To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.2.203
- compare with another revision
- download diff
- download tarball
- view history from revision 237.2.203
- Committer: Teddy Hogeborn
- Date: 2010-09-25 21:24:49 UTC
- mto: (24.1.168 mandos) (237.12.2 mandos-persistent) (299.1.1 release) (300.1.1 release) (301.1.1 release)
- mto: This revision was merged to the branch mainline in revision 270.
- Revision ID: teddy@fukt.bsnet.se-20100925212449-h9hpy9n406tkkakb
* mandos.xml (APPROVAL): New section.
- files removed:
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
31
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
36
import SocketServer as socketserver
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
82
81
SO_BINDTODEVICE = None
83
82
84
83
85
version = "1.3.1"
84
version = "1.0.14"
86
85
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
89
88
syslogger = (logging.handlers.SysLogHandler
90
89
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
address = str("/dev/log")))
90
address = "/dev/log"))
92
91
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
95
94
logger.addHandler(syslogger)
96
95
97
96
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
100
' %(message)s'))
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
101
100
logger.addHandler(console)
102
101
103
102
class AvahiError(Exception):
120
119
Attributes:
121
120
interface: integer; avahi.IF_UNSPEC or an interface index.
122
121
Used to optionally bind to the specified interface.
123
name: string; Example: 'Mandos'
124
type: string; Example: '_mandos._tcp'.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
125
124
See <http://www.dns-sd.org/ServiceTypes.html>
126
125
port: integer; what port to announce
127
126
TXT: list of strings; TXT record for the service
136
135
"""
137
136
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
137
servicetype = None, port = None, TXT = None,
139
domain = "", host = "", max_renames = 32768,
138
domain = u"", host = u"", max_renames = 32768,
140
139
protocol = avahi.PROTO_UNSPEC, bus = None):
141
140
self.interface = interface
142
141
self.name = name
151
150
self.group = None # our entry group
152
151
self.server = None
153
152
self.bus = bus
154
self.entry_group_state_changed_match = None
155
153
def rename(self):
156
154
"""Derived from the Avahi example code"""
157
155
if self.rename_count >= self.max_renames:
158
logger.critical("No suitable Zeroconf service name found"
159
" after %i retries, exiting.",
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
160
158
self.rename_count)
161
raise AvahiServiceError("Too many renames")
159
raise AvahiServiceError(u"Too many renames")
162
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
163
logger.info("Changing Zeroconf service name to %r ...",
161
logger.info(u"Changing Zeroconf service name to %r ...",
164
162
self.name)
165
163
syslogger.setFormatter(logging.Formatter
166
('Mandos (%s) [%%(process)d]:'
167
' %%(levelname)s: %%(message)s'
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
168
166
% self.name))
169
167
self.remove()
170
168
try:
171
169
self.add()
172
except dbus.exceptions.DBusException as error:
173
logger.critical("DBusException: %s", error)
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
174
172
self.cleanup()
175
173
os._exit(1)
176
174
self.rename_count += 1
177
175
def remove(self):
178
176
"""Derived from the Avahi example code"""
179
if self.entry_group_state_changed_match is not None:
180
self.entry_group_state_changed_match.remove()
181
self.entry_group_state_changed_match = None
182
177
if self.group is not None:
183
178
self.group.Reset()
184
179
def add(self):
185
180
"""Derived from the Avahi example code"""
186
self.remove()
187
181
if self.group is None:
188
182
self.group = dbus.Interface(
189
183
self.bus.get_object(avahi.DBUS_NAME,
190
184
self.server.EntryGroupNew()),
191
185
avahi.DBUS_INTERFACE_ENTRY_GROUP)
192
self.entry_group_state_changed_match = (
193
self.group.connect_to_signal(
194
'StateChanged', self .entry_group_state_changed))
195
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
186
self.group.connect_to_signal('StateChanged',
187
self
188
.entry_group_state_changed)
189
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
196
190
self.name, self.type)
197
191
self.group.AddService(
198
192
self.interface,
205
199
self.group.Commit()
206
200
def entry_group_state_changed(self, state, error):
207
201
"""Derived from the Avahi example code"""
208
logger.debug("Avahi entry group state change: %i", state)
202
logger.debug(u"Avahi entry group state change: %i", state)
209
203
210
204
if state == avahi.ENTRY_GROUP_ESTABLISHED:
211
logger.debug("Zeroconf service established.")
205
logger.debug(u"Zeroconf service established.")
212
206
elif state == avahi.ENTRY_GROUP_COLLISION:
213
logger.info("Zeroconf service name collision.")
207
logger.warning(u"Zeroconf service name collision.")
214
208
self.rename()
215
209
elif state == avahi.ENTRY_GROUP_FAILURE:
216
logger.critical("Avahi: Error in group state changed %s",
210
logger.critical(u"Avahi: Error in group state changed %s",
217
211
unicode(error))
218
raise AvahiGroupError("State changed: %s"
212
raise AvahiGroupError(u"State changed: %s"
219
213
% unicode(error))
220
214
def cleanup(self):
221
215
"""Derived from the Avahi example code"""
222
216
if self.group is not None:
223
try:
224
self.group.Free()
225
except (dbus.exceptions.UnknownMethodException,
226
dbus.exceptions.DBusException) as e:
227
pass
217
self.group.Free()
228
218
self.group = None
229
self.remove()
230
def server_state_changed(self, state, error=None):
219
def server_state_changed(self, state):
231
220
"""Derived from the Avahi example code"""
232
logger.debug("Avahi server state change: %i", state)
233
bad_states = { avahi.SERVER_INVALID:
234
"Zeroconf server invalid",
235
avahi.SERVER_REGISTERING: None,
236
avahi.SERVER_COLLISION:
237
"Zeroconf server name collision",
238
avahi.SERVER_FAILURE:
239
"Zeroconf server failure" }
240
if state in bad_states:
241
if bad_states[state] is not None:
242
if error is None:
243
logger.error(bad_states[state])
244
else:
245
logger.error(bad_states[state] + ": %r", error)
246
self.cleanup()
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
224
self.remove()
247
225
elif state == avahi.SERVER_RUNNING:
248
226
self.add()
249
else:
250
if error is None:
251
logger.debug("Unknown state: %r", state)
252
else:
253
logger.debug("Unknown state: %r: %r", state, error)
254
227
def activate(self):
255
228
"""Derived from the Avahi example code"""
256
229
if self.server is None:
257
230
self.server = dbus.Interface(
258
231
self.bus.get_object(avahi.DBUS_NAME,
259
avahi.DBUS_PATH_SERVER,
260
follow_name_owner_changes=True),
232
avahi.DBUS_PATH_SERVER),
261
233
avahi.DBUS_INTERFACE_SERVER)
262
self.server.connect_to_signal("StateChanged",
234
self.server.connect_to_signal(u"StateChanged",
263
235
self.server_state_changed)
264
236
self.server_state_changed(self.server.GetState())
265
237
274
246
checker: subprocess.Popen(); a running checker process used
275
247
to see if the client lives.
276
248
'None' if no process is running.
277
checker_callback_tag: a gobject event source tag, or None
249
checker_callback_tag: - '' -
278
250
checker_command: string; External command which is run to check
279
251
if client lives. %() expansions are done at
280
252
runtime with vars(self) as dict, so that for
283
255
created: datetime.datetime(); (UTC) object creation
284
256
current_checker_command: string; current running checker_command
285
257
disable_hook: If set, called by disable() as disable_hook(self)
286
disable_initiator_tag: a gobject event source tag, or None
258
disable_initiator_tag: - '' -
287
259
enabled: bool()
288
260
fingerprint: string (40 or 32 hexadecimal digits); used to
289
261
uniquely identify the client
290
262
host: string; available for use by the checker command
291
263
interval: datetime.timedelta(); How often to start a new checker
292
last_approval_request: datetime.datetime(); (UTC) or None
293
264
last_checked_ok: datetime.datetime(); (UTC) or None
294
265
last_enabled: datetime.datetime(); (UTC)
295
266
name: string; from the config file, used in log messages and
300
271
runtime_expansions: Allowed attributes for runtime expansion.
