241
229
"""A representation of a client host served by this server.
244
_approved: bool(); 'None' if not yet approved/disapproved
245
approval_delay: datetime.timedelta(); Time to wait for approval
246
approval_duration: datetime.timedelta(); Duration of one approval
232
name: string; from the config file, used in log messages and
234
fingerprint: string (40 or 32 hexadecimal digits); used to
235
uniquely identify the client
236
secret: bytestring; sent verbatim (over TLS) to client
237
host: string; available for use by the checker command
238
created: datetime.datetime(); (UTC) object creation
239
last_enabled: datetime.datetime(); (UTC)
241
last_checked_ok: datetime.datetime(); (UTC) or None
242
timeout: datetime.timedelta(); How long from last_checked_ok
243
until this client is invalid
244
interval: datetime.timedelta(); How often to start a new checker
245
disable_hook: If set, called by disable() as disable_hook(self)
247
246
checker: subprocess.Popen(); a running checker process used
248
247
to see if the client lives.
249
248
'None' if no process is running.
250
checker_callback_tag: a gobject event source tag, or None
251
checker_command: string; External command which is run to check
252
if client lives. %() expansions are done at
249
checker_initiator_tag: a gobject event source tag, or None
250
disable_initiator_tag: - '' -
251
checker_callback_tag: - '' -
252
checker_command: string; External command which is run to check if
253
client lives. %() expansions are done at
253
254
runtime with vars(self) as dict, so that for
254
255
instance %(name)s can be used in the command.
255
checker_initiator_tag: a gobject event source tag, or None
256
created: datetime.datetime(); (UTC) object creation
257
256
current_checker_command: string; current running checker_command
258
disable_hook: If set, called by disable() as disable_hook(self)
259
disable_initiator_tag: a gobject event source tag, or None
261
fingerprint: string (40 or 32 hexadecimal digits); used to
262
uniquely identify the client
263
host: string; available for use by the checker command
264
interval: datetime.timedelta(); How often to start a new checker
265
last_approval_request: datetime.datetime(); (UTC) or None
266
last_checked_ok: datetime.datetime(); (UTC) or None
267
last_enabled: datetime.datetime(); (UTC)
268
name: string; from the config file, used in log messages and
270
secret: bytestring; sent verbatim (over TLS) to client
271
timeout: datetime.timedelta(); How long from last_checked_ok
272
until this client is disabled
273
runtime_expansions: Allowed attributes for runtime expansion.
276
runtime_expansions = ("approval_delay", "approval_duration",
277
"created", "enabled", "fingerprint",
278
"host", "interval", "last_checked_ok",
279
"last_enabled", "name", "timeout")
282
def _timedelta_to_milliseconds(td):
283
"Convert a datetime.timedelta() to milliseconds"
284
return ((td.days * 24 * 60 * 60 * 1000)
285
+ (td.seconds * 1000)
286
+ (td.microseconds // 1000))
260
def _datetime_to_milliseconds(dt):
261
"Convert a datetime.datetime() to milliseconds"
262
return ((dt.days * 24 * 60 * 60 * 1000)
263
+ (dt.seconds * 1000)
264
+ (dt.microseconds // 1000))
288
266
def timeout_milliseconds(self):
289
267
"Return the 'timeout' attribute in milliseconds"
290
return self._timedelta_to_milliseconds(self.timeout)
268
return self._datetime_to_milliseconds(self.timeout)
292
270
def interval_milliseconds(self):
293
271
"Return the 'interval' attribute in milliseconds"
294
return self._timedelta_to_milliseconds(self.interval)
296
def approval_delay_milliseconds(self):
297
return self._timedelta_to_milliseconds(self.approval_delay)
272
return self._datetime_to_milliseconds(self.interval)
299
274
def __init__(self, name = None, disable_hook=None, config=None):
300
275
"""Note: the 'checker' key in 'config' sets the
304
279
if config is None:
306
logger.debug("Creating client %r", self.name)
281
logger.debug(u"Creating client %r", self.name)
307
282
# Uppercase and remove spaces from fingerprint for later
308
283
# comparison purposes with return value from the fingerprint()
310
self.fingerprint = (config["fingerprint"].upper()
312
logger.debug(" Fingerprint: %s", self.fingerprint)
313
if "secret" in config:
314
self.secret = config["secret"].decode("base64")
315
elif "secfile" in config:
316
with open(os.path.expanduser(os.path.expandvars
317
(config["secfile"])),
285
self.fingerprint = (config[u"fingerprint"].upper()
287
logger.debug(u" Fingerprint: %s", self.fingerprint)
288
if u"secret" in config:
289
self.secret = config[u"secret"].decode(u"base64")
290
elif u"secfile" in config:
291
with closing(open(os.path.expanduser
293
(config[u"secfile"])))) as secfile:
319
294
self.secret = secfile.read()
321
raise TypeError("No secret or secfile for client %s"
296
raise TypeError(u"No secret or secfile for client %s"
323
self.host = config.get("host", "")
298
self.host = config.get(u"host", u"")
324
299
self.created = datetime.datetime.utcnow()
325
300
self.enabled = False
326
self.last_approval_request = None
327
301
self.last_enabled = None
328
302
self.last_checked_ok = None
329
self.timeout = string_to_delta(config["timeout"])
330
self.interval = string_to_delta(config["interval"])
303
self.timeout = string_to_delta(config[u"timeout"])
304
self.interval = string_to_delta(config[u"interval"])
331
305
self.disable_hook = disable_hook
332
306
self.checker = None
333
307
self.checker_initiator_tag = None
334
308
self.disable_initiator_tag = None
335
309
self.checker_callback_tag = None
336
self.checker_command = config["checker"]
310
self.checker_command = config[u"checker"]
337
311
self.current_checker_command = None
338
312
self.last_connect = None
339
self._approved = None
340
self.approved_by_default = config.get("approved_by_default",
342
self.approvals_pending = 0
343
self.approval_delay = string_to_delta(
344
config["approval_delay"])
345
self.approval_duration = string_to_delta(
346
config["approval_duration"])
347
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
349
def send_changedstate(self):
350
self.changedstate.acquire()
351
self.changedstate.notify_all()
352
self.changedstate.release()
354
314
def enable(self):
355
315
"""Start this client's checker and timeout hooks"""
356
if getattr(self, "enabled", False):
316
if getattr(self, u"enabled", False):
357
317
# Already enabled
359
self.send_changedstate()
360
319
self.last_enabled = datetime.datetime.utcnow()
361
320
# Schedule a new checker to be started an 'interval' from now,
362
321
# and every interval from then on.
363
322
self.checker_initiator_tag = (gobject.timeout_add
364
323
(self.interval_milliseconds(),
365
324
self.start_checker))
325
# Also start a new checker *right now*.
366
327
# Schedule a disable() when 'timeout' has passed
367
328
self.disable_initiator_tag = (gobject.timeout_add
368
329
(self.timeout_milliseconds(),
370
331
self.enabled = True
371
# Also start a new checker *right now*.
374
def disable(self, quiet=True):
375
334
"""Disable this client."""
