/mandos/trunk : revision 237.4.1

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

55

import logging

56

import logging.handlers

57

import pwd

58

from contextlib import closing

58

import contextlib

59

import struct

60

import fcntl

61

import functools

62

import cPickle as pickle

63

import multiprocessing

62

64

63

65

import dbus

64

66

import dbus.service

67

69

from dbus.mainloop.glib import DBusGMainLoop

68

70

import ctypes

69

71

import ctypes.util

72

import xml.dom.minidom

73

import inspect

70

74

71

75

try:

72

76

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

79

83

80

84

version = "1.0.14"

81

85

86

#logger = logging.getLogger(u'mandos')

82

87

logger = logging.Logger(u'mandos')

83

88

syslogger = (logging.handlers.SysLogHandler

84

89

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

152

157

u" after %i retries, exiting.",

153

158

self.rename_count)

154

159

raise AvahiServiceError(u"Too many renames")

155

self.name = self.server.GetAlternativeServiceName(self.name)

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

156

161

logger.info(u"Changing Zeroconf service name to %r ...",

157

unicode(self.name))

162

self.name)

158

163

syslogger.setFormatter(logging.Formatter

159

164

(u'Mandos (%s) [%%(process)d]:'

160

165

u' %%(levelname)s: %%(message)s'

161

166

% self.name))

162

167

self.remove()

163

self.add()

168

try:

169

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

172

self.cleanup()

173

os._exit(1)

164

174

self.rename_count += 1

165

175

def remove(self):

166

176

"""Derived from the Avahi example code"""

174

184

self.server.EntryGroupNew()),

175

185

avahi.DBUS_INTERFACE_ENTRY_GROUP)

176

186

self.group.connect_to_signal('StateChanged',

177

self.entry_group_state_changed)

187

self

188

.entry_group_state_changed)

178

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

179

190

self.name, self.type)

180

191

self.group.AddService(

188

199

self.group.Commit()

189

200

def entry_group_state_changed(self, state, error):

190

201

"""Derived from the Avahi example code"""

191

logger.debug(u"Avahi state change: %i", state)

202

logger.debug(u"Avahi entry group state change: %i", state)

192

203

193

204

if state == avahi.ENTRY_GROUP_ESTABLISHED:

194

205

logger.debug(u"Zeroconf service established.")

207

218

self.group = None

208

219

def server_state_changed(self, state):

209

220

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

210

222

if state == avahi.SERVER_COLLISION:

211

223

logger.error(u"Zeroconf server name collision")

212

224

self.remove()

228

240

"""A representation of a client host served by this server.

229

241

230

242

Attributes:

231

name: string; from the config file, used in log messages and

232

D-Bus identifiers

233

fingerprint: string (40 or 32 hexadecimal digits); used to

234

uniquely identify the client

235

secret: bytestring; sent verbatim (over TLS) to client

236

host: string; available for use by the checker command

237

created: datetime.datetime(); (UTC) object creation

238

last_enabled: datetime.datetime(); (UTC)

239

enabled: bool()

240

last_checked_ok: datetime.datetime(); (UTC) or None

241

timeout: datetime.timedelta(); How long from last_checked_ok

242

until this client is invalid

243

interval: datetime.timedelta(); How often to start a new checker

244

disable_hook: If set, called by disable() as disable_hook(self)

243

_approved: bool(); 'None' if not yet approved/disapproved

244

approval_delay: datetime.timedelta(); Time to wait for approval

245

approval_duration: datetime.timedelta(); Duration of one approval

245

246

checker: subprocess.Popen(); a running checker process used

246

247

to see if the client lives.

247

248

'None' if no process is running.

248

checker_initiator_tag: a gobject event source tag, or None

249

disable_initiator_tag: - '' -

250

checker_callback_tag: - '' -

251

checker_command: string; External command which is run to check if

252

client lives. %() expansions are done at

249

checker_callback_tag: a gobject event source tag, or None

250

checker_command: string; External command which is run to check

251

if client lives. %() expansions are done at

253

252

runtime with vars(self) as dict, so that for

254

253

instance %(name)s can be used in the command.

254

checker_initiator_tag: a gobject event source tag, or None

255

created: datetime.datetime(); (UTC) object creation

255

256

current_checker_command: string; current running checker_command

257

disable_hook: If set, called by disable() as disable_hook(self)

258

disable_initiator_tag: a gobject event source tag, or None

259

enabled: bool()

260

fingerprint: string (40 or 32 hexadecimal digits); used to

261

uniquely identify the client

262

host: string; available for use by the checker command

263

interval: datetime.timedelta(); How often to start a new checker

264

last_approval_request: datetime.datetime(); (UTC) or None

265

last_checked_ok: datetime.datetime(); (UTC) or None

266

last_enabled: datetime.datetime(); (UTC)

267

name: string; from the config file, used in log messages and

268

D-Bus identifiers

269

secret: bytestring; sent verbatim (over TLS) to client

270

timeout: datetime.timedelta(); How long from last_checked_ok

271

until this client is disabled

272

runtime_expansions: Allowed attributes for runtime expansion.

256

273

"""

257

274

275

runtime_expansions = (u"approval_delay", u"approval_duration",

276

u"created", u"enabled", u"fingerprint",

277

u"host", u"interval", u"last_checked_ok",

278

u"last_enabled", u"name", u"timeout")

279

258

280

@staticmethod

259

def _datetime_to_milliseconds(dt):

260

"Convert a datetime.datetime() to milliseconds"

261

return ((dt.days * 24 * 60 * 60 * 1000)

262

+ (dt.seconds * 1000)

263

+ (dt.microseconds // 1000))

281

def _timedelta_to_milliseconds(td):

282

"Convert a datetime.timedelta() to milliseconds"

283

return ((td.days * 24 * 60 * 60 * 1000)

284

+ (td.seconds * 1000)

285

+ (td.microseconds // 1000))

264

286

265

287

def timeout_milliseconds(self):

266

288

"Return the 'timeout' attribute in milliseconds"

267

return self._datetime_to_milliseconds(self.timeout)

289

return self._timedelta_to_milliseconds(self.timeout)

268

290

269

291

def interval_milliseconds(self):

270

292

"Return the 'interval' attribute in milliseconds"

271

return self._datetime_to_milliseconds(self.interval)

293

return self._timedelta_to_milliseconds(self.interval)

294

295

def approval_delay_milliseconds(self):

296

return self._timedelta_to_milliseconds(self.approval_delay)

272

297

273

298

def __init__(self, name = None, disable_hook=None, config=None):

274

299

"""Note: the 'checker' key in 'config' sets the

287

312

if u"secret" in config:

288

313

self.secret = config[u"secret"].decode(u"base64")

289

314

elif u"secfile" in config:

290

with closing(open(os.path.expanduser

291

(os.path.expandvars

292

(config[u"secfile"])))) as secfile:

315

with open(os.path.expanduser(os.path.expandvars

316

(config[u"secfile"])),

317

"rb") as secfile:

293

318

self.secret = secfile.read()

294

319

else:

295

320

raise TypeError(u"No secret or secfile for client %s"

297

322

self.host = config.get(u"host", u"")

298

323

self.created = datetime.datetime.utcnow()

299

324

self.enabled = False

325

self.last_approval_request = None

300

326

self.last_enabled = None

301

327

self.last_checked_ok = None

302

328

self.timeout = string_to_delta(config[u"timeout"])

309

335

self.checker_command = config[u"checker"]

310

336

self.current_checker_command = None

311

337

self.last_connect = None

338

self._approved = None

339

self.approved_by_default = config.get(u"approved_by_default",

340

True)

341

self.approvals_pending = 0

342

self.approval_delay = string_to_delta(

343

config[u"approval_delay"])

344

self.approval_duration = string_to_delta(

345

config[u"approval_duration"])

346

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

312

347

348

def send_changedstate(self):

349

self.changedstate.acquire()

350

self.changedstate.notify_all()

351

self.changedstate.release()

352

313

353

def enable(self):

314

354

"""Start this client's checker and timeout hooks"""

315

355

if getattr(self, u"enabled", False):

316

356

# Already enabled

317

357

return

358

self.send_changedstate()

318

359

self.last_enabled = datetime.datetime.utcnow()

319

360

# Schedule a new checker to be started an 'interval' from now,

320

361

# and every interval from then on.

321

362

self.checker_initiator_tag = (gobject.timeout_add

322

363

(self.interval_milliseconds(),

323

364

self.start_checker))

324

# Also start a new checker *right now*.

325

self.start_checker()

326

365

# Schedule a disable() when 'timeout' has passed

327

366

self.disable_initiator_tag = (gobject.timeout_add

328

367

(self.timeout_milliseconds(),

329

368

self.disable))

330

369

self.enabled = True

370

# Also start a new checker *right now*.

371

self.start_checker()

331

372

332

def disable(self):

373

def disable(self, quiet=True):

333

374

"""Disable this client."""

