157
133
u" after %i retries, exiting.",
158
134
self.rename_count)
159
135
raise AvahiServiceError(u"Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
136
self.name = server.GetAlternativeServiceName(self.name)
161
137
logger.info(u"Changing Zeroconf service name to %r ...",
163
139
syslogger.setFormatter(logging.Formatter
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
140
('Mandos (%s): %%(levelname)s:'
141
' %%(message)s' % self.name))
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
174
144
self.rename_count += 1
175
145
def remove(self):
176
146
"""Derived from the Avahi example code"""
177
if self.group is not None:
147
if group is not None:
180
150
"""Derived from the Avahi example code"""
181
if self.group is None:
182
self.group = dbus.Interface(
183
self.bus.get_object(avahi.DBUS_NAME,
184
self.server.EntryGroupNew()),
185
avahi.DBUS_INTERFACE_ENTRY_GROUP)
186
self.group.connect_to_signal('StateChanged',
188
.entry_group_state_changed)
153
group = dbus.Interface(bus.get_object
155
server.EntryGroupNew()),
156
avahi.DBUS_INTERFACE_ENTRY_GROUP)
157
group.connect_to_signal('StateChanged',
158
entry_group_state_changed)
189
159
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
190
self.name, self.type)
191
self.group.AddService(
194
dbus.UInt32(0), # flags
195
self.name, self.type,
196
self.domain, self.host,
197
dbus.UInt16(self.port),
198
avahi.string_array_to_txt_array(self.TXT))
200
def entry_group_state_changed(self, state, error):
201
"""Derived from the Avahi example code"""
202
logger.debug(u"Avahi entry group state change: %i", state)
204
if state == avahi.ENTRY_GROUP_ESTABLISHED:
205
logger.debug(u"Zeroconf service established.")
206
elif state == avahi.ENTRY_GROUP_COLLISION:
207
logger.warning(u"Zeroconf service name collision.")
209
elif state == avahi.ENTRY_GROUP_FAILURE:
210
logger.critical(u"Avahi: Error in group state changed %s",
212
raise AvahiGroupError(u"State changed: %s"
215
"""Derived from the Avahi example code"""
216
if self.group is not None:
219
def server_state_changed(self, state):
220
"""Derived from the Avahi example code"""
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
225
elif state == avahi.SERVER_RUNNING:
228
"""Derived from the Avahi example code"""
229
if self.server is None:
230
self.server = dbus.Interface(
231
self.bus.get_object(avahi.DBUS_NAME,
232
avahi.DBUS_PATH_SERVER),
233
avahi.DBUS_INTERFACE_SERVER)
234
self.server.connect_to_signal(u"StateChanged",
235
self.server_state_changed)
236
self.server_state_changed(self.server.GetState())
239
class Client(object):
160
service.name, service.type)
162
self.interface, # interface
163
self.protocol, # protocol
164
dbus.UInt32(0), # flags
165
self.name, self.type,
166
self.domain, self.host,
167
dbus.UInt16(self.port),
168
avahi.string_array_to_txt_array(self.TXT))
171
# From the Avahi example code:
172
group = None # our entry group
173
# End of Avahi example code
176
def _datetime_to_dbus(dt, variant_level=0):
177
"""Convert a UTC datetime.datetime() to a D-Bus type."""
178
return dbus.String(dt.isoformat(), variant_level=variant_level)
181
class Client(dbus.service.Object):
240
182
"""A representation of a client host served by this server.
243
_approved: bool(); 'None' if not yet approved/disapproved
244
approval_delay: datetime.timedelta(); Time to wait for approval
245
approval_duration: datetime.timedelta(); Duration of one approval
184
name: string; from the config file, used in log messages and
186
fingerprint: string (40 or 32 hexadecimal digits); used to
187
uniquely identify the client
188
secret: bytestring; sent verbatim (over TLS) to client
189
host: string; available for use by the checker command
190
created: datetime.datetime(); (UTC) object creation
191
last_enabled: datetime.datetime(); (UTC)
193
last_checked_ok: datetime.datetime(); (UTC) or None
194
timeout: datetime.timedelta(); How long from last_checked_ok
195
until this client is invalid
196
interval: datetime.timedelta(); How often to start a new checker
197
disable_hook: If set, called by disable() as disable_hook(self)
246
198
checker: subprocess.Popen(); a running checker process used
247
199
to see if the client lives.
248
200
'None' if no process is running.
201
checker_initiator_tag: a gobject event source tag, or None
202
disable_initiator_tag: - '' -
249
203
checker_callback_tag: - '' -
250
checker_command: string; External command which is run to check
251
if client lives. %() expansions are done at
204
checker_command: string; External command which is run to check if
205
client lives. %() expansions are done at
252
206
runtime with vars(self) as dict, so that for
253
207
instance %(name)s can be used in the command.
254
checker_initiator_tag: a gobject event source tag, or None
255
created: datetime.datetime(); (UTC) object creation
256
208
current_checker_command: string; current running checker_command
257
disable_hook: If set, called by disable() as disable_hook(self)
258
disable_initiator_tag: - '' -
260
fingerprint: string (40 or 32 hexadecimal digits); used to
261
uniquely identify the client
262
host: string; available for use by the checker command
263
interval: datetime.timedelta(); How often to start a new checker
264
last_checked_ok: datetime.datetime(); (UTC) or None
265
last_enabled: datetime.datetime(); (UTC)
266
name: string; from the config file, used in log messages and
268
secret: bytestring; sent verbatim (over TLS) to client
269
timeout: datetime.timedelta(); How long from last_checked_ok
270
until this client is disabled
271
runtime_expansions: Allowed attributes for runtime expansion.
