To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 237.4.9
- compare with another revision
- download diff
- download tarball
- view history from revision 237.4.9
- Committer: Teddy Hogeborn
- Date: 2010-10-07 18:21:13 UTC
- mfrom: (456 mandos)
- mto: (237.4.29 release)
- mto: This revision was merged to the branch mainline in revision 457.
- Revision ID: teddy@fukt.bsnet.se-20101007182113-a9n1q0dklh6q1x94
Merge from trunk.
- files modified:
- DBUS-API
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008-2010 Teddy Hogeborn
15
# Copyright © 2008-2010 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
31
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
36
import SocketServer as socketserver
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
82
81
SO_BINDTODEVICE = None
83
82
84
83
85
version = "1.3.0"
84
version = "1.2.1"
86
85
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
89
88
syslogger = (logging.handlers.SysLogHandler
90
89
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
address = str("/dev/log")))
90
address = "/dev/log"))
92
91
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
95
94
logger.addHandler(syslogger)
96
95
97
96
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
100
' %(message)s'))
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
101
100
logger.addHandler(console)
102
101
103
102
class AvahiError(Exception):
120
119
Attributes:
121
120
interface: integer; avahi.IF_UNSPEC or an interface index.
122
121
Used to optionally bind to the specified interface.
123
name: string; Example: 'Mandos'
124
type: string; Example: '_mandos._tcp'.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
125
124
See <http://www.dns-sd.org/ServiceTypes.html>
126
125
port: integer; what port to announce
127
126
TXT: list of strings; TXT record for the service
136
135
"""
137
136
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
137
servicetype = None, port = None, TXT = None,
139
domain = "", host = "", max_renames = 32768,
138
domain = u"", host = u"", max_renames = 32768,
140
139
protocol = avahi.PROTO_UNSPEC, bus = None):
141
140
self.interface = interface
142
141
self.name = name
154
153
def rename(self):
155
154
"""Derived from the Avahi example code"""
156
155
if self.rename_count >= self.max_renames:
157
logger.critical("No suitable Zeroconf service name found"
158
" after %i retries, exiting.",
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
159
158
self.rename_count)
160
raise AvahiServiceError("Too many renames")
159
raise AvahiServiceError(u"Too many renames")
161
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
162
logger.info("Changing Zeroconf service name to %r ...",
161
logger.info(u"Changing Zeroconf service name to %r ...",
163
162
self.name)
164
163
syslogger.setFormatter(logging.Formatter
165
('Mandos (%s) [%%(process)d]:'
166
' %%(levelname)s: %%(message)s'
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
167
166
% self.name))
168
167
self.remove()
169
168
try:
170
169
self.add()
171
170
except dbus.exceptions.DBusException, error:
172
logger.critical("DBusException: %s", error)
171
logger.critical(u"DBusException: %s", error)
173
172
self.cleanup()
174
173
os._exit(1)
175
174
self.rename_count += 1
187
186
self.group.connect_to_signal('StateChanged',
188
187
self
189
188
.entry_group_state_changed)
190
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
189
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
191
190
self.name, self.type)
192
191
self.group.AddService(
193
192
self.interface,
200
199
self.group.Commit()
201
200
def entry_group_state_changed(self, state, error):
202
201
"""Derived from the Avahi example code"""
203
logger.debug("Avahi entry group state change: %i", state)
202
logger.debug(u"Avahi entry group state change: %i", state)
204
203
205
204
if state == avahi.ENTRY_GROUP_ESTABLISHED:
206
logger.debug("Zeroconf service established.")
205
logger.debug(u"Zeroconf service established.")
207
206
elif state == avahi.ENTRY_GROUP_COLLISION:
208
logger.info("Zeroconf service name collision.")
207
logger.warning(u"Zeroconf service name collision.")
209
208
self.rename()
210
209
elif state == avahi.ENTRY_GROUP_FAILURE:
211
logger.critical("Avahi: Error in group state changed %s",
210
logger.critical(u"Avahi: Error in group state changed %s",
212
211
unicode(error))
213
raise AvahiGroupError("State changed: %s"
212
raise AvahiGroupError(u"State changed: %s"
214
213
% unicode(error))
215
214
def cleanup(self):
216
215
"""Derived from the Avahi example code"""
219
218
self.group = None
220
219
def server_state_changed(self, state):
221
220
"""Derived from the Avahi example code"""
222
logger.debug("Avahi server state change: %i", state)
221
logger.debug(u"Avahi server state change: %i", state)
223
222
if state == avahi.SERVER_COLLISION:
224
logger.error("Zeroconf server name collision")
223
logger.error(u"Zeroconf server name collision")
225
224
self.remove()
226
225
elif state == avahi.SERVER_RUNNING:
227
226
self.add()
232
231
self.bus.get_object(avahi.DBUS_NAME,
233
232
avahi.DBUS_PATH_SERVER),
234
233
avahi.DBUS_INTERFACE_SERVER)
235
self.server.connect_to_signal("StateChanged",
234
self.server.connect_to_signal(u"StateChanged",
236
235
self.server_state_changed)
237
236
self.server_state_changed(self.server.GetState())
238
237
273
272
runtime_expansions: Allowed attributes for runtime expansion.
274
273
"""
275
274
276
runtime_expansions = ("approval_delay", "approval_duration",
277
"created", "enabled", "fingerprint",
278
"host", "interval", "last_checked_ok",
279
"last_enabled", "name", "timeout")
275
runtime_expansions = (u"approval_delay", u"approval_duration",
276
u"created", u"enabled", u"fingerprint",
277
u"host", u"interval", u"last_checked_ok",
278
u"last_enabled", u"name", u"timeout")
280
279
281
280
@staticmethod
282
281
def _timedelta_to_milliseconds(td):
303
302
self.name = name
304
303
if config is None:
305
304
config = {}
306
logger.debug("Creating client %r", self.name)
305
logger.debug(u"Creating client %r", self.name)
307
306
# Uppercase and remove spaces from fingerprint for later
308
307
# comparison purposes with return value from the fingerprint()
309
308
# function
310
self.fingerprint = (config["fingerprint"].upper()
311
.replace(" ", ""))
312
logger.debug(" Fingerprint: %s", self.fingerprint)
313
if "secret" in config:
314
self.secret = config["secret"].decode("base64")
315
elif "secfile" in config:
309
self.fingerprint = (config[u"fingerprint"].upper()
310
.replace(u" ", u""))
311
logger.debug(u" Fingerprint: %s", self.fingerprint)
312
if u"secret" in config:
313
self.secret = config[u"secret"].decode(u"base64")
314
elif u"secfile" in config:
316
315
with open(os.path.expanduser(os.path.expandvars
317
(config["secfile"])),
316
(config[u"secfile"])),
318
317
"rb") as secfile:
319
318
self.secret = secfile.read()
320
319
else:
321
raise TypeError("No secret or secfile for client %s"
320
raise TypeError(u"No secret or secfile for client %s"
322
321
% self.name)
323
self.host = config.get("host", "")
322
self.host = config.get(u"host", u"")
324
323
self.created = datetime.datetime.utcnow()
325
324
self.enabled = False
326
325
self.last_approval_request = None
327
326
self.last_enabled = None
328
327
self.last_checked_ok = None
329
self.timeout = string_to_delta(config["timeout"])
330
self.interval = string_to_delta(config["interval"])
328
self.timeout = string_to_delta(config[u"timeout"])
329
self.interval = string_to_delta(config[u"interval"])
331
330
self.disable_hook = disable_hook
332
331
self.checker = None
333
332
self.checker_initiator_tag = None
334
333
self.disable_initiator_tag = None
335
334
self.checker_callback_tag = None
336
self.checker_command = config["checker"]
335
self.checker_command = config[u"checker"]
337
336
self.current_checker_command = None
338
337
self.last_connect = None
339
338
self._approved = None
340
self.approved_by_default = config.get("approved_by_default",
339
self.approved_by_default = config.get(u"approved_by_default",
341
340
True)
342
341
self.approvals_pending = 0
343
342