334

375

if not getattr(self, "enabled", False):

335

376

return False

336

logger.info(u"Disabling client %s", self.name)

377

if not quiet:

378

self.send_changedstate()

379

if not quiet:

380

logger.info(u"Disabling client %s", self.name)

337

381

if getattr(self, u"disable_initiator_tag", False):

338

382

gobject.source_remove(self.disable_initiator_tag)

339

383

self.disable_initiator_tag = None

380

424

(self.timeout_milliseconds(),

381

425

self.disable))

382

426

427

def need_approval(self):

428

self.last_approval_request = datetime.datetime.utcnow()

429

383

430

def start_checker(self):

384

431

"""Start a new checker subprocess if one is not running.

385

432

391

438

# client would inevitably timeout, since no checker would get

392

439

# a chance to run to completion. If we instead leave running

393

440

# checkers alone, the checker would have to take more time

394

# than 'timeout' for the client to be declared invalid, which

395

# is as it should be.

441

# than 'timeout' for the client to be disabled, which is as it

442

# should be.

396

443

397

444

# If a checker exists, make sure it is not a zombie

398

if self.checker is not None:

445

try:

399

446

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

447

except (AttributeError, OSError), error:

448

if (isinstance(error, OSError)

449

and error.errno != errno.ECHILD):

450

raise error

451

else:

400

452

if pid:

401

453

logger.warning(u"Checker was a zombie")

402

454

gobject.source_remove(self.checker_callback_tag)

409

461

command = self.checker_command % self.host

410

462

except TypeError:

411

463

# Escape attributes for the shell

412

escaped_attrs = dict((key,

413

re.escape(unicode(str(val),

414

errors=

415

u'replace')))

416

for key, val in

417

vars(self).iteritems())

464

escaped_attrs = dict(

465

(attr,

466

re.escape(unicode(str(getattr(self, attr, u"")),

467

errors=

468

u'replace')))

469

for attr in

470

self.runtime_expansions)

471

418

472

try:

419

473

command = self.checker_command % escaped_attrs

420

474

except TypeError, error:

458

512

logger.debug(u"Stopping checker for %(name)s", vars(self))

459

513

try:

460

514

os.kill(self.checker.pid, signal.SIGTERM)

461

#os.sleep(0.5)

515

#time.sleep(0.5)

462

516

#if self.checker.poll() is None:

463

517

# os.kill(self.checker.pid, signal.SIGKILL)

464

518

except OSError, error:

465

519

if error.errno != errno.ESRCH: # No such process

466

520

raise

467

521

self.checker = None

468

469

def still_valid(self):

470

"""Has the timeout not yet passed for this client?"""

471

if not getattr(self, u"enabled", False):

472

return False

473

now = datetime.datetime.utcnow()

474

if self.last_checked_ok is None:

475

return now < (self.created + self.timeout)

476

else:

477

return now < (self.last_checked_ok + self.timeout)

478

479

480

class ClientDBus(Client, dbus.service.Object):

522

523

def dbus_service_property(dbus_interface, signature=u"v",

524

access=u"readwrite", byte_arrays=False):

525

"""Decorators for marking methods of a DBusObjectWithProperties to

526

become properties on the D-Bus.

527

528

The decorated method will be called with no arguments by "Get"

529

and with one argument by "Set".

530

531

The parameters, where they are supported, are the same as

532

dbus.service.method, except there is only "signature", since the

533

type from Get() and the type sent to Set() is the same.

534

"""

535

# Encoding deeply encoded byte arrays is not supported yet by the

536

# "Set" method, so we fail early here:

537

if byte_arrays and signature != u"ay":

538

raise ValueError(u"Byte arrays not supported for non-'ay'"

539

u" signature %r" % signature)

540

def decorator(func):

541

func._dbus_is_property = True

542

func._dbus_interface = dbus_interface

543

func._dbus_signature = signature

544

func._dbus_access = access

545

func._dbus_name = func.__name__

546

if func._dbus_name.endswith(u"_dbus_property"):

547

func._dbus_name = func._dbus_name[:-14]

548

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

549

return func

550

return decorator

551

552

553

class DBusPropertyException(dbus.exceptions.DBusException):

554

"""A base class for D-Bus property-related exceptions

555

"""

556

def __unicode__(self):

557

return unicode(str(self))

558

559

560

class DBusPropertyAccessException(DBusPropertyException):

561

"""A property's access permissions disallows an operation.

562

"""

563

pass

564

565

566

class DBusPropertyNotFound(DBusPropertyException):

567

"""An attempt was made to access a non-existing property.

568

"""

569

pass

570

571

572

class DBusObjectWithProperties(dbus.service.Object):

573

"""A D-Bus object with properties.

574

575

Classes inheriting from this can use the dbus_service_property

576

decorator to expose methods as D-Bus properties. It exposes the

577

standard Get(), Set(), and GetAll() methods on the D-Bus.

578

"""

579

580

@staticmethod

581

def _is_dbus_property(obj):

582

return getattr(obj, u"_dbus_is_property", False)

583

584

def _get_all_dbus_properties(self):

585

"""Returns a generator of (name, attribute) pairs

586

"""

587

return ((prop._dbus_name, prop)

588

for name, prop in

589

inspect.getmembers(self, self._is_dbus_property))

590

591

def _get_dbus_property(self, interface_name, property_name):

592

"""Returns a bound method if one exists which is a D-Bus

593

property with the specified name and interface.

594

"""

595

for name in (property_name,

596

property_name + u"_dbus_property"):

597

prop = getattr(self, name, None)

598

if (prop is None

599

or not self._is_dbus_property(prop)

600

or prop._dbus_name != property_name

601

or (interface_name and prop._dbus_interface

602

and interface_name != prop._dbus_interface)):

603

continue

604

return prop

605

# No such property

606

raise DBusPropertyNotFound(self.dbus_object_path + u":"

607

+ interface_name + u"."

608

+ property_name)

609

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

611

out_signature=u"v")

612

def Get(self, interface_name, property_name):

613

"""Standard D-Bus property Get() method, see D-Bus standard.

614

"""

615

prop = self._get_dbus_property(interface_name, property_name)

616

if prop._dbus_access == u"write":

617

raise DBusPropertyAccessException(property_name)

618

value = prop()

619

if not hasattr(value, u"variant_level"):

620

return value

621

return type(value)(value, variant_level=value.variant_level+1)

622

623

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

624

def Set(self, interface_name, property_name, value):

625

"""Standard D-Bus property Set() method, see D-Bus standard.

626

"""

627

prop = self._get_dbus_property(interface_name, property_name)

628

if prop._dbus_access == u"read":

629

raise DBusPropertyAccessException(property_name)

630

if prop._dbus_get_args_options[u"byte_arrays"]:

631

# The byte_arrays option is not supported yet on

632

# signatures other than "ay".

633

if prop._dbus_signature != u"ay":

634

raise ValueError

635

value = dbus.ByteArray(''.join(unichr(byte)

636

for byte in value))

637

prop(value)

638

639

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

640

out_signature=u"a{sv}")

641

def GetAll(self, interface_name):

642

"""Standard D-Bus property GetAll() method, see D-Bus

643

standard.