209
use_dbus: bool(); Whether to provide D-Bus interface and signals
210
dbus_object_path: dbus.ObjectPath ; only set if self.use_dbus
274
runtime_expansions = (u"approval_delay", u"approval_duration",
275
u"created", u"enabled", u"fingerprint",
276
u"host", u"interval", u"last_checked_ok",
277
u"last_enabled", u"name", u"timeout")
280
def _timedelta_to_milliseconds(td):
281
"Convert a datetime.timedelta() to milliseconds"
282
return ((td.days * 24 * 60 * 60 * 1000)
283
+ (td.seconds * 1000)
284
+ (td.microseconds // 1000))
286
212
def timeout_milliseconds(self):
287
213
"Return the 'timeout' attribute in milliseconds"
288
return self._timedelta_to_milliseconds(self.timeout)
214
return ((self.timeout.days * 24 * 60 * 60 * 1000)
215
+ (self.timeout.seconds * 1000)
216
+ (self.timeout.microseconds // 1000))
290
218
def interval_milliseconds(self):
291
219
"Return the 'interval' attribute in milliseconds"
292
return self._timedelta_to_milliseconds(self.interval)
294
def approval_delay_milliseconds(self):
295
return self._timedelta_to_milliseconds(self.approval_delay)
220
return ((self.interval.days * 24 * 60 * 60 * 1000)
221
+ (self.interval.seconds * 1000)
222
+ (self.interval.microseconds // 1000))
297
def __init__(self, name = None, disable_hook=None, config=None):
224
def __init__(self, name = None, disable_hook=None, config=None,
298
226
"""Note: the 'checker' key in 'config' sets the
299
227
'checker_command' attribute and *not* the 'checker'
502
444
if self.checker_callback_tag:
503
445
gobject.source_remove(self.checker_callback_tag)
504
446
self.checker_callback_tag = None
505
if getattr(self, u"checker", None) is None:
447
if getattr(self, "checker", None) is None:
507
449
logger.debug(u"Stopping checker for %(name)s", vars(self))
509
451
os.kill(self.checker.pid, signal.SIGTERM)
511
453
#if self.checker.poll() is None:
512
454
# os.kill(self.checker.pid, signal.SIGKILL)
513
455
except OSError, error:
514
456
if error.errno != errno.ESRCH: # No such process
516
458
self.checker = None
518
def dbus_service_property(dbus_interface, signature=u"v",
519
access=u"readwrite", byte_arrays=False):
520
"""Decorators for marking methods of a DBusObjectWithProperties to
521
become properties on the D-Bus.
523
The decorated method will be called with no arguments by "Get"
524
and with one argument by "Set".
526
The parameters, where they are supported, are the same as
527
dbus.service.method, except there is only "signature", since the
528
type from Get() and the type sent to Set() is the same.
530
# Encoding deeply encoded byte arrays is not supported yet by the
531
# "Set" method, so we fail early here:
532
if byte_arrays and signature != u"ay":
533
raise ValueError(u"Byte arrays not supported for non-'ay'"
534
u" signature %r" % signature)
536
func._dbus_is_property = True
537
func._dbus_interface = dbus_interface
538
func._dbus_signature = signature
539
func._dbus_access = access
540
func._dbus_name = func.__name__
541
if func._dbus_name.endswith(u"_dbus_property"):
542
func._dbus_name = func._dbus_name[:-14]
543
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
548
class DBusPropertyException(dbus.exceptions.DBusException):
549
"""A base class for D-Bus property-related exceptions
551
def __unicode__(self):
552
return unicode(str(self))
555
class DBusPropertyAccessException(DBusPropertyException):
556
"""A property's access permissions disallows an operation.
561
class DBusPropertyNotFound(DBusPropertyException):
562
"""An attempt was made to access a non-existing property.
567
class DBusObjectWithProperties(dbus.service.Object):
568
"""A D-Bus object with properties.
570
Classes inheriting from this can use the dbus_service_property
571
decorator to expose methods as D-Bus properties. It exposes the
572
standard Get(), Set(), and GetAll() methods on the D-Bus.
576
def _is_dbus_property(obj):
577
return getattr(obj, u"_dbus_is_property", False)
579
def _get_all_dbus_properties(self):
580
"""Returns a generator of (name, attribute) pairs
582
return ((prop._dbus_name, prop)
584
inspect.getmembers(self, self._is_dbus_property))
586
def _get_dbus_property(self, interface_name, property_name):
587
"""Returns a bound method if one exists which is a D-Bus
588
property with the specified name and interface.
590
for name in (property_name,
591
property_name + u"_dbus_property"):
592
prop = getattr(self, name, None)
594
or not self._is_dbus_property(prop)
595
or prop._dbus_name != property_name
596
or (interface_name and prop._dbus_interface
597
and interface_name != prop._dbus_interface)):
601
raise DBusPropertyNotFound(self.dbus_object_path + u":"
602
+ interface_name + u"."
605
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
607
def Get(self, interface_name, property_name):
608
"""Standard D-Bus property Get() method, see D-Bus standard.
610
prop = self._get_dbus_property(interface_name, property_name)
611
if prop._dbus_access == u"write":
612
raise DBusPropertyAccessException(property_name)
614
if not hasattr(value, u"variant_level"):
616
return type(value)(value, variant_level=value.variant_level+1)
618
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
619
def Set(self, interface_name, property_name, value):
620
"""Standard D-Bus property Set() method, see D-Bus standard.
622
prop = self._get_dbus_property(interface_name, property_name)
623
if prop._dbus_access == u"read":
624
raise DBusPropertyAccessException(property_name)
625
if prop._dbus_get_args_options[u"byte_arrays"]:
626
# The byte_arrays option is not supported yet on
627
# signatures other than "ay".
628
if prop._dbus_signature != u"ay":
630
value = dbus.ByteArray(''.join(unichr(byte)
634
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
635
out_signature=u"a{sv}")
636
def GetAll(self, interface_name):
637
"""Standard D-Bus property GetAll() method, see D-Bus
640
Note: Will not include properties with access="write".
643
for name, prop in self._get_all_dbus_properties():
645
and interface_name != prop._dbus_interface):
646
# Interface non-empty but did not match
648
# Ignore write-only properties
649
if prop._dbus_access == u"write":
652
if not hasattr(value, u"variant_level"):
655
all[name] = type(value)(value, variant_level=
656
value.variant_level+1)
657
return dbus.Dictionary(all, signature=u"sv")
659
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
661
path_keyword='object_path',
662
connection_keyword='connection')
663
def Introspect(self, object_path, connection):
664
"""Standard D-Bus method, overloaded to insert property tags.