self.approval_delay = string_to_delta(
344
config["approval_delay"])
343
config[u"approval_delay"])
345
344
self.approval_duration = string_to_delta(
346
config["approval_duration"])
345
config[u"approval_duration"])
347
346
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
348
347
349
348
def send_changedstate(self):
353
352
354
353
def enable(self):
355
354
"""Start this client's checker and timeout hooks"""
356
if getattr(self, "enabled", False):
355
if getattr(self, u"enabled", False):
357
356
# Already enabled
358
357
return
359
358
self.send_changedstate()
378
377
if not quiet:
379
378
self.send_changedstate()
380
379
if not quiet:
381
logger.info("Disabling client %s", self.name)
382
if getattr(self, "disable_initiator_tag", False):
380
logger.info(u"Disabling client %s", self.name)
381
if getattr(self, u"disable_initiator_tag", False):
383
382
gobject.source_remove(self.disable_initiator_tag)
384
383
self.disable_initiator_tag = None
385
if getattr(self, "checker_initiator_tag", False):
384
if getattr(self, u"checker_initiator_tag", False):
386
385
gobject.source_remove(self.checker_initiator_tag)
387
386
self.checker_initiator_tag = None
388
387
self.stop_checker()
403
402
if os.WIFEXITED(condition):
404
403
exitstatus = os.WEXITSTATUS(condition)
405
404
if exitstatus == 0:
406
logger.info("Checker for %(name)s succeeded",
405
logger.info(u"Checker for %(name)s succeeded",
407
406
vars(self))
408
407
self.checked_ok()
409
408
else:
410
logger.info("Checker for %(name)s failed",
409
logger.info(u"Checker for %(name)s failed",
411
410
vars(self))
412
411
else:
413
logger.warning("Checker for %(name)s crashed?",
412
logger.warning(u"Checker for %(name)s crashed?",
414
413
vars(self))
415
414
416
415
def checked_ok(self):
451
450
raise error
452
451
else:
453
452
if pid:
454
logger.warning("Checker was a zombie")
453
logger.warning(u"Checker was a zombie")
455
454
gobject.source_remove(self.checker_callback_tag)
456
455
self.checker_callback(pid, status,
457
456
self.current_checker_command)
464
463
# Escape attributes for the shell
465
464
escaped_attrs = dict(
466
465
(attr,
467
re.escape(unicode(str(getattr(self, attr, "")),
466
re.escape(unicode(str(getattr(self, attr, u"")),
468
467
errors=
469
'replace')))
468
u'replace')))
470
469
for attr in
471
470
self.runtime_expansions)
472
471
473
472
try:
474
473
command = self.checker_command % escaped_attrs
475
474
except TypeError, error:
476
logger.error('Could not format string "%s":'
477
' %s', self.checker_command, error)
475
logger.error(u'Could not format string "%s":'
476
u' %s', self.checker_command, error)
478
477
return True # Try again later
479
478
self.current_checker_command = command
480
479
try:
481
logger.info("Starting checker %r for %s",
480
logger.info(u"Starting checker %r for %s",
482
481
command, self.name)
483
482
# We don't need to redirect stdout and stderr, since
484
483
# in normal mode, that is already done by daemon(),
486
485
# always replaced by /dev/null.)
487
486
self.checker = subprocess.Popen(command,
488
487
close_fds=True,
489
shell=True, cwd="/")
488
shell=True, cwd=u"/")
490
489
self.checker_callback_tag = (gobject.child_watch_add
491
490
(self.checker.pid,
492
491
self.checker_callback,
498
497
gobject.source_remove(self.checker_callback_tag)
499
498
self.checker_callback(pid, status, command)
500
499
except OSError, error:
501
logger.error("Failed to start subprocess: %s",
500
logger.error(u"Failed to start subprocess: %s",
502
501
error)
503
502
# Re-run this periodically if run by gobject.timeout_add
504
503
return True
508
507
if self.checker_callback_tag:
509
508
gobject.source_remove(self.checker_callback_tag)
510
509
self.checker_callback_tag = None
511
if getattr(self, "checker", None) is None:
510
if getattr(self, u"checker", None) is None:
512
511
return
513
logger.debug("Stopping checker for %(name)s", vars(self))
512
logger.debug(u"Stopping checker for %(name)s", vars(self))
514
513
try:
515
514
os.kill(self.checker.pid, signal.SIGTERM)
516
515
#time.sleep(0.5)
521
520
raise
522
521
self.checker = None
523
522
524
def dbus_service_property(dbus_interface, signature="v",
525
access="readwrite", byte_arrays=False):
523
def dbus_service_property(dbus_interface, signature=u"v",
524
access=u"readwrite", byte_arrays=False):
526
525
"""Decorators for marking methods of a DBusObjectWithProperties to
527
526
become properties on the D-Bus.
528
527
535
534
"""
536
535
# Encoding deeply encoded byte arrays is not supported yet by the
537
536
# "Set" method, so we fail early here:
538
if byte_arrays and signature != "ay":
539
raise ValueError("Byte arrays not supported for non-'ay'"
540
" signature %r" % signature)
537
if byte_arrays and signature != u"ay":
538
raise ValueError(u"Byte arrays not supported for non-'ay'"
539
u" signature %r" % signature)
541
540
def decorator(func):
542
541
func._dbus_is_property = True
543
542
func._dbus_interface = dbus_interface
544
543
func._dbus_signature = signature
545
544
func._dbus_access = access
546
545
func._dbus_name = func.__name__
547
if func._dbus_name.endswith("_dbus_property"):
546
if func._dbus_name.endswith(u"_dbus_property"):
548
547
func._dbus_name = func._dbus_name[:-14]
549
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
548
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
550
549
return func
551
550
return decorator
552
551
580
579
581
580
@staticmethod
582
581
def _is_dbus_property(obj):
583
return getattr(obj, "_dbus_is_property", False)
582
return getattr(obj, u"_dbus_is_property", False)
584
583
585
584
def _get_all_dbus_properties(self):
586
585
"""Returns a generator of (name, attribute) pairs
594
593
property with the specified name and interface.
595
594
"""
596
595
for name in (property_name,
597
property_name + "_dbus_property"):
596
property_name + u"_dbus_property"):
598
597
prop = getattr(self, name, None)
599
598
if (prop is None
600
599
or not self._is_dbus_property(prop)
604
603
continue
605
604
return prop
606
605
# No such property
607
raise DBusPropertyNotFound(self.dbus_object_path + ":"
608
+ interface_name + "."
606
raise DBusPropertyNotFound(self.dbus_object_path + u":"
607
+ interface_name + u"."
609
608
+ property_name)
610
609
611
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
612
out_signature="v")
610
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
611
out_signature=u"v")
613
612
def Get(self, interface_name, property_name):
614
613
"""Standard D-Bus property Get() method, see D-Bus standard.
615
614
"""
616
615
prop = self._get_dbus_property(interface_name, property_name)
617
if prop._dbus_access == "write":
616
if prop._dbus_access == u"write":
618
617
raise DBusPropertyAccessException(property_name)
619
618
value = prop()
620
if not hasattr(value, "variant_level"):
619
if not hasattr(value, u"variant_level"):
621
620
return value
622
621
return type(value)(value, variant_level=value.variant_level+1)
623
622
624
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
623
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
625
624
def Set(self, interface_name, property_name, value):
626
625
"""Standard D-Bus property Set() method, see D-Bus standard.
627
626
"""
628
627
prop = self._get_dbus_property(interface_name, property_name)
629
if prop._dbus_access == "read":
628
if prop._dbus_access == u"read":
630
629
raise DBusPropertyAccessException(property_name)
631
if prop._dbus_get_args_options["byte_arrays"]:
630
if prop._dbus_get_args_options[u"byte_arrays"]:
632
631
# The byte_arrays option is not supported yet on
633
632
# signatures other than "ay".
634
if prop._dbus_signature != "ay":
633
if prop._dbus_signature != u"ay":
635
634
raise ValueError
636
635
value = dbus.ByteArray(''.join(unichr(byte)
637
636
for byte in value))
638
637
prop(value)
639
638
640
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
641
out_signature="a{sv}")
639
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
640
out_signature=u"a{sv}")
642
641
def GetAll(self, interface_name):
643
642
"""Standard D-Bus property GetAll() method, see D-Bus
644
643
standard.