644

645

Note: Will not include properties with access="write".

646

"""

647

all = {}

648

for name, prop in self._get_all_dbus_properties():

649

if (interface_name

650

and interface_name != prop._dbus_interface):

651

# Interface non-empty but did not match

652

continue

653

# Ignore write-only properties

654

if prop._dbus_access == u"write":

655

continue

656

value = prop()

657

if not hasattr(value, u"variant_level"):

658

all[name] = value

659

continue

660

all[name] = type(value)(value, variant_level=

661

value.variant_level+1)

662

return dbus.Dictionary(all, signature=u"sv")

663

664

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

665

out_signature=u"s",

666

path_keyword='object_path',

667

connection_keyword='connection')

668

def Introspect(self, object_path, connection):

669

"""Standard D-Bus method, overloaded to insert property tags.

670

"""

671

xmlstring = dbus.service.Object.Introspect(self, object_path,

672

connection)

673

try:

674

document = xml.dom.minidom.parseString(xmlstring)

675

def make_tag(document, name, prop):

676

e = document.createElement(u"property")

677

e.setAttribute(u"name", name)

678

e.setAttribute(u"type", prop._dbus_signature)

679

e.setAttribute(u"access", prop._dbus_access)

680

return e

681

for if_tag in document.getElementsByTagName(u"interface"):

682

for tag in (make_tag(document, name, prop)

683

for name, prop

684

in self._get_all_dbus_properties()

685

if prop._dbus_interface

686

== if_tag.getAttribute(u"name")):

687

if_tag.appendChild(tag)

688

# Add the names to the return values for the

689

# "org.freedesktop.DBus.Properties" methods

690

if (if_tag.getAttribute(u"name")

691

== u"org.freedesktop.DBus.Properties"):

692

for cn in if_tag.getElementsByTagName(u"method"):

693

if cn.getAttribute(u"name") == u"Get":

694

for arg in cn.getElementsByTagName(u"arg"):

695

if (arg.getAttribute(u"direction")

696

== u"out"):

697

arg.setAttribute(u"name", u"value")

698

elif cn.getAttribute(u"name") == u"GetAll":

699

for arg in cn.getElementsByTagName(u"arg"):

700

if (arg.getAttribute(u"direction")

701

== u"out"):

702

arg.setAttribute(u"name", u"props")

703

xmlstring = document.toxml(u"utf-8")

704

document.unlink()

705

except (AttributeError, xml.dom.DOMException,

706

xml.parsers.expat.ExpatError), error:

707

logger.error(u"Failed to override Introspection method",

708

error)

709

return xmlstring

710

711

712

class ClientDBus(Client, DBusObjectWithProperties):

481

713

"""A Client class using D-Bus

482

714

483

715

Attributes:

484

716

dbus_object_path: dbus.ObjectPath

485

717

bus: dbus.SystemBus()

486

718

"""

719

720

runtime_expansions = (Client.runtime_expansions

721

+ (u"dbus_object_path",))

722

487

723

# dbus.service.Object doesn't use super(), so we can't either.

488

724

489

725

def __init__(self, bus = None, *args, **kwargs):

726

self._approvals_pending = 0

490

727

self.bus = bus

491

728

Client.__init__(self, *args, **kwargs)

492

729

# Only now, when this client is initialized, can it show up on

493

730

# the D-Bus

731

client_object_name = unicode(self.name).translate(

732

{ord(u"."): ord(u"_"),

733

ord(u"-"): ord(u"_")})

494

734

self.dbus_object_path = (dbus.ObjectPath

495

(u"/clients/"

496

+ self.name.replace(u".", u"_")))

497

dbus.service.Object.__init__(self, self.bus,

498

self.dbus_object_path)

735

(u"/clients/" + client_object_name))

736

DBusObjectWithProperties.__init__(self, self.bus,

737

self.dbus_object_path)

738

739

def _get_approvals_pending(self):

740

return self._approvals_pending

741

def _set_approvals_pending(self, value):

742

old_value = self._approvals_pending

743

self._approvals_pending = value

744

bval = bool(value)

745

if (hasattr(self, "dbus_object_path")

746

and bval is not bool(old_value)):

747

dbus_bool = dbus.Boolean(bval, variant_level=1)

748

self.PropertyChanged(dbus.String(u"ApprovalPending"),

749

dbus_bool)

750

751

approvals_pending = property(_get_approvals_pending,

752

_set_approvals_pending)

753

del _get_approvals_pending, _set_approvals_pending

499

754

500

755

@staticmethod

501

756

def _datetime_to_dbus(dt, variant_level=0):

508

763

r = Client.enable(self)

509

764

if oldstate != self.enabled:

510

765

# Emit D-Bus signals

511

self.PropertyChanged(dbus.String(u"enabled"),

766

self.PropertyChanged(dbus.String(u"Enabled"),

512

767

dbus.Boolean(True, variant_level=1))

513

768

self.PropertyChanged(

514

dbus.String(u"last_enabled"),

769

dbus.String(u"LastEnabled"),

515

770

self._datetime_to_dbus(self.last_enabled,

516

771

variant_level=1))

517

772

return r

518

773

519

def disable(self, signal = True):

774

def disable(self, quiet = False):

520

775

oldstate = getattr(self, u"enabled", False)

521

r = Client.disable(self)

522

if signal and oldstate != self.enabled:

776

r = Client.disable(self, quiet=quiet)

777

if not quiet and oldstate != self.enabled:

523

778

# Emit D-Bus signal

524

self.PropertyChanged(dbus.String(u"enabled"),

779

self.PropertyChanged(dbus.String(u"Enabled"),

525

780

dbus.Boolean(False, variant_level=1))

526

781

return r

527

782

530

785

self.remove_from_connection()

531

786

except LookupError:

532

787

pass

533

if hasattr(dbus.service.Object, u"__del__"):

534

dbus.service.Object.__del__(self, *args, **kwargs)

788

if hasattr(DBusObjectWithProperties, u"__del__"):

789

DBusObjectWithProperties.__del__(self, *args, **kwargs)

535

790

Client.__del__(self, *args, **kwargs)

536

791

537

792

def checker_callback(self, pid, condition, command,

539

794

self.checker_callback_tag = None

540

795

self.checker = None

541

796

# Emit D-Bus signal

542

self.PropertyChanged(dbus.String(u"checker_running"),

797

self.PropertyChanged(dbus.String(u"CheckerRunning"),

543

798

dbus.Boolean(False, variant_level=1))

544

799

if os.WIFEXITED(condition):

545

800

exitstatus = os.WEXITSTATUS(condition)

560

815

r = Client.checked_ok(self, *args, **kwargs)

561

816

# Emit D-Bus signal

562

817

self.PropertyChanged(

563

dbus.String(u"last_checked_ok"),

818

dbus.String(u"LastCheckedOK"),

564

819

(self._datetime_to_dbus(self.last_checked_ok,

565

820

variant_level=1)))

566

821

return r

567

822

823

def need_approval(self, *args, **kwargs):

824

r = Client.need_approval(self, *args, **kwargs)

825

# Emit D-Bus signal

826

self.PropertyChanged(

827

dbus.String(u"LastApprovalRequest"),

828

(self._datetime_to_dbus(self.last_approval_request,

829

variant_level=1)))

830

return r

831

568

832

def start_checker(self, *args, **kwargs):

569

833

old_checker = self.checker

570

834

if self.checker is not None:

578

842

# Emit D-Bus signal

579

843

self.CheckerStarted(self.current_checker_command)

580

844

self.PropertyChanged(

581

dbus.String(u"checker_running"),

845

dbus.String(u"CheckerRunning"),

582

846

dbus.Boolean(True, variant_level=1))

583

847

return r

584

848

587

851

r = Client.stop_checker(self, *args, **kwargs)

588

852

if (old_checker is not None

589

853

and getattr(self, u"checker", None) is None):

590

self.PropertyChanged(dbus.String(u"checker_running"),

854

self.PropertyChanged(dbus.String(u"CheckerRunning"),

591

855

dbus.Boolean(False, variant_level=1))