666
xmlstring = dbus.service.Object.Introspect(self, object_path,
669
document = xml.dom.minidom.parseString(xmlstring)
670
def make_tag(document, name, prop):
671
e = document.createElement(u"property")
672
e.setAttribute(u"name", name)
673
e.setAttribute(u"type", prop._dbus_signature)
674
e.setAttribute(u"access", prop._dbus_access)
676
for if_tag in document.getElementsByTagName(u"interface"):
677
for tag in (make_tag(document, name, prop)
679
in self._get_all_dbus_properties()
680
if prop._dbus_interface
681
== if_tag.getAttribute(u"name")):
682
if_tag.appendChild(tag)
683
# Add the names to the return values for the
684
# "org.freedesktop.DBus.Properties" methods
685
if (if_tag.getAttribute(u"name")
686
== u"org.freedesktop.DBus.Properties"):
687
for cn in if_tag.getElementsByTagName(u"method"):
688
if cn.getAttribute(u"name") == u"Get":
689
for arg in cn.getElementsByTagName(u"arg"):
690
if (arg.getAttribute(u"direction")
692
arg.setAttribute(u"name", u"value")
693
elif cn.getAttribute(u"name") == u"GetAll":
694
for arg in cn.getElementsByTagName(u"arg"):
695
if (arg.getAttribute(u"direction")
697
arg.setAttribute(u"name", u"props")
698
xmlstring = document.toxml(u"utf-8")
700
except (AttributeError, xml.dom.DOMException,
701
xml.parsers.expat.ExpatError), error:
702
logger.error(u"Failed to override Introspection method",
707
class ClientDBus(Client, DBusObjectWithProperties):
708
"""A Client class using D-Bus
711
dbus_object_path: dbus.ObjectPath
712
bus: dbus.SystemBus()
715
runtime_expansions = (Client.runtime_expansions
716
+ (u"dbus_object_path",))
718
# dbus.service.Object doesn't use super(), so we can't either.
720
def __init__(self, bus = None, *args, **kwargs):
721
self._approvals_pending = 0
723
Client.__init__(self, *args, **kwargs)
724
# Only now, when this client is initialized, can it show up on
726
self.dbus_object_path = (dbus.ObjectPath
728
+ self.name.replace(u".", u"_")))
729
DBusObjectWithProperties.__init__(self, self.bus,
730
self.dbus_object_path)
732
def _get_approvals_pending(self):
733
return self._approvals_pending
734
def _set_approvals_pending(self, value):
735
old_value = self._approvals_pending
736
self._approvals_pending = value
738
if (hasattr(self, "dbus_object_path")
739
and bval is not bool(old_value)):
740
dbus_bool = dbus.Boolean(bval, variant_level=1)
741
self.PropertyChanged(dbus.String(u"ApprovalPending"),
744
approvals_pending = property(_get_approvals_pending,
745
_set_approvals_pending)
746
del _get_approvals_pending, _set_approvals_pending
749
def _datetime_to_dbus(dt, variant_level=0):
750
"""Convert a UTC datetime.datetime() to a D-Bus type."""
751
return dbus.String(dt.isoformat(),
752
variant_level=variant_level)
755
oldstate = getattr(self, u"enabled", False)
756
r = Client.enable(self)
757
if oldstate != self.enabled:
759
self.PropertyChanged(dbus.String(u"Enabled"),
760
dbus.Boolean(True, variant_level=1))
761
self.PropertyChanged(
762
dbus.String(u"LastEnabled"),
763
self._datetime_to_dbus(self.last_enabled,
767
def disable(self, quiet = False):
768
oldstate = getattr(self, u"enabled", False)
769
r = Client.disable(self, quiet=quiet)
770
if not quiet and oldstate != self.enabled:
772
self.PropertyChanged(dbus.String(u"Enabled"),
773
dbus.Boolean(False, variant_level=1))
776
def __del__(self, *args, **kwargs):
778
self.remove_from_connection()
781
if hasattr(DBusObjectWithProperties, u"__del__"):
782
DBusObjectWithProperties.__del__(self, *args, **kwargs)
783
Client.__del__(self, *args, **kwargs)
785
def checker_callback(self, pid, condition, command,
787
self.checker_callback_tag = None
790
self.PropertyChanged(dbus.String(u"CheckerRunning"),
791
dbus.Boolean(False, variant_level=1))
792
if os.WIFEXITED(condition):
793
exitstatus = os.WEXITSTATUS(condition)
795
self.CheckerCompleted(dbus.Int16(exitstatus),
796
dbus.Int64(condition),
797
dbus.String(command))
800
self.CheckerCompleted(dbus.Int16(-1),
801
dbus.Int64(condition),
802
dbus.String(command))
804
return Client.checker_callback(self, pid, condition, command,
807
def checked_ok(self, *args, **kwargs):
808
r = Client.checked_ok(self, *args, **kwargs)
810
self.PropertyChanged(
811
dbus.String(u"LastCheckedOK"),
812
(self._datetime_to_dbus(self.last_checked_ok,
816
def start_checker(self, *args, **kwargs):
817
old_checker = self.checker
818
if self.checker is not None:
819
old_checker_pid = self.checker.pid
821
old_checker_pid = None
822
r = Client.start_checker(self, *args, **kwargs)
823
# Only if new checker process was started
824
if (self.checker is not None
825
and old_checker_pid != self.checker.pid):
827
self.CheckerStarted(self.current_checker_command)
828
self.PropertyChanged(
829
dbus.String(u"CheckerRunning"),
830
dbus.Boolean(True, variant_level=1))
833
def stop_checker(self, *args, **kwargs):
834
old_checker = getattr(self, u"checker", None)
835
r = Client.stop_checker(self, *args, **kwargs)
836
if (old_checker is not None
837
and getattr(self, u"checker", None) is None):
838
self.PropertyChanged(dbus.String(u"CheckerRunning"),
839
dbus.Boolean(False, variant_level=1))
842
def _reset_approved(self):
843
self._approved = None
846
def approve(self, value=True):
847
self.send_changedstate()
848
self._approved = value
849
gobject.timeout_add(self._timedelta_to_milliseconds
850
(self.approval_duration),
851
self._reset_approved)
854
## D-Bus methods, signals & properties
460
self.PropertyChanged(dbus.String(u"checker_running"),
461
dbus.Boolean(False, variant_level=1))
463
def still_valid(self):
464
"""Has the timeout not yet passed for this client?"""