301
272
"""
302
273
303
runtime_expansions = ("approval_delay", "approval_duration",
304
"created", "enabled", "fingerprint",
305
"host", "interval", "last_checked_ok",
306
"last_enabled", "name", "timeout")
274
runtime_expansions = (u"approval_delay", u"approval_duration",
275
u"created", u"enabled", u"fingerprint",
276
u"host", u"interval", u"last_checked_ok",
277
u"last_enabled", u"name", u"timeout")
307
278
308
279
@staticmethod
309
280
def _timedelta_to_milliseconds(td):
330
301
self.name = name
331
302
if config is None:
332
303
config = {}
333
logger.debug("Creating client %r", self.name)
304
logger.debug(u"Creating client %r", self.name)
334
305
# Uppercase and remove spaces from fingerprint for later
335
306
# comparison purposes with return value from the fingerprint()
336
307
# function
337
self.fingerprint = (config["fingerprint"].upper()
338
.replace(" ", ""))
339
logger.debug(" Fingerprint: %s", self.fingerprint)
340
if "secret" in config:
341
self.secret = config["secret"].decode("base64")
342
elif "secfile" in config:
308
self.fingerprint = (config[u"fingerprint"].upper()
309
.replace(u" ", u""))
310
logger.debug(u" Fingerprint: %s", self.fingerprint)
311
if u"secret" in config:
312
self.secret = config[u"secret"].decode(u"base64")
313
elif u"secfile" in config:
343
314
with open(os.path.expanduser(os.path.expandvars
344
(config["secfile"])),
315
(config[u"secfile"])),
345
316
"rb") as secfile:
346
317
self.secret = secfile.read()
347
318
else:
348
raise TypeError("No secret or secfile for client %s"
319
raise TypeError(u"No secret or secfile for client %s"
349
320
% self.name)
350
self.host = config.get("host", "")
321
self.host = config.get(u"host", u"")
351
322
self.created = datetime.datetime.utcnow()
352
323
self.enabled = False
353
self.last_approval_request = None
354
324
self.last_enabled = None
355
325
self.last_checked_ok = None
356
self.timeout = string_to_delta(config["timeout"])
357
self.interval = string_to_delta(config["interval"])
326
self.timeout = string_to_delta(config[u"timeout"])
327
self.interval = string_to_delta(config[u"interval"])
358
328
self.disable_hook = disable_hook
359
329
self.checker = None
360
330
self.checker_initiator_tag = None
361
331
self.disable_initiator_tag = None
362
332
self.checker_callback_tag = None
363
self.checker_command = config["checker"]
333
self.checker_command = config[u"checker"]
364
334
self.current_checker_command = None
365
335
self.last_connect = None
366
336
self._approved = None
367
self.approved_by_default = config.get("approved_by_default",
337
self.approved_by_default = config.get(u"approved_by_default",
368
338
True)
369
339
self.approvals_pending = 0
370
340
self.approval_delay = string_to_delta(
371
config["approval_delay"])
341
config[u"approval_delay"])
372
342
self.approval_duration = string_to_delta(
373
config["approval_duration"])
343
config[u"approval_duration"])
374
344
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
375
345
376
346
def send_changedstate(self):
380
350
381
351
def enable(self):
382
352
"""Start this client's checker and timeout hooks"""
383
if getattr(self, "enabled", False):
353
if getattr(self, u"enabled", False):
384
354
# Already enabled
385
355
return
386
356
self.send_changedstate()
405
375
if not quiet:
406
376
self.send_changedstate()
407
377
if not quiet:
408
logger.info("Disabling client %s", self.name)
409
if getattr(self, "disable_initiator_tag", False):
378
logger.info(u"Disabling client %s", self.name)
379
if getattr(self, u"disable_initiator_tag", False):
410
380
gobject.source_remove(self.disable_initiator_tag)
411
381
self.disable_initiator_tag = None
412
if getattr(self, "checker_initiator_tag", False):
382
if getattr(self, u"checker_initiator_tag", False):
413
383
gobject.source_remove(self.checker_initiator_tag)
414
384
self.checker_initiator_tag = None
415
385
self.stop_checker()
430
400
if os.WIFEXITED(condition):
431
401
exitstatus = os.WEXITSTATUS(condition)
432
402
if exitstatus == 0:
433
logger.info("Checker for %(name)s succeeded",
403
logger.info(u"Checker for %(name)s succeeded",
434
404
vars(self))
435
405
self.checked_ok()
436
406
else:
437
logger.info("Checker for %(name)s failed",
407
logger.info(u"Checker for %(name)s failed",
438
408
vars(self))
439
409
else:
440
logger.warning("Checker for %(name)s crashed?",
410
logger.warning(u"Checker for %(name)s crashed?",
441
411
vars(self))
442
412
443
413
def checked_ok(self):
452
422
(self.timeout_milliseconds(),
453
423
self.disable))
454
424
455
def need_approval(self):
456
self.last_approval_request = datetime.datetime.utcnow()
457
458
425
def start_checker(self):
459
426
"""Start a new checker subprocess if one is not running.
460
427
472
439
# If a checker exists, make sure it is not a zombie
473
440
try:
474
441
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
475
except (AttributeError, OSError) as error:
442
except (AttributeError, OSError), error:
476
443
if (isinstance(error, OSError)
477
444
and error.errno != errno.ECHILD):
478
445
raise error
479
446
else:
480
447
if pid:
481
logger.warning("Checker was a zombie")
448
logger.warning(u"Checker was a zombie")
482
449
gobject.source_remove(self.checker_callback_tag)
483
450
self.checker_callback(pid, status,
484
451
self.current_checker_command)
491
458
# Escape attributes for the shell
492
459
escaped_attrs = dict(
493
460
(attr,
494
re.escape(unicode(str(getattr(self, attr, "")),
461
re.escape(unicode(str(getattr(self, attr, u"")),
495
462
errors=
496
'replace')))
463
u'replace')))
497
464
for attr in
498
465
self.runtime_expansions)
499
466
500
467
try:
501
468
command = self.checker_command % escaped_attrs
502
except TypeError as error:
503
logger.error('Could not format string "%s":'
504
' %s', self.checker_command, error)
469
except TypeError, error:
470
logger.error(u'Could not format string "%s":'
471
u' %s', self.checker_command, error)
505
472
return True # Try again later
506
473
self.current_checker_command = command
507
474
try:
508
logger.info("Starting checker %r for %s",
475
logger.info(u"Starting checker %r for %s",
509
476
command, self.name)
510
477
# We don't need to redirect stdout and stderr, since
511
478
# in normal mode, that is already done by daemon(),
513
480
# always replaced by /dev/null.)
514
481
self.checker = subprocess.Popen(command,
515
482
close_fds=True,
516
shell=True, cwd="/")
483
shell=True, cwd=u"/")
517
484
self.checker_callback_tag = (gobject.child_watch_add
518
485
(self.checker.pid,
519
486
self.checker_callback,
524
491
if pid:
525
492
gobject.source_remove(self.checker_callback_tag)
526
493
self.checker_callback(pid, status, command)
527
except OSError as error:
528
logger.error("Failed to start subprocess: %s",
494
except OSError, error:
495
logger.error(u"Failed to start subprocess: %s",
529
496
error)
530
497
# Re-run this periodically if run by gobject.timeout_add
531
498
return True
535
502
if self.checker_callback_tag:
536
503
gobject.source_remove(self.checker_callback_tag)
537
504
self.checker_callback_tag = None
538
if getattr(self, "checker", None) is None:
505
if getattr(self, u"checker", None) is None:
539
506
return
540
logger.debug("Stopping checker for %(name)s", vars(self))
507
logger.debug(u"Stopping checker for %(name)s", vars(self))
541
508
try:
542
509
os.kill(self.checker.pid, signal.SIGTERM)
543
510
#time.sleep(0.5)
544
511
#if self.checker.poll() is None:
545
512
# os.kill(self.checker.pid, signal.SIGKILL)
546
except OSError as error:
513
except OSError, error:
547
514
if error.errno != errno.ESRCH: # No such process
548
515
raise
549
516
self.checker = None
550
517
551
def dbus_service_property(dbus_interface, signature="v",
552
access="readwrite", byte_arrays=False):
518
def dbus_service_property(dbus_interface, signature=u"v",
519
access=u"readwrite", byte_arrays=False):
553
520
"""Decorators for marking methods of a DBusObjectWithProperties to
554
521
become properties on the D-Bus.
555
522
562
529
"""
563
530
# Encoding deeply encoded byte arrays is not supported yet by the
564
531
# "Set" method, so we fail early here:
565
if byte_arrays and signature != "ay":
566
raise ValueError("Byte arrays not supported for non-'ay'"
567
" signature %r" % signature)
532
if byte_arrays and signature != u"ay":
533
raise ValueError(u"Byte arrays not supported for non-'ay'"
534
u" signature %r" % signature)
568
535
def decorator(func):
569
536
func._dbus_is_property = True
570
537
func._dbus_interface = dbus_interface
571
538
func._dbus_signature = signature
572
539
func._dbus_access = access
573
540
func._dbus_name = func.__name__
574
if func._dbus_name.endswith("_dbus_property"):
541
if func._dbus_name.endswith(u"_dbus_property"):
575
542
func._dbus_name = func._dbus_name[:-14]
576
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
543
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
577
544
return func
578
545
return decorator
579
546
607
574
608
575
@staticmethod
609
576
def _is_dbus_property(obj):
610
return getattr(obj, "_dbus_is_property", False)
577
return getattr(obj, u"_dbus_is_property", False)
611
578
612
579
def _get_all_dbus_properties(self):
613
580
"""Returns a generator of (name, attribute) pairs
621
588
property with the specified name and interface.