592

856

return r

593

594

## D-Bus methods & signals

857

858

def _reset_approved(self):

859

self._approved = None

860

return False

861

862

def approve(self, value=True):

863

self.send_changedstate()

864

self._approved = value

865

gobject.timeout_add(self._timedelta_to_milliseconds

866

(self.approval_duration),

867

self._reset_approved)

868

869

870

## D-Bus methods, signals & properties

595

871

_interface = u"se.bsnet.fukt.Mandos.Client"

596

872

597

# CheckedOK - method

598

@dbus.service.method(_interface)

599

def CheckedOK(self):

600

return self.checked_ok()

873

## Signals

601

874

602

875

# CheckerCompleted - signal

603

876

@dbus.service.signal(_interface, signature=u"nxs")

611

884

"D-Bus signal"

612

885

pass

613

886

614

# GetAllProperties - method

615

@dbus.service.method(_interface, out_signature=u"a{sv}")

616

def GetAllProperties(self):

617

"D-Bus method"

618

return dbus.Dictionary({

619

dbus.String(u"name"):

620

dbus.String(self.name, variant_level=1),

621

dbus.String(u"fingerprint"):

622

dbus.String(self.fingerprint, variant_level=1),

623

dbus.String(u"host"):

624

dbus.String(self.host, variant_level=1),

625

dbus.String(u"created"):

626

self._datetime_to_dbus(self.created,

627

variant_level=1),

628

dbus.String(u"last_enabled"):

629

(self._datetime_to_dbus(self.last_enabled,

630

variant_level=1)

631

if self.last_enabled is not None

632

else dbus.Boolean(False, variant_level=1)),

633

dbus.String(u"enabled"):

634

dbus.Boolean(self.enabled, variant_level=1),

635

dbus.String(u"last_checked_ok"):

636

(self._datetime_to_dbus(self.last_checked_ok,

637

variant_level=1)

638

if self.last_checked_ok is not None

639

else dbus.Boolean (False, variant_level=1)),

640

dbus.String(u"timeout"):

641

dbus.UInt64(self.timeout_milliseconds(),

642

variant_level=1),

643

dbus.String(u"interval"):

644

dbus.UInt64(self.interval_milliseconds(),

645

variant_level=1),

646

dbus.String(u"checker"):

647

dbus.String(self.checker_command,

648

variant_level=1),

649

dbus.String(u"checker_running"):

650

dbus.Boolean(self.checker is not None,

651

variant_level=1),

652

dbus.String(u"object_path"):

653

dbus.ObjectPath(self.dbus_object_path,

654

variant_level=1)

655

}, signature=u"sv")

656

657

# IsStillValid - method

658

@dbus.service.method(_interface, out_signature=u"b")

659

def IsStillValid(self):

660

return self.still_valid()

661

662

887

# PropertyChanged - signal

663

888

@dbus.service.signal(_interface, signature=u"sv")

664

889

def PropertyChanged(self, property, value):

665

890

"D-Bus signal"

666

891

pass

667

892

668

# ReceivedSecret - signal

893

# GotSecret - signal

669

894

@dbus.service.signal(_interface)

670

def ReceivedSecret(self):

671

"D-Bus signal"

895

def GotSecret(self):

896

"""D-Bus signal

897

Is sent after a successful transfer of secret from the Mandos

898

server to mandos-client

899

"""

672

900

pass

673

901

674

902

# Rejected - signal

675

@dbus.service.signal(_interface)

676

def Rejected(self):

903

@dbus.service.signal(_interface, signature=u"s")

904

def Rejected(self, reason):

677

905

"D-Bus signal"

678

906

pass

679

907

680

# SetChecker - method

681

@dbus.service.method(_interface, in_signature=u"s")

682

def SetChecker(self, checker):

683

"D-Bus setter method"

684

self.checker_command = checker

685

# Emit D-Bus signal

686

self.PropertyChanged(dbus.String(u"checker"),

687

dbus.String(self.checker_command,

688

variant_level=1))

689

690

# SetHost - method

691

@dbus.service.method(_interface, in_signature=u"s")

692

def SetHost(self, host):

693

"D-Bus setter method"

694

self.host = host

695

# Emit D-Bus signal

696

self.PropertyChanged(dbus.String(u"host"),

697

dbus.String(self.host, variant_level=1))

698

699

# SetInterval - method

700

@dbus.service.method(_interface, in_signature=u"t")

701

def SetInterval(self, milliseconds):

702

self.interval = datetime.timedelta(0, 0, 0, milliseconds)

703

# Emit D-Bus signal

704

self.PropertyChanged(dbus.String(u"interval"),

705

(dbus.UInt64(self.interval_milliseconds(),

706

variant_level=1)))

707

708

# SetSecret - method

709

@dbus.service.method(_interface, in_signature=u"ay",

710

byte_arrays=True)

711

def SetSecret(self, secret):

712

"D-Bus setter method"

713

self.secret = str(secret)

714

715

# SetTimeout - method

716

@dbus.service.method(_interface, in_signature=u"t")

717

def SetTimeout(self, milliseconds):

718

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

719

# Emit D-Bus signal

720

self.PropertyChanged(dbus.String(u"timeout"),

721

(dbus.UInt64(self.timeout_milliseconds(),

722

variant_level=1)))

908

# NeedApproval - signal

909

@dbus.service.signal(_interface, signature=u"tb")

910

def NeedApproval(self, timeout, default):

911

"D-Bus signal"

912

return self.need_approval()

913

914

## Methods

915

916

# Approve - method

917

@dbus.service.method(_interface, in_signature=u"b")

918

def Approve(self, value):

919

self.approve(value)

920

921

# CheckedOK - method

922

@dbus.service.method(_interface)

923

def CheckedOK(self):

924

return self.checked_ok()

723

925

724

926

# Enable - method

725

927

@dbus.service.method(_interface)

744

946

def StopChecker(self):

745

947

self.stop_checker()

746

948

949

## Properties

950

951

# ApprovalPending - property

952

@dbus_service_property(_interface, signature=u"b", access=u"read")

953

def ApprovalPending_dbus_property(self):

954

return dbus.Boolean(bool(self.approvals_pending))

955

956

# ApprovedByDefault - property

957

@dbus_service_property(_interface, signature=u"b",

958

access=u"readwrite")

959

def ApprovedByDefault_dbus_property(self, value=None):

960

if value is None: # get

961

return dbus.Boolean(self.approved_by_default)

962

self.approved_by_default = bool(value)

963

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

965

dbus.Boolean(value, variant_level=1))

966

967

# ApprovalDelay - property

968

@dbus_service_property(_interface, signature=u"t",

969

access=u"readwrite")

970

def ApprovalDelay_dbus_property(self, value=None):

971

if value is None: # get

972

return dbus.UInt64(self.approval_delay_milliseconds())

973

self.approval_delay = datetime.timedelta(0, 0, 0, value)

974

# Emit D-Bus signal

975

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

976

dbus.UInt64(value, variant_level=1))

977

978

# ApprovalDuration - property

979

@dbus_service_property(_interface, signature=u"t",

980

access=u"readwrite")

981

def ApprovalDuration_dbus_property(self, value=None):

982

if value is None: # get

983

return dbus.UInt64(self._timedelta_to_milliseconds(

984

self.approval_duration))

985

self.approval_duration = datetime.timedelta(0, 0, 0, value)

986

# Emit D-Bus signal

987

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

988

dbus.UInt64(value, variant_level=1))

989

990

# Name - property

991

@dbus_service_property(_interface, signature=u"s", access=u"read")

992

def Name_dbus_property(self):

993

return dbus.String(self.name)

994

995

# Fingerprint - property

996

@dbus_service_property(_interface, signature=u"s", access=u"read")

997

def Fingerprint_dbus_property(self):

998

return dbus.String(self.fingerprint)

999

1000

# Host - property

1001

@dbus_service_property(_interface, signature=u"s",

1002

access=u"readwrite")

