To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 24.1.113
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.113
- Committer: Björn Påhlsson
- Date: 2008-11-12 05:46:49 UTC
- mfrom: (237.1.2 mandos)
- mto: (24.1.154 mandos) (237.4.3 mandos-release)
- mto: This revision was merged to the branch mainline in revision 240.
- Revision ID: belorn@braxen-20081112054649-g3m4i22ncnaf5hbi
merge
- files added:
- debian/mandos-client.config
- files removed:
- debian/watch
- files modified:
- INSTALL
added
removed
mandos
6
6
# This program is partly derived from an example program for an Avahi
7
7
# service publisher, downloaded from
8
8
# <http://avahi.org/wiki/PythonPublishExample>. This includes the
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
9
# methods "add" and "remove" in the "AvahiService" class, the
10
# "server_state_changed" and "entry_group_state_changed" functions,
11
# and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008 Teddy Hogeborn
15
# Copyright © 2008 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
33
33
34
34
from __future__ import division, with_statement, absolute_import
35
35
36
import SocketServer as socketserver
36
import SocketServer
37
37
import socket
38
import optparse
38
from optparse import OptionParser
39
39
import datetime
40
40
import errno
41
41
import gnutls.crypto
44
44
import gnutls.library.functions
45
45
import gnutls.library.constants
46
46
import gnutls.library.types
47
import ConfigParser as configparser
47
import ConfigParser
48
48
import sys
49
49
import re
50
50
import os
51
51
import signal
52
from sets import Set
52
53
import subprocess
53
54
import atexit
54
55
import stat
56
57
import logging.handlers
57
58
import pwd
58
59
from contextlib import closing
59
import struct
60
import fcntl
61
import functools
62
60
63
61
import dbus
64
62
import dbus.service
68
66
import ctypes
69
67
import ctypes.util
70
68
71
try:
72
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
73
except AttributeError:
74
try:
75
from IN import SO_BINDTODEVICE
76
except ImportError:
77
SO_BINDTODEVICE = None
78
79
80
version = "1.0.8"
81
82
logger = logging.Logger(u'mandos')
69
version = "1.0.2"
70
71
logger = logging.Logger('mandos')
83
72
syslogger = (logging.handlers.SysLogHandler
84
73
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
85
74
address = "/dev/log"))
86
75
syslogger.setFormatter(logging.Formatter
87
(u'Mandos [%(process)d]: %(levelname)s:'
88
u' %(message)s'))
76
('Mandos: %(levelname)s: %(message)s'))
89
77
logger.addHandler(syslogger)
90
78
91
79
console = logging.StreamHandler()
92
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
93
u' %(levelname)s:'
94
u' %(message)s'))
80
console.setFormatter(logging.Formatter('%(name)s: %(levelname)s:'
81
' %(message)s'))
95
82
logger.addHandler(console)
96
83
97
84
class AvahiError(Exception):
98
def __init__(self, value, *args, **kwargs):
85
def __init__(self, value):
99
86
self.value = value
100
super(AvahiError, self).__init__(value, *args, **kwargs)
101
def __unicode__(self):
102
return unicode(repr(self.value))
87
super(AvahiError, self).__init__()
88
def __str__(self):
89
return repr(self.value)
103
90
104
91
class AvahiServiceError(AvahiError):
105
92
pass
110
97
111
98
class AvahiService(object):
112
99
"""An Avahi (Zeroconf) service.
113
114
100
Attributes:
115
101
interface: integer; avahi.IF_UNSPEC or an interface index.
116
102
Used to optionally bind to the specified interface.
117
name: string; Example: u'Mandos'
118
type: string; Example: u'_mandos._tcp'.
103
name: string; Example: 'Mandos'
104
type: string; Example: '_mandos._tcp'.
119
105
See <http://www.dns-sd.org/ServiceTypes.html>
120
106
port: integer; what port to announce
121
107
TXT: list of strings; TXT record for the service
124
110
max_renames: integer; maximum number of renames
125
111
rename_count: integer; counter so we only rename after collisions
126
112
a sensible number of times
127
group: D-Bus Entry Group
128
server: D-Bus Server
129
bus: dbus.SystemBus()
130
113
"""
131
114
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
132
115
servicetype = None, port = None, TXT = None,
133
domain = u"", host = u"", max_renames = 32768,
134
protocol = avahi.PROTO_UNSPEC, bus = None):
116
domain = "", host = "", max_renames = 32768):
135
117
self.interface = interface
136
118
self.name = name
137
119
self.type = servicetype
141
123
self.host = host
142
124
self.rename_count = 0
143
125
self.max_renames = max_renames
144
self.protocol = protocol
145
self.group = None # our entry group
146
self.server = None
147
self.bus = bus
148
126
def rename(self):
149
127
"""Derived from the Avahi example code"""
150
128
if self.rename_count >= self.max_renames:
151
129
logger.critical(u"No suitable Zeroconf service name found"
152
130
u" after %i retries, exiting.",
153
131
self.rename_count)
154
raise AvahiServiceError(u"Too many renames")
155
self.name = self.server.GetAlternativeServiceName(self.name)
132
raise AvahiServiceError("Too many renames")
133
self.name = server.GetAlternativeServiceName(self.name)
156
134
logger.info(u"Changing Zeroconf service name to %r ...",
157
unicode(self.name))
135
str(self.name))
158
136
syslogger.setFormatter(logging.Formatter
159
(u'Mandos (%s) [%%(process)d]:'
160
u' %%(levelname)s: %%(message)s'
161
% self.name))
137
('Mandos (%s): %%(levelname)s:'
138
' %%(message)s' % self.name))
162
139
self.remove()
163
140
self.add()
164
141
self.rename_count += 1
165
142
def remove(self):
166
143
"""Derived from the Avahi example code"""
167
if self.group is not None:
168
self.group.Reset()
144
if group is not None:
145
group.Reset()
169
146
def add(self):
170
147
"""Derived from the Avahi example code"""
171
if self.group is None:
172
self.group = dbus.Interface(
173
self.bus.get_object(avahi.DBUS_NAME,
174
self.server.EntryGroupNew()),
175
avahi.DBUS_INTERFACE_ENTRY_GROUP)
176
self.group.connect_to_signal('StateChanged',
177
self.entry_group_state_changed)
148
global group
149
if group is None:
150
group = dbus.Interface(bus.get_object
151
(avahi.DBUS_NAME,
152
server.EntryGroupNew()),
153
avahi.DBUS_INTERFACE_ENTRY_GROUP)
154
group.connect_to_signal('StateChanged',
155
entry_group_state_changed)
178
156
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
179
self.name, self.type)
180
self.group.AddService(
181
self.interface,
182
self.protocol,
183
dbus.UInt32(0), # flags
184
self.name, self.type,
185
self.domain, self.host,
186
dbus.UInt16(self.port),
187
avahi.string_array_to_txt_array(self.TXT))
188
self.group.Commit()
189
def entry_group_state_changed(self, state, error):
190
"""Derived from the Avahi example code"""
191
logger.debug(u"Avahi state change: %i", state)
192
193
if state == avahi.ENTRY_GROUP_ESTABLISHED:
194
logger.debug(u"Zeroconf service established.")
195
elif state == avahi.ENTRY_GROUP_COLLISION:
196
logger.warning(u"Zeroconf service name collision.")
197
self.rename()
198
elif state == avahi.ENTRY_GROUP_FAILURE:
199
logger.critical(u"Avahi: Error in group state changed %s",
200
unicode(error))
201
raise AvahiGroupError(u"State changed: %s"
202
% unicode(error))
203
def cleanup(self):
204
"""Derived from the Avahi example code"""
205
if self.group is not None:
206
self.group.Free()
207
self.group = None
208
def server_state_changed(self, state):
209
"""Derived from the Avahi example code"""
210
if state == avahi.SERVER_COLLISION:
211
logger.error(u"Zeroconf server name collision")
212
self.remove()
213
elif state == avahi.SERVER_RUNNING:
214
self.add()
215
def activate(self):
216
"""Derived from the Avahi example code"""
217
if self.server is None:
218
self.server = dbus.Interface(
219
self.bus.get_object(avahi.DBUS_NAME,
220
avahi.DBUS_PATH_SERVER),
221
avahi.DBUS_INTERFACE_SERVER)
222
self.server.connect_to_signal(u"StateChanged",
223
self.server_state_changed)
224
self.server_state_changed(self.server.GetState())
225
226
227
class Client(object):
157
service.name, service.type)
158
group.AddService(
159
self.interface, # interface
160
avahi.PROTO_INET6, # protocol
161
dbus.UInt32(0), # flags
162
self.name, self.type,
163
self.domain, self.host,
164
dbus.UInt16(self.port),
165
avahi.string_array_to_txt_array(self.TXT))
166
group.Commit()
167
168
# From the Avahi example code:
169
group = None # our entry group
170
# End of Avahi example code
171
172
173
class Client(dbus.service.Object):
228
174
"""A representation of a client host served by this server.
