240
233
"""A representation of a client host served by this server.
243
_approved: bool(); 'None' if not yet approved/disapproved
244
approval_delay: datetime.timedelta(); Time to wait for approval
245
approval_duration: datetime.timedelta(); Duration of one approval
236
name: string; from the config file, used in log messages and
238
fingerprint: string (40 or 32 hexadecimal digits); used to
239
uniquely identify the client
240
secret: bytestring; sent verbatim (over TLS) to client
241
host: string; available for use by the checker command
242
created: datetime.datetime(); (UTC) object creation
243
last_enabled: datetime.datetime(); (UTC)
245
last_checked_ok: datetime.datetime(); (UTC) or None
246
timeout: datetime.timedelta(); How long from last_checked_ok
247
until this client is disabled
248
interval: datetime.timedelta(); How often to start a new checker
249
disable_hook: If set, called by disable() as disable_hook(self)
246
250
checker: subprocess.Popen(); a running checker process used
247
251
to see if the client lives.
248
252
'None' if no process is running.
249
checker_callback_tag: a gobject event source tag, or None
250
checker_command: string; External command which is run to check
251
if client lives. %() expansions are done at
253
checker_initiator_tag: a gobject event source tag, or None
254
disable_initiator_tag: - '' -
255
checker_callback_tag: - '' -
256
checker_command: string; External command which is run to check if
257
client lives. %() expansions are done at
252
258
runtime with vars(self) as dict, so that for
253
259
instance %(name)s can be used in the command.
254
checker_initiator_tag: a gobject event source tag, or None
255
created: datetime.datetime(); (UTC) object creation
256
260
current_checker_command: string; current running checker_command
257
disable_hook: If set, called by disable() as disable_hook(self)
258
disable_initiator_tag: a gobject event source tag, or None
260
fingerprint: string (40 or 32 hexadecimal digits); used to
261
uniquely identify the client
262
host: string; available for use by the checker command
263
interval: datetime.timedelta(); How often to start a new checker
264
last_approval_request: datetime.datetime(); (UTC) or None
265
last_checked_ok: datetime.datetime(); (UTC) or None
266
last_enabled: datetime.datetime(); (UTC)
267
name: string; from the config file, used in log messages and
269
secret: bytestring; sent verbatim (over TLS) to client
270
timeout: datetime.timedelta(); How long from last_checked_ok
271
until this client is disabled
272
runtime_expansions: Allowed attributes for runtime expansion.
261
approved_delay: datetime.timedelta(); Time to wait for approval
262
_approved: bool(); 'None' if not yet approved/disapproved
263
approved_duration: datetime.timedelta(); Duration of one approval
275
runtime_expansions = (u"approval_delay", u"approval_duration",
276
u"created", u"enabled", u"fingerprint",
277
u"host", u"interval", u"last_checked_ok",
278
u"last_enabled", u"name", u"timeout")
281
267
def _timedelta_to_milliseconds(td):
282
268
"Convert a datetime.timedelta() to milliseconds"
335
321
self.checker_command = config[u"checker"]
336
322
self.current_checker_command = None
337
323
self.last_connect = None
324
self.approvals_pending = 0
338
325
self._approved = None
339
326
self.approved_by_default = config.get(u"approved_by_default",
341
self.approvals_pending = 0
342
self.approval_delay = string_to_delta(
343
config[u"approval_delay"])
344
self.approval_duration = string_to_delta(
345
config[u"approval_duration"])
328
self.approved_delay = string_to_delta(
329
config[u"approved_delay"])
330
self.approved_duration = string_to_delta(
331
config[u"approved_duration"])
346
332
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
348
334
def send_changedstate(self):
349
335
self.changedstate.acquire()
350
336
self.changedstate.notify_all()
716
697
dbus_object_path: dbus.ObjectPath
717
698
bus: dbus.SystemBus()
720
runtime_expansions = (Client.runtime_expansions
721
+ (u"dbus_object_path",))