1003

def Host_dbus_property(self, value=None):

1004

if value is None: # get

1005

return dbus.String(self.host)

1006

self.host = value

1007

# Emit D-Bus signal

1008

self.PropertyChanged(dbus.String(u"Host"),

1009

dbus.String(value, variant_level=1))

1010

1011

# Created - property

1012

@dbus_service_property(_interface, signature=u"s", access=u"read")

1013

def Created_dbus_property(self):

1014

return dbus.String(self._datetime_to_dbus(self.created))

1015

1016

# LastEnabled - property

1017

@dbus_service_property(_interface, signature=u"s", access=u"read")

1018

def LastEnabled_dbus_property(self):

1019

if self.last_enabled is None:

1020

return dbus.String(u"")

1021

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1022

1023

# Enabled - property

1024

@dbus_service_property(_interface, signature=u"b",

1025

access=u"readwrite")

1026

def Enabled_dbus_property(self, value=None):

1027

if value is None: # get

1028

return dbus.Boolean(self.enabled)

1029

if value:

1030

self.enable()

1031

else:

1032

self.disable()

1033

1034

# LastCheckedOK - property

1035

@dbus_service_property(_interface, signature=u"s",

1036

access=u"readwrite")

1037

def LastCheckedOK_dbus_property(self, value=None):

1038

if value is not None:

1039

self.checked_ok()

1040

return

1041

if self.last_checked_ok is None:

1042

return dbus.String(u"")

1043

return dbus.String(self._datetime_to_dbus(self

1044

.last_checked_ok))

1045

1046

# LastApprovalRequest - property

1047

@dbus_service_property(_interface, signature=u"s", access=u"read")

1048

def LastApprovalRequest_dbus_property(self):

1049

if self.last_approval_request is None:

1050

return dbus.String(u"")

1051

return dbus.String(self.

1052

_datetime_to_dbus(self

1053

.last_approval_request))

1054

1055

# Timeout - property

1056

@dbus_service_property(_interface, signature=u"t",

1057

access=u"readwrite")

1058

def Timeout_dbus_property(self, value=None):

1059

if value is None: # get

1060

return dbus.UInt64(self.timeout_milliseconds())

1061

self.timeout = datetime.timedelta(0, 0, 0, value)

1062

# Emit D-Bus signal

1063

self.PropertyChanged(dbus.String(u"Timeout"),

1064

dbus.UInt64(value, variant_level=1))

1065

if getattr(self, u"disable_initiator_tag", None) is None:

1066

return

1067

# Reschedule timeout

1068

gobject.source_remove(self.disable_initiator_tag)

1069

self.disable_initiator_tag = None

1070

time_to_die = (self.

1071

_timedelta_to_milliseconds((self

1072

.last_checked_ok

1073

+ self.timeout)

1074

- datetime.datetime

1075

.utcnow()))

1076

if time_to_die <= 0:

1077

# The timeout has passed

1078

self.disable()

1079

else:

1080

self.disable_initiator_tag = (gobject.timeout_add

1081

(time_to_die, self.disable))

1082

1083

# Interval - property

1084

@dbus_service_property(_interface, signature=u"t",

1085

access=u"readwrite")

1086

def Interval_dbus_property(self, value=None):

1087

if value is None: # get

1088

return dbus.UInt64(self.interval_milliseconds())

1089

self.interval = datetime.timedelta(0, 0, 0, value)

1090

# Emit D-Bus signal

1091

self.PropertyChanged(dbus.String(u"Interval"),

1092

dbus.UInt64(value, variant_level=1))

1093

if getattr(self, u"checker_initiator_tag", None) is None:

1094

return

1095

# Reschedule checker run

1096

gobject.source_remove(self.checker_initiator_tag)

1097

self.checker_initiator_tag = (gobject.timeout_add

1098

(value, self.start_checker))

1099

self.start_checker() # Start one now, too

1100

1101

# Checker - property

1102

@dbus_service_property(_interface, signature=u"s",

1103

access=u"readwrite")

1104

def Checker_dbus_property(self, value=None):

1105

if value is None: # get

1106

return dbus.String(self.checker_command)

1107

self.checker_command = value

1108

# Emit D-Bus signal

1109

self.PropertyChanged(dbus.String(u"Checker"),

1110

dbus.String(self.checker_command,

1111

variant_level=1))

1112

1113

# CheckerRunning - property

1114

@dbus_service_property(_interface, signature=u"b",

1115

access=u"readwrite")

1116

def CheckerRunning_dbus_property(self, value=None):

1117

if value is None: # get

1118

return dbus.Boolean(self.checker is not None)

1119

if value:

1120

self.start_checker()

1121

else:

1122

self.stop_checker()

1123

1124

# ObjectPath - property

1125

@dbus_service_property(_interface, signature=u"o", access=u"read")

1126

def ObjectPath_dbus_property(self):

1127

return self.dbus_object_path # is already a dbus.ObjectPath

1128

1129

# Secret = property

1130

@dbus_service_property(_interface, signature=u"ay",

1131

access=u"write", byte_arrays=True)

1132

def Secret_dbus_property(self, value):

1133

self.secret = str(value)

1134

747

1135

del _interface

748

1136

749

1137

1138

class ProxyClient(object):

1139

def __init__(self, child_pipe, fpr, address):

1140

self._pipe = child_pipe

1141

self._pipe.send(('init', fpr, address))

1142

if not self._pipe.recv():

1143

raise KeyError()

1144

1145

def __getattribute__(self, name):

1146

if(name == '_pipe'):

1147

return super(ProxyClient, self).__getattribute__(name)

1148

self._pipe.send(('getattr', name))

1149

data = self._pipe.recv()

1150

if data[0] == 'data':

1151

return data[1]

1152

if data[0] == 'function':

1153

def func(*args, **kwargs):

1154

self._pipe.send(('funcall', name, args, kwargs))

1155

return self._pipe.recv()[1]

1156

return func

1157

1158

def __setattr__(self, name, value):

1159

if(name == '_pipe'):

1160

return super(ProxyClient, self).__setattr__(name, value)

1161

self._pipe.send(('setattr', name, value))

1162

1163

750

1164

class ClientHandler(socketserver.BaseRequestHandler, object):

751

1165

"""A class to handle client connections.

752

1166

754

1168

Note: This will run in its own forked process."""

755

1169

756

1170

def handle(self):

757

logger.info(u"TCP connection from: %s",

758

unicode(self.client_address))

759

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

760

# Open IPC pipe to parent process

761

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

1171

with contextlib.closing(self.server.child_pipe) as child_pipe:

1172

logger.info(u"TCP connection from: %s",

1173

unicode(self.client_address))

1174

logger.debug(u"Pipe FD: %d",

1175

self.server.child_pipe.fileno())

1176

762

1177

session = (gnutls.connection

763

1178

.ClientSession(self.request,

764

1179

gnutls.connection

765

1180

.X509Credentials()))

766

767

line = self.request.makefile().readline()

768

logger.debug(u"Protocol version: %r", line)

769

try:

770

if int(line.strip().split()[0]) > 1:

771

raise RuntimeError

772

except (ValueError, IndexError, RuntimeError), error:

773

logger.error(u"Unknown protocol version: %s", error)

774

return

775

1181

776

1182

# Note: gnutls.connection.X509Credentials is really a

777

1183

# generic GnuTLS certificate credentials object so long as

778

1184

# no X.509 keys are added to it. Therefore, we can use it

779

1185

# here despite using OpenPGP certificates.

780

1186

781

1187

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

782

1188

# u"+AES-256-CBC", u"+SHA1",

783

1189

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

789

1195

(gnutls.library.functions

790

1196

.gnutls_priority_set_direct(session._c_object,

791

1197

priority, None))

792

1198

1199

# Start communication using the Mandos protocol

1200

# Get protocol number

1201

line = self.request.makefile().readline()

1202

logger.debug(u"Protocol version: %r", line)

1203

try:

1204

if int(line.strip().split()[0]) > 1:

1205

raise RuntimeError

1206

except (ValueError, IndexError, RuntimeError), error:

1207

logger.error(u"Unknown protocol version: %s", error)

1208

return

1209

1210

# Start GnuTLS connection

793

1211

try:

794

1212

session.handshake()

795

1213

except gnutls.errors.GNUTLSError, error:

798

1216

# established. Just abandon the request.

799

1217

return

800

1218

logger.debug(u"Handshake succeeded")

1219

1220

approval_required = False

801

1221

try:

802

fpr = self.fingerprint(self.peer_certificate(session))

803

except (TypeError, gnutls.errors.GNUTLSError), error:

804

logger.warning(u"Bad certificate: %s", error)

805

session.bye()

806

return

807

logger.debug(u"Fingerprint: %s", fpr)

1222

try:

1223

fpr = self.fingerprint(self.peer_certificate

1224

(session))

1225

except (TypeError, gnutls.errors.GNUTLSError), error:

1226

logger.warning(u"Bad certificate: %s", error)

1227

return

1228

logger.debug(u"Fingerprint: %s", fpr)

1229

1230

try:

1231

client = ProxyClient(child_pipe, fpr,

1232

self.client_address)

1233

except KeyError:

1234

return

1235

1236

if client.approval_delay:

1237

delay = client.approval_delay

1238

client.approvals_pending += 1

1239

approval_required = True

1240

1241

while True:

1242

if not client.enabled:

1243

logger.warning(u"Client %s is disabled",

1244

client.name)

1245

if self.server.use_dbus:

1246

# Emit D-Bus signal

1247

client.Rejected("Disabled")

1248

return

1249

1250

if client._approved or not client.approval_delay:

1251

#We are approved or approval is disabled

1252

break

1253

elif client._approved is None:

1254

logger.info(u"Client %s needs approval",

1255

client.name)

1256

if self.server.use_dbus:

1257

# Emit D-Bus signal

1258

client.NeedApproval(

1259

client.approval_delay_milliseconds(),

1260

client.approved_by_default)

1261

else:

1262

logger.warning(u"Client %s was not approved",

1263

client.name)

1264

if self.server.use_dbus:

1265

# Emit D-Bus signal

1266

client.Rejected("Denied")

1267

return

1268

1269

#wait until timeout or approved

1270

#x = float(client._timedelta_to_milliseconds(delay))

1271

time = datetime.datetime.now()

1272

client.changedstate.acquire()

1273

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1274

client.changedstate.release()

1275

time2 = datetime.datetime.now()

1276

if (time2 - time) >= delay:

1277

if not client.approved_by_default:

1278

logger.warning("Client %s timed out while"

1279

" waiting for approval",

1280

client.name)

1281

if self.server.use_dbus:

1282

# Emit D-Bus signal

1283

client.Rejected("Approval timed out")

1284

return

1285

else:

1286

break

1287

else:

1288

delay -= time2 - time

1289

1290

sent_size = 0

1291

while sent_size < len(client.secret):

1292

try:

1293

sent = session.send(client.secret[sent_size:])

1294

except (gnutls.errors.GNUTLSError), error:

1295

logger.warning("gnutls send failed")

1296

return

1297

logger.debug(u"Sent: %d, remaining: %d",

1298

sent, len(client.secret)

1299

- (sent_size + sent))

1300

sent_size += sent

1301

1302

logger.info(u"Sending secret to %s", client.name)

1303

# bump the timeout as if seen

1304

client.checked_ok()

1305

if self.server.use_dbus:

1306

# Emit D-Bus signal

1307

client.GotSecret()

808

1308

809

for c in self.server.clients:

810

if c.fingerprint == fpr:

811

client = c

812

break

813

else:

814

ipc.write(u"NOTFOUND %s %s\n"

815

% (fpr, unicode(self.client_address)))

816

session.bye()

817

return

818

# Have to check if client.still_valid(), since it is

819

# possible that the client timed out while establishing

820

# the GnuTLS session.

821

if not client.still_valid():

822

ipc.write(u"INVALID %s\n" % client.name)

823

session.bye()

824

return

825

ipc.write(u"SENDING %s\n" % client.name)

826

sent_size = 0

827

while sent_size < len(client.secret):

828

sent = session.send(client.secret[sent_size:])

829

logger.debug(u"Sent: %d, remaining: %d",

830

sent, len(client.secret)

831

- (sent_size + sent))

832

sent_size += sent

833

session.bye()

1309

finally:

1310

if approval_required:

1311

client.approvals_pending -= 1

1312

try:

1313

session.bye()

1314

except (gnutls.errors.GNUTLSError), error:

1315

logger.warning("GnuTLS bye failed")

834

1316

835

1317

@staticmethod

836

1318

def peer_certificate(session):

896

1378

return hex_fpr

897

1379

898

1380

899

class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):

900

"""Like socketserver.ForkingMixIn, but also pass a pipe."""

1381

class MultiprocessingMixIn(object):

1382

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1383

def sub_process_main(self, request, address):

1384

try:

1385

self.finish_request(request, address)

1386

except:

1387

self.handle_error(request, address)

1388

self.close_request(request)

1389

1390

def process_request(self, request, address):

1391

"""Start a new process to process the request."""

1392

multiprocessing.Process(target = self.sub_process_main,

1393

args = (request, address)).start()

1394

1395

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1396

""" adds a pipe to the MixIn """

901

1397

def process_request(self, request, client_address):

902

1398

"""Overrides and wraps the original process_request().

903

1399

904

1400

This function creates a new pipe in self.pipe

905

1401

"""

906

self.pipe = os.pipe()

907

super(ForkingMixInWithPipe,

1402

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1403

1404

super(MultiprocessingMixInWithPipe,

908

1405

self).process_request(request, client_address)

909

os.close(self.pipe[1]) # close write end

910

self.add_pipe(self.pipe[0])

911

def add_pipe(self, pipe):

1406

self.child_pipe.close()

1407

self.add_pipe(parent_pipe)

1408

1409

def add_pipe(self, parent_pipe):

912

1410

"""Dummy function; override as necessary"""

913

os.close(pipe)

914

915

916

class IPv6_TCPServer(ForkingMixInWithPipe,

1411

pass

1412

1413

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

917

1414

socketserver.TCPServer, object):

918

1415

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

919

1416

983

1480

clients: set of Client objects

984

1481

gnutls_priority GnuTLS priority string

985

1482

use_dbus: Boolean; to emit D-Bus signals or not

986

clients: set of Client objects

987

gnutls_priority GnuTLS priority string

988

use_dbus: Boolean; to emit D-Bus signals or not

989

1483

990

1484

Assumes a gobject.MainLoop event loop.

991

1485

"""

1007

1501

return socketserver.TCPServer.server_activate(self)

1008

1502

def enable(self):

1009

1503

self.enabled = True

1010

def add_pipe(self, pipe):

1504

def add_pipe(self, parent_pipe):

1011

1505

# Call "handle_ipc" for both data and EOF events

1012

gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,

1013

self.handle_ipc)

1014

def handle_ipc(self, source, condition, file_objects={}):

1506

gobject.io_add_watch(parent_pipe.fileno(),

1507

gobject.IO_IN | gobject.IO_HUP,

1508

functools.partial(self.handle_ipc,

1509

parent_pipe = parent_pipe))

1510

1511

def handle_ipc(self, source, condition, parent_pipe=None,

1512

client_object=None):

1015

1513

condition_names = {

1016

1514

gobject.IO_IN: u"IN", # There is data to read.

