To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 24.1.154
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.154
- Committer: Björn Påhlsson
- Date: 2010-09-04 13:31:36 UTC
- mfrom: (24.2.5 mandos-multiprocessing)
- mto: (237.4.3 mandos-release)
- mto: This revision was merged to the branch mainline in revision 421.
- Revision ID: belorn@fukt.bsnet.se-20100904133136-vhn6gxmunefopx3c
merge
new approve/deny functionallity in mandos-monitor
new approve/deny functionallity in mandos-monitor
- files added:
- plugins.d/plymouth
- files removed:
- DBUS-API
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
31
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
36
import SocketServer as socketserver
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
62
61
import functools
63
62
import cPickle as pickle
64
63
import multiprocessing
65
import types
66
64
67
65
import dbus
68
66
import dbus.service
83
81
SO_BINDTODEVICE = None
84
82
85
83
86
version = "1.3.1"
84
version = "1.0.14"
87
85
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
90
88
syslogger = (logging.handlers.SysLogHandler
91
89
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
address = str("/dev/log")))
90
address = "/dev/log"))
93
91
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
96
94
logger.addHandler(syslogger)
97
95
98
96
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
102
100
logger.addHandler(console)
103
101
104
102
class AvahiError(Exception):
121
119
Attributes:
122
120
interface: integer; avahi.IF_UNSPEC or an interface index.
123
121
Used to optionally bind to the specified interface.
124
name: string; Example: 'Mandos'
125
type: string; Example: '_mandos._tcp'.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
126
124
See <http://www.dns-sd.org/ServiceTypes.html>
127
125
port: integer; what port to announce
128
126
TXT: list of strings; TXT record for the service
137
135
"""
138
136
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
139
137
servicetype = None, port = None, TXT = None,
140
domain = "", host = "", max_renames = 32768,
138
domain = u"", host = u"", max_renames = 32768,
141
139
protocol = avahi.PROTO_UNSPEC, bus = None):
142
140
self.interface = interface
143
141
self.name = name
152
150
self.group = None # our entry group
153
151
self.server = None
154
152
self.bus = bus
155
self.entry_group_state_changed_match = None
156
153
def rename(self):
157
154
"""Derived from the Avahi example code"""
158
155
if self.rename_count >= self.max_renames:
159
logger.critical("No suitable Zeroconf service name found"
160
" after %i retries, exiting.",
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
161
158
self.rename_count)
162
raise AvahiServiceError("Too many renames")
163
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
164
logger.info("Changing Zeroconf service name to %r ...",
165
self.name)
159
raise AvahiServiceError(u"Too many renames")
160
self.name = self.server.GetAlternativeServiceName(self.name)
161
logger.info(u"Changing Zeroconf service name to %r ...",
162
unicode(self.name))
166
163
syslogger.setFormatter(logging.Formatter
167
('Mandos (%s) [%%(process)d]:'
168
' %%(levelname)s: %%(message)s'
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
169
166
% self.name))
170
167
self.remove()
171
try:
172
self.add()
173
except dbus.exceptions.DBusException as error:
174
logger.critical("DBusException: %s", error)
175
self.cleanup()
176
os._exit(1)
168
self.add()
177
169
self.rename_count += 1
178
170
def remove(self):
179
171
"""Derived from the Avahi example code"""
180
if self.entry_group_state_changed_match is not None:
181
self.entry_group_state_changed_match.remove()
182
self.entry_group_state_changed_match = None
183
172
if self.group is not None:
184
173
self.group.Reset()
185
174
def add(self):
186
175
"""Derived from the Avahi example code"""
187
self.remove()
188
176
if self.group is None:
189
177
self.group = dbus.Interface(
190
178
self.bus.get_object(avahi.DBUS_NAME,
191
179
self.server.EntryGroupNew()),
192
180
avahi.DBUS_INTERFACE_ENTRY_GROUP)
193
self.entry_group_state_changed_match = (
194
self.group.connect_to_signal(
195
'StateChanged', self .entry_group_state_changed))
196
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
181
self.group.connect_to_signal('StateChanged',
182
self
183
.entry_group_state_changed)
184
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
197
185
self.name, self.type)
198
186
self.group.AddService(
199
187
self.interface,
206
194
self.group.Commit()
207
195
def entry_group_state_changed(self, state, error):
208
196
"""Derived from the Avahi example code"""
209
logger.debug("Avahi entry group state change: %i", state)
197
logger.debug(u"Avahi state change: %i", state)
210
198
211
199
if state == avahi.ENTRY_GROUP_ESTABLISHED:
212
logger.debug("Zeroconf service established.")
200
logger.debug(u"Zeroconf service established.")
213
201
elif state == avahi.ENTRY_GROUP_COLLISION:
214
logger.info("Zeroconf service name collision.")
202
logger.warning(u"Zeroconf service name collision.")
215
203
self.rename()
216
204
elif state == avahi.ENTRY_GROUP_FAILURE:
217
logger.critical("Avahi: Error in group state changed %s",
205
logger.critical(u"Avahi: Error in group state changed %s",
218
206
unicode(error))
219
raise AvahiGroupError("State changed: %s"
207
raise AvahiGroupError(u"State changed: %s"
220
208
% unicode(error))
221
209
def cleanup(self):
222
210
"""Derived from the Avahi example code"""
223
211
if self.group is not None:
224
try:
225
self.group.Free()
226
except (dbus.exceptions.UnknownMethodException,
227
dbus.exceptions.DBusException) as e:
228
pass
212
self.group.Free()
229
213
self.group = None
230
self.remove()
231
def server_state_changed(self, state, error=None):
214
def server_state_changed(self, state):
232
215
"""Derived from the Avahi example code"""
233
logger.debug("Avahi server state change: %i", state)
234
bad_states = { avahi.SERVER_INVALID:
235
"Zeroconf server invalid",
236
avahi.SERVER_REGISTERING: None,
237
avahi.SERVER_COLLISION:
238
"Zeroconf server name collision",
239
avahi.SERVER_FAILURE:
240
"Zeroconf server failure" }
241
if state in bad_states:
242
if bad_states[state] is not None:
243
if error is None:
244
logger.error(bad_states[state])
245
else:
246
logger.error(bad_states[state] + ": %r", error)
247
self.cleanup()
216
if state == avahi.SERVER_COLLISION:
217
logger.error(u"Zeroconf server name collision")
218
self.remove()
248
219
elif state == avahi.SERVER_RUNNING:
249
220
self.add()
250
else:
251
if error is None:
252
logger.debug("Unknown state: %r", state)
253
else:
254
logger.debug("Unknown state: %r: %r", state, error)
255
221
def activate(self):
256
222
"""Derived from the Avahi example code"""
257
223
if self.server is None:
258
224
self.server = dbus.Interface(
259
225
self.bus.get_object(avahi.DBUS_NAME,
260
avahi.DBUS_PATH_SERVER,
261
follow_name_owner_changes=True),
226
avahi.DBUS_PATH_SERVER),
262
227
avahi.DBUS_INTERFACE_SERVER)
263
self.server.connect_to_signal("StateChanged",
228
self.server.connect_to_signal(u"StateChanged",
264
229
self.server_state_changed)
265
230
self.server_state_changed(self.server.GetState())
266
231
267
232
268
def _timedelta_to_milliseconds(td):
269
"Convert a datetime.timedelta() to milliseconds"
270
return ((td.days * 24 * 60 * 60 * 1000)
271
+ (td.seconds * 1000)
272
+ (td.microseconds // 1000))
273
274
233
class Client(object):
275
234
"""A representation of a client host served by this server.
276
235
277
236
Attributes:
278
_approved: bool(); 'None' if not yet approved/disapproved
279
approval_delay: datetime.timedelta(); Time to wait for approval
280
approval_duration: datetime.timedelta(); Duration of one approval
237
name: string; from the config file, used in log messages and
238
D-Bus identifiers
239
fingerprint: string (40 or 32 hexadecimal digits); used to
240
uniquely identify the client
241
secret: bytestring; sent verbatim (over TLS) to client
242
host: string; available for use by the checker command
243
created: datetime.datetime(); (UTC) object creation
244
last_enabled: datetime.datetime(); (UTC)
245
enabled: bool()
246
last_checked_ok: datetime.datetime(); (UTC) or None
247
timeout: datetime.timedelta(); How long from last_checked_ok
248
until this client is disabled
249
interval: datetime.timedelta(); How often to start a new checker
250
disable_hook: If set, called by disable() as disable_hook(self)
281
251
checker: subprocess.Popen(); a running checker process used
282
252
to see if the client lives.
283
253
'None' if no process is running.
284
checker_callback_tag: a gobject event source tag, or None
285
checker_command: string; External command which is run to check
286
if client lives. %() expansions are done at
254
checker_initiator_tag: a gobject event source tag, or None
255
disable_initiator_tag: - '' -
256
checker_callback_tag: - '' -
257
checker_command: string; External command which is run to check if
258
client lives. %() expansions are done at
287
259
runtime with vars(self) as dict, so that for
288
260
instance %(name)s can be used in the command.
289
checker_initiator_tag: a gobject event source tag, or None
290
created: datetime.datetime(); (UTC) object creation
291
261
current_checker_command: string; current running checker_command
292
disable_hook: If set, called by disable() as disable_hook(self)
293
disable_initiator_tag: a gobject event source tag, or None
294
enabled: bool()
295
fingerprint: string (40 or 32 hexadecimal digits); used to
296
uniquely identify the client
297
host: string; available for use by the checker command
298
interval: datetime.timedelta(); How often to start a new checker
299
last_approval_request: datetime.datetime(); (UTC) or None
300
last_checked_ok: datetime.datetime(); (UTC) or None
301
last_enabled: datetime.datetime(); (UTC)
302
name: string; from the config file, used in log messages and
303
D-Bus identifiers
304
secret: bytestring; sent verbatim (over TLS) to client
305
timeout: datetime.timedelta(); How long from last_checked_ok
306
until this client is disabled
307
extended_timeout: extra long timeout when password has been sent
308
runtime_expansions: Allowed attributes for runtime expansion.