376
335
if not getattr(self, "enabled", False):
379
self.send_changedstate()
381
logger.info("Disabling client %s", self.name)
382
if getattr(self, "disable_initiator_tag", False):
337
logger.info(u"Disabling client %s", self.name)
338
if getattr(self, u"disable_initiator_tag", False):
383
339
gobject.source_remove(self.disable_initiator_tag)
384
340
self.disable_initiator_tag = None
385
if getattr(self, "checker_initiator_tag", False):
341
if getattr(self, u"checker_initiator_tag", False):
386
342
gobject.source_remove(self.checker_initiator_tag)
387
343
self.checker_initiator_tag = None
388
344
self.stop_checker()
508
454
if self.checker_callback_tag:
509
455
gobject.source_remove(self.checker_callback_tag)
510
456
self.checker_callback_tag = None
511
if getattr(self, "checker", None) is None:
457
if getattr(self, u"checker", None) is None:
513
logger.debug("Stopping checker for %(name)s", vars(self))
459
logger.debug(u"Stopping checker for %(name)s", vars(self))
515
461
os.kill(self.checker.pid, signal.SIGTERM)
517
463
#if self.checker.poll() is None:
518
464
# os.kill(self.checker.pid, signal.SIGKILL)
519
465
except OSError, error:
520
466
if error.errno != errno.ESRCH: # No such process
522
468
self.checker = None
524
def dbus_service_property(dbus_interface, signature="v",
525
access="readwrite", byte_arrays=False):
526
"""Decorators for marking methods of a DBusObjectWithProperties to
527
become properties on the D-Bus.
529
The decorated method will be called with no arguments by "Get"
530
and with one argument by "Set".
532
The parameters, where they are supported, are the same as
533
dbus.service.method, except there is only "signature", since the
534
type from Get() and the type sent to Set() is the same.
536
# Encoding deeply encoded byte arrays is not supported yet by the
537
# "Set" method, so we fail early here:
538
if byte_arrays and signature != "ay":
539
raise ValueError("Byte arrays not supported for non-'ay'"
540
" signature %r" % signature)
542
func._dbus_is_property = True
543
func._dbus_interface = dbus_interface
544
func._dbus_signature = signature
545
func._dbus_access = access
546
func._dbus_name = func.__name__
547
if func._dbus_name.endswith("_dbus_property"):
548
func._dbus_name = func._dbus_name[:-14]
549
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
554
class DBusPropertyException(dbus.exceptions.DBusException):
555
"""A base class for D-Bus property-related exceptions
557
def __unicode__(self):
558
return unicode(str(self))
561
class DBusPropertyAccessException(DBusPropertyException):
562
"""A property's access permissions disallows an operation.
567
class DBusPropertyNotFound(DBusPropertyException):
568
"""An attempt was made to access a non-existing property.
573
class DBusObjectWithProperties(dbus.service.Object):
574
"""A D-Bus object with properties.
576
Classes inheriting from this can use the dbus_service_property
577
decorator to expose methods as D-Bus properties. It exposes the
578
standard Get(), Set(), and GetAll() methods on the D-Bus.
582
def _is_dbus_property(obj):
583
return getattr(obj, "_dbus_is_property", False)
585
def _get_all_dbus_properties(self):
586
"""Returns a generator of (name, attribute) pairs
588
return ((prop._dbus_name, prop)
590
inspect.getmembers(self, self._is_dbus_property))
592
def _get_dbus_property(self, interface_name, property_name):
593
"""Returns a bound method if one exists which is a D-Bus
594
property with the specified name and interface.
596
for name in (property_name,
597
property_name + "_dbus_property"):
598
prop = getattr(self, name, None)
600
or not self._is_dbus_property(prop)
601
or prop._dbus_name != property_name
602
or (interface_name and prop._dbus_interface
603
and interface_name != prop._dbus_interface)):
607
raise DBusPropertyNotFound(self.dbus_object_path + ":"
608
+ interface_name + "."
611
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
613
def Get(self, interface_name, property_name):
614
"""Standard D-Bus property Get() method, see D-Bus standard.
616
prop = self._get_dbus_property(interface_name, property_name)
617
if prop._dbus_access == "write":
618
raise DBusPropertyAccessException(property_name)
620
if not hasattr(value, "variant_level"):
622
return type(value)(value, variant_level=value.variant_level+1)
624
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
625
def Set(self, interface_name, property_name, value):
626
"""Standard D-Bus property Set() method, see D-Bus standard.
628
prop = self._get_dbus_property(interface_name, property_name)
629
if prop._dbus_access == "read":
630
raise DBusPropertyAccessException(property_name)
631
if prop._dbus_get_args_options["byte_arrays"]:
632
# The byte_arrays option is not supported yet on
633
# signatures other than "ay".
634
if prop._dbus_signature != "ay":
636
value = dbus.ByteArray(''.join(unichr(byte)
640
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
641
out_signature="a{sv}")
642
def GetAll(self, interface_name):
643
"""Standard D-Bus property GetAll() method, see D-Bus
646
Note: Will not include properties with access="write".
649
for name, prop in self._get_all_dbus_properties():
651
and interface_name != prop._dbus_interface):
652
# Interface non-empty but did not match
654
# Ignore write-only properties
655
if prop._dbus_access == "write":
658
if not hasattr(value, "variant_level"):
661
all[name] = type(value)(value, variant_level=
662
value.variant_level+1)
663
return dbus.Dictionary(all, signature="sv")
665
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
667
path_keyword='object_path',
668
connection_keyword='connection')
669
def Introspect(self, object_path, connection):
670
"""Standard D-Bus method, overloaded to insert property tags.