723
700
# dbus.service.Object doesn't use super(), so we can't either.
725
702
def __init__(self, bus = None, *args, **kwargs):
726
self._approvals_pending = 0
728
704
Client.__init__(self, *args, **kwargs)
729
705
# Only now, when this client is initialized, can it show up on
731
client_object_name = unicode(self.name).translate(
732
{ord(u"."): ord(u"_"),
733
ord(u"-"): ord(u"_")})
734
707
self.dbus_object_path = (dbus.ObjectPath
735
(u"/clients/" + client_object_name))
709
+ self.name.replace(u".", u"_")))
736
710
DBusObjectWithProperties.__init__(self, self.bus,
737
711
self.dbus_object_path)
739
def _get_approvals_pending(self):
740
return self._approvals_pending
741
def _set_approvals_pending(self, value):
742
old_value = self._approvals_pending
743
self._approvals_pending = value
745
if (hasattr(self, "dbus_object_path")
746
and bval is not bool(old_value)):
747
dbus_bool = dbus.Boolean(bval, variant_level=1)
748
self.PropertyChanged(dbus.String(u"ApprovalPending"),
751
approvals_pending = property(_get_approvals_pending,
752
_set_approvals_pending)
753
del _get_approvals_pending, _set_approvals_pending
756
714
def _datetime_to_dbus(dt, variant_level=0):
815
773
r = Client.checked_ok(self, *args, **kwargs)
816
774
# Emit D-Bus signal
817
775
self.PropertyChanged(
818
dbus.String(u"LastCheckedOK"),
776
dbus.String(u"last_checked_ok"),
819
777
(self._datetime_to_dbus(self.last_checked_ok,
820
778
variant_level=1)))
823
def need_approval(self, *args, **kwargs):
824
r = Client.need_approval(self, *args, **kwargs)
826
self.PropertyChanged(
827
dbus.String(u"LastApprovalRequest"),
828
(self._datetime_to_dbus(self.last_approval_request,
832
781
def start_checker(self, *args, **kwargs):
833
782
old_checker = self.checker
834
783
if self.checker is not None:
951
# ApprovalPending - property
898
# approved_pending - property
952
899
@dbus_service_property(_interface, signature=u"b", access=u"read")
953
def ApprovalPending_dbus_property(self):
954
return dbus.Boolean(bool(self.approvals_pending))
900
def approved_pending_dbus_property(self):
901
return dbus.Boolean(self.approved_pending())
956
# ApprovedByDefault - property
903
# approved_by_default - property
957
904
@dbus_service_property(_interface, signature=u"b",
958
905
access=u"readwrite")
959
def ApprovedByDefault_dbus_property(self, value=None):
960
if value is None: # get
961
return dbus.Boolean(self.approved_by_default)
962
self.approved_by_default = bool(value)
964
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
965
dbus.Boolean(value, variant_level=1))
967
# ApprovalDelay - property
968
@dbus_service_property(_interface, signature=u"t",
970
def ApprovalDelay_dbus_property(self, value=None):
971
if value is None: # get
972
return dbus.UInt64(self.approval_delay_milliseconds())
973
self.approval_delay = datetime.timedelta(0, 0, 0, value)
975
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
976
dbus.UInt64(value, variant_level=1))
978
# ApprovalDuration - property
979
@dbus_service_property(_interface, signature=u"t",
981
def ApprovalDuration_dbus_property(self, value=None):
982
if value is None: # get
983
return dbus.UInt64(self._timedelta_to_milliseconds(
984
self.approval_duration))
985
self.approval_duration = datetime.timedelta(0, 0, 0, value)
987
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
988
dbus.UInt64(value, variant_level=1))
906
def approved_by_default_dbus_property(self):
907
return dbus.Boolean(self.approved_by_default)
909
# approved_delay - property
910
@dbus_service_property(_interface, signature=u"t",
912