309
expires: datetime.datetime(); time (UTC) when a client will be
310
disabled, or None
262
approved_delay: datetime.timedelta(); Time to wait for approval
263
_approved: bool(); 'None' if not yet approved/disapproved
264
approved_duration: datetime.timedelta(); Duration of one approval
311
265
"""
312
266
313
runtime_expansions = ("approval_delay", "approval_duration",
314
"created", "enabled", "fingerprint",
315
"host", "interval", "last_checked_ok",
316
"last_enabled", "name", "timeout")
267
@staticmethod
268
def _timedelta_to_milliseconds(td):
269
"Convert a datetime.timedelta() to milliseconds"
270
return ((td.days * 24 * 60 * 60 * 1000)
271
+ (td.seconds * 1000)
272
+ (td.microseconds // 1000))
317
273
318
274
def timeout_milliseconds(self):
319
275
"Return the 'timeout' attribute in milliseconds"
320
return _timedelta_to_milliseconds(self.timeout)
321
322
def extended_timeout_milliseconds(self):
323
"Return the 'extended_timeout' attribute in milliseconds"
324
return _timedelta_to_milliseconds(self.extended_timeout)
276
return self._timedelta_to_milliseconds(self.timeout)
325
277
326
278
def interval_milliseconds(self):
327
279
"Return the 'interval' attribute in milliseconds"
328
return _timedelta_to_milliseconds(self.interval)
329
330
def approval_delay_milliseconds(self):
331
return _timedelta_to_milliseconds(self.approval_delay)
280
return self._timedelta_to_milliseconds(self.interval)
281
282
def approved_delay_milliseconds(self):
283
return self._timedelta_to_milliseconds(self.approved_delay)
332
284
333
285
def __init__(self, name = None, disable_hook=None, config=None):
334
286
"""Note: the 'checker' key in 'config' sets the
337
289
self.name = name
338
290
if config is None:
339
291
config = {}
340
logger.debug("Creating client %r", self.name)
292
logger.debug(u"Creating client %r", self.name)
341
293
# Uppercase and remove spaces from fingerprint for later
342
294
# comparison purposes with return value from the fingerprint()
343
295
# function
344
self.fingerprint = (config["fingerprint"].upper()
345
.replace(" ", ""))
346
logger.debug(" Fingerprint: %s", self.fingerprint)
347
if "secret" in config:
348
self.secret = config["secret"].decode("base64")
349
elif "secfile" in config:
296
self.fingerprint = (config[u"fingerprint"].upper()
297
.replace(u" ", u""))
298
logger.debug(u" Fingerprint: %s", self.fingerprint)
299
if u"secret" in config:
300
self.secret = config[u"secret"].decode(u"base64")
301
elif u"secfile" in config:
350
302
with open(os.path.expanduser(os.path.expandvars
351
(config["secfile"])),
303
(config[u"secfile"])),
352
304
"rb") as secfile:
353
305
self.secret = secfile.read()
354
306
else:
355
raise TypeError("No secret or secfile for client %s"
307
#XXX Need to allow secret on demand!
308
raise TypeError(u"No secret or secfile for client %s"
356
309
% self.name)
357
self.host = config.get("host", "")
310
self.host = config.get(u"host", u"")
358
311
self.created = datetime.datetime.utcnow()
359
312
self.enabled = False
360
self.last_approval_request = None
361
313
self.last_enabled = None
362
314
self.last_checked_ok = None
363
self.timeout = string_to_delta(config["timeout"])
364
self.extended_timeout = string_to_delta(config["extended_timeout"])
365
self.interval = string_to_delta(config["interval"])
315
self.timeout = string_to_delta(config[u"timeout"])
316
self.interval = string_to_delta(config[u"interval"])
366
317
self.disable_hook = disable_hook
367
318
self.checker = None
368
319
self.checker_initiator_tag = None
369
320
self.disable_initiator_tag = None
370
self.expires = None
371
321
self.checker_callback_tag = None
372
self.checker_command = config["checker"]
322
self.checker_command = config[u"checker"]
373
323
self.current_checker_command = None
374
324
self.last_connect = None
375
325
self._approved = None
376
self.approved_by_default = config.get("approved_by_default",
326
self.approved_by_default = config.get(u"approved_by_default",
377
327
True)
378
328
self.approvals_pending = 0
379
self.approval_delay = string_to_delta(
380
config["approval_delay"])
381
self.approval_duration = string_to_delta(
382
config["approval_duration"])
329
self.approved_delay = string_to_delta(
330
config[u"approved_delay"])
331
self.approved_duration = string_to_delta(
332
config[u"approved_duration"])
383
333
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
384
334
385
335
def send_changedstate(self):
389
339
390
340
def enable(self):
391
341
"""Start this client's checker and timeout hooks"""
392
if getattr(self, "enabled", False):
342
if getattr(self, u"enabled", False):
393
343
# Already enabled
394
344
return
395
345
self.send_changedstate()
346
self.last_enabled = datetime.datetime.utcnow()
396
347
# Schedule a new checker to be started an 'interval' from now,
397
348
# and every interval from then on.
398
349
self.checker_initiator_tag = (gobject.timeout_add
399
350
(self.interval_milliseconds(),
400
351
self.start_checker))
401
352
# Schedule a disable() when 'timeout' has passed
402
self.expires = datetime.datetime.utcnow() + self.timeout
403
353
self.disable_initiator_tag = (gobject.timeout_add
404
354
(self.timeout_milliseconds(),
405
355
self.disable))
406
356
self.enabled = True
407
self.last_enabled = datetime.datetime.utcnow()
408
357
# Also start a new checker *right now*.
409
358
self.start_checker()
410
359
415
364
if not quiet:
416
365
self.send_changedstate()
417
366
if not quiet:
418
logger.info("Disabling client %s", self.name)
419
if getattr(self, "disable_initiator_tag", False):
367
logger.info(u"Disabling client %s", self.name)
368
if getattr(self, u"disable_initiator_tag", False):
420
369
gobject.source_remove(self.disable_initiator_tag)
421
370
self.disable_initiator_tag = None
422
self.expires = None
423
if getattr(self, "checker_initiator_tag", False):
371
if getattr(self, u"checker_initiator_tag", False):
424
372
gobject.source_remove(self.checker_initiator_tag)
425
373
self.checker_initiator_tag = None
426
374
self.stop_checker()
441
389
if os.WIFEXITED(condition):
442
390
exitstatus = os.WEXITSTATUS(condition)
443
391
if exitstatus == 0:
444
logger.info("Checker for %(name)s succeeded",
392
logger.info(u"Checker for %(name)s succeeded",
445
393
vars(self))
446
394
self.checked_ok()
447
395
else:
448
logger.info("Checker for %(name)s failed",
396
logger.info(u"Checker for %(name)s failed",
449
397
vars(self))
450
398
else:
451
logger.warning("Checker for %(name)s crashed?",
399
logger.warning(u"Checker for %(name)s crashed?",
452
400
vars(self))
453
401
454
def checked_ok(self, timeout=None):
402
def checked_ok(self):
455
403
"""Bump up the timeout for this client.
456
404
457
405
This should only be called when the client has been seen,
458
406
alive and well.
459
407
"""
460
if timeout is None:
461
timeout = self.timeout
462
408
self.last_checked_ok = datetime.datetime.utcnow()
463
409
gobject.source_remove(self.disable_initiator_tag)
464
self.expires = datetime.datetime.utcnow() + timeout
465
410
self.disable_initiator_tag = (gobject.timeout_add
466
(_timedelta_to_milliseconds(timeout),
411
(self.timeout_milliseconds(),
467
412
self.disable))
468
413
469
def need_approval(self):
470
self.last_approval_request = datetime.datetime.utcnow()
471
472
414
def start_checker(self):
473
415
"""Start a new checker subprocess if one is not running.
474
416
486
428
# If a checker exists, make sure it is not a zombie
487
429
try:
488
430
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
489
except (AttributeError, OSError) as error:
431
except (AttributeError, OSError), error:
490
432
if (isinstance(error, OSError)
491
433
and error.errno != errno.ECHILD):
492
434
raise error
493
435
else:
494
436
if pid:
495
logger.warning("Checker was a zombie")
437
logger.warning(u"Checker was a zombie")
496
438
gobject.source_remove(self.checker_callback_tag)
497
439
self.checker_callback(pid, status,
498
440
self.current_checker_command)
503
445
command = self.checker_command % self.host
504
446
except TypeError:
505
447
# Escape attributes for the shell
506
escaped_attrs = dict(
507
(attr,
508
re.escape(unicode(str(getattr(self, attr, "")),
509
errors=
510
'replace')))
511
for attr in
512
self.runtime_expansions)
513
448
escaped_attrs = dict((key,
449
re.escape(unicode(str(val),
450
errors=
451
u'replace')))
452
for key, val in
453
vars(self).iteritems())
514
454
try:
515
455
command = self.checker_command % escaped_attrs
516
except TypeError as error:
517
logger.error('Could not format string "%s":'
518
' %s', self.checker_command, error)
456
except TypeError, error:
457
logger.error(u'Could not format string "%s":'
458
u' %s', self.checker_command, error)
519
459
return True # Try again later
520
460
self.current_checker_command = command
521
461
try:
522
logger.info("Starting checker %r for %s",
462
logger.info(u"Starting checker %r for %s",
523
463
command, self.name)
524
464
# We don't need to redirect stdout and stderr, since
525
465
# in normal mode, that is already done by daemon(),
527
467
# always replaced by /dev/null.)
528
468
self.checker = subprocess.Popen(command,
529
469
close_fds=True,
530
shell=True, cwd="/")
470
shell=True, cwd=u"/")
531
471
self.checker_callback_tag = (gobject.child_watch_add
532
472
(self.checker.pid,
533
473
self.checker_callback,
538
478
if pid:
539
479
gobject.source_remove(self.checker_callback_tag)
540
480
self.checker_callback(pid, status, command)
541
except OSError as error:
542
logger.error("Failed to start subprocess: %s",
481
except OSError, error:
482
logger.error(u"Failed to start subprocess: %s",
543
483
error)
544
484
# Re-run this periodically if run by gobject.timeout_add
545
485
return True
549
489
if self.checker_callback_tag:
550
490
gobject.source_remove(self.checker_callback_tag)
551
491
self.checker_callback_tag = None
552
if getattr(self, "checker", None) is None:
492
if getattr(self, u"checker", None) is None:
553
493
return
554
logger.debug("Stopping checker for %(name)s", vars(self))
494
logger.debug(u"Stopping checker for %(name)s", vars(self))
555
495
try:
556
496
os.kill(self.checker.pid, signal.SIGTERM)
557
497
#time.sleep(0.5)
558
498
#if self.checker.poll() is None:
559
499
# os.kill(self.checker.pid, signal.SIGKILL)
560
except OSError as error:
500
except OSError, error:
561
501
if error.errno != errno.ESRCH: # No such process
562
502
raise
563
503
self.checker = None
564
504
565
566
def dbus_service_property(dbus_interface, signature="v",
567
access="readwrite", byte_arrays=False):
505
def dbus_service_property(dbus_interface, signature=u"v",
506
access=u"readwrite", byte_arrays=False):
568
507
"""Decorators for marking methods of a DBusObjectWithProperties to
569
508
become properties on the D-Bus.
570
509
577
516
"""
578
517
# Encoding deeply encoded byte arrays is not supported yet by the
579
518
# "Set" method, so we fail early here:
580
if byte_arrays and signature != "ay":
581
raise ValueError("Byte arrays not supported for non-'ay'"
582
" signature %r" % signature)
519
if byte_arrays and signature != u"ay":
520
raise ValueError(u"Byte arrays not supported for non-'ay'"
521
u" signature %r" % signature)
583
522
def decorator(func):
584
523
func._dbus_is_property = True
585
524
func._dbus_interface = dbus_interface
586
525
func._dbus_signature = signature
587
526
func._dbus_access = access
588
527
func._dbus_name = func.__name__
589
if func._dbus_name.endswith("_dbus_property"):
528
if func._dbus_name.endswith(u"_dbus_property"):
590
529
func._dbus_name = func._dbus_name[:-14]
591
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
530
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
592
531
return func
593
532
return decorator
594
533
614
553
615
554
class DBusObjectWithProperties(dbus.service.Object):
616
555
"""A D-Bus object with properties.