672
xmlstring = dbus.service.Object.Introspect(self, object_path,
675
document = xml.dom.minidom.parseString(xmlstring)
676
def make_tag(document, name, prop):
677
e = document.createElement("property")
678
e.setAttribute("name", name)
679
e.setAttribute("type", prop._dbus_signature)
680
e.setAttribute("access", prop._dbus_access)
682
for if_tag in document.getElementsByTagName("interface"):
683
for tag in (make_tag(document, name, prop)
685
in self._get_all_dbus_properties()
686
if prop._dbus_interface
687
== if_tag.getAttribute("name")):
688
if_tag.appendChild(tag)
689
# Add the names to the return values for the
690
# "org.freedesktop.DBus.Properties" methods
691
if (if_tag.getAttribute("name")
692
== "org.freedesktop.DBus.Properties"):
693
for cn in if_tag.getElementsByTagName("method"):
694
if cn.getAttribute("name") == "Get":
695
for arg in cn.getElementsByTagName("arg"):
696
if (arg.getAttribute("direction")
698
arg.setAttribute("name", "value")
699
elif cn.getAttribute("name") == "GetAll":
700
for arg in cn.getElementsByTagName("arg"):
701
if (arg.getAttribute("direction")
703
arg.setAttribute("name", "props")
704
xmlstring = document.toxml("utf-8")
706
except (AttributeError, xml.dom.DOMException,
707
xml.parsers.expat.ExpatError), error:
708
logger.error("Failed to override Introspection method",
713
class ClientDBus(Client, DBusObjectWithProperties):
470
def still_valid(self):
471
"""Has the timeout not yet passed for this client?"""
472
if not getattr(self, u"enabled", False):
474
now = datetime.datetime.utcnow()
475
if self.last_checked_ok is None:
476
return now < (self.created + self.timeout)
478
return now < (self.last_checked_ok + self.timeout)
481
class ClientDBus(Client, dbus.service.Object):
714
482
"""A Client class using D-Bus
717
485
dbus_object_path: dbus.ObjectPath
718
486
bus: dbus.SystemBus()
721
runtime_expansions = (Client.runtime_expansions
722
+ ("dbus_object_path",))
724
488
# dbus.service.Object doesn't use super(), so we can't either.
726
490
def __init__(self, bus = None, *args, **kwargs):
727
self._approvals_pending = 0
729
492
Client.__init__(self, *args, **kwargs)
730
493
# Only now, when this client is initialized, can it show up on
732
client_object_name = unicode(self.name).translate(
735
495
self.dbus_object_path = (dbus.ObjectPath
736
("/clients/" + client_object_name))
737
DBusObjectWithProperties.__init__(self, self.bus,
738
self.dbus_object_path)
740
def _get_approvals_pending(self):
741
return self._approvals_pending
742
def _set_approvals_pending(self, value):
743
old_value = self._approvals_pending
744
self._approvals_pending = value
746
if (hasattr(self, "dbus_object_path")
747
and bval is not bool(old_value)):
748
dbus_bool = dbus.Boolean(bval, variant_level=1)
749
self.PropertyChanged(dbus.String("ApprovalPending"),
752
approvals_pending = property(_get_approvals_pending,
753
_set_approvals_pending)
754
del _get_approvals_pending, _set_approvals_pending
497
+ self.name.replace(u".", u"_")))
498
dbus.service.Object.__init__(self, self.bus,
499
self.dbus_object_path)
757
502
def _datetime_to_dbus(dt, variant_level=0):
843
579
# Emit D-Bus signal
844
580
self.CheckerStarted(self.current_checker_command)
845
581
self.PropertyChanged(
846
dbus.String("CheckerRunning"),
582
dbus.String(u"checker_running"),
847
583
dbus.Boolean(True, variant_level=1))
850
586
def stop_checker(self, *args, **kwargs):
851
old_checker = getattr(self, "checker", None)
587
old_checker = getattr(self, u"checker", None)
852
588
r = Client.stop_checker(self, *args, **kwargs)
853
589
if (old_checker is not None
854
and getattr(self, "checker", None) is None):
855
self.PropertyChanged(dbus.String("CheckerRunning"),
590
and getattr(self, u"checker", None) is None):
591
self.PropertyChanged(dbus.String(u"checker_running"),
856
592
dbus.Boolean(False, variant_level=1))
859
def _reset_approved(self):
860
self._approved = None
863
def approve(self, value=True):
864
self.send_changedstate()
865
self._approved = value
866
gobject.timeout_add(self._timedelta_to_milliseconds
867
(self.approval_duration),
868
self._reset_approved)
871
## D-Bus methods, signals & properties
872
_interface = "se.bsnet.fukt.Mandos.Client"
595
## D-Bus methods & signals
596
_interface = u"se.bsnet.fukt.Mandos.Client"
599
@dbus.service.method(_interface)
601
return self.checked_ok()
876
603
# CheckerCompleted - signal
877
@dbus.service.signal(_interface, signature="nxs")
604
@dbus.service.signal(_interface, signature=u"nxs")
878
605
def CheckerCompleted(self, exitcode, waitstatus, command):
882
609
# CheckerStarted - signal
883
@dbus.service.signal(_interface, signature="s")
610
@dbus.service.signal(_interface, signature=u"s")
884
611
def CheckerStarted(self, command):
615
# GetAllProperties - method
616
@dbus.service.method(_interface, out_signature=u"a{sv}")
617
def GetAllProperties(self):
619
return dbus.Dictionary({
620
dbus.String(u"name"):
621
dbus.String(self.name, variant_level=1),
622
dbus.String(u"fingerprint"):
623
dbus.String(self.fingerprint, variant_level=1),
624
dbus.String(u"host"):
625
dbus.String(self.host, variant_level=1),
626
dbus.String(u"created"):
627
self._datetime_to_dbus(self.created,
629
dbus.String(u"last_enabled"):
630
(self._datetime_to_dbus(self.last_enabled,
632
if self.last_enabled is not None
633
else dbus.Boolean(False, variant_level=1)),
634
dbus.String(u"enabled"):
635
dbus.Boolean(self.enabled, variant_level=1),
636
dbus.String(u"last_checked_ok"):
637
(self._datetime_to_dbus(self.last_checked_ok,
639
if self.last_checked_ok is not None
640
else dbus.Boolean (False, variant_level=1)),
641
dbus.String(u"timeout"):
642
dbus.UInt64(self.timeout_milliseconds(),
644
dbus.String(u"interval"):
645
dbus.UInt64(self.interval_milliseconds(),
647
dbus.String(u"checker"):
648
dbus.String(self.checker_command,
650
dbus.String(u"checker_running"):
651
dbus.Boolean(self.checker is not None,
653
dbus.String(u"object_path"):
654
dbus.ObjectPath(self.dbus_object_path,
658
# IsStillValid - method
659
@dbus.service.method(_interface, out_signature=u"b")
660
def IsStillValid(self):
661
return self.still_valid()
888
663
# PropertyChanged - signal
889
@dbus.service.signal(_interface, signature="sv")
664
@dbus.service.signal(_interface, signature=u"sv")
890
665
def PropertyChanged(self, property, value):
669
# ReceivedSecret - signal
895
670
@dbus.service.signal(_interface)
898
Is sent after a successful transfer of secret from the Mandos
899
server to mandos-client
671
def ReceivedSecret(self):
903
675
# Rejected - signal
904
@dbus.service.signal(_interface, signature="s")
905
def Rejected(self, reason):
676
@dbus.service.signal(_interface)
909
# NeedApproval - signal
910
@dbus.service.signal(_interface, signature="tb")
911
def NeedApproval(self, timeout, default):
913
return self.need_approval()
918
@dbus.service.method(_interface, in_signature="b")
919
def Approve(self, value):
923
@dbus.service.method(_interface)
925
return self.checked_ok()
681
# SetChecker - method
682
@dbus.service.method(_interface, in_signature=u"s")
683
def SetChecker(self, checker):
684
"D-Bus setter method"
685
self.checker_command = checker
687
self.PropertyChanged(dbus.String(u"checker"),
688
dbus.String(self.checker_command,
692
@dbus.service.method(_interface, in_signature=u"s")
693
def SetHost(self, host):
694
"D-Bus setter method"
697
self.PropertyChanged(dbus.String(u"host"),
698
dbus.String(self.host, variant_level=1))
700
# SetInterval - method
701
@dbus.service.method(_interface, in_signature=u"t")
702
def SetInterval(self, milliseconds):
703
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
705
self.PropertyChanged(dbus.String(u"interval"),
707
.interval_milliseconds(),
711
@dbus.service.method(_interface, in_signature=u"ay",
713
def SetSecret(self, secret):
714
"D-Bus setter method"
715
self.secret = str(secret)
717
# SetTimeout - method
718
@dbus.service.method(_interface, in_signature=u"t")
719
def SetTimeout(self, milliseconds):
720
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
722
self.PropertyChanged(dbus.String(u"timeout"),
723
(dbus.UInt64(self.timeout_milliseconds(),
927
726
# Enable - method
928
727
@dbus.service.method(_interface)
947
746
def StopChecker(self):
948
747
self.stop_checker()
952
# ApprovalPending - property
953
@dbus_service_property(_interface, signature="b", access="read")
954
def ApprovalPending_dbus_property(self):
955
return dbus.Boolean(bool(self.approvals_pending))
957
# ApprovedByDefault - property
958
@dbus_service_property(_interface, signature="b",
960
def ApprovedByDefault_dbus_property(self, value=None):
961
if value is None: # get
962
return dbus.Boolean(self.approved_by_default)
963
self.approved_by_default = bool(value)
965
self.PropertyChanged(dbus.String("ApprovedByDefault"),
966
dbus.Boolean(value, variant_level=1))
968
# ApprovalDelay - property
969
@dbus_service_property(_interface, signature="t",
971
def ApprovalDelay_dbus_property(self, value=None):
972
if value is None: # get
973
return dbus.UInt64(self.approval_delay_milliseconds())
974
self.approval_delay = datetime.timedelta(0, 0, 0, value)
976
self.PropertyChanged(dbus.String("ApprovalDelay"),
977
dbus.UInt64(value, variant_level=1))
979
# ApprovalDuration - property
980
@dbus_service_property(_interface, signature="t",
982
def ApprovalDuration_dbus_property(self, value=None):
983
if value is None: # get
984
return dbus.UInt64(self._timedelta_to_milliseconds(
985
self.approval_duration))
986
self.approval_duration = datetime.timedelta(0, 0, 0, value)
988
self.PropertyChanged(dbus.String("ApprovalDuration"),
989
dbus.UInt64(value, variant_level=1))
992
@dbus_service_property(_interface, signature="s", access="read")
993
def Name_dbus_property(self):
994
return dbus.String(self.name)
996
# Fingerprint - property
997
@dbus_service_property(_interface, signature="s", access="read")
998
def Fingerprint_dbus_property(self):
999
return dbus.String(self.fingerprint)
1002
@dbus_service_property(_interface, signature="s",
1004
def Host_dbus_property(self, value=None):
1005
if value is None: # get
1006
return dbus.String(self.host)
1009
self.PropertyChanged(dbus.String("Host"),
1010
dbus.String(value, variant_level=1))
1012
# Created - property
1013
@dbus_service_property(_interface, signature="s", access="read")
1014
def Created_dbus_property(self):
1015
return dbus.String(self._datetime_to_dbus(self.created))
1017
# LastEnabled - property
1018
@dbus_service_property(_interface, signature="s", access="read")
1019
def LastEnabled_dbus_property(self):
1020
if self.last_enabled is None:
1021
return dbus.String("")
1022
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1024
# Enabled - property
1025
@dbus_service_property(_interface, signature="b",
1027
def Enabled_dbus_property(self, value=None):
1028
if value is None: # get
1029
return dbus.Boolean(self.enabled)
1035
# LastCheckedOK - property
1036
@dbus_service_property(_interface, signature="s",
1038
def LastCheckedOK_dbus_property(self, value=None):
1039
if value is not None:
1042
if self.last_checked_ok is None:
1043
return dbus.String("")
1044
return dbus.String(self._datetime_to_dbus(self
1047
# LastApprovalRequest - property
1048
@dbus_service_property(_interface, signature="s", access="read")
1049
def LastApprovalRequest_dbus_property(self):
1050
if self.last_approval_request is None:
1051
return dbus.String("")
1052
return dbus.String(self.
1053
_datetime_to_dbus(self
1054
.last_approval_request))
1056
# Timeout - property
1057
@dbus_service_property(_interface, signature="t",
1059
def Timeout_dbus_property(self, value=None):
1060
if value is None: # get
1061
return dbus.UInt64(self.timeout_milliseconds())
1062
self.timeout = datetime.timedelta(0, 0, 0, value)
1064
self.PropertyChanged(dbus.String("Timeout"),
1065
dbus.UInt64(value, variant_level=1))
1066
if getattr(self, "disable_initiator_tag", None) is None:
1068
# Reschedule timeout
1069
gobject.source_remove(self.disable_initiator_tag)
1070
self.disable_initiator_tag = None
1071
time_to_die = (self.