622
589
"""
623
590
for name in (property_name,
624
property_name + "_dbus_property"):
591
property_name + u"_dbus_property"):
625
592
prop = getattr(self, name, None)
626
593
if (prop is None
627
594
or not self._is_dbus_property(prop)
631
598
continue
632
599
return prop
633
600
# No such property
634
raise DBusPropertyNotFound(self.dbus_object_path + ":"
635
+ interface_name + "."
601
raise DBusPropertyNotFound(self.dbus_object_path + u":"
602
+ interface_name + u"."
636
603
+ property_name)
637
604
638
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
639
out_signature="v")
605
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
606
out_signature=u"v")
640
607
def Get(self, interface_name, property_name):
641
608
"""Standard D-Bus property Get() method, see D-Bus standard.
642
609
"""
643
610
prop = self._get_dbus_property(interface_name, property_name)
644
if prop._dbus_access == "write":
611
if prop._dbus_access == u"write":
645
612
raise DBusPropertyAccessException(property_name)
646
613
value = prop()
647
if not hasattr(value, "variant_level"):
614
if not hasattr(value, u"variant_level"):
648
615
return value
649
616
return type(value)(value, variant_level=value.variant_level+1)
650
617
651
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
618
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
652
619
def Set(self, interface_name, property_name, value):
653
620
"""Standard D-Bus property Set() method, see D-Bus standard.
654
621
"""
655
622
prop = self._get_dbus_property(interface_name, property_name)
656
if prop._dbus_access == "read":
623
if prop._dbus_access == u"read":
657
624
raise DBusPropertyAccessException(property_name)
658
if prop._dbus_get_args_options["byte_arrays"]:
625
if prop._dbus_get_args_options[u"byte_arrays"]:
659
626
# The byte_arrays option is not supported yet on
660
627
# signatures other than "ay".
661
if prop._dbus_signature != "ay":
628
if prop._dbus_signature != u"ay":
662
629
raise ValueError
663
630
value = dbus.ByteArray(''.join(unichr(byte)
664
631
for byte in value))
665
632
prop(value)
666
633
667
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
668
out_signature="a{sv}")
634
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
635
out_signature=u"a{sv}")
669
636
def GetAll(self, interface_name):
670
637
"""Standard D-Bus property GetAll() method, see D-Bus
671
638
standard.
679
646
# Interface non-empty but did not match
680
647
continue
681
648
# Ignore write-only properties
682
if prop._dbus_access == "write":
649
if prop._dbus_access == u"write":
683
650
continue
684
651
value = prop()
685
if not hasattr(value, "variant_level"):
652
if not hasattr(value, u"variant_level"):
686
653
all[name] = value
687
654
continue
688
655
all[name] = type(value)(value, variant_level=
689
656
value.variant_level+1)
690
return dbus.Dictionary(all, signature="sv")
657
return dbus.Dictionary(all, signature=u"sv")
691
658
692
659
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
693
out_signature="s",
660
out_signature=u"s",
694
661
path_keyword='object_path',
695
662
connection_keyword='connection')
696
663
def Introspect(self, object_path, connection):
701
668
try:
702
669
document = xml.dom.minidom.parseString(xmlstring)
703
670
def make_tag(document, name, prop):
704
e = document.createElement("property")
705
e.setAttribute("name", name)
706
e.setAttribute("type", prop._dbus_signature)
707
e.setAttribute("access", prop._dbus_access)
671
e = document.createElement(u"property")
672
e.setAttribute(u"name", name)
673
e.setAttribute(u"type", prop._dbus_signature)
674
e.setAttribute(u"access", prop._dbus_access)
708
675
return e
709
for if_tag in document.getElementsByTagName("interface"):
676
for if_tag in document.getElementsByTagName(u"interface"):
710
677
for tag in (make_tag(document, name, prop)
711
678
for name, prop
712
679
in self._get_all_dbus_properties()
713
680
if prop._dbus_interface
714
== if_tag.getAttribute("name")):
681
== if_tag.getAttribute(u"name")):
715
682
if_tag.appendChild(tag)
716
683
# Add the names to the return values for the
717
684
# "org.freedesktop.DBus.Properties" methods
718
if (if_tag.getAttribute("name")
719
== "org.freedesktop.DBus.Properties"):
720
for cn in if_tag.getElementsByTagName("method"):
721
if cn.getAttribute("name") == "Get":
722
for arg in cn.getElementsByTagName("arg"):
723
if (arg.getAttribute("direction")
724
== "out"):
725
arg.setAttribute("name", "value")
726
elif cn.getAttribute("name") == "GetAll":
727
for arg in cn.getElementsByTagName("arg"):
728
if (arg.getAttribute("direction")
729
== "out"):
730
arg.setAttribute("name", "props")
731
xmlstring = document.toxml("utf-8")
685
if (if_tag.getAttribute(u"name")
686
== u"org.freedesktop.DBus.Properties"):
687
for cn in if_tag.getElementsByTagName(u"method"):
688
if cn.getAttribute(u"name") == u"Get":
689
for arg in cn.getElementsByTagName(u"arg"):
690
if (arg.getAttribute(u"direction")
691
== u"out"):
692
arg.setAttribute(u"name", u"value")
693
elif cn.getAttribute(u"name") == u"GetAll":
694
for arg in cn.getElementsByTagName(u"arg"):
695
if (arg.getAttribute(u"direction")
696
== u"out"):
697
arg.setAttribute(u"name", u"props")
698
xmlstring = document.toxml(u"utf-8")
732
699
document.unlink()
733
700
except (AttributeError, xml.dom.DOMException,
734
xml.parsers.expat.ExpatError) as error:
735
logger.error("Failed to override Introspection method",
701
xml.parsers.expat.ExpatError), error:
702
logger.error(u"Failed to override Introspection method",
736
703
error)
737
704
return xmlstring
738
705
746
713
"""
747
714
748
715
runtime_expansions = (Client.runtime_expansions
749
+ ("dbus_object_path",))
716
+ (u"dbus_object_path",))