229
230
175
Attributes:
231
name: string; from the config file, used in log messages and
232
D-Bus identifiers
176
name: string; from the config file, used in log messages
233
177
fingerprint: string (40 or 32 hexadecimal digits); used to
234
178
uniquely identify the client
235
secret: bytestring; sent verbatim (over TLS) to client
236
host: string; available for use by the checker command
237
created: datetime.datetime(); (UTC) object creation
238
last_enabled: datetime.datetime(); (UTC)
239
enabled: bool()
179
secret: bytestring; sent verbatim (over TLS) to client
180
host: string; available for use by the checker command
181
created: datetime.datetime(); (UTC) object creation
182
started: datetime.datetime(); (UTC) last started
240
183
last_checked_ok: datetime.datetime(); (UTC) or None
241
timeout: datetime.timedelta(); How long from last_checked_ok
242
until this client is invalid
243
interval: datetime.timedelta(); How often to start a new checker
244
disable_hook: If set, called by disable() as disable_hook(self)
245
checker: subprocess.Popen(); a running checker process used
246
to see if the client lives.
247
'None' if no process is running.
184
timeout: datetime.timedelta(); How long from last_checked_ok
185
until this client is invalid
186
interval: datetime.timedelta(); How often to start a new checker
187
stop_hook: If set, called by stop() as stop_hook(self)
188
checker: subprocess.Popen(); a running checker process used
189
to see if the client lives.
190
'None' if no process is running.
248
191
checker_initiator_tag: a gobject event source tag, or None
249
disable_initiator_tag: - '' -
192
stop_initiator_tag: - '' -
250
193
checker_callback_tag: - '' -
251
194
checker_command: string; External command which is run to check if
252
195
client lives. %() expansions are done at
253
196
runtime with vars(self) as dict, so that for
254
197
instance %(name)s can be used in the command.
255
current_checker_command: string; current running checker_command
198
Private attibutes:
199
_timeout: Real variable for 'timeout'
200
_interval: Real variable for 'interval'
201
_timeout_milliseconds: Used when calling gobject.timeout_add()
202
_interval_milliseconds: - '' -
256
203
"""
257
258
@staticmethod
259
def _datetime_to_milliseconds(dt):
260
"Convert a datetime.datetime() to milliseconds"
261
return ((dt.days * 24 * 60 * 60 * 1000)
262
+ (dt.seconds * 1000)
263
+ (dt.microseconds // 1000))
264
265
def timeout_milliseconds(self):
266
"Return the 'timeout' attribute in milliseconds"
267
return self._datetime_to_milliseconds(self.timeout)
268
269
def interval_milliseconds(self):
270
"Return the 'interval' attribute in milliseconds"
271
return self._datetime_to_milliseconds(self.interval)
272
273
def __init__(self, name = None, disable_hook=None, config=None):
204
def _set_timeout(self, timeout):
205
"Setter function for the 'timeout' attribute"
206
self._timeout = timeout
207
self._timeout_milliseconds = ((self.timeout.days
208
* 24 * 60 * 60 * 1000)
209
+ (self.timeout.seconds * 1000)
210
+ (self.timeout.microseconds
211
// 1000))
212
# Emit D-Bus signal
213
self.TimeoutChanged(self._timeout_milliseconds)
214
timeout = property(lambda self: self._timeout, _set_timeout)
215
del _set_timeout
216
217
def _set_interval(self, interval):
218
"Setter function for the 'interval' attribute"
219
self._interval = interval
220
self._interval_milliseconds = ((self.interval.days
221
* 24 * 60 * 60 * 1000)
222
+ (self.interval.seconds
223
* 1000)
224
+ (self.interval.microseconds
225
// 1000))
226
# Emit D-Bus signal
227
self.IntervalChanged(self._interval_milliseconds)
228
interval = property(lambda self: self._interval, _set_interval)
229
del _set_interval
230
231
def __init__(self, name = None, stop_hook=None, config=None):
274
232
"""Note: the 'checker' key in 'config' sets the
275
233
'checker_command' attribute and *not* the 'checker'
276
234
attribute."""
277
self.name = name
235
dbus.service.Object.__init__(self, bus,
236
"/Mandos/clients/%s"
237
% name.replace(".", "_"))
278
238
if config is None:
279
239
config = {}
240
self.name = name
280
241
logger.debug(u"Creating client %r", self.name)
281
242
# Uppercase and remove spaces from fingerprint for later
282
243
# comparison purposes with return value from the fingerprint()
283
244
# function
284
self.fingerprint = (config[u"fingerprint"].upper()
245
self.fingerprint = (config["fingerprint"].upper()
285
246
.replace(u" ", u""))
286
247
logger.debug(u" Fingerprint: %s", self.fingerprint)
287
if u"secret" in config:
288
self.secret = config[u"secret"].decode(u"base64")
289
elif u"secfile" in config:
248
if "secret" in config:
249
self.secret = config["secret"].decode(u"base64")
250
elif "secfile" in config:
290
251
with closing(open(os.path.expanduser
291
252
(os.path.expandvars
292
(config[u"secfile"])))) as secfile:
253
(config["secfile"])))) as secfile:
293
254
self.secret = secfile.read()
294
255
else:
295
256
raise TypeError(u"No secret or secfile for client %s"
296
257
% self.name)
297
self.host = config.get(u"host", u"")
258
self.host = config.get("host", "")
298
259
self.created = datetime.datetime.utcnow()
299
self.enabled = False
300
self.last_enabled = None
260
self.started = None
301
261
self.last_checked_ok = None
302
self.timeout = string_to_delta(config[u"timeout"])
303
self.interval = string_to_delta(config[u"interval"])
304
self.disable_hook = disable_hook
262
self.timeout = string_to_delta(config["timeout"])
263
self.interval = string_to_delta(config["interval"])
264
self.stop_hook = stop_hook
305
265
self.checker = None
306
266
self.checker_initiator_tag = None
307
self.disable_initiator_tag = None
267
self.stop_initiator_tag = None
308
268
self.checker_callback_tag = None
309
self.checker_command = config[u"checker"]
310
self.current_checker_command = None
311
self.last_connect = None
269
self.check_command = config["checker"]
312
270
313
def enable(self):
271
def start(self):
314
272
"""Start this client's checker and timeout hooks"""
315
if getattr(self, u"enabled", False):
316
# Already enabled
317
return
318
self.last_enabled = datetime.datetime.utcnow()
273
self.started = datetime.datetime.utcnow()
319
274
# Schedule a new checker to be started an 'interval' from now,
320
275
# and every interval from then on.
321
276
self.checker_initiator_tag = (gobject.timeout_add
322
(self.interval_milliseconds(),
277
(self._interval_milliseconds,
323
278
self.start_checker))
324
279
# Also start a new checker *right now*.
325
280
self.start_checker()
326
# Schedule a disable() when 'timeout' has passed
327
self.disable_initiator_tag = (gobject.timeout_add
328
(self.timeout_milliseconds(),
329
self.disable))
330
self.enabled = True
281
# Schedule a stop() when 'timeout' has passed
282
self.stop_initiator_tag = (gobject.timeout_add
283
(self._timeout_milliseconds,
284
self.stop))
285
# Emit D-Bus signal
286
self.StateChanged(True)
331
287
332
def disable(self):
333
"""Disable this client."""
334
if not getattr(self, "enabled", False):
288
def stop(self):
289
"""Stop this client."""
290
if getattr(self, "started", None) is not None:
291
logger.info(u"Stopping client %s", self.name)
292
else:
335
293
return False
336
logger.info(u"Disabling client %s", self.name)
337
if getattr(self, u"disable_initiator_tag", False):
338
gobject.source_remove(self.disable_initiator_tag)
339
self.disable_initiator_tag = None
340
if getattr(self, u"checker_initiator_tag", False):
294
if getattr(self, "stop_initiator_tag", False):
295
gobject.source_remove(self.stop_initiator_tag)
296
self.stop_initiator_tag = None
297
if getattr(self, "checker_initiator_tag", False):
341
298
gobject.source_remove(self.checker_initiator_tag)
342
299
self.checker_initiator_tag = None
343
300
self.stop_checker()
344
if self.disable_hook:
345
self.disable_hook(self)
346
self.enabled = False
301
if self.stop_hook:
302
self.stop_hook(self)
303
self.started = None
304
# Emit D-Bus signal
305
self.StateChanged(False)
347
306
# Do not run this again if called by a gobject.timeout_add
348
307
return False
349
308
350
309
def __del__(self):
351
self.disable_hook = None
352
self.disable()
310
self.stop_hook = None
311
self.stop()
353
312
354
def checker_callback(self, pid, condition, command):
313
def checker_callback(self, pid, condition):
355
314
"""The checker has completed, so take appropriate actions."""
356
315
self.checker_callback_tag = None
357
316
self.checker = None
358
if os.WIFEXITED(condition):
359
exitstatus = os.WEXITSTATUS(condition)
360
if exitstatus == 0:
361
logger.info(u"Checker for %(name)s succeeded",
362
vars(self))
363
self.checked_ok()
364
else:
365
logger.info(u"Checker for %(name)s failed",
366
vars(self))
367
else:
317
if (os.WIFEXITED(condition)
318
and (os.WEXITSTATUS(condition) == 0)):
319
logger.info(u"Checker for %(name)s succeeded",
320
vars(self))
321
# Emit D-Bus signal
322
self.CheckerCompleted(True)
323
self.bump_timeout()
324
elif not os.WIFEXITED(condition):
368
325
logger.warning(u"Checker for %(name)s crashed?",
369
326
vars(self))
327
# Emit D-Bus signal
328
self.CheckerCompleted(False)
329
else:
330
logger.info(u"Checker for %(name)s failed",
331
vars(self))
332
# Emit D-Bus signal
333
self.CheckerCompleted(False)
370
334
371
def checked_ok(self):
335
def bump_timeout(self):
372
336
"""Bump up the timeout for this client.