1072
_timedelta_to_milliseconds((self
1077
if time_to_die <= 0:
1078
# The timeout has passed
1081
self.disable_initiator_tag = (gobject.timeout_add
1082
(time_to_die, self.disable))
1084
# Interval - property
1085
@dbus_service_property(_interface, signature="t",
1087
def Interval_dbus_property(self, value=None):
1088
if value is None: # get
1089
return dbus.UInt64(self.interval_milliseconds())
1090
self.interval = datetime.timedelta(0, 0, 0, value)
1092
self.PropertyChanged(dbus.String("Interval"),
1093
dbus.UInt64(value, variant_level=1))
1094
if getattr(self, "checker_initiator_tag", None) is None:
1096
# Reschedule checker run
1097
gobject.source_remove(self.checker_initiator_tag)
1098
self.checker_initiator_tag = (gobject.timeout_add
1099
(value, self.start_checker))
1100
self.start_checker() # Start one now, too
1102
# Checker - property
1103
@dbus_service_property(_interface, signature="s",
1105
def Checker_dbus_property(self, value=None):
1106
if value is None: # get
1107
return dbus.String(self.checker_command)
1108
self.checker_command = value
1110
self.PropertyChanged(dbus.String("Checker"),
1111
dbus.String(self.checker_command,
1114
# CheckerRunning - property
1115
@dbus_service_property(_interface, signature="b",
1117
def CheckerRunning_dbus_property(self, value=None):
1118
if value is None: # get
1119
return dbus.Boolean(self.checker is not None)
1121
self.start_checker()
1125
# ObjectPath - property
1126
@dbus_service_property(_interface, signature="o", access="read")
1127
def ObjectPath_dbus_property(self):
1128
return self.dbus_object_path # is already a dbus.ObjectPath
1131
@dbus_service_property(_interface, signature="ay",
1132
access="write", byte_arrays=True)
1133
def Secret_dbus_property(self, value):
1134
self.secret = str(value)
1139
class ProxyClient(object):
1140
def __init__(self, child_pipe, fpr, address):
1141
self._pipe = child_pipe
1142
self._pipe.send(('init', fpr, address))
1143
if not self._pipe.recv():
1146
def __getattribute__(self, name):
1147
if(name == '_pipe'):
1148
return super(ProxyClient, self).__getattribute__(name)
1149
self._pipe.send(('getattr', name))
1150
data = self._pipe.recv()
1151
if data[0] == 'data':
1153
if data[0] == 'function':
1154
def func(*args, **kwargs):
1155
self._pipe.send(('funcall', name, args, kwargs))
1156
return self._pipe.recv()[1]
1159
def __setattr__(self, name, value):
1160
if(name == '_pipe'):
1161
return super(ProxyClient, self).__setattr__(name, value)
1162
self._pipe.send(('setattr', name, value))
1165
752
class ClientHandler(socketserver.BaseRequestHandler, object):
1166
753
"""A class to handle client connections.
1169
756
Note: This will run in its own forked process."""
1171
758
def handle(self):
1172
with contextlib.closing(self.server.child_pipe) as child_pipe:
1173
logger.info("TCP connection from: %s",
1174
unicode(self.client_address))
1175
logger.debug("Pipe FD: %d",
1176
self.server.child_pipe.fileno())
759
logger.info(u"TCP connection from: %s",
760
unicode(self.client_address))
761
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
762
# Open IPC pipe to parent process
763
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
1178
764
session = (gnutls.connection
1179
765
.ClientSession(self.request,
1180
766
gnutls.connection
1181
767
.X509Credentials()))
769
line = self.request.makefile().readline()
770
logger.debug(u"Protocol version: %r", line)
772
if int(line.strip().split()[0]) > 1:
774
except (ValueError, IndexError, RuntimeError), error:
775
logger.error(u"Unknown protocol version: %s", error)
1183
778
# Note: gnutls.connection.X509Credentials is really a
1184
779
# generic GnuTLS certificate credentials object so long as
1185
780
# no X.509 keys are added to it. Therefore, we can use it
1186
781
# here despite using OpenPGP certificates.
1188
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1189
# "+AES-256-CBC", "+SHA1",
1190
# "+COMP-NULL", "+CTYPE-OPENPGP",
783
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
784
# u"+AES-256-CBC", u"+SHA1",
785
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1192
787
# Use a fallback default, since this MUST be set.
1193
788
priority = self.server.gnutls_priority
1194
789
if priority is None:
1196
791
(gnutls.library.functions
1197
792
.gnutls_priority_set_direct(session._c_object,
1198
793
priority, None))
1200
# Start communication using the Mandos protocol
1201
# Get protocol number
1202
line = self.request.makefile().readline()
1203
logger.debug("Protocol version: %r", line)
1205
if int(line.strip().split()[0]) > 1:
1207
except (ValueError, IndexError, RuntimeError), error:
1208
logger.error("Unknown protocol version: %s", error)
1211
# Start GnuTLS connection
1213
796
session.handshake()
1214
797
except gnutls.errors.GNUTLSError, error:
1215
logger.warning("Handshake failed: %s", error)
798
logger.warning(u"Handshake failed: %s", error)