652
651
# Interface non-empty but did not match
653
652
continue
654
653
# Ignore write-only properties
655
if prop._dbus_access == "write":
654
if prop._dbus_access == u"write":
656
655
continue
657
656
value = prop()
658
if not hasattr(value, "variant_level"):
657
if not hasattr(value, u"variant_level"):
659
658
all[name] = value
660
659
continue
661
660
all[name] = type(value)(value, variant_level=
662
661
value.variant_level+1)
663
return dbus.Dictionary(all, signature="sv")
662
return dbus.Dictionary(all, signature=u"sv")
664
663
665
664
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
666
out_signature="s",
665
out_signature=u"s",
667
666
path_keyword='object_path',
668
667
connection_keyword='connection')
669
668
def Introspect(self, object_path, connection):
674
673
try:
675
674
document = xml.dom.minidom.parseString(xmlstring)
676
675
def make_tag(document, name, prop):
677
e = document.createElement("property")
678
e.setAttribute("name", name)
679
e.setAttribute("type", prop._dbus_signature)
680
e.setAttribute("access", prop._dbus_access)
676
e = document.createElement(u"property")
677
e.setAttribute(u"name", name)
678
e.setAttribute(u"type", prop._dbus_signature)
679
e.setAttribute(u"access", prop._dbus_access)
681
680
return e
682
for if_tag in document.getElementsByTagName("interface"):
681
for if_tag in document.getElementsByTagName(u"interface"):
683
682
for tag in (make_tag(document, name, prop)
684
683
for name, prop
685
684
in self._get_all_dbus_properties()
686
685
if prop._dbus_interface
687
== if_tag.getAttribute("name")):
686
== if_tag.getAttribute(u"name")):
688
687
if_tag.appendChild(tag)
689
688
# Add the names to the return values for the
690
689
# "org.freedesktop.DBus.Properties" methods
691
if (if_tag.getAttribute("name")
692
== "org.freedesktop.DBus.Properties"):
693
for cn in if_tag.getElementsByTagName("method"):
694
if cn.getAttribute("name") == "Get":
695
for arg in cn.getElementsByTagName("arg"):
696
if (arg.getAttribute("direction")
697
== "out"):
698
arg.setAttribute("name", "value")
699
elif cn.getAttribute("name") == "GetAll":
700
for arg in cn.getElementsByTagName("arg"):
701
if (arg.getAttribute("direction")
702
== "out"):
703
arg.setAttribute("name", "props")
704
xmlstring = document.toxml("utf-8")
690
if (if_tag.getAttribute(u"name")
691
== u"org.freedesktop.DBus.Properties"):
692
for cn in if_tag.getElementsByTagName(u"method"):
693
if cn.getAttribute(u"name") == u"Get":
694
for arg in cn.getElementsByTagName(u"arg"):
695
if (arg.getAttribute(u"direction")
696
== u"out"):
697
arg.setAttribute(u"name", u"value")
698
elif cn.getAttribute(u"name") == u"GetAll":
699
for arg in cn.getElementsByTagName(u"arg"):
700
if (arg.getAttribute(u"direction")
701
== u"out"):
702
arg.setAttribute(u"name", u"props")
703
xmlstring = document.toxml(u"utf-8")
705
704
document.unlink()
706
705
except (AttributeError, xml.dom.DOMException,
707
706
xml.parsers.expat.ExpatError), error:
708
logger.error("Failed to override Introspection method",
707
logger.error(u"Failed to override Introspection method",
709
708
error)
710
709
return xmlstring
711
710
719
718
"""
720
719
721
720
runtime_expansions = (Client.runtime_expansions
722
+ ("dbus_object_path",))
721
+ (u"dbus_object_path",))
723
722
724
723
# dbus.service.Object doesn't use super(), so we can't either.
725
724
730
729
# Only now, when this client is initialized, can it show up on
731
730
# the D-Bus
732
731
client_object_name = unicode(self.name).translate(
733
{ord("."): ord("_"),
734
ord("-"): ord("_")})
732
{ord(u"."): ord(u"_"),
733
ord(u"-"): ord(u"_")})
735
734
self.dbus_object_path = (dbus.ObjectPath
736
("/clients/" + client_object_name))
735
(u"/clients/" + client_object_name))
737
736
DBusObjectWithProperties.__init__(self, self.bus,
738
737
self.dbus_object_path)
739
738
746
745
if (hasattr(self, "dbus_object_path")
747
746
and bval is not bool(old_value)):
748
747
dbus_bool = dbus.Boolean(bval, variant_level=1)
749
self.PropertyChanged(dbus.String("ApprovalPending"),
748
self.PropertyChanged(dbus.String(u"ApprovalPending"),
750
749
dbus_bool)
751
750
752
751
approvals_pending = property(_get_approvals_pending,
760
759
variant_level=variant_level)
761
760
762
761
def enable(self):
763
oldstate = getattr(self, "enabled", False)
762
oldstate = getattr(self, u"enabled", False)
764
763
r = Client.enable(self)
765
764
if oldstate != self.enabled:
766
765
# Emit D-Bus signals
767
self.PropertyChanged(dbus.String("Enabled"),
766
self.PropertyChanged(dbus.String(u"Enabled"),
768
767
dbus.Boolean(True, variant_level=1))
769
768
self.PropertyChanged(
770
dbus.String("LastEnabled"),
769
dbus.String(u"LastEnabled"),
771
770
self._datetime_to_dbus(self.last_enabled,
772
771
variant_level=1))
773
772
return r
774
773
775
774
def disable(self, quiet = False):
776
oldstate = getattr(self, "enabled", False)
775
oldstate = getattr(self, u"enabled", False)
777
776
r = Client.disable(self, quiet=quiet)
778
777
if not quiet and oldstate != self.enabled:
779
778
# Emit D-Bus signal
780
self.PropertyChanged(dbus.String("Enabled"),
779
self.PropertyChanged(dbus.String(u"Enabled"),
781
780
dbus.Boolean(False, variant_level=1))
782
781
return r
783
782
786
785
self.remove_from_connection()
787
786
except LookupError:
788
787
pass
789
if hasattr(DBusObjectWithProperties, "__del__"):
788
if hasattr(DBusObjectWithProperties, u"__del__"):
790
789
DBusObjectWithProperties.__del__(self, *args, **kwargs)
791
790
Client.__del__(self, *args, **kwargs)
792
791
795
794
self.checker_callback_tag = None
796
795
self.checker = None
797
796
# Emit D-Bus signal
798
self.PropertyChanged(dbus.String("CheckerRunning"),
797
self.PropertyChanged(dbus.String(u"CheckerRunning"),
799
798
dbus.Boolean(False, variant_level=1))
800
799
if os.WIFEXITED(condition):
801
800
exitstatus = os.WEXITSTATUS(condition)
816
815
r = Client.checked_ok(self, *args, **kwargs)
817
816
# Emit D-Bus signal
818
817
self.PropertyChanged(
819
dbus.String("LastCheckedOK"),
818
dbus.String(u"LastCheckedOK"),
820
819
(self._datetime_to_dbus(self.last_checked_ok,
821
820
variant_level=1)))
822
821
return r
825
824
r = Client.need_approval(self, *args, **kwargs)
826
825
# Emit D-Bus signal
827
826
self.PropertyChanged(
828
dbus.String("LastApprovalRequest"),
827
dbus.String(u"LastApprovalRequest"),
829
828
(self._datetime_to_dbus(self.last_approval_request,
830
829
variant_level=1)))
831
830
return r
843
842
# Emit D-Bus signal
844
843
self.CheckerStarted(self.current_checker_command)
845
844
self.PropertyChanged(
846
dbus.String("CheckerRunning"),
845
dbus.String(u"CheckerRunning"),
847
846
dbus.Boolean(True, variant_level=1))
848
847
return r
849
848
850
849
def stop_checker(self, *args, **kwargs):
851
old_checker = getattr(self, "checker", None)
850
old_checker = getattr(self, u"checker", None)
852
851
r = Client.stop_checker(self, *args, **kwargs)
853
852
if (old_checker is not None
854
and getattr(self, "checker", None) is None):
855