465
if not getattr(self, "enabled", False):
467
now = datetime.datetime.utcnow()
468
if self.last_checked_ok is None:
469
return now < (self.created + self.timeout)
471
return now < (self.last_checked_ok + self.timeout)
473
## D-Bus methods & signals
855
474
_interface = u"se.bsnet.fukt.Mandos.Client"
477
CheckedOK = dbus.service.method(_interface)(checked_ok)
478
CheckedOK.__name__ = "CheckedOK"
859
480
# CheckerCompleted - signal
860
@dbus.service.signal(_interface, signature=u"nxs")
481
@dbus.service.signal(_interface, signature="nxs")
861
482
def CheckerCompleted(self, exitcode, waitstatus, command):
865
486
# CheckerStarted - signal
866
@dbus.service.signal(_interface, signature=u"s")
487
@dbus.service.signal(_interface, signature="s")
867
488
def CheckerStarted(self, command):
492
# GetAllProperties - method
493
@dbus.service.method(_interface, out_signature="a{sv}")
494
def GetAllProperties(self):
496
return dbus.Dictionary({
498
dbus.String(self.name, variant_level=1),
499
dbus.String("fingerprint"):
500
dbus.String(self.fingerprint, variant_level=1),
502
dbus.String(self.host, variant_level=1),
503
dbus.String("created"):
504
_datetime_to_dbus(self.created, variant_level=1),
505
dbus.String("last_enabled"):
506
(_datetime_to_dbus(self.last_enabled,
508
if self.last_enabled is not None
509
else dbus.Boolean(False, variant_level=1)),
510
dbus.String("enabled"):
511
dbus.Boolean(self.enabled, variant_level=1),
512
dbus.String("last_checked_ok"):
513
(_datetime_to_dbus(self.last_checked_ok,
515
if self.last_checked_ok is not None
516
else dbus.Boolean (False, variant_level=1)),
517
dbus.String("timeout"):
518
dbus.UInt64(self.timeout_milliseconds(),
520
dbus.String("interval"):
521
dbus.UInt64(self.interval_milliseconds(),
523
dbus.String("checker"):
524
dbus.String(self.checker_command,
526
dbus.String("checker_running"):
527
dbus.Boolean(self.checker is not None,
529
dbus.String("object_path"):
530
dbus.ObjectPath(self.dbus_object_path,
534
# IsStillValid - method
535
IsStillValid = (dbus.service.method(_interface, out_signature="b")
537
IsStillValid.__name__ = "IsStillValid"
871
539
# PropertyChanged - signal
872
@dbus.service.signal(_interface, signature=u"sv")
540
@dbus.service.signal(_interface, signature="sv")
873
541
def PropertyChanged(self, property, value):
878
@dbus.service.signal(_interface)
881
Is sent after a successful transfer of secret from the Mandos
882
server to mandos-client
887
@dbus.service.signal(_interface, signature=u"s")
888
def Rejected(self, reason):
892
# NeedApproval - signal
893
@dbus.service.signal(_interface, signature=u"tb")
894
def NeedApproval(self, timeout, default):
901
@dbus.service.method(_interface, in_signature=u"b")
902
def Approve(self, value):
906
@dbus.service.method(_interface)
908
return self.checked_ok()
545
# SetChecker - method
546
@dbus.service.method(_interface, in_signature="s")
547
def SetChecker(self, checker):
548
"D-Bus setter method"
549
self.checker_command = checker
551
self.PropertyChanged(dbus.String(u"checker"),
552
dbus.String(self.checker_command,
556
@dbus.service.method(_interface, in_signature="s")
557
def SetHost(self, host):
558
"D-Bus setter method"
561
self.PropertyChanged(dbus.String(u"host"),
562
dbus.String(self.host, variant_level=1))
564
# SetInterval - method
565
@dbus.service.method(_interface, in_signature="t")
566
def SetInterval(self, milliseconds):
567
self.interval = datetime.timedelta(0, 0, 0, milliseconds)
569
self.PropertyChanged(dbus.String(u"interval"),
570
(dbus.UInt64(self.interval_milliseconds(),
574
@dbus.service.method(_interface, in_signature="ay",
576
def SetSecret(self, secret):
577
"D-Bus setter method"
578
self.secret = str(secret)
580
# SetTimeout - method
581
@dbus.service.method(_interface, in_signature="t")
582
def SetTimeout(self, milliseconds):
583
self.timeout = datetime.timedelta(0, 0, 0, milliseconds)
585
self.PropertyChanged(dbus.String(u"timeout"),
586
(dbus.UInt64(self.timeout_milliseconds(),
910
589
# Enable - method
911
@dbus.service.method(_interface)
590
Enable = dbus.service.method(_interface)(enable)
591
Enable.__name__ = "Enable"
916
593
# StartChecker - method
917
594
@dbus.service.method(_interface)
928
605
# StopChecker - method
929
@dbus.service.method(_interface)
930
def StopChecker(self):
935
# ApprovalPending - property
936
@dbus_service_property(_interface, signature=u"b", access=u"read")
937
def ApprovalPending_dbus_property(self):
938
return dbus.Boolean(bool(self.approvals_pending))
940
# ApprovedByDefault - property
941
@dbus_service_property(_interface, signature=u"b",
943
def ApprovedByDefault_dbus_property(self, value=None):
944
if value is None: # get
945
return dbus.Boolean(self.approved_by_default)
946
self.approved_by_default = bool(value)
948
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
949
dbus.Boolean(value, variant_level=1))
951
# ApprovalDelay - property
952
@dbus_service_property(_interface, signature=u"t",
954
def ApprovalDelay_dbus_property(self, value=None):
955
if value is None: # get
956
return dbus.UInt64(self.approval_delay_milliseconds())
957
self.approval_delay = datetime.timedelta(0, 0, 0, value)
959
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
960
dbus.UInt64(value, variant_level=1))
962
# ApprovalDuration - property
963
@dbus_service_property(_interface, signature=u"t",
965
def ApprovalDuration_dbus_property(self, value=None):
