls.library.functions
638
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
639
if crtverify.value != 0:
640
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
641
raise gnutls.errors.CertificateSecurityError("Verify failed")
642
# New buffer for the fingerprint
643
buf = ctypes.create_string_buffer(20)
644
buf_len = ctypes.c_size_t()
645
# Get the fingerprint from the certificate into the buffer
646
(gnutls.library.functions
647
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
648
ctypes.byref(buf_len)))
649
# Deinit the certificate
650
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
651
# Convert the buffer to a Python bytestring
652
fpr = ctypes.string_at(buf, buf_len.value)
653
# Convert the bytestring to hexadecimal notation
654
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
655
return hex_fpr
656
657
658
class TCP_handler(SocketServer.BaseRequestHandler, object):
659
"""A TCP request handler class.
660
Instantiated by IPv6_TCPServer for each request to handle it.
1373
class ProxyClient(object):
1374
def __init__(self, child_pipe, fpr, address):
1375
self._pipe = child_pipe
1376
self._pipe.send(('init', fpr, address))
1377
if not self._pipe.recv():
1378
raise KeyError()
1379
1380
def __getattribute__(self, name):
1381
if(name == '_pipe'):
1382
return super(ProxyClient, self).__getattribute__(name)
1383
self._pipe.send(('getattr', name))
1384
data = self._pipe.recv()
1385
if data[0] == 'data':
1386
return data[1]
1387
if data[0] == 'function':
1388
def func(*args, **kwargs):
1389
self._pipe.send(('funcall', name, args, kwargs))
1390
return self._pipe.recv()[1]
1391
return func
1392
1393
def __setattr__(self, name, value):
1394
if(name == '_pipe'):
1395
return super(ProxyClient, self).__setattr__(name, value)
1396
self._pipe.send(('setattr', name, value))
1397
1398
1399
class ClientDBusTransitional(ClientDBus):
1400
__metaclass__ = AlternateDBusNamesMetaclass
1401
1402
1403
class ClientHandler(socketserver.BaseRequestHandler, object):
1404
"""A class to handle client connections.
1405
1406
Instantiated once for each connection to handle it.
661
1407
Note: This will run in its own forked process."""
662
1408
663
1409
def handle(self):
664
logger.info(u"TCP connection from: %s",
665
unicode(self.client_address))
666
session = (gnutls.connection
667
.ClientSession(self.request,
668
gnutls.connection
669
.X509Credentials()))
670
671
line = self.request.makefile().readline()
672
logger.debug(u"Protocol version: %r", line)
673
try:
674
if int(line.strip().split()[0]) > 1:
675
raise RuntimeError
676
except (ValueError, IndexError, RuntimeError), error:
677
logger.error(u"Unknown protocol version: %s", error)
678
return
679
680
# Note: gnutls.connection.X509Credentials is really a generic
681
# GnuTLS certificate credentials object so long as no X.509
682
# keys are added to it. Therefore, we can use it here despite
683
# using OpenPGP certificates.
684
685
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
686
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
687
# "+DHE-DSS"))
688
# Use a fallback default, since this MUST be set.
689
priority = self.server.settings.get("priority", "NORMAL")
690
(gnutls.library.functions
691
.gnutls_priority_set_direct(session._c_object,
692
priority, None))
693
694
try:
695
session.handshake()
696
except gnutls.errors.GNUTLSError, error:
697
logger.warning(u"Handshake failed: %s", error)
698
# Do not run session.bye() here: the session is not
699
# established. Just abandon the request.
700
return
701
logger.debug(u"Handshake succeeded")
702
try:
703
fpr = fingerprint(peer_certificate(session))
704
except (TypeError, gnutls.errors.GNUTLSError), error:
705
logger.warning(u"Bad certificate: %s", error)
706
session.bye()
707
return
708
logger.debug(u"Fingerprint: %s", fpr)
709
710
for c in self.server.clients:
711
if c.fingerprint == fpr:
712
client = c
713
break
714
else:
715
logger.warning(u"Client not found for fingerprint: %s",
716
fpr)
717
session.bye()
718
return
719
# Have to check if client.still_valid(), since it is possible
720
# that the client timed out while establishing the GnuTLS
721
# session.
722
if not client.still_valid():
723
logger.warning(u"Client %(name)s is invalid",
724
vars(client))
725
session.bye()
726
return
727
## This won't work here, since we're in a fork.
728
# client.checked_ok()
729
sent_size = 0
730
while sent_size < len(client.secret):
731
sent = session.send(client.secret[sent_size:])
732
logger.debug(u"Sent: %d, remaining: %d",
733
sent, len(client.secret)
734
- (sent_size + sent))
735
sent_size += sent
736
session.bye()
737
738
739
class IPv6_TCPServer(SocketServer.ForkingMixIn,
740
SocketServer.TCPServer, object):
741
"""IPv6 TCP server. Accepts 'None' as address and/or port.
1410
with contextlib.closing(self.server.child_pipe) as child_pipe:
1411
logger.info("TCP connection from: %s",
1412
unicode(self.client_address))
1413
logger.debug("Pipe FD: %d",
1414
self.server.child_pipe.fileno())
1415
1416
session = (gnutls.connection
1417
.ClientSession(self.request,
1418
gnutls.connection
1419
.X509Credentials()))