self.PropertyChanged(dbus.String("CheckerRunning"),
853
and getattr(self, u"checker", None) is None):
854
self.PropertyChanged(dbus.String(u"CheckerRunning"),
856
855
dbus.Boolean(False, variant_level=1))
857
856
return r
858
857
869
868
870
869
871
870
## D-Bus methods, signals & properties
872
_interface = "se.bsnet.fukt.Mandos.Client"
871
_interface = u"se.bsnet.fukt.Mandos.Client"
873
872
874
873
## Signals
875
874
876
875
# CheckerCompleted - signal
877
@dbus.service.signal(_interface, signature="nxs")
876
@dbus.service.signal(_interface, signature=u"nxs")
878
877
def CheckerCompleted(self, exitcode, waitstatus, command):
879
878
"D-Bus signal"
880
879
pass
881
880
882
881
# CheckerStarted - signal
883
@dbus.service.signal(_interface, signature="s")
882
@dbus.service.signal(_interface, signature=u"s")
884
883
def CheckerStarted(self, command):
885
884
"D-Bus signal"
886
885
pass
887
886
888
887
# PropertyChanged - signal
889
@dbus.service.signal(_interface, signature="sv")
888
@dbus.service.signal(_interface, signature=u"sv")
890
889
def PropertyChanged(self, property, value):
891
890
"D-Bus signal"
892
891
pass
901
900
pass
902
901
903
902
# Rejected - signal
904
@dbus.service.signal(_interface, signature="s")
903
@dbus.service.signal(_interface, signature=u"s")
905
904
def Rejected(self, reason):
906
905
"D-Bus signal"
907
906
pass
908
907
909
908
# NeedApproval - signal
910
@dbus.service.signal(_interface, signature="tb")
909
@dbus.service.signal(_interface, signature=u"tb")
911
910
def NeedApproval(self, timeout, default):
912
911
"D-Bus signal"
913
912
return self.need_approval()
915
914
## Methods
916
915
917
916
# Approve - method
918
@dbus.service.method(_interface, in_signature="b")
917
@dbus.service.method(_interface, in_signature=u"b")
919
918
def Approve(self, value):
920
919
self.approve(value)
921
920
950
949
## Properties
951
950
952
951
# ApprovalPending - property
953
@dbus_service_property(_interface, signature="b", access="read")
952
@dbus_service_property(_interface, signature=u"b", access=u"read")
954
953
def ApprovalPending_dbus_property(self):
955
954
return dbus.Boolean(bool(self.approvals_pending))
956
955
957
956
# ApprovedByDefault - property
958
@dbus_service_property(_interface, signature="b",
959
access="readwrite")
957
@dbus_service_property(_interface, signature=u"b",
958
access=u"readwrite")
960
959
def ApprovedByDefault_dbus_property(self, value=None):
961
960
if value is None: # get
962
961
return dbus.Boolean(self.approved_by_default)
963
962
self.approved_by_default = bool(value)
964
963
# Emit D-Bus signal
965
self.PropertyChanged(dbus.String("ApprovedByDefault"),
964
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
966
965
dbus.Boolean(value, variant_level=1))
967
966
968
967
# ApprovalDelay - property
969
@dbus_service_property(_interface, signature="t",
970
access="readwrite")
968
@dbus_service_property(_interface, signature=u"t",
969
access=u"readwrite")
971
970
def ApprovalDelay_dbus_property(self, value=None):
972
971
if value is None: # get
973
972
return dbus.UInt64(self.approval_delay_milliseconds())
974
973
self.approval_delay = datetime.timedelta(0, 0, 0, value)
975
974
# Emit D-Bus signal
976
self.PropertyChanged(dbus.String("ApprovalDelay"),
975
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
977
976
dbus.UInt64(value, variant_level=1))
978
977
979
978
# ApprovalDuration - property
980
@dbus_service_property(_interface, signature="t",
981
access="readwrite")
979
@dbus_service_property(_interface, signature=u"t",
980
access=u"readwrite")
982
981
def ApprovalDuration_dbus_property(self, value=None):
983
982
if value is None: # get
984
983
return dbus.UInt64(self._timedelta_to_milliseconds(
985
984
self.approval_duration))
986
985
self.approval_duration = datetime.timedelta(0, 0, 0, value)
987
986
# Emit D-Bus signal
988
self.PropertyChanged(dbus.String("ApprovalDuration"),
987
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
989
988
dbus.UInt64(value, variant_level=1))
990
989
991
990
# Name - property
992
@dbus_service_property(_interface, signature="s", access="read")
991
@dbus_service_property(_interface, signature=u"s", access=u"read")
993
992
def Name_dbus_property(self):
994
993
return dbus.String(self.name)
995
994
996
995
# Fingerprint - property
997
@dbus_service_property(_interface, signature="s", access="read")
996
@dbus_service_property(_interface, signature=u"s", access=u"read")
998
997
def Fingerprint_dbus_property(self):
999
998
return dbus.String(self.fingerprint)
1000
999
1001
1000
# Host - property
1002
@dbus_service_property(_interface, signature="s",
1003
access="readwrite")
1001
@dbus_service_property(_interface, signature=u"s",
1002
access=u"readwrite")
1004
1003
def Host_dbus_property(self, value=None):
1005
1004
if value is None: # get
1006
1005
return dbus.String(self.host)
1007
1006
self.host = value
1008
1007
# Emit D-Bus signal
1009
self.PropertyChanged(dbus.String("Host"),
1008
self.PropertyChanged(dbus.String(u"Host"),
1010
1009
dbus.String(value, variant_level=1))
1011
1010
1012
1011
# Created - property
1013
@dbus_service_property(_interface, signature="s", access="read")
1012
@dbus_service_property(_interface, signature=u"s", access=u"read")
1014
1013
def Created_dbus_property(self):
1015
1014
return dbus.String(self._datetime_to_dbus(self.created))
1016
1015
1017
1016
# LastEnabled - property
1018
@dbus_service_property(_interface, signature="s", access="read")
1017
@dbus_service_property(_interface, signature=u"s", access=u"read")
1019
1018
def LastEnabled_dbus_property(self):
1020
1019
if self.last_enabled is None:
1021
return dbus.String("")
1020
return dbus.String(u"")
1022
1021
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1023
1022
1024
1023
# Enabled - property
1025
@dbus_service_property(_interface, signature="b",
1026
access="readwrite")
1024
@dbus_service_property(_interface, signature=u"b",
1025
access=u"readwrite")
1027
1026
def Enabled_dbus_property(self, value=None):
1028
1027
if value is None: # get
1029
1028
return dbus.Boolean(self.enabled)
1033
1032
self.disable()
1034
1033
1035
1034
# LastCheckedOK - property
1036
@dbus_service_property(_interface, signature="s",
1037
access="readwrite")
1035
@dbus_service_property(_interface, signature=u"s",
1036
access=u"readwrite")
1038
1037
def LastCheckedOK_dbus_property(self, value=None):
1039
1038
if value is not None:
1040
1039
self.checked_ok()
1041
1040
return
1042
1041
if self.last_checked_ok is None:
1043
return dbus.String("")
1042
return dbus.String(u"")
1044
1043
return dbus.String(self._datetime_to_dbus(self
1045
1044
.last_checked_ok))
1046
1045
1047
1046
# LastApprovalRequest - property
1048
@dbus_service_property(_interface, signature="s", access="read")
1047
@dbus_service_property(_interface, signature=u"s", access=u"read")
1049
1048
def LastApprovalRequest_dbus_property(self):
1050
1049
if self.last_approval_request is None:
1051
return dbus.String("")
1050
return dbus.String(u"")
1052
1051
return dbus.String(self.
