/mandos/trunk : revision 369

55

import logging

56

import logging.handlers

57

import pwd

58

import contextlib

58

from contextlib import closing

59

import struct

60

import fcntl

61

import functools

62

import cPickle as pickle

63

import multiprocessing

64

62

65

63

import dbus

66

64

import dbus.service

69

67

from dbus.mainloop.glib import DBusGMainLoop

70

68

import ctypes

71

69

import ctypes.util

72

import xml.dom.minidom

73

import inspect

74

70

75

71

try:

76

72

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

81

77

SO_BINDTODEVICE = None

82

78

83

79

84

version = "1.0.14"

80

version = "1.0.11"

85

81

86

#logger = logging.getLogger(u'mandos')

87

82

logger = logging.Logger(u'mandos')

88

83

syslogger = (logging.handlers.SysLogHandler

89

84

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

157

152

u" after %i retries, exiting.",

158

153

self.rename_count)

159

154

raise AvahiServiceError(u"Too many renames")

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

155

self.name = self.server.GetAlternativeServiceName(self.name)

161

156

logger.info(u"Changing Zeroconf service name to %r ...",

162

self.name)

157

unicode(self.name))

163

158

syslogger.setFormatter(logging.Formatter

164

159

(u'Mandos (%s) [%%(process)d]:'

165

160

u' %%(levelname)s: %%(message)s'

166

161

% self.name))

167

162

self.remove()

168

try:

169

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

172

self.cleanup()

173

os._exit(1)

163

self.add()

174

164

self.rename_count += 1

175

165

def remove(self):

176

166

"""Derived from the Avahi example code"""

184

174

self.server.EntryGroupNew()),

185

175

avahi.DBUS_INTERFACE_ENTRY_GROUP)

186

176

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

177

self.entry_group_state_changed)

189

178

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

190

179

self.name, self.type)

191

180

self.group.AddService(

199

188

self.group.Commit()

200

189

def entry_group_state_changed(self, state, error):

201

190

"""Derived from the Avahi example code"""

202

logger.debug(u"Avahi entry group state change: %i", state)

191

logger.debug(u"Avahi state change: %i", state)

203

192

204

193

if state == avahi.ENTRY_GROUP_ESTABLISHED:

205

194

logger.debug(u"Zeroconf service established.")

218

207

self.group = None

219

208

def server_state_changed(self, state):

220

209

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

222

210

if state == avahi.SERVER_COLLISION:

223

211

logger.error(u"Zeroconf server name collision")

224

212

self.remove()

251

239

enabled: bool()

252

240

last_checked_ok: datetime.datetime(); (UTC) or None

253

241

timeout: datetime.timedelta(); How long from last_checked_ok

254

until this client is disabled

242

until this client is invalid

255

243

interval: datetime.timedelta(); How often to start a new checker

256

244

disable_hook: If set, called by disable() as disable_hook(self)

257

245

checker: subprocess.Popen(); a running checker process used

258

246

to see if the client lives.

259

247

'None' if no process is running.

260

248

checker_initiator_tag: a gobject event source tag, or None

261

disable_initiator_tag: - '' -

249

disable_initiator_tag: - '' -

262

250

checker_callback_tag: - '' -

263

251

checker_command: string; External command which is run to check if

264

252

client lives. %() expansions are done at

265

253

runtime with vars(self) as dict, so that for

266

254

instance %(name)s can be used in the command.

267

255

current_checker_command: string; current running checker_command

268

approval_delay: datetime.timedelta(); Time to wait for approval

269

_approved: bool(); 'None' if not yet approved/disapproved

270

approval_duration: datetime.timedelta(); Duration of one approval

271

256

"""

272

257

273

258

@staticmethod

274

def _timedelta_to_milliseconds(td):

275

"Convert a datetime.timedelta() to milliseconds"

276

return ((td.days * 24 * 60 * 60 * 1000)

277

+ (td.seconds * 1000)

278

+ (td.microseconds // 1000))

259

def _datetime_to_milliseconds(dt):

260

"Convert a datetime.datetime() to milliseconds"

261

return ((dt.days * 24 * 60 * 60 * 1000)

262

+ (dt.seconds * 1000)

263

+ (dt.microseconds // 1000))

279

264

280

265

def timeout_milliseconds(self):

281

266

"Return the 'timeout' attribute in milliseconds"

282

return self._timedelta_to_milliseconds(self.timeout)

267

return self._datetime_to_milliseconds(self.timeout)

283

268

284

269

def interval_milliseconds(self):

285

270

"Return the 'interval' attribute in milliseconds"

286

return self._timedelta_to_milliseconds(self.interval)

287

288

def approval_delay_milliseconds(self):

289

return self._timedelta_to_milliseconds(self.approval_delay)

271

return self._datetime_to_milliseconds(self.interval)

290

272

291

273

def __init__(self, name = None, disable_hook=None, config=None):

292

274

"""Note: the 'checker' key in 'config' sets the

305

287

if u"secret" in config:

306

288

self.secret = config[u"secret"].decode(u"base64")

307

289

elif u"secfile" in config:

308

with open(os.path.expanduser(os.path.expandvars

309

(config[u"secfile"])),

310

"rb") as secfile:

290

with closing(open(os.path.expanduser

291

(os.path.expandvars

292

(config[u"secfile"])))) as secfile:

311

293

self.secret = secfile.read()

312

294

else:

313

295

raise TypeError(u"No secret or secfile for client %s"

327

309

self.checker_command = config[u"checker"]

328

310

self.current_checker_command = None

329

311

self.last_connect = None

330

self._approved = None

331

self.approved_by_default = config.get(u"approved_by_default",

332

True)

333

self.approvals_pending = 0

334

self.approval_delay = string_to_delta(

335

config[u"approval_delay"])

336

self.approval_duration = string_to_delta(

337

config[u"approval_duration"])

338

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

339

312

340

def send_changedstate(self):

341

self.changedstate.acquire()

342

self.changedstate.notify_all()

343

self.changedstate.release()

344

345

313

def enable(self):

346

314

"""Start this client's checker and timeout hooks"""

347

315

if getattr(self, u"enabled", False):

348

316

# Already enabled

349

317

return

350

self.send_changedstate()

351

318

self.last_enabled = datetime.datetime.utcnow()

352

319

# Schedule a new checker to be started an 'interval' from now,

353

320

# and every interval from then on.

354

321

self.checker_initiator_tag = (gobject.timeout_add

355

322

(self.interval_milliseconds(),

356

323

self.start_checker))

324

# Also start a new checker *right now*.

325

self.start_checker()

357

326

# Schedule a disable() when 'timeout' has passed

358

327

self.disable_initiator_tag = (gobject.timeout_add

359

328

(self.timeout_milliseconds(),

360

329

self.disable))

361

330

self.enabled = True

362

# Also start a new checker *right now*.

363

self.start_checker()

364

331

365

def disable(self, quiet=True):

332

def disable(self):

366

333

"""Disable this client."""