1420
1421
# Note: gnutls.connection.X509Credentials is really a
1422
# generic GnuTLS certificate credentials object so long as
1423
# no X.509 keys are added to it. Therefore, we can use it
1424
# here despite using OpenPGP certificates.
1425
1426
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1427
# "+AES-256-CBC", "+SHA1",
1428
# "+COMP-NULL", "+CTYPE-OPENPGP",
1429
# "+DHE-DSS"))
1430
# Use a fallback default, since this MUST be set.
1431
priority = self.server.gnutls_priority
1432
if priority is None:
1433
priority = "NORMAL"
1434
(gnutls.library.functions
1435
.gnutls_priority_set_direct(session._c_object,
1436
priority, None))
1437
1438
# Start communication using the Mandos protocol
1439
# Get protocol number
1440
line = self.request.makefile().readline()
1441
logger.debug("Protocol version: %r", line)
1442
try:
1443
if int(line.strip().split()[0]) > 1:
1444
raise RuntimeError
1445
except (ValueError, IndexError, RuntimeError) as error:
1446
logger.error("Unknown protocol version: %s", error)
1447
return
1448
1449
# Start GnuTLS connection
1450
try:
1451
session.handshake()
1452
except gnutls.errors.GNUTLSError as error:
1453
logger.warning("Handshake failed: %s", error)
1454
# Do not run session.bye() here: the session is not
1455
# established. Just abandon the request.
1456
return
1457
logger.debug("Handshake succeeded")
1458
1459
approval_required = False
1460
try:
1461
try:
1462
fpr = self.fingerprint(self.peer_certificate
1463
(session))
1464
except (TypeError,
1465
gnutls.errors.GNUTLSError) as error:
1466
logger.warning("Bad certificate: %s", error)
1467
return
1468
logger.debug("Fingerprint: %s", fpr)
1469
if self.server.use_dbus:
1470
# Emit D-Bus signal
1471
client.NewRequest(str(self.client_address))
1472
1473
try:
1474
client = ProxyClient(child_pipe, fpr,
1475
self.client_address)
1476
except KeyError:
1477
return
1478
1479
if client.approval_delay:
1480
delay = client.approval_delay
1481
client.approvals_pending += 1
1482
approval_required = True
1483
1484
while True:
1485
if not client.enabled:
1486
logger.info("Client %s is disabled",
1487
client.name)
1488
if self.server.use_dbus:
1489
# Emit D-Bus signal
1490
client.Rejected("Disabled")
1491
return
1492
1493
if client._approved or not client.approval_delay:
1494
#We are approved or approval is disabled
1495
break
1496
elif client._approved is None:
1497
logger.info("Client %s needs approval",
1498
client.name)
1499
if self.server.use_dbus:
1500
# Emit D-Bus signal
1501
client.NeedApproval(
1502
client.approval_delay_milliseconds(),
1503
client.approved_by_default)
1504
else:
1505
logger.warning("Client %s was not approved",
1506
client.name)
1507
if self.server.use_dbus:
1508
# Emit D-Bus signal
1509
client.Rejected("Denied")
1510
return
1511
1512
#wait until timeout or approved
1513
time = datetime.datetime.now()
1514
client.changedstate.acquire()
1515
(client.changedstate.wait
1516
(float(client._timedelta_to_milliseconds(delay)
1517
/ 1000)))
1518
client.changedstate.release()
1519
time2 = datetime.datetime.now()
1520
if (time2 - time) >= delay:
1521
if not client.approved_by_default:
1522
logger.warning("Client %s timed out while"
1523
" waiting for approval",
1524
client.name)
1525
if self.server.use_dbus:
1526
# Emit D-Bus signal
1527
client.Rejected("Approval timed out")
1528
return
1529
else:
1530
break
1531
else:
1532
delay -= time2 - time
1533
1534
sent_size = 0
1535
while sent_size < len(client.secret):
1536
try:
1537
sent = session.send(client.secret[sent_size:])
1538
except gnutls.errors.GNUTLSError as error:
1539
logger.warning("gnutls send failed")
1540
return
1541
logger.debug("Sent: %d, remaining: %d",
1542
sent, len(client.secret)
1543
- (sent_size + sent))
1544
sent_size += sent
1545
1546
logger.info("Sending secret to %s", client.name)
1547
# bump the timeout using extended_timeout
1548
client.checked_ok(client.extended_timeout)
1549
if self.server.use_dbus:
1550
# Emit D-Bus signal
1551
client.GotSecret()
1552
1553
finally:
1554
if approval_required:
1555
client.approvals_pending -= 1
1556
try:
1557
session.bye()
1558
except gnutls.errors.GNUTLSError as error:
1559
logger.warning("GnuTLS bye failed")
1560
1561
@staticmethod
1562
def peer_certificate(session):
1563
"Return the peer's OpenPGP certificate as a bytestring"
1564
# If not an OpenPGP certificate...
1565
if (gnutls.library.functions
1566
.gnutls_certificate_type_get(session._c_object)
1567
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1568
# ...do the normal thing
1569
return session.peer_certificate
1570
list_size = ctypes.c_uint(1)
1571
cert_list = (gnutls.library.functions
1572
.gnutls_certificate_get_peers
1573
(session._c_object, ctypes.byref(list_size)))
1574
if not bool(cert_list) and list_size.value != 0:
1575
raise gnutls.errors.GNUTLSError("error getting peer"
1576
" certificate")
1577
if list_size.value == 0:
1578
return None
1579
cert = cert_list[0]
1580
return ctypes.string_at(cert.data, cert.size)
1581
1582
@staticmethod
1583
def fingerprint(openpgp):
1584
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1585
# New GnuTLS "datum" with the OpenPGP public key
1586
datum = (gnutls.library.types
1587
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1588
ctypes.POINTER
1589
(ctypes.c_ubyte)),
1590
ctypes.c_uint(len(openpgp))))
1591
# New empty GnuTLS certificate
1592
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1593
(gnutls.library.functions
1594
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1595
# Import the OpenPGP public key into the certificate
1596
(gnutls.library.functions
1597
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1598
gnutls.library.constants
1599
.GNUTLS_OPENPGP_FMT_RAW))
1600
# Verify the self signature in the key
1601
crtverify = ctypes.c_uint()
1602
(gnutls.library.functions
1603
.gnutls_openpgp_crt_verify_self(crt, 0,
1604
ctypes.byref(crtverify)))
1605
if crtverify.value != 0:
1606
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1607
raise (gnutls.errors.CertificateSecurityError
1608
("Verify failed"))
1609
# New buffer for the fingerprint
1610
buf = ctypes.create_string_buffer(20)
1611
buf_len = ctypes.c_size_t()
1612
# Get the fingerprint from the certificate into the buffer
1613
(gnutls.library.functions
1614
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1615
ctypes.byref(buf_len)))
1616
# Deinit the certificate
1617
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1618
# Convert the buffer to a Python bytestring
1619
fpr = ctypes.string_at(buf, buf_len.value)
1620
# Convert the bytestring to hexadecimal notation
1621
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1622
return hex_fpr
1623
1624
1625
class MultiprocessingMixIn(object):
1626
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1627
def sub_process_main(self, request, address):
1628
try:
1629
self.finish_request(request, address)
1630
except:
1631
self.handle_error(request, address)
1632
self.close_request(request)
1633
1634
def process_request(self, request, address):
1635
"""Start a new process to process the request."""