1053
1052
_datetime_to_dbus(self
1054
1053
.last_approval_request))
1055
1054
1056
1055
# Timeout - property
1057
@dbus_service_property(_interface, signature="t",
1058
access="readwrite")
1056
@dbus_service_property(_interface, signature=u"t",
1057
access=u"readwrite")
1059
1058
def Timeout_dbus_property(self, value=None):
1060
1059
if value is None: # get
1061
1060
return dbus.UInt64(self.timeout_milliseconds())
1062
1061
self.timeout = datetime.timedelta(0, 0, 0, value)
1063
1062
# Emit D-Bus signal
1064
self.PropertyChanged(dbus.String("Timeout"),
1063
self.PropertyChanged(dbus.String(u"Timeout"),
1065
1064
dbus.UInt64(value, variant_level=1))
1066
if getattr(self, "disable_initiator_tag", None) is None:
1065
if getattr(self, u"disable_initiator_tag", None) is None:
1067
1066
return
1068
1067
# Reschedule timeout
1069
1068
gobject.source_remove(self.disable_initiator_tag)
1082
1081
(time_to_die, self.disable))
1083
1082
1084
1083
# Interval - property
1085
@dbus_service_property(_interface, signature="t",
1086
access="readwrite")
1084
@dbus_service_property(_interface, signature=u"t",
1085
access=u"readwrite")
1087
1086
def Interval_dbus_property(self, value=None):
1088
1087
if value is None: # get
1089
1088
return dbus.UInt64(self.interval_milliseconds())
1090
1089
self.interval = datetime.timedelta(0, 0, 0, value)
1091
1090
# Emit D-Bus signal
1092
self.PropertyChanged(dbus.String("Interval"),
1091
self.PropertyChanged(dbus.String(u"Interval"),
1093
1092
dbus.UInt64(value, variant_level=1))
1094
if getattr(self, "checker_initiator_tag", None) is None:
1093
if getattr(self, u"checker_initiator_tag", None) is None:
1095
1094
return
1096
1095
# Reschedule checker run
1097
1096
gobject.source_remove(self.checker_initiator_tag)
1100
1099
self.start_checker() # Start one now, too
1101
1100
1102
1101
# Checker - property
1103
@dbus_service_property(_interface, signature="s",
1104
access="readwrite")
1102
@dbus_service_property(_interface, signature=u"s",
1103
access=u"readwrite")
1105
1104
def Checker_dbus_property(self, value=None):
1106
1105
if value is None: # get
1107
1106
return dbus.String(self.checker_command)
1108
1107
self.checker_command = value
1109
1108
# Emit D-Bus signal
1110
self.PropertyChanged(dbus.String("Checker"),
1109
self.PropertyChanged(dbus.String(u"Checker"),
1111
1110
dbus.String(self.checker_command,
1112
1111
variant_level=1))
1113
1112
1114
1113
# CheckerRunning - property
1115
@dbus_service_property(_interface, signature="b",
1116
access="readwrite")
1114
@dbus_service_property(_interface, signature=u"b",
1115
access=u"readwrite")
1117
1116
def CheckerRunning_dbus_property(self, value=None):
1118
1117
if value is None: # get
1119
1118
return dbus.Boolean(self.checker is not None)
1123
1122
self.stop_checker()
1124
1123
1125
1124
# ObjectPath - property
1126
@dbus_service_property(_interface, signature="o", access="read")
1125
@dbus_service_property(_interface, signature=u"o", access=u"read")
1127
1126
def ObjectPath_dbus_property(self):
1128
1127
return self.dbus_object_path # is already a dbus.ObjectPath
1129
1128
1130
1129
# Secret = property
1131
@dbus_service_property(_interface, signature="ay",
1132
access="write", byte_arrays=True)
1130
@dbus_service_property(_interface, signature=u"ay",
1131
access=u"write", byte_arrays=True)
1133
1132
def Secret_dbus_property(self, value):
1134
1133
self.secret = str(value)
1135
1134
1170
1169
1171
1170
def handle(self):
1172
1171
with contextlib.closing(self.server.child_pipe) as child_pipe:
1173
logger.info("TCP connection from: %s",
1172
logger.info(u"TCP connection from: %s",
1174
1173
unicode(self.client_address))
1175
logger.debug("Pipe FD: %d",
1174
logger.debug(u"Pipe FD: %d",
1176
1175
self.server.child_pipe.fileno())
1177
1176
1178
1177
session = (gnutls.connection
1185
1184
# no X.509 keys are added to it. Therefore, we can use it
1186
1185
# here despite using OpenPGP certificates.
1187
1186
1188
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1189
# "+AES-256-CBC", "+SHA1",
1190
# "+COMP-NULL", "+CTYPE-OPENPGP",
1191
# "+DHE-DSS"))
1187
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1188
# u"+AES-256-CBC", u"+SHA1",
1189
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1190
# u"+DHE-DSS"))
1192
1191
# Use a fallback default, since this MUST be set.
1193
1192
priority = self.server.gnutls_priority
1194
1193
if priority is None:
1195
priority = "NORMAL"
1194
priority = u"NORMAL"
1196
1195
(gnutls.library.functions
1197
1196
.gnutls_priority_set_direct(session._c_object,
1198
1197
priority, None))
1200
1199
# Start communication using the Mandos protocol
1201
1200
# Get protocol number
1202
1201
line = self.request.makefile().readline()
1203
logger.debug("Protocol version: %r", line)
1202
logger.debug(u"Protocol version: %r", line)
1204
1203
try:
1205
1204
if int(line.strip().split()[0]) > 1:
1206
1205
raise RuntimeError
1207
1206
except (ValueError, IndexError, RuntimeError), error:
1208
logger.error("Unknown protocol version: %s", error)
1207
logger.error(u"Unknown protocol version: %s", error)
1209
1208
return
1210
1209
1211
1210
# Start GnuTLS connection
1212
1211
try:
1213
1212
session.handshake()
1214
1213
except gnutls.errors.GNUTLSError, error:
1215
logger.warning("Handshake failed: %s", error)
1214
logger.warning(u"Handshake failed: %s", error)
1216
1215
# Do not run session.bye() here: the session is not
1217
1216
# established. Just abandon the request.
1218
1217
return
1219
logger.debug("Handshake succeeded")
1218
logger.debug(u"Handshake succeeded")
1220
1219
1221
1220
approval_required = False
1222
1221
try:
1224
1223
fpr = self.fingerprint(self.peer_certificate
1225
1224
(session))
1226
1225
except (TypeError, gnutls.errors.GNUTLSError), error:
1227
logger.warning("Bad certificate: %s", error)
1226
logger.warning(u"Bad certificate: %s", error)
1228
1227
return
1229
logger.debug("Fingerprint: %s", fpr)
1228
logger.debug(u"Fingerprint: %s", fpr)
1230
1229
1231
1230
try:
1232
1231
client = ProxyClient(child_pipe, fpr,
1241
1240
1242
1241
while True:
1243
1242
if not client.enabled:
1244
logger.warning("Client %s is disabled",
1243
logger.warning(u"Client %s is disabled",
1245
1244
client.name)
1246
1245
if self.server.use_dbus:
1247
1246
# Emit D-Bus signal
1252
1251
#We are approved or approval is disabled
1253
1252
break
1254
1253
elif client._approved is None:
1255
logger.info("Client %s needs approval",
1254
logger.info(u"Client %s needs approval",
1256
1255
client.name)
1257
1256
if self.server.use_dbus:
1258
1257
# Emit D-Bus signal
1260
1259
client.approval_delay_milliseconds(),
1261
1260
client.approved_by_default)
1262
1261
else:
1263
logger.warning("Client %s was not approved",
1262
logger.warning(u"Client %s was not approved",
1264
1263
client.name)
1265
1264
if self.server.use_dbus:
1266
1265
# Emit D-Bus signal
1295
1294
except (gnutls.errors.GNUTLSError), error:
1296
1295
logger.warning("gnutls send failed")
1297
1296
return
1298
logger.debug("Sent: %d, remaining: %d",
1297
logger.debug(u"Sent: %d, remaining: %d",
1299
1298
sent, len(client.secret)
1300
1299
- (sent_size + sent))
1301
1300
sent_size += sent
1302
1301
1303
logger.info("Sending secret to %s", client.name)
1302
logger.info(u"Sending secret to %s", client.name)
1304
1303
# bump the timeout as if seen
1305
1304
client.checked_ok()
1306
1305
if self.server.use_dbus:
1329
1328
.gnutls_certificate_get_peers
1330
1329
(session._c_object, ctypes.byref(list_size)))
1331
1330
if not bool(cert_list) and list_size.value != 0:
1332
raise gnutls.errors.GNUTLSError("error getting peer"
1333
" certificate")
1331
raise gnutls.errors.GNUTLSError(u"error getting peer"
1332
u" certificate")
1334
1333
if list_size.value == 0:
1335
1334
return None
1336
1335
cert = cert_list[0]
1362
1361
if crtverify.value != 0:
1363
1362
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1364
1363
raise (gnutls.errors.CertificateSecurityError
1365
("Verify failed"))
1364
(u"Verify failed"))
1366
1365
# New buffer for the fingerprint
1367
1366
buf = ctypes.create_string_buffer(20)
1368
1367
buf_len = ctypes.c_size_t()
1375
1374
# Convert the buffer to a Python bytestring
1376
1375
fpr = ctypes.string_at(buf, buf_len.value)
1377
1376
# Convert the bytestring to hexadecimal notation
1378
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1377
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1379
1378
return hex_fpr
1380
1379
1381
1380
1409
1408
1410
1409
def add_pipe(self, parent_pipe):
1411
1410
"""Dummy function; override as necessary"""
1412
raise NotImplementedError
1411
pass
1413
1412
1414
1413
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1415
1414
socketserver.TCPServer, object):
1433
1432
bind to an address or port if they were not specified."""
