To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 389
- compare with another revision
- download diff
- download tarball
- view history from revision 389
- Committer: Teddy Hogeborn
- Date: 2009-10-18 08:47:40 UTC
- Revision ID: teddy@fukt.bsnet.se-20091018084740-fa1qgm22lg125r10
* plugins.d/splashy.c: Use exit codes from <sysexits.h>.
- files removed:
- DBUS-API
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
31
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
36
import SocketServer as socketserver
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
56
55
import logging
57
56
import logging.handlers
58
57
import pwd
59
import contextlib
58
from contextlib import closing
60
59
import struct
61
60
import fcntl
62
61
import functools
63
import cPickle as pickle
64
import multiprocessing
65
62
66
63
import dbus
67
64
import dbus.service
82
79
SO_BINDTODEVICE = None
83
80
84
81
85
version = "1.3.1"
82
version = "1.0.12"
86
83
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
84
logger = logging.Logger(u'mandos')
89
85
syslogger = (logging.handlers.SysLogHandler
90
86
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
address = str("/dev/log")))
87
address = "/dev/log"))
92
88
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
89
(u'Mandos [%(process)d]: %(levelname)s:'
90
u' %(message)s'))
95
91
logger.addHandler(syslogger)
96
92
97
93
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
100
' %(message)s'))
94
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
95
u' %(levelname)s:'
96
u' %(message)s'))
101
97
logger.addHandler(console)
102
98
103
99
class AvahiError(Exception):
120
116
Attributes:
121
117
interface: integer; avahi.IF_UNSPEC or an interface index.
122
118
Used to optionally bind to the specified interface.
123
name: string; Example: 'Mandos'
124
type: string; Example: '_mandos._tcp'.
119
name: string; Example: u'Mandos'
120
type: string; Example: u'_mandos._tcp'.
125
121
See <http://www.dns-sd.org/ServiceTypes.html>
126
122
port: integer; what port to announce
127
123
TXT: list of strings; TXT record for the service
136
132
"""
137
133
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
134
servicetype = None, port = None, TXT = None,
139
domain = "", host = "", max_renames = 32768,
135
domain = u"", host = u"", max_renames = 32768,
140
136
protocol = avahi.PROTO_UNSPEC, bus = None):
141
137
self.interface = interface
142
138
self.name = name
151
147
self.group = None # our entry group
152
148
self.server = None
153
149
self.bus = bus
154
self.entry_group_state_changed_match = None
155
150
def rename(self):
156
151
"""Derived from the Avahi example code"""
157
152
if self.rename_count >= self.max_renames:
158
logger.critical("No suitable Zeroconf service name found"
159
" after %i retries, exiting.",
153
logger.critical(u"No suitable Zeroconf service name found"
154
u" after %i retries, exiting.",
160
155
self.rename_count)
161
raise AvahiServiceError("Too many renames")
162
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
163
logger.info("Changing Zeroconf service name to %r ...",
164
self.name)
156
raise AvahiServiceError(u"Too many renames")
157
self.name = self.server.GetAlternativeServiceName(self.name)
158
logger.info(u"Changing Zeroconf service name to %r ...",
159
unicode(self.name))
165
160
syslogger.setFormatter(logging.Formatter
166
('Mandos (%s) [%%(process)d]:'
167
' %%(levelname)s: %%(message)s'
161
(u'Mandos (%s) [%%(process)d]:'
162
u' %%(levelname)s: %%(message)s'
168
163
% self.name))
169
164
self.remove()
170
try:
171
self.add()
172
except dbus.exceptions.DBusException as error:
173
logger.critical("DBusException: %s", error)
174
self.cleanup()
175
os._exit(1)
165
self.add()
176
166
self.rename_count += 1
177
167
def remove(self):
178
168
"""Derived from the Avahi example code"""
179
if self.entry_group_state_changed_match is not None:
180
self.entry_group_state_changed_match.remove()
181
self.entry_group_state_changed_match = None
182
169
if self.group is not None:
183
170
self.group.Reset()
184
171
def add(self):
185
172
"""Derived from the Avahi example code"""
186
self.remove()
187
173
if self.group is None:
188
174
self.group = dbus.Interface(
189
175
self.bus.get_object(avahi.DBUS_NAME,
190
176
self.server.EntryGroupNew()),
191
177
avahi.DBUS_INTERFACE_ENTRY_GROUP)
192
self.entry_group_state_changed_match = (
193
self.group.connect_to_signal(
194
'StateChanged', self .entry_group_state_changed))
195
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
178
self.group.connect_to_signal('StateChanged',
179
self
180
.entry_group_state_changed)
181
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
196
182
self.name, self.type)
197
183
self.group.AddService(
198
184
self.interface,
205
191
self.group.Commit()
206
192
def entry_group_state_changed(self, state, error):
207
193
"""Derived from the Avahi example code"""
208
logger.debug("Avahi entry group state change: %i", state)
194
logger.debug(u"Avahi state change: %i", state)
209
195
210
196
if state == avahi.ENTRY_GROUP_ESTABLISHED:
211
logger.debug("Zeroconf service established.")