750
717
751
718
# dbus.service.Object doesn't use super(), so we can't either.
752
719
756
723
Client.__init__(self, *args, **kwargs)
757
724
# Only now, when this client is initialized, can it show up on
758
725
# the D-Bus
759
client_object_name = unicode(self.name).translate(
760
{ord("."): ord("_"),
761
ord("-"): ord("_")})
762
726
self.dbus_object_path = (dbus.ObjectPath
763
("/clients/" + client_object_name))
727
(u"/clients/"
728
+ self.name.replace(u".", u"_")))
764
729
DBusObjectWithProperties.__init__(self, self.bus,
765
730
self.dbus_object_path)
766
731
773
738
if (hasattr(self, "dbus_object_path")
774
739
and bval is not bool(old_value)):
775
740
dbus_bool = dbus.Boolean(bval, variant_level=1)
776
self.PropertyChanged(dbus.String("ApprovalPending"),
741
self.PropertyChanged(dbus.String(u"ApprovalPending"),
777
742
dbus_bool)
778
743
779
744
approvals_pending = property(_get_approvals_pending,
787
752
variant_level=variant_level)
788
753
789
754
def enable(self):
790
oldstate = getattr(self, "enabled", False)
755
oldstate = getattr(self, u"enabled", False)
791
756
r = Client.enable(self)
792
757
if oldstate != self.enabled:
793
758
# Emit D-Bus signals
794
self.PropertyChanged(dbus.String("Enabled"),
759
self.PropertyChanged(dbus.String(u"Enabled"),
795
760
dbus.Boolean(True, variant_level=1))
796
761
self.PropertyChanged(
797
dbus.String("LastEnabled"),
762
dbus.String(u"LastEnabled"),
798
763
self._datetime_to_dbus(self.last_enabled,
799
764
variant_level=1))
800
765
return r
801
766
802
767
def disable(self, quiet = False):
803
oldstate = getattr(self, "enabled", False)
768
oldstate = getattr(self, u"enabled", False)
804
769
r = Client.disable(self, quiet=quiet)
805
770
if not quiet and oldstate != self.enabled:
806
771
# Emit D-Bus signal
807
self.PropertyChanged(dbus.String("Enabled"),
772
self.PropertyChanged(dbus.String(u"Enabled"),
808
773
dbus.Boolean(False, variant_level=1))
809
774
return r
810
775
813
778
self.remove_from_connection()
814
779
except LookupError:
815
780
pass
816
if hasattr(DBusObjectWithProperties, "__del__"):
781
if hasattr(DBusObjectWithProperties, u"__del__"):
817
782
DBusObjectWithProperties.__del__(self, *args, **kwargs)
818
783
Client.__del__(self, *args, **kwargs)
819
784
822
787
self.checker_callback_tag = None
823
788
self.checker = None
824
789
# Emit D-Bus signal
825
self.PropertyChanged(dbus.String("CheckerRunning"),
790
self.PropertyChanged(dbus.String(u"CheckerRunning"),
826
791
dbus.Boolean(False, variant_level=1))
827
792
if os.WIFEXITED(condition):
828
793
exitstatus = os.WEXITSTATUS(condition)
840
805
*args, **kwargs)
841
806
842
807
def checked_ok(self, *args, **kwargs):
843
Client.checked_ok(self, *args, **kwargs)
808
r = Client.checked_ok(self, *args, **kwargs)
844
809
# Emit D-Bus signal
845
810
self.PropertyChanged(
846
dbus.String("LastCheckedOK"),
811
dbus.String(u"LastCheckedOK"),
847
812
(self._datetime_to_dbus(self.last_checked_ok,
848
813
variant_level=1)))
849
850
def need_approval(self, *args, **kwargs):
851
r = Client.need_approval(self, *args, **kwargs)
852
# Emit D-Bus signal
853
self.PropertyChanged(
854
dbus.String("LastApprovalRequest"),
855
(self._datetime_to_dbus(self.last_approval_request,
856
variant_level=1)))
857
814
return r
858
815
859
816
def start_checker(self, *args, **kwargs):
869
826
# Emit D-Bus signal
870
827
self.CheckerStarted(self.current_checker_command)
871
828
self.PropertyChanged(
872
dbus.String("CheckerRunning"),
829
dbus.String(u"CheckerRunning"),
873
830
dbus.Boolean(True, variant_level=1))
874
831
return r
875
832
876
833
def stop_checker(self, *args, **kwargs):
877
old_checker = getattr(self, "checker", None)
834
old_checker = getattr(self, u"checker", None)
878
835
r = Client.stop_checker(self, *args, **kwargs)
879
836
if (old_checker is not None
880
and getattr(self, "checker", None) is None):
881
self.PropertyChanged(dbus.String("CheckerRunning"),
837
and getattr(self, u"checker", None) is None):
838
self.PropertyChanged(dbus.String(u"CheckerRunning"),
882
839
dbus.Boolean(False, variant_level=1))
883
840
return r
884
841
895
852
896
853
897
854
## D-Bus methods, signals & properties
898
_interface = "se.bsnet.fukt.Mandos.Client"
855
_interface = u"se.bsnet.fukt.Mandos.Client"
899
856
900
857
## Signals
901
858
902
859
# CheckerCompleted - signal
903
@dbus.service.signal(_interface, signature="nxs")
860
@dbus.service.signal(_interface, signature=u"nxs")
904
861
def CheckerCompleted(self, exitcode, waitstatus, command):
905
862
"D-Bus signal"
906
863
pass
907
864
908
865
# CheckerStarted - signal
909
@dbus.service.signal(_interface, signature="s")
866
@dbus.service.signal(_interface, signature=u"s")
910
867
def CheckerStarted(self, command):
911
868
"D-Bus signal"
912
869
pass
913
870
914
871
# PropertyChanged - signal
915
@dbus.service.signal(_interface, signature="sv")
872
@dbus.service.signal(_interface, signature=u"sv")
916
873
def PropertyChanged(self, property, value):
917
874
"D-Bus signal"
918
875
pass
927
884
pass
928
885
929
886
# Rejected - signal
930
@dbus.service.signal(_interface, signature="s")
887
@dbus.service.signal(_interface, signature=u"s")
931
888
def Rejected(self, reason):
932
889
"D-Bus signal"
933
890
pass
934
891
935
892
# NeedApproval - signal
936
@dbus.service.signal(_interface, signature="tb")
893
@dbus.service.signal(_interface, signature=u"tb")
937
894
def NeedApproval(self, timeout, default):
938
895
"D-Bus signal"
939
return self.need_approval()
896
pass
940
897
941
898
## Methods
942
899
943
900
# Approve - method
944
@dbus.service.method(_interface, in_signature="b")
901
@dbus.service.method(_interface, in_signature=u"b")
945
902
def Approve(self, value):
946
903
self.approve(value)
947
904
948
905
# CheckedOK - method
949
906
@dbus.service.method(_interface)
950
907
def CheckedOK(self):
951
self.checked_ok()
908
return self.checked_ok()
952
909
953
910
# Enable - method
954
911
@dbus.service.method(_interface)
976
933
## Properties
977
934
978
935
# ApprovalPending - property
979
@dbus_service_property(_interface, signature="b", access="read")
936
@dbus_service_property(_interface, signature=u"b", access=u"read")
980
937
def ApprovalPending_dbus_property(self):
981
938
return dbus.Boolean(bool(self.approvals_pending))
982
939
983
940
# ApprovedByDefault - property
984
@dbus_service_property(_interface, signature="b",
985
access="readwrite")
941
@dbus_service_property(_interface, signature=u"b",
942
access=u"readwrite")
986
943
def ApprovedByDefault_dbus_property(self, value=None):
987
944
if value is None: # get
988
945
return dbus.Boolean(self.approved_by_default)
989
946
self.approved_by_default = bool(value)
990
947
# Emit D-Bus signal
991
self.PropertyChanged(dbus.String("ApprovedByDefault"),
948
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
992
949
dbus.Boolean(value, variant_level=1))
993
950
994
951
# ApprovalDelay - property
995
@dbus_service_property(_interface, signature="t",
996
access="readwrite")
952
@dbus_service_property(_interface, signature=u"t",
953
access=u"readwrite")
997
954
def ApprovalDelay_dbus_property(self, value=None):
998
955
if value is None: # get
999
956
return dbus.UInt64(self.approval_delay_milliseconds())
1000
957
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1001
958
# Emit D-Bus signal
1002
self.PropertyChanged(dbus.String("ApprovalDelay"),
959
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
1003
960
dbus.UInt64(value, variant_level=1))
1004
961
1005
962
# ApprovalDuration - property
1006
@dbus_service_property(_interface, signature="t",
1007
access="readwrite")
963
@dbus_service_property(_interface, signature=u"t",
964
access=u"readwrite")
1008
965
def ApprovalDuration_dbus_property(self, value=None):
1009
966
if value is None: # get
1010
967
return dbus.UInt64(self._timedelta_to_milliseconds(
1011
968
self.approval_duration))
1012
969
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1013
970
# Emit D-Bus signal
1014
self.PropertyChanged(dbus.String("ApprovalDuration"),
971
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
1015
972
dbus.UInt64(value, variant_level=1))
1016
973
1017
974
# Name - property
1018
@dbus_service_property(_interface, signature="s", access="read")
975
@dbus_service_property(_interface, signature=u"s", access=u"read")
1019
976
def Name_dbus_property(self):
1020
977
return dbus.String(self.name)
1021
978
1022
979
# Fingerprint - property
1023
@dbus_service_property(_interface, signature="s", access="read")
980
@dbus_service_property(_interface, signature=u"s", access=u"read")
1024
981
def Fingerprint_dbus_property(self):
1025
982
return dbus.String(self.fingerprint)
1026
983
1027
984
# Host - property
1028
@dbus_service_property(_interface, signature="s",
1029
access="readwrite")
985
@dbus_service_property(_interface, signature=u"s",
986
access=u"readwrite")
1030
987
def Host_dbus_property(self, value=None):
1031
988
if value is None: # get
1032
989
return dbus.String(self.host)
1033
990
self.host = value
1034
991
# Emit D-Bus signal
1035
self.PropertyChanged(dbus.String("Host"),
992
self.PropertyChanged(dbus.String(u"Host"),
1036
993
dbus.String(value, variant_level=1))
1037
994
1038
995
# Created - property
1039
@dbus_service_property(_interface, signature="s", access="read")
996
@dbus_service_property(_interface, signature=u"s", access=u"read")
1040
997
def Created_dbus_property(self):
1041
998
return dbus.String(self._datetime_to_dbus(self.created))
1042
999
1043
1000
# LastEnabled - property
1044
@dbus_service_property(_interface, signature="s", access="read")
1001
@dbus_service_property(_interface, signature=u"s", access=u"read")
1045
1002
def LastEnabled_dbus_property(self):
1046
1003
if self.last_enabled is None:
1047
return dbus.String("")
1004
return dbus.String(u"")
1048
1005
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1049
1006
1050
1007
# Enabled - property
1051
@dbus_service_property(_interface, signature="b",
1052
access="readwrite")
1008
@dbus_service_property(_interface, signature=u"b",
1009
access=u"readwrite")
1053
1010
def Enabled_dbus_property(self, value=None):
1054
1011
if value is None: # get
1055
1012
return dbus.Boolean(self.enabled)
1059
1016
self.disable()
1060
1017
1061
1018
# LastCheckedOK - property
1062
@dbus_service_property(_interface, signature="s",
1063
access="readwrite")
1019
@dbus_service_property(_interface, signature=u"s",
1020
access=u"readwrite")
1064
1021
def LastCheckedOK_dbus_property(self, value=None):
1065
1022
if value is not None:
1066
1023
self.checked_ok()
1067
1024
return
1068
1025
if self.last_checked_ok is None:
1069
return dbus.String("")
1026
return dbus.String(u"")
1070
1027
return dbus.String(self._datetime_to_dbus(self
1071
1028
.last_checked_ok))
1072
1029
1073
# LastApprovalRequest - property
1074
@dbus_service_property(_interface, signature="s", access="read")
1075
def LastApprovalRequest_dbus_property(self):
1076
if self.last_approval_request is None:
1077
return dbus.String("")
1078
return dbus.String(self.