367

334

if not getattr(self, "enabled", False):

368

335

return False

369

if not quiet:

370

self.send_changedstate()

371

if not quiet:

372

logger.info(u"Disabling client %s", self.name)

336

logger.info(u"Disabling client %s", self.name)

373

337

if getattr(self, u"disable_initiator_tag", False):

374

338

gobject.source_remove(self.disable_initiator_tag)

375

339

self.disable_initiator_tag = None

427

391

# client would inevitably timeout, since no checker would get

428

392

# a chance to run to completion. If we instead leave running

429

393

# checkers alone, the checker would have to take more time

430

# than 'timeout' for the client to be disabled, which is as it

431

# should be.

394

# than 'timeout' for the client to be declared invalid, which

395

# is as it should be.

432

396

433

397

# If a checker exists, make sure it is not a zombie

434

try:

398

if self.checker is not None:

435

399

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

436

except (AttributeError, OSError), error:

437

if (isinstance(error, OSError)

438

and error.errno != errno.ECHILD):

439

raise error

440

else:

441

400

if pid:

442

401

logger.warning(u"Checker was a zombie")

443

402

gobject.source_remove(self.checker_callback_tag)

499

458

logger.debug(u"Stopping checker for %(name)s", vars(self))

500

459

try:

501

460

os.kill(self.checker.pid, signal.SIGTERM)

502

#time.sleep(0.5)

461

#os.sleep(0.5)

503

462

#if self.checker.poll() is None:

504

463

# os.kill(self.checker.pid, signal.SIGKILL)

505

464

except OSError, error:

506

465

if error.errno != errno.ESRCH: # No such process

507

466

raise

508

467

self.checker = None

509

510

def dbus_service_property(dbus_interface, signature=u"v",

511

access=u"readwrite", byte_arrays=False):

512

"""Decorators for marking methods of a DBusObjectWithProperties to

513

become properties on the D-Bus.

514

515

The decorated method will be called with no arguments by "Get"

516

and with one argument by "Set".

517

518

The parameters, where they are supported, are the same as

519

dbus.service.method, except there is only "signature", since the

520

type from Get() and the type sent to Set() is the same.

521

"""

522

# Encoding deeply encoded byte arrays is not supported yet by the

523

# "Set" method, so we fail early here:

524

if byte_arrays and signature != u"ay":

525

raise ValueError(u"Byte arrays not supported for non-'ay'"

526

u" signature %r" % signature)

527

def decorator(func):

528

func._dbus_is_property = True

529

func._dbus_interface = dbus_interface

530

func._dbus_signature = signature

531

func._dbus_access = access

532

func._dbus_name = func.__name__

533

if func._dbus_name.endswith(u"_dbus_property"):

534

func._dbus_name = func._dbus_name[:-14]

535

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

536

return func

537

return decorator

538

539

540

class DBusPropertyException(dbus.exceptions.DBusException):

541

"""A base class for D-Bus property-related exceptions

542

"""

543

def __unicode__(self):

544

return unicode(str(self))

545

546

547

class DBusPropertyAccessException(DBusPropertyException):

548

"""A property's access permissions disallows an operation.

549

"""

550

pass

551

552

553

class DBusPropertyNotFound(DBusPropertyException):

554

"""An attempt was made to access a non-existing property.

555

"""

556

pass

557

558

559

class DBusObjectWithProperties(dbus.service.Object):

560

"""A D-Bus object with properties.

561

562

Classes inheriting from this can use the dbus_service_property

563

decorator to expose methods as D-Bus properties. It exposes the

564

standard Get(), Set(), and GetAll() methods on the D-Bus.

565

"""

566

567

@staticmethod

568

def _is_dbus_property(obj):

569

return getattr(obj, u"_dbus_is_property", False)

570

571

def _get_all_dbus_properties(self):

572

"""Returns a generator of (name, attribute) pairs

573

"""

574

return ((prop._dbus_name, prop)

575

for name, prop in

576

inspect.getmembers(self, self._is_dbus_property))

577

578

def _get_dbus_property(self, interface_name, property_name):

579

"""Returns a bound method if one exists which is a D-Bus

580

property with the specified name and interface.

581

"""

582

for name in (property_name,

583

property_name + u"_dbus_property"):

584

prop = getattr(self, name, None)

585

if (prop is None

586

or not self._is_dbus_property(prop)

587

or prop._dbus_name != property_name

588

or (interface_name and prop._dbus_interface

589

and interface_name != prop._dbus_interface)):

590

continue

591

return prop

592

# No such property

593

raise DBusPropertyNotFound(self.dbus_object_path + u":"

594

+ interface_name + u"."

595

+ property_name)

596

597

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

598

out_signature=u"v")

599

def Get(self, interface_name, property_name):

600

"""Standard D-Bus property Get() method, see D-Bus standard.

601

"""

602

prop = self._get_dbus_property(interface_name, property_name)

603

if prop._dbus_access == u"write":

604

raise DBusPropertyAccessException(property_name)

605

value = prop()

606

if not hasattr(value, u"variant_level"):

607

return value

608

return type(value)(value, variant_level=value.variant_level+1)

609

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

611

def Set(self, interface_name, property_name, value):

612

"""Standard D-Bus property Set() method, see D-Bus standard.

613

"""

614

prop = self._get_dbus_property(interface_name, property_name)

615

if prop._dbus_access == u"read":

616

raise DBusPropertyAccessException(property_name)

617

if prop._dbus_get_args_options[u"byte_arrays"]:

618

# The byte_arrays option is not supported yet on

619

# signatures other than "ay".

620

if prop._dbus_signature != u"ay":

621

raise ValueError

622

value = dbus.ByteArray(''.join(unichr(byte)

623

for byte in value))

624

prop(value)

625

626

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

627

out_signature=u"a{sv}")

628

def GetAll(self, interface_name):

629

"""Standard D-Bus property GetAll() method, see D-Bus

630

standard.

631

632

Note: Will not include properties with access="write".

633

"""

634

all = {}

635

for name, prop in self._get_all_dbus_properties():

636

if (interface_name

637

and interface_name != prop._dbus_interface):

638

# Interface non-empty but did not match

639

continue

640

# Ignore write-only properties

641

if prop._dbus_access == u"write":

642

continue

643

value = prop()

644

if not hasattr(value, u"variant_level"):

645

all[name] = value

646

continue

647

all[name] = type(value)(value, variant_level=

648

value.variant_level+1)

649

return dbus.Dictionary(all, signature=u"sv")

650

651

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

652

out_signature=u"s",

653

path_keyword='object_path',

654

connection_keyword='connection')

655

def Introspect(self, object_path, connection):

656

"""Standard D-Bus method, overloaded to insert property tags.

657

"""

658

xmlstring = dbus.service.Object.Introspect(self, object_path,

659

connection)

660

try:

661

document = xml.dom.minidom.parseString(xmlstring)

662

def make_tag(document, name, prop):

663

e = document.createElement(u"property")

664

e.setAttribute(u"name", name)

665

e.setAttribute(u"type", prop._dbus_signature)

666

e.setAttribute(u"access", prop._dbus_access)

667

return e

668

for if_tag in document.getElementsByTagName(u"interface"):

669

for tag in (make_tag(document, name, prop)

670

for name, prop

671

in self._get_all_dbus_properties()

672

if prop._dbus_interface

673

== if_tag.getAttribute(u"name")):

674

if_tag.appendChild(tag)

675

# Add the names to the return values for the

676

# "org.freedesktop.DBus.Properties" methods

677

if (if_tag.getAttribute(u"name")

678

== u"org.freedesktop.DBus.Properties"):

679

for cn in if_tag.getElementsByTagName(u"method"):

680

if cn.getAttribute(u"name") == u"Get":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"value")

685

elif cn.getAttribute(u"name") == u"GetAll":

686

for arg in cn.getElementsByTagName(u"arg"):

687

if (arg.getAttribute(u"direction")

688

== u"out"):

689

arg.setAttribute(u"name", u"props")

690

xmlstring = document.toxml(u"utf-8")

691

document.unlink()

692

except (AttributeError, xml.dom.DOMException,

693

xml.parsers.expat.ExpatError), error:

694

logger.error(u"Failed to override Introspection method",

695

error)

696

return xmlstring

697

698

699

class ClientDBus(Client, DBusObjectWithProperties):

468

469

def still_valid(self):

470

"""Has the timeout not yet passed for this client?"""