617
556
618
557
Classes inheriting from this can use the dbus_service_property
619
558
decorator to expose methods as D-Bus properties. It exposes the
620
559
standard Get(), Set(), and GetAll() methods on the D-Bus.
622
561
623
562
@staticmethod
624
563
def _is_dbus_property(obj):
625
return getattr(obj, "_dbus_is_property", False)
564
return getattr(obj, u"_dbus_is_property", False)
626
565
627
566
def _get_all_dbus_properties(self):
628
567
"""Returns a generator of (name, attribute) pairs
629
568
"""
630
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
631
for cls in self.__class__.__mro__
632
for name, prop in inspect.getmembers(cls, self._is_dbus_property))
569
return ((prop._dbus_name, prop)
570
for name, prop in
571
inspect.getmembers(self, self._is_dbus_property))
633
572
634
573
def _get_dbus_property(self, interface_name, property_name):
635
574
"""Returns a bound method if one exists which is a D-Bus
636
575
property with the specified name and interface.
637
576
"""
638
for cls in self.__class__.__mro__:
639
for name, value in inspect.getmembers(cls, self._is_dbus_property):
640
if value._dbus_name == property_name and value._dbus_interface == interface_name:
641
return value.__get__(self)
642
577
for name in (property_name,
578
property_name + u"_dbus_property"):
579
prop = getattr(self, name, None)
580
if (prop is None
581
or not self._is_dbus_property(prop)
582
or prop._dbus_name != property_name
583
or (interface_name and prop._dbus_interface
584
and interface_name != prop._dbus_interface)):
585
continue
586
return prop
643
587
# No such property
644
raise DBusPropertyNotFound(self.dbus_object_path + ":"
645
+ interface_name + "."
588
raise DBusPropertyNotFound(self.dbus_object_path + u":"
589
+ interface_name + u"."
646
590
+ property_name)
647
648
591
649
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
650
out_signature="v")
592
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
593
out_signature=u"v")
651
594
def Get(self, interface_name, property_name):
652
595
"""Standard D-Bus property Get() method, see D-Bus standard.
653
596
"""
654
597
prop = self._get_dbus_property(interface_name, property_name)
655
if prop._dbus_access == "write":
598
if prop._dbus_access == u"write":
656
599
raise DBusPropertyAccessException(property_name)
657
600
value = prop()
658
if not hasattr(value, "variant_level"):
601
if not hasattr(value, u"variant_level"):
659
602
return value
660
603
return type(value)(value, variant_level=value.variant_level+1)
661
604
662
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
605
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
663
606
def Set(self, interface_name, property_name, value):
664
607
"""Standard D-Bus property Set() method, see D-Bus standard.
665
608
"""
666
609
prop = self._get_dbus_property(interface_name, property_name)
667
if prop._dbus_access == "read":
610
if prop._dbus_access == u"read":
668
611
raise DBusPropertyAccessException(property_name)
669
if prop._dbus_get_args_options["byte_arrays"]:
612
if prop._dbus_get_args_options[u"byte_arrays"]:
670
613
# The byte_arrays option is not supported yet on
671
614
# signatures other than "ay".
672
if prop._dbus_signature != "ay":
615
if prop._dbus_signature != u"ay":
673
616
raise ValueError
674
617
value = dbus.ByteArray(''.join(unichr(byte)
675
618
for byte in value))
676
619
prop(value)
677
620
678
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
679
out_signature="a{sv}")
621
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
622
out_signature=u"a{sv}")
680
623
def GetAll(self, interface_name):
681
624
"""Standard D-Bus property GetAll() method, see D-Bus
682
625
standard.
683
626
684
627
Note: Will not include properties with access="write".
685
628
"""
686
629
all = {}
690
633
# Interface non-empty but did not match
691
634
continue
692
635
# Ignore write-only properties
693
if prop._dbus_access == "write":
636
if prop._dbus_access == u"write":
694
637
continue
695
638
value = prop()
696
if not hasattr(value, "variant_level"):
639
if not hasattr(value, u"variant_level"):
697
640
all[name] = value
698
641
continue
699
642
all[name] = type(value)(value, variant_level=
700
643
value.variant_level+1)
701
return dbus.Dictionary(all, signature="sv")
644
return dbus.Dictionary(all, signature=u"sv")
702
645
703
646
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
704
out_signature="s",
647
out_signature=u"s",
705
648
path_keyword='object_path',
706
649
connection_keyword='connection')
707
650
def Introspect(self, object_path, connection):
712
655
try:
713
656
document = xml.dom.minidom.parseString(xmlstring)
714
657
def make_tag(document, name, prop):
715
e = document.createElement("property")
716
e.setAttribute("name", name)
717
e.setAttribute("type", prop._dbus_signature)
718
e.setAttribute("access", prop._dbus_access)
658
e = document.createElement(u"property")
659
e.setAttribute(u"name", name)
660
e.setAttribute(u"type", prop._dbus_signature)
661
e.setAttribute(u"access", prop._dbus_access)
719
662
return e
720
for if_tag in document.getElementsByTagName("interface"):
663
for if_tag in document.getElementsByTagName(u"interface"):
721
664
for tag in (make_tag(document, name, prop)
722
665
for name, prop
723
666
in self._get_all_dbus_properties()
724
667
if prop._dbus_interface
725
== if_tag.getAttribute("name")):
668
== if_tag.getAttribute(u"name")):
726
669
if_tag.appendChild(tag)
727
670
# Add the names to the return values for the
728
671
# "org.freedesktop.DBus.Properties" methods
729
if (if_tag.getAttribute("name")
730
== "org.freedesktop.DBus.Properties"):
731
for cn in if_tag.getElementsByTagName("method"):
732
if cn.getAttribute("name") == "Get":
733
for arg in cn.getElementsByTagName("arg"):
734
if (arg.getAttribute("direction")
735
== "out"):
736
arg.setAttribute("name", "value")
737
elif cn.getAttribute("name") == "GetAll":
738
for arg in cn.getElementsByTagName("arg"):
739
if (arg.getAttribute("direction")
740
== "out"):
741
arg.setAttribute("name", "props")
742
xmlstring = document.toxml("utf-8")
672
if (if_tag.getAttribute(u"name")
673
== u"org.freedesktop.DBus.Properties"):
674
for cn in if_tag.getElementsByTagName(u"method"):
675
if cn.getAttribute(u"name") == u"Get":
676
for arg in cn.getElementsByTagName(u"arg"):
677
if (arg.getAttribute(u"direction")
678
== u"out"):
679
arg.setAttribute(u"name", u"value")
680
elif cn.getAttribute(u"name") == u"GetAll":
681
for arg in cn.getElementsByTagName(u"arg"):
682
if (arg.getAttribute(u"direction")
683
== u"out"):
684
arg.setAttribute(u"name", u"props")
685
xmlstring = document.toxml(u"utf-8")
743
686
document.unlink()
744
687
except (AttributeError, xml.dom.DOMException,
745
xml.parsers.expat.ExpatError) as error:
746
logger.error("Failed to override Introspection method",
688
xml.parsers.expat.ExpatError), error:
689
logger.error(u"Failed to override Introspection method",
747
690
error)
748
691
return xmlstring
749
692
750
693
751
def datetime_to_dbus (dt, variant_level=0):
752
"""Convert a UTC datetime.datetime() to a D-Bus type."""
753
if dt is None:
754
return dbus.String("", variant_level = variant_level)
755
return dbus.String(dt.isoformat(),
756
variant_level=variant_level)
757
758
class transitional_dbus_metaclass(DBusObjectWithProperties.__metaclass__):
759
def __new__(mcs, name, bases, attr):
760
for attrname, old_dbusobj in inspect.getmembers(bases[0]):
761
new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")
762
if (getattr(old_dbusobj, "_dbus_is_signal", False)
763
and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):
764
unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,
765
old_dbusobj.__closure__))["func"].cell_contents
766
newfunc = types.FunctionType(unwrappedfunc.func_code,
767
unwrappedfunc.func_globals,
768
unwrappedfunc.func_name,
769
unwrappedfunc.func_defaults,
770
unwrappedfunc.func_closure)
771
new_dbusfunc = dbus.service.signal(
772
new_interface, old_dbusobj._dbus_signature)(newfunc)
773
attr["_transitional_" + attrname] = new_dbusfunc
774
775
def fixscope(func1, func2):
776
def newcall(*args, **kwargs):
777
func1(*args, **kwargs)
778
func2(*args, **kwargs)
779
return newcall
780
781
attr[attrname] = fixscope(old_dbusobj, new_dbusfunc)
782
783
elif (getattr(old_dbusobj, "_dbus_is_method", False)
784
and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):
785
new_dbusfunc = (dbus.service.method
786
(new_interface,
787
old_dbusobj._dbus_in_signature,
788
old_dbusobj._dbus_out_signature)
789
(types.FunctionType
790
(old_dbusobj.func_code,
791
old_dbusobj.func_globals,
792
old_dbusobj.func_name,
793
old_dbusobj.func_defaults,
794
old_dbusobj.func_closure)))
795
796
attr[attrname] = new_dbusfunc
797
elif (getattr(old_dbusobj, "_dbus_is_property", False)
798
and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):
799
new_dbusfunc = (dbus_service_property
800
(new_interface,
801
old_dbusobj._dbus_signature,
802
old_dbusobj._dbus_access,
803
old_dbusobj._dbus_get_args_options["byte_arrays"])
804
(types.FunctionType
805
(old_dbusobj.func_code,
806
old_dbusobj.func_globals,
807
old_dbusobj.func_name,
808
old_dbusobj.func_defaults,
809
old_dbusobj.func_closure)))
810
811
attr[attrname] = new_dbusfunc
812
return type.__new__(mcs, name, bases, attr)
813
814
694
class ClientDBus(Client, DBusObjectWithProperties):
815
695
"""A Client class using D-Bus
816
696
818
698
dbus_object_path: dbus.ObjectPath
819
699
bus: dbus.SystemBus()
820
700
"""
821
822
runtime_expansions = (Client.runtime_expansions
823
+ ("dbus_object_path",))
824
825
701
# dbus.service.Object doesn't use super(), so we can't either.
826
702
827
703
def __init__(self, bus = None, *args, **kwargs):
830
706
Client.__init__(self, *args, **kwargs)
831
707
# Only now, when this client is initialized, can it show up on
832
708
# the D-Bus
833
client_object_name = unicode(self.name).translate(
834
{ord("."): ord("_"),
835
ord("-"): ord("_")})
836
709
self.dbus_object_path = (dbus.ObjectPath
837
("/clients/" + client_object_name))
710
(u"/clients/"
711
+ self.name.replace(u".", u"_")))
838
712
DBusObjectWithProperties.__init__(self, self.bus,
839
713
self.dbus_object_path)
840
841
def notifychangeproperty(transform_func,
842
dbus_name, type_func=lambda x: x,
843
variant_level=1):
844
""" Modify a variable so that its a property that announce its
845
changes to DBus.
846
transform_fun: Function that takes a value and transform it to
847
DBus type.