1017

1515

gobject.IO_OUT: u"OUT", # Data can be written (without

1026

1524

for cond, name in

1027

1525

condition_names.iteritems()

1028

1526

if cond & condition)

1029

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1030

conditions_string)

1031

1032

# Turn the pipe file descriptor into a Python file object

1033

if source not in file_objects:

1034

file_objects[source] = os.fdopen(source, u"r", 1)

1035

1036

# Read a line from the file object

1037

cmdline = file_objects[source].readline()

1038

if not cmdline: # Empty line means end of file

1039

# close the IPC pipe

1040

file_objects[source].close()

1041

del file_objects[source]

1042

1043

# Stop calling this function

1044

return False

1045

1046

logger.debug(u"IPC command: %r", cmdline)

1047

1048

# Parse and act on command

1049

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1050

1051

if cmd == u"NOTFOUND":

1052

logger.warning(u"Client not found for fingerprint: %s",

1053

args)

1054

if self.use_dbus:

1055

# Emit D-Bus signal

1056

mandos_dbus_service.ClientNotFound(args)

1057

elif cmd == u"INVALID":

1058

for client in self.clients:

1059

if client.name == args:

1060

logger.warning(u"Client %s is invalid", args)

1061

if self.use_dbus:

1062

# Emit D-Bus signal

1063

client.Rejected()

1064

break

1065

else:

1066

logger.error(u"Unknown client %s is invalid", args)

1067

elif cmd == u"SENDING":

1068

for client in self.clients:

1069

if client.name == args:

1070

logger.info(u"Sending secret to %s", client.name)

1071

client.checked_ok()

1072

if self.use_dbus:

1073

# Emit D-Bus signal

1074

client.ReceivedSecret()

1075

break

1076

else:

1077

logger.error(u"Sending secret to unknown client %s",

1078

args)

1079

else:

1080

logger.error(u"Unknown IPC command: %r", cmdline)

1081

1082

# Keep calling this function

1527

# error or the other end of multiprocessing.Pipe has closed

1528

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1529

return False

1530

1531

# Read a request from the child

1532

request = parent_pipe.recv()

1533

command = request[0]

1534

1535

if command == 'init':

1536

fpr = request[1]

1537

address = request[2]

1538

1539

for c in self.clients:

1540

if c.fingerprint == fpr:

1541

client = c

1542

break

1543

else:

1544

logger.warning(u"Client not found for fingerprint: %s, ad"

1545

u"dress: %s", fpr, address)

1546

if self.use_dbus:

1547

# Emit D-Bus signal

1548

mandos_dbus_service.ClientNotFound(fpr, address[0])

1549

parent_pipe.send(False)

1550

return False

1551

1552

gobject.io_add_watch(parent_pipe.fileno(),

1553

gobject.IO_IN | gobject.IO_HUP,

1554

functools.partial(self.handle_ipc,

1555

parent_pipe = parent_pipe,

1556

client_object = client))

1557

parent_pipe.send(True)

1558

# remove the old hook in favor of the new above hook on same fileno

1559

return False

1560

if command == 'funcall':

1561

funcname = request[1]

1562

args = request[2]

1563

kwargs = request[3]

1564

1565

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1566

1567

if command == 'getattr':

1568

attrname = request[1]

1569

if callable(client_object.__getattribute__(attrname)):

1570

parent_pipe.send(('function',))

1571

else:

1572

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1573

1574

if command == 'setattr':

1575

attrname = request[1]

1576

value = request[2]

1577

setattr(client_object, attrname, value)

1578

1083

1579

return True

1084

1580

1085

1581

1115

1611

elif suffix == u"w":

1116

1612

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1117

1613

else:

1118

raise ValueError

1119

except (ValueError, IndexError):

1120

raise ValueError

1614

raise ValueError(u"Unknown suffix %r" % suffix)

1615

except (ValueError, IndexError), e:

1616

raise ValueError(e.message)

1121

1617

timevalue += delta

1122

1618

return timevalue

1123

1619

1136

1632

def if_nametoindex(interface):

1137

1633

"Get an interface index the hard way, i.e. using fcntl()"

1138

1634

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1139

with closing(socket.socket()) as s:

1635

with contextlib.closing(socket.socket()) as s:

1140

1636

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1141

1637

struct.pack(str(u"16s16x"),

1142

1638

interface))

1162

1658

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1163

1659

if not stat.S_ISCHR(os.fstat(null).st_mode):

1164

1660

raise OSError(errno.ENODEV,

1165

u"/dev/null not a character device")

1661

u"%s not a character device"

1662

% os.path.devnull)

1166

1663

os.dup2(null, sys.stdin.fileno())

1167

1664

os.dup2(null, sys.stdout.fileno())

1168

1665

os.dup2(null, sys.stderr.fileno())

1172

1669

1173

1670

def main():

1174

1671

1175

######################################################################

1672

##################################################################

1176

1673

# Parsing of options, both command line and config file

1177

1674

1178

1675

parser = optparse.OptionParser(version = "%%prog %s" % version)

1187

1684

parser.add_option("--debug", action=u"store_true",

1188

1685

help=u"Debug mode; run in foreground and log to"

1189

1686

u" terminal")

1687

parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",

1688

help=u"Debug level for stdout output")

1190

1689

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1191

1690

u" priority string (see GnuTLS documentation)")

1192

1691

parser.add_option("--servicename", type=u"string",

1196

1695

help=u"Directory to search for configuration"

1197

1696

u" files")

1198

1697

parser.add_option("--no-dbus", action=u"store_false",

1199

dest=u"use_dbus",

1200

help=optparse.SUPPRESS_HELP) # XXX: Not done yet

1698

dest=u"use_dbus", help=u"Do not provide D-Bus"

1699

u" system bus interface")

1201

1700

parser.add_option("--no-ipv6", action=u"store_false",

1202

1701

dest=u"use_ipv6", help=u"Do not use IPv6")

1203

1702

options = parser.parse_args()[0]

1217

1716

u"servicename": u"Mandos",

1218

1717

u"use_dbus": u"True",

1219

1718

u"use_ipv6": u"True",

1719

u"debuglevel": u"",

1220

1720

}

1221

1721

1222

1722

# Parse config file for server-global settings

1239

1739

# options, if set.

1240

1740

for option in (u"interface", u"address", u"port", u"debug",

1241

1741

u"priority", u"servicename", u"configdir",

1242

u"use_dbus", u"use_ipv6"):

1742

u"use_dbus", u"use_ipv6", u"debuglevel"):

1243

1743

value = getattr(options, option)

1244

1744

if value is not None:

1245

1745

server_settings[option] = value

1254

1754

1255

1755

# For convenience

1256

1756

debug = server_settings[u"debug"]

1757

debuglevel = server_settings[u"debuglevel"]

1257

1758

use_dbus = server_settings[u"use_dbus"]

1258

use_dbus = False # XXX: Not done yet

1259

1759

use_ipv6 = server_settings[u"use_ipv6"]

1260

1261

if not debug:

1262

syslogger.setLevel(logging.WARNING)

1263

console.setLevel(logging.WARNING)

1264

1760

1265

1761

if server_settings[u"servicename"] != u"Mandos":

1266

1762

syslogger.setFormatter(logging.Formatter

1267

1763

(u'Mandos (%s) [%%(process)d]:'

1273

1769

u"interval": u"5m",

1274

1770

u"checker": u"fping -q -- %%(host)s",

1275

1771

u"host": u"",

1772

u"approval_delay": u"0s",

1773

u"approval_duration": u"1s",

1276

1774

}

1277

1775

client_config = configparser.SafeConfigParser(client_defaults)

1278

1776

client_config.read(os.path.join(server_settings[u"configdir"],

1284

1782

tcp_server = MandosServer((server_settings[u"address"],

1285

1783

server_settings[u"port"]),

1286

1784

ClientHandler,

1287

interface=server_settings[u"interface"],

1785

interface=(server_settings[u"interface"]

1786

or None),

1288

1787

use_ipv6=use_ipv6,

1289

1788

gnutls_priority=

1290

1789

server_settings[u"priority"],

1291

1790

use_dbus=use_dbus)

1292

pidfilename = u"/var/run/mandos.pid"

1293

try:

1294

pidfile = open(pidfilename, u"w")

1295

except IOError:

1296

logger.error(u"Could not open file %r", pidfilename)

1791

if not debug:

1792

pidfilename = u"/var/run/mandos.pid"

1793

try:

1794

pidfile = open(pidfilename, u"w")

1795

except IOError:

1796

logger.error(u"Could not open file %r", pidfilename)