1636
proc = multiprocessing.Process(target = self.sub_process_main,
1637
args = (request,
1638
address))
1639
proc.start()
1640
return proc
1641
1642
1643
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1644
""" adds a pipe to the MixIn """
1645
def process_request(self, request, client_address):
1646
"""Overrides and wraps the original process_request().
1647
1648
This function creates a new pipe in self.pipe
1649
"""
1650
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1651
1652
proc = MultiprocessingMixIn.process_request(self, request,
1653
client_address)
1654
self.child_pipe.close()
1655
self.add_pipe(parent_pipe, proc)
1656
1657
def add_pipe(self, parent_pipe, proc):
1658
"""Dummy function; override as necessary"""
1659
raise NotImplementedError
1660
1661
1662
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1663
socketserver.TCPServer, object):
1664
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1665
742
1666
Attributes:
743
settings: Server settings
744
clients: Set() of Client objects
745
1667
enabled: Boolean; whether this server is activated yet
1668
interface: None or a network interface name (string)
1669
use_ipv6: Boolean; to use IPv6 or not
746
1670
"""
747
address_family = socket.AF_INET6
748
def __init__(self, *args, **kwargs):
749
if "settings" in kwargs:
750
self.settings = kwargs["settings"]
751
del kwargs["settings"]
752
if "clients" in kwargs:
753
self.clients = kwargs["clients"]
754
del kwargs["clients"]
755
self.enabled = False
756
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1671
def __init__(self, server_address, RequestHandlerClass,
1672
interface=None, use_ipv6=True):
1673
self.interface = interface
1674
if use_ipv6:
1675
self.address_family = socket.AF_INET6
1676
socketserver.TCPServer.__init__(self, server_address,
1677
RequestHandlerClass)
757
1678
def server_bind(self):
758
1679
"""This overrides the normal server_bind() function
759
1680
to bind to an interface if one was specified, and also NOT to
760
1681
bind to an address or port if they were not specified."""
761
if self.settings["interface"]:
762
# 25 is from /usr/include/asm-i486/socket.h
763
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
764
try:
765
self.socket.setsockopt(socket.SOL_SOCKET,
766
SO_BINDTODEVICE,
767
self.settings["interface"])
768
except socket.error, error:
769
if error[0] == errno.EPERM:
770
logger.error(u"No permission to"
771
u" bind to interface %s",
772
self.settings["interface"])
773
else:
774
raise
1682
if self.interface is not None:
1683
if SO_BINDTODEVICE is None:
1684
logger.error("SO_BINDTODEVICE does not exist;"
1685
" cannot bind to interface %s",
1686
self.interface)
1687
else:
1688
try:
1689
self.socket.setsockopt(socket.SOL_SOCKET,
1690
SO_BINDTODEVICE,
1691
str(self.interface
1692
+ '\0'))
1693
except socket.error as error:
1694
if error[0] == errno.EPERM:
1695
logger.error("No permission to"
1696
" bind to interface %s",
1697
self.interface)
1698
elif error[0] == errno.ENOPROTOOPT:
1699
logger.error("SO_BINDTODEVICE not available;"
1700
" cannot bind to interface %s",
1701
self.interface)
1702
else:
1703
raise
775
1704
# Only bind(2) the socket if we really need to.
776
1705
if self.server_address[0] or self.server_address[1]:
777
1706
if not self.server_address[0]:
778
in6addr_any = "::"
779
self.server_address = (in6addr_any,
1707
if self.address_family == socket.AF_INET6:
1708
any_address = "::" # in6addr_any
1709
else:
1710
any_address = socket.INADDR_ANY
1711
self.server_address = (any_address,
780
1712
self.server_address[1])
781
1713
elif not self.server_address[1]:
782
1714
self.server_address = (self.server_address[0],
783
1715
0)
784
# if self.settings["interface"]:
1716
# if self.interface:
785
1717
# self.server_address = (self.server_address[0],
786
1718
# 0, # port
787
1719
# 0, # flowinfo
788
1720
# if_nametoindex
789
# (self.settings
790
# ["interface"]))
791
return super(IPv6_TCPServer, self).server_bind()
1721
# (self.interface))
1722
return socketserver.TCPServer.server_bind(self)
1723
1724
1725
class MandosServer(IPv6_TCPServer):
1726
"""Mandos server.
1727
1728
Attributes:
1729
clients: set of Client objects
1730
gnutls_priority GnuTLS priority string
1731
use_dbus: Boolean; to emit D-Bus signals or not
1732
1733
Assumes a gobject.MainLoop event loop.
1734
"""
1735
def __init__(self, server_address, RequestHandlerClass,
1736
interface=None, use_ipv6=True, clients=None,
1737
gnutls_priority=None, use_dbus=True):
1738
self.enabled = False
1739
self.clients = clients
1740
if self.clients is None:
1741
self.clients = {}
1742
self.use_dbus = use_dbus
1743
self.gnutls_priority = gnutls_priority
1744
IPv6_TCPServer.__init__(self, server_address,
1745
RequestHandlerClass,
1746
interface = interface,
1747
use_ipv6 = use_ipv6)
792
1748
def server_activate(self):
793
1749
if self.enabled:
794
return super(IPv6_TCPServer, self).server_activate()
1750
return socketserver.TCPServer.server_activate(self)
1751
795
1752
def enable(self):
796
1753
self.enabled = True
1754
1755
def add_pipe(self, parent_pipe, proc):
1756
# Call "handle_ipc" for both data and EOF events
1757
gobject.io_add_watch(parent_pipe.fileno(),
1758
gobject.IO_IN | gobject.IO_HUP,
1759
functools.partial(self.handle_ipc,
1760
parent_pipe =
1761
parent_pipe,
1762
proc = proc))
1763
1764
def handle_ipc(self, source, condition, parent_pipe=None,
1765
proc = None, client_object=None):
1766
condition_names = {
1767
gobject.IO_IN: "IN", # There is data to read.
1768
gobject.IO_OUT: "OUT", # Data can be written (without
1769
# blocking).
1770
gobject.IO_PRI: "PRI", # There is urgent data to read.
1771
gobject.IO_ERR: "ERR", # Error condition.
1772
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1773
# broken, usually for pipes and
1774
# sockets).
1775
}
1776
conditions_string = ' | '.join(name
1777
for cond, name in
1778
condition_names.iteritems()
1779
if cond & condition)
1780
# error, or the other end of multiprocessing.Pipe has closed
1781
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1782
# Wait for other process to exit
1783
proc.join()
1784
return False
1785
1786
# Read a request from the child
1787
request = parent_pipe.recv()
1788
command = request[0]
1789
1790
if command == 'init':
1791
fpr = request[1]
1792
address = request[2]
1793
1794
for c in self.clients.itervalues():
1795
if c.fingerprint == fpr:
1796
client = c
1797
break
1798
else:
1799
logger.info("Client not found for fingerprint: %s, ad"
1800
"dress: %s", fpr, address)
1801
if self.use_dbus:
1802
# Emit D-Bus signal
1803
mandos_dbus_service.ClientNotFound(fpr,
1804
address[0])
1805
parent_pipe.send(False)
1806
return False
1807
1808
gobject.io_add_watch(parent_pipe.fileno(),
1809
gobject.IO_IN | gobject.IO_HUP,
1810
functools.partial(self.handle_ipc,
1811
parent_pipe =
1812
parent_pipe,
1813
proc = proc,
1814
client_object =
1815
client))
1816
parent_pipe.send(True)
1817
# remove the old hook in favor of the new above hook on
1818
# same fileno
1819
return False
1820
if command == 'funcall':
1821
funcname = request[1]
1822
args = request[2]
1823
kwargs = request[3]
1824
1825
parent_pipe.send(('data', getattr(client_object,
1826
funcname)(*args,
1827
**kwargs)))
1828
1829
if command == 'getattr':
1830
attrname = request[1]
1831
if callable(client_object.__getattribute__(attrname)):
1832
parent_pipe.send(('function',))
1833
else:
1834
parent_pipe.send(('data', client_object
1835
.__getattribute__(attrname)))
1836
1837
if command == 'setattr':
1838
attrname = request[1]
1839
value = request[2]
1840
setattr(client_object, attrname, value)
1841
1842
return True
797
1843
798
1844
799
1845
def string_to_delta(interval):
807
1853
datetime.timedelta(0, 3600)
808
1854
>>> string_to_delta('24h')
809
1855
datetime.timedelta(1)
810
>>> string_to_delta(u'1w')
1856
>>> string_to_delta('1w')
811
1857
datetime.timedelta(7)
812
1858
>>> string_to_delta('5m 30s')
813
1859
datetime.timedelta(0, 330)
817
1863
try:
818
1864
suffix = unicode(s[-1])
819
1865
value = int(s[:-1])
820
if suffix == u"d":
1866
if suffix == "d":
821
1867
delta = datetime.timedelta(value)
822
elif suffix == u"s":
1868
elif suffix == "s":
823
1869
delta = datetime.timedelta(0, value)
824
elif suffix == u"m":
1870
elif suffix == "m":
825
1871
delta = datetime.timedelta(0, 0, 0, 0, value)
826
elif suffix == u"h":
1872
elif suffix == "h":
827
1873
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
828
elif suffix == u"w":
1874
elif suffix == "w":
829
1875
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
830
1876
else:
831
raise ValueError
832
except (ValueError, IndexError):
833
raise ValueError
1877
raise ValueError("Unknown suffix %r" % suffix)
1878
except (ValueError, IndexError) as e:
1879
raise ValueError(*(e.args))
834
1880
timevalue += delta
835
1881
return timevalue
836
1882
837
1883
838
def server_state_changed(state):
839
"""Derived from the Avahi example code"""
840
if state == avahi.SERVER_COLLISION:
841
logger.error(u"Zeroconf server name collision")
842
service.remove()
843
elif state == avahi.SERVER_RUNNING:
844
service.add()
845
846
847
def entry_group_state_changed(state, error):
848
"""Derived from the Avahi example code"""
849
logger.debug(u"Avahi state change: %i", state)
850
851
if state == avahi.ENTRY_GROUP_ESTABLISHED:
852
logger.debug(u"Zeroconf service established.")
853
elif state == avahi.ENTRY_GROUP_COLLISION:
854
logger.warning(u"Zeroconf service name collision.")
855
service.rename()
856
elif state == avahi.ENTRY_GROUP_FAILURE:
857
logger.critical(u"Avahi: Error in group state changed %s",
858
unicode(error))
859
raise AvahiGroupError(u"State changed: %s" % unicode(error))
860
861
def if_nametoindex(interface):
862
"""Call the C function if_nametoindex(), or equivalent"""
863
global if_nametoindex
864
try:
865
if_nametoindex = (ctypes.cdll.LoadLibrary
866
(ctypes.util.find_library("c"))
867
.if_nametoindex)
868
except (OSError, AttributeError):
869
if "struct" not in sys.modules:
870
import struct
871
if "fcntl" not in sys.modules:
872
import fcntl
873
def if_nametoindex(interface):
874
"Get an interface index the hard way, i.e. using fcntl()"
875
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
876
with closing(socket.socket()) as s:
877
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
878
struct.pack("16s16x", interface))
879
interface_index = struct.unpack("I", ifreq[16:20])[0]
880
return interface_index
881
return if_nametoindex(interface)
882
883
884
1884
def daemon(nochdir = False, noclose = False):
885
1885
"""See daemon(3). Standard BSD Unix function.
1886
886
1887
This should really exist as os.daemon, but it doesn't (yet)."""
887
1888
if os.fork():
888
1889
sys.exit()
896
1897
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
897
1898
if not stat.S_ISCHR(os.fstat(null).st_mode):
898
1899
raise OSError(errno.ENODEV,
899
"/dev/null not a character device")
1900
"%s not a character device"
1901
% os.path.devnull)
900
1902
os.dup2(null, sys.stdin.fileno())
901
1903
os.dup2(null, sys.stdout.fileno())
902
1904
os.dup2(null, sys.stderr.fileno())
905
1907
906
1908
907
1909
def main():
908
parser = optparse.OptionParser(version = "%%prog %s" % version)
909
parser.add_option("-i", "--interface", type="string",
910
metavar="IF", help="Bind to interface IF")
911
parser.add_option("-a", "--address", type="string",
912
help="Address to listen for requests on")
913
parser.add_option("-p", "--port", type="int",
914
help="Port number to receive requests on")
915
parser.add_option("--check", action="store_true",
916
help="Run self-test")
917
parser.add_option("--debug", action="store_true",
918
help="Debug mode; run in foreground and log to"
919
" terminal")
920
parser.add_option("--priority", type="string", help="GnuTLS"
921
" priority string (see GnuTLS documentation)")
922
parser.add_option("--servicename", type="string", metavar="NAME",
923
help="Zeroconf service name")
924
parser.add_option("--configdir", type="string",
925
default="/etc/mandos", metavar="DIR",
926
help="Directory to search for configuration"
927
" files")
928
parser.add_option("--no-dbus", action="store_false",
929
dest="use_dbus",
930
help="Do not provide D-Bus system bus"
931
" interface")
932
options = parser.parse_args()[0]
1910
1911
##################################################################
1912
# Parsing of options, both command line and config file
1913
1914
parser = argparse.ArgumentParser()
1915
parser.add_argument("-v", "--version", action="version",
1916
version = "%%(prog)s %s" % version,
1917
help="show version number and exit")
1918
parser.add_argument("-i", "--interface", metavar="IF",
1919
help="Bind to interface IF")
1920
parser.add_argument("-a", "--address",
1921
help="Address to listen for requests on")
1922
parser.add_argument("-p", "--port", type=int,
1923
help="Port number to receive requests on")
1924
parser.add_argument("--check", action="store_true",
1925
help="Run self-test")
1926
parser.add_argument("--debug", action="store_true",
1927
help="Debug mode; run in foreground and log"
1928
" to terminal")
1929
parser.add_argument("--debuglevel", metavar="LEVEL",
1930
help="Debug level for stdout output")
1931
parser.add_argument("--priority", help="GnuTLS"
1932
" priority string (see GnuTLS documentation)")
1933
parser.add_argument("--servicename",
1934
metavar="NAME", help="Zeroconf service name")
1935
parser.add_argument("--configdir",
1936
default="/etc/mandos", metavar="DIR",
1937
help="Directory to search for configuration"
1938
" files")
1939
parser.add_argument("--no-dbus", action="store_false",
1940
dest="use_dbus", help="Do not provide D-Bus"
1941
" system bus interface")
1942
parser.add_argument("--no-ipv6", action="store_false",
1943
dest="use_ipv6", help="Do not use IPv6")
1944
parser.add_argument("--no-restore", action="store_false",
1945
dest="restore", help="Do not restore stored"
1946
" state", default=True)
1947
1948
options = parser.parse_args()
933
1949
934
1950
if options.check:
935
1951
import doctest
945
1961
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
946
1962
"servicename": "Mandos",
947
1963
"use_dbus": "True",
1964
"use_ipv6": "True",
1965
"debuglevel": "",
948
1966
}
949
1967
950
1968
# Parse config file for server-global settings
951
server_config = ConfigParser.SafeConfigParser(server_defaults)
1969
server_config = configparser.SafeConfigParser(server_defaults)
952
1970
del server_defaults
953
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1971
server_config.read(os.path.join(options.configdir,
1972
"mandos.conf"))
954
1973
# Convert the SafeConfigParser object to a dict
955
1974
server_settings = server_config.defaults()
956
1975
# Use the appropriate methods on the non-string config options
957
server_settings["debug"] = server_config.getboolean("DEFAULT",
958
"debug")
959
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
960
"use_dbus")
1976
for option in ("debug", "use_dbus", "use_ipv6"):
1977
server_settings[option] = server_config.getboolean("DEFAULT",
1978
option)
961
1979
if server_settings["port"]:
962
1980
server_settings["port"] = server_config.getint("DEFAULT",
963
1981
"port")