848
dbus_name: DBus name of the variable
849
type_func: Function that transform the value before sending it
850
to DBus
851
variant_level: DBus variant level. default: 1
852
"""
853
real_value = [None,]
854
def setter(self, value):
855
old_value = real_value[0]
856
real_value[0] = value
857
if hasattr(self, "dbus_object_path"):
858
if type_func(old_value) != type_func(real_value[0]):
859
dbus_value = transform_func(type_func(real_value[0]),
860
variant_level)
861
self.PropertyChanged(dbus.String(dbus_name),
862
dbus_value)
863
864
return property(lambda self: real_value[0], setter)
865
866
867
expires = notifychangeproperty(datetime_to_dbus, "Expires")
868
approvals_pending = notifychangeproperty(dbus.Boolean,
869
"ApprovalPending",
870
type_func = bool)
871
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
872
last_enabled = notifychangeproperty(datetime_to_dbus,
873
"LastEnabled")
874
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
875
type_func = lambda checker: checker is not None)
876
last_checked_ok = notifychangeproperty(datetime_to_dbus,
877
"LastCheckedOK")
878
last_approval_request = notifychangeproperty(datetime_to_dbus,
879
"LastApprovalRequest")
880
approved_by_default = notifychangeproperty(dbus.Boolean,
881
"ApprovedByDefault")
882
approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",
883
type_func = _timedelta_to_milliseconds)
884
approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",
885
type_func = _timedelta_to_milliseconds)
886
host = notifychangeproperty(dbus.String, "Host")
887
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
888
type_func = _timedelta_to_milliseconds)
889
extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",
890
type_func = _timedelta_to_milliseconds)
891
interval = notifychangeproperty(dbus.UInt16, "Interval",
892
type_func = _timedelta_to_milliseconds)
893
checker_command = notifychangeproperty(dbus.String, "Checker")
894
895
del notifychangeproperty
714
715
#Could possible return a bool(self._approvals_pending),
716
#but this could mess up approvals_pending += 1 XXX
717
def _get_approvals_pending(self):
718
return self._approvals_pending
719
def _set_approvals_pending(self, value):
720
old_value = self._approvals_pending
721
self._approvals_pending = value
722
bval = bool(value)
723
if (hasattr(self, "dbus_object_path")
724
and bval is not bool(old_value)):
725
dbus_bool = dbus.Boolean(bval, variant_level=1)
726
self.PropertyChanged(dbus.String(u"approved_pending"),
727
dbus_bool)
728
729
approvals_pending = property(_get_approvals_pending,
730
_set_approvals_pending)
731
del _get_approvals_pending, _set_approvals_pending
732
733
@staticmethod
734
def _datetime_to_dbus(dt, variant_level=0):
735
"""Convert a UTC datetime.datetime() to a D-Bus type."""
736
return dbus.String(dt.isoformat(),
737
variant_level=variant_level)
738
739
def enable(self):
740
oldstate = getattr(self, u"enabled", False)
741
r = Client.enable(self)
742
if oldstate != self.enabled:
743
# Emit D-Bus signals
744
self.PropertyChanged(dbus.String(u"enabled"),
745
dbus.Boolean(True, variant_level=1))
746
self.PropertyChanged(
747
dbus.String(u"last_enabled"),
748
self._datetime_to_dbus(self.last_enabled,
749
variant_level=1))
750
return r
751
752
def disable(self, quiet = False):
753
oldstate = getattr(self, u"enabled", False)
754
r = Client.disable(self, quiet=quiet)
755
if not quiet and oldstate != self.enabled:
756
# Emit D-Bus signal
757
self.PropertyChanged(dbus.String(u"enabled"),
758
dbus.Boolean(False, variant_level=1))
759
return r
896
760
897
761
def __del__(self, *args, **kwargs):
898
762
try:
899
763
self.remove_from_connection()
900
764
except LookupError:
901
765
pass
902
if hasattr(DBusObjectWithProperties, "__del__"):
766
if hasattr(DBusObjectWithProperties, u"__del__"):
903
767
DBusObjectWithProperties.__del__(self, *args, **kwargs)
904
768
Client.__del__(self, *args, **kwargs)
905
769
907
771
*args, **kwargs):
908
772
self.checker_callback_tag = None
909
773
self.checker = None
774
# Emit D-Bus signal
775
self.PropertyChanged(dbus.String(u"checker_running"),
776
dbus.Boolean(False, variant_level=1))
910
777
if os.WIFEXITED(condition):
911
778
exitstatus = os.WEXITSTATUS(condition)
912
779
# Emit D-Bus signal
922
789
return Client.checker_callback(self, pid, condition, command,
923
790
*args, **kwargs)
924
791
792
def checked_ok(self, *args, **kwargs):
793
r = Client.checked_ok(self, *args, **kwargs)
794
# Emit D-Bus signal
795
self.PropertyChanged(
796
dbus.String(u"last_checked_ok"),
797
(self._datetime_to_dbus(self.last_checked_ok,
798
variant_level=1)))
799
return r
800
925
801
def start_checker(self, *args, **kwargs):
926
802
old_checker = self.checker
927
803
if self.checker is not None:
934
810
and old_checker_pid != self.checker.pid):
935
811
# Emit D-Bus signal
936
812
self.CheckerStarted(self.current_checker_command)
813
self.PropertyChanged(
814
dbus.String(u"checker_running"),
815
dbus.Boolean(True, variant_level=1))
937
816
return r
938
817
818
def stop_checker(self, *args, **kwargs):
819
old_checker = getattr(self, u"checker", None)
820
r = Client.stop_checker(self, *args, **kwargs)
821
if (old_checker is not None
822
and getattr(self, u"checker", None) is None):
823
self.PropertyChanged(dbus.String(u"checker_running"),
824
dbus.Boolean(False, variant_level=1))
825
return r
826
939
827
def _reset_approved(self):
940
828
self._approved = None
941
829
return False
943
831
def approve(self, value=True):
944
832
self.send_changedstate()
945
833
self._approved = value
946
gobject.timeout_add(_timedelta_to_milliseconds
947
(self.approval_duration),
834
gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),
948
835
self._reset_approved)
949
836
950
837
951
838
## D-Bus methods, signals & properties
952
_interface = "se.bsnet.fukt.Mandos.Client"
953
839
_interface = u"se.bsnet.fukt.Mandos.Client"
840
954
841
## Signals
955
842
956
843
# CheckerCompleted - signal
957
@dbus.service.signal(_interface, signature="nxs")
844
@dbus.service.signal(_interface, signature=u"nxs")
958
845
def CheckerCompleted(self, exitcode, waitstatus, command):
959
846
"D-Bus signal"
960
847
pass
961
848
962
849
# CheckerStarted - signal
963
@dbus.service.signal(_interface, signature="s")
850
@dbus.service.signal(_interface, signature=u"s")
964
851
def CheckerStarted(self, command):
965
852
"D-Bus signal"
966
853
pass
967
854
968
855
# PropertyChanged - signal
969
@dbus.service.signal(_interface, signature="sv")
856
@dbus.service.signal(_interface, signature=u"sv")
970
857
def PropertyChanged(self, property, value):
971
858
"D-Bus signal"
972
859
pass
973
860
974
861
# GotSecret - signal
862
# XXXTEDDY Is sent after succesfull transfer of secret from mandos-server to mandos-client
975
863
@dbus.service.signal(_interface)
976
864
def GotSecret(self):
977
"""D-Bus signal
978
Is sent after a successful transfer of secret from the Mandos
979
server to mandos-client
980
"""
865
"D-Bus signal"
981
866
pass
982
867
983
868
# Rejected - signal
984
@dbus.service.signal(_interface, signature="s")
869
@dbus.service.signal(_interface, signature=u"s")
985
870
def Rejected(self, reason):
986
871
"D-Bus signal"
987
872
pass
988
873
989
874
# NeedApproval - signal
990
@dbus.service.signal(_interface, signature="tb")
875
@dbus.service.signal(_interface, signature=u"db")
991
876
def NeedApproval(self, timeout, default):
992
877
"D-Bus signal"
993
return self.need_approval()
878
pass
994
879
995
880
## Methods
996
881
997
882
# Approve - method
998
@dbus.service.method(_interface, in_signature="b")
883
@dbus.service.method(_interface, in_signature=u"b")
999
884
def Approve(self, value):
1000
885
self.approve(value)
1001
886
1002
887
# CheckedOK - method
1003
888
@dbus.service.method(_interface)
1004
889
def CheckedOK(self):
1005
self.checked_ok()
890
return self.checked_ok()
1006
891
1007
892
# Enable - method
1008
893
@dbus.service.method(_interface)
1029
914
1030
915
## Properties
1031
916
1032
# ApprovalPending - property
1033
@dbus_service_property(_interface, signature="b", access="read")
1034
def ApprovalPending_dbus_property(self):
917
# approved_pending - property
918
@dbus_service_property(_interface, signature=u"b", access=u"read")
919
def approved_pending_dbus_property(self):
1035
920
return dbus.Boolean(bool(self.approvals_pending))
1036
921
1037
# ApprovedByDefault - property
1038
@dbus_service_property(_interface, signature="b",
1039
access="readwrite")
1040
def ApprovedByDefault_dbus_property(self, value=None):
1041
if value is None: # get
1042
return dbus.Boolean(self.approved_by_default)
1043
self.approved_by_default = bool(value)
1044
1045
# ApprovalDelay - property
1046
@dbus_service_property(_interface, signature="t",
1047
access="readwrite")
1048
def ApprovalDelay_dbus_property(self, value=None):
1049
if value is None: # get
1050
return dbus.UInt64(self.approval_delay_milliseconds())
1051
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1052
1053
# ApprovalDuration - property
1054
@dbus_service_property(_interface, signature="t",
1055
access="readwrite")
1056
def ApprovalDuration_dbus_property(self, value=None):
1057
if value is None: # get
1058
return dbus.UInt64(_timedelta_to_milliseconds(
1059
self.approval_duration))
1060
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1061
1062
# Name - property
1063
@dbus_service_property(_interface, signature="s", access="read")
1064
def Name_dbus_property(self):
922
# approved_by_default - property
923
@dbus_service_property(_interface, signature=u"b",
924
access=u"readwrite")
925
def approved_by_default_dbus_property(self):
926
return dbus.Boolean(self.approved_by_default)
927
928
# approved_delay - property
929
@dbus_service_property(_interface, signature=u"t",
930
access=u"readwrite")
931
def approved_delay_dbus_property(self):
932
return dbus.UInt64(self.approved_delay_milliseconds())
933
934
# approved_duration - property
935
@dbus_service_property(_interface, signature=u"t",
936
access=u"readwrite")
937
def approved_duration_dbus_property(self):
938
return dbus.UInt64(self._timedelta_to_milliseconds(
939
self.approved_duration))
940
941
# name - property
942
@dbus_service_property(_interface, signature=u"s", access=u"read")
943
def name_dbus_property(self):
1065
944
return dbus.String(self.name)
1066
945
1067
# Fingerprint - property
1068
@dbus_service_property(_interface, signature="s", access="read")
1069
def Fingerprint_dbus_property(self):
946
# fingerprint - property
947
@dbus_service_property(_interface, signature=u"s", access=u"read")
948
def fingerprint_dbus_property(self):
1070
949
return dbus.String(self.fingerprint)
1071
950
1072
# Host - property
1073
@dbus_service_property(_interface, signature="s",
1074
access="readwrite")
1075
def Host_dbus_property(self, value=None):
951
# host - property
952
@dbus_service_property(_interface, signature=u"s",
953
access=u"readwrite")
954
def host_dbus_property(self, value=None):
1076
955
if value is None: # get
1077
956
return dbus.String(self.host)
1078
957
self.host = value
1079
1080
# Created - property
1081
@dbus_service_property(_interface, signature="s", access="read")
1082
def Created_dbus_property(self):
1083
return dbus.String(datetime_to_dbus(self.created))
1084
1085
# LastEnabled - property
1086
@dbus_service_property(_interface, signature="s", access="read")
1087
def LastEnabled_dbus_property(self):
1088
return datetime_to_dbus(self.last_enabled)
1089
1090
# Enabled - property
1091
@dbus_service_property(_interface, signature="b",
1092
access="readwrite")
1093
def Enabled_dbus_property(self, value=None):
958
# Emit D-Bus signal
959
self.PropertyChanged(dbus.String(u"host"),
960
dbus.String(value, variant_level=1))
961
962
# created - property
963
@dbus_service_property(_interface, signature=u"s", access=u"read")
964
def created_dbus_property(self):
965
return dbus.String(self._datetime_to_dbus(self.created))
966
967
# last_enabled - property
968
@dbus_service_property(_interface, signature=u"s", access=u"read")
969
def last_enabled_dbus_property(self):
970
if self.last_enabled is None:
971
return dbus.String(u"")
972
return dbus.String(self._datetime_to_dbus(self.last_enabled))
973
974
# enabled - property
975
@dbus_service_property(_interface, signature=u"b",
976
access=u"readwrite")
977
def enabled_dbus_property(self, value=None):
1094
978
if value is None: # get
1095
979
return dbus.Boolean(self.enabled)
1096
980
if value:
1098
982
else:
1099
983
self.disable()
1100
984
1101
# LastCheckedOK - property
1102
@dbus_service_property(_interface, signature="s",
1103
access="readwrite")
1104
def LastCheckedOK_dbus_property(self, value=None):
985
# last_checked_ok - property
986
@dbus_service_property(_interface, signature=u"s",
987
access=u"readwrite")
988
def last_checked_ok_dbus_property(self, value=None):
1105
989
if value is not None:
1106
990
self.checked_ok()
1107
991
return
1108
return datetime_to_dbus(self.last_checked_ok)
1109
1110
# Expires - property
1111
@dbus_service_property(_interface, signature="s", access="read")
1112
def Expires_dbus_property(self):
1113
return datetime_to_dbus(self.expires)
1114
1115
# LastApprovalRequest - property
1116
@dbus_service_property(_interface, signature="s", access="read")
1117
def LastApprovalRequest_dbus_property(self):
1118
return datetime_to_dbus(self.last_approval_request)
1119
1120
# Timeout - property
1121
@dbus_service_property(_interface, signature="t",
1122
access="readwrite")
1123
def Timeout_dbus_property(self, value=None):
992
if self.last_checked_ok is None:
993
return dbus.String(u"")
994
return dbus.String(self._datetime_to_dbus(self
995
.last_checked_ok))
996
997
# timeout - property
998
@dbus_service_property(_interface, signature=u"t",
999
access=u"readwrite")
1000
def timeout_dbus_property(self, value=None):
1124
1001
if value is None: # get
1125
1002
return dbus.UInt64(self.timeout_milliseconds())
1126
1003
self.timeout = datetime.timedelta(0, 0, 0, value)
1127
if getattr(self, "disable_initiator_tag", None) is None:
1004
# Emit D-Bus signal
1005
self.PropertyChanged(dbus.String(u"timeout"),
1006
dbus.UInt64(value, variant_level=1))
1007
if getattr(self, u"disable_initiator_tag", None) is None:
1128
1008
return
1129
1009
# Reschedule timeout
1130
1010
gobject.source_remove(self.disable_initiator_tag)
1131
1011
self.disable_initiator_tag = None
1132
self.expires = None
1133
1012
time_to_die = (self.
1134
1013
_timedelta_to_milliseconds((self
1135
1014
.last_checked_ok
1140
1019
# The timeout has passed
1141
1020
self.disable()
1142
1021
else:
1143
self.expires = (datetime.datetime.utcnow()
1144
+ datetime.timedelta(milliseconds = time_to_die))
1145
1022
self.disable_initiator_tag = (gobject.timeout_add
1146
1023
(time_to_die, self.disable))
1147
1024
1148
# ExtendedTimeout - property
1149
@dbus_service_property(_interface, signature="t",
1150
access="readwrite")
1151
def ExtendedTimeout_dbus_property(self, value=None):
1152
if value is None: # get
1153
return dbus.UInt64(self.extended_timeout_milliseconds())
1154
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1155
1156
# Interval - property
1157
@dbus_service_property(_interface, signature="t",
1158
access="readwrite")
1159
def Interval_dbus_property(self, value=None):
1025
# interval - property
1026
@dbus_service_property(_interface, signature=u"t",
1027
access=u"readwrite")
1028
def interval_dbus_property(self, value=None):
1160
1029
if value is None: # get
1161
1030
return dbus.UInt64(self.interval_milliseconds())
1162
1031
self.interval = datetime.timedelta(0, 0, 0, value)
1163
if getattr(self, "checker_initiator_tag", None) is None:
1032
# Emit D-Bus signal
1033
self.PropertyChanged(dbus.String(u"interval"),
1034
dbus.UInt64(value, variant_level=1))
1035
if getattr(self, u"checker_initiator_tag", None) is None:
1164
1036
return
1165
1037
# Reschedule checker run
1166
1038
gobject.source_remove(self.checker_initiator_tag)
1167
1039
self.checker_initiator_tag = (gobject.timeout_add
1168
1040
(value, self.start_checker))
1169
1041
self.start_checker() # Start one now, too
1170
1171
# Checker - property
1172
@dbus_service_property(_interface, signature="s",
1173
access="readwrite")
1174
def Checker_dbus_property(self, value=None):
1042
1043
# checker - property
1044
@dbus_service_property(_interface, signature=u"s",
1045
access=u"readwrite")
1046
def checker_dbus_property(self, value=None):
1175
1047
if value is None: # get
1176
1048
return dbus.String(self.checker_command)
1177
1049
self.checker_command = value
1050
# Emit D-Bus signal
1051
self.PropertyChanged(dbus.String(u"checker"),
1052
dbus.String(self.checker_command,
1053
variant_level=1))
1178
1054
1179
# CheckerRunning - property
1180
@dbus_service_property(_interface, signature="b",
1181
access="readwrite")
1182
def CheckerRunning_dbus_property(self, value=None):
1055
# checker_running - property
1056
@dbus_service_property(_interface, signature=u"b",
1057
access=u"readwrite")
1058
def checker_running_dbus_property(self, value=None):
1183
1059
if value is None: # get
1184
1060
return dbus.Boolean(self.checker is not None)
1185
1061
if value:
1187
1063
else:
1188
1064
self.stop_checker()
1189
1065
1190
# ObjectPath - property
1191
@dbus_service_property(_interface, signature="o", access="read")
1192
def ObjectPath_dbus_property(self):
1066
# object_path - property
1067
@dbus_service_property(_interface, signature=u"o", access=u"read")
1068
def object_path_dbus_property(self):
1193
1069
return self.dbus_object_path # is already a dbus.ObjectPath
1194
1070
1195
# Secret = property
1196
@dbus_service_property(_interface, signature="ay",
1197
access="write", byte_arrays=True)
1198
def Secret_dbus_property(self, value):
1071
# secret = property
1072
@dbus_service_property(_interface, signature=u"ay",
1073
access=u"write", byte_arrays=True)
1074
def secret_dbus_property(self, value):
1199
1075
self.secret = str(value)
1200
1076
1201
1077
del _interface
1207
1083
self._pipe.send(('init', fpr, address))
1208
1084
if not self._pipe.recv():
1209
1085
raise KeyError()
1210
1086
1211
1087
def __getattribute__(self, name):
1212
1088
if(name == '_pipe'):
1213
1089
return super(ProxyClient, self).__getattribute__(name)
1220
1096
self._pipe.send(('funcall', name, args, kwargs))
1221
1097
return self._pipe.recv()[1]
1222
1098
return func
1223
1099
1224
1100
def __setattr__(self, name, value):
1225
1101
if(name == '_pipe'):
1226
1102
return super(ProxyClient, self).__setattr__(name, value)
1227
1103
self._pipe.send(('setattr', name, value))
1228
1104
1229
class ClientDBusTransitional(ClientDBus):
1230
__metaclass__ = transitional_dbus_metaclass
1231
1105
1232
1106
class ClientHandler(socketserver.BaseRequestHandler, object):
1233
1107
"""A class to handle client connections.
1237
1111
1238
1112
def handle(self):
1239
1113
with contextlib.closing(self.server.child_pipe) as child_pipe:
1240
logger.info("TCP connection from: %s",
1114
logger.info(u"TCP connection from: %s",
1241
1115
unicode(self.client_address))
1242
logger.debug("Pipe FD: %d",
1116
logger.debug(u"Pipe FD: %d",
1243
1117
self.server.child_pipe.fileno())
1244
1118
1245
1119
session = (gnutls.connection
1246
1120
.ClientSession(self.request,
1247
1121
gnutls.connection
1248
1122
.X509Credentials()))
1249
1123
1250
1124
# Note: gnutls.connection.X509Credentials is really a
1251
1125
# generic GnuTLS certificate credentials object so long as
1252
1126
# no X.509 keys are added to it. Therefore, we can use it
1253
1127
# here despite using OpenPGP certificates.
1254
1255
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1256
# "+AES-256-CBC", "+SHA1",
1257
# "+COMP-NULL", "+CTYPE-OPENPGP",
1258
# "+DHE-DSS"))
1128
1129
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1130
# u"+AES-256-CBC", u"+SHA1",
1131
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1132
# u"+DHE-DSS"))
1259
1133
# Use a fallback default, since this MUST be set.
1260
1134
priority = self.server.gnutls_priority
1261
1135
if priority is None:
1262
priority = "NORMAL"
1136
priority = u"NORMAL"
1263
1137
(gnutls.library.functions
1264
1138
.gnutls_priority_set_direct(session._c_object,
1265
1139
priority, None))
1266
1140
1267
1141
# Start communication using the Mandos protocol
1268
1142
# Get protocol number
1269
1143
line = self.request.makefile().readline()
1270
logger.debug("Protocol version: %r", line)
1144
logger.debug(u"Protocol version: %r", line)
1271
1145
try:
1272
1146
if int(line.strip().split()[0]) > 1:
1273
1147
raise RuntimeError
1274
except (ValueError, IndexError, RuntimeError) as error:
1275
logger.error("Unknown protocol version: %s", error)
1148
except (ValueError, IndexError, RuntimeError), error:
1149
logger.error(u"Unknown protocol version: %s", error)
1276
1150
return
1277
1151
1278
1152
# Start GnuTLS connection
1279
1153
try:
1280
1154
session.handshake()
1281
except gnutls.errors.GNUTLSError as error:
1282
logger.warning("Handshake failed: %s", error)
1155
except gnutls.errors.GNUTLSError, error:
1156
logger.warning(u"Handshake failed: %s", error)