1079
_datetime_to_dbus(self
1080
.last_approval_request))
1081
1082
1030
# Timeout - property
1083
@dbus_service_property(_interface, signature="t",
1084
access="readwrite")
1031
@dbus_service_property(_interface, signature=u"t",
1032
access=u"readwrite")
1085
1033
def Timeout_dbus_property(self, value=None):
1086
1034
if value is None: # get
1087
1035
return dbus.UInt64(self.timeout_milliseconds())
1088
1036
self.timeout = datetime.timedelta(0, 0, 0, value)
1089
1037
# Emit D-Bus signal
1090
self.PropertyChanged(dbus.String("Timeout"),
1038
self.PropertyChanged(dbus.String(u"Timeout"),
1091
1039
dbus.UInt64(value, variant_level=1))
1092
if getattr(self, "disable_initiator_tag", None) is None:
1040
if getattr(self, u"disable_initiator_tag", None) is None:
1093
1041
return
1094
1042
# Reschedule timeout
1095
1043
gobject.source_remove(self.disable_initiator_tag)
1108
1056
(time_to_die, self.disable))
1109
1057
1110
1058
# Interval - property
1111
@dbus_service_property(_interface, signature="t",
1112
access="readwrite")
1059
@dbus_service_property(_interface, signature=u"t",
1060
access=u"readwrite")
1113
1061
def Interval_dbus_property(self, value=None):
1114
1062
if value is None: # get
1115
1063
return dbus.UInt64(self.interval_milliseconds())
1116
1064
self.interval = datetime.timedelta(0, 0, 0, value)
1117
1065
# Emit D-Bus signal
1118
self.PropertyChanged(dbus.String("Interval"),
1066
self.PropertyChanged(dbus.String(u"Interval"),
1119
1067
dbus.UInt64(value, variant_level=1))
1120
if getattr(self, "checker_initiator_tag", None) is None:
1068
if getattr(self, u"checker_initiator_tag", None) is None:
1121
1069
return
1122
1070
# Reschedule checker run
1123
1071
gobject.source_remove(self.checker_initiator_tag)
1126
1074
self.start_checker() # Start one now, too
1127
1075
1128
1076
# Checker - property
1129
@dbus_service_property(_interface, signature="s",
1130
access="readwrite")
1077
@dbus_service_property(_interface, signature=u"s",
1078
access=u"readwrite")
1131
1079
def Checker_dbus_property(self, value=None):
1132
1080
if value is None: # get
1133
1081
return dbus.String(self.checker_command)
1134
1082
self.checker_command = value
1135
1083
# Emit D-Bus signal
1136
self.PropertyChanged(dbus.String("Checker"),
1084
self.PropertyChanged(dbus.String(u"Checker"),
1137
1085
dbus.String(self.checker_command,
1138
1086
variant_level=1))
1139
1087
1140
1088
# CheckerRunning - property
1141
@dbus_service_property(_interface, signature="b",
1142
access="readwrite")
1089
@dbus_service_property(_interface, signature=u"b",
1090
access=u"readwrite")
1143
1091
def CheckerRunning_dbus_property(self, value=None):
1144
1092
if value is None: # get
1145
1093
return dbus.Boolean(self.checker is not None)
1149
1097
self.stop_checker()
1150
1098
1151
1099
# ObjectPath - property
1152
@dbus_service_property(_interface, signature="o", access="read")
1100
@dbus_service_property(_interface, signature=u"o", access=u"read")
1153
1101
def ObjectPath_dbus_property(self):
1154
1102
return self.dbus_object_path # is already a dbus.ObjectPath
1155
1103
1156
1104
# Secret = property
1157
@dbus_service_property(_interface, signature="ay",
1158
access="write", byte_arrays=True)
1105
@dbus_service_property(_interface, signature=u"ay",
1106
access=u"write", byte_arrays=True)
1159
1107
def Secret_dbus_property(self, value):
1160
1108
self.secret = str(value)
1161
1109
1196
1144
1197
1145
def handle(self):
1198
1146
with contextlib.closing(self.server.child_pipe) as child_pipe:
1199
logger.info("TCP connection from: %s",
1147
logger.info(u"TCP connection from: %s",
1200
1148
unicode(self.client_address))
1201
logger.debug("Pipe FD: %d",
1149
logger.debug(u"Pipe FD: %d",
1202
1150
self.server.child_pipe.fileno())
1203
1151
1204
1152
session = (gnutls.connection
1211
1159
# no X.509 keys are added to it. Therefore, we can use it
1212
1160
# here despite using OpenPGP certificates.
1213
1161
1214
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1215
# "+AES-256-CBC", "+SHA1",
1216
# "+COMP-NULL", "+CTYPE-OPENPGP",
1217
# "+DHE-DSS"))
1162
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1163
# u"+AES-256-CBC", u"+SHA1",
1164
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1165
# u"+DHE-DSS"))
1218
1166
# Use a fallback default, since this MUST be set.
1219
1167
priority = self.server.gnutls_priority
1220
1168
if priority is None:
1221
priority = "NORMAL"
1169
priority = u"NORMAL"
1222
1170
(gnutls.library.functions
1223
1171
.gnutls_priority_set_direct(session._c_object,
1224
1172
priority, None))
1226
1174
# Start communication using the Mandos protocol
1227
1175
# Get protocol number
1228
1176
line = self.request.makefile().readline()
1229
logger.debug("Protocol version: %r", line)
1177
logger.debug(u"Protocol version: %r", line)
1230
1178
try:
1231
1179
if int(line.strip().split()[0]) > 1:
1232
1180
raise RuntimeError
1233
except (ValueError, IndexError, RuntimeError) as error:
1234
logger.error("Unknown protocol version: %s", error)
1181
except (ValueError, IndexError, RuntimeError), error:
1182
logger.error(u"Unknown protocol version: %s", error)
1235
1183
return
1236
1184
1237
1185
# Start GnuTLS connection
1238
1186
try:
1239
1187
session.handshake()
1240
except gnutls.errors.GNUTLSError as error:
1241
logger.warning("Handshake failed: %s", error)
1188
except gnutls.errors.GNUTLSError, error:
1189
logger.warning(u"Handshake failed: %s", error)