1216
799
# Do not run session.bye() here: the session is not
1217
800
# established. Just abandon the request.
1219
logger.debug("Handshake succeeded")
1221
approval_required = False
802
logger.debug(u"Handshake succeeded")
1224
fpr = self.fingerprint(self.peer_certificate
1226
except (TypeError, gnutls.errors.GNUTLSError), error:
1227
logger.warning("Bad certificate: %s", error)
1229
logger.debug("Fingerprint: %s", fpr)
1232
client = ProxyClient(child_pipe, fpr,
1233
self.client_address)
1237
if client.approval_delay:
1238
delay = client.approval_delay
1239
client.approvals_pending += 1
1240
approval_required = True
1243
if not client.enabled:
1244
logger.warning("Client %s is disabled",
1246
if self.server.use_dbus:
1248
client.Rejected("Disabled")
1251
if client._approved or not client.approval_delay:
1252
#We are approved or approval is disabled
1254
elif client._approved is None:
1255
logger.info("Client %s needs approval",
1257
if self.server.use_dbus:
1259
client.NeedApproval(
1260
client.approval_delay_milliseconds(),
1261
client.approved_by_default)
1263
logger.warning("Client %s was not approved",
1265
if self.server.use_dbus:
1267
client.Rejected("Denied")
1270
#wait until timeout or approved
1271
#x = float(client._timedelta_to_milliseconds(delay))
1272
time = datetime.datetime.now()
1273
client.changedstate.acquire()
1274
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1275
client.changedstate.release()
1276
time2 = datetime.datetime.now()
1277
if (time2 - time) >= delay:
1278
if not client.approved_by_default:
1279
logger.warning("Client %s timed out while"
1280
" waiting for approval",
1282
if self.server.use_dbus:
1284
client.Rejected("Approval timed out")
1289
delay -= time2 - time
1292
while sent_size < len(client.secret):
1294
sent = session.send(client.secret[sent_size:])
1295
except (gnutls.errors.GNUTLSError), error:
1296
logger.warning("gnutls send failed")
1298
logger.debug("Sent: %d, remaining: %d",
1299
sent, len(client.secret)
1300
- (sent_size + sent))
1303
logger.info("Sending secret to %s", client.name)
1304
# bump the timeout as if seen
1306
if self.server.use_dbus:
804
fpr = self.fingerprint(self.peer_certificate(session))
805
except (TypeError, gnutls.errors.GNUTLSError), error:
806
logger.warning(u"Bad certificate: %s", error)
809
logger.debug(u"Fingerprint: %s", fpr)
1311
if approval_required:
1312
client.approvals_pending -= 1
1315
except (gnutls.errors.GNUTLSError), error:
1316
logger.warning("GnuTLS bye failed")
811
for c in self.server.clients:
812
if c.fingerprint == fpr:
816
ipc.write(u"NOTFOUND %s %s\n"
817
% (fpr, unicode(self.client_address)))
820
# Have to check if client.still_valid(), since it is
821
# possible that the client timed out while establishing
822
# the GnuTLS session.
823
if not client.still_valid():
824
ipc.write(u"INVALID %s\n" % client.name)
827
ipc.write(u"SENDING %s\n" % client.name)
829
while sent_size < len(client.secret):
830
sent = session.send(client.secret[sent_size:])
831
logger.debug(u"Sent: %d, remaining: %d",
832
sent, len(client.secret)
833
- (sent_size + sent))
1319
838
def peer_certificate(session):
1375
894
# Convert the buffer to a Python bytestring
1376
895
fpr = ctypes.string_at(buf, buf_len.value)
1377
896
# Convert the bytestring to hexadecimal notation
1378
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
897
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1382
class MultiprocessingMixIn(object):
1383
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1384
def sub_process_main(self, request, address):
1386
self.finish_request(request, address)
1388
self.handle_error(request, address)
1389
self.close_request(request)
1391
def process_request(self, request, address):
1392
"""Start a new process to process the request."""
1393
multiprocessing.Process(target = self.sub_process_main,
1394
args = (request, address)).start()
1396
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1397
""" adds a pipe to the MixIn """
901
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
902
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
1398
903
def process_request(self, request, client_address):
1399
904
"""Overrides and wraps the original process_request().
1401
906
This function creates a new pipe in self.pipe
1403
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1405
super(MultiprocessingMixInWithPipe,
908
self.pipe = os.pipe()
909
super(ForkingMixInWithPipe,
1406
910
self).process_request(request, client_address)
1407
self.child_pipe.close()
1408
self.add_pipe(parent_pipe)
1410
def add_pipe(self, parent_pipe):
911
os.close(self.pipe[1]) # close write end
912
self.add_pipe(self.pipe[0])
913
def add_pipe(self, pipe):
1411
914
"""Dummy function; override as necessary"""
1412
raise NotImplementedError
1414
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
918
class IPv6_TCPServer(ForkingMixInWithPipe,
1415
919
socketserver.TCPServer, object):
1416
920
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1525
1025
for cond, name in
1526
1026
condition_names.iteritems()
1527
1027
if cond & condition)
1528
# error or the other end of multiprocessing.Pipe has closed
1529
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1532
# Read a request from the child
1533
request = parent_pipe.recv()
1534
command = request[0]
1536
if command == 'init':
1538
address = request[2]
1540
for c in self.clients:
1541
if c.fingerprint == fpr:
1545
logger.warning("Client not found for fingerprint: %s, ad"
1546
"dress: %s", fpr, address)
1549
mandos_dbus_service.ClientNotFound(fpr, address[0])
1550
parent_pipe.send(False)
1553
gobject.io_add_watch(parent_pipe.fileno(),
1554
gobject.IO_IN | gobject.IO_HUP,
1555
functools.partial(self.handle_ipc,
1556
parent_pipe = parent_pipe,
1557
client_object = client))
1558
parent_pipe.send(True)
1559
# remove the old hook in favor of the new above hook on same fileno
1561
if command == 'funcall':
1562
funcname = request[1]
1566
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1568
if command == 'getattr':
1569
attrname = request[1]
1570
if callable(client_object.__getattribute__(attrname)):