967
1985
# options, if set.
968
1986
for option in ("interface", "address", "port", "debug",
969
1987
"priority", "servicename", "configdir",
970
"use_dbus"):
1988
"use_dbus", "use_ipv6", "debuglevel", "restore"):
971
1989
value = getattr(options, option)
972
1990
if value is not None:
973
1991
server_settings[option] = value
974
1992
del options
1993
# Force all strings to be unicode
1994
for option in server_settings.keys():
1995
if type(server_settings[option]) is str:
1996
server_settings[option] = unicode(server_settings[option])
975
1997
# Now we have our good server settings in "server_settings"
976
1998
1999
##################################################################
2000
977
2001
# For convenience
978
2002
debug = server_settings["debug"]
2003
debuglevel = server_settings["debuglevel"]
979
2004
use_dbus = server_settings["use_dbus"]
2005
use_ipv6 = server_settings["use_ipv6"]
980
2006
981
if not debug:
982
syslogger.setLevel(logging.WARNING)
983
console.setLevel(logging.WARNING)
2007
if debug:
2008
initlogger(logging.DEBUG)
2009
else:
2010
if not debuglevel:
2011
initlogger()
2012
else:
2013
level = getattr(logging, debuglevel.upper())
2014
initlogger(level)
984
2015
985
2016
if server_settings["servicename"] != "Mandos":
986
2017
syslogger.setFormatter(logging.Formatter
987
('Mandos (%s): %%(levelname)s:'
988
' %%(message)s'
2018
('Mandos (%s) [%%(process)d]:'
2019
' %%(levelname)s: %%(message)s'
989
2020
% server_settings["servicename"]))
990
2021
991
2022
# Parse config file with clients
992
client_defaults = { "timeout": "1h",
993
"interval": "5m",
2023
client_defaults = { "timeout": "5m",
2024
"extended_timeout": "15m",
2025
"interval": "2m",
994
2026
"checker": "fping -q -- %%(host)s",
995
2027
"host": "",
2028
"approval_delay": "0s",
2029
"approval_duration": "1s",
996
2030
}
997
client_config = ConfigParser.SafeConfigParser(client_defaults)
2031
client_config = configparser.SafeConfigParser(client_defaults)
998
2032
client_config.read(os.path.join(server_settings["configdir"],
999
2033
"clients.conf"))
1000
2034
1001
clients = Set()
1002
tcp_server = IPv6_TCPServer((server_settings["address"],
1003
server_settings["port"]),
1004
TCP_handler,
1005
settings=server_settings,
1006
clients=clients)
1007
pidfilename = "/var/run/mandos.pid"
1008
try:
1009
pidfile = open(pidfilename, "w")
1010
except IOError:
1011
logger.error("Could not open file %r", pidfilename)
2035
global mandos_dbus_service
2036
mandos_dbus_service = None
2037
2038
tcp_server = MandosServer((server_settings["address"],
2039
server_settings["port"]),
2040
ClientHandler,
2041
interface=(server_settings["interface"]
2042
or None),
2043
use_ipv6=use_ipv6,
2044
gnutls_priority=
2045
server_settings["priority"],
2046
use_dbus=use_dbus)
2047
if not debug:
2048
pidfilename = "/var/run/mandos.pid"
2049
try:
2050
pidfile = open(pidfilename, "w")
2051
except IOError:
2052
logger.error("Could not open file %r", pidfilename)
1012
2053
1013
2054
try:
1014
2055
uid = pwd.getpwnam("_mandos").pw_uid
1020
2061
except KeyError:
1021
2062
try:
1022
2063
uid = pwd.getpwnam("nobody").pw_uid
1023
gid = pwd.getpwnam("nogroup").pw_gid
2064
gid = pwd.getpwnam("nobody").pw_gid
1024
2065
except KeyError:
1025
2066
uid = 65534
1026
2067
gid = 65534
1027
2068
try:
1028
2069
os.setgid(gid)
1029
2070
os.setuid(uid)
1030
except OSError, error:
2071
except OSError as error:
1031
2072
if error[0] != errno.EPERM:
1032
2073
raise error
1033
2074
1034
# Enable all possible GnuTLS debugging
1035
2075
if debug:
2076
# Enable all possible GnuTLS debugging
2077
1036
2078
# "Use a log level over 10 to enable all debugging options."
1037
2079
# - GnuTLS manual
1038
2080
gnutls.library.functions.gnutls_global_set_log_level(11)
1043
2085
1044
2086
(gnutls.library.functions
1045
2087
.gnutls_global_set_log_function(debug_gnutls))
2088
2089
# Redirect stdin so all checkers get /dev/null
2090
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
2091
os.dup2(null, sys.stdin.fileno())
2092
if null > 2:
2093
os.close(null)
2094
else:
2095
# No console logging
2096
logger.removeHandler(console)
1046
2097
1047
global service
1048
service = AvahiService(name = server_settings["servicename"],
1049
servicetype = "_mandos._tcp", )
1050
if server_settings["interface"]:
1051
service.interface = (if_nametoindex
1052
(server_settings["interface"]))
2098
# Need to fork before connecting to D-Bus
2099
if not debug:
2100
# Close all input and output, do double fork, etc.
2101
daemon()
1053
2102
1054
2103
global main_loop
1055
global bus
1056
global server
1057
2104
# From the Avahi example code
1058
2105
DBusGMainLoop(set_as_default=True )
1059
2106
main_loop = gobject.MainLoop()
1060
2107
bus = dbus.SystemBus()
1061
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1062
avahi.DBUS_PATH_SERVER),
1063
avahi.DBUS_INTERFACE_SERVER)
1064
2108
# End of Avahi example code
1065
2109
if use_dbus:
1066
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1067
1068
clients.update(Set(Client(name = section,
1069
config
1070
= dict(client_config.items(section)),
1071
use_dbus = use_dbus)
1072
for section in client_config.sections()))
1073
if not clients:
1074
logger.warning(u"No clients defined")
1075
1076
if debug:
1077
# Redirect stdin so all checkers get /dev/null
1078
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1079
os.dup2(null, sys.stdin.fileno())
1080
if null > 2:
1081
os.close(null)
1082
else:
1083
# No console logging
1084
logger.removeHandler(console)
1085
# Close all input and output, do double fork, etc.
1086
daemon()
1087
1088
try:
1089
pid = os.getpid()
1090
pidfile.write(str(pid) + "\n")
1091
pidfile.close()
1092
del pidfile
1093
except IOError:
1094
logger.error(u"Could not write to file %r with PID %d",
1095
pidfilename, pid)
1096
except NameError:
1097
# "pidfile" was never created
1098
pass
1099
del pidfilename
1100
1101
def cleanup():
1102
"Cleanup function; run on exit"
1103
global group
1104
# From the Avahi example code
1105
if not group is None:
1106
group.Free()
1107
group = None
1108
# End of Avahi example code
1109
1110
while clients:
1111
client = clients.pop()
1112
client.disable_hook = None
1113
client.disable()
1114
1115
atexit.register(cleanup)
1116
2110
try:
2111
bus_name = dbus.service.BusName("se.recompile.Mandos",
2112
bus, do_not_queue=True)
2113
old_bus_name = (dbus.service.BusName
2114
("se.bsnet.fukt.Mandos", bus,
2115
do_not_queue=True))
2116
except dbus.exceptions.NameExistsException as e:
2117
logger.error(unicode(e) + ", disabling D-Bus")
2118
use_dbus = False
2119
server_settings["use_dbus"] = False
2120
tcp_server.use_dbus = False
2121
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2122
service = AvahiServiceToSyslog(name =
2123
server_settings["servicename"],
2124
servicetype = "_mandos._tcp",
2125
protocol = protocol, bus = bus)
2126
if server_settings["interface"]:
2127
service.interface = (if_nametoindex
2128
(str(server_settings["interface"])))
2129
2130
global multiprocessing_manager
2131
multiprocessing_manager = multiprocessing.Manager()
2132
2133
client_class = Client
2134
if use_dbus:
2135
client_class = functools.partial(ClientDBusTransitional,
2136
bus = bus)
2137
2138
special_settings = {
2139
# Some settings need to be accessd by special methods;
2140
# booleans need .getboolean(), etc. Here is a list of them:
2141
"approved_by_default":
2142
lambda section:
2143
client_config.getboolean(section, "approved_by_default"),
2144
}
2145
# Construct a new dict of client settings of this form:
2146
# { client_name: {setting_name: value, ...}, ...}
2147
# with exceptions for any special settings as defined above
2148
client_settings = dict((clientname,
2149
dict((setting,
2150
(value
2151
if setting not in special_settings
2152
else special_settings[setting]
2153
(clientname)))
2154
for setting, value in
2155
client_config.items(clientname)))
2156
for clientname in client_config.sections())
2157
2158
old_client_settings = {}
2159
clients_data = []
2160
2161
# Get client data and settings from last running state.
2162
if server_settings["restore"]:
2163
try:
2164
with open(stored_state_path, "rb") as stored_state:
2165
clients_data, old_client_settings = (pickle.load
2166
(stored_state))
2167
os.remove(stored_state_path)
2168
except IOError as e:
2169
logger.warning("Could not load persistant state: {0}"
2170
.format(e))
2171
if e.errno != errno.ENOENT:
2172
raise
2173
2174
for client in clients_data:
2175
client_name = client["name"]
2176
2177
# Decide which value to use after restoring saved state.
2178
# We have three different values: Old config file,
2179
# new config file, and saved state.
2180
# New config value takes precedence if it differs from old
2181
# config value, otherwise use saved state.
2182
for name, value in client_settings[client_name].items():
2183
try:
2184
# For each value in new config, check if it differs
2185
# from the old config value (Except for the "secret"
2186
# attribute)
2187
if (name != "secret" and
2188
value != old_client_settings[client_name][name]):
2189
setattr(client, name, value)
2190
except KeyError:
2191
pass
2192
2193
# Clients who has passed its expire date, can still be enabled
2194
# if its last checker was sucessful. Clients who checkers
2195
# failed before we stored it state is asumed to had failed
2196
# checker during downtime.
2197
if client["enabled"] and client["last_checked_ok"]:
2198
if ((datetime.datetime.utcnow()
2199
- client["last_checked_ok"]) > client["interval"]):
2200
if client["last_checker_status"] != 0:
2201
client["enabled"] = False
2202
else:
2203
client["expires"] = (datetime.datetime.utcnow()
2204
+ client["timeout"])
2205
2206
client["changedstate"] = (multiprocessing_manager
2207
.Condition(multiprocessing_manager
2208
.Lock()))
2209
if use_dbus:
2210
new_client = (ClientDBusTransitional.__new__
2211
(ClientDBusTransitional))
2212
tcp_server.clients[client_name] = new_client
2213
new_client.bus = bus
2214
for name, value in client.iteritems():
2215
setattr(new_client, name, value)
2216
client_object_name = unicode(client_name).translate(
2217
{ord("."): ord("_"),
2218
ord("-"): ord("_")})
2219
new_client.dbus_object_path = (dbus.ObjectPath
2220
("/clients/"
2221
+ client_object_name))
2222
DBusObjectWithProperties.__init__(new_client,
2223
new_client.bus,
2224
new_client
2225
.dbus_object_path)
2226
else:
2227
tcp_server.clients[client_name] = Client.__new__(Client)
2228
for name, value in client.iteritems():
2229
setattr(tcp_server.clients[client_name], name, value)
2230
2231
tcp_server.clients[client_name].decrypt_secret(
2232
client_settings[client_name]["secret"])
2233
2234
# Create/remove clients based on new changes made to config
2235
for clientname in set(old_client_settings) - set(client_settings):
2236
del tcp_server.clients[clientname]
2237
for clientname in set(client_settings) - set(old_client_settings):
2238
tcp_server.clients[clientname] = (client_class(name
2239
= clientname,
2240
config =
2241
client_settings
2242
[clientname]))
2243
2244
if not tcp_server.clients:
2245
logger.warning("No clients defined")
2246
1117
2247
if not debug:
2248
try:
2249
with pidfile:
2250
pid = os.getpid()
2251
pidfile.write(str(pid) + "\n".encode("utf-8"))
2252
del pidfile
2253
except IOError:
2254
logger.error("Could not write to file %r with PID %d",
2255
pidfilename, pid)
2256
except NameError:
2257
# "pidfile" was never created
2258
pass
2259
del pidfilename
2260
1118
2261
signal.signal(signal.SIGINT, signal.SIG_IGN)
2262
1119
2263
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1120
2264
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1121
2265
1122
2266
if use_dbus:
1123
class MandosServer(dbus.service.Object):
2267
class MandosDBusService(dbus.service.Object):
1124
2268
"""A D-Bus proxy object"""
1125
2269
def __init__(self):
1126
2270
dbus.service.Object.__init__(self, bus, "/")
1127
_interface = u"se.bsnet.fukt.Mandos"
1128
1129
@dbus.service.signal(_interface, signature="oa{sv}")
1130
def ClientAdded(self, objpath, properties):
2271
_interface = "se.recompile.Mandos"
2272
2273
@dbus.service.signal(_interface, signature="o")
2274
def ClientAdded(self, objpath):
2275
"D-Bus signal"
2276
pass
2277
2278
@dbus.service.signal(_interface, signature="ss")
2279
def ClientNotFound(self, fingerprint, address):
1131
2280
"D-Bus signal"
1132
2281
pass
1133
2282
1139
2288
@dbus.service.method(_interface, out_signature="ao")
1140
2289
def GetAllClients(self):
1141
2290
"D-Bus method"
1142
return dbus.Array(c.dbus_object_path for c in clients)
2291
return dbus.Array(c.dbus_object_path
2292
for c in
2293
tcp_server.clients.itervalues())
1143
2294
1144
@dbus.service.method(_interface, out_signature="a{oa{sv}}")
2295
@dbus.service.method(_interface,
2296
out_signature="a{oa{sv}}")
1145
2297
def GetAllClientsWithProperties(self):
1146
2298
"D-Bus method"
1147
2299
return dbus.Dictionary(
1148
((c.dbus_object_path, c.GetAllProperties())
1149
for c in clients),
2300
((c.dbus_object_path, c.GetAll(""))
2301
for c in tcp_server.clients.itervalues()),
1150
2302
signature="oa{sv}")
1151
2303
1152
2304
@dbus.service.method(_interface, in_signature="o")
1153
2305
def RemoveClient(self, object_path):
1154
2306
"D-Bus method"
1155
for c in clients:
2307
for c in tcp_server.clients.itervalues():
1156
2308
if c.dbus_object_path == object_path:
1157
clients.remove(c)
2309
del tcp_server.clients[c.name]
2310
c.remove_from_connection()
1158
2311
# Don't signal anything except ClientRemoved
1159
c.use_dbus = False
1160
c.disable()
2312
c.disable(quiet=True)
1161
2313
# Emit D-Bus signal
1162
2314
self.ClientRemoved(object_path, c.name)
1163
2315
return
1164
raise KeyError
2316
raise KeyError(object_path)
1165
2317
1166
2318
del _interface
1167
2319
1168
mandos_server = MandosServer()
1169
1170
for client in clients:
2320
class MandosDBusServiceTransitional(MandosDBusService):
2321
__metaclass__ = AlternateDBusNamesMetaclass
2322
mandos_dbus_service = MandosDBusServiceTransitional()
2323
2324
def cleanup():
2325
"Cleanup function; run on exit"
2326
service.cleanup()
2327
2328
multiprocessing.active_children()
2329
if not (tcp_server.clients or client_settings):
2330
return
2331
2332
# Store client before exiting. Secrets are encrypted with key
2333
# based on what config file has. If config file is
2334
# removed/edited, old secret will thus be unrecovable.
2335
clients = []
2336
for client in tcp_server.clients.itervalues():
2337
client.encrypt_secret(client_settings[client.name]
2338
["secret"])
2339
2340
client_dict = {}
2341
2342
# A list of attributes that will not be stored when
2343
# shutting down.
2344
exclude = set(("bus", "changedstate", "secret"))
2345
for name, typ in inspect.getmembers(dbus.service.Object):
2346
exclude.add(name)
2347
2348
client_dict["encrypted_secret"] = client.encrypted_secret
2349
for attr in client.client_structure:
2350
if attr not in exclude:
2351
client_dict[attr] = getattr(client, attr)
2352
2353
clients.append(client_dict)
2354
del client_settings[client.name]["secret"]
2355
2356
try:
2357
with os.fdopen(os.open(stored_state_path,
2358
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2359
0600), "wb") as stored_state:
2360
pickle.dump((clients, client_settings), stored_state)
2361
except IOError as e:
2362
logger.warning("Could not save persistant state: {0}"
2363
.format(e))
2364
if e.errno != errno.ENOENT:
2365
raise
2366
2367
# Delete all clients, and settings from config
2368
while tcp_server.clients:
2369
name, client = tcp_server.clients.popitem()
2370
if use_dbus:
2371
client.remove_from_connection()
2372
# Don't signal anything except ClientRemoved
2373
client.disable(quiet=True)
2374
if use_dbus:
2375
# Emit D-Bus signal
2376
mandos_dbus_service.ClientRemoved(client
2377
.dbus_object_path,
2378
client.name)
2379
client_settings.clear()
2380
2381
atexit.register(cleanup)
2382
2383
for client in tcp_server.clients.itervalues():
1171
2384
if use_dbus:
1172
2385
# Emit D-Bus signal
1173
mandos_server.ClientAdded(client.dbus_object_path,
1174
client.GetAllProperties())
1175
client.enable()
2386
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2387
# Need to initiate checking of clients
2388
if client.enabled:
2389
client.init_checker()
2390
1176
2391
1177
2392
tcp_server.enable()
1178
2393
tcp_server.server_activate()
1179
2394
1180
2395
# Find out what port we got
1181
2396
service.port = tcp_server.socket.getsockname()[1]
1182
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1183
u" scope_id %d" % tcp_server.socket.getsockname())
2397
if use_ipv6:
2398
logger.info("Now listening on address %r, port %d,"
2399
" flowinfo %d, scope_id %d"
2400
% tcp_server.socket.getsockname())
2401
else: # IPv4
2402
logger.info("Now listening on address %r, port %d"
2403
% tcp_server.socket.getsockname())
1184
2404
1185
2405
#service.interface = tcp_server.socket.getsockname()[3]
1186
2406
1187
2407
try:
1188
2408
# From the Avahi example code
1189
server.connect_to_signal("StateChanged", server_state_changed)
1190
2409
try:
1191
server_state_changed(server.GetState())
1192
except dbus.exceptions.DBusException, error:
1193
logger.critical(u"DBusException: %s", error)
2410
service.activate()
2411
except dbus.exceptions.DBusException as error:
2412
logger.critical("DBusException: %s", error)
2413
cleanup()
1194
2414
sys.exit(1)
1195
2415
# End of Avahi example code
1196
2416
1199
2419
(tcp_server.handle_request
1200
2420
(*args[2:], **kwargs) or True))
1201
2421
1202
logger.debug(u"Starting main loop")
2422
logger.debug("Starting main loop")
1203
2423
main_loop.run()
1204
except AvahiError, error:
1205
logger.critical(u"AvahiError: %s", error)
2424
except AvahiError as error:
2425
logger.critical("AvahiError: %s", error)
2426
cleanup()
1206
2427
sys.exit(1)
1207
2428
except KeyboardInterrupt:
1208
2429
if debug:
1209
print >> sys.stderr
2430
print("", file=sys.stderr)
1210
2431
logger.debug("Server received KeyboardInterrupt")
1211
2432
logger.debug("Server exiting")
2433
# Must run before the D-Bus bus name gets deregistered
2434
cleanup()
2435
1212
2436
1213
2437
if __name__ == '__main__':
1214
2438
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0