1434
1433
if self.interface is not None:
1435
1434
if SO_BINDTODEVICE is None:
1436
logger.error("SO_BINDTODEVICE does not exist;"
1437
" cannot bind to interface %s",
1435
logger.error(u"SO_BINDTODEVICE does not exist;"
1436
u" cannot bind to interface %s",
1438
1437
self.interface)
1439
1438
else:
1440
1439
try:
1441
1440
self.socket.setsockopt(socket.SOL_SOCKET,
1442
1441
SO_BINDTODEVICE,
1443
1442
str(self.interface
1444
+ '\0'))
1443
+ u'\0'))
1445
1444
except socket.error, error:
1446
1445
if error[0] == errno.EPERM:
1447
logger.error("No permission to"
1448
" bind to interface %s",
1446
logger.error(u"No permission to"
1447
u" bind to interface %s",
1449
1448
self.interface)
1450
1449
elif error[0] == errno.ENOPROTOOPT:
1451
logger.error("SO_BINDTODEVICE not available;"
1452
" cannot bind to interface %s",
1450
logger.error(u"SO_BINDTODEVICE not available;"
1451
u" cannot bind to interface %s",
1453
1452
self.interface)
1454
1453
else:
1455
1454
raise
1457
1456
if self.server_address[0] or self.server_address[1]:
1458
1457
if not self.server_address[0]:
1459
1458
if self.address_family == socket.AF_INET6:
1460
any_address = "::" # in6addr_any
1459
any_address = u"::" # in6addr_any
1461
1460
else:
1462
1461
any_address = socket.INADDR_ANY
1463
1462
self.server_address = (any_address,
1512
1511
def handle_ipc(self, source, condition, parent_pipe=None,
1513
1512
client_object=None):
1514
1513
condition_names = {
1515
gobject.IO_IN: "IN", # There is data to read.
1516
gobject.IO_OUT: "OUT", # Data can be written (without
1514
gobject.IO_IN: u"IN", # There is data to read.
1515
gobject.IO_OUT: u"OUT", # Data can be written (without
1517
1516
# blocking).
1518
gobject.IO_PRI: "PRI", # There is urgent data to read.
1519
gobject.IO_ERR: "ERR", # Error condition.
1520
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1517
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1518
gobject.IO_ERR: u"ERR", # Error condition.
1519
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1521
1520
# broken, usually for pipes and
1522
1521
# sockets).
1523
1522
}
1542
1541
client = c
1543
1542
break
1544
1543
else:
1545
logger.warning("Client not found for fingerprint: %s, ad"
1546
"dress: %s", fpr, address)
1544
logger.warning(u"Client not found for fingerprint: %s, ad"
1545
u"dress: %s", fpr, address)
1547
1546
if self.use_dbus:
1548
1547
# Emit D-Bus signal
1549
1548
mandos_dbus_service.ClientNotFound(fpr, address[0])
1583
1582
def string_to_delta(interval):
1584
1583
"""Parse a string and return a datetime.timedelta
1585
1584
1586
>>> string_to_delta('7d')
1585
>>> string_to_delta(u'7d')
1587
1586
datetime.timedelta(7)
1588
>>> string_to_delta('60s')
1587
>>> string_to_delta(u'60s')
1589
1588
datetime.timedelta(0, 60)
1590
>>> string_to_delta('60m')
1589
>>> string_to_delta(u'60m')
1591
1590
datetime.timedelta(0, 3600)
1592
>>> string_to_delta('24h')
1591
>>> string_to_delta(u'24h')
1593
1592
datetime.timedelta(1)
1594
>>> string_to_delta('1w')
1593
>>> string_to_delta(u'1w')
1595
1594
datetime.timedelta(7)
1596
>>> string_to_delta('5m 30s')
1595
>>> string_to_delta(u'5m 30s')
1597
1596
datetime.timedelta(0, 330)
1598
1597
"""
1599
1598
timevalue = datetime.timedelta(0)
1601
1600
try:
1602
1601
suffix = unicode(s[-1])
1603
1602
value = int(s[:-1])
1604
if suffix == "d":
1603
if suffix == u"d":
1605
1604
delta = datetime.timedelta(value)
1606
elif suffix == "s":
1605
elif suffix == u"s":
1607
1606
delta = datetime.timedelta(0, value)
1608
elif suffix == "m":
1607
elif suffix == u"m":
1609
1608
delta = datetime.timedelta(0, 0, 0, 0, value)
1610
elif suffix == "h":
1609
elif suffix == u"h":
1611
1610
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1612
elif suffix == "w":
1611
elif suffix == u"w":
1613
1612
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1614
1613
else:
1615
raise ValueError("Unknown suffix %r" % suffix)
1614
raise ValueError(u"Unknown suffix %r" % suffix)
1616
1615
except (ValueError, IndexError), e:
1617
raise ValueError(*(e.args))
1616
raise ValueError(e.message)
1618
1617
timevalue += delta
1619
1618
return timevalue
1620
1619
1626
1625
global if_nametoindex
1627
1626
try:
1628
1627
if_nametoindex = (ctypes.cdll.LoadLibrary
1629
(ctypes.util.find_library("c"))
1628
(ctypes.util.find_library(u"c"))
1630
1629
.if_nametoindex)
1631
1630
except (OSError, AttributeError):
1632
logger.warning("Doing if_nametoindex the hard way")
1631
logger.warning(u"Doing if_nametoindex the hard way")
1633
1632
def if_nametoindex(interface):
1634
1633
"Get an interface index the hard way, i.e. using fcntl()"
1635
1634
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1636
1635
with contextlib.closing(socket.socket()) as s:
1637
1636
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1638
struct.pack(str("16s16x"),
1637
struct.pack(str(u"16s16x"),
1639
1638
interface))
1640
interface_index = struct.unpack(str("I"),
1639
interface_index = struct.unpack(str(u"I"),
1641
1640
ifreq[16:20])[0]
1642
1641
return interface_index
1643
1642
return if_nametoindex(interface)
1651
1650
sys.exit()
1652
1651
os.setsid()
1653
1652
if not nochdir:
1654
os.chdir("/")
1653
os.chdir(u"/")
1655
1654
if os.fork():
1656
1655
sys.exit()
1657
1656
if not noclose:
1659
1658
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1660
1659
if not stat.S_ISCHR(os.fstat(null).st_mode):
1661
1660
raise OSError(errno.ENODEV,
1662
"%s not a character device"
1661
u"%s not a character device"
1663
1662
% os.path.devnull)
1664
1663
os.dup2(null, sys.stdin.fileno())
1665
1664
os.dup2(null, sys.stdout.fileno())
1673
1672
##################################################################
1674
1673
# Parsing of options, both command line and config file
1675
1674
1676
parser = argparse.ArgumentParser()
1677
parser.add_argument("-v", "--version", action="version",
1678
version = "%%(prog)s %s" % version,
1679
help="show version number and exit")
1680
parser.add_argument("-i", "--interface", metavar="IF",
1681
help="Bind to interface IF")
1682
parser.add_argument("-a", "--address",
1683
help="Address to listen for requests on")
1684
parser.add_argument("-p", "--port", type=int,
1685
help="Port number to receive requests on")
1686
parser.add_argument("--check", action="store_true",
1687
help="Run self-test")
1688
parser.add_argument("--debug", action="store_true",
1689
help="Debug mode; run in foreground and log"
1690
" to terminal")
1691
parser.add_argument("--debuglevel", metavar="LEVEL",
1692
help="Debug level for stdout output")
1693
parser.add_argument("--priority", help="GnuTLS"
1694
" priority string (see GnuTLS documentation)")
1695
parser.add_argument("--servicename",
1696
metavar="NAME", help="Zeroconf service name")
1697
parser.add_argument("--configdir",
1698
default="/etc/mandos", metavar="DIR",
1699
help="Directory to search for configuration"
1700
" files")
1701
parser.add_argument("--no-dbus", action="store_false",
1702
dest="use_dbus", help="Do not provide D-Bus"
1703
" system bus interface")
1704
parser.add_argument("--no-ipv6", action="store_false",
1705
dest="use_ipv6", help="Do not use IPv6")
1706
options = parser.parse_args()
1675