373
374
337
This should only be called when the client has been seen,
375
338
alive and well.
376
339
"""
377
340
self.last_checked_ok = datetime.datetime.utcnow()
378
gobject.source_remove(self.disable_initiator_tag)
379
self.disable_initiator_tag = (gobject.timeout_add
380
(self.timeout_milliseconds(),
381
self.disable))
341
gobject.source_remove(self.stop_initiator_tag)
342
self.stop_initiator_tag = (gobject.timeout_add
343
(self._timeout_milliseconds,
344
self.stop))
382
345
383
346
def start_checker(self):
384
347
"""Start a new checker subprocess if one is not running.
385
386
348
If a checker already exists, leave it running and do
387
349
nothing."""
388
350
# The reason for not killing a running checker is that if we
393
355
# checkers alone, the checker would have to take more time
394
356
# than 'timeout' for the client to be declared invalid, which
395
357
# is as it should be.
396
397
# If a checker exists, make sure it is not a zombie
398
if self.checker is not None:
399
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
400
if pid:
401
logger.warning(u"Checker was a zombie")
402
gobject.source_remove(self.checker_callback_tag)
403
self.checker_callback(pid, status,
404
self.current_checker_command)
405
# Start a new checker if needed
406
358
if self.checker is None:
407
359
try:
408
# In case checker_command has exactly one % operator
409
command = self.checker_command % self.host
360
# In case check_command has exactly one % operator
361
command = self.check_command % self.host
410
362
except TypeError:
411
363
# Escape attributes for the shell
412
escaped_attrs = dict((key,
413
re.escape(unicode(str(val),
414
errors=
415
u'replace')))
364
escaped_attrs = dict((key, re.escape(str(val)))
416
365
for key, val in
417
366
vars(self).iteritems())
418
367
try:
419
command = self.checker_command % escaped_attrs
368
command = self.check_command % escaped_attrs
420
369
except TypeError, error:
421
370
logger.error(u'Could not format string "%s":'
422
u' %s', self.checker_command, error)
371
u' %s', self.check_command, error)
423
372
return True # Try again later
424
self.current_checker_command = command
425
373
try:
426
374
logger.info(u"Starting checker %r for %s",
427
375
command, self.name)
431
379
# always replaced by /dev/null.)
432
380
self.checker = subprocess.Popen(command,
433
381
close_fds=True,
434
shell=True, cwd=u"/")
382
shell=True, cwd="/")
435
383
self.checker_callback_tag = (gobject.child_watch_add
436
384
(self.checker.pid,
437
self.checker_callback,
438
data=command))
439
# The checker may have completed before the gobject
440
# watch was added. Check for this.
441
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
442
if pid:
443
gobject.source_remove(self.checker_callback_tag)
444
self.checker_callback(pid, status, command)
385
self.checker_callback))
386
# Emit D-Bus signal
387
self.CheckerStarted(command)
445
388
except OSError, error:
446
389
logger.error(u"Failed to start subprocess: %s",
447
390
error)
453
396
if self.checker_callback_tag:
454
397
gobject.source_remove(self.checker_callback_tag)
455
398
self.checker_callback_tag = None
456
if getattr(self, u"checker", None) is None:
399
if getattr(self, "checker", None) is None:
457
400
return
458
401
logger.debug(u"Stopping checker for %(name)s", vars(self))
459
402
try:
468
411
469
412
def still_valid(self):
470
413
"""Has the timeout not yet passed for this client?"""
471
if not getattr(self, u"enabled", False):
414
if not self.started:
472
415
return False
473
416
now = datetime.datetime.utcnow()
474
417
if self.last_checked_ok is None:
475
418
return now < (self.created + self.timeout)
476
419
else:
477
420
return now < (self.last_checked_ok + self.timeout)
478
479
480
class ClientDBus(Client, dbus.service.Object):
481
"""A Client class using D-Bus
482
483
Attributes:
484
dbus_object_path: dbus.ObjectPath
485
bus: dbus.SystemBus()
486
"""
487
# dbus.service.Object doesn't use super(), so we can't either.
488
489
def __init__(self, bus = None, *args, **kwargs):
490
self.bus = bus
491
Client.__init__(self, *args, **kwargs)
492
# Only now, when this client is initialized, can it show up on
493
# the D-Bus
494
self.dbus_object_path = (dbus.ObjectPath
495
(u"/clients/"
496
+ self.name.replace(u".", u"_")))
497
dbus.service.Object.__init__(self, self.bus,
498
self.dbus_object_path)
499
500
@staticmethod
501
def _datetime_to_dbus(dt, variant_level=0):
502
"""Convert a UTC datetime.datetime() to a D-Bus type."""
503
return dbus.String(dt.isoformat(),
504
variant_level=variant_level)
505
506
def enable(self):
507
oldstate = getattr(self, u"enabled", False)
508
r = Client.enable(self)
509
if oldstate != self.enabled:
510
# Emit D-Bus signals
511
self.PropertyChanged(dbus.String(u"enabled"),
512
dbus.Boolean(True, variant_level=1))
513
self.PropertyChanged(
514
dbus.String(u"last_enabled"),
515
self._datetime_to_dbus(self.last_enabled,
516
variant_level=1))
517
return r
518
519
def disable(self, signal = True):
520
oldstate = getattr(self, u"enabled", False)
521
r = Client.disable(self)
522
if signal and oldstate != self.enabled:
523
# Emit D-Bus signal
524
self.PropertyChanged(dbus.String(u"enabled"),
525
dbus.Boolean(False, variant_level=1))
526
return r
527
528
def __del__(self, *args, **kwargs):
529
try:
530
self.remove_from_connection()
531
except LookupError:
532
pass
533
if hasattr(dbus.service.Object, u"__del__"):
534
dbus.service.Object.__del__(self, *args, **kwargs)
535
Client.__del__(self, *args, **kwargs)
536
537
def checker_callback(self, pid, condition, command,
538
*args, **kwargs):
539
self.checker_callback_tag = None
540
self.checker = None
541
# Emit D-Bus signal
542
self.PropertyChanged(dbus.String(u"checker_running"),
543
dbus.Boolean(False, variant_level=1))
544
if os.WIFEXITED(condition):
545
exitstatus = os.WEXITSTATUS(condition)
546
# Emit D-Bus signal
547
self.CheckerCompleted(dbus.Int16(exitstatus),
548
dbus.Int64(condition),
549
dbus.String(command))
550
else:
551
# Emit D-Bus signal
552
self.CheckerCompleted(dbus.Int16(-1),
553
dbus.Int64(condition),
554
dbus.String(command))
555
556
return Client.checker_callback(self, pid, condition, command,
557
*args, **kwargs)
558
559
def checked_ok(self, *args, **kwargs):
560
r = Client.checked_ok(self, *args, **kwargs)
561
# Emit D-Bus signal
562
self.PropertyChanged(
563
dbus.String(u"last_checked_ok"),
564
(self._datetime_to_dbus(self.last_checked_ok,
565
variant_level=1)))
566
return r
567
568
def start_checker(self, *args, **kwargs):
569
old_checker = self.checker
570
if self.checker is not None:
571
old_checker_pid = self.checker.pid
572
else:
573
old_checker_pid = None
574
r = Client.start_checker(self, *args, **kwargs)
575
# Only if new checker process was started
576
if (self.checker is not None
577
and old_checker_pid != self.checker.pid):
578
# Emit D-Bus signal
579
self.CheckerStarted(self.current_checker_command)
580
self.PropertyChanged(
581
dbus.String(u"checker_running"),
582
dbus.Boolean(True, variant_level=1))
583
return r
584
585
def stop_checker(self, *args, **kwargs):
586
old_checker = getattr(self, u"checker", None)
587
r = Client.stop_checker(self, *args, **kwargs)
588
if (old_checker is not None
589
and getattr(self, u"checker", None) is None):
590
self.PropertyChanged(dbus.String(u"checker_running"),
591
dbus.Boolean(False, variant_level=1))
592
return r
593
421
594
422
## D-Bus methods & signals
595
_interface = u"se.bsnet.fukt.Mandos.Client"
596
597
# CheckedOK - method
598
@dbus.service.method(_interface)
599
def CheckedOK(self):
600
return self.checked_ok()
423
_interface = u"org.mandos_system.Mandos.Client"
424
425
def _datetime_to_dbus_struct(dt):
426
return dbus.Struct(dt.year, dt.month, dt.day, dt.hour,
427
dt.minute, dt.second, dt.microsecond,
428
signature="nyyyyyu")
429
430
# BumpTimeout - method
431
BumpTimeout = dbus.service.method(_interface)(bump_timeout)
432
BumpTimeout.__name__ = "BumpTimeout"
433
434
# IntervalChanged - signal
435
@dbus.service.signal(_interface, signature="t")
436
def IntervalChanged(self, t):
437
"D-Bus signal"
438
pass
601
439
602
440
# CheckerCompleted - signal
603
@dbus.service.signal(_interface, signature=u"nxs")
604
def CheckerCompleted(self, exitcode, waitstatus, command):
441
@dbus.service.signal(_interface, signature="b")
442
def CheckerCompleted(self, success):
605
443
"D-Bus signal"
606
444
pass
607
445
446
# CheckerIsRunning - method
447
@dbus.service.method(_interface, out_signature="b")
448
def CheckerIsRunning(self):
449
"D-Bus getter method"
450
return self.checker is not None
451
608
452
# CheckerStarted - signal
609
@dbus.service.signal(_interface, signature=u"s")
453
@dbus.service.signal(_interface, signature="s")
610
454
def CheckerStarted(self, command):
611
455
"D-Bus signal"
612
456
pass
613
457
614
# GetAllProperties - method
615
@dbus.service.method(_interface, out_signature=u"a{sv}")
616
def GetAllProperties(self):
617
"D-Bus method"
618
return dbus.Dictionary({
619
dbus.String(u"name"):
620
dbus.String(self.name, variant_level=1),
621
dbus.String(u"fingerprint"):
622
dbus.String(self.fingerprint, variant_level=1),
623
dbus.String(u"host"):
624
dbus.String(self.host, variant_level=1),
625
dbus.String(u"created"):
626
self._datetime_to_dbus(self.created,
627
variant_level=1),
628
dbus.String(u"last_enabled"):
629
(self._datetime_to_dbus(self.last_enabled,
630
variant_level=1)
631
if self.last_enabled is not None
632
else dbus.Boolean(False, variant_level=1)),
633
dbus.String(u"enabled"):
634
dbus.Boolean(self.enabled, variant_level=1),
635
dbus.String(u"last_checked_ok"):
636
(self._datetime_to_dbus(self.last_checked_ok,
637
variant_level=1)
638
if self.last_checked_ok is not None
639
else dbus.Boolean (False, variant_level=1)),
640
dbus.String(u"timeout"):
641
dbus.UInt64(self.timeout_milliseconds(),
642
variant_level=1),
643
dbus.String(u"interval"):
644
dbus.UInt64(self.interval_milliseconds(),
645
variant_level=1),
646
dbus.String(u"checker"):
647
dbus.String(self.checker_command,
648
variant_level=1),
649
dbus.String(u"checker_running"):
650
dbus.Boolean(self.checker is not None,
651
variant_level=1),
652
dbus.String(u"object_path"):
653
dbus.ObjectPath(self.dbus_object_path,
654
variant_level=1)
655
}, signature=u"sv")
656
657
# IsStillValid - method
658
@dbus.service.method(_interface, out_signature=u"b")
659
def IsStillValid(self):
660
return self.still_valid()
661
662
# PropertyChanged - signal
663
@dbus.service.signal(_interface, signature=u"sv")
664
def PropertyChanged(self, property, value):
665
"D-Bus signal"
666
pass
667
668
# ReceivedSecret - signal
669
@dbus.service.signal(_interface)
670
def ReceivedSecret(self):
671
"D-Bus signal"
672
pass
673
674
# Rejected - signal
675
@dbus.service.signal(_interface)
676
def Rejected(self):
677
"D-Bus signal"
678
pass
458
# GetChecker - method
459
@dbus.service.method(_interface, out_signature="s")
460
def GetChecker(self):
461
"D-Bus getter method"
462
return self.checker_command
463
464
# GetCreated - method
465
@dbus.service.method(_interface, out_signature="(nyyyyyu)")
466
def GetCreated(self):
467
"D-Bus getter method"
468
return datetime_to_dbus_struct(self.created)
469
470
# GetFingerprint - method
471
@dbus.service.method(_interface, out_signature="s")
472
def GetFingerprint(self):
473
"D-Bus getter method"
474
return self.fingerprint
475
476
# GetHost - method
477
@dbus.service.method(_interface, out_signature="s")
478
def GetHost(self):
479
"D-Bus getter method"
480
return self.host
481
482
# GetInterval - method
483
@dbus.service.method(_interface, out_signature="t")
484
def GetInterval(self):
485
"D-Bus getter method"
486
return self._interval_milliseconds
487
488
# GetName - method
489
@dbus.service.method(_interface, out_signature="s")
490
def GetName(self):
491
"D-Bus getter method"
492
return self.name
493
494
# GetStarted - method
495
@dbus.service.method(_interface, out_signature="(nyyyyyu)")
496
def GetStarted(self):
497
"D-Bus getter method"
498
if self.started is not None:
499
return datetime_to_dbus_struct(self.started)
500
else:
501
return dbus.Struct(0, 0, 0, 0, 0, 0, 0,
502
signature="nyyyyyu")
503
504
# GetTimeout - method
505
@dbus.service.method(_interface, out_signature="t")
506
def GetTimeout(self):
507
"D-Bus getter method"
508
return self._timeout_milliseconds
679
509
680
510
# SetChecker - method
681
@dbus.service.method(_interface, in_signature=u"s")
511
@dbus.service.method(_interface, in_signature="s")
682
512
def SetChecker(self, checker):
683
513
"D-Bus setter method"
684
514
self.checker_command = checker
685
# Emit D-Bus signal
686
self.PropertyChanged(dbus.String(u"checker"),
687
dbus.String(self.checker_command,
688
variant_level=1))
689
515
690
516
# SetHost - method
691
@dbus.service.method(_interface, in_signature=u"s")
517
@dbus.service.method(_interface, in_signature="s")
692
518
def SetHost(self, host):
693
519
"D-Bus setter method"
694
520
self.host = host
695
# Emit D-Bus signal
696
self.PropertyChanged(dbus.String(u"host"),
697
dbus.String(self.host, variant_level=1))
698
521
699
522
# SetInterval - method
700
@dbus.service.method(_interface, in_signature=u"t")
523
@dbus.service.method(_interface, in_signature="t")
701
524
def SetInterval(self, milliseconds):
702
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
703
# Emit D-Bus signal
704
self.PropertyChanged(dbus.String(u"interval"),
705
(dbus.UInt64(self.interval_milliseconds(),
706
variant_level=1)))
525
self.interval = datetime.timdeelta(0, 0, 0, milliseconds)
526
527
# SetTimeout - method
528
@dbus.service.method(_interface, in_signature="t")
529
def SetTimeout(self, milliseconds):
530
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
707
531
708
532
# SetSecret - method
709
@dbus.service.method(_interface, in_signature=u"ay",
533
@dbus.service.method(_interface, in_signature="ay",
710
534
byte_arrays=True)
711
535
def SetSecret(self, secret):
712
536
"D-Bus setter method"
713
537
self.secret = str(secret)
714
538
715
# SetTimeout - method
716
@dbus.service.method(_interface, in_signature=u"t")
717
def SetTimeout(self, milliseconds):
718
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
719
# Emit D-Bus signal
720
self.PropertyChanged(dbus.String(u"timeout"),
721
(dbus.UInt64(self.timeout_milliseconds(),
722
variant_level=1)))
723
724
# Enable - method
725
@dbus.service.method(_interface)
726
def Enable(self):
727
"D-Bus method"
728
self.enable()
539
# Start - method
540
Start = dbus.service.method(_interface)(start)
541
Start.__name__ = "Start"
729
542
730
543
# StartChecker - method
731
@dbus.service.method(_interface)
732
def StartChecker(self):
733
"D-Bus method"
734
self.start_checker()
735
736
# Disable - method
737
@dbus.service.method(_interface)
738
def Disable(self):
739
"D-Bus method"
740
self.disable()
544
StartChecker = dbus.service.method(_interface)(start_checker)
545
StartChecker.__name__ = "StartChecker"
546
547
# StateChanged - signal
548
@dbus.service.signal(_interface, signature="b")
549
def StateChanged(self, started):
550
"D-Bus signal"
551
pass
552
553
# StillValid - method
554
StillValid = (dbus.service.method(_interface, out_signature="b")
555
(still_valid))
556
StillValid.__name__ = "StillValid"
557
558
# Stop - method
559
Stop = dbus.service.method(_interface)(stop)
560
Stop.__name__ = "Stop"
741
561
742
562
# StopChecker - method
743
@dbus.service.method(_interface)
744
def StopChecker(self):
745
self.stop_checker()
746
563
StopChecker = dbus.service.method(_interface)(stop_checker)
564
StopChecker.__name__ = "StopChecker"
565
566
# TimeoutChanged - signal
567
@dbus.service.signal(_interface, signature="t")
568
def TimeoutChanged(self, t):
569
"D-Bus signal"
570
pass
571
572
del _datetime_to_dbus_struct
747
573
del _interface
748
574
749
575
750
class ClientHandler(socketserver.BaseRequestHandler, object):
751
"""A class to handle client connections.
752
753
Instantiated once for each connection to handle it.