1283
1157
# Do not run session.bye() here: the session is not
1284
1158
# established. Just abandon the request.
1285
1159
return
1286
logger.debug("Handshake succeeded")
1287
1160
logger.debug(u"Handshake succeeded")
1161
1288
1162
approval_required = False
1289
1163
try:
1290
1164
try:
1291
1165
fpr = self.fingerprint(self.peer_certificate
1292
1166
(session))
1293
except (TypeError,
1294
gnutls.errors.GNUTLSError) as error:
1295
logger.warning("Bad certificate: %s", error)
1167
except (TypeError, gnutls.errors.GNUTLSError), error:
1168
logger.warning(u"Bad certificate: %s", error)
1296
1169
return
1297
logger.debug("Fingerprint: %s", fpr)
1298
1170
logger.debug(u"Fingerprint: %s", fpr)
1171
1299
1172
try:
1300
1173
client = ProxyClient(child_pipe, fpr,
1301
1174
self.client_address)
1302
1175
except KeyError:
1303
1176
return
1304
1177
1305
if client.approval_delay:
1306
delay = client.approval_delay
1178
if client.approved_delay:
1179
delay = client.approved_delay
1307
1180
client.approvals_pending += 1
1308
1181
approval_required = True
1309
1182
1310
1183
while True:
1311
1184
if not client.enabled:
1312
logger.info("Client %s is disabled",
1185
logger.warning(u"Client %s is disabled",
1313
1186
client.name)
1314
1187
if self.server.use_dbus:
1315
1188
# Emit D-Bus signal
1316
1189
client.Rejected("Disabled")
1317
1190
return
1318
1191
1319
if client._approved or not client.approval_delay:
1192
if client._approved or not client.approved_delay:
1320
1193
#We are approved or approval is disabled
1321
1194
break
1322
1195
elif client._approved is None:
1323
logger.info("Client %s needs approval",
1196
logger.info(u"Client %s need approval",
1324
1197
client.name)
1325
1198
if self.server.use_dbus:
1326
1199
# Emit D-Bus signal
1327
1200
client.NeedApproval(
1328
client.approval_delay_milliseconds(),
1201
client.approved_delay_milliseconds(),
1329
1202
client.approved_by_default)
1330
1203
else:
1331
logger.warning("Client %s was not approved",
1204
logger.warning(u"Client %s was not approved",
1332
1205
client.name)
1333
1206
if self.server.use_dbus:
1334
1207
# Emit D-Bus signal
1335
client.Rejected("Denied")
1208
client.Rejected("Disapproved")
1336
1209
return
1337
1210
1338
1211
#wait until timeout or approved
1349
1222
client.name)
1350
1223
if self.server.use_dbus:
1351
1224
# Emit D-Bus signal
1352
client.Rejected("Approval timed out")
1225
client.Rejected("Time out")
1353
1226
return
1354
1227
else:
1355
1228
break
1358
1231
1359
1232
sent_size = 0
1360
1233
while sent_size < len(client.secret):
1361
try:
1362
sent = session.send(client.secret[sent_size:])
1363
except gnutls.errors.GNUTLSError as error:
1364
logger.warning("gnutls send failed")
1365
return
1366
logger.debug("Sent: %d, remaining: %d",
1234
# XXX handle session exception
1235
sent = session.send(client.secret[sent_size:])
1236
logger.debug(u"Sent: %d, remaining: %d",
1367
1237
sent, len(client.secret)
1368
1238
- (sent_size + sent))
1369
1239
sent_size += sent
1370
1371
logger.info("Sending secret to %s", client.name)
1240
1241
logger.info(u"Sending secret to %s", client.name)
1372
1242
# bump the timeout as if seen
1373
client.checked_ok(client.extended_timeout)
1243
client.checked_ok()
1374
1244
if self.server.use_dbus:
1375
1245
# Emit D-Bus signal
1376
1246
client.GotSecret()
1378
1248
finally:
1379
1249
if approval_required:
1380
1250
client.approvals_pending -= 1
1381
try:
1382
session.bye()
1383
except gnutls.errors.GNUTLSError as error:
1384
logger.warning("GnuTLS bye failed")
1251
session.bye()
1385
1252
1386
1253
@staticmethod
1387
1254
def peer_certificate(session):
1397
1264
.gnutls_certificate_get_peers
1398
1265
(session._c_object, ctypes.byref(list_size)))
1399
1266
if not bool(cert_list) and list_size.value != 0:
1400
raise gnutls.errors.GNUTLSError("error getting peer"
1401
" certificate")
1267
raise gnutls.errors.GNUTLSError(u"error getting peer"
1268
u" certificate")
1402
1269
if list_size.value == 0:
1403
1270
return None
1404
1271
cert = cert_list[0]
1430
1297
if crtverify.value != 0:
1431
1298
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1432
1299
raise (gnutls.errors.CertificateSecurityError
1433
("Verify failed"))
1300
(u"Verify failed"))
1434
1301
# New buffer for the fingerprint
1435
1302
buf = ctypes.create_string_buffer(20)
1436
1303
buf_len = ctypes.c_size_t()
1443
1310
# Convert the buffer to a Python bytestring
1444
1311
fpr = ctypes.string_at(buf, buf_len.value)
1445
1312
# Convert the bytestring to hexadecimal notation
1446
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1313
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1447
1314
return hex_fpr
1448
1315
1449
1316
1461
1328
multiprocessing.Process(target = self.sub_process_main,
1462
1329
args = (request, address)).start()
1463
1330
1464
1465
1331
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1466
1332
""" adds a pipe to the MixIn """
1467
1333
def process_request(self, request, client_address):
1470
1336
This function creates a new pipe in self.pipe
1471
1337
"""
1472
1338
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1473
1339
1474
1340
super(MultiprocessingMixInWithPipe,
1475
1341
self).process_request(request, client_address)
1476
1342
self.child_pipe.close()
1477
1343
self.add_pipe(parent_pipe)
1478
1344
1479
1345
def add_pipe(self, parent_pipe):
1480
1346
"""Dummy function; override as necessary"""
1481
raise NotImplementedError
1482
1347
pass
1483
1348
1484
1349
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1485
1350
socketserver.TCPServer, object):
1503
1368
bind to an address or port if they were not specified."""
1504
1369
if self.interface is not None:
1505
1370
if SO_BINDTODEVICE is None:
1506
logger.error("SO_BINDTODEVICE does not exist;"
1507
" cannot bind to interface %s",
1371
logger.error(u"SO_BINDTODEVICE does not exist;"
1372
u" cannot bind to interface %s",
1508
1373
self.interface)
1509
1374
else:
1510
1375
try:
1511
1376
self.socket.setsockopt(socket.SOL_SOCKET,
1512
1377
SO_BINDTODEVICE,
1513
1378
str(self.interface
1514
+ '\0'))
1515
except socket.error as error:
1379
+ u'\0'))
1380
except socket.error, error:
1516
1381
if error[0] == errno.EPERM:
1517
logger.error("No permission to"
1518
" bind to interface %s",
1382
logger.error(u"No permission to"
1383
u" bind to interface %s",
1519
1384
self.interface)
1520
1385
elif error[0] == errno.ENOPROTOOPT:
1521
logger.error("SO_BINDTODEVICE not available;"
1522
" cannot bind to interface %s",
1386
logger.error(u"SO_BINDTODEVICE not available;"
1387
u" cannot bind to interface %s",
1523
1388
self.interface)
1524
1389
else:
1525
1390
raise
1527
1392
if self.server_address[0] or self.server_address[1]:
1528
1393
if not self.server_address[0]:
1529
1394
if self.address_family == socket.AF_INET6:
1530
any_address = "::" # in6addr_any
1395
any_address = u"::" # in6addr_any
1531
1396
else:
1532
1397
any_address = socket.INADDR_ANY
1533
1398
self.server_address = (any_address,
1582
1447
def handle_ipc(self, source, condition, parent_pipe=None,
1583
1448
client_object=None):
1584
1449
condition_names = {
1585
gobject.IO_IN: "IN", # There is data to read.
1586
gobject.IO_OUT: "OUT", # Data can be written (without
1450
gobject.IO_IN: u"IN", # There is data to read.
1451
gobject.IO_OUT: u"OUT", # Data can be written (without
1587
1452
# blocking).
1588
gobject.IO_PRI: "PRI", # There is urgent data to read.
1589
gobject.IO_ERR: "ERR", # Error condition.
1590
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1453
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1454
gobject.IO_ERR: u"ERR", # Error condition.