966
if value is None: # get
967
return dbus.UInt64(self._timedelta_to_milliseconds(
968
self.approval_duration))
969
self.approval_duration = datetime.timedelta(0, 0, 0, value)
971
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
972
dbus.UInt64(value, variant_level=1))
975
@dbus_service_property(_interface, signature=u"s", access=u"read")
976
def Name_dbus_property(self):
977
return dbus.String(self.name)
979
# Fingerprint - property
980
@dbus_service_property(_interface, signature=u"s", access=u"read")
981
def Fingerprint_dbus_property(self):
982
return dbus.String(self.fingerprint)
985
@dbus_service_property(_interface, signature=u"s",
987
def Host_dbus_property(self, value=None):
988
if value is None: # get
989
return dbus.String(self.host)
992
self.PropertyChanged(dbus.String(u"Host"),
993
dbus.String(value, variant_level=1))
996
@dbus_service_property(_interface, signature=u"s", access=u"read")
997
def Created_dbus_property(self):
998
return dbus.String(self._datetime_to_dbus(self.created))
1000
# LastEnabled - property
1001
@dbus_service_property(_interface, signature=u"s", access=u"read")
1002
def LastEnabled_dbus_property(self):
1003
if self.last_enabled is None:
1004
return dbus.String(u"")
1005
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1007
# Enabled - property
1008
@dbus_service_property(_interface, signature=u"b",
1009
access=u"readwrite")
1010
def Enabled_dbus_property(self, value=None):
1011
if value is None: # get
1012
return dbus.Boolean(self.enabled)
1018
# LastCheckedOK - property
1019
@dbus_service_property(_interface, signature=u"s",
1020
access=u"readwrite")
1021
def LastCheckedOK_dbus_property(self, value=None):
1022
if value is not None:
1025
if self.last_checked_ok is None:
1026
return dbus.String(u"")
1027
return dbus.String(self._datetime_to_dbus(self
1030
# Timeout - property
1031
@dbus_service_property(_interface, signature=u"t",
1032
access=u"readwrite")
1033
def Timeout_dbus_property(self, value=None):
1034
if value is None: # get
1035
return dbus.UInt64(self.timeout_milliseconds())
1036
self.timeout = datetime.timedelta(0, 0, 0, value)
1038
self.PropertyChanged(dbus.String(u"Timeout"),
1039
dbus.UInt64(value, variant_level=1))
1040
if getattr(self, u"disable_initiator_tag", None) is None:
1042
# Reschedule timeout
1043
gobject.source_remove(self.disable_initiator_tag)
1044
self.disable_initiator_tag = None
1045
time_to_die = (self.
1046
_timedelta_to_milliseconds((self
1051
if time_to_die <= 0:
1052
# The timeout has passed
1055
self.disable_initiator_tag = (gobject.timeout_add
1056
(time_to_die, self.disable))
1058
# Interval - property
1059
@dbus_service_property(_interface, signature=u"t",
1060
access=u"readwrite")
1061
def Interval_dbus_property(self, value=None):
1062
if value is None: # get
1063
return dbus.UInt64(self.interval_milliseconds())
1064
self.interval = datetime.timedelta(0, 0, 0, value)
1066
self.PropertyChanged(dbus.String(u"Interval"),
1067
dbus.UInt64(value, variant_level=1))
1068
if getattr(self, u"checker_initiator_tag", None) is None:
1070
# Reschedule checker run
1071
gobject.source_remove(self.checker_initiator_tag)
1072
self.checker_initiator_tag = (gobject.timeout_add
1073
(value, self.start_checker))
1074
self.start_checker() # Start one now, too
1076
# Checker - property
1077
@dbus_service_property(_interface, signature=u"s",
1078
access=u"readwrite")
1079
def Checker_dbus_property(self, value=None):
1080
if value is None: # get
1081
return dbus.String(self.checker_command)
1082
self.checker_command = value
1084
self.PropertyChanged(dbus.String(u"Checker"),
1085
dbus.String(self.checker_command,
1088
# CheckerRunning - property
1089
@dbus_service_property(_interface, signature=u"b",
1090
access=u"readwrite")
1091
def CheckerRunning_dbus_property(self, value=None):
1092
if value is None: # get
1093
return dbus.Boolean(self.checker is not None)
1095
self.start_checker()
1099
# ObjectPath - property
1100
@dbus_service_property(_interface, signature=u"o", access=u"read")
1101
def ObjectPath_dbus_property(self):
1102
return self.dbus_object_path # is already a dbus.ObjectPath
1105
@dbus_service_property(_interface, signature=u"ay",
1106
access=u"write", byte_arrays=True)
1107
def Secret_dbus_property(self, value):
1108
self.secret = str(value)
606
StopChecker = dbus.service.method(_interface)(stop_checker)
607
StopChecker.__name__ = "StopChecker"
1113
class ProxyClient(object):
1114
def __init__(self, child_pipe, fpr, address):
1115
self._pipe = child_pipe
1116
self._pipe.send(('init', fpr, address))
1117
if not self._pipe.recv():
1120
def __getattribute__(self, name):
1121
if(name == '_pipe'):
1122
return super(ProxyClient, self).__getattribute__(name)
1123
self._pipe.send(('getattr', name))
1124
data = self._pipe.recv()
1125
if data[0] == 'data':
1127
if data[0] == 'function':
1128
def func(*args, **kwargs):
1129
self._pipe.send(('funcall', name, args, kwargs))
1130
return self._pipe.recv()[1]
1133
def __setattr__(self, name, value):
1134
if(name == '_pipe'):
1135
return super(ProxyClient, self).__setattr__(name, value)
1136
self._pipe.send(('setattr', name, value))
1139
class ClientHandler(socketserver.BaseRequestHandler, object):
1140
"""A class to handle client connections.
1142
Instantiated once for each connection to handle it.
612
def peer_certificate(session):
613
"Return the peer's OpenPGP certificate as a bytestring"