576
def peer_certificate(session):
577
"Return the peer's OpenPGP certificate as a bytestring"
578
# If not an OpenPGP certificate...
579
if (gnutls.library.functions
580
.gnutls_certificate_type_get(session._c_object)
581
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
582
# ...do the normal thing
583
return session.peer_certificate
584
list_size = ctypes.c_uint()
585
cert_list = (gnutls.library.functions
586
.gnutls_certificate_get_peers
587
(session._c_object, ctypes.byref(list_size)))
588
if list_size.value == 0:
589
return None
590
cert = cert_list[0]
591
return ctypes.string_at(cert.data, cert.size)
592
593
594
def fingerprint(openpgp):
595
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
596
# New GnuTLS "datum" with the OpenPGP public key
597
datum = (gnutls.library.types
598
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
599
ctypes.POINTER
600
(ctypes.c_ubyte)),
601
ctypes.c_uint(len(openpgp))))
602
# New empty GnuTLS certificate
603
crt = gnutls.library.types.gnutls_openpgp_crt_t()
604
(gnutls.library.functions
605
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
606
# Import the OpenPGP public key into the certificate
607
(gnutls.library.functions
608
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
609
gnutls.library.constants
610
.GNUTLS_OPENPGP_FMT_RAW))
611
# Verify the self signature in the key
612
crtverify = ctypes.c_uint()
613
(gnutls.library.functions
614
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
615
if crtverify.value != 0:
616
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
617
raise gnutls.errors.CertificateSecurityError("Verify failed")
618
# New buffer for the fingerprint
619
buf = ctypes.create_string_buffer(20)
620
buf_len = ctypes.c_size_t()
621
# Get the fingerprint from the certificate into the buffer
622
(gnutls.library.functions
623
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
624
ctypes.byref(buf_len)))
625
# Deinit the certificate
626
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
627
# Convert the buffer to a Python bytestring
628
fpr = ctypes.string_at(buf, buf_len.value)
629
# Convert the bytestring to hexadecimal notation
630
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
631
return hex_fpr
632
633
634
class TCP_handler(SocketServer.BaseRequestHandler, object):
635
"""A TCP request handler class.
636
Instantiated by IPv6_TCPServer for each request to handle it.
754
637
Note: This will run in its own forked process."""
755
638
756
639
def handle(self):
757
640
logger.info(u"TCP connection from: %s",
758
641
unicode(self.client_address))
759
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
760
# Open IPC pipe to parent process
761
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
762
session = (gnutls.connection
763
.ClientSession(self.request,
764
gnutls.connection
765
.X509Credentials()))
766
767
line = self.request.makefile().readline()
768
logger.debug(u"Protocol version: %r", line)
769
try:
770
if int(line.strip().split()[0]) > 1:
771
raise RuntimeError
772
except (ValueError, IndexError, RuntimeError), error:
773
logger.error(u"Unknown protocol version: %s", error)
774
return
775
776
# Note: gnutls.connection.X509Credentials is really a
777
# generic GnuTLS certificate credentials object so long as
778
# no X.509 keys are added to it. Therefore, we can use it
779
# here despite using OpenPGP certificates.
780
781
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
782
# u"+AES-256-CBC", u"+SHA1",
783
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
784
# u"+DHE-DSS"))
785
# Use a fallback default, since this MUST be set.
786
priority = self.server.gnutls_priority
787
if priority is None:
788
priority = u"NORMAL"
789
(gnutls.library.functions
790
.gnutls_priority_set_direct(session._c_object,
791
priority, None))
792
793
try:
794
session.handshake()
795
except gnutls.errors.GNUTLSError, error:
796
logger.warning(u"Handshake failed: %s", error)
797
# Do not run session.bye() here: the session is not
798
# established. Just abandon the request.
799
return
800
logger.debug(u"Handshake succeeded")
801
try:
802
fpr = self.fingerprint(self.peer_certificate(session))
803
except (TypeError, gnutls.errors.GNUTLSError), error:
804
logger.warning(u"Bad certificate: %s", error)
805
session.bye()
806
return
807
logger.debug(u"Fingerprint: %s", fpr)
808
809
for c in self.server.clients:
810
if c.fingerprint == fpr:
811
client = c
812
break
813
else:
814
ipc.write(u"NOTFOUND %s\n" % fpr)
815
session.bye()
816
return
817
# Have to check if client.still_valid(), since it is
818
# possible that the client timed out while establishing
819
# the GnuTLS session.
820
if not client.still_valid():
821
ipc.write(u"INVALID %s\n" % client.name)
822
session.bye()
823
return
824
ipc.write(u"SENDING %s\n" % client.name)
825
sent_size = 0
826
while sent_size < len(client.secret):
827
sent = session.send(client.secret[sent_size:])
828
logger.debug(u"Sent: %d, remaining: %d",
829
sent, len(client.secret)
830
- (sent_size + sent))
831
sent_size += sent
832
session.bye()
833
834
@staticmethod
835
def peer_certificate(session):
836
"Return the peer's OpenPGP certificate as a bytestring"
837
# If not an OpenPGP certificate...
838
if (gnutls.library.functions
839
.gnutls_certificate_type_get(session._c_object)
840
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
841
# ...do the normal thing
842
return session.peer_certificate
843
list_size = ctypes.c_uint(1)
844
cert_list = (gnutls.library.functions
845
.gnutls_certificate_get_peers
846
(session._c_object, ctypes.byref(list_size)))
847
if not bool(cert_list) and list_size.value != 0:
848
raise gnutls.errors.GNUTLSError(u"error getting peer"
849
u" certificate")
850
if list_size.value == 0:
851
return None
852
cert = cert_list[0]
853
return ctypes.string_at(cert.data, cert.size)
854
855
@staticmethod
856
def fingerprint(openpgp):
857
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
858
# New GnuTLS "datum" with the OpenPGP public key
859
datum = (gnutls.library.types
860
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
861
ctypes.POINTER
862
(ctypes.c_ubyte)),
863
ctypes.c_uint(len(openpgp))))
864
# New empty GnuTLS certificate
865
crt = gnutls.library.types.gnutls_openpgp_crt_t()
866
(gnutls.library.functions
867
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
868
# Import the OpenPGP public key into the certificate
869
(gnutls.library.functions
870
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
871
gnutls.library.constants
872
.GNUTLS_OPENPGP_FMT_RAW))
873
# Verify the self signature in the key
874
crtverify = ctypes.c_uint()
875
(gnutls.library.functions
876
.gnutls_openpgp_crt_verify_self(crt, 0,
877
ctypes.byref(crtverify)))
878
if crtverify.value != 0:
879
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
880
raise (gnutls.errors.CertificateSecurityError
881
(u"Verify failed"))
882
# New buffer for the fingerprint
883
buf = ctypes.create_string_buffer(20)
884
buf_len = ctypes.c_size_t()
885
# Get the fingerprint from the certificate into the buffer
886
(gnutls.library.functions
887
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
888
ctypes.byref(buf_len)))
889
# Deinit the certificate
890
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
891
# Convert the buffer to a Python bytestring
892
fpr = ctypes.string_at(buf, buf_len.value)
893
# Convert the bytestring to hexadecimal notation
894
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
895
return hex_fpr
896
897
898
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
899
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
900
def process_request(self, request, client_address):
901
"""Overrides and wraps the original process_request().
902
903
This function creates a new pipe in self.pipe
904
"""
905
self.pipe = os.pipe()
906
super(ForkingMixInWithPipe,
907
self).process_request(request, client_address)
908
os.close(self.pipe[1]) # close write end
909
self.add_pipe(self.pipe[0])
910
def add_pipe(self, pipe):
911
"""Dummy function; override as necessary"""
912
os.close(pipe)
913
914
915
class IPv6_TCPServer(ForkingMixInWithPipe,
916
socketserver.TCPServer, object):
917
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
918
642
session = (gnutls.connection
643
.ClientSession(self.request,
644
gnutls.connection
645
.X509Credentials()))
646
647
line = self.request.makefile().readline()
648
logger.debug(u"Protocol version: %r", line)
649
try:
650
if int(line.strip().split()[0]) > 1:
651
raise RuntimeError
652
except (ValueError, IndexError, RuntimeError), error:
653
logger.error(u"Unknown protocol version: %s", error)
654
return
655
656
# Note: gnutls.connection.X509Credentials is really a generic
657
# GnuTLS certificate credentials object so long as no X.509
658
# keys are added to it. Therefore, we can use it here despite
659
# using OpenPGP certificates.
660
661
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
662
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
663
# "+DHE-DSS"))
664
# Use a fallback default, since this MUST be set.
665
priority = self.server.settings.get("priority", "NORMAL")
666
(gnutls.library.functions
667
.gnutls_priority_set_direct(session._c_object,
668
priority, None))
669
670
try:
671
session.handshake()
672
except gnutls.errors.GNUTLSError, error:
673
logger.warning(u"Handshake failed: %s", error)
674
# Do not run session.bye() here: the session is not
675
# established. Just abandon the request.
676
return
677
try:
678
fpr = fingerprint(peer_certificate(session))
679
except (TypeError, gnutls.errors.GNUTLSError), error:
680
logger.warning(u"Bad certificate: %s", error)
681
session.bye()
682
return
683
logger.debug(u"Fingerprint: %s", fpr)
684
for c in self.server.clients:
685
if c.fingerprint == fpr:
686
client = c
687
break
688
else:
689
logger.warning(u"Client not found for fingerprint: %s",
690
fpr)
691
session.bye()
692
return
693
# Have to check if client.still_valid(), since it is possible
694
# that the client timed out while establishing the GnuTLS
695
# session.
696
if not client.still_valid():
697
logger.warning(u"Client %(name)s is invalid",
698
vars(client))
699
session.bye()
700
return
701
## This won't work here, since we're in a fork.
702
# client.bump_timeout()
703
sent_size = 0
704
while sent_size < len(client.secret):
705
sent = session.send(client.secret[sent_size:])
706
logger.debug(u"Sent: %d, remaining: %d",
707
sent, len(client.secret)
708
- (sent_size + sent))
709
sent_size += sent
710
session.bye()
711
712
713
class IPv6_TCPServer(SocketServer.ForkingMixIn,
714
SocketServer.TCPServer, object):
715
"""IPv6 TCP server. Accepts 'None' as address and/or port.