471

if not getattr(self, u"enabled", False):

472

return False

473

now = datetime.datetime.utcnow()

474

if self.last_checked_ok is None:

475

return now < (self.created + self.timeout)

476

else:

477

return now < (self.last_checked_ok + self.timeout)

478

479

480

class ClientDBus(Client, dbus.service.Object):

700

481

"""A Client class using D-Bus

701

482

702

483

Attributes:

706

487

# dbus.service.Object doesn't use super(), so we can't either.

707

488

708

489

def __init__(self, bus = None, *args, **kwargs):

709

self._approvals_pending = 0

710

490

self.bus = bus

711

491

Client.__init__(self, *args, **kwargs)

712

492

# Only now, when this client is initialized, can it show up on

714

494

self.dbus_object_path = (dbus.ObjectPath

715

495

(u"/clients/"

716

496

+ self.name.replace(u".", u"_")))

717

DBusObjectWithProperties.__init__(self, self.bus,

718

self.dbus_object_path)

719

720

def _get_approvals_pending(self):

721

return self._approvals_pending

722

def _set_approvals_pending(self, value):

723

old_value = self._approvals_pending

724

self._approvals_pending = value

725

bval = bool(value)

726

if (hasattr(self, "dbus_object_path")

727

and bval is not bool(old_value)):

728

dbus_bool = dbus.Boolean(bval, variant_level=1)

729

self.PropertyChanged(dbus.String(u"ApprovalPending"),

730

dbus_bool)

731

732

approvals_pending = property(_get_approvals_pending,

733

_set_approvals_pending)

734

del _get_approvals_pending, _set_approvals_pending

497

dbus.service.Object.__init__(self, self.bus,

498

self.dbus_object_path)

735

499

736

500

@staticmethod

737

501

def _datetime_to_dbus(dt, variant_level=0):

744

508

r = Client.enable(self)

745

509

if oldstate != self.enabled:

746

510

# Emit D-Bus signals

747

self.PropertyChanged(dbus.String(u"Enabled"),

511

self.PropertyChanged(dbus.String(u"enabled"),

748

512

dbus.Boolean(True, variant_level=1))

749

513

self.PropertyChanged(

750

dbus.String(u"LastEnabled"),

514

dbus.String(u"last_enabled"),

751

515

self._datetime_to_dbus(self.last_enabled,

752

516

variant_level=1))

753

517

return r

754

518

755

def disable(self, quiet = False):

519

def disable(self, signal = True):

756

520

oldstate = getattr(self, u"enabled", False)

757

r = Client.disable(self, quiet=quiet)

758

if not quiet and oldstate != self.enabled:

521

r = Client.disable(self)

522

if signal and oldstate != self.enabled:

759

523

# Emit D-Bus signal

760

self.PropertyChanged(dbus.String(u"Enabled"),

524

self.PropertyChanged(dbus.String(u"enabled"),

761

525

dbus.Boolean(False, variant_level=1))

762

526

return r

763

527

766

530

self.remove_from_connection()

767

531

except LookupError:

768

532

pass

769

if hasattr(DBusObjectWithProperties, u"__del__"):

770

DBusObjectWithProperties.__del__(self, *args, **kwargs)

533

if hasattr(dbus.service.Object, u"__del__"):

534

dbus.service.Object.__del__(self, *args, **kwargs)

771

535

Client.__del__(self, *args, **kwargs)

772

536

773

537

def checker_callback(self, pid, condition, command,

775

539

self.checker_callback_tag = None

776

540

self.checker = None

777

541

# Emit D-Bus signal

778

self.PropertyChanged(dbus.String(u"CheckerRunning"),

542

self.PropertyChanged(dbus.String(u"checker_running"),

779

543

dbus.Boolean(False, variant_level=1))

780

544

if os.WIFEXITED(condition):

781

545

exitstatus = os.WEXITSTATUS(condition)

796

560

r = Client.checked_ok(self, *args, **kwargs)

797

561

# Emit D-Bus signal

798

562

self.PropertyChanged(

799

dbus.String(u"LastCheckedOK"),

563

dbus.String(u"last_checked_ok"),

800

564

(self._datetime_to_dbus(self.last_checked_ok,

801

565

variant_level=1)))

802

566

return r

814

578

# Emit D-Bus signal

815

579

self.CheckerStarted(self.current_checker_command)

816

580

self.PropertyChanged(

817

dbus.String(u"CheckerRunning"),

581

dbus.String(u"checker_running"),

818

582

dbus.Boolean(True, variant_level=1))

819

583

return r

820

584

823

587

r = Client.stop_checker(self, *args, **kwargs)

824

588

if (old_checker is not None

825

589

and getattr(self, u"checker", None) is None):

826

self.PropertyChanged(dbus.String(u"CheckerRunning"),

590

self.PropertyChanged(dbus.String(u"checker_running"),

827

591

dbus.Boolean(False, variant_level=1))

828

592

return r

829

830

def _reset_approved(self):

831

self._approved = None

832

return False

833

834

def approve(self, value=True):

835

self.send_changedstate()

836

self._approved = value

837

gobject.timeout_add(self._timedelta_to_milliseconds

838

(self.approval_duration),

839

self._reset_approved)

840

841

842

## D-Bus methods, signals & properties

593

594

## D-Bus methods & signals

843

595

_interface = u"se.bsnet.fukt.Mandos.Client"

844

596

845

## Signals

597

# CheckedOK - method

598

@dbus.service.method(_interface)

599

def CheckedOK(self):

600

return self.checked_ok()

846

601

847

602

# CheckerCompleted - signal

848

603

@dbus.service.signal(_interface, signature=u"nxs")

856

611

"D-Bus signal"

857

612

pass

858

613

614

# GetAllProperties - method

615

@dbus.service.method(_interface, out_signature=u"a{sv}")

616

def GetAllProperties(self):

617

"D-Bus method"

618

return dbus.Dictionary({

619

dbus.String(u"name"):

620

dbus.String(self.name, variant_level=1),

621

dbus.String(u"fingerprint"):

622

dbus.String(self.fingerprint, variant_level=1),

623

dbus.String(u"host"):

624

dbus.String(self.host, variant_level=1),

625

dbus.String(u"created"):

626

self._datetime_to_dbus(self.created,

627

variant_level=1),

628

dbus.String(u"last_enabled"):

629

(self._datetime_to_dbus(self.last_enabled,

630

variant_level=1)

631

if self.last_enabled is not None

632

else dbus.Boolean(False, variant_level=1)),

633

dbus.String(u"enabled"):