197
logger.debug(u"Zeroconf service established.")
212
198
elif state == avahi.ENTRY_GROUP_COLLISION:
213
logger.info("Zeroconf service name collision.")
199
logger.warning(u"Zeroconf service name collision.")
214
200
self.rename()
215
201
elif state == avahi.ENTRY_GROUP_FAILURE:
216
logger.critical("Avahi: Error in group state changed %s",
202
logger.critical(u"Avahi: Error in group state changed %s",
217
203
unicode(error))
218
raise AvahiGroupError("State changed: %s"
204
raise AvahiGroupError(u"State changed: %s"
219
205
% unicode(error))
220
206
def cleanup(self):
221
207
"""Derived from the Avahi example code"""
222
208
if self.group is not None:
223
try:
224
self.group.Free()
225
except (dbus.exceptions.UnknownMethodException,
226
dbus.exceptions.DBusException) as e:
227
pass
209
self.group.Free()
228
210
self.group = None
229
self.remove()
230
def server_state_changed(self, state, error=None):
211
def server_state_changed(self, state):
231
212
"""Derived from the Avahi example code"""
232
logger.debug("Avahi server state change: %i", state)
233
bad_states = { avahi.SERVER_INVALID:
234
"Zeroconf server invalid",
235
avahi.SERVER_REGISTERING: None,
236
avahi.SERVER_COLLISION:
237
"Zeroconf server name collision",
238
avahi.SERVER_FAILURE:
239
"Zeroconf server failure" }
240
if state in bad_states:
241
if bad_states[state] is not None:
242
if error is None:
243
logger.error(bad_states[state])
244
else:
245
logger.error(bad_states[state] + ": %r", error)
246
self.cleanup()
213
if state == avahi.SERVER_COLLISION:
214
logger.error(u"Zeroconf server name collision")
215
self.remove()
247
216
elif state == avahi.SERVER_RUNNING:
248
217
self.add()
249
else:
250
if error is None:
251
logger.debug("Unknown state: %r", state)
252
else:
253
logger.debug("Unknown state: %r: %r", state, error)
254
218
def activate(self):
255
219
"""Derived from the Avahi example code"""
256
220
if self.server is None:
257
221
self.server = dbus.Interface(
258
222
self.bus.get_object(avahi.DBUS_NAME,
259
avahi.DBUS_PATH_SERVER,
260
follow_name_owner_changes=True),
223
avahi.DBUS_PATH_SERVER),
261
224
avahi.DBUS_INTERFACE_SERVER)
262
self.server.connect_to_signal("StateChanged",
225
self.server.connect_to_signal(u"StateChanged",
263
226
self.server_state_changed)
264
227
self.server_state_changed(self.server.GetState())
265
228
268
231
"""A representation of a client host served by this server.
269
232
270
233
Attributes:
271
_approved: bool(); 'None' if not yet approved/disapproved
272
approval_delay: datetime.timedelta(); Time to wait for approval
273
approval_duration: datetime.timedelta(); Duration of one approval
234
name: string; from the config file, used in log messages and
235
D-Bus identifiers
236
fingerprint: string (40 or 32 hexadecimal digits); used to
237
uniquely identify the client
238
secret: bytestring; sent verbatim (over TLS) to client
239
host: string; available for use by the checker command
240
created: datetime.datetime(); (UTC) object creation
241
last_enabled: datetime.datetime(); (UTC)
242
enabled: bool()
243
last_checked_ok: datetime.datetime(); (UTC) or None
244
timeout: datetime.timedelta(); How long from last_checked_ok
245
until this client is invalid
246
interval: datetime.timedelta(); How often to start a new checker
247
disable_hook: If set, called by disable() as disable_hook(self)
274
248
checker: subprocess.Popen(); a running checker process used
275
249
to see if the client lives.
276
250
'None' if no process is running.
277
checker_callback_tag: a gobject event source tag, or None
278
checker_command: string; External command which is run to check
279
if client lives. %() expansions are done at
251
checker_initiator_tag: a gobject event source tag, or None
252
disable_initiator_tag: - '' -
253
checker_callback_tag: - '' -
254
checker_command: string; External command which is run to check if
255
client lives. %() expansions are done at
280
256
runtime with vars(self) as dict, so that for
281
257
instance %(name)s can be used in the command.