parser = optparse.OptionParser(version = "%%prog %s" % version)
1676
parser.add_option("-i", u"--interface", type=u"string",
1677
metavar="IF", help=u"Bind to interface IF")
1678
parser.add_option("-a", u"--address", type=u"string",
1679
help=u"Address to listen for requests on")
1680
parser.add_option("-p", u"--port", type=u"int",
1681
help=u"Port number to receive requests on")
1682
parser.add_option("--check", action=u"store_true",
1683
help=u"Run self-test")
1684
parser.add_option("--debug", action=u"store_true",
1685
help=u"Debug mode; run in foreground and log to"
1686
u" terminal")
1687
parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",
1688
help=u"Debug level for stdout output")
1689
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1690
u" priority string (see GnuTLS documentation)")
1691
parser.add_option("--servicename", type=u"string",
1692
metavar=u"NAME", help=u"Zeroconf service name")
1693
parser.add_option("--configdir", type=u"string",
1694
default=u"/etc/mandos", metavar=u"DIR",
1695
help=u"Directory to search for configuration"
1696
u" files")
1697
parser.add_option("--no-dbus", action=u"store_false",
1698
dest=u"use_dbus", help=u"Do not provide D-Bus"
1699
u" system bus interface")
1700
parser.add_option("--no-ipv6", action=u"store_false",
1701
dest=u"use_ipv6", help=u"Do not use IPv6")
1702
options = parser.parse_args()[0]
1707
1703
1708
1704
if options.check:
1709
1705
import doctest
1711
1707
sys.exit()
1712
1708
1713
1709
# Default values for config file for server-global settings
1714
server_defaults = { "interface": "",
1715
"address": "",
1716
"port": "",
1717
"debug": "False",
1718
"priority":
1719
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1720
"servicename": "Mandos",
1721
"use_dbus": "True",
1722
"use_ipv6": "True",
1723
"debuglevel": "",
1710
server_defaults = { u"interface": u"",
1711
u"address": u"",
1712
u"port": u"",
1713
u"debug": u"False",
1714
u"priority":
1715
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1716
u"servicename": u"Mandos",
1717
u"use_dbus": u"True",
1718
u"use_ipv6": u"True",
1719
u"debuglevel": u"",
1724
1720
}
1725
1721
1726
1722
# Parse config file for server-global settings
1727
1723
server_config = configparser.SafeConfigParser(server_defaults)
1728
1724
del server_defaults
1729
1725
server_config.read(os.path.join(options.configdir,
1730
"mandos.conf"))
1726
u"mandos.conf"))
1731
1727
# Convert the SafeConfigParser object to a dict
1732
1728
server_settings = server_config.defaults()
1733
1729
# Use the appropriate methods on the non-string config options
1734
for option in ("debug", "use_dbus", "use_ipv6"):
1735
server_settings[option] = server_config.getboolean("DEFAULT",
1730
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1731
server_settings[option] = server_config.getboolean(u"DEFAULT",
1736
1732
option)
1737
1733
if server_settings["port"]:
1738
server_settings["port"] = server_config.getint("DEFAULT",
1739
"port")
1734
server_settings["port"] = server_config.getint(u"DEFAULT",
1735
u"port")
1740
1736
del server_config
1741
1737
1742
1738
# Override the settings from the config file with command line
1743
1739
# options, if set.
1744
for option in ("interface", "address", "port", "debug",
1745
"priority", "servicename", "configdir",
1746
"use_dbus", "use_ipv6", "debuglevel"):
1740
for option in (u"interface", u"address", u"port", u"debug",
1741
u"priority", u"servicename", u"configdir",
1742
u"use_dbus", u"use_ipv6", u"debuglevel"):
1747
1743
value = getattr(options, option)
1748
1744
if value is not None:
1749
1745
server_settings[option] = value
1757
1753
##################################################################
1758
1754
1759
1755
# For convenience
1760
debug = server_settings["debug"]
1761
debuglevel = server_settings["debuglevel"]
1762
use_dbus = server_settings["use_dbus"]
1763
use_ipv6 = server_settings["use_ipv6"]
1756
debug = server_settings[u"debug"]
1757
debuglevel = server_settings[u"debuglevel"]
1758
use_dbus = server_settings[u"use_dbus"]
1759
use_ipv6 = server_settings[u"use_ipv6"]
1764
1760
1765
if server_settings["servicename"] != "Mandos":
1761
if server_settings[u"servicename"] != u"Mandos":
1766
1762
syslogger.setFormatter(logging.Formatter
1767
('Mandos (%s) [%%(process)d]:'
1768
' %%(levelname)s: %%(message)s'
1769
% server_settings["servicename"]))
1763
(u'Mandos (%s) [%%(process)d]:'
1764
u' %%(levelname)s: %%(message)s'
1765
% server_settings[u"servicename"]))
1770
1766
1771
1767
# Parse config file with clients
1772
client_defaults = { "timeout": "1h",
1773
"interval": "5m",
1774
"checker": "fping -q -- %%(host)s",
1775
"host": "",
1776
"approval_delay": "0s",
1777
"approval_duration": "1s",
1768
client_defaults = { u"timeout": u"1h",
1769
u"interval": u"5m",
1770
u"checker": u"fping -q -- %%(host)s",
1771
u"host": u"",
1772
u"approval_delay": u"0s",
1773
u"approval_duration": u"1s",
1778
1774
}
1779
1775
client_config = configparser.SafeConfigParser(client_defaults)
1780
client_config.read(os.path.join(server_settings["configdir"],
1781
"clients.conf"))
1776
client_config.read(os.path.join(server_settings[u"configdir"],
1777
u"clients.conf"))
1782
1778
1783
1779
global mandos_dbus_service
1784
1780
mandos_dbus_service = None
1785
1781
1786
tcp_server = MandosServer((server_settings["address"],
1787
server_settings["port"]),
1782
tcp_server = MandosServer((server_settings[u"address"],
1783
server_settings[u"port"]),
1788
1784
ClientHandler,
1789
interface=(server_settings["interface"]
1785
interface=(server_settings[u"interface"]
1790
1786
or None),
1791
1787
use_ipv6=use_ipv6,
1792
1788
gnutls_priority=
1793
server_settings["priority"],
1789
server_settings[u"priority"],
1794
1790
use_dbus=use_dbus)
1795
1791
if not debug:
1796
pidfilename = "/var/run/mandos.pid"
1792
pidfilename = u"/var/run/mandos.pid"
1797
1793
try:
1798
pidfile = open(pidfilename, "w")
1794
pidfile = open(pidfilename, u"w")
1799
1795
except IOError:
1800
logger.error("Could not open file %r", pidfilename)
1796
logger.error(u"Could not open file %r", pidfilename)
1801
1797
1802
1798
try:
1803
uid = pwd.getpwnam("_mandos").pw_uid
1804
gid = pwd.getpwnam("_mandos").pw_gid
1799
uid = pwd.getpwnam(u"_mandos").pw_uid
1800
gid = pwd.getpwnam(u"_mandos").pw_gid
1805
1801
except KeyError:
1806
1802
try:
1807
uid = pwd.getpwnam("mandos").pw_uid
1808
gid = pwd.getpwnam("mandos").pw_gid
1803
uid = pwd.getpwnam(u"mandos").pw_uid
1804
gid = pwd.getpwnam(u"mandos").pw_gid
1809
1805
except KeyError:
1810
1806
try:
1811
uid = pwd.getpwnam("nobody").pw_uid
1812
gid = pwd.getpwnam("nobody").pw_gid
1807
uid = pwd.getpwnam(u"nobody").pw_uid
1808
gid = pwd.getpwnam(u"nobody").pw_gid
1813
1809
except KeyError:
1814
1810
uid = 65534
1815
1811
gid = 65534
1837
1833
1838
1834
@gnutls.library.types.gnutls_log_func
1839
1835
def debug_gnutls(level, string):
1840
logger.debug("GnuTLS: %s", string[:-1])
1836
logger.debug(u"GnuTLS: %s", string[:-1])
1841
1837
1842
1838
(gnutls.library.functions
1843
1839
.gnutls_global_set_log_function(debug_gnutls))
1851
1847
# No console logging
1852
1848
logger.removeHandler(console)
1853
1849
1854
# Need to fork before connecting to D-Bus
1855
if not debug:
1856
# Close all input and output, do double fork, etc.
1857
daemon()
1858
1850
1859
1851
global main_loop
1860
1852
# From the Avahi example code
1864
1856
# End of Avahi example code
1865
1857
if use_dbus:
1866
1858
try:
1867
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1859
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1868
1860
bus, do_not_queue=True)
1869
1861
except dbus.exceptions.NameExistsException, e:
1870
logger.error(unicode(e) + ", disabling D-Bus")
1862
logger.error(unicode(e) + u", disabling D-Bus")
1871
1863
use_dbus = False
1872
server_settings["use_dbus"] = False
1864
server_settings[u"use_dbus"] = False
1873
1865
tcp_server.use_dbus = False
1874
1866
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1875
service = AvahiService(name = server_settings["servicename"],
1876
servicetype = "_mandos._tcp",
1867
service = AvahiService(name = server_settings[u"servicename"],
1868
servicetype = u"_mandos._tcp",
1877
1869
protocol = protocol, bus = bus)
1878
1870
if server_settings["interface"]:
1879
1871
service.interface = (if_nametoindex
1880
(str(server_settings["interface"])))
1881
1872
(str(server_settings[u"interface"])))
1873
1874
if not debug:
1875
# Close all input and output, do double fork, etc.
1876
daemon()
1877
1882
1878
global multiprocessing_manager
1883
1879
multiprocessing_manager = multiprocessing.Manager()
1884
1880
1903
1899
client_config, section)))
1904
1900
for section in client_config.sections()))
1905
1901
if not tcp_server.clients:
1906
logger.warning("No clients defined")
1902
logger.warning(u"No clients defined")
1907
1903
1908
1904
if not debug:
1909
1905
try:
1910
1906
with pidfile:
1911
1907
pid = os.getpid()
1912
pidfile.write(str(pid) + "\n".encode("utf-8"))
1908
pidfile.write(str(pid) + "\n")
1913
1909
del pidfile
1914
1910
except IOError:
1915
logger.error("Could not write to file %r with PID %d",
1911
logger.error(u"Could not write to file %r with PID %d",
1916
1912
pidfilename, pid)
1917
1913
except NameError:
1918
1914
# "pidfile" was never created
1928
1924
class MandosDBusService(dbus.service.Object):
1929
1925
"""A D-Bus proxy object"""
1930
1926
def __init__(self):
1931
dbus.service.Object.__init__(self, bus, "/")
1932
_interface = "se.bsnet.fukt.Mandos"
1927
dbus.service.Object.__init__(self, bus, u"/")
1928
_interface = u"se.bsnet.fukt.Mandos"
1933
1929
1934
@dbus.service.signal(_interface, signature="o")
1930
@dbus.service.signal(_interface, signature=u"o")
1935
1931
def ClientAdded(self, objpath):
1936
1932
"D-Bus signal"
1937
1933
pass
1938
1934
1939
@dbus.service.signal(_interface, signature="ss")
1935
@dbus.service.signal(_interface, signature=u"ss")
1940
1936
def ClientNotFound(self, fingerprint, address):
1941
1937
"D-Bus signal"
1942
1938
pass
1943
1939
1944
@dbus.service.signal(_interface, signature="os")
1940
@dbus.service.signal(_interface, signature=u"os")
1945
1941
def ClientRemoved(self, objpath, name):
1946
1942
"D-Bus signal"
1947
1943
pass
1948
1944
1949
@dbus.service.method(_interface, out_signature="ao")
1945
@dbus.service.method(_interface, out_signature=u"ao")
1950
1946
def GetAllClients(self):
1951
1947
"D-Bus method"
1952
1948
return dbus.Array(c.dbus_object_path
1953
1949
for c in tcp_server.clients)
1954
1950
1955
1951
@dbus.service.method(_interface,
1956
out_signature="a{oa{sv}}")
1952
out_signature=u"a{oa{sv}}")
1957
1953
def GetAllClientsWithProperties(self):
1958
1954
"D-Bus method"
1959
1955
return dbus.Dictionary(
1960
((c.dbus_object_path, c.GetAll(""))
1956
((c.dbus_object_path, c.GetAll(u""))
1961
1957
for c in tcp_server.clients),
1962
signature="oa{sv}")
1958
signature=u"oa{sv}")
1963
1959
1964
@dbus.service.method(_interface, in_signature="o")
1960
@dbus.service.method(_interface, in_signature=u"o")
1965
1961
def RemoveClient(self, object_path):
1966
1962
"D-Bus method"
1967
1963
for c in tcp_server.clients:
2009
2005
# Find out what port we got
2010
2006
service.port = tcp_server.socket.getsockname()[1]
2011
2007
if use_ipv6:
2012
logger.info("Now listening on address %r, port %d,"
2008
logger.info(u"Now listening on address %r, port %d,"
2013
2009
" flowinfo %d, scope_id %d"
2014
2010
% tcp_server.socket.getsockname())
2015
2011
else: # IPv4
2016
logger.info("Now listening on address %r, port %d"
2012
logger.info(u"Now listening on address %r, port %d"
2017
2013
% tcp_server.socket.getsockname())
2018
2014
2019
2015
#service.interface = tcp_server.socket.getsockname()[3]
2023
2019
try:
2024
2020
service.activate()
2025
2021
except dbus.exceptions.DBusException, error:
2026
logger.critical("DBusException: %s", error)
2022
logger.critical(u"DBusException: %s", error)
2027
2023
cleanup()
2028
2024
sys.exit(1)
2029
2025
# End of Avahi example code
2033
2029
(tcp_server.handle_request
2034
2030
(*args[2:], **kwargs) or True))
2035
2031
2036
logger.debug("Starting main loop")
2032
logger.debug(u"Starting main loop")
2037
2033
main_loop.run()
2038
2034
except AvahiError, error:
2039
logger.critical("AvahiError: %s", error)
2035
logger.critical(u"AvahiError: %s", error)
2040
2036
cleanup()
2041
2037
sys.exit(1)
2042
2038
except KeyboardInterrupt:
2043
2039
if debug:
2044
print("", file=sys.stderr)
2045
logger.debug("Server received KeyboardInterrupt")
2046
logger.debug("Server exiting")
2040
print >> sys.stderr
2041
logger.debug(u"Server received KeyboardInterrupt")
2042
logger.debug(u"Server exiting")
2047
2043
# Must run before the D-Bus bus name gets deregistered
2048
2044
cleanup()
2049
2045
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0