634

dbus.Boolean(self.enabled, variant_level=1),

635

dbus.String(u"last_checked_ok"):

636

(self._datetime_to_dbus(self.last_checked_ok,

637

variant_level=1)

638

if self.last_checked_ok is not None

639

else dbus.Boolean (False, variant_level=1)),

640

dbus.String(u"timeout"):

641

dbus.UInt64(self.timeout_milliseconds(),

642

variant_level=1),

643

dbus.String(u"interval"):

644

dbus.UInt64(self.interval_milliseconds(),

645

variant_level=1),

646

dbus.String(u"checker"):

647

dbus.String(self.checker_command,

648

variant_level=1),

649

dbus.String(u"checker_running"):

650

dbus.Boolean(self.checker is not None,

651

variant_level=1),

652

dbus.String(u"object_path"):

653

dbus.ObjectPath(self.dbus_object_path,

654

variant_level=1)

655

}, signature=u"sv")

656

657

# IsStillValid - method

658

@dbus.service.method(_interface, out_signature=u"b")

659

def IsStillValid(self):

660

return self.still_valid()

661

859

662

# PropertyChanged - signal

860

663

@dbus.service.signal(_interface, signature=u"sv")

861

664

def PropertyChanged(self, property, value):

862

665

"D-Bus signal"

863

666

pass

864

667

865

# GotSecret - signal

668

# ReceivedSecret - signal

866

669

@dbus.service.signal(_interface)

867

def GotSecret(self):

868

"""D-Bus signal

869

Is sent after a successful transfer of secret from the Mandos

870

server to mandos-client

871

"""

670

def ReceivedSecret(self):

671

"D-Bus signal"

872

672

pass

873

673

874

674

# Rejected - signal

875

@dbus.service.signal(_interface, signature=u"s")

876

def Rejected(self, reason):

877

"D-Bus signal"

878

pass

879

880

# NeedApproval - signal

881

@dbus.service.signal(_interface, signature=u"tb")

882

def NeedApproval(self, timeout, default):

883

"D-Bus signal"

884

pass

885

886

## Methods

887

888

# Approve - method

889

@dbus.service.method(_interface, in_signature=u"b")

890

def Approve(self, value):

891

self.approve(value)

892

893

# CheckedOK - method

894

@dbus.service.method(_interface)

895

def CheckedOK(self):

896

return self.checked_ok()

675

@dbus.service.signal(_interface)

676

def Rejected(self):

677

"D-Bus signal"

678

pass

679

680

# SetChecker - method

681

@dbus.service.method(_interface, in_signature=u"s")

682

def SetChecker(self, checker):

683

"D-Bus setter method"

684

self.checker_command = checker

685

# Emit D-Bus signal

686

self.PropertyChanged(dbus.String(u"checker"),

687

dbus.String(self.checker_command,

688

variant_level=1))

689

690

# SetHost - method

691

@dbus.service.method(_interface, in_signature=u"s")

692

def SetHost(self, host):

693

"D-Bus setter method"

694

self.host = host

695

# Emit D-Bus signal

696

self.PropertyChanged(dbus.String(u"host"),

697

dbus.String(self.host, variant_level=1))

698

699

# SetInterval - method

700

@dbus.service.method(_interface, in_signature=u"t")

701

def SetInterval(self, milliseconds):

702

self.interval = datetime.timedelta(0, 0, 0, milliseconds)

703

# Emit D-Bus signal

704

self.PropertyChanged(dbus.String(u"interval"),

705

(dbus.UInt64(self.interval_milliseconds(),

706

variant_level=1)))

707

708

# SetSecret - method

709

@dbus.service.method(_interface, in_signature=u"ay",

710

byte_arrays=True)

711

def SetSecret(self, secret):

712

"D-Bus setter method"

713

self.secret = str(secret)

714

715

# SetTimeout - method

716

@dbus.service.method(_interface, in_signature=u"t")

717

def SetTimeout(self, milliseconds):

718

self.timeout = datetime.timedelta(0, 0, 0, milliseconds)

719

# Emit D-Bus signal

720

self.PropertyChanged(dbus.String(u"timeout"),

721

(dbus.UInt64(self.timeout_milliseconds(),

722

variant_level=1)))

897

723

898

724

# Enable - method

899

725

@dbus.service.method(_interface)

918

744

def StopChecker(self):

919

745

self.stop_checker()

920

746

921

## Properties

922

923

# ApprovalPending - property

924

@dbus_service_property(_interface, signature=u"b", access=u"read")

925

def ApprovalPending_dbus_property(self):

926

return dbus.Boolean(bool(self.approvals_pending))

927

928

# ApprovedByDefault - property

929

@dbus_service_property(_interface, signature=u"b",

930

access=u"readwrite")

931

def ApprovedByDefault_dbus_property(self, value=None):

932

if value is None: # get

933

return dbus.Boolean(self.approved_by_default)

934

self.approved_by_default = bool(value)

935

# Emit D-Bus signal

936

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

937

dbus.Boolean(value, variant_level=1))

938

939

# ApprovalDelay - property

940

@dbus_service_property(_interface, signature=u"t",

941

access=u"readwrite")

942

def ApprovalDelay_dbus_property(self, value=None):

943

if value is None: # get

944

return dbus.UInt64(self.approval_delay_milliseconds())

945

self.approval_delay = datetime.timedelta(0, 0, 0, value)

946

# Emit D-Bus signal

947

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

948

dbus.UInt64(value, variant_level=1))

949

950

# ApprovalDuration - property

951

@dbus_service_property(_interface, signature=u"t",

952

access=u"readwrite")

953

def ApprovalDuration_dbus_property(self, value=None):

954

if value is None: # get

955

return dbus.UInt64(self._timedelta_to_milliseconds(

956

self.approval_duration))

957

self.approval_duration = datetime.timedelta(0, 0, 0, value)

958

# Emit D-Bus signal

959

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

960

dbus.UInt64(value, variant_level=1))

961

962

# Name - property

963

@dbus_service_property(_interface, signature=u"s", access=u"read")

964

def Name_dbus_property(self):

965

return dbus.String(self.name)

966

967

# Fingerprint - property

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

969

def Fingerprint_dbus_property(self):

970

return dbus.String(self.fingerprint)

971

972

# Host - property

973

@dbus_service_property(_interface, signature=u"s",

974

access=u"readwrite")

975

def Host_dbus_property(self, value=None):

976

if value is None: # get

977

return dbus.String(self.host)

978

self.host = value

979

# Emit D-Bus signal

980

self.PropertyChanged(dbus.String(u"Host"),

981

dbus.String(value, variant_level=1))

982

983

# Created - property

984

@dbus_service_property(_interface, signature=u"s", access=u"read")

985

def Created_dbus_property(self):

986

return dbus.String(self._datetime_to_dbus(self.created))

987

988

# LastEnabled - property

989

@dbus_service_property(_interface, signature=u"s", access=u"read")

990

def LastEnabled_dbus_property(self):

991

if self.last_enabled is None:

992

return dbus.String(u"")

993

return dbus.String(self._datetime_to_dbus(self.last_enabled))

994

995

# Enabled - property

996

@dbus_service_property(_interface, signature=u"b",

997

access=u"readwrite")