1571
parent_pipe.send(('function',))
1573
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1575
if command == 'setattr':
1576
attrname = request[1]
1578
setattr(client_object, attrname, value)
1028
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1031
# Turn the pipe file descriptor into a Python file object
1032
if source not in file_objects:
1033
file_objects[source] = os.fdopen(source, u"r", 1)
1035
# Read a line from the file object
1036
cmdline = file_objects[source].readline()
1037
if not cmdline: # Empty line means end of file
1038
# close the IPC pipe
1039
file_objects[source].close()
1040
del file_objects[source]
1042
# Stop calling this function
1045
logger.debug(u"IPC command: %r", cmdline)
1047
# Parse and act on command
1048
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1050
if cmd == u"NOTFOUND":
1051
logger.warning(u"Client not found for fingerprint: %s",
1055
mandos_dbus_service.ClientNotFound(args)
1056
elif cmd == u"INVALID":
1057
for client in self.clients:
1058
if client.name == args:
1059
logger.warning(u"Client %s is invalid", args)
1065
logger.error(u"Unknown client %s is invalid", args)
1066
elif cmd == u"SENDING":
1067
for client in self.clients:
1068
if client.name == args:
1069
logger.info(u"Sending secret to %s", client.name)
1073
client.ReceivedSecret()
1076
logger.error(u"Sending secret to unknown client %s",
1079
logger.error(u"Unknown IPC command: %r", cmdline)
1081
# Keep calling this function
1583
1085
def string_to_delta(interval):
1584
1086
"""Parse a string and return a datetime.timedelta
1586
>>> string_to_delta('7d')
1088
>>> string_to_delta(u'7d')
1587
1089
datetime.timedelta(7)
1588
>>> string_to_delta('60s')
1090
>>> string_to_delta(u'60s')
1589
1091
datetime.timedelta(0, 60)
1590
>>> string_to_delta('60m')
1092
>>> string_to_delta(u'60m')
1591
1093
datetime.timedelta(0, 3600)
1592
>>> string_to_delta('24h')
1094
>>> string_to_delta(u'24h')
1593
1095
datetime.timedelta(1)
1594
>>> string_to_delta('1w')
1096
>>> string_to_delta(u'1w')
1595
1097
datetime.timedelta(7)
1596
>>> string_to_delta('5m 30s')
1098
>>> string_to_delta(u'5m 30s')
1597
1099
datetime.timedelta(0, 330)
1599
1101
timevalue = datetime.timedelta(0)
1673
1174
##################################################################
1674
1175
# Parsing of options, both command line and config file
1676
parser = argparse.ArgumentParser()
1677
parser.add_argument("-v", "--version", action="version",
1678
version = "%%(prog)s %s" % version,
1679
help="show version number and exit")
1680
parser.add_argument("-i", "--interface", metavar="IF",
1681
help="Bind to interface IF")
1682
parser.add_argument("-a", "--address",
1683
help="Address to listen for requests on")
1684
parser.add_argument("-p", "--port", type=int,
1685
help="Port number to receive requests on")
1686
parser.add_argument("--check", action="store_true",
1687
help="Run self-test")
1688
parser.add_argument("--debug", action="store_true",
1689
help="Debug mode; run in foreground and log"
1691
parser.add_argument("--debuglevel", metavar="LEVEL",
1692
help="Debug level for stdout output")
1693
parser.add_argument("--priority", help="GnuTLS"
1694
" priority string (see GnuTLS documentation)")
1695
parser.add_argument("--servicename",
1696
metavar="NAME", help="Zeroconf service name")
1697
parser.add_argument("--configdir",
1698
default="/etc/mandos", metavar="DIR",
1699
help="Directory to search for configuration"
1701
parser.add_argument("--no-dbus", action="store_false",
1702
dest="use_dbus", help="Do not provide D-Bus"
1703
" system bus interface")
1704
parser.add_argument("--no-ipv6", action="store_false",
1705
dest="use_ipv6", help="Do not use IPv6")
1706
options = parser.parse_args()
1177
parser = optparse.OptionParser(version = "%%prog %s" % version)
1178
parser.add_option("-i", u"--interface", type=u"string",
1179
metavar="IF", help=u"Bind to interface IF")
1180
parser.add_option("-a", u"--address", type=u"string",
1181
help=u"Address to listen for requests on")
1182
parser.add_option("-p", u"--port", type=u"int",
1183
help=u"Port number to receive requests on")
1184
parser.add_option("--check", action=u"store_true",
1185
help=u"Run self-test")
1186
parser.add_option("--debug", action=u"store_true",
1187
help=u"Debug mode; run in foreground and log to"
1189
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1190
u" priority string (see GnuTLS documentation)")
1191
parser.add_option("--servicename", type=u"string",
1192
metavar=u"NAME", help=u"Zeroconf service name")
1193
parser.add_option("--configdir", type=u"string",
1194
default=u"/etc/mandos", metavar=u"DIR",
1195
help=u"Directory to search for configuration"
1197
parser.add_option("--no-dbus", action=u"store_false",
1198
dest=u"use_dbus", help=u"Do not provide D-Bus"
1199
u" system bus interface")
1200
parser.add_option("--no-ipv6", action=u"store_false",
1201
dest=u"use_ipv6", help=u"Do not use IPv6")
1202
options = parser.parse_args()[0]
1708
1204
if options.check:
1713
1209
# Default values for config file for server-global settings
1714
server_defaults = { "interface": "",
1719
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1720
"servicename": "Mandos",
1210
server_defaults = { u"interface": u"",
1215
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1216
u"servicename": u"Mandos",
1217
u"use_dbus": u"True",
1218
u"use_ipv6": u"True",
1726
1221
# Parse config file for server-global settings
1727
1222
server_config = configparser.SafeConfigParser(server_defaults)
1728
1223
del server_defaults
1729
1224
server_config.read(os.path.join(options.configdir,
1731
1226
# Convert the SafeConfigParser object to a dict
1732
1227
server_settings = server_config.defaults()
1733
1228
# Use the appropriate methods on the non-string config options
1734
for option in ("debug", "use_dbus", "use_ipv6"):
1735
server_settings[option] = server_config.getboolean("DEFAULT",
1229
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1230
server_settings[option] = server_config.getboolean(u"DEFAULT",
1737
1232
if server_settings["port"]:
1738
server_settings["port"] = server_config.getint("DEFAULT",
1233
server_settings["port"] = server_config.getint(u"DEFAULT",
1740
1235
del server_config
1742
1237
# Override the settings from the config file with command line
1743
1238
# options, if set.
1744
for option in ("interface", "address", "port", "debug",
1745
"priority", "servicename", "configdir",
1746
"use_dbus", "use_ipv6", "debuglevel"):
1239
for option in (u"interface", u"address", u"port", u"debug",
1240
u"priority", u"servicename", u"configdir",
1241
u"use_dbus", u"use_ipv6"):
1747
1242
value = getattr(options, option)
1748
1243
if value is not None:
1749
1244
server_settings[option] = value
1757
1252
##################################################################
1759
1254
# For convenience
1760
debug = server_settings["debug"]
1761
debuglevel = server_settings["debuglevel"]
1762
use_dbus = server_settings["use_dbus"]
1763
use_ipv6 = server_settings["use_ipv6"]
1765
if server_settings["servicename"] != "Mandos":
1255
debug = server_settings[u"debug"]
1256
use_dbus = server_settings[u"use_dbus"]
1257
use_ipv6 = server_settings[u"use_ipv6"]
1260
syslogger.setLevel(logging.WARNING)
1261
console.setLevel(logging.WARNING)
1263
if server_settings[u"servicename"] != u"Mandos":
1766
1264
syslogger.setFormatter(logging.Formatter
1767
('Mandos (%s) [%%(process)d]:'
1768
' %%(levelname)s: %%(message)s'
1769
% server_settings["servicename"]))
1265
(u'Mandos (%s) [%%(process)d]:'
1266
u' %%(levelname)s: %%(message)s'
1267
% server_settings[u"servicename"]))
1771
1269
# Parse config file with clients
1772
client_defaults = { "timeout": "1h",
1774
"checker": "fping -q -- %%(host)s",
1776
"approval_delay": "0s",
1777
"approval_duration": "1s",
1270
client_defaults = { u"timeout": u"1h",
1272
u"checker": u"fping -q -- %%(host)s",
1779
1275
client_config = configparser.SafeConfigParser(client_defaults)
1780
client_config.read(os.path.join(server_settings["configdir"],
1276
client_config.read(os.path.join(server_settings[u"configdir"],
1783
1279
global mandos_dbus_service
1784
1280
mandos_dbus_service = None
1786
tcp_server = MandosServer((server_settings["address"],
1787
server_settings["port"]),
1282
tcp_server = MandosServer((server_settings[u"address"],
1283
server_settings[u"port"]),
1789
interface=(server_settings["interface"]
1285
interface=server_settings[u"interface"],
1791
1286
use_ipv6=use_ipv6,
1792
1287
gnutls_priority=
1793
server_settings["priority"],
1288
server_settings[u"priority"],
1794
1289
use_dbus=use_dbus)
1796
pidfilename = "/var/run/mandos.pid"
1798
pidfile = open(pidfilename, "w")
1800
logger.error("Could not open file %r", pidfilename)
1290
pidfilename = u"/var/run/mandos.pid"
1292
pidfile = open(pidfilename, u"w")
1294
logger.error(u"Could not open file %r", pidfilename)
1803
uid = pwd.getpwnam("_mandos").pw_uid
1804
gid = pwd.getpwnam("_mandos").pw_gid
1297
uid = pwd.getpwnam(u"_mandos").pw_uid
1298
gid = pwd.getpwnam(u"_mandos").pw_gid
1805
1299
except KeyError:
1807
uid = pwd.getpwnam("mandos").pw_uid
1808
gid = pwd.getpwnam("mandos").pw_gid
1301
uid = pwd.getpwnam(u"mandos").pw_uid
1302
gid = pwd.getpwnam(u"mandos").pw_gid
1809
1303
except KeyError:
1811
uid = pwd.getpwnam("nobody").pw_uid
1812
gid = pwd.getpwnam("nobody").pw_gid
1305
uid = pwd.getpwnam(u"nobody").pw_uid
1306
gid = pwd.getpwnam(u"nobody").pw_gid
1813
1307
except KeyError:
1863
1334
bus = dbus.SystemBus()
1864
1335
# End of Avahi example code
1867
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1868
bus, do_not_queue=True)
1869
except dbus.exceptions.NameExistsException, e:
1870
logger.error(unicode(e) + ", disabling D-Bus")
1872
server_settings["use_dbus"] = False
1873
tcp_server.use_dbus = False
1337
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1874
1338
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1875
service = AvahiService(name = server_settings["servicename"],
1876
servicetype = "_mandos._tcp",
1339
service = AvahiService(name = server_settings[u"servicename"],
1340
servicetype = u"_mandos._tcp",
1877
1341
protocol = protocol, bus = bus)
1878
1342
if server_settings["interface"]:
1879
1343
service.interface = (if_nametoindex
1880
(str(server_settings["interface"])))
1882
global multiprocessing_manager
1883
multiprocessing_manager = multiprocessing.Manager()
1344
(str(server_settings[u"interface"])))
1885
1346
client_class = Client
1887
1348
client_class = functools.partial(ClientDBus, bus = bus)
1888
def client_config_items(config, section):
1889
special_settings = {
1890
"approved_by_default":
1891
lambda: config.getboolean(section,
1892
"approved_by_default"),
1894
for name, value in config.items(section):
1896
yield (name, special_settings[name]())
1900
1349
tcp_server.clients.update(set(
1901
1350
client_class(name = section,
1902
config= dict(client_config_items(
1903
client_config, section)))
1351
config= dict(client_config.items(section)))
1904
1352
for section in client_config.sections()))
1905
1353
if not tcp_server.clients:
1906
logger.warning("No clients defined")
1354
logger.warning(u"No clients defined")
1357
# Redirect stdin so all checkers get /dev/null
1358
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1359
os.dup2(null, sys.stdin.fileno())
1363
# No console logging
1364
logger.removeHandler(console)
1365
# Close all input and output, do double fork, etc.
1369
with closing(pidfile):
1371
pidfile.write(str(pid) + "\n")
1374
logger.error(u"Could not write to file %r with PID %d",
1377
# "pidfile" was never created
1382
"Cleanup function; run on exit"
1385
while tcp_server.clients:
1386
client = tcp_server.clients.pop()
1387
client.disable_hook = None
1390
atexit.register(cleanup)
1912
pidfile.write(str(pid) + "\n".encode("utf-8"))
1915
logger.error("Could not write to file %r with PID %d",
1918
# "pidfile" was never created
1922
1393
signal.signal(signal.SIGINT, signal.SIG_IGN)
1924
1394
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1925
1395
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1928
1398
class MandosDBusService(dbus.service.Object):
1929
1399
"""A D-Bus proxy object"""
1930
1400
def __init__(self):
1931
dbus.service.Object.__init__(self, bus, "/")
1932
_interface = "se.bsnet.fukt.Mandos"
1934
@dbus.service.signal(_interface, signature="o")
1935
def ClientAdded(self, objpath):
1939
@dbus.service.signal(_interface, signature="ss")
1940
def ClientNotFound(self, fingerprint, address):
1944
@dbus.service.signal(_interface, signature="os")
1401
dbus.service.Object.__init__(self, bus, u"/")
1402
_interface = u"se.bsnet.fukt.Mandos"
1404
@dbus.service.signal(_interface, signature=u"oa{sv}")
1405
def ClientAdded(self, objpath, properties):
1409
@dbus.service.signal(_interface, signature=u"s")
1410
def ClientNotFound(self, fingerprint):
1414
@dbus.service.signal(_interface, signature=u"os")
1945
1415
def ClientRemoved(self, objpath, name):
1949
@dbus.service.method(_interface, out_signature="ao")
1419
@dbus.service.method(_interface, out_signature=u"ao")
1950
1420
def GetAllClients(self):
1952
1422
return dbus.Array(c.dbus_object_path
1953
1423
for c in tcp_server.clients)
1955
1425
@dbus.service.method(_interface,
1956
out_signature="a{oa{sv}}")
1426
out_signature=u"a{oa{sv}}")
1957
1427
def GetAllClientsWithProperties(self):
1959
1429
return dbus.Dictionary(
1960
((c.dbus_object_path, c.GetAll(""))
1430
((c.dbus_object_path, c.GetAllProperties())
1961
1431
for c in tcp_server.clients),
1432
signature=u"oa{sv}")
1964
@dbus.service.method(_interface, in_signature="o")
1434
@dbus.service.method(_interface, in_signature=u"o")
1965
1435
def RemoveClient(self, object_path):
1967
1437
for c in tcp_server.clients: