/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

* mandos: Added ClientDBus.approve_pending property.  Exposed
          approved_by_default, approved_delay, approved_duration as
          D-Bus properties.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
83
83
 
84
84
version = "1.0.14"
85
85
 
86
 
#logger = logging.getLogger(u'mandos')
87
86
logger = logging.Logger(u'mandos')
88
87
syslogger = (logging.handlers.SysLogHandler
89
88
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
99
98
                                       u' %(message)s'))
100
99
logger.addHandler(console)
101
100
 
 
101
multiprocessing_manager = multiprocessing.Manager()
 
102
 
102
103
class AvahiError(Exception):
103
104
    def __init__(self, value, *args, **kwargs):
104
105
        self.value = value
157
158
                            u" after %i retries, exiting.",
158
159
                            self.rename_count)
159
160
            raise AvahiServiceError(u"Too many renames")
160
 
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
 
161
        self.name = self.server.GetAlternativeServiceName(self.name)
161
162
        logger.info(u"Changing Zeroconf service name to %r ...",
162
 
                    self.name)
 
163
                    unicode(self.name))
163
164
        syslogger.setFormatter(logging.Formatter
164
165
                               (u'Mandos (%s) [%%(process)d]:'
165
166
                                u' %%(levelname)s: %%(message)s'
304
305
                      "rb") as secfile:
305
306
                self.secret = secfile.read()
306
307
        else:
 
308
            #XXX Need to allow secret on demand!
307
309
            raise TypeError(u"No secret or secfile for client %s"
308
310
                            % self.name)
309
311
        self.host = config.get(u"host", u"")
321
323
        self.checker_command = config[u"checker"]
322
324
        self.current_checker_command = None
323
325
        self.last_connect = None
 
326
        self.approvals_pending = 0
324
327
        self._approved = None
325
328
        self.approved_by_default = config.get(u"approved_by_default",
326
 
                                              True)
327
 
        self.approvals_pending = 0
 
329
                                              False)
328
330
        self.approved_delay = string_to_delta(
329
331
            config[u"approved_delay"])
330
332
        self.approved_duration = string_to_delta(
331
333
            config[u"approved_duration"])
332
334
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
333
 
    
 
335
 
334
336
    def send_changedstate(self):
335
337
        self.changedstate.acquire()
336
338
        self.changedstate.notify_all()
700
702
    # dbus.service.Object doesn't use super(), so we can't either.
701
703
    
702
704
    def __init__(self, bus = None, *args, **kwargs):
703
 
        self._approvals_pending = 0
704
705
        self.bus = bus
705
706
        Client.__init__(self, *args, **kwargs)
706
707
        # Only now, when this client is initialized, can it show up on
710
711
                                  + self.name.replace(u".", u"_")))
711
712
        DBusObjectWithProperties.__init__(self, self.bus,
712
713
                                          self.dbus_object_path)
713
 
 
714
 
    def _get_approvals_pending(self):
715
 
        return self._approvals_pending
716
 
    def _set_approvals_pending(self, value):
717
 
        old_value = self._approvals_pending
718
 
        self._approvals_pending = value
719
 
        bval = bool(value)
720
 
        if (hasattr(self, "dbus_object_path")
721
 
            and bval is not bool(old_value)):
722
 
            dbus_bool = dbus.Boolean(bval, variant_level=1)
723
 
            self.PropertyChanged(dbus.String(u"approved_pending"),
724
 
                                 dbus_bool)
725
 
 
726
 
    approvals_pending = property(_get_approvals_pending,
727
 
                                 _set_approvals_pending)
728
 
    del _get_approvals_pending, _set_approvals_pending
729
714
    
730
715
    @staticmethod
731
716
    def _datetime_to_dbus(dt, variant_level=0):
826
811
        return False
827
812
    
828
813
    def approve(self, value=True):
829
 
        self.send_changedstate()
830
814
        self._approved = value
831
 
        gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),
832
 
                            self._reset_approved)
833
 
    
 
815
        gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))
 
816
 
 
817
    def approved_pending(self):
 
818
        return self.approvals_pending > 0
 
819
 
834
820
    
835
821
    ## D-Bus methods, signals & properties
836
822
    _interface = u"se.bsnet.fukt.Mandos.Client"
858
844
    # GotSecret - signal
859
845
    @dbus.service.signal(_interface)
860
846
    def GotSecret(self):
861
 
        """D-Bus signal
862
 
        Is sent after a successful transfer of secret from the Mandos
863
 
        server to mandos-client
864
 
        """
 
847
        "D-Bus signal"
865
848
        pass
866
849
    
867
850
    # Rejected - signal
916
899
    # approved_pending - property
917
900
    @dbus_service_property(_interface, signature=u"b", access=u"read")
918
901
    def approved_pending_dbus_property(self):
919
 
        return dbus.Boolean(bool(self.approvals_pending))
 
902
        return dbus.Boolean(self.approved_pending())
920
903
    
921
904
    # approved_by_default - property
922
905
    @dbus_service_property(_interface, signature=u"b",
1230
1213
                
1231
1214
                sent_size = 0
1232
1215
                while sent_size < len(client.secret):
1233
 
                    try:
1234
 
                        sent = session.send(client.secret[sent_size:])
1235
 
                    except (gnutls.errors.GNUTLSError), error:
1236
 
                        logger.warning("gnutls send failed")
1237
 
                        return
 
1216
                    # XXX handle session exception
 
1217
                    sent = session.send(client.secret[sent_size:])
1238
1218
                    logger.debug(u"Sent: %d, remaining: %d",
1239
1219
                                 sent, len(client.secret)
1240
1220
                                 - (sent_size + sent))
1250
1230
            finally:
1251
1231
                if approval_required:
1252
1232
                    client.approvals_pending -= 1
1253
 
                try:
1254
 
                    session.bye()
1255
 
                except (gnutls.errors.GNUTLSError), error:
1256
 
                    logger.warning("gnutls bye failed")
 
1233
                session.bye()
1257
1234
    
1258
1235
    @staticmethod
1259
1236
    def peer_certificate(session):
1344
1321
 
1345
1322
        super(MultiprocessingMixInWithPipe,
1346
1323
              self).process_request(request, client_address)
1347
 
        self.child_pipe.close()
1348
1324
        self.add_pipe(parent_pipe)
1349
 
 
1350
1325
    def add_pipe(self, parent_pipe):
1351
1326
        """Dummy function; override as necessary"""
1352
1327
        pass
1467
1442
                                       if cond & condition)
1468
1443
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1469
1444
                     conditions_string)
1470
 
 
1471
 
        # error or the other end of multiprocessing.Pipe has closed
1472
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1473
 
            return False
1474
1445
        
1475
1446
        # Read a request from the child
1476
1447
        request = parent_pipe.recv()
1477
 
        logger.debug(u"IPC request: %s", repr(request))
1478
1448
        command = request[0]
1479
1449
        
1480
1450
        if command == 'init':
1515
1485
                parent_pipe.send(('function',))
1516
1486
            else:
1517
1487
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1518
 
        
 
1488
 
1519
1489
        if command == 'setattr':
1520
1490
            attrname = request[1]
1521
1491
            value = request[2]
1522
1492
            setattr(client_object, attrname, value)
1523
 
 
 
1493
            
1524
1494
        return True
1525
1495
 
1526
1496
 
1629
1599
    parser.add_option("--debug", action=u"store_true",
1630
1600
                      help=u"Debug mode; run in foreground and log to"
1631
1601
                      u" terminal")
1632
 
    parser.add_option("--debuglevel", type=u"string", metavar="Level",
1633
 
                      help=u"Debug level for stdout output")
1634
1602
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1635
1603
                      u" priority string (see GnuTLS documentation)")
1636
1604
    parser.add_option("--servicename", type=u"string",
1661
1629
                        u"servicename": u"Mandos",
1662
1630
                        u"use_dbus": u"True",
1663
1631
                        u"use_ipv6": u"True",
1664
 
                        u"debuglevel": u"",
1665
1632
                        }
1666
1633
    
1667
1634
    # Parse config file for server-global settings
1684
1651
    # options, if set.
1685
1652
    for option in (u"interface", u"address", u"port", u"debug",
1686
1653
                   u"priority", u"servicename", u"configdir",
1687
 
                   u"use_dbus", u"use_ipv6", u"debuglevel"):
 
1654
                   u"use_dbus", u"use_ipv6"):
1688
1655
        value = getattr(options, option)
1689
1656
        if value is not None:
1690
1657
            server_settings[option] = value
1699
1666
    
1700
1667
    # For convenience
1701
1668
    debug = server_settings[u"debug"]
1702
 
    debuglevel = server_settings[u"debuglevel"]
1703
1669
    use_dbus = server_settings[u"use_dbus"]
1704
1670
    use_ipv6 = server_settings[u"use_ipv6"]
1705
 
 
 
1671
    
 
1672
    if not debug:
 
1673
        syslogger.setLevel(logging.WARNING)
 
1674
        console.setLevel(logging.WARNING)
 
1675
    
1706
1676
    if server_settings[u"servicename"] != u"Mandos":
1707
1677
        syslogger.setFormatter(logging.Formatter
1708
1678
                               (u'Mandos (%s) [%%(process)d]:'
1714
1684
                        u"interval": u"5m",
1715
1685
                        u"checker": u"fping -q -- %%(host)s",
1716
1686
                        u"host": u"",
1717
 
                        u"approved_delay": u"0s",
 
1687
                        u"approved_delay": u"5m",
1718
1688
                        u"approved_duration": u"1s",
1719
1689
                        }
1720
1690
    client_config = configparser.SafeConfigParser(client_defaults)
1760
1730
            raise error
1761
1731
    
1762
1732
    # Enable all possible GnuTLS debugging
1763
 
 
1764
 
 
1765
 
    if not debug and not debuglevel:
1766
 
        syslogger.setLevel(logging.WARNING)
1767
 
        console.setLevel(logging.WARNING)
1768
 
    if debuglevel:
1769
 
        level = getattr(logging, debuglevel.upper())
1770
 
        syslogger.setLevel(level)
1771
 
        console.setLevel(level)
1772
 
 
1773
1733
    if debug:
1774
1734
        # "Use a log level over 10 to enable all debugging options."
1775
1735
        # - GnuTLS manual
1781
1741
        
1782
1742
        (gnutls.library.functions
1783
1743
         .gnutls_global_set_log_function(debug_gnutls))
1784
 
 
1785
 
        # Redirect stdin so all checkers get /dev/null
1786
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1787
 
        os.dup2(null, sys.stdin.fileno())
1788
 
        if null > 2:
1789
 
            os.close(null)
1790
 
    else:
1791
 
        # No console logging
1792
 
        logger.removeHandler(console)
1793
 
 
1794
1744
    
1795
1745
    global main_loop
1796
1746
    # From the Avahi example code
1814
1764
    if server_settings["interface"]:
1815
1765
        service.interface = (if_nametoindex
1816
1766
                             (str(server_settings[u"interface"])))
1817
 
 
1818
 
    if not debug:
1819
 
        # Close all input and output, do double fork, etc.
1820
 
        daemon()
1821
 
        
1822
 
    global multiprocessing_manager
1823
 
    multiprocessing_manager = multiprocessing.Manager()
1824
1767
    
1825
1768
    client_class = Client
1826
1769
    if use_dbus:
1844
1787
            for section in client_config.sections()))
1845
1788
    if not tcp_server.clients:
1846
1789
        logger.warning(u"No clients defined")
1847
 
        
 
1790
    
 
1791
    if debug:
 
1792
        # Redirect stdin so all checkers get /dev/null
 
1793
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1794
        os.dup2(null, sys.stdin.fileno())
 
1795
        if null > 2:
 
1796
            os.close(null)
 
1797
    else:
 
1798
        # No console logging
 
1799
        logger.removeHandler(console)
 
1800
        # Close all input and output, do double fork, etc.
 
1801
        daemon()
 
1802
    
1848
1803
    try:
1849
1804
        with pidfile:
1850
1805
            pid = os.getpid()