998

def Enabled_dbus_property(self, value=None):

999

if value is None: # get

1000

return dbus.Boolean(self.enabled)

1001

if value:

1002

self.enable()

1003

else:

1004

self.disable()

1005

1006

# LastCheckedOK - property

1007

@dbus_service_property(_interface, signature=u"s",

1008

access=u"readwrite")

1009

def LastCheckedOK_dbus_property(self, value=None):

1010

if value is not None:

1011

self.checked_ok()

1012

return

1013

if self.last_checked_ok is None:

1014

return dbus.String(u"")

1015

return dbus.String(self._datetime_to_dbus(self

1016

.last_checked_ok))

1017

1018

# Timeout - property

1019

@dbus_service_property(_interface, signature=u"t",

1020

access=u"readwrite")

1021

def Timeout_dbus_property(self, value=None):

1022

if value is None: # get

1023

return dbus.UInt64(self.timeout_milliseconds())

1024

self.timeout = datetime.timedelta(0, 0, 0, value)

1025

# Emit D-Bus signal

1026

self.PropertyChanged(dbus.String(u"Timeout"),

1027

dbus.UInt64(value, variant_level=1))

1028

if getattr(self, u"disable_initiator_tag", None) is None:

1029

return

1030

# Reschedule timeout

1031

gobject.source_remove(self.disable_initiator_tag)

1032

self.disable_initiator_tag = None

1033

time_to_die = (self.

1034

_timedelta_to_milliseconds((self

1035

.last_checked_ok

1036

+ self.timeout)

1037

- datetime.datetime

1038

.utcnow()))

1039

if time_to_die <= 0:

1040

# The timeout has passed

1041

self.disable()

1042

else:

1043

self.disable_initiator_tag = (gobject.timeout_add

1044

(time_to_die, self.disable))

1045

1046

# Interval - property

1047

@dbus_service_property(_interface, signature=u"t",

1048

access=u"readwrite")

1049

def Interval_dbus_property(self, value=None):

1050

if value is None: # get

1051

return dbus.UInt64(self.interval_milliseconds())

1052

self.interval = datetime.timedelta(0, 0, 0, value)

1053

# Emit D-Bus signal

1054

self.PropertyChanged(dbus.String(u"Interval"),

1055

dbus.UInt64(value, variant_level=1))

1056

if getattr(self, u"checker_initiator_tag", None) is None:

1057

return

1058

# Reschedule checker run

1059

gobject.source_remove(self.checker_initiator_tag)

1060

self.checker_initiator_tag = (gobject.timeout_add

1061

(value, self.start_checker))

1062

self.start_checker() # Start one now, too

1063

1064

# Checker - property

1065

@dbus_service_property(_interface, signature=u"s",

1066

access=u"readwrite")

1067

def Checker_dbus_property(self, value=None):

1068

if value is None: # get

1069

return dbus.String(self.checker_command)

1070

self.checker_command = value

1071

# Emit D-Bus signal

1072

self.PropertyChanged(dbus.String(u"Checker"),

1073

dbus.String(self.checker_command,

1074

variant_level=1))

1075

1076

# CheckerRunning - property

1077

@dbus_service_property(_interface, signature=u"b",

1078

access=u"readwrite")

1079

def CheckerRunning_dbus_property(self, value=None):

1080

if value is None: # get

1081

return dbus.Boolean(self.checker is not None)

1082

if value:

1083

self.start_checker()

1084

else:

1085

self.stop_checker()

1086

1087

# ObjectPath - property

1088

@dbus_service_property(_interface, signature=u"o", access=u"read")

1089

def ObjectPath_dbus_property(self):

1090

return self.dbus_object_path # is already a dbus.ObjectPath

1091

1092

# Secret = property

1093

@dbus_service_property(_interface, signature=u"ay",

1094

access=u"write", byte_arrays=True)

1095

def Secret_dbus_property(self, value):

1096

self.secret = str(value)

1097

1098

747

del _interface

1099

748

1100

749

1101

class ProxyClient(object):

1102

def __init__(self, child_pipe, fpr, address):

1103

self._pipe = child_pipe

1104

self._pipe.send(('init', fpr, address))

1105

if not self._pipe.recv():

1106

raise KeyError()

1107

1108

def __getattribute__(self, name):

1109

if(name == '_pipe'):

1110

return super(ProxyClient, self).__getattribute__(name)

1111

self._pipe.send(('getattr', name))

1112

data = self._pipe.recv()

1113

if data[0] == 'data':

1114

return data[1]

1115

if data[0] == 'function':

1116

def func(*args, **kwargs):

1117

self._pipe.send(('funcall', name, args, kwargs))

1118

return self._pipe.recv()[1]

1119

return func

1120

1121

def __setattr__(self, name, value):

1122

if(name == '_pipe'):

1123

return super(ProxyClient, self).__setattr__(name, value)

1124

self._pipe.send(('setattr', name, value))

1125

1126

1127

750

class ClientHandler(socketserver.BaseRequestHandler, object):

1128

751

"""A class to handle client connections.

1129

752

1131

754

Note: This will run in its own forked process."""

1132

755

1133

756

def handle(self):

1134

with contextlib.closing(self.server.child_pipe) as child_pipe:

1135

logger.info(u"TCP connection from: %s",

1136

unicode(self.client_address))

1137

logger.debug(u"Pipe FD: %d",

1138

self.server.child_pipe.fileno())

1139

757

logger.info(u"TCP connection from: %s",

758

unicode(self.client_address))

759

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

760

# Open IPC pipe to parent process

761

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

1140

762

session = (gnutls.connection

1141

763

.ClientSession(self.request,

1142

764

gnutls.connection

1143

765

.X509Credentials()))

1144

766

767

line = self.request.makefile().readline()

768

logger.debug(u"Protocol version: %r", line)

769

try:

770

if int(line.strip().split()[0]) > 1:

771

raise RuntimeError

772

except (ValueError, IndexError, RuntimeError), error:

773

logger.error(u"Unknown protocol version: %s", error)

774

return

775

1145

776

# Note: gnutls.connection.X509Credentials is really a

1146

777

# generic GnuTLS certificate credentials object so long as

1147

778

# no X.509 keys are added to it. Therefore, we can use it

1148

779

# here despite using OpenPGP certificates.

1149

780

1150

781

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1151

782

# u"+AES-256-CBC", u"+SHA1",

1152

783

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1158

789

(gnutls.library.functions

1159

790

.gnutls_priority_set_direct(session._c_object,

1160

791

priority, None))

1161

1162

# Start communication using the Mandos protocol

1163

# Get protocol number

1164

line = self.request.makefile().readline()

1165

logger.debug(u"Protocol version: %r", line)

1166

try:

1167

if int(line.strip().split()[0]) > 1:

1168

raise RuntimeError

1169

except (ValueError, IndexError, RuntimeError), error:

1170

logger.error(u"Unknown protocol version: %s", error)

1171

return

1172

1173

# Start GnuTLS connection

792

1174

793

try:

1175

794

session.handshake()

1176

795

except gnutls.errors.GNUTLSError, error:

1179

798

# established. Just abandon the request.

1180

799

return

1181

800

logger.debug(u"Handshake succeeded")

1182

1183

approval_required = False

1184

801

try:

1185

try:

1186

fpr = self.fingerprint(self.peer_certificate

1187

(session))

1188

except (TypeError, gnutls.errors.GNUTLSError), error:

1189

logger.warning(u"Bad certificate: %s", error)

1190

return

1191

logger.debug(u"Fingerprint: %s", fpr)

1192

1193

try:

1194

client = ProxyClient(child_pipe, fpr,

1195

self.client_address)

1196

except KeyError:

1197

return

1198

1199

if client.approval_delay:

1200

delay = client.approval_delay

1201

client.approvals_pending += 1

1202

approval_required = True

1203

1204

while True:

1205

if not client.enabled:

1206

logger.warning(u"Client %s is disabled",

1207

client.name)

1208

if self.server.use_dbus:

1209

# Emit D-Bus signal

1210

client.Rejected("Disabled")

1211

return

1212

1213

if client._approved or not client.approval_delay:

1214

#We are approved or approval is disabled

1215

break

1216

elif client._approved is None:

1217

logger.info(u"Client %s needs approval",

1218

client.name)

1219

if self.server.use_dbus:

1220

# Emit D-Bus signal

1221

client.NeedApproval(

1222

client.approval_delay_milliseconds(),

1223

client.approved_by_default)

1224

else:

1225

logger.warning(u"Client %s was not approved",

1226

client.name)

1227

if self.server.use_dbus:

1228

# Emit D-Bus signal

1229

client.Rejected("Denied")

1230

return

1231

1232

#wait until timeout or approved

1233

#x = float(client._timedelta_to_milliseconds(delay))

1234

time = datetime.datetime.now()

1235

client.changedstate.acquire()

1236

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1237

client.changedstate.release()

1238

time2 = datetime.datetime.now()

1239

if (time2 - time) >= delay:

1240

if not client.approved_by_default:

1241

logger.warning("Client %s timed out while"

1242

" waiting for approval",

1243

client.name)

1244

if self.server.use_dbus:

1245

# Emit D-Bus signal

1246

client.Rejected("Timed out")

1247

return

1248

else:

1249

break

1250

else:

1251

delay -= time2 - time

1252

1253

sent_size = 0

1254

while sent_size < len(client.secret):

1255

try:

1256

sent = session.send(client.secret[sent_size:])

1257

except (gnutls.errors.GNUTLSError), error:

1258

logger.warning("gnutls send failed")

1259

return

1260

logger.debug(u"Sent: %d, remaining: %d",

1261

sent, len(client.secret)

1262

- (sent_size + sent))

1263

sent_size += sent

1264

1265

logger.info(u"Sending secret to %s", client.name)

1266

# bump the timeout as if seen

1267

client.checked_ok()

1268

if self.server.use_dbus:

1269

# Emit D-Bus signal

1270

client.GotSecret()

802

fpr = self.fingerprint(self.peer_certificate(session))

803

except (TypeError, gnutls.errors.GNUTLSError), error:

804

logger.warning(u"Bad certificate: %s", error)

805

session.bye()

806

return

807

logger.debug(u"Fingerprint: %s", fpr)

1271

808

1272

finally:

1273

if approval_required:

1274

client.approvals_pending -= 1

1275

try:

1276

session.bye()

1277

except (gnutls.errors.GNUTLSError), error:

1278

logger.warning("GnuTLS bye failed")

809

for c in self.server.clients:

810

if c.fingerprint == fpr:

811

client = c

812

break

813

else:

814

ipc.write(u"NOTFOUND %s %s\n"

815

% (fpr, unicode(self.client_address)))

816

session.bye()

817

return

818

# Have to check if client.still_valid(), since it is

819

# possible that the client timed out while establishing

820

# the GnuTLS session.

821

if not client.still_valid():

822

ipc.write(u"INVALID %s\n" % client.name)

823

session.bye()

824

return

825

ipc.write(u"SENDING %s\n" % client.name)

826

sent_size = 0

827

while sent_size < len(client.secret):

828

sent = session.send(client.secret[sent_size:])

829

logger.debug(u"Sent: %d, remaining: %d",

830

sent, len(client.secret)

831

- (sent_size + sent))

832

sent_size += sent

833

session.bye()

1279

834

1280

835

@staticmethod

1281

836

def peer_certificate(session):

1341

896

return hex_fpr

1342

897

1343

898

1344

class MultiprocessingMixIn(object):

1345

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1346

def sub_process_main(self, request, address):

1347

try:

1348

self.finish_request(request, address)

1349

except:

1350

self.handle_error(request, address)

1351

self.close_request(request)

1352

1353

def process_request(self, request, address):

1354

"""Start a new process to process the request."""

1355

multiprocessing.Process(target = self.sub_process_main,

1356

args = (request, address)).start()

1357

1358

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1359

""" adds a pipe to the MixIn """

899

class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):

900

"""Like socketserver.ForkingMixIn, but also pass a pipe."""

1360

901

def process_request(self, request, client_address):

1361

902

"""Overrides and wraps the original process_request().

1362

903

1363

904

This function creates a new pipe in self.pipe

1364

905

"""

1365

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1366

1367

super(MultiprocessingMixInWithPipe,

906

self.pipe = os.pipe()

907

super(ForkingMixInWithPipe,

1368

908

self).process_request(request, client_address)

1369

self.child_pipe.close()

1370

self.add_pipe(parent_pipe)

1371

1372

def add_pipe(self, parent_pipe):

909

os.close(self.pipe[1]) # close write end

910

self.add_pipe(self.pipe[0])

911

def add_pipe(self, pipe):

1373

912

"""Dummy function; override as necessary"""

1374

pass

1375

1376

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

913

os.close(pipe)

914

915

916

class IPv6_TCPServer(ForkingMixInWithPipe,

1377

917

socketserver.TCPServer, object):

1378

918

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1379

919

1443

983

clients: set of Client objects

1444

984

gnutls_priority GnuTLS priority string

1445

985

use_dbus: Boolean; to emit D-Bus signals or not

986

clients: set of Client objects

987

gnutls_priority GnuTLS priority string

988

use_dbus: Boolean; to emit D-Bus signals or not

1446

989

1447

990

Assumes a gobject.MainLoop event loop.

1448

991

"""

1464

1007

return socketserver.TCPServer.server_activate(self)

1465

1008

def enable(self):

1466

1009

self.enabled = True

1467

def add_pipe(self, parent_pipe):

1010

def add_pipe(self, pipe):

1468

1011

# Call "handle_ipc" for both data and EOF events

1469

gobject.io_add_watch(parent_pipe.fileno(),

1470

gobject.IO_IN | gobject.IO_HUP,

1471

functools.partial(self.handle_ipc,

1472

parent_pipe = parent_pipe))

1473

1474

def handle_ipc(self, source, condition, parent_pipe=None,

1475

client_object=None):

1012

gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,

1013

self.handle_ipc)

1014

def handle_ipc(self, source, condition, file_objects={}):

1476

1015

condition_names = {

1477

1016

gobject.IO_IN: u"IN", # There is data to read.

1478

1017

gobject.IO_OUT: u"OUT", # Data can be written (without

1489

1028

if cond & condition)

1490

1029

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1491

1030

conditions_string)

1492

1493

# error or the other end of multiprocessing.Pipe has closed

1494

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1495

return False

1496

1497

# Read a request from the child

1498

request = parent_pipe.recv()

1499

logger.debug(u"IPC request: %s", repr(request))

1500

command = request[0]

1501

1502

if command == 'init':

1503

fpr = request[1]

1504

address = request[2]

1505

1506

for c in self.clients:

1507

if c.fingerprint == fpr:

1508

client = c

1509

break

1510

else:

1511

logger.warning(u"Client not found for fingerprint: %s, ad"

1512

u"dress: %s", fpr, address)

1513

if self.use_dbus:

1514

# Emit D-Bus signal

1515

mandos_dbus_service.ClientNotFound(fpr, address)

1516

parent_pipe.send(False)

1517

return False

1518

1519

gobject.io_add_watch(parent_pipe.fileno(),

1520

gobject.IO_IN | gobject.IO_HUP,

1521

functools.partial(self.handle_ipc,

1522

parent_pipe = parent_pipe,

1523

client_object = client))

1524

parent_pipe.send(True)

1525

# remove the old hook in favor of the new above hook on same fileno

1526

return False

1527

if command == 'funcall':

1528

funcname = request[1]

1529

args = request[2]

1530

kwargs = request[3]

1531

1532

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1533

1534

if command == 'getattr':

1535

attrname = request[1]

1536

if callable(client_object.__getattribute__(attrname)):

1537

parent_pipe.send(('function',))

1538

else:

1539

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1540

1541

if command == 'setattr':

1542

attrname = request[1]

1543

value = request[2]

1544

setattr(client_object, attrname, value)

1545

1031

1032

# Turn the pipe file descriptor into a Python file object

1033

if source not in file_objects:

1034

file_objects[source] = os.fdopen(source, u"r", 1)

1035

1036

# Read a line from the file object

1037

cmdline = file_objects[source].readline()

1038

if not cmdline: # Empty line means end of file

1039

# close the IPC pipe

1040

file_objects[source].close()

1041

del file_objects[source]

1042

1043

# Stop calling this function

1044

return False

1045

1046

logger.debug(u"IPC command: %r", cmdline)

1047

1048

# Parse and act on command

1049

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1050

1051

if cmd == u"NOTFOUND":

1052

logger.warning(u"Client not found for fingerprint: %s",

1053

args)

1054

if self.use_dbus:

1055

# Emit D-Bus signal

1056

mandos_dbus_service.ClientNotFound(args)

1057

elif cmd == u"INVALID":

1058

for client in self.clients:

1059

if client.name == args:

1060

logger.warning(u"Client %s is invalid", args)

1061

if self.use_dbus:

1062

# Emit D-Bus signal

1063

client.Rejected()

1064

break

1065

else:

1066

logger.error(u"Unknown client %s is invalid", args)

1067

elif cmd == u"SENDING":

1068

for client in self.clients:

1069

if client.name == args:

1070

logger.info(u"Sending secret to %s", client.name)

1071

client.checked_ok()

1072

if self.use_dbus:

1073

# Emit D-Bus signal

1074

client.ReceivedSecret()

1075

break

1076

else:

1077

logger.error(u"Sending secret to unknown client %s",

1078

args)

1079

else:

1080

logger.error(u"Unknown IPC command: %r", cmdline)

1081

1082

# Keep calling this function

1546

1083

return True

1547

1084

1548

1085

1578

1115

elif suffix == u"w":

1579

1116

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1580

1117

else:

1581

raise ValueError(u"Unknown suffix %r" % suffix)

1582

except (ValueError, IndexError), e:

1583

raise ValueError(e.message)

1118

raise ValueError

1119

except (ValueError, IndexError):

1120

raise ValueError

1584

1121

timevalue += delta

1585

1122

return timevalue

1586

1123

1599

1136

def if_nametoindex(interface):

1600

1137

"Get an interface index the hard way, i.e. using fcntl()"

1601

1138

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1602

with contextlib.closing(socket.socket()) as s:

1139

with closing(socket.socket()) as s:

1603

1140

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1604

1141

struct.pack(str(u"16s16x"),

1605

1142

interface))

1625

1162

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1626

1163

if not stat.S_ISCHR(os.fstat(null).st_mode):

1627

1164

raise OSError(errno.ENODEV,

1628

u"%s not a character device"

1629

% os.path.devnull)

1165

u"/dev/null not a character device")

1630

1166

os.dup2(null, sys.stdin.fileno())

1631

1167

os.dup2(null, sys.stdout.fileno())

1632

1168

os.dup2(null, sys.stderr.fileno())

1636

1172

1637

1173

def main():

1638

1174

1639

##################################################################

1175

######################################################################

1640

1176

# Parsing of options, both command line and config file

1641

1177

1642

1178

parser = optparse.OptionParser(version = "%%prog %s" % version)

1651

1187

parser.add_option("--debug", action=u"store_true",

1652

1188

help=u"Debug mode; run in foreground and log to"

1653

1189

u" terminal")

1654

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1655

help=u"Debug level for stdout output")

1656

1190

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1657

1191

u" priority string (see GnuTLS documentation)")

1658

1192

parser.add_option("--servicename", type=u"string",

1683

1217

u"servicename": u"Mandos",

1684

1218

u"use_dbus": u"True",

1685

1219

u"use_ipv6": u"True",

1686

u"debuglevel": u"",

1687

1220

}

1688

1221

1689

1222

# Parse config file for server-global settings

1706

1239

# options, if set.

1707

1240

for option in (u"interface", u"address", u"port", u"debug",

1708

1241

u"priority", u"servicename", u"configdir",

1709

u"use_dbus", u"use_ipv6", u"debuglevel"):

1242

u"use_dbus", u"use_ipv6"):

1710

1243

value = getattr(options, option)

1711

1244

if value is not None:

1712

1245

server_settings[option] = value

1721

1254

1722

1255

# For convenience

1723

1256

debug = server_settings[u"debug"]

1724

debuglevel = server_settings[u"debuglevel"]

1725

1257

use_dbus = server_settings[u"use_dbus"]

1726

1258

use_ipv6 = server_settings[u"use_ipv6"]

1727

1259

1260

if not debug:

1261

syslogger.setLevel(logging.WARNING)

1262

console.setLevel(logging.WARNING)

1263

1728

1264

if server_settings[u"servicename"] != u"Mandos":

1729

1265

syslogger.setFormatter(logging.Formatter

1730

1266

(u'Mandos (%s) [%%(process)d]:'

1736

1272

u"interval": u"5m",

1737

1273

u"checker": u"fping -q -- %%(host)s",

1738

1274

u"host": u"",

1739

u"approval_delay": u"0s",

1740

u"approval_duration": u"1s",

1741

1275

}

1742

1276

client_config = configparser.SafeConfigParser(client_defaults)

1743

1277

client_config.read(os.path.join(server_settings[u"configdir"],

1749

1283

tcp_server = MandosServer((server_settings[u"address"],

1750

1284

server_settings[u"port"]),

1751

1285

ClientHandler,

1752

interface=(server_settings[u"interface"]

1753

or None),

1286

interface=server_settings[u"interface"],

1754

1287

use_ipv6=use_ipv6,

1755

1288

gnutls_priority=

1756

1289

server_settings[u"priority"],

1782

1315

if error[0] != errno.EPERM:

1783

1316

raise error

1784

1317

1785

if not debug and not debuglevel:

1786

syslogger.setLevel(logging.WARNING)

1787

console.setLevel(logging.WARNING)

1788

if debuglevel:

1789

level = getattr(logging, debuglevel.upper())

1790

syslogger.setLevel(level)

1791

console.setLevel(level)

1792

1318

# Enable all possible GnuTLS debugging

1793

1319

if debug:

1794

# Enable all possible GnuTLS debugging

1795

1796

1320

# "Use a log level over 10 to enable all debugging options."

1797

1321

# - GnuTLS manual

1798

1322

gnutls.library.functions.gnutls_global_set_log_level(11)

1803

1327

1804

1328

(gnutls.library.functions

1805

1329

.gnutls_global_set_log_function(debug_gnutls))

1806

1807

# Redirect stdin so all checkers get /dev/null

1808

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1809

os.dup2(null, sys.stdin.fileno())

1810

if null > 2:

1811

os.close(null)

1812

else:

1813

# No console logging

1814

logger.removeHandler(console)

1815

1816

1330

1817

1331

global main_loop

1818

1332

# From the Avahi example code

1821

1335

bus = dbus.SystemBus()

1822

1336

# End of Avahi example code

1823

1337

if use_dbus:

1824

try:

1825

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1826

bus, do_not_queue=True)

1827

except dbus.exceptions.NameExistsException, e:

1828

logger.error(unicode(e) + u", disabling D-Bus")

1829

use_dbus = False

1830

server_settings[u"use_dbus"] = False

1831

tcp_server.use_dbus = False

1338

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1832

1339

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1833

1340

service = AvahiService(name = server_settings[u"servicename"],

1834

1341

servicetype = u"_mandos._tcp",

1836

1343

if server_settings["interface"]:

1837

1344

service.interface = (if_nametoindex

1838

1345

(str(server_settings[u"interface"])))

1839

1840

if not debug:

1841

# Close all input and output, do double fork, etc.

1842

daemon()

1843

1844

global multiprocessing_manager

1845

multiprocessing_manager = multiprocessing.Manager()

1846

1346

1847

1347

client_class = Client

1848

1348

if use_dbus:

1849

1349

client_class = functools.partial(ClientDBus, bus = bus)

1850

def client_config_items(config, section):

1851

special_settings = {

1852

"approved_by_default":

1853

lambda: config.getboolean(section,

1854

"approved_by_default"),

1855

}

1856

for name, value in config.items(section):

1857

try:

1858

yield (name, special_settings[name]())

1859

except KeyError:

1860

yield (name, value)

1861

1862

1350

tcp_server.clients.update(set(

1863

1351

client_class(name = section,

1864

config= dict(client_config_items(

1865

client_config, section)))

1352

config= dict(client_config.items(section)))

1866

1353

for section in client_config.sections()))

1867

1354

if not tcp_server.clients:

1868

1355

logger.warning(u"No clients defined")

1869

1356

1357

if debug:

1358

# Redirect stdin so all checkers get /dev/null

1359

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1360

os.dup2(null, sys.stdin.fileno())

1361

if null > 2:

1362

os.close(null)

1363

else:

1364

# No console logging

1365

logger.removeHandler(console)

1366

# Close all input and output, do double fork, etc.

1367

daemon()

1368

1870

1369

try:

1871

with pidfile:

1370

with closing(pidfile):

1872

1371

pid = os.getpid()

1873

1372

pidfile.write(str(pid) + "\n")

1874

1373

del pidfile

1880

1379

pass

1881

1380

del pidfilename

1882

1381

1382

def cleanup():

1383

"Cleanup function; run on exit"

1384

service.cleanup()

1385

1386

while tcp_server.clients:

1387

client = tcp_server.clients.pop()

1388

client.disable_hook = None

1389

client.disable()

1390

1391

atexit.register(cleanup)

1392

1883

1393

if not debug:

1884

1394

signal.signal(signal.SIGINT, signal.SIG_IGN)

1885

1395

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1892

1402

dbus.service.Object.__init__(self, bus, u"/")

1893

1403

_interface = u"se.bsnet.fukt.Mandos"

1894

1404

1895

@dbus.service.signal(_interface, signature=u"o")

1896

def ClientAdded(self, objpath):

1405

@dbus.service.signal(_interface, signature=u"oa{sv}")

1406

def ClientAdded(self, objpath, properties):

1897

1407

"D-Bus signal"

1898

1408

pass

1899

1409

1900

@dbus.service.signal(_interface, signature=u"ss")

1901

def ClientNotFound(self, fingerprint, address):

1410

@dbus.service.signal(_interface, signature=u"s")

1411

def ClientNotFound(self, fingerprint):

1902

1412

"D-Bus signal"

1903

1413

pass

1904

1414

1918

1428

def GetAllClientsWithProperties(self):

1919

1429

"D-Bus method"

1920

1430

return dbus.Dictionary(

1921

((c.dbus_object_path, c.GetAll(u""))

1431

((c.dbus_object_path, c.GetAllProperties())

1922

1432

for c in tcp_server.clients),

1923

1433

signature=u"oa{sv}")

1924

1434

1930

1440

tcp_server.clients.remove(c)

1931

1441

c.remove_from_connection()

1932

1442

# Don't signal anything except ClientRemoved

1933

c.disable(quiet=True)

1443

c.disable(signal=False)

1934

1444

# Emit D-Bus signal

1935

1445

self.ClientRemoved(object_path, c.name)

1936

1446

return

1937

raise KeyError(object_path)

1447

raise KeyError

1938

1448

1939

1449

del _interface

1940

1450

1941

1451

mandos_dbus_service = MandosDBusService()

1942

1452

1943

def cleanup():

1944

"Cleanup function; run on exit"

1945

service.cleanup()

1946

1947

while tcp_server.clients:

1948

client = tcp_server.clients.pop()

1949

if use_dbus:

1950

client.remove_from_connection()

1951

client.disable_hook = None

1952

# Don't signal anything except ClientRemoved

1953

client.disable(quiet=True)

1954

if use_dbus:

1955

# Emit D-Bus signal

1956

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

1957

client.name)

1958

1959

atexit.register(cleanup)

1960

1961

1453

for client in tcp_server.clients:

1962

1454

if use_dbus:

1963

1455

# Emit D-Bus signal

1964

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1456

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1457

client.GetAllProperties())

1965

1458

client.enable()

1966

1459

1967

1460

tcp_server.enable()

1985

1478

service.activate()

1986

1479

except dbus.exceptions.DBusException, error:

1987

1480

logger.critical(u"DBusException: %s", error)

1988

cleanup()

1989

1481

sys.exit(1)

1990

1482

# End of Avahi example code

1991

1483

1998

1490

main_loop.run()

1999

1491

except AvahiError, error:

2000

1492

logger.critical(u"AvahiError: %s", error)

2001

cleanup()

2002

1493

sys.exit(1)

2003

1494

except KeyboardInterrupt:

2004

1495

if debug:

2005

1496

print >> sys.stderr

2006

1497

logger.debug(u"Server received KeyboardInterrupt")

2007

1498

logger.debug(u"Server exiting")

2008

# Must run before the D-Bus bus name gets deregistered

2009

cleanup()

2010

1499

2011

1500

if __name__ == '__main__':

2012

1501

main()