1242
1190
# Do not run session.bye() here: the session is not
1243
1191
# established. Just abandon the request.
1244
1192
return
1245
logger.debug("Handshake succeeded")
1193
logger.debug(u"Handshake succeeded")
1246
1194
1247
1195
approval_required = False
1248
1196
try:
1249
1197
try:
1250
1198
fpr = self.fingerprint(self.peer_certificate
1251
1199
(session))
1252
except (TypeError,
1253
gnutls.errors.GNUTLSError) as error:
1254
logger.warning("Bad certificate: %s", error)
1200
except (TypeError, gnutls.errors.GNUTLSError), error:
1201
logger.warning(u"Bad certificate: %s", error)
1255
1202
return
1256
logger.debug("Fingerprint: %s", fpr)
1203
logger.debug(u"Fingerprint: %s", fpr)
1257
1204
1258
1205
try:
1259
1206
client = ProxyClient(child_pipe, fpr,
1268
1215
1269
1216
while True:
1270
1217
if not client.enabled:
1271
logger.info("Client %s is disabled",
1218
logger.warning(u"Client %s is disabled",
1272
1219
client.name)
1273
1220
if self.server.use_dbus:
1274
1221
# Emit D-Bus signal
1279
1226
#We are approved or approval is disabled
1280
1227
break
1281
1228
elif client._approved is None:
1282
logger.info("Client %s needs approval",
1229
logger.info(u"Client %s needs approval",
1283
1230
client.name)
1284
1231
if self.server.use_dbus:
1285
1232
# Emit D-Bus signal
1287
1234
client.approval_delay_milliseconds(),
1288
1235
client.approved_by_default)
1289
1236
else:
1290
logger.warning("Client %s was not approved",
1237
logger.warning(u"Client %s was not approved",
1291
1238
client.name)
1292
1239
if self.server.use_dbus:
1293
1240
# Emit D-Bus signal
1319
1266
while sent_size < len(client.secret):
1320
1267
try:
1321
1268
sent = session.send(client.secret[sent_size:])
1322
except gnutls.errors.GNUTLSError as error:
1269
except (gnutls.errors.GNUTLSError), error:
1323
1270
logger.warning("gnutls send failed")
1324
1271
return
1325
logger.debug("Sent: %d, remaining: %d",
1272
logger.debug(u"Sent: %d, remaining: %d",
1326
1273
sent, len(client.secret)
1327
1274
- (sent_size + sent))
1328
1275
sent_size += sent
1329
1276
1330
logger.info("Sending secret to %s", client.name)
1277
logger.info(u"Sending secret to %s", client.name)
1331
1278
# bump the timeout as if seen
1332
1279
client.checked_ok()
1333
1280
if self.server.use_dbus:
1339
1286
client.approvals_pending -= 1
1340
1287
try:
1341
1288
session.bye()
1342
except gnutls.errors.GNUTLSError as error:
1289
except (gnutls.errors.GNUTLSError), error:
1343
1290
logger.warning("GnuTLS bye failed")
1344
1291
1345
1292
@staticmethod
1356
1303
.gnutls_certificate_get_peers
1357
1304
(session._c_object, ctypes.byref(list_size)))
1358
1305
if not bool(cert_list) and list_size.value != 0:
1359
raise gnutls.errors.GNUTLSError("error getting peer"
1360
" certificate")
1306
raise gnutls.errors.GNUTLSError(u"error getting peer"
1307
u" certificate")
1361
1308
if list_size.value == 0:
1362
1309
return None
1363
1310
cert = cert_list[0]
1389
1336
if crtverify.value != 0:
1390
1337
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1391
1338
raise (gnutls.errors.CertificateSecurityError
1392
("Verify failed"))
1339
(u"Verify failed"))
1393
1340
# New buffer for the fingerprint
1394
1341
buf = ctypes.create_string_buffer(20)
1395
1342
buf_len = ctypes.c_size_t()
1402
1349
# Convert the buffer to a Python bytestring
1403
1350
fpr = ctypes.string_at(buf, buf_len.value)
1404
1351
# Convert the bytestring to hexadecimal notation
1405
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1352
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1406
1353
return hex_fpr
1407
1354
1408
1355
1436
1383
1437
1384
def add_pipe(self, parent_pipe):
1438
1385
"""Dummy function; override as necessary"""
1439
raise NotImplementedError
1386
pass
1440
1387
1441
1388
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1442
1389
socketserver.TCPServer, object):
1460
1407
bind to an address or port if they were not specified."""
1461
1408
if self.interface is not None:
1462
1409
if SO_BINDTODEVICE is None:
1463
logger.error("SO_BINDTODEVICE does not exist;"
1464
" cannot bind to interface %s",
1410
logger.error(u"SO_BINDTODEVICE does not exist;"
1411
u" cannot bind to interface %s",
1465
1412
self.interface)
1466
1413
else:
1467
1414
try:
1468
1415
self.socket.setsockopt(socket.SOL_SOCKET,
1469
1416
SO_BINDTODEVICE,
1470
1417
str(self.interface
1471
+ '\0'))
1472
except socket.error as error:
1418
+ u'\0'))
1419
except socket.error, error:
1473
1420
if error[0] == errno.EPERM:
1474
logger.error("No permission to"
1475
" bind to interface %s",
1421
logger.error(u"No permission to"
1422
u" bind to interface %s",
1476
1423
self.interface)
1477
1424
elif error[0] == errno.ENOPROTOOPT:
1478
logger.error("SO_BINDTODEVICE not available;"
1479
" cannot bind to interface %s",
1425
logger.error(u"SO_BINDTODEVICE not available;"
1426
u" cannot bind to interface %s",
1480
1427
self.interface)
1481
1428
else:
1482
1429
raise
1484
1431
if self.server_address[0] or self.server_address[1]:
1485
1432
if not self.server_address[0]:
1486
1433
if self.address_family == socket.AF_INET6:
1487
any_address = "::" # in6addr_any
1434
any_address = u"::" # in6addr_any
1488
1435
else:
1489
1436
any_address = socket.INADDR_ANY
1490
1437
self.server_address = (any_address,
1539
1486
def handle_ipc(self, source, condition, parent_pipe=None,
1540
1487
client_object=None):
1541
1488
condition_names = {
1542
gobject.IO_IN: "IN", # There is data to read.
1543
gobject.IO_OUT: "OUT", # Data can be written (without
1489
gobject.IO_IN: u"IN", # There is data to read.
1490
gobject.IO_OUT: u"OUT", # Data can be written (without
1544
1491
# blocking).
1545
gobject.IO_PRI: "PRI", # There is urgent data to read.
1546
gobject.IO_ERR: "ERR", # Error condition.
1547
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1492
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1493
gobject.IO_ERR: u"ERR", # Error condition.
1494
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1548
1495
# broken, usually for pipes and
1549
1496
# sockets).
1550
1497
}
1569
1516
client = c
1570
1517
break
1571
1518
else:
1572
logger.info("Client not found for fingerprint: %s, ad"
1573
"dress: %s", fpr, address)
1519
logger.warning(u"Client not found for fingerprint: %s, ad"
1520
u"dress: %s", fpr, address)
1574
1521
if self.use_dbus:
1575
1522
# Emit D-Bus signal
1576
mandos_dbus_service.ClientNotFound(fpr, address[0])
1523
mandos_dbus_service.ClientNotFound(fpr, address)
1577
1524
parent_pipe.send(False)
1578
1525
return False
1579
1526
1610
1557
def string_to_delta(interval):
1611
1558
"""Parse a string and return a datetime.timedelta
1612
1559
1613
>>> string_to_delta('7d')
1560
>>> string_to_delta(u'7d')
1614
1561
datetime.timedelta(7)
1615
>>> string_to_delta('60s')
1562
>>> string_to_delta(u'60s')
1616
1563
datetime.timedelta(0, 60)
1617
>>> string_to_delta('60m')
1564
>>> string_to_delta(u'60m')
1618
1565
datetime.timedelta(0, 3600)
1619
>>> string_to_delta('24h')
1566
>>> string_to_delta(u'24h')
1620
1567
datetime.timedelta(1)
1621
>>> string_to_delta('1w')
1568
>>> string_to_delta(u'1w')
1622
1569
datetime.timedelta(7)
1623
>>> string_to_delta('5m 30s')
1570
>>> string_to_delta(u'5m 30s')
1624
1571
datetime.timedelta(0, 330)
1625
1572
"""
1626
1573
timevalue = datetime.timedelta(0)
1628
1575
try:
1629
1576
suffix = unicode(s[-1])
1630
1577
value = int(s[:-1])
1631
if suffix == "d":
1578
if suffix == u"d":
1632
1579
delta = datetime.timedelta(value)
1633
elif suffix == "s":
1580
elif suffix == u"s":
1634
1581
delta = datetime.timedelta(0, value)
1635
elif suffix == "m":
1582
elif suffix == u"m":
1636
1583
delta = datetime.timedelta(0, 0, 0, 0, value)
1637
elif suffix == "h":
1584
elif suffix == u"h":
1638
1585
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1639
elif suffix == "w":
1586
elif suffix == u"w":
1640
1587
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1641
1588
else:
1642
raise ValueError("Unknown suffix %r" % suffix)
1643
except (ValueError, IndexError) as e:
1644
raise ValueError(*(e.args))
1589
raise ValueError(u"Unknown suffix %r" % suffix)
1590
except (ValueError, IndexError), e:
1591
raise ValueError(e.message)
1645
1592
timevalue += delta
1646
1593
return timevalue
1647
1594
1653
1600
global if_nametoindex
1654
1601
try:
1655
1602
if_nametoindex = (ctypes.cdll.LoadLibrary
1656
(ctypes.util.find_library("c"))
1603
(ctypes.util.find_library(u"c"))
1657
1604
.if_nametoindex)
1658
1605
except (OSError, AttributeError):
1659
logger.warning("Doing if_nametoindex the hard way")
1606
logger.warning(u"Doing if_nametoindex the hard way")
1660
1607
def if_nametoindex(interface):
1661
1608
"Get an interface index the hard way, i.e. using fcntl()"
1662
1609
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1663
1610
with contextlib.closing(socket.socket()) as s:
1664
1611
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1665
struct.pack(str("16s16x"),
1612
struct.pack(str(u"16s16x"),
1666
1613
interface))
1667
interface_index = struct.unpack(str("I"),
1614
interface_index = struct.unpack(str(u"I"),
1668
1615
ifreq[16:20])[0]
1669
1616
return interface_index
1670
1617
return if_nametoindex(interface)
1678
1625
sys.exit()
1679
1626
os.setsid()
1680
1627
if not nochdir:
1681
os.chdir("/")
1628
os.chdir(u"/")
1682
1629
if os.fork():
1683
1630
sys.exit()
1684