def approved_delay_dbus_property(self):
913
return dbus.UInt64(self.approved_delay_milliseconds())
915
# approved_duration - property
916
@dbus_service_property(_interface, signature=u"t",
918
def approved_duration_dbus_property(self):
919
return dbus.UInt64(self._timedelta_to_milliseconds(
920
self.approved_duration))
991
923
@dbus_service_property(_interface, signature=u"s", access=u"read")
992
def Name_dbus_property(self):
924
def name_dbus_property(self):
993
925
return dbus.String(self.name)
995
# Fingerprint - property
927
# fingerprint - property
996
928
@dbus_service_property(_interface, signature=u"s", access=u"read")
997
def Fingerprint_dbus_property(self):
929
def fingerprint_dbus_property(self):
998
930
return dbus.String(self.fingerprint)
1001
933
@dbus_service_property(_interface, signature=u"s",
1002
934
access=u"readwrite")
1003
def Host_dbus_property(self, value=None):
935
def host_dbus_property(self, value=None):
1004
936
if value is None: # get
1005
937
return dbus.String(self.host)
1006
938
self.host = value
1007
939
# Emit D-Bus signal
1008
self.PropertyChanged(dbus.String(u"Host"),
940
self.PropertyChanged(dbus.String(u"host"),
1009
941
dbus.String(value, variant_level=1))
1011
# Created - property
1012
944
@dbus_service_property(_interface, signature=u"s", access=u"read")
1013
def Created_dbus_property(self):
945
def created_dbus_property(self):
1014
946
return dbus.String(self._datetime_to_dbus(self.created))
1016
# LastEnabled - property
948
# last_enabled - property
1017
949
@dbus_service_property(_interface, signature=u"s", access=u"read")
1018
def LastEnabled_dbus_property(self):
950
def last_enabled_dbus_property(self):
1019
951
if self.last_enabled is None:
1020
952
return dbus.String(u"")
1021
953
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1023
# Enabled - property
1024
956
@dbus_service_property(_interface, signature=u"b",
1025
957
access=u"readwrite")
1026
def Enabled_dbus_property(self, value=None):
958
def enabled_dbus_property(self, value=None):
1027
959
if value is None: # get
1028
960
return dbus.Boolean(self.enabled)
1043
975
return dbus.String(self._datetime_to_dbus(self
1044
976
.last_checked_ok))
1046
# LastApprovalRequest - property
1047
@dbus_service_property(_interface, signature=u"s", access=u"read")
1048
def LastApprovalRequest_dbus_property(self):
1049
if self.last_approval_request is None:
1050
return dbus.String(u"")
1051
return dbus.String(self.
1052
_datetime_to_dbus(self
1053
.last_approval_request))
1055
# Timeout - property
1056
979
@dbus_service_property(_interface, signature=u"t",
1057
980
access=u"readwrite")
1058
def Timeout_dbus_property(self, value=None):
981
def timeout_dbus_property(self, value=None):
1059
982
if value is None: # get
1060
983
return dbus.UInt64(self.timeout_milliseconds())
1061
984
self.timeout = datetime.timedelta(0, 0, 0, value)
1062
985
# Emit D-Bus signal
1063
self.PropertyChanged(dbus.String(u"Timeout"),
986
self.PropertyChanged(dbus.String(u"timeout"),
1064
987
dbus.UInt64(value, variant_level=1))
1065
988
if getattr(self, u"disable_initiator_tag", None) is None:
1080
1003
self.disable_initiator_tag = (gobject.timeout_add
1081
1004
(time_to_die, self.disable))
1083
# Interval - property
1006
# interval - property
1084
1007
@dbus_service_property(_interface, signature=u"t",
1085
1008
access=u"readwrite")
1086
def Interval_dbus_property(self, value=None):
1009
def interval_dbus_property(self, value=None):
1087
1010
if value is None: # get
1088
1011
return dbus.UInt64(self.interval_milliseconds())
1089
1012
self.interval = datetime.timedelta(0, 0, 0, value)
1090
1013
# Emit D-Bus signal
1091
self.PropertyChanged(dbus.String(u"Interval"),
1014
self.PropertyChanged(dbus.String(u"interval"),
1092
1015
dbus.UInt64(value, variant_level=1))
1093
1016
if getattr(self, u"checker_initiator_tag", None) is None:
1098
1021
(value, self.start_checker))
1099
1022
self.start_checker() # Start one now, too
1101
# Checker - property
1024
# checker - property
1102
1025
@dbus_service_property(_interface, signature=u"s",
1103
1026
access=u"readwrite")
1104
def Checker_dbus_property(self, value=None):
1027
def checker_dbus_property(self, value=None):
1105
1028
if value is None: # get
1106
1029
return dbus.String(self.checker_command)
1107
1030
self.checker_command = value
1108
1031
# Emit D-Bus signal
1109
self.PropertyChanged(dbus.String(u"Checker"),
1032
self.PropertyChanged(dbus.String(u"checker"),
1110
1033
dbus.String(self.checker_command,
1111
1034
variant_level=1))
1113
# CheckerRunning - property
1036
# checker_running - property
1114
1037
@dbus_service_property(_interface, signature=u"b",
1115
1038
access=u"readwrite")
1116
def CheckerRunning_dbus_property(self, value=None):
1039
def checker_running_dbus_property(self, value=None):
1117
1040
if value is None: # get
1118
1041
return dbus.Boolean(self.checker is not None)
1247
1170
client.Rejected("Disabled")
1250
if client._approved or not client.approval_delay:
1173
if client._approved or not client.approved_delay:
1251
1174
#We are approved or approval is disabled
1253
1176
elif client._approved is None:
1254
logger.info(u"Client %s needs approval",
1177
logger.info(u"Client %s need approval",
1256
1179
if self.server.use_dbus:
1257
1180
# Emit D-Bus signal
1258
1181
client.NeedApproval(
1259
client.approval_delay_milliseconds(),
1182
client.approved_delay_milliseconds(),
1260
1183
client.approved_by_default)
1262
1185
logger.warning(u"Client %s was not approved",
1264
1187
if self.server.use_dbus:
1265
1188
# Emit D-Bus signal
1266
client.Rejected("Denied")
1189
client.Rejected("Disapproved")
1269
1192
#wait until timeout or approved
1782
1703
tcp_server = MandosServer((server_settings[u"address"],
1783
1704
server_settings[u"port"]),
1785
interface=(server_settings[u"interface"]
1706
interface=server_settings[u"interface"],
1787
1707
use_ipv6=use_ipv6,
1788
1708
gnutls_priority=
1789
1709
server_settings[u"priority"],
1790
1710
use_dbus=use_dbus)
1792
pidfilename = u"/var/run/mandos.pid"
1794
pidfile = open(pidfilename, u"w")
1796
logger.error(u"Could not open file %r", pidfilename)
1711
pidfilename = u"/var/run/mandos.pid"
1713
pidfile = open(pidfilename, u"w")
1715
logger.error(u"Could not open file %r", pidfilename)
1799
1718
uid = pwd.getpwnam(u"_mandos").pw_uid
1900
1796
for section in client_config.sections()))
1901
1797
if not tcp_server.clients:
1902
1798
logger.warning(u"No clients defined")
1801
# Redirect stdin so all checkers get /dev/null
1802
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1803
os.dup2(null, sys.stdin.fileno())
1807
# No console logging
1808
logger.removeHandler(console)
1809
# Close all input and output, do double fork, etc.
1815
pidfile.write(str(pid) + "\n")
1818
logger.error(u"Could not write to file %r with PID %d",
1821
# "pidfile" was never created
1908
pidfile.write(str(pid) + "\n")
1911
logger.error(u"Could not write to file %r with PID %d",
1914
# "pidfile" was never created
1918
1826
signal.signal(signal.SIGINT, signal.SIG_IGN)
1920
1827
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1921
1828
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())