1297

1797

1298

1798

try:

1299

1799

uid = pwd.getpwnam(u"_mandos").pw_uid

1316

1816

if error[0] != errno.EPERM:

1317

1817

raise error

1318

1818

1319

# Enable all possible GnuTLS debugging

1819

if not debug and not debuglevel:

1820

syslogger.setLevel(logging.WARNING)

1821

console.setLevel(logging.WARNING)

1822

if debuglevel:

1823

level = getattr(logging, debuglevel.upper())

1824

syslogger.setLevel(level)

1825

console.setLevel(level)

1826

1320

1827

if debug:

1828

# Enable all possible GnuTLS debugging

1829

1321

1830

# "Use a log level over 10 to enable all debugging options."

1322

1831

# - GnuTLS manual

1323

1832

gnutls.library.functions.gnutls_global_set_log_level(11)

1328

1837

1329

1838

(gnutls.library.functions

1330

1839

.gnutls_global_set_log_function(debug_gnutls))

1840

1841

# Redirect stdin so all checkers get /dev/null

1842

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1843

os.dup2(null, sys.stdin.fileno())

1844

if null > 2:

1845

os.close(null)

1846

else:

1847

# No console logging

1848

logger.removeHandler(console)

1849

1331

1850

1332

1851

global main_loop

1333

1852

# From the Avahi example code

1336

1855

bus = dbus.SystemBus()

1337

1856

# End of Avahi example code

1338

1857

if use_dbus:

1339

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1858

try:

1859

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1860

bus, do_not_queue=True)

1861

except dbus.exceptions.NameExistsException, e:

1862

logger.error(unicode(e) + u", disabling D-Bus")

1863

use_dbus = False

1864

server_settings[u"use_dbus"] = False

1865

tcp_server.use_dbus = False

1340

1866

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1341

1867

service = AvahiService(name = server_settings[u"servicename"],

1342

1868

servicetype = u"_mandos._tcp",

1344

1870

if server_settings["interface"]:

1345

1871

service.interface = (if_nametoindex

1346

1872

(str(server_settings[u"interface"])))

1873

1874

if not debug:

1875

# Close all input and output, do double fork, etc.

1876

daemon()

1877

1878

global multiprocessing_manager

1879

multiprocessing_manager = multiprocessing.Manager()

1347

1880

1348

1881

client_class = Client

1349

1882

if use_dbus:

1350

1883

client_class = functools.partial(ClientDBus, bus = bus)

1884

def client_config_items(config, section):

1885

special_settings = {

1886

"approved_by_default":

1887

lambda: config.getboolean(section,

1888

"approved_by_default"),

1889

}

1890

for name, value in config.items(section):

1891

try:

1892

yield (name, special_settings[name]())

1893

except KeyError:

1894

yield (name, value)

1895

1351

1896

tcp_server.clients.update(set(

1352

1897

client_class(name = section,

1353

config= dict(client_config.items(section)))

1898

config= dict(client_config_items(

1899

client_config, section)))

1354

1900

for section in client_config.sections()))

1355

1901

if not tcp_server.clients:

1356

1902

logger.warning(u"No clients defined")

1357

1358

if debug:

1359

# Redirect stdin so all checkers get /dev/null

1360

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1361

os.dup2(null, sys.stdin.fileno())

1362

if null > 2:

1363

os.close(null)

1364

else:

1365

# No console logging

1366

logger.removeHandler(console)

1367

# Close all input and output, do double fork, etc.

1368

daemon()

1369

1370

try:

1371

with closing(pidfile):

1372

pid = os.getpid()

1373

pidfile.write(str(pid) + "\n")

1374

del pidfile

1375

except IOError:

1376

logger.error(u"Could not write to file %r with PID %d",

1377

pidfilename, pid)

1378

except NameError:

1379

# "pidfile" was never created

1380

pass

1381

del pidfilename

1382

1383

def cleanup():

1384

"Cleanup function; run on exit"

1385

service.cleanup()

1386

1903

1387

while tcp_server.clients:

1388

client = tcp_server.clients.pop()

1389

client.disable_hook = None

1390

client.disable()

1391

1392

atexit.register(cleanup)

1393

1394

1904

if not debug:

1905

try:

1906

with pidfile:

1907

pid = os.getpid()

1908

pidfile.write(str(pid) + "\n")

1909

del pidfile

1910

except IOError:

1911

logger.error(u"Could not write to file %r with PID %d",

1912

pidfilename, pid)

1913

except NameError:

1914

# "pidfile" was never created

1915

pass

1916

del pidfilename

1917

1395

1918

signal.signal(signal.SIGINT, signal.SIG_IGN)

1919

1396

1920

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1397

1921

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1398

1922

1403

1927

dbus.service.Object.__init__(self, bus, u"/")

1404

1928

_interface = u"se.bsnet.fukt.Mandos"

1405

1929

1406

@dbus.service.signal(_interface, signature=u"oa{sv}")

1407

def ClientAdded(self, objpath, properties):

1930

@dbus.service.signal(_interface, signature=u"o")

1931

def ClientAdded(self, objpath):

1408

1932

"D-Bus signal"

1409

1933

pass

1410

1934

1411

@dbus.service.signal(_interface, signature=u"s")

1412

def ClientNotFound(self, fingerprint):

1935

@dbus.service.signal(_interface, signature=u"ss")

1936

def ClientNotFound(self, fingerprint, address):

1413

1937

"D-Bus signal"

1414

1938

pass

1415

1939

1429

1953

def GetAllClientsWithProperties(self):

1430

1954

"D-Bus method"

1431

1955

return dbus.Dictionary(

1432

((c.dbus_object_path, c.GetAllProperties())

1956

((c.dbus_object_path, c.GetAll(u""))

1433

1957

for c in tcp_server.clients),

1434

1958

signature=u"oa{sv}")

1435

1959

1441

1965

tcp_server.clients.remove(c)

1442

1966

c.remove_from_connection()

1443

1967

# Don't signal anything except ClientRemoved

1444

c.disable(signal=False)

1968

c.disable(quiet=True)

1445

1969

# Emit D-Bus signal

1446

1970

self.ClientRemoved(object_path, c.name)

1447

1971

return

1448

raise KeyError

1972

raise KeyError(object_path)

1449

1973

1450

1974

del _interface

1451

1975

1452

1976

mandos_dbus_service = MandosDBusService()

1453

1977

1978

def cleanup():

1979

"Cleanup function; run on exit"

1980

service.cleanup()

1981

1982

while tcp_server.clients:

1983

client = tcp_server.clients.pop()

1984

if use_dbus:

1985

client.remove_from_connection()

1986

client.disable_hook = None

1987

# Don't signal anything except ClientRemoved

1988

client.disable(quiet=True)

1989

if use_dbus:

1990

# Emit D-Bus signal

1991

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

1992

client.name)

1993

1994

atexit.register(cleanup)

1995

1454

1996

for client in tcp_server.clients:

1455

1997

if use_dbus:

1456

1998

# Emit D-Bus signal

1457

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1458

client.GetAllProperties())

1999

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1459

2000

client.enable()

1460

2001

1461

2002

tcp_server.enable()

1479

2020

service.activate()

1480

2021

except dbus.exceptions.DBusException, error:

1481

2022

logger.critical(u"DBusException: %s", error)

2023

cleanup()

1482

2024

sys.exit(1)

1483

2025

# End of Avahi example code

1484

2026

1491

2033

main_loop.run()

1492

2034

except AvahiError, error:

1493

2035

logger.critical(u"AvahiError: %s", error)

2036

cleanup()

1494

2037

sys.exit(1)

1495

2038

except KeyboardInterrupt:

1496

2039

if debug:

1497

2040

print >> sys.stderr

1498

2041

logger.debug(u"Server received KeyboardInterrupt")

1499

2042

logger.debug(u"Server exiting")

2043

# Must run before the D-Bus bus name gets deregistered

2044

cleanup()

1500

2045

1501

2046

if __name__ == '__main__':

1502

2047

main()