1631
if not noclose:
1686
1633
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1687
1634
if not stat.S_ISCHR(os.fstat(null).st_mode):
1688
1635
raise OSError(errno.ENODEV,
1689
"%s not a character device"
1636
u"%s not a character device"
1690
1637
% os.path.devnull)
1691
1638
os.dup2(null, sys.stdin.fileno())
1692
1639
os.dup2(null, sys.stdout.fileno())
1700
1647
##################################################################
1701
1648
# Parsing of options, both command line and config file
1702
1649
1703
parser = argparse.ArgumentParser()
1704
parser.add_argument("-v", "--version", action="version",
1705
version = "%%(prog)s %s" % version,
1706
help="show version number and exit")
1707
parser.add_argument("-i", "--interface", metavar="IF",
1708
help="Bind to interface IF")
1709
parser.add_argument("-a", "--address",
1710
help="Address to listen for requests on")
1711
parser.add_argument("-p", "--port", type=int,
1712
help="Port number to receive requests on")
1713
parser.add_argument("--check", action="store_true",
1714
help="Run self-test")
1715
parser.add_argument("--debug", action="store_true",
1716
help="Debug mode; run in foreground and log"
1717
" to terminal")
1718
parser.add_argument("--debuglevel", metavar="LEVEL",
1719
help="Debug level for stdout output")
1720
parser.add_argument("--priority", help="GnuTLS"
1721
" priority string (see GnuTLS documentation)")
1722
parser.add_argument("--servicename",
1723
metavar="NAME", help="Zeroconf service name")
1724
parser.add_argument("--configdir",
1725
default="/etc/mandos", metavar="DIR",
1726
help="Directory to search for configuration"
1727
" files")
1728
parser.add_argument("--no-dbus", action="store_false",
1729
dest="use_dbus", help="Do not provide D-Bus"
1730
" system bus interface")
1731
parser.add_argument("--no-ipv6", action="store_false",
1732
dest="use_ipv6", help="Do not use IPv6")
1733
options = parser.parse_args()
1650
parser = optparse.OptionParser(version = "%%prog %s" % version)
1651
parser.add_option("-i", u"--interface", type=u"string",
1652
metavar="IF", help=u"Bind to interface IF")
1653
parser.add_option("-a", u"--address", type=u"string",
1654
help=u"Address to listen for requests on")
1655
parser.add_option("-p", u"--port", type=u"int",
1656
help=u"Port number to receive requests on")
1657
parser.add_option("--check", action=u"store_true",
1658
help=u"Run self-test")
1659
parser.add_option("--debug", action=u"store_true",
1660
help=u"Debug mode; run in foreground and log to"
1661
u" terminal")
1662
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1663
help=u"Debug level for stdout output")
1664
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1665
u" priority string (see GnuTLS documentation)")
1666
parser.add_option("--servicename", type=u"string",
1667
metavar=u"NAME", help=u"Zeroconf service name")
1668
parser.add_option("--configdir", type=u"string",
1669
default=u"/etc/mandos", metavar=u"DIR",
1670
help=u"Directory to search for configuration"
1671
u" files")
1672
parser.add_option("--no-dbus", action=u"store_false",
1673
dest=u"use_dbus", help=u"Do not provide D-Bus"
1674
u" system bus interface")
1675
parser.add_option("--no-ipv6", action=u"store_false",
1676
dest=u"use_ipv6", help=u"Do not use IPv6")
1677
options = parser.parse_args()[0]
1734
1678
1735
1679
if options.check:
1736
1680
import doctest
1738
1682
sys.exit()
1739
1683
1740
1684
# Default values for config file for server-global settings
1741
server_defaults = { "interface": "",
1742
"address": "",
1743
"port": "",
1744
"debug": "False",
1745
"priority":
1746
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1747
"servicename": "Mandos",
1748
"use_dbus": "True",
1749
"use_ipv6": "True",
1750
"debuglevel": "",
1685
server_defaults = { u"interface": u"",
1686
u"address": u"",
1687
u"port": u"",
1688
u"debug": u"False",
1689
u"priority":
1690
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1691
u"servicename": u"Mandos",
1692
u"use_dbus": u"True",
1693
u"use_ipv6": u"True",
1694
u"debuglevel": u"",
1751
1695
}
1752
1696
1753
1697
# Parse config file for server-global settings
1754
1698
server_config = configparser.SafeConfigParser(server_defaults)
1755
1699
del server_defaults
1756
1700
server_config.read(os.path.join(options.configdir,
1757
"mandos.conf"))
1701
u"mandos.conf"))
1758
1702
# Convert the SafeConfigParser object to a dict
1759
1703
server_settings = server_config.defaults()
1760
1704
# Use the appropriate methods on the non-string config options
1761
for option in ("debug", "use_dbus", "use_ipv6"):
1762
server_settings[option] = server_config.getboolean("DEFAULT",
1705
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1706
server_settings[option] = server_config.getboolean(u"DEFAULT",
1763
1707
option)
1764
1708
if server_settings["port"]:
1765
server_settings["port"] = server_config.getint("DEFAULT",
1766
"port")
1709
server_settings["port"] = server_config.getint(u"DEFAULT",
1710
u"port")
1767
1711
del server_config
1768
1712
1769
1713
# Override the settings from the config file with command line
1770
1714
# options, if set.
1771
for option in ("interface", "address", "port", "debug",
1772
"priority", "servicename", "configdir",
1773
"use_dbus", "use_ipv6", "debuglevel"):
1715
for option in (u"interface", u"address", u"port", u"debug",
1716
u"priority", u"servicename", u"configdir",
1717
u"use_dbus", u"use_ipv6", u"debuglevel"):
1774
1718
value = getattr(options, option)
1775
1719
if value is not None:
1776
1720
server_settings[option] = value
1784
1728
##################################################################
1785
1729
1786
1730
# For convenience
1787
debug = server_settings["debug"]
1788
debuglevel = server_settings["debuglevel"]
1789
use_dbus = server_settings["use_dbus"]
1790
use_ipv6 = server_settings["use_ipv6"]
1731
debug = server_settings[u"debug"]
1732
debuglevel = server_settings[u"debuglevel"]
1733
use_dbus = server_settings[u"use_dbus"]
1734
use_ipv6 = server_settings[u"use_ipv6"]
1791
1735
1792
if server_settings["servicename"] != "Mandos":
1736
if server_settings[u"servicename"] != u"Mandos":
1793
1737
syslogger.setFormatter(logging.Formatter
1794
('Mandos (%s) [%%(process)d]:'
1795
' %%(levelname)s: %%(message)s'
1796
% server_settings["servicename"]))
1738
(u'Mandos (%s) [%%(process)d]:'
1739
u' %%(levelname)s: %%(message)s'
1740
% server_settings[u"servicename"]))
1797
1741
1798
1742
# Parse config file with clients
1799
client_defaults = { "timeout": "1h",
1800
"interval": "5m",
1801
"checker": "fping -q -- %%(host)s",
1802
"host": "",
1803
"approval_delay": "0s",
1804
"approval_duration": "1s",
1743
client_defaults = { u"timeout": u"1h",
1744
u"interval": u"5m",
1745
u"checker": u"fping -q -- %%(host)s",
1746
u"host": u"",
1747
u"approval_delay": u"0s",
1748
u"approval_duration": u"1s",
1805
1749
}
1806
1750
client_config = configparser.SafeConfigParser(client_defaults)
1807
client_config.read(os.path.join(server_settings["configdir"],
1808
"clients.conf"))
1751
client_config.read(os.path.join(server_settings[u"configdir"],
1752
u"clients.conf"))
1809
1753
1810
1754
global mandos_dbus_service
1811
1755
mandos_dbus_service = None
1812
1756
1813
tcp_server = MandosServer((server_settings["address"],
1814
server_settings["port"]),
1757
tcp_server = MandosServer((server_settings[u"address"],
1758
server_settings[u"port"]),
1815
1759
ClientHandler,
1816
interface=(server_settings["interface"]
1760
interface=(server_settings[u"interface"]
1817
1761
or None),
1818
1762
use_ipv6=use_ipv6,
1819
1763
gnutls_priority=
1820
server_settings["priority"],
1764
server_settings[u"priority"],
1821
1765
use_dbus=use_dbus)
1822
1766
if not debug:
1823
pidfilename = "/var/run/mandos.pid"
1767
pidfilename = u"/var/run/mandos.pid"
1824
1768
try:
1825
pidfile = open(pidfilename, "w")
1769
pidfile = open(pidfilename, u"w")
1826
1770
except IOError:
1827
logger.error("Could not open file %r", pidfilename)
1771
logger.error(u"Could not open file %r", pidfilename)
1828
1772
1829
1773
try:
1830
uid = pwd.getpwnam("_mandos").pw_uid
1831
gid = pwd.getpwnam("_mandos").pw_gid
1774
uid = pwd.getpwnam(u"_mandos").pw_uid
1775
gid = pwd.getpwnam(u"_mandos").pw_gid
1832
1776
except KeyError:
1833
1777
try:
1834
uid = pwd.getpwnam("mandos").pw_uid
1835
gid = pwd.getpwnam("mandos").pw_gid
1778
uid = pwd.getpwnam(u"mandos").pw_uid
1779
gid = pwd.getpwnam(u"mandos").pw_gid
1836
1780
except KeyError:
1837
1781
try:
1838
uid = pwd.getpwnam("nobody").pw_uid
1839
gid = pwd.getpwnam("nobody").pw_gid
1782
uid = pwd.getpwnam(u"nobody").pw_uid
1783
gid = pwd.getpwnam(u"nobody").pw_gid
1840
1784
except KeyError:
1841
1785
uid = 65534
1842
1786
gid = 65534
1843
1787
try:
1844
1788
os.setgid(gid)
1845
1789
os.setuid(uid)
1846
except OSError as error:
1790
except OSError, error:
1847
1791
if error[0] != errno.EPERM:
1848
1792
raise error
1849
1793
1864
1808
1865
1809
@gnutls.library.types.gnutls_log_func
1866
1810
def debug_gnutls(level, string):
1867
logger.debug("GnuTLS: %s", string[:-1])
1811
logger.debug(u"GnuTLS: %s", string[:-1])
1868
1812
1869
1813
(gnutls.library.functions
1870
1814
.gnutls_global_set_log_function(debug_gnutls))
1878
1822
# No console logging
1879
1823
logger.removeHandler(console)
1880
1824
1881
# Need to fork before connecting to D-Bus
1882
if not debug:
1883
# Close all input and output, do double fork, etc.
1884
daemon()
1885
1825
1886
1826
global main_loop
1887
1827
# From the Avahi example code
1891
1831
# End of Avahi example code
1892
1832
if use_dbus:
1893
1833
try:
1894
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1834
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1895
1835
bus, do_not_queue=True)
1896
except dbus.exceptions.NameExistsException as e:
1897
logger.error(unicode(e) + ", disabling D-Bus")
1836
except dbus.exceptions.NameExistsException, e:
1837
logger.error(unicode(e) + u", disabling D-Bus")
1898
1838
use_dbus = False
1899
server_settings["use_dbus"] = False
1839
server_settings[u"use_dbus"] = False
1900
1840
tcp_server.use_dbus = False
1901
1841
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1902
service = AvahiService(name = server_settings["servicename"],
1903
servicetype = "_mandos._tcp",
1842
service = AvahiService(name = server_settings[u"servicename"],
1843
servicetype = u"_mandos._tcp",
1904
1844
protocol = protocol, bus = bus)
1905
1845
if server_settings["interface"]:
1906
1846
service.interface = (if_nametoindex
1907
(str(server_settings["interface"])))
1908
1847
(str(server_settings[u"interface"])))
1848
1849
if not debug:
1850
# Close all input and output, do double fork, etc.
1851
daemon()
1852
1909
1853
global multiprocessing_manager
1910
1854
multiprocessing_manager = multiprocessing.Manager()
1911
1855
1930
1874
client_config, section)))
1931
1875
for section in client_config.sections()))
1932
1876
if not tcp_server.clients:
1933
logger.warning("No clients defined")
1877
logger.warning(u"No clients defined")
1934
1878
1935
1879
if not debug:
1936
1880
try:
1937
1881
with pidfile:
1938
1882
pid = os.getpid()
1939
pidfile.write(str(pid) + "\n".encode("utf-8"))
1883
pidfile.write(str(pid) + "\n")
1940
1884
del pidfile
1941
1885
except IOError:
1942
logger.error("Could not write to file %r with PID %d",
1886
logger.error(u"Could not write to file %r with PID %d",
1943
1887
pidfilename, pid)
1944
1888
except NameError:
1945
1889
# "pidfile" was never created
1955
1899
class MandosDBusService(dbus.service.Object):
1956
1900
"""A D-Bus proxy object"""
1957
1901
def __init__(self):
1958
dbus.service.Object.__init__(self, bus, "/")
1959
_interface = "se.bsnet.fukt.Mandos"
1902
dbus.service.Object.__init__(self, bus, u"/")
1903
_interface = u"se.bsnet.fukt.Mandos"
1960
1904
1961
@dbus.service.signal(_interface, signature="o")
1905
@dbus.service.signal(_interface, signature=u"o")
1962
1906
def ClientAdded(self, objpath):
1963
1907
"D-Bus signal"
1964
1908
pass
1965
1909
1966
@dbus.service.signal(_interface, signature="ss")
1910
@dbus.service.signal(_interface, signature=u"ss")
1967
1911
def ClientNotFound(self, fingerprint, address):
1968
1912
"D-Bus signal"
1969
1913
pass
1970
1914
1971
@dbus.service.signal(_interface, signature="os")
1915
@dbus.service.signal(_interface, signature=u"os")
1972
1916
def ClientRemoved(self, objpath, name):
1973
1917
"D-Bus signal"
1974
1918
pass
1975
1919
1976
@dbus.service.method(_interface, out_signature="ao")
1920
@dbus.service.method(_interface, out_signature=u"ao")
1977
1921
def GetAllClients(self):
1978
1922
"D-Bus method"
1979
1923
return dbus.Array(c.dbus_object_path
1980
1924
for c in tcp_server.clients)
1981
1925
1982
1926
@dbus.service.method(_interface,
1983
out_signature="a{oa{sv}}")
1927
out_signature=u"a{oa{sv}}")
1984
1928
def GetAllClientsWithProperties(self):
1985
1929
"D-Bus method"
1986
1930
return dbus.Dictionary(
1987
((c.dbus_object_path, c.GetAll(""))
1931
((c.dbus_object_path, c.GetAll(u""))
1988
1932
for c in tcp_server.clients),
1989
signature="oa{sv}")
1933
signature=u"oa{sv}")
1990
1934
1991
@dbus.service.method(_interface, in_signature="o")
1935
@dbus.service.method(_interface, in_signature=u"o")
1992
1936
def RemoveClient(self, object_path):
1993
1937
"D-Bus method"
1994
1938
for c in tcp_server.clients:
2036
1980
# Find out what port we got
2037
1981
service.port = tcp_server.socket.getsockname()[1]
2038
1982
if use_ipv6:
2039
logger.info("Now listening on address %r, port %d,"
1983
logger.info(u"Now listening on address %r, port %d,"
2040
1984
" flowinfo %d, scope_id %d"
2041
1985
% tcp_server.socket.getsockname())
2042
1986
else: # IPv4
2043
logger.info("Now listening on address %r, port %d"
1987
logger.info(u"Now listening on address %r, port %d"
2044
1988
% tcp_server.socket.getsockname())
2045
1989
2046
1990
#service.interface = tcp_server.socket.getsockname()[3]
2049
1993
# From the Avahi example code
2050
1994
try:
2051
1995
service.activate()
2052
except dbus.exceptions.DBusException as error:
2053
logger.critical("DBusException: %s", error)
1996
except dbus.exceptions.DBusException, error:
1997
logger.critical(u"DBusException: %s", error)
2054
1998
cleanup()
2055
1999
sys.exit(1)
2056
2000
# End of Avahi example code
2060
2004
(tcp_server.handle_request
2061
2005
(*args[2:], **kwargs) or True))
2062
2006
2063
logger.debug("Starting main loop")
2007
logger.debug(u"Starting main loop")
2064
2008
main_loop.run()
2065
except AvahiError as error:
2066
logger.critical("AvahiError: %s", error)
2009
except AvahiError, error:
2010
logger.critical(u"AvahiError: %s", error)
2067
2011
cleanup()
2068
2012
sys.exit(1)
2069
2013
except KeyboardInterrupt:
2070
2014
if debug:
2071
print("", file=sys.stderr)
2072
logger.debug("Server received KeyboardInterrupt")
2073
logger.debug("Server exiting")
2015
print >> sys.stderr
2016
logger.debug(u"Server received KeyboardInterrupt")
2017
logger.debug(u"Server exiting")
2074
2018
# Must run before the D-Bus bus name gets deregistered
2075
2019
cleanup()
2076
2020
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0