919
716
Attributes:
717
settings: Server settings
718
clients: Set() of Client objects
920
719
enabled: Boolean; whether this server is activated yet
921
interface: None or a network interface name (string)
922
use_ipv6: Boolean; to use IPv6 or not
923
720
"""
924
def __init__(self, server_address, RequestHandlerClass,
925
interface=None, use_ipv6=True):
926
self.interface = interface
927
if use_ipv6:
928
self.address_family = socket.AF_INET6
929
socketserver.TCPServer.__init__(self, server_address,
930
RequestHandlerClass)
721
address_family = socket.AF_INET6
722
def __init__(self, *args, **kwargs):
723
if "settings" in kwargs:
724
self.settings = kwargs["settings"]
725
del kwargs["settings"]
726
if "clients" in kwargs:
727
self.clients = kwargs["clients"]
728
del kwargs["clients"]
729
self.enabled = False
730
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
931
731
def server_bind(self):
932
732
"""This overrides the normal server_bind() function
933
733
to bind to an interface if one was specified, and also NOT to
934
734
bind to an address or port if they were not specified."""
935
if self.interface is not None:
936
if SO_BINDTODEVICE is None:
937
logger.error(u"SO_BINDTODEVICE does not exist;"
938
u" cannot bind to interface %s",
939
self.interface)
940
else:
941
try:
942
self.socket.setsockopt(socket.SOL_SOCKET,
943
SO_BINDTODEVICE,
944
str(self.interface
945
+ u'\0'))
946
except socket.error, error:
947
if error[0] == errno.EPERM:
948
logger.error(u"No permission to"
949
u" bind to interface %s",
950
self.interface)
951
elif error[0] == errno.ENOPROTOOPT:
952
logger.error(u"SO_BINDTODEVICE not available;"
953
u" cannot bind to interface %s",
954
self.interface)
955
else:
956
raise
735
if self.settings["interface"]:
736
# 25 is from /usr/include/asm-i486/socket.h
737
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
738
try:
739
self.socket.setsockopt(socket.SOL_SOCKET,
740
SO_BINDTODEVICE,
741
self.settings["interface"])
742
except socket.error, error:
743
if error[0] == errno.EPERM:
744
logger.error(u"No permission to"
745
u" bind to interface %s",
746
self.settings["interface"])
747
else:
748
raise error
957
749
# Only bind(2) the socket if we really need to.
958
750
if self.server_address[0] or self.server_address[1]:
959
751
if not self.server_address[0]:
960
if self.address_family == socket.AF_INET6:
961
any_address = u"::" # in6addr_any
962
else:
963
any_address = socket.INADDR_ANY
964
self.server_address = (any_address,
752
in6addr_any = "::"
753
self.server_address = (in6addr_any,
965
754
self.server_address[1])
966
755
elif not self.server_address[1]:
967
756
self.server_address = (self.server_address[0],
968
757
0)
969
# if self.interface:
758
# if self.settings["interface"]:
970
759
# self.server_address = (self.server_address[0],
971
760
# 0, # port
972
761
# 0, # flowinfo
973
762
# if_nametoindex
974
# (self.interface))
975
return socketserver.TCPServer.server_bind(self)
976
977
978
class MandosServer(IPv6_TCPServer):
979
"""Mandos server.
980
981
Attributes:
982
clients: set of Client objects
983
gnutls_priority GnuTLS priority string
984
use_dbus: Boolean; to emit D-Bus signals or not
985
clients: set of Client objects
986
gnutls_priority GnuTLS priority string
987
use_dbus: Boolean; to emit D-Bus signals or not
988
989
Assumes a gobject.MainLoop event loop.
990
"""
991
def __init__(self, server_address, RequestHandlerClass,
992
interface=None, use_ipv6=True, clients=None,
993
gnutls_priority=None, use_dbus=True):
994
self.enabled = False
995
self.clients = clients
996
if self.clients is None:
997
self.clients = set()
998
self.use_dbus = use_dbus
999
self.gnutls_priority = gnutls_priority
1000
IPv6_TCPServer.__init__(self, server_address,
1001
RequestHandlerClass,
1002
interface = interface,
1003
use_ipv6 = use_ipv6)
763
# (self.settings
764
# ["interface"]))
765
return super(IPv6_TCPServer, self).server_bind()
1004
766
def server_activate(self):
1005
767
if self.enabled:
1006
return socketserver.TCPServer.server_activate(self)
768
return super(IPv6_TCPServer, self).server_activate()
1007
769
def enable(self):
1008
770
self.enabled = True
1009
def add_pipe(self, pipe):
1010
# Call "handle_ipc" for both data and EOF events
1011
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1012
self.handle_ipc)
1013
def handle_ipc(self, source, condition, file_objects={}):
1014
condition_names = {
1015
gobject.IO_IN: u"IN", # There is data to read.
1016
gobject.IO_OUT: u"OUT", # Data can be written (without
1017
# blocking).
1018
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1019
gobject.IO_ERR: u"ERR", # Error condition.
1020
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1021
# broken, usually for pipes and
1022
# sockets).
1023
}
1024
conditions_string = ' | '.join(name
1025
for cond, name in
1026
condition_names.iteritems()
1027
if cond & condition)
1028
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1029
conditions_string)
1030
1031
# Turn the pipe file descriptor into a Python file object
1032
if source not in file_objects:
1033
file_objects[source] = os.fdopen(source, u"r", 1)
1034
1035
# Read a line from the file object
1036
cmdline = file_objects[source].readline()
1037
if not cmdline: # Empty line means end of file
1038
# close the IPC pipe
1039
file_objects[source].close()
1040
del file_objects[source]
1041
1042
# Stop calling this function
1043
return False
1044
1045
logger.debug(u"IPC command: %r", cmdline)
1046
1047
# Parse and act on command
1048
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1049
1050
if cmd == u"NOTFOUND":
1051
logger.warning(u"Client not found for fingerprint: %s",
1052
args)
1053
if self.use_dbus:
1054
# Emit D-Bus signal
1055
mandos_dbus_service.ClientNotFound(args)
1056
elif cmd == u"INVALID":
1057
for client in self.clients:
1058
if client.name == args:
1059
logger.warning(u"Client %s is invalid", args)
1060
if self.use_dbus:
1061
# Emit D-Bus signal
1062
client.Rejected()
1063
break
1064
else:
1065
logger.error(u"Unknown client %s is invalid", args)
1066
elif cmd == u"SENDING":
1067
for client in self.clients:
1068
if client.name == args:
1069
logger.info(u"Sending secret to %s", client.name)
1070
client.checked_ok()
1071
if self.use_dbus:
1072
# Emit D-Bus signal
1073
client.ReceivedSecret()
1074
break
1075
else:
1076
logger.error(u"Sending secret to unknown client %s",
1077
args)
1078
else:
1079
logger.error(u"Unknown IPC command: %r", cmdline)
1080
1081
# Keep calling this function
1082
return True
1083
771
1084
772
1085
773
def string_to_delta(interval):
1086
774
"""Parse a string and return a datetime.timedelta
1087
1088
>>> string_to_delta(u'7d')
775
776
>>> string_to_delta('7d')
1089
777
datetime.timedelta(7)
1090
>>> string_to_delta(u'60s')
778
>>> string_to_delta('60s')
1091
779
datetime.timedelta(0, 60)
1092
>>> string_to_delta(u'60m')
780
>>> string_to_delta('60m')
1093
781
datetime.timedelta(0, 3600)
1094
>>> string_to_delta(u'24h')
782
>>> string_to_delta('24h')
1095
783
datetime.timedelta(1)
1096
784
>>> string_to_delta(u'1w')
1097
785
datetime.timedelta(7)
1098
>>> string_to_delta(u'5m 30s')
786
>>> string_to_delta('5m 30s')
1099
787
datetime.timedelta(0, 330)
1100
788
"""
1101
789
timevalue = datetime.timedelta(0)
1121
809
return timevalue
1122
810
1123
811
812
def server_state_changed(state):
813
"""Derived from the Avahi example code"""
814
if state == avahi.SERVER_COLLISION:
815
logger.error(u"Zeroconf server name collision")
816
service.remove()
817
elif state == avahi.SERVER_RUNNING:
818
service.add()
819
820
821
def entry_group_state_changed(state, error):
822
"""Derived from the Avahi example code"""
823
logger.debug(u"Avahi state change: %i", state)
824
825
if state == avahi.ENTRY_GROUP_ESTABLISHED:
826
logger.debug(u"Zeroconf service established.")
827
elif state == avahi.ENTRY_GROUP_COLLISION:
828
logger.warning(u"Zeroconf service name collision.")