1455
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1591
1456
# broken, usually for pipes and
1592
1457
# sockets).
1593
1458
}
1595
1460
for cond, name in
1596
1461
condition_names.iteritems()
1597
1462
if cond & condition)
1598
# error or the other end of multiprocessing.Pipe has closed
1599
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1463
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1464
conditions_string)
1465
1466
# XXXTEDDY error or the other end of multiprocessing.Pipe has closed
1467
if condition & gobject.IO_HUP or condition & gobject.IO_ERR:
1600
1468
return False
1601
1469
1602
1470
# Read a request from the child
1603
1471
request = parent_pipe.recv()
1472
logger.debug(u"IPC request: %s", repr(request))
1604
1473
command = request[0]
1605
1474
1606
1475
if command == 'init':
1612
1481
client = c
1613
1482
break
1614
1483
else:
1615
logger.info("Client not found for fingerprint: %s, ad"
1616
"dress: %s", fpr, address)
1484
logger.warning(u"Client not found for fingerprint: %s, ad"
1485
u"dress: %s", fpr, address)
1617
1486
if self.use_dbus:
1618
1487
# Emit D-Bus signal
1619
mandos_dbus_service.ClientNotFound(fpr, address[0])
1488
mandos_dbus_service.ClientNotFound(fpr, address)
1620
1489
parent_pipe.send(False)
1621
1490
return False
1622
1491
1634
1503
kwargs = request[3]
1635
1504
1636
1505
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1637
1506
1638
1507
if command == 'getattr':
1639
1508
attrname = request[1]
1640
1509
if callable(client_object.__getattribute__(attrname)):
1646
1515
attrname = request[1]
1647
1516
value = request[2]
1648
1517
setattr(client_object, attrname, value)
1649
1518
1650
1519
return True
1651
1520
1652
1521
1653
1522
def string_to_delta(interval):
1654
1523
"""Parse a string and return a datetime.timedelta
1655
1524
1656
>>> string_to_delta('7d')
1525
>>> string_to_delta(u'7d')
1657
1526
datetime.timedelta(7)
1658
>>> string_to_delta('60s')
1527
>>> string_to_delta(u'60s')
1659
1528
datetime.timedelta(0, 60)
1660
>>> string_to_delta('60m')
1529
>>> string_to_delta(u'60m')
1661
1530
datetime.timedelta(0, 3600)
1662
>>> string_to_delta('24h')
1531
>>> string_to_delta(u'24h')
1663
1532
datetime.timedelta(1)
1664
>>> string_to_delta('1w')
1533
>>> string_to_delta(u'1w')
1665
1534
datetime.timedelta(7)
1666
>>> string_to_delta('5m 30s')
1535
>>> string_to_delta(u'5m 30s')
1667
1536
datetime.timedelta(0, 330)
1668
1537
"""
1669
1538
timevalue = datetime.timedelta(0)
1671
1540
try:
1672
1541
suffix = unicode(s[-1])
1673
1542
value = int(s[:-1])
1674
if suffix == "d":
1543
if suffix == u"d":
1675
1544
delta = datetime.timedelta(value)
1676
elif suffix == "s":
1545
elif suffix == u"s":
1677
1546
delta = datetime.timedelta(0, value)
1678
elif suffix == "m":
1547
elif suffix == u"m":
1679
1548
delta = datetime.timedelta(0, 0, 0, 0, value)
1680
elif suffix == "h":
1549
elif suffix == u"h":
1681
1550
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1682
elif suffix == "w":
1551
elif suffix == u"w":
1683
1552
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1684
1553
else:
1685
raise ValueError("Unknown suffix %r" % suffix)
1686
except (ValueError, IndexError) as e:
1687
raise ValueError(*(e.args))
1554
raise ValueError(u"Unknown suffix %r" % suffix)
1555
except (ValueError, IndexError), e:
1556
raise ValueError(e.message)
1688
1557
timevalue += delta
1689
1558
return timevalue
1690
1559
1696
1565
global if_nametoindex
1697
1566
try:
1698
1567
if_nametoindex = (ctypes.cdll.LoadLibrary
1699
(ctypes.util.find_library("c"))
1568
(ctypes.util.find_library(u"c"))
1700
1569
.if_nametoindex)
1701
1570
except (OSError, AttributeError):
1702
logger.warning("Doing if_nametoindex the hard way")
1571
logger.warning(u"Doing if_nametoindex the hard way")
1703
1572
def if_nametoindex(interface):
1704
1573
"Get an interface index the hard way, i.e. using fcntl()"
1705
1574
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1706
1575
with contextlib.closing(socket.socket()) as s:
1707
1576
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1708
struct.pack(str("16s16x"),
1577
struct.pack(str(u"16s16x"),
1709
1578
interface))
1710
interface_index = struct.unpack(str("I"),
1579
interface_index = struct.unpack(str(u"I"),
1711
1580
ifreq[16:20])[0]
1712
1581
return interface_index
1713
1582
return if_nametoindex(interface)
1721
1590
sys.exit()
1722
1591
os.setsid()
1723
1592
if not nochdir:
1724
os.chdir("/")
1593
os.chdir(u"/")
1725
1594
if os.fork():
1726
1595
sys.exit()
1727
1596
if not noclose:
1729
1598
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1730
1599
if not stat.S_ISCHR(os.fstat(null).st_mode):
1731
1600
raise OSError(errno.ENODEV,
1732
"%s not a character device"
1601
u"%s not a character device"
1733
1602
% os.path.devnull)
1734
1603
os.dup2(null, sys.stdin.fileno())
1735
1604
os.dup2(null, sys.stdout.fileno())
1743
1612
##################################################################
1744
1613
# Parsing of options, both command line and config file
1745
1614
1746
parser = argparse.ArgumentParser()
1747
parser.add_argument("-v", "--version", action="version",
1748
version = "%%(prog)s %s" % version,
1749
help="show version number and exit")
1750
parser.add_argument("-i", "--interface", metavar="IF",
1751
help="Bind to interface IF")
1752
parser.add_argument("-a", "--address",
1753
help="Address to listen for requests on")
1754
parser.add_argument("-p", "--port", type=int,
1755
help="Port number to receive requests on")
1756
parser.add_argument("--check", action="store_true",
1757
help="Run self-test")
1758
parser.add_argument("--debug", action="store_true",
1759
help="Debug mode; run in foreground and log"
1760
" to terminal")
1761
parser.add_argument("--debuglevel", metavar="LEVEL",
1762
help="Debug level for stdout output")
1763
parser.add_argument("--priority", help="GnuTLS"
1764
" priority string (see GnuTLS documentation)")
1765
parser.add_argument("--servicename",
1766
metavar="NAME", help="Zeroconf service name")
1767
parser.add_argument("--configdir",
1768
default="/etc/mandos", metavar="DIR",
1769
help="Directory to search for configuration"
1770
" files")
1771
parser.add_argument("--no-dbus", action="store_false",
1772
dest="use_dbus", help="Do not provide D-Bus"
1773
" system bus interface")
1774
parser.add_argument("--no-ipv6", action="store_false",
1775
dest="use_ipv6", help="Do not use IPv6")
1776
options = parser.parse_args()
1615
parser = optparse.OptionParser(version = "%%prog %s" % version)
1616
parser.add_option("-i", u"--interface", type=u"string",
1617
metavar="IF", help=u"Bind to interface IF")
1618
parser.add_option("-a", u"--address", type=u"string",
1619
help=u"Address to listen for requests on")
1620
parser.add_option("-p", u"--port", type=u"int",
1621
help=u"Port number to receive requests on")
1622
parser.add_option("--check", action=u"store_true",
1623
help=u"Run self-test")
1624
parser.add_option("--debug", action=u"store_true",
1625
help=u"Debug mode; run in foreground and log to"
1626
u" terminal")
1627
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1628
u" priority string (see GnuTLS documentation)")
1629
parser.add_option("--servicename", type=u"string",
1630
metavar=u"NAME", help=u"Zeroconf service name")
1631
parser.add_option("--configdir", type=u"string",
1632
default=u"/etc/mandos", metavar=u"DIR",
1633
help=u"Directory to search for configuration"
1634
u" files")
1635
parser.add_option("--no-dbus", action=u"store_false",
1636
dest=u"use_dbus", help=u"Do not provide D-Bus"
1637
u" system bus interface")
1638
parser.add_option("--no-ipv6", action=u"store_false",
1639
dest=u"use_ipv6", help=u"Do not use IPv6")
1640
options = parser.parse_args()[0]
1777
1641
1778
1642
if options.check:
1779
1643
import doctest
1781
1645
sys.exit()
1782
1646
1783
1647
# Default values for config file for server-global settings
1784
server_defaults = { "interface": "",
1785
"address": "",
1786
"port": "",
1787
"debug": "False",
1788
"priority":
1789
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1790
"servicename": "Mandos",
1791
"use_dbus": "True",
1792
"use_ipv6": "True",
1793
"debuglevel": "",
1648
server_defaults = { u"interface": u"",
1649
u"address": u"",
1650
u"port": u"",
1651
u"debug": u"False",
1652
u"priority":
1653
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1654
u"servicename": u"Mandos",
1655
u"use_dbus": u"True",
1656
u"use_ipv6": u"True",
1794
1657
}
1795
1658
1796
1659
# Parse config file for server-global settings
1797
1660
server_config = configparser.SafeConfigParser(server_defaults)
1798
1661
del server_defaults
1799
1662
server_config.read(os.path.join(options.configdir,
1800
"mandos.conf"))
1663
u"mandos.conf"))
1801
1664
# Convert the SafeConfigParser object to a dict
1802
1665
server_settings = server_config.defaults()
1803
1666
# Use the appropriate methods on the non-string config options
1804
for option in ("debug", "use_dbus", "use_ipv6"):
1805
server_settings[option] = server_config.getboolean("DEFAULT",
1667
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1668
server_settings[option] = server_config.getboolean(u"DEFAULT",
1806
1669
option)
1807
1670
if server_settings["port"]:
1808
server_settings["port"] = server_config.getint("DEFAULT",
1809
"port")
1671
server_settings["port"] = server_config.getint(u"DEFAULT",
1672
u"port")
1810
1673
del server_config
1811
1674
1812
1675
# Override the settings from the config file with command line
1813
1676
# options, if set.
1814
for option in ("interface", "address", "port", "debug",
1815
"priority", "servicename", "configdir",
1816
"use_dbus", "use_ipv6", "debuglevel"):
1677
for option in (u"interface", u"address", u"port", u"debug",
1678
u"priority", u"servicename", u"configdir",
1679
u"use_dbus", u"use_ipv6"):
1817
1680
value = getattr(options, option)
1818
1681
if value is not None:
1819
1682
server_settings[option] = value
1827
1690
##################################################################
1828
1691
1829
1692
# For convenience
1830
debug = server_settings["debug"]
1831
debuglevel = server_settings["debuglevel"]
1832
use_dbus = server_settings["use_dbus"]
1833
use_ipv6 = server_settings["use_ipv6"]
1834
1835
if server_settings["servicename"] != "Mandos":
1693
debug = server_settings[u"debug"]
1694
use_dbus = server_settings[u"use_dbus"]
1695
use_ipv6 = server_settings[u"use_ipv6"]
1696
1697
if not debug:
1698
syslogger.setLevel(logging.WARNING)
1699
console.setLevel(logging.WARNING)
1700
1701
if server_settings[u"servicename"] != u"Mandos":
1836
1702
syslogger.setFormatter(logging.Formatter
1837
('Mandos (%s) [%%(process)d]:'
1838
' %%(levelname)s: %%(message)s'
1839
% server_settings["servicename"]))
1703
(u'Mandos (%s) [%%(process)d]:'
1704
u' %%(levelname)s: %%(message)s'
1705
% server_settings[u"servicename"]))
1840
1706
1841
1707
# Parse config file with clients
1842
client_defaults = { "timeout": "5m",
1843
"extended_timeout": "15m",
1844
"interval": "2m",
1845
"checker": "fping -q -- %%(host)s",
1846
"host": "",
1847
"approval_delay": "0s",
1848
"approval_duration": "1s",
1708
client_defaults = { u"timeout": u"1h",
1709
u"interval": u"5m",
1710
u"checker": u"fping -q -- %%(host)s",
1711
u"host": u"",
1712
u"approved_delay": u"0s",
1713
u"approved_duration": u"1s",
1849
1714
}
1850
1715
client_config = configparser.SafeConfigParser(client_defaults)
1851
client_config.read(os.path.join(server_settings["configdir"],
1852
"clients.conf"))
1716
client_config.read(os.path.join(server_settings[u"configdir"],
1717
u"clients.conf"))
1853
1718
1854
1719
global mandos_dbus_service
1855
1720
mandos_dbus_service = None
1856
1721
1857
tcp_server = MandosServer((server_settings["address"],
1858
server_settings["port"]),
1722
tcp_server = MandosServer((server_settings[u"address"],
1723
server_settings[u"port"]),
1859
1724
ClientHandler,
1860
interface=(server_settings["interface"]
1861
or None),
1725
interface=server_settings[u"interface"],
1862
1726
use_ipv6=use_ipv6,
1863
1727
gnutls_priority=
1864
server_settings["priority"],
1728
server_settings[u"priority"],
1865
1729
use_dbus=use_dbus)
1866
if not debug:
1867
pidfilename = "/var/run/mandos.pid"
1868
try:
1869
pidfile = open(pidfilename, "w")
1870
except IOError:
1871
logger.error("Could not open file %r", pidfilename)
1730
pidfilename = u"/var/run/mandos.pid"
1731
try:
1732
pidfile = open(pidfilename, u"w")
1733
except IOError:
1734
logger.error(u"Could not open file %r", pidfilename)
1872
1735
1873
1736
try:
1874
uid = pwd.getpwnam("_mandos").pw_uid
1875
gid = pwd.getpwnam("_mandos").pw_gid
1737
uid = pwd.getpwnam(u"_mandos").pw_uid
1738
gid = pwd.getpwnam(u"_mandos").pw_gid
1876
1739
except KeyError:
1877
1740
try:
1878
uid = pwd.getpwnam("mandos").pw_uid
1879
gid = pwd.getpwnam("mandos").pw_gid
1741
uid = pwd.getpwnam(u"mandos").pw_uid
1742
gid = pwd.getpwnam(u"mandos").pw_gid
1880
1743
except KeyError:
1881
1744
try:
1882
uid = pwd.getpwnam("nobody").pw_uid
1883
gid = pwd.getpwnam("nobody").pw_gid
1745
uid = pwd.getpwnam(u"nobody").pw_uid
1746
gid = pwd.getpwnam(u"nobody").pw_gid
1884
1747
except KeyError:
1885
1748
uid = 65534
1886
1749
gid = 65534
1887
1750
try:
1888
1751
os.setgid(gid)
1889
1752
os.setuid(uid)
1890
except OSError as error:
1753
except OSError, error:
1891
1754
if error[0] != errno.EPERM:
1892
1755
raise error
1893
1756
1894
if not debug and not debuglevel:
1895
syslogger.setLevel(logging.WARNING)
1896
console.setLevel(logging.WARNING)
1897
if debuglevel:
1898
level = getattr(logging, debuglevel.upper())
1899
syslogger.setLevel(level)
1900
console.setLevel(level)
1901
1757
# Enable all possible GnuTLS debugging
1902
1758
if debug:
1903
# Enable all possible GnuTLS debugging
1904
1905
1759
# "Use a log level over 10 to enable all debugging options."
1906
1760
# - GnuTLS manual
1907
1761
gnutls.library.functions.gnutls_global_set_log_level(11)
1908
1762
1909
1763
@gnutls.library.types.gnutls_log_func
1910
1764
def debug_gnutls(level, string):
1911
logger.debug("GnuTLS: %s", string[:-1])
1765
logger.debug(u"GnuTLS: %s", string[:-1])
1912
1766
1913
1767
(gnutls.library.functions
1914
1768
.gnutls_global_set_log_function(debug_gnutls))
1915
1916
# Redirect stdin so all checkers get /dev/null
1917
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1918
os.dup2(null, sys.stdin.fileno())
1919
if null > 2:
1920
os.close(null)
1921
else:
1922
# No console logging
1923
logger.removeHandler(console)
1924
1925
# Need to fork before connecting to D-Bus
1926
if not debug:
1927
# Close all input and output, do double fork, etc.
1928
daemon()
1929
1769
1930
1770
global main_loop
1931
1771
# From the Avahi example code
1935
1775
# End of Avahi example code
1936
1776
if use_dbus:
1937
1777
try:
1938
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1939
bus, do_not_queue=True)
1940
bus_name2 = dbus.service.BusName("se.recompile.Mandos",
1941
bus, do_not_queue=True)
1942
except dbus.exceptions.NameExistsException as e:
1943
logger.error(unicode(e) + ", disabling D-Bus")
1778
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1779
bus, do_not_queue=True)
1780
except dbus.exceptions.NameExistsException, e:
1781
logger.error(unicode(e) + u", disabling D-Bus")
1944
1782
use_dbus = False
1945
server_settings["use_dbus"] = False
1783
server_settings[u"use_dbus"] = False
1946
1784
tcp_server.use_dbus = False
1947
1785
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1948
service = AvahiService(name = server_settings["servicename"],
1949
servicetype = "_mandos._tcp",
1786
service = AvahiService(name = server_settings[u"servicename"],
1787
servicetype = u"_mandos._tcp",
1950
1788
protocol = protocol, bus = bus)
1951
1789
if server_settings["interface"]:
1952
1790
service.interface = (if_nametoindex
1953
(str(server_settings["interface"])))
1954
1791
(str(server_settings[u"interface"])))
1792
1955
1793
global multiprocessing_manager
1956
1794
multiprocessing_manager = multiprocessing.Manager()
1957
1795
1958
1796
client_class = Client
1959
1797
if use_dbus:
1960
client_class = functools.partial(ClientDBusTransitional, bus = bus)
1798
client_class = functools.partial(ClientDBus, bus = bus)
1961
1799
def client_config_items(config, section):
1962
1800
special_settings = {
1963
1801
"approved_by_default":
1976
1814
client_config, section)))
1977
1815
for section in client_config.sections()))
1978
1816
if not tcp_server.clients:
1979
logger.warning("No clients defined")
1980
1817
logger.warning(u"No clients defined")
1818
1819
if debug:
1820
# Redirect stdin so all checkers get /dev/null
1821
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1822
os.dup2(null, sys.stdin.fileno())
1823
if null > 2:
1824
os.close(null)
1825
else:
1826
# No console logging
1827
logger.removeHandler(console)
1828
# Close all input and output, do double fork, etc.
1829
daemon()
1830
1831
try:
1832
with pidfile:
1833
pid = os.getpid()
1834
pidfile.write(str(pid) + "\n")
1835
del pidfile
1836
except IOError:
1837
logger.error(u"Could not write to file %r with PID %d",
1838
pidfilename, pid)
1839
except NameError:
1840
# "pidfile" was never created
1841
pass
1842
del pidfilename
1843
1981
1844
if not debug:
1982
try:
1983
with pidfile:
1984
pid = os.getpid()
1985
pidfile.write(str(pid) + "\n".encode("utf-8"))
1986
del pidfile
1987
except IOError:
1988
logger.error("Could not write to file %r with PID %d",
1989
pidfilename, pid)
1990
except NameError:
1991
# "pidfile" was never created
1992
pass
1993
del pidfilename
1994
1995
1845
signal.signal(signal.SIGINT, signal.SIG_IGN)
1996
1997
1846
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1998
1847
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1999
1848
2001
1850
class MandosDBusService(dbus.service.Object):
2002
1851
"""A D-Bus proxy object"""
2003
1852
def __init__(self):
2004
dbus.service.Object.__init__(self, bus, "/")
2005
_interface = "se.bsnet.fukt.Mandos"
1853
dbus.service.Object.__init__(self, bus, u"/")
1854
_interface = u"se.bsnet.fukt.Mandos"
2006
1855
2007
@dbus.service.signal(_interface, signature="o")
1856
@dbus.service.signal(_interface, signature=u"o")
2008
1857
def ClientAdded(self, objpath):
2009
1858
"D-Bus signal"
2010
1859
pass
2011
1860
2012
@dbus.service.signal(_interface, signature="ss")
1861
@dbus.service.signal(_interface, signature=u"ss")
2013
1862
def ClientNotFound(self, fingerprint, address):
2014
1863
"D-Bus signal"
2015
1864
pass
2016
1865
2017
@dbus.service.signal(_interface, signature="os")
1866
@dbus.service.signal(_interface, signature=u"os")
2018
1867
def ClientRemoved(self, objpath, name):
2019
1868
"D-Bus signal"
2020
1869
pass
2021
1870
2022
@dbus.service.method(_interface, out_signature="ao")
1871
@dbus.service.method(_interface, out_signature=u"ao")
2023
1872
def GetAllClients(self):
2024
1873
"D-Bus method"
2025
1874
return dbus.Array(c.dbus_object_path
2026
1875
for c in tcp_server.clients)
2027
1876
2028
1877
@dbus.service.method(_interface,
2029
out_signature="a{oa{sv}}")
1878
out_signature=u"a{oa{sv}}")
2030
1879
def GetAllClientsWithProperties(self):
2031
1880
"D-Bus method"
2032
1881
return dbus.Dictionary(
2033
((c.dbus_object_path, c.GetAll(""))
1882
((c.dbus_object_path, c.GetAll(u""))
2034
1883
for c in tcp_server.clients),
2035
signature="oa{sv}")
1884
signature=u"oa{sv}")
2036
1885
2037
@dbus.service.method(_interface, in_signature="o")
1886
@dbus.service.method(_interface, in_signature=u"o")
2038
1887
def RemoveClient(self, object_path):
2039
1888
"D-Bus method"
2040
1889
for c in tcp_server.clients:
2050
1899
2051
1900
del _interface
2052
1901
2053
class MandosDBusServiceTransitional(MandosDBusService):
2054
__metaclass__ = transitional_dbus_metaclass
2055
mandos_dbus_service = MandosDBusServiceTransitional()
1902
mandos_dbus_service = MandosDBusService()
2056
1903
2057
1904
def cleanup():
2058
1905
"Cleanup function; run on exit"
2084
1931
# Find out what port we got
2085
1932
service.port = tcp_server.socket.getsockname()[1]
2086
1933
if use_ipv6:
2087
logger.info("Now listening on address %r, port %d,"
1934
logger.info(u"Now listening on address %r, port %d,"
2088
1935
" flowinfo %d, scope_id %d"
2089
1936
% tcp_server.socket.getsockname())
2090
1937
else: # IPv4
2091
logger.info("Now listening on address %r, port %d"
1938
logger.info(u"Now listening on address %r, port %d"
2092
1939
% tcp_server.socket.getsockname())
2093
1940
2094
1941
#service.interface = tcp_server.socket.getsockname()[3]
2097
1944
# From the Avahi example code
2098
1945
try:
2099
1946
service.activate()
2100
except dbus.exceptions.DBusException as error:
2101
logger.critical("DBusException: %s", error)
1947
except dbus.exceptions.DBusException, error:
1948
logger.critical(u"DBusException: %s", error)
2102
1949
cleanup()
2103
1950
sys.exit(1)
2104
1951
# End of Avahi example code
2108
1955
(tcp_server.handle_request
2109
1956
(*args[2:], **kwargs) or True))
2110
1957
2111
logger.debug("Starting main loop")
1958
logger.debug(u"Starting main loop")
2112
1959
main_loop.run()
2113
except AvahiError as error:
2114
logger.critical("AvahiError: %s", error)
1960
except AvahiError, error:
1961
logger.critical(u"AvahiError: %s", error)
2115
1962
cleanup()
2116
1963
sys.exit(1)
2117
1964
except KeyboardInterrupt:
2118
1965
if debug:
2119
print("", file=sys.stderr)
2120
logger.debug("Server received KeyboardInterrupt")
2121
logger.debug("Server exiting")
1966
print >> sys.stderr
1967
logger.debug(u"Server received KeyboardInterrupt")
1968
logger.debug(u"Server exiting")
2122
1969
# Must run before the D-Bus bus name gets deregistered
2123
1970
cleanup()
2124
1971
2125
2126
1972
if __name__ == '__main__':
2127
1973
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0