/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: teddy at bsnet
  • Date: 2010-08-23 19:23:15 UTC
  • mto: (24.1.154 mandos)
  • mto: This revision was merged to the branch mainline in revision 421.
  • Revision ID: teddy@fukt.bsnet.se-20100823192315-pefgye0l6cavcejs
* debian/control (mandos/Depends): Added "python-urwid".
* mandos (Client.approved_by_default): Changed default to "True".
  (Client.approved_delay): Changed default to "0s".
  (ClientDBus.GotSecret, ClientDBus.Rejected,
  ClientDBus.NeedApproval): Emit "PropertyChanged" signal for the
                            "approved_pending" property.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
83
83
 
84
84
version = "1.0.14"
85
85
 
86
 
#logger = logging.getLogger(u'mandos')
87
86
logger = logging.Logger(u'mandos')
88
87
syslogger = (logging.handlers.SysLogHandler
89
88
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
99
98
                                       u' %(message)s'))
100
99
logger.addHandler(console)
101
100
 
 
101
multiprocessing_manager = multiprocessing.Manager()
 
102
 
102
103
class AvahiError(Exception):
103
104
    def __init__(self, value, *args, **kwargs):
104
105
        self.value = value
157
158
                            u" after %i retries, exiting.",
158
159
                            self.rename_count)
159
160
            raise AvahiServiceError(u"Too many renames")
160
 
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
 
161
        self.name = self.server.GetAlternativeServiceName(self.name)
161
162
        logger.info(u"Changing Zeroconf service name to %r ...",
162
 
                    self.name)
 
163
                    unicode(self.name))
163
164
        syslogger.setFormatter(logging.Formatter
164
165
                               (u'Mandos (%s) [%%(process)d]:'
165
166
                                u' %%(levelname)s: %%(message)s'
304
305
                      "rb") as secfile:
305
306
                self.secret = secfile.read()
306
307
        else:
 
308
            #XXX Need to allow secret on demand!
307
309
            raise TypeError(u"No secret or secfile for client %s"
308
310
                            % self.name)
309
311
        self.host = config.get(u"host", u"")
321
323
        self.checker_command = config[u"checker"]
322
324
        self.current_checker_command = None
323
325
        self.last_connect = None
 
326
        self.approvals_pending = 0
324
327
        self._approved = None
325
328
        self.approved_by_default = config.get(u"approved_by_default",
326
329
                                              True)
327
 
        self.approvals_pending = 0
328
330
        self.approved_delay = string_to_delta(
329
331
            config[u"approved_delay"])
330
332
        self.approved_duration = string_to_delta(
331
333
            config[u"approved_duration"])
332
334
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
333
 
    
 
335
 
334
336
    def send_changedstate(self):
335
337
        self.changedstate.acquire()
336
338
        self.changedstate.notify_all()
700
702
    # dbus.service.Object doesn't use super(), so we can't either.
701
703
    
702
704
    def __init__(self, bus = None, *args, **kwargs):
703
 
        self._approvals_pending = 0
704
705
        self.bus = bus
705
706
        Client.__init__(self, *args, **kwargs)
706
707
        # Only now, when this client is initialized, can it show up on
710
711
                                  + self.name.replace(u".", u"_")))
711
712
        DBusObjectWithProperties.__init__(self, self.bus,
712
713
                                          self.dbus_object_path)
713
 
 
714
 
    def _get_approvals_pending(self):
715
 
        return self._approvals_pending
716
 
    def _set_approvals_pending(self, value):
717
 
        old_value = self._approvals_pending
718
 
        self._approvals_pending = value
719
 
        bval = bool(value)
720
 
        if (hasattr(self, "dbus_object_path")
721
 
            and bval is not bool(old_value)):
722
 
            dbus_bool = dbus.Boolean(bval, variant_level=1)
723
 
            self.PropertyChanged(dbus.String(u"approved_pending"),
724
 
                                 dbus_bool)
725
 
 
726
 
    approvals_pending = property(_get_approvals_pending,
727
 
                                 _set_approvals_pending)
728
 
    del _get_approvals_pending, _set_approvals_pending
729
714
    
730
715
    @staticmethod
731
716
    def _datetime_to_dbus(dt, variant_level=0):
826
811
        return False
827
812
    
828
813
    def approve(self, value=True):
829
 
        self.send_changedstate()
830
814
        self._approved = value
831
 
        gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),
832
 
                            self._reset_approved)
 