829
service.rename()
830
elif state == avahi.ENTRY_GROUP_FAILURE:
831
logger.critical(u"Avahi: Error in group state changed %s",
832
unicode(error))
833
raise AvahiGroupError("State changed: %s", str(error))
834
1124
835
def if_nametoindex(interface):
1125
"""Call the C function if_nametoindex(), or equivalent
1126
1127
Note: This function cannot accept a unicode string."""
836
"""Call the C function if_nametoindex(), or equivalent"""
1128
837
global if_nametoindex
1129
838
try:
1130
839
if_nametoindex = (ctypes.cdll.LoadLibrary
1131
(ctypes.util.find_library(u"c"))
840
(ctypes.util.find_library("c"))
1132
841
.if_nametoindex)
1133
842
except (OSError, AttributeError):
1134
logger.warning(u"Doing if_nametoindex the hard way")
843
if "struct" not in sys.modules:
844
import struct
845
if "fcntl" not in sys.modules:
846
import fcntl
1135
847
def if_nametoindex(interface):
1136
848
"Get an interface index the hard way, i.e. using fcntl()"
1137
849
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1138
850
with closing(socket.socket()) as s:
1139
851
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1140
struct.pack(str(u"16s16x"),
1141
interface))
1142
interface_index = struct.unpack(str(u"I"),
1143
ifreq[16:20])[0]
852
struct.pack("16s16x", interface))
853
interface_index = struct.unpack("I", ifreq[16:20])[0]
1144
854
return interface_index
1145
855
return if_nametoindex(interface)
1146
856
1147
857
1148
858
def daemon(nochdir = False, noclose = False):
1149
859
"""See daemon(3). Standard BSD Unix function.
1150
1151
860
This should really exist as os.daemon, but it doesn't (yet)."""
1152
861
if os.fork():
1153
862
sys.exit()
1154
863
os.setsid()
1155
864
if not nochdir:
1156
os.chdir(u"/")
865
os.chdir("/")
1157
866
if os.fork():
1158
867
sys.exit()
1159
868
if not noclose:
1161
870
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1162
871
if not stat.S_ISCHR(os.fstat(null).st_mode):
1163
872
raise OSError(errno.ENODEV,
1164
u"/dev/null not a character device")
873
"/dev/null not a character device")
1165
874
os.dup2(null, sys.stdin.fileno())
1166
875
os.dup2(null, sys.stdout.fileno())
1167
876
os.dup2(null, sys.stderr.fileno())
1170
879
1171
880
1172
881
def main():
1173
1174
######################################################################
1175
# Parsing of options, both command line and config file
1176
1177
parser = optparse.OptionParser(version = "%%prog %s" % version)
1178
parser.add_option("-i", u"--interface", type=u"string",
1179
metavar="IF", help=u"Bind to interface IF")
1180
parser.add_option("-a", u"--address", type=u"string",
1181
help=u"Address to listen for requests on")
1182
parser.add_option("-p", u"--port", type=u"int",
1183
help=u"Port number to receive requests on")
1184
parser.add_option("--check", action=u"store_true",
1185
help=u"Run self-test")
1186
parser.add_option("--debug", action=u"store_true",
1187
help=u"Debug mode; run in foreground and log to"
1188
u" terminal")
1189
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1190
u" priority string (see GnuTLS documentation)")
1191
parser.add_option("--servicename", type=u"string",
1192
metavar=u"NAME", help=u"Zeroconf service name")
1193
parser.add_option("--configdir", type=u"string",
1194
default=u"/etc/mandos", metavar=u"DIR",
1195
help=u"Directory to search for configuration"
1196
u" files")
1197
parser.add_option("--no-dbus", action=u"store_false",
1198
dest=u"use_dbus", help=u"Do not provide D-Bus"
1199
u" system bus interface")
1200
parser.add_option("--no-ipv6", action=u"store_false",
1201
dest=u"use_ipv6", help=u"Do not use IPv6")
882
parser = OptionParser(version = "%%prog %s" % version)
883
parser.add_option("-i", "--interface", type="string",
884
metavar="IF", help="Bind to interface IF")
885
parser.add_option("-a", "--address", type="string",
886
help="Address to listen for requests on")
887
parser.add_option("-p", "--port", type="int",
888
help="Port number to receive requests on")
889
parser.add_option("--check", action="store_true", default=False,
890
help="Run self-test")
891
parser.add_option("--debug", action="store_true",
892
help="Debug mode; run in foreground and log to"
893
" terminal")
894
parser.add_option("--priority", type="string", help="GnuTLS"
895
" priority string (see GnuTLS documentation)")
896
parser.add_option("--servicename", type="string", metavar="NAME",
897
help="Zeroconf service name")
898
parser.add_option("--configdir", type="string",
899
default="/etc/mandos", metavar="DIR",
900
help="Directory to search for configuration"
901
" files")
1202
902
options = parser.parse_args()[0]
1203
903
1204
904
if options.check:
1207
907
sys.exit()
1208
908
1209
909
# Default values for config file for server-global settings
1210
server_defaults = { u"interface": u"",
1211
u"address": u"",
1212
u"port": u"",
1213
u"debug": u"False",
1214
u"priority":
1215
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1216
u"servicename": u"Mandos",
1217
u"use_dbus": u"True",
1218
u"use_ipv6": u"True",
910
server_defaults = { "interface": "",
911
"address": "",
912
"port": "",
913
"debug": "False",
914
"priority":
915
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
916
"servicename": "Mandos",
1219
917
}
1220
918
1221
919
# Parse config file for server-global settings
1222
server_config = configparser.SafeConfigParser(server_defaults)
920
server_config = ConfigParser.SafeConfigParser(server_defaults)
1223
921
del server_defaults
1224
server_config.read(os.path.join(options.configdir,
1225
u"mandos.conf"))
922
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1226
923
# Convert the SafeConfigParser object to a dict
1227
924
server_settings = server_config.defaults()
1228
# Use the appropriate methods on the non-string config options
1229
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1230
server_settings[option] = server_config.getboolean(u"DEFAULT",
1231
option)
1232
if server_settings["port"]:
1233
server_settings["port"] = server_config.getint(u"DEFAULT",
1234
u"port")
925
# Use getboolean on the boolean config option
926
server_settings["debug"] = (server_config.getboolean
927
("DEFAULT", "debug"))
1235
928
del server_config
1236
929
1237
930
# Override the settings from the config file with command line
1238
931
# options, if set.
1239
for option in (u"interface", u"address", u"port", u"debug",
1240
u"priority", u"servicename", u"configdir",
1241
u"use_dbus", u"use_ipv6"):
932
for option in ("interface", "address", "port", "debug",
933
"priority", "servicename", "configdir"):
1242
934
value = getattr(options, option)
1243
935
if value is not None:
1244
936
server_settings[option] = value
1245
937
del options
1246
# Force all strings to be unicode
1247
for option in server_settings.keys():
1248
if type(server_settings[option]) is str:
1249
server_settings[option] = unicode(server_settings[option])
1250
938
# Now we have our good server settings in "server_settings"
1251
939
1252
##################################################################
1253
1254
# For convenience
1255
debug = server_settings[u"debug"]
1256
use_dbus = server_settings[u"use_dbus"]
1257
use_ipv6 = server_settings[u"use_ipv6"]
940
debug = server_settings["debug"]
1258
941
1259
942
if not debug:
1260
943
syslogger.setLevel(logging.WARNING)
1261
944
console.setLevel(logging.WARNING)
1262
945
1263
if server_settings[u"servicename"] != u"Mandos":
946
if server_settings["servicename"] != "Mandos":
1264
947
syslogger.setFormatter(logging.Formatter
1265
(u'Mandos (%s) [%%(process)d]:'
1266
u' %%(levelname)s: %%(message)s'
1267
% server_settings[u"servicename"]))
948
('Mandos (%s): %%(levelname)s:'
949
' %%(message)s'
950
% server_settings["servicename"]))
1268
951
1269
952
# Parse config file with clients
1270
client_defaults = { u"timeout": u"1h",
1271
u"interval": u"5m",
1272
u"checker": u"fping -q -- %%(host)s",
1273
u"host": u"",
953
client_defaults = { "timeout": "1h",
954
"interval": "5m",
955
"checker": "fping -q -- %(host)s",
956
"host": "",
1274
957
}
1275
client_config = configparser.SafeConfigParser(client_defaults)
1276
client_config.read(os.path.join(server_settings[u"configdir"],
1277
u"clients.conf"))
1278
1279
global mandos_dbus_service
1280
mandos_dbus_service = None
1281
1282
tcp_server = MandosServer((server_settings[u"address"],
1283
server_settings[u"port"]),
1284
ClientHandler,
1285
interface=server_settings[u"interface"],
1286
use_ipv6=use_ipv6,
1287
gnutls_priority=
1288
server_settings[u"priority"],
1289
use_dbus=use_dbus)
1290
pidfilename = u"/var/run/mandos.pid"
1291
try:
1292
pidfile = open(pidfilename, u"w")
1293
except IOError:
1294
logger.error(u"Could not open file %r", pidfilename)
1295
1296
try:
1297
uid = pwd.getpwnam(u"_mandos").pw_uid
1298
gid = pwd.getpwnam(u"_mandos").pw_gid
1299
except KeyError:
1300
try:
1301
uid = pwd.getpwnam(u"mandos").pw_uid
1302
gid = pwd.getpwnam(u"mandos").pw_gid
1303
except KeyError:
1304
try:
1305
uid = pwd.getpwnam(u"nobody").pw_uid
1306
gid = pwd.getpwnam(u"nobody").pw_gid
1307
except KeyError:
1308
uid = 65534
1309
gid = 65534
1310
try:
958
client_config = ConfigParser.SafeConfigParser(client_defaults)
959
client_config.read(os.path.join(server_settings["configdir"],
960
"clients.conf"))
961
962
clients = Set()
963
tcp_server = IPv6_TCPServer((server_settings["address"],
964
server_settings["port"]),
965
TCP_handler,
966
settings=server_settings,
967
clients=clients)
968
pidfilename = "/var/run/mandos.pid"
969
try:
970
pidfile = open(pidfilename, "w")
971
except IOError, error:
972
logger.error("Could not open file %r", pidfilename)
973
974
uid = 65534
975
gid = 65534
976
try:
977
uid = pwd.getpwnam("mandos").pw_uid
978
except KeyError:
979
try:
980
uid = pwd.getpwnam("nobody").pw_uid
981
except KeyError:
982
pass
983
try:
984
gid = pwd.getpwnam("mandos").pw_gid
985
except KeyError:
986
try:
987
gid = pwd.getpwnam("nogroup").pw_gid
988
except KeyError:
989
pass
990
try:
991
os.setuid(uid)
1311
992
os.setgid(gid)
1312
os.setuid(uid)
1313
993
except OSError, error:
1314
994
if error[0] != errno.EPERM:
1315
995
raise error
1316
996
1317
# Enable all possible GnuTLS debugging
1318
if debug:
1319
# "Use a log level over 10 to enable all debugging options."
1320
# - GnuTLS manual
1321
gnutls.library.functions.gnutls_global_set_log_level(11)
1322
1323
@gnutls.library.types.gnutls_log_func
1324
def debug_gnutls(level, string):
1325
logger.debug(u"GnuTLS: %s", string[:-1])
1326
1327
(gnutls.library.functions
1328
.gnutls_global_set_log_function(debug_gnutls))
997
global service
998
service = AvahiService(name = server_settings["servicename"],
999
servicetype = "_mandos._tcp", )
1000
if server_settings["interface"]:
1001
service.interface = (if_nametoindex
1002
(server_settings["interface"]))
1329
1003
1330
1004
global main_loop
1005
global bus
1006
global server
1331
1007
# From the Avahi example code
1332
1008
DBusGMainLoop(set_as_default=True )
1333
1009
main_loop = gobject.MainLoop()
1334
1010
bus = dbus.SystemBus()
1011
server = dbus.Interface(bus.get_object(avahi.DBUS_NAME,
1012
avahi.DBUS_PATH_SERVER),
1013
avahi.DBUS_INTERFACE_SERVER)
1335
1014
# End of Avahi example code
1336
if use_dbus:
1337
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1338
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1339
service = AvahiService(name = server_settings[u"servicename"],
1340
servicetype = u"_mandos._tcp",
1341
protocol = protocol, bus = bus)
1342
if server_settings["interface"]:
1343
service.interface = (if_nametoindex
1344
(str(server_settings[u"interface"])))
1345
1346
client_class = Client
1347
if use_dbus:
1348
client_class = functools.partial(ClientDBus, bus = bus)
1349
tcp_server.clients.update(set(
1350
client_class(name = section,
1351
config= dict(client_config.items(section)))
1352
for section in client_config.sections()))
1353
if not tcp_server.clients:
1354
logger.warning(u"No clients defined")
1015
bus_name = dbus.service.BusName(u"org.mandos-system.Mandos", bus)
1016
1017
def remove_from_clients(client):
1018
clients.remove(client)
1019
if not clients:
1020
logger.critical(u"No clients left, exiting")
1021
sys.exit()
1022
1023
clients.update(Set(Client(name = section,
1024
stop_hook = remove_from_clients,
1025
config
1026
= dict(client_config.items(section)))
1027
for section in client_config.sections()))
1028
if not clients:
1029
logger.critical(u"No clients defined")
1030
sys.exit(1)
1355
1031
1356
1032
if debug:
1357
1033
# Redirect stdin so all checkers get /dev/null
1366
1042
daemon()
1367
1043
1368
1044
try:
1369
with closing(pidfile):
1370
pid = os.getpid()
1371
pidfile.write(str(pid) + "\n")
1045
pid = os.getpid()
1046
pidfile.write(str(pid) + "\n")
1047
pidfile.close()
1372
1048
del pidfile
1373
1049
except IOError:
1374
1050
logger.error(u"Could not write to file %r with PID %d",
1380
1056
1381
1057
def cleanup():
1382
1058
"Cleanup function; run on exit"
1383
service.cleanup()
1059
global group
1060
# From the Avahi example code
1061
if not group is None:
1062
group.Free()
1063
group = None
1064
# End of Avahi example code
1384
1065
1385
while tcp_server.clients:
1386
client = tcp_server.clients.pop()
1387
client.disable_hook = None
1388
client.disable()
1066
while clients:
1067
client = clients.pop()
1068
client.stop_hook = None
1069
client.stop()
1389
1070
1390
1071
atexit.register(cleanup)
1391
1072
1394
1075
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1395
1076
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1396
1077
1397
if use_dbus:
1398
class MandosDBusService(dbus.service.Object):
1399
"""A D-Bus proxy object"""
1400
def __init__(self):
1401
dbus.service.Object.__init__(self, bus, u"/")
1402
_interface = u"se.bsnet.fukt.Mandos"
1403
1404
@dbus.service.signal(_interface, signature=u"oa{sv}")
1405
def ClientAdded(self, objpath, properties):
1406
"D-Bus signal"
1407
pass
1408
1409
@dbus.service.signal(_interface, signature=u"s")
1410
def ClientNotFound(self, fingerprint):
1411
"D-Bus signal"
1412
pass
1413
1414
@dbus.service.signal(_interface, signature=u"os")
1415
def ClientRemoved(self, objpath, name):
1416
"D-Bus signal"
1417
pass
1418
1419
@dbus.service.method(_interface, out_signature=u"ao")
1420
def GetAllClients(self):
1421
"D-Bus method"
1422
return dbus.Array(c.dbus_object_path
1423
for c in tcp_server.clients)
1424
1425
@dbus.service.method(_interface,
1426
out_signature=u"a{oa{sv}}")
1427
def GetAllClientsWithProperties(self):
1428
"D-Bus method"
1429
return dbus.Dictionary(
1430
((c.dbus_object_path, c.GetAllProperties())
1431
for c in tcp_server.clients),
1432
signature=u"oa{sv}")
1433
1434
@dbus.service.method(_interface, in_signature=u"o")
1435
def RemoveClient(self, object_path):
1436
"D-Bus method"
1437
for c in tcp_server.clients:
1438
if c.dbus_object_path == object_path:
1439
tcp_server.clients.remove(c)
1440
c.remove_from_connection()
1441
# Don't signal anything except ClientRemoved
1442
c.disable(signal=False)
1443
# Emit D-Bus signal
1444
self.ClientRemoved(object_path, c.name)
1445
return
1446
raise KeyError
1447
1448
del _interface
1449
1450
mandos_dbus_service = MandosDBusService()
1451
1452
for client in tcp_server.clients:
1453
if use_dbus:
1454
# Emit D-Bus signal
1455
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1456
client.GetAllProperties())
1457
client.enable()
1078
for client in clients:
1079
client.start()
1458
1080
1459
1081
tcp_server.enable()
1460
1082
tcp_server.server_activate()
1461
1083
1462
1084
# Find out what port we got
1463
1085
service.port = tcp_server.socket.getsockname()[1]
1464
if use_ipv6:
1465
logger.info(u"Now listening on address %r, port %d,"
1466
" flowinfo %d, scope_id %d"
1467
% tcp_server.socket.getsockname())
1468
else: # IPv4
1469
logger.info(u"Now listening on address %r, port %d"
1470
% tcp_server.socket.getsockname())
1086
logger.info(u"Now listening on address %r, port %d, flowinfo %d,"
1087
u" scope_id %d" % tcp_server.socket.getsockname())
1471
1088
1472
1089
#service.interface = tcp_server.socket.getsockname()[3]
1473
1090
1474
1091
try:
1475
1092
# From the Avahi example code
1093
server.connect_to_signal("StateChanged", server_state_changed)
1476
1094
try:
1477
service.activate()
1095
server_state_changed(server.GetState())
1478
1096
except dbus.exceptions.DBusException, error:
1479
1097
logger.critical(u"DBusException: %s", error)
1480
1098
sys.exit(1)
1488
1106
logger.debug(u"Starting main loop")
1489
1107
main_loop.run()
1490
1108
except AvahiError, error:
1491
logger.critical(u"AvahiError: %s", error)
1109
logger.critical(u"AvahiError: %s" + unicode(error))
1492
1110
sys.exit(1)
1493
1111
except KeyboardInterrupt:
1494
1112
if debug:
1495
print >> sys.stderr
1496
logger.debug(u"Server received KeyboardInterrupt")
1497
logger.debug(u"Server exiting")
1113
print
1498
1114
1499
1115
if __name__ == '__main__':
1500
1116
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0