282
checker_initiator_tag: a gobject event source tag, or None
283
created: datetime.datetime(); (UTC) object creation
284
258
current_checker_command: string; current running checker_command
285
disable_hook: If set, called by disable() as disable_hook(self)
286
disable_initiator_tag: a gobject event source tag, or None
287
enabled: bool()
288
fingerprint: string (40 or 32 hexadecimal digits); used to
289
uniquely identify the client
290
host: string; available for use by the checker command
291
interval: datetime.timedelta(); How often to start a new checker
292
last_approval_request: datetime.datetime(); (UTC) or None
293
last_checked_ok: datetime.datetime(); (UTC) or None
294
last_enabled: datetime.datetime(); (UTC)
295
name: string; from the config file, used in log messages and
296
D-Bus identifiers
297
secret: bytestring; sent verbatim (over TLS) to client
298
timeout: datetime.timedelta(); How long from last_checked_ok
299
until this client is disabled
300
extended_timeout: extra long timeout when password has been sent
301
runtime_expansions: Allowed attributes for runtime expansion.
302
expires: datetime.datetime(); time (UTC) when a client will be
303
disabled, or None
304
259
"""
305
260
306
runtime_expansions = ("approval_delay", "approval_duration",
307
"created", "enabled", "fingerprint",
308
"host", "interval", "last_checked_ok",
309
"last_enabled", "name", "timeout")
310
311
261
@staticmethod
312
262
def _timedelta_to_milliseconds(td):
313
263
"Convert a datetime.timedelta() to milliseconds"
318
268
def timeout_milliseconds(self):
319
269
"Return the 'timeout' attribute in milliseconds"
320
270
return self._timedelta_to_milliseconds(self.timeout)
321
322
def extended_timeout_milliseconds(self):
323
"Return the 'extended_timeout' attribute in milliseconds"
324
return self._timedelta_to_milliseconds(self.extended_timeout)
325
271
326
272
def interval_milliseconds(self):
327
273
"Return the 'interval' attribute in milliseconds"
328
274
return self._timedelta_to_milliseconds(self.interval)
329
330
def approval_delay_milliseconds(self):
331
return self._timedelta_to_milliseconds(self.approval_delay)
332
275
333
276
def __init__(self, name = None, disable_hook=None, config=None):
334
277
"""Note: the 'checker' key in 'config' sets the
337
280
self.name = name
338
281
if config is None:
339
282
config = {}
340
logger.debug("Creating client %r", self.name)
283
logger.debug(u"Creating client %r", self.name)
341
284
# Uppercase and remove spaces from fingerprint for later
342
285
# comparison purposes with return value from the fingerprint()
343
286
# function
344
self.fingerprint = (config["fingerprint"].upper()
345
.replace(" ", ""))
346
logger.debug(" Fingerprint: %s", self.fingerprint)
347
if "secret" in config:
348
self.secret = config["secret"].decode("base64")
349
elif "secfile" in config:
350
with open(os.path.expanduser(os.path.expandvars
351
(config["secfile"])),
352
"rb") as secfile:
287
self.fingerprint = (config[u"fingerprint"].upper()
288
.replace(u" ", u""))
289
logger.debug(u" Fingerprint: %s", self.fingerprint)
290
if u"secret" in config:
291
self.secret = config[u"secret"].decode(u"base64")
292
elif u"secfile" in config:
293
with closing(open(os.path.expanduser
294
(os.path.expandvars
295
(config[u"secfile"])),
296
"rb")) as secfile:
353
297
self.secret = secfile.read()
354
298
else:
355
raise TypeError("No secret or secfile for client %s"
299
raise TypeError(u"No secret or secfile for client %s"
356
300
% self.name)
357
self.host = config.get("host", "")
301
self.host = config.get(u"host", u"")
358
302
self.created = datetime.datetime.utcnow()
359
303
self.enabled = False
360
self.last_approval_request = None
361
304
self.last_enabled = None
362
305
self.last_checked_ok = None
363
self.timeout = string_to_delta(config["timeout"])
364
self.extended_timeout = string_to_delta(config["extended_timeout"])
365
self.interval = string_to_delta(config["interval"])
306
self.timeout = string_to_delta(config[u"timeout"])
307
self.interval = string_to_delta(config[u"interval"])
366
308
self.disable_hook = disable_hook
367
309
self.checker = None
368
310
self.checker_initiator_tag = None
369
311
self.disable_initiator_tag = None
370
self.expires = None
371
312
self.checker_callback_tag = None
372
self.checker_command = config["checker"]
313
self.checker_command = config[u"checker"]
373
314
self.current_checker_command = None
374
315
self.last_connect = None
375
self._approved = None
376
self.approved_by_default = config.get("approved_by_default",
377
True)
378
self.approvals_pending = 0
379
self.approval_delay = string_to_delta(
380
config["approval_delay"])
381
self.approval_duration = string_to_delta(
382
config["approval_duration"])
383
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
384
316
385
def send_changedstate(self):
386
self.changedstate.acquire()
387
self.changedstate.notify_all()
388
self.changedstate.release()
389
390
317
def enable(self):
391
318
"""Start this client's checker and timeout hooks"""
392
if getattr(self, "enabled", False):
319
if getattr(self, u"enabled", False):
393
320
# Already enabled
394
321
return
395
self.send_changedstate()
396
322
self.last_enabled = datetime.datetime.utcnow()
397
323
# Schedule a new checker to be started an 'interval' from now,
398
324
# and every interval from then on.
399
325
self.checker_initiator_tag = (gobject.timeout_add
400
326
(self.interval_milliseconds(),
401
327
self.start_checker))
328
# Also start a new checker *right now*.
329
self.start_checker()
402
330
# Schedule a disable() when 'timeout' has passed
403
self.expires = datetime.datetime.utcnow() + self.timeout
404
331
self.disable_initiator_tag = (gobject.timeout_add
405
332
(self.timeout_milliseconds(),
406
333
self.disable))
407
334
self.enabled = True
408
# Also start a new checker *right now*.
409
self.start_checker()
410
335
411
def disable(self, quiet=True):
336
def disable(self):
412
337
"""Disable this client."""
413
338
if not getattr(self, "enabled", False):
414
339
return False
415
if not quiet:
416
self.send_changedstate()
417
if not quiet:
418
logger.info("Disabling client %s", self.name)
419
if getattr(self, "disable_initiator_tag", False):
340
logger.info(u"Disabling client %s", self.name)
341
if getattr(self, u"disable_initiator_tag", False):
420
342
gobject.source_remove(self.disable_initiator_tag)
421
343
self.disable_initiator_tag = None
422
self.expires = None
423
if getattr(self, "checker_initiator_tag", False):
344
if getattr(self, u"checker_initiator_tag", False):
424
345
gobject.source_remove(self.checker_initiator_tag)
425
346
self.checker_initiator_tag = None
426
347
self.stop_checker()
441
362
if os.WIFEXITED(condition):
442
363
exitstatus = os.WEXITSTATUS(condition)
443
364
if exitstatus == 0:
444
logger.info("Checker for %(name)s succeeded",
365
logger.info(u"Checker for %(name)s succeeded",
445
366
vars(self))
446
367
self.checked_ok()
447
368
else:
448
logger.info("Checker for %(name)s failed",
369
logger.info(u"Checker for %(name)s failed",
449
370
vars(self))
450
371
else:
451
logger.warning("Checker for %(name)s crashed?",
372
logger.warning(u"Checker for %(name)s crashed?",
452
373
vars(self))
453
374
454
def checked_ok(self, timeout=None):
375
def checked_ok(self):
455
376
"""Bump up the timeout for this client.
456
377
457
378
This should only be called when the client has been seen,
458
379
alive and well.
459
380
"""
460
if timeout is None:
461
timeout = self.timeout
462
381
self.last_checked_ok = datetime.datetime.utcnow()
463
382
gobject.source_remove(self.disable_initiator_tag)
464
self.expires = datetime.datetime.utcnow() + timeout
465
383
self.disable_initiator_tag = (gobject.timeout_add
466
(self._timedelta_to_milliseconds(timeout),
384
(self.timeout_milliseconds(),
467
385
self.disable))
468
386
469
def need_approval(self):
470
self.last_approval_request = datetime.datetime.utcnow()
471
472
387
def start_checker(self):
473
388
"""Start a new checker subprocess if one is not running.
474
389
480
395
# client would inevitably timeout, since no checker would get
481
396
# a chance to run to completion. If we instead leave running
482
397
# checkers alone, the checker would have to take more time
483
# than 'timeout' for the client to be disabled, which is as it
484
# should be.
398
# than 'timeout' for the client to be declared invalid, which
399
# is as it should be.
485
400
486
401
# If a checker exists, make sure it is not a zombie
487
402
try:
488
403
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
489
except (AttributeError, OSError) as error:
404
except (AttributeError, OSError), error:
490
405
if (isinstance(error, OSError)
491
406
and error.errno != errno.ECHILD):
492
407
raise error
493
408
else:
494
409
if pid:
495
logger.warning("Checker was a zombie")
410
logger.warning(u"Checker was a zombie")
496
411
gobject.source_remove(self.checker_callback_tag)
497
412
self.checker_callback(pid, status,
498
413
self.current_checker_command)
503
418
command = self.checker_command % self.host
504
419
except TypeError:
505
420
# Escape attributes for the shell
506
escaped_attrs = dict(
507
(attr,
508
re.escape(unicode(str(getattr(self, attr, "")),
509
errors=
510
'replace')))
511
for attr in
512
self.runtime_expansions)
513
421
escaped_attrs = dict((key,
422
re.escape(unicode(str(val),
423
errors=
424
u'replace')))
425
for key, val in
426
vars(self).iteritems())
514
427
try:
515
428
command = self.checker_command % escaped_attrs
516
except TypeError as error:
517
logger.error('Could not format string "%s":'
518
' %s', self.checker_command, error)
429
except TypeError, error:
430
logger.error(u'Could not format string "%s":'
431
u' %s', self.checker_command, error)
519
432
return True # Try again later
520
433
self.current_checker_command = command
521
434
try:
522
logger.info("Starting checker %r for %s",
435
logger.info(u"Starting checker %r for %s",
523
436
command, self.name)
524
437
# We don't need to redirect stdout and stderr, since
525
438
# in normal mode, that is already done by daemon(),
527
440
# always replaced by /dev/null.)
528
441
self.checker = subprocess.Popen(command,
529
442
close_fds=True,
530
shell=True, cwd="/")
443
shell=True, cwd=u"/")
531
444
self.checker_callback_tag = (gobject.child_watch_add
532
445
(self.checker.pid,
533
446
self.checker_callback,
538
451
if pid:
539
452
gobject.source_remove(self.checker_callback_tag)
540
453
self.checker_callback(pid, status, command)
541
except OSError as error:
542
logger.error("Failed to start subprocess: %s",
454
except OSError, error:
455
logger.error(u"Failed to start subprocess: %s",
543
456
error)
544
457
# Re-run this periodically if run by gobject.timeout_add
545
458
return True
549
462
if self.checker_callback_tag:
550
463
gobject.source_remove(self.checker_callback_tag)
551
464
self.checker_callback_tag = None
552
if getattr(self, "checker", None) is None:
465
if getattr(self, u"checker", None) is None:
553
466
return
554
logger.debug("Stopping checker for %(name)s", vars(self))
467
logger.debug(u"Stopping checker for %(name)s", vars(self))
555
468
try:
556
469
os.kill(self.checker.pid, signal.SIGTERM)
557
#time.sleep(0.5)
470
#os.sleep(0.5)
558
471
#if self.checker.poll() is None:
559
472
# os.kill(self.checker.pid, signal.SIGKILL)
560
except OSError as error:
473
except OSError, error:
561
474
if error.errno != errno.ESRCH: # No such process
562
475
raise
563
476
self.checker = None
564
565
def dbus_service_property(dbus_interface, signature="v",
566
access="readwrite", byte_arrays=False):
477
478
def still_valid(self):
479
"""Has the timeout not yet passed for this client?"""
480
if not getattr(self, u"enabled", False):
481
return False
482
now = datetime.datetime.utcnow()
483
if self.last_checked_ok is None:
484
return now < (self.created + self.timeout)
485
else:
486
return now < (self.last_checked_ok + self.timeout)
487
488
489
def dbus_service_property(dbus_interface, signature=u"v",
490
access=u"readwrite", byte_arrays=False):
567
491
"""Decorators for marking methods of a DBusObjectWithProperties to
568
492
become properties on the D-Bus.
569
493
574
498
dbus.service.method, except there is only "signature", since the
575
499
type from Get() and the type sent to Set() is the same.
576
500
"""
577
# Encoding deeply encoded byte arrays is not supported yet by the
578
# "Set" method, so we fail early here:
579
if byte_arrays and signature != "ay":
580
raise ValueError("Byte arrays not supported for non-'ay'"
581
" signature %r" % signature)
582
501
def decorator(func):
583
502
func._dbus_is_property = True
584
503
func._dbus_interface = dbus_interface
585
504
func._dbus_signature = signature
586
505
func._dbus_access = access
587
506
func._dbus_name = func.__name__
588
if func._dbus_name.endswith("_dbus_property"):
507
if func._dbus_name.endswith(u"_dbus_property"):
589
508
func._dbus_name = func._dbus_name[:-14]
590
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
509
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
591
510
return func
592
511
return decorator
593
512
621
540
622
541
@staticmethod
623
542
def _is_dbus_property(obj):
624
return getattr(obj, "_dbus_is_property", False)
543
return getattr(obj, u"_dbus_is_property", False)
625
544
626
545
def _get_all_dbus_properties(self):
627
546
"""Returns a generator of (name, attribute) pairs
635
554
property with the specified name and interface.
636
555
"""
637
556
for name in (property_name,
638
property_name + "_dbus_property"):
557
property_name + u"_dbus_property"):
639
558
prop = getattr(self, name, None)
640
559
if (prop is None
641
560
or not self._is_dbus_property(prop)
645
564
continue
646
565
return prop
647
566
# No such property
648
raise DBusPropertyNotFound(self.dbus_object_path + ":"
649
+ interface_name + "."
567
raise DBusPropertyNotFound(self.dbus_object_path + u":"
568
+ interface_name + u"."
650
569
+ property_name)
651
570
652
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
653
out_signature="v")
571
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
572
out_signature=u"v")
654
573
def Get(self, interface_name, property_name):
655
574
"""Standard D-Bus property Get() method, see D-Bus standard.
656
575
"""
657
576
prop = self._get_dbus_property(interface_name, property_name)
658
if prop._dbus_access == "write":
577
if prop._dbus_access == u"write":
659
578
raise DBusPropertyAccessException(property_name)
660
579
value = prop()
661
if not hasattr(value, "variant_level"):
580
if not hasattr(value, u"variant_level"):
662
581
return value
663
582
return type(value)(value, variant_level=value.variant_level+1)
664
583
665
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
584
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
666
585
def Set(self, interface_name, property_name, value):
667
586
"""Standard D-Bus property Set() method, see D-Bus standard.
668
587
"""
669
588
prop = self._get_dbus_property(interface_name, property_name)
670
if prop._dbus_access == "read":
589
if prop._dbus_access == u"read":
671
590
raise DBusPropertyAccessException(property_name)
672
if prop._dbus_get_args_options["byte_arrays"]:
673
# The byte_arrays option is not supported yet on
674
# signatures other than "ay".
675
if prop._dbus_signature != "ay":
676
raise ValueError
591
if prop._dbus_get_args_options[u"byte_arrays"]:
677
592
value = dbus.ByteArray(''.join(unichr(byte)
678
593
for byte in value))
679
594
prop(value)
680
595
681
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
682
out_signature="a{sv}")
596
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
597
out_signature=u"a{sv}")
683
598
def GetAll(self, interface_name):
684
599
"""Standard D-Bus property GetAll() method, see D-Bus
685
600
standard.
693
608
# Interface non-empty but did not match
694
609
continue
695
610
# Ignore write-only properties
696
if prop._dbus_access == "write":
611
if prop._dbus_access == u"write":
697
612
continue
698
613
value = prop()
699
if not hasattr(value, "variant_level"):
614
if not hasattr(value, u"variant_level"):
700
615
all[name] = value
701
616
continue
702
617
all[name] = type(value)(value, variant_level=
703
618
value.variant_level+1)
704
return dbus.Dictionary(all, signature="sv")
619
return dbus.Dictionary(all, signature=u"sv")
705
620
706
621
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
707
out_signature="s",
622
out_signature=u"s",
708
623
path_keyword='object_path',
709
624
connection_keyword='connection')
710
625
def Introspect(self, object_path, connection):
715
630
try:
716
631
document = xml.dom.minidom.parseString(xmlstring)
717
632
def make_tag(document, name, prop):
718
e = document.createElement("property")
719
e.setAttribute("name", name)
720
e.setAttribute("type", prop._dbus_signature)
721
e.setAttribute("access", prop._dbus_access)
633
e = document.createElement(u"property")
634
e.setAttribute(u"name", name)
635
e.setAttribute(u"type", prop._dbus_signature)
636
e.setAttribute(u"access", prop._dbus_access)
722
637
return e
723
for if_tag in document.getElementsByTagName("interface"):
638
for if_tag in document.getElementsByTagName(u"interface"):
724
639
for tag in (make_tag(document, name, prop)
725
640
for name, prop
726
641
in self._get_all_dbus_properties()
727
642
if prop._dbus_interface
728
== if_tag.getAttribute("name")):
643
== if_tag.getAttribute(u"name")):
729
644
if_tag.appendChild(tag)
730
645
# Add the names to the return values for the
731
646
# "org.freedesktop.DBus.Properties" methods
732
if (if_tag.getAttribute("name")
733
== "org.freedesktop.DBus.Properties"):
734
for cn in if_tag.getElementsByTagName("method"):
735
if cn.getAttribute("name") == "Get":
736
for arg in cn.getElementsByTagName("arg"):
737
if (arg.getAttribute("direction")
738
== "out"):
739
arg.setAttribute("name", "value")
740
elif cn.getAttribute("name") == "GetAll":
741
for arg in cn.getElementsByTagName("arg"):
742
if (arg.getAttribute("direction")
743
== "out"):
744
arg.setAttribute("name", "props")
745
xmlstring = document.toxml("utf-8")
647
if (if_tag.getAttribute(u"name")
648
== u"org.freedesktop.DBus.Properties"):
649
for cn in if_tag.getElementsByTagName(u"method"):
650
if cn.getAttribute(u"name") == u"Get":
651
for arg in cn.getElementsByTagName(u"arg"):
652
if (arg.getAttribute(u"direction")
653
== u"out"):
654
arg.setAttribute(u"name", u"value")
655
elif cn.getAttribute(u"name") == u"GetAll":
656
for arg in cn.getElementsByTagName(u"arg"):
657
if (arg.getAttribute(u"direction")
658
== u"out"):
659
arg.setAttribute(u"name", u"props")
660
xmlstring = document.toxml(u"utf-8")
746
661
document.unlink()
747
662
except (AttributeError, xml.dom.DOMException,
748
xml.parsers.expat.ExpatError) as error:
749
logger.error("Failed to override Introspection method",
663
xml.parsers.expat.ExpatError), error:
664
logger.error(u"Failed to override Introspection method",
750
665
error)
751
666
return xmlstring
752
667
758
673
dbus_object_path: dbus.ObjectPath
759
674
bus: dbus.SystemBus()
760
675
"""
761
762
runtime_expansions = (Client.runtime_expansions
763
+ ("dbus_object_path",))
764
765
676
# dbus.service.Object doesn't use super(), so we can't either.
766
677
767
678
def __init__(self, bus = None, *args, **kwargs):
768
self._approvals_pending = 0
769
679
self.bus = bus
770
680
Client.__init__(self, *args, **kwargs)
771
681
# Only now, when this client is initialized, can it show up on
772
682
# the D-Bus
773
client_object_name = unicode(self.name).translate(
774
{ord("."): ord("_"),
775
ord("-"): ord("_")})
776
683
self.dbus_object_path = (dbus.ObjectPath
777
("/clients/" + client_object_name))
684
(u"/clients/"
685
+ self.name.replace(u".", u"_")))
778
686
DBusObjectWithProperties.__init__(self, self.bus,
779
687
self.dbus_object_path)
780
def _set_expires(self, value):
781
old_value = getattr(self, "_expires", None)
782
self._expires = value
783
if hasattr(self, "dbus_object_path") and old_value != value:
784
dbus_time = (self._datetime_to_dbus(self._expires,
785
variant_level=1))
786
self.PropertyChanged(dbus.String("Expires"),
787
dbus_time)
788
expires = property(lambda self: self._expires, _set_expires)
789
del _set_expires
790
791
def _get_approvals_pending(self):
792
return self._approvals_pending
793
def _set_approvals_pending(self, value):
794
old_value = self._approvals_pending
795
self._approvals_pending = value
796
bval = bool(value)
797
if (hasattr(self, "dbus_object_path")
798
and bval is not bool(old_value)):
799
dbus_bool = dbus.Boolean(bval, variant_level=1)
800
self.PropertyChanged(dbus.String("ApprovalPending"),
801
dbus_bool)
802
803
approvals_pending = property(_get_approvals_pending,
804
_set_approvals_pending)
805
del _get_approvals_pending, _set_approvals_pending
806
688
807
689
@staticmethod
808
690
def _datetime_to_dbus(dt, variant_level=0):
809
691
"""Convert a UTC datetime.datetime() to a D-Bus type."""
810
if dt is None:
811
return dbus.String("", variant_level = variant_level)
812
692
return dbus.String(dt.isoformat(),
813
693
variant_level=variant_level)
814
694
815
695
def enable(self):
816
oldstate = getattr(self, "enabled", False)
696
oldstate = getattr(self, u"enabled", False)
817
697
r = Client.enable(self)
818
698
if oldstate != self.enabled:
819
699
# Emit D-Bus signals
820
self.PropertyChanged(dbus.String("Enabled"),
700
self.PropertyChanged(dbus.String(u"enabled"),
821
701
dbus.Boolean(True, variant_level=1))
822
702
self.PropertyChanged(
823
dbus.String("LastEnabled"),
703
dbus.String(u"last_enabled"),
824
704
self._datetime_to_dbus(self.last_enabled,
825
705
variant_level=1))
826
706
return r
827
707
828
def disable(self, quiet = False):
829
oldstate = getattr(self, "enabled", False)
830
r = Client.disable(self, quiet=quiet)
831
if not quiet and oldstate != self.enabled:
708
def disable(self, signal = True):
709
oldstate = getattr(self, u"enabled", False)
710
r = Client.disable(self)
711
if signal and oldstate != self.enabled:
832
712
# Emit D-Bus signal
833
self.PropertyChanged(dbus.String("Enabled"),
713
self.PropertyChanged(dbus.String(u"enabled"),
834
714
dbus.Boolean(False, variant_level=1))
835
715
return r
836
716
839
719
self.remove_from_connection()
840
720
except LookupError:
841
721
pass
842
if hasattr(DBusObjectWithProperties, "__del__"):
722
if hasattr(DBusObjectWithProperties, u"__del__"):
843
723
DBusObjectWithProperties.__del__(self, *args, **kwargs)
844
724
Client.__del__(self, *args, **kwargs)
845
725
848
728
self.checker_callback_tag = None
849
729
self.checker = None
850
730
# Emit D-Bus signal
851
self.PropertyChanged(dbus.String("CheckerRunning"),
731
self.PropertyChanged(dbus.String(u"checker_running"),
852
732
dbus.Boolean(False, variant_level=1))
853
733
if os.WIFEXITED(condition):
854
734
exitstatus = os.WEXITSTATUS(condition)
866
746
*args, **kwargs)
867
747
868
748
def checked_ok(self, *args, **kwargs):
869
Client.checked_ok(self, *args, **kwargs)
749
r = Client.checked_ok(self, *args, **kwargs)
870
750
# Emit D-Bus signal
871
751
self.PropertyChanged(
872
dbus.String("LastCheckedOK"),
752
dbus.String(u"last_checked_ok"),
873
753
(self._datetime_to_dbus(self.last_checked_ok,
874
754
variant_level=1)))
875
876
def need_approval(self, *args, **kwargs):
877
r = Client.need_approval(self, *args, **kwargs)
878
# Emit D-Bus signal
879
self.PropertyChanged(
880
dbus.String("LastApprovalRequest"),
881
(self._datetime_to_dbus(self.last_approval_request,
882
variant_level=1)))
883
755
return r
884
756
885
757
def start_checker(self, *args, **kwargs):
895
767
# Emit D-Bus signal
896
768
self.CheckerStarted(self.current_checker_command)
897
769
self.PropertyChanged(
898
dbus.String("CheckerRunning"),
770
dbus.String(u"checker_running"),
899
771
dbus.Boolean(True, variant_level=1))
900
772
return r
901
773
902
774
def stop_checker(self, *args, **kwargs):
903
old_checker = getattr(self, "checker", None)
775
old_checker = getattr(self, u"checker", None)
904
776
r = Client.stop_checker(self, *args, **kwargs)
905
777
if (old_checker is not None
906
and getattr(self, "checker", None) is None):
907
self.PropertyChanged(dbus.String("CheckerRunning"),
778
and getattr(self, u"checker", None) is None):
779
self.PropertyChanged(dbus.String(u"checker_running"),
908
780
dbus.Boolean(False, variant_level=1))
909
781
return r
910
911
def _reset_approved(self):
912
self._approved = None
913
return False
914
915
def approve(self, value=True):
916
self.send_changedstate()
917
self._approved = value
918
gobject.timeout_add(self._timedelta_to_milliseconds
919
(self.approval_duration),
920
self._reset_approved)
921
922
923
## D-Bus methods, signals & properties
924
_interface = "se.bsnet.fukt.Mandos.Client"
925
926
## Signals
782
783
## D-Bus methods & signals
784
_interface = u"se.bsnet.fukt.Mandos.Client"
785
786
# CheckedOK - method
787
@dbus.service.method(_interface)
788
def CheckedOK(self):
789
return self.checked_ok()
927
790
928
791
# CheckerCompleted - signal
929
@dbus.service.signal(_interface, signature="nxs")
792
@dbus.service.signal(_interface, signature=u"nxs")
930
793
def CheckerCompleted(self, exitcode, waitstatus, command):
931
794
"D-Bus signal"
932
795
pass
933
796
934
797
# CheckerStarted - signal
935
@dbus.service.signal(_interface, signature="s")
798
@dbus.service.signal(_interface, signature=u"s")
936
799
def CheckerStarted(self, command):
937
800
"D-Bus signal"
938
801
pass
939
802
940
803
# PropertyChanged - signal
941
@dbus.service.signal(_interface, signature="sv")
804
@dbus.service.signal(_interface, signature=u"sv")
942
805
def PropertyChanged(self, property, value):
943
806
"D-Bus signal"
944
807
pass
946
809
# GotSecret - signal
947
810
@dbus.service.signal(_interface)
948
811
def GotSecret(self):
949
"""D-Bus signal
950
Is sent after a successful transfer of secret from the Mandos
951
server to mandos-client
952
"""
812
"D-Bus signal"
953
813
pass
954
814
955
815
# Rejected - signal
956
@dbus.service.signal(_interface, signature="s")
957
def Rejected(self, reason):
816
@dbus.service.signal(_interface)
817
def Rejected(self):
958
818
"D-Bus signal"
959
819
pass
960
820
961
# NeedApproval - signal
962
@dbus.service.signal(_interface, signature="tb")
963
def NeedApproval(self, timeout, default):
964
"D-Bus signal"
965
return self.need_approval()
966
967
## Methods
968
969
# Approve - method
970
@dbus.service.method(_interface, in_signature="b")
971
def Approve(self, value):
972
self.approve(value)
973
974
# CheckedOK - method
975
@dbus.service.method(_interface)
976
def CheckedOK(self):
977
self.checked_ok()
978
979
821
# Enable - method
980
822
@dbus.service.method(_interface)
981
823
def Enable(self):
999
841
def StopChecker(self):
1000
842
self.stop_checker()
1001
843
1002
## Properties
1003
1004
# ApprovalPending - property
1005
@dbus_service_property(_interface, signature="b", access="read")
1006
def ApprovalPending_dbus_property(self):
1007
return dbus.Boolean(bool(self.approvals_pending))
1008
1009
# ApprovedByDefault - property