815
        gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))
 
816
 
 
817
    def approved_pending(self):
 
818
        return self.approvals_pending > 0
833
819
    
834
820
    
835
821
    ## D-Bus methods, signals & properties
858
844
    # GotSecret - signal
859
845
    @dbus.service.signal(_interface)
860
846
    def GotSecret(self):
861
 
        """D-Bus signal
862
 
        Is sent after a successful transfer of secret from the Mandos
863
 
        server to mandos-client
864
 
        """
865
 
        pass
 
847
        "D-Bus signal"
 
848
        if self.approved_pending():
 
849
            self.PropertyChanged(dbus.String(u"checker_running"),
 
850
                                 dbus.Boolean(False, variant_level=1))
866
851
    
867
852
    # Rejected - signal
868
853
    @dbus.service.signal(_interface, signature=u"s")
869
854
    def Rejected(self, reason):
870
855
        "D-Bus signal"
871
 
        pass
 
856
        if self.approved_pending():
 
857
            self.PropertyChanged(dbus.String(u"checker_running"),
 
858
                                 dbus.Boolean(False, variant_level=1))
872
859
    
873
860
    # NeedApproval - signal
874
861
    @dbus.service.signal(_interface, signature=u"db")
875
862
    def NeedApproval(self, timeout, default):
876
863
        "D-Bus signal"
877
 
        pass
 
864
        if not self.approved_pending():
 
865
            self.PropertyChanged(dbus.String(u"approved_pending"),
 
866
                                 dbus.Boolean(True, variant_level=1))
878
867
    
879
868
    ## Methods
880
869
 
916
905
    # approved_pending - property
917
906
    @dbus_service_property(_interface, signature=u"b", access=u"read")
918
907
    def approved_pending_dbus_property(self):
919
 
        return dbus.Boolean(bool(self.approvals_pending))
 
908
        return dbus.Boolean(self.approved_pending())
920
909
    
921
910
    # approved_by_default - property
922
911
    @dbus_service_property(_interface, signature=u"b",
1230
1219
                
1231
1220
                sent_size = 0
1232
1221
                while sent_size < len(client.secret):
1233
 
                    try:
1234
 
                        sent = session.send(client.secret[sent_size:])
1235
 
                    except (gnutls.errors.GNUTLSError), error:
1236
 
                        logger.warning("gnutls send failed")
1237
 
                        return
 
1222
                    # XXX handle session exception
 
1223
                    sent = session.send(client.secret[sent_size:])
1238
1224
                    logger.debug(u"Sent: %d, remaining: %d",
1239
1225
                                 sent, len(client.secret)
1240
1226
                                 - (sent_size + sent))
1250
1236
            finally:
1251
1237
                if approval_required:
1252
1238
                    client.approvals_pending -= 1
1253
 
                try:
1254
 
                    session.bye()
1255
 
                except (gnutls.errors.GNUTLSError), error:
1256
 
                    logger.warning("gnutls bye failed")
 
1239
                session.bye()
1257
1240
    
1258
1241
    @staticmethod
1259
1242
    def peer_certificate(session):
1344
1327
 
1345
1328
        super(MultiprocessingMixInWithPipe,
1346
1329
              self).process_request(request, client_address)
1347
 
        self.child_pipe.close()
1348
1330
        self.add_pipe(parent_pipe)
1349
 
 
1350
1331
    def add_pipe(self, parent_pipe):
1351
1332
        """Dummy function; override as necessary"""
1352
1333
        pass
1467
1448
                                       if cond & condition)
1468
1449
        logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1469
1450
                     conditions_string)
1470
 
 
1471
 
        # error or the other end of multiprocessing.Pipe has closed
1472
 
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1473
 
            return False
1474
1451
        
1475
1452
        # Read a request from the child
1476
1453
        request = parent_pipe.recv()
1477
 
        logger.debug(u"IPC request: %s", repr(request))
1478
1454
        command = request[0]
1479
1455
        
1480
1456
        if command == 'init':
1515
1491
                parent_pipe.send(('function',))
1516
1492
            else:
1517
1493
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1518
 
        
 
1494
 
1519
1495
        if command == 'setattr':
1520
1496
            attrname = request[1]
1521
1497
            value = request[2]
1522
1498
            setattr(client_object, attrname, value)
1523
 
 
 
1499
            
1524
1500
        return True
1525
1501
 
1526
1502
 
1629
1605
    parser.add_option("--debug", action=u"store_true",
1630
1606
                      help=u"Debug mode; run in foreground and log to"
1631
1607
                      u" terminal")
1632
 
    parser.add_option("--debuglevel", type=u"string", metavar="Level",
1633
 
                      help=u"Debug level for stdout output")
1634
1608
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1635
1609
                      u" priority string (see GnuTLS documentation)")
1636
1610
    parser.add_option("--servicename", type=u"string",
1661
1635
                        u"servicename": u"Mandos",
1662
1636
                        u"use_dbus": u"True",
1663
1637
                        u"use_ipv6": u"True",
1664
 
                        u"debuglevel": u"",
1665
1638
                        }
1666
1639
    
1667
1640
    # Parse config file for server-global settings
1684
1657
    # options, if set.
1685
1658
    for option in (u"interface", u"address", u"port", u"debug",
1686
1659
                   u"priority", u"servicename", u"configdir",
1687
 
                   u"use_dbus", u"use_ipv6", u"debuglevel"):
 
1660
                   u"use_dbus", u"use_ipv6"):
1688
1661
        value = getattr(options, option)
1689
1662
        if value is not None:
1690
1663
            server_settings[option] = value
1699
1672
    
1700
1673
    # For convenience
1701
1674
    debug = server_settings[u"debug"]
1702
 
    debuglevel = server_settings[u"debuglevel"]
1703
1675
    use_dbus = server_settings[u"use_dbus"]
1704
1676
    use_ipv6 = server_settings[u"use_ipv6"]
1705
 
 
 
1677
    
 
1678
    if not debug:
 
1679
        syslogger.setLevel(logging.WARNING)
 
1680
        console.setLevel(logging.WARNING)
 
1681
    
1706
1682
    if server_settings[u"servicename"] != u"Mandos":
1707
1683
        syslogger.setFormatter(logging.Formatter
1708
1684
                               (u'Mandos (%s) [%%(process)d]:'
1760
1736
            raise error
1761
1737
    
1762
1738
    # Enable all possible GnuTLS debugging
1763
 
 
1764
 
 
1765
 
    if not debug and not debuglevel:
1766
 
        syslogger.setLevel(logging.WARNING)
1767
 
        console.setLevel(logging.WARNING)
1768
 
    if debuglevel:
1769
 
        level = getattr(logging, debuglevel.upper())
1770
 
        syslogger.setLevel(level)
1771
 
        console.setLevel(level)
1772
 
 
1773
1739
    if debug:
1774
1740
        # "Use a log level over 10 to enable all debugging options."
1775
1741
        # - GnuTLS manual
1781
1747
        
1782
1748
        (gnutls.library.functions
1783
1749
         .gnutls_global_set_log_function(debug_gnutls))
1784
 
 
1785
 
        # Redirect stdin so all checkers get /dev/null
1786
 
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1787
 
        os.dup2(null, sys.stdin.fileno())
1788
 
        if null > 2:
1789
 
            os.close(null)
1790
 
    else:
1791
 
        # No console logging
1792
 
        logger.removeHandler(console)
1793
 
 
1794
1750
    
1795
1751
    global main_loop
1796
1752
    # From the Avahi example code
1814
1770
    if server_settings["interface"]:
1815
1771
        service.interface = (if_nametoindex
1816
1772
                             (str(server_settings[u"interface"])))
1817
 
 
1818
 
    if not debug:
1819
 
        # Close all input and output, do double fork, etc.
1820
 
        daemon()
1821
 
        
1822
 
    global multiprocessing_manager
1823
 
    multiprocessing_manager = multiprocessing.Manager()
1824
1773
    
1825
1774
    client_class = Client
1826
1775
    if use_dbus:
1844
1793
            for section in client_config.sections()))
1845
1794
    if not tcp_server.clients:
1846
1795
        logger.warning(u"No clients defined")
1847
 
        
 
1796
    
 
1797
    if debug:
 
1798
        # Redirect stdin so all checkers get /dev/null
 
1799
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1800
        os.dup2(null, sys.stdin.fileno())
 
1801
        if null > 2:
 
1802
            os.close(null)
 
1803
    else:
 
1804
        # No console logging
 
1805
        logger.removeHandler(console)
 
1806
        # Close all input and output, do double fork, etc.
 
1807
        daemon()
 
1808
    
1848
1809
    try:
1849
1810
        with pidfile:
1850
1811
            pid = os.getpid()