614
# If not an OpenPGP certificate...
615
if (gnutls.library.functions
616
.gnutls_certificate_type_get(session._c_object)
617
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
618
# ...do the normal thing
619
return session.peer_certificate
620
list_size = ctypes.c_uint(1)
621
cert_list = (gnutls.library.functions
622
.gnutls_certificate_get_peers
623
(session._c_object, ctypes.byref(list_size)))
624
if not bool(cert_list) and list_size.value != 0:
625
raise gnutls.errors.GNUTLSError("error getting peer"
627
if list_size.value == 0:
630
return ctypes.string_at(cert.data, cert.size)
633
def fingerprint(openpgp):
634
"Convert an OpenPGP bytestring to a hexdigit fingerprint string"
635
# New GnuTLS "datum" with the OpenPGP public key
636
datum = (gnutls.library.types
637
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
640
ctypes.c_uint(len(openpgp))))
641
# New empty GnuTLS certificate
642
crt = gnutls.library.types.gnutls_openpgp_crt_t()
643
(gnutls.library.functions
644
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
645
# Import the OpenPGP public key into the certificate
646
(gnutls.library.functions
647
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
648
gnutls.library.constants
649
.GNUTLS_OPENPGP_FMT_RAW))
650
# Verify the self signature in the key
651
crtverify = ctypes.c_uint()
652
(gnutls.library.functions
653
.gnutls_openpgp_crt_verify_self(crt, 0, ctypes.byref(crtverify)))
654
if crtverify.value != 0:
655
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
656
raise gnutls.errors.CertificateSecurityError("Verify failed")
657
# New buffer for the fingerprint
658
buf = ctypes.create_string_buffer(20)
659
buf_len = ctypes.c_size_t()
660
# Get the fingerprint from the certificate into the buffer
661
(gnutls.library.functions
662
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
663
ctypes.byref(buf_len)))
664
# Deinit the certificate
665
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
666
# Convert the buffer to a Python bytestring
667
fpr = ctypes.string_at(buf, buf_len.value)
668
# Convert the bytestring to hexadecimal notation
669
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
673
class TCP_handler(SocketServer.BaseRequestHandler, object):
674
"""A TCP request handler class.
675
Instantiated by IPv6_TCPServer for each request to handle it.
1143
676
Note: This will run in its own forked process."""
1145
678
def handle(self):
1146
with contextlib.closing(self.server.child_pipe) as child_pipe:
1147
logger.info(u"TCP connection from: %s",
1148
unicode(self.client_address))
1149
logger.debug(u"Pipe FD: %d",
1150
self.server.child_pipe.fileno())
1152
session = (gnutls.connection
1153
.ClientSession(self.request,
1155
.X509Credentials()))
1157
# Note: gnutls.connection.X509Credentials is really a
1158
# generic GnuTLS certificate credentials object so long as
1159
# no X.509 keys are added to it. Therefore, we can use it
1160
# here despite using OpenPGP certificates.
1162
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1163
# u"+AES-256-CBC", u"+SHA1",
1164
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1166
# Use a fallback default, since this MUST be set.
1167
priority = self.server.gnutls_priority
1168
if priority is None:
1169
priority = u"NORMAL"
1170
(gnutls.library.functions
1171
.gnutls_priority_set_direct(session._c_object,
1174
# Start communication using the Mandos protocol
1175
# Get protocol number
1176
line = self.request.makefile().readline()
1177
logger.debug(u"Protocol version: %r", line)
1179
if int(line.strip().split()[0]) > 1:
1181
except (ValueError, IndexError, RuntimeError), error:
1182
logger.error(u"Unknown protocol version: %s", error)
1185
# Start GnuTLS connection
1188
except gnutls.errors.GNUTLSError, error:
1189
logger.warning(u"Handshake failed: %s", error)
1190
# Do not run session.bye() here: the session is not
1191
# established. Just abandon the request.
1193
logger.debug(u"Handshake succeeded")
1195
approval_required = False
1198
fpr = self.fingerprint(self.peer_certificate
1200
except (TypeError, gnutls.errors.GNUTLSError), error:
1201
logger.warning(u"Bad certificate: %s", error)
1203
logger.debug(u"Fingerprint: %s", fpr)
1206
client = ProxyClient(child_pipe, fpr,
1207
self.client_address)
1211
if client.approval_delay:
1212
delay = client.approval_delay
1213
client.approvals_pending += 1
1214
approval_required = True
1217
if not client.enabled:
1218
logger.warning(u"Client %s is disabled",
1220
if self.server.use_dbus:
1222
client.Rejected("Disabled")
1225
if client._approved or not client.approval_delay:
1226
#We are approved or approval is disabled
1228
elif client._approved is None:
1229
logger.info(u"Client %s needs approval",
1231
if self.server.use_dbus:
1233
client.NeedApproval(
1234
client.approval_delay_milliseconds(),
1235
client.approved_by_default)
1237
logger.warning(u"Client %s was not approved",
1239
if self.server.use_dbus:
1241
client.Rejected("Denied")
1244
#wait until timeout or approved
1245
#x = float(client._timedelta_to_milliseconds(delay))
1246
time = datetime.datetime.now()
1247
client.changedstate.acquire()
1248
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1249
client.changedstate.release()
1250
time2 = datetime.datetime.now()
1251
if (time2 - time) >= delay:
1252
if not client.approved_by_default:
1253
logger.warning("Client %s timed out while"
1254
" waiting for approval",
1256
if self.server.use_dbus:
1258
client.Rejected("Approval timed out")
1263
delay -= time2 - time
1266
while sent_size < len(client.secret):
1268
sent = session.send(client.secret[sent_size:])
1269
except (gnutls.errors.GNUTLSError), error:
1270
logger.warning("gnutls send failed")
1272
logger.debug(u"Sent: %d, remaining: %d",
1273
sent, len(client.secret)
1274
- (sent_size + sent))
1277
logger.info(u"Sending secret to %s", client.name)
1278
# bump the timeout as if seen
1280
if self.server.use_dbus:
1285
if approval_required:
1286
client.approvals_pending -= 1
1289
except (gnutls.errors.GNUTLSError), error:
1290
logger.warning("GnuTLS bye failed")
1293
def peer_certificate(session):
1294
"Return the peer's OpenPGP certificate as a bytestring"
1295
# If not an OpenPGP certificate...
1296
if (gnutls.library.functions
1297
.gnutls_certificate_type_get(session._c_object)
1298
!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1299
# ...do the normal thing
1300
return session.peer_certificate
1301
list_size = ctypes.c_uint(1)
1302
cert_list = (gnutls.library.functions
1303
.gnutls_certificate_get_peers
1304
(session._c_object, ctypes.byref(list_size)))
1305
if not bool(cert_list) and list_size.value != 0:
1306
raise gnutls.errors.GNUTLSError(u"error getting peer"
1308
if list_size.value == 0:
1311
return ctypes.string_at(cert.data, cert.size)
1314
def fingerprint(openpgp):
1315
"Convert an OpenPGP bytestring to a hexdigit fingerprint"
1316
# New GnuTLS "datum" with the OpenPGP public key
1317
datum = (gnutls.library.types
1318
.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1321
ctypes.c_uint(len(openpgp))))
1322
# New empty GnuTLS certificate
1323
crt = gnutls.library.types.gnutls_openpgp_crt_t()
1324
(gnutls.library.functions
1325
.gnutls_openpgp_crt_init(ctypes.byref(crt)))
1326
# Import the OpenPGP public key into the certificate
1327
(gnutls.library.functions
1328
.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1329
gnutls.library.constants
1330
.GNUTLS_OPENPGP_FMT_RAW))
1331
# Verify the self signature in the key
1332
crtverify = ctypes.c_uint()
1333
(gnutls.library.functions
1334
.gnutls_openpgp_crt_verify_self(crt, 0,
1335
ctypes.byref(crtverify)))
1336
if crtverify.value != 0:
1337
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1338
raise (gnutls.errors.CertificateSecurityError
1340
# New buffer for the fingerprint
1341
buf = ctypes.create_string_buffer(20)
1342
buf_len = ctypes.c_size_t()
1343
# Get the fingerprint from the certificate into the buffer
1344
(gnutls.library.functions
1345
.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1346
ctypes.byref(buf_len)))
1347
# Deinit the certificate
1348
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1349
# Convert the buffer to a Python bytestring
1350
fpr = ctypes.string_at(buf, buf_len.value)
1351
# Convert the bytestring to hexadecimal notation
1352
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1356
class MultiprocessingMixIn(object):
1357
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1358
def sub_process_main(self, request, address):
1360
self.finish_request(request, address)
1362
self.handle_error(request, address)
1363
self.close_request(request)
1365
def process_request(self, request, address):
1366
"""Start a new process to process the request."""
1367
multiprocessing.Process(target = self.sub_process_main,
1368
args = (request, address)).start()
1370
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1371
""" adds a pipe to the MixIn """
1372
def process_request(self, request, client_address):
1373
"""Overrides and wraps the original process_request().
1375
This function creates a new pipe in self.pipe
1377
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1379
super(MultiprocessingMixInWithPipe,
1380
self).process_request(request, client_address)
1381
self.child_pipe.close()
1382
self.add_pipe(parent_pipe)
1384
def add_pipe(self, parent_pipe):
1385
"""Dummy function; override as necessary"""
1388
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1389
socketserver.TCPServer, object):
679
logger.info(u"TCP connection from: %s",
680
unicode(self.client_address))
681
session = (gnutls.connection
682
.ClientSession(self.request,
686
line = self.request.makefile().readline()
687
logger.debug(u"Protocol version: %r", line)
689
if int(line.strip().split()[0]) > 1:
691
except (ValueError, IndexError, RuntimeError), error:
692
logger.error(u"Unknown protocol version: %s", error)
695
# Note: gnutls.connection.X509Credentials is really a generic
696
# GnuTLS certificate credentials object so long as no X.509
697
# keys are added to it. Therefore, we can use it here despite
698
# using OpenPGP certificates.
700
#priority = ':'.join(("NONE", "+VERS-TLS1.1", "+AES-256-CBC",
701
# "+SHA1", "+COMP-NULL", "+CTYPE-OPENPGP",
703
# Use a fallback default, since this MUST be set.
704
priority = self.server.settings.get("priority", "NORMAL")
705
(gnutls.library.functions
706
.gnutls_priority_set_direct(session._c_object,
711
except gnutls.errors.GNUTLSError, error:
712
logger.warning(u"Handshake failed: %s", error)
713
# Do not run session.bye() here: the session is not
714
# established. Just abandon the request.
716
logger.debug(u"Handshake succeeded")
718
fpr = fingerprint(peer_certificate(session))
719
except (TypeError, gnutls.errors.GNUTLSError), error:
720
logger.warning(u"Bad certificate: %s", error)
723
logger.debug(u"Fingerprint: %s", fpr)
725
for c in self.server.clients:
726
if c.fingerprint == fpr:
730
logger.warning(u"Client not found for fingerprint: %s",
734
# Have to check if client.still_valid(), since it is possible
735
# that the client timed out while establishing the GnuTLS
737
if not client.still_valid():
738
logger.warning(u"Client %(name)s is invalid",
742
## This won't work here, since we're in a fork.
743
# client.checked_ok()
745
while sent_size < len(client.secret):
746
sent = session.send(client.secret[sent_size:])
747
logger.debug(u"Sent: %d, remaining: %d",
748
sent, len(client.secret)
749
- (sent_size + sent))
754
class IPv6_TCPServer(SocketServer.ForkingMixIn,
755
SocketServer.TCPServer, object):
1390
756
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
758
settings: Server settings
759
clients: Set() of Client objects
1393
760
enabled: Boolean; whether this server is activated yet
1394
interface: None or a network interface name (string)
1395
use_ipv6: Boolean; to use IPv6 or not
1397
def __init__(self, server_address, RequestHandlerClass,
1398
interface=None, use_ipv6=True):
1399
self.interface = interface
1401
self.address_family = socket.AF_INET6
1402
socketserver.TCPServer.__init__(self, server_address,
1403
RequestHandlerClass)
762
address_family = socket.AF_INET6
763
def __init__(self, *args, **kwargs):
764
if "settings" in kwargs:
765
self.settings = kwargs["settings"]
766
del kwargs["settings"]
767
if "clients" in kwargs:
768
self.clients = kwargs["clients"]
769
del kwargs["clients"]
770
if "use_ipv6" in kwargs:
771
if not kwargs["use_ipv6"]:
772
self.address_family = socket.AF_INET
773
del kwargs["use_ipv6"]
775
super(IPv6_TCPServer, self).__init__(*args, **kwargs)
1404
776
def server_bind(self):
1405
777
"""This overrides the normal server_bind() function
1406
778
to bind to an interface if one was specified, and also NOT to
1407
779
bind to an address or port if they were not specified."""
1408
if self.interface is not None:
1409
if SO_BINDTODEVICE is None:
1410
logger.error(u"SO_BINDTODEVICE does not exist;"
1411
u" cannot bind to interface %s",
1415
self.socket.setsockopt(socket.SOL_SOCKET,
1419
except socket.error, error:
1420
if error[0] == errno.EPERM:
1421
logger.error(u"No permission to"
1422
u" bind to interface %s",
1424
elif error[0] == errno.ENOPROTOOPT:
1425
logger.error(u"SO_BINDTODEVICE not available;"
1426
u" cannot bind to interface %s",
780
if self.settings["interface"]:
781
# 25 is from /usr/include/asm-i486/socket.h
782
SO_BINDTODEVICE = getattr(socket, "SO_BINDTODEVICE", 25)
784
self.socket.setsockopt(socket.SOL_SOCKET,
786
self.settings["interface"])
787
except socket.error, error:
788
if error[0] == errno.EPERM:
789
logger.error(u"No permission to"
790
u" bind to interface %s",
791
self.settings["interface"])
1430
794
# Only bind(2) the socket if we really need to.
1431
795
if self.server_address[0] or self.server_address[1]:
1432
796
if not self.server_address[0]:
1433
797
if self.address_family == socket.AF_INET6:
1434
any_address = u"::" # in6addr_any
798
any_address = "::" # in6addr_any
1436
800
any_address = socket.INADDR_ANY
1437
801
self.server_address = (any_address,
1684
963
# Default values for config file for server-global settings
1685
server_defaults = { u"interface": u"",
1690
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1691
u"servicename": u"Mandos",
1692
u"use_dbus": u"True",
1693
u"use_ipv6": u"True",
964
server_defaults = { "interface": "",
969
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
970
"servicename": "Mandos",
1697
975
# Parse config file for server-global settings
1698
server_config = configparser.SafeConfigParser(server_defaults)
976
server_config = ConfigParser.SafeConfigParser(server_defaults)
1699
977
del server_defaults
1700
server_config.read(os.path.join(options.configdir,
978
server_config.read(os.path.join(options.configdir, "mandos.conf"))
1702
979
# Convert the SafeConfigParser object to a dict
1703
980
server_settings = server_config.defaults()
1704
981
# Use the appropriate methods on the non-string config options
1705
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1706
server_settings[option] = server_config.getboolean(u"DEFAULT",
982
server_settings["debug"] = server_config.getboolean("DEFAULT",
984
server_settings["use_dbus"] = server_config.getboolean("DEFAULT",
986
server_settings["use_ipv6"] = server_config.getboolean("DEFAULT",
1708
988
if server_settings["port"]:
1709
server_settings["port"] = server_config.getint(u"DEFAULT",
989
server_settings["port"] = server_config.getint("DEFAULT",
1711
991
del server_config
1713
993
# Override the settings from the config file with command line
1714
994
# options, if set.
1715
for option in (u"interface", u"address", u"port", u"debug",
1716
u"priority", u"servicename", u"configdir",
1717
u"use_dbus", u"use_ipv6", u"debuglevel"):
995
for option in ("interface", "address", "port", "debug",
996
"priority", "servicename", "configdir",
997
"use_dbus", "use_ipv6"):
1718
998
value = getattr(options, option)
1719
999
if value is not None:
1720
1000
server_settings[option] = value
1722
# Force all strings to be unicode
1723
for option in server_settings.keys():
1724
if type(server_settings[option]) is str:
1725
server_settings[option] = unicode(server_settings[option])
1726
1002
# Now we have our good server settings in "server_settings"
1728
##################################################################
1730
1004
# For convenience
1731
debug = server_settings[u"debug"]
1732
debuglevel = server_settings[u"debuglevel"]
1733
use_dbus = server_settings[u"use_dbus"]
1734
use_ipv6 = server_settings[u"use_ipv6"]
1736
if server_settings[u"servicename"] != u"Mandos":
1005
debug = server_settings["debug"]
1006
use_dbus = server_settings["use_dbus"]
1007
use_ipv6 = server_settings["use_ipv6"]
1010
syslogger.setLevel(logging.WARNING)
1011
console.setLevel(logging.WARNING)
1013
if server_settings["servicename"] != "Mandos":
1737
1014
syslogger.setFormatter(logging.Formatter
1738
(u'Mandos (%s) [%%(process)d]:'
1739
u' %%(levelname)s: %%(message)s'
1740
% server_settings[u"servicename"]))
1015
('Mandos (%s): %%(levelname)s:'
1017
% server_settings["servicename"]))
1742
1019
# Parse config file with clients
1743
client_defaults = { u"timeout": u"1h",
1745
u"checker": u"fping -q -- %%(host)s",
1747
u"approval_delay": u"0s",
1748
u"approval_duration": u"1s",
1020
client_defaults = { "timeout": "1h",
1022
"checker": "fping -q -- %%(host)s",
1750
client_config = configparser.SafeConfigParser(client_defaults)
1751
client_config.read(os.path.join(server_settings[u"configdir"],
1754
global mandos_dbus_service
1755
mandos_dbus_service = None
1757
tcp_server = MandosServer((server_settings[u"address"],
1758
server_settings[u"port"]),
1760
interface=(server_settings[u"interface"]
1764
server_settings[u"priority"],
1766
pidfilename = u"/var/run/mandos.pid"
1025
client_config = ConfigParser.SafeConfigParser(client_defaults)
1026
client_config.read(os.path.join(server_settings["configdir"],
1030
tcp_server = IPv6_TCPServer((server_settings["address"],
1031
server_settings["port"]),
1033
settings=server_settings,
1034
clients=clients, use_ipv6=use_ipv6)
1035
pidfilename = "/var/run/mandos.pid"
1768
pidfile = open(pidfilename, u"w")
1037
pidfile = open(pidfilename, "w")
1769
1038
except IOError:
1770
logger.error(u"Could not open file %r", pidfilename)
1039
logger.error("Could not open file %r", pidfilename)
1773
uid = pwd.getpwnam(u"_mandos").pw_uid
1774
gid = pwd.getpwnam(u"_mandos").pw_gid
1042
uid = pwd.getpwnam("_mandos").pw_uid
1043
gid = pwd.getpwnam("_mandos").pw_gid
1775
1044
except KeyError:
1777
uid = pwd.getpwnam(u"mandos").pw_uid
1778
gid = pwd.getpwnam(u"mandos").pw_gid
1046
uid = pwd.getpwnam("mandos").pw_uid
1047
gid = pwd.getpwnam("mandos").pw_gid
1779
1048
except KeyError:
1781
uid = pwd.getpwnam(u"nobody").pw_uid
1782
gid = pwd.getpwnam(u"nobody").pw_gid
1050
uid = pwd.getpwnam("nobody").pw_uid
1051
gid = pwd.getpwnam("nogroup").pw_gid
1783
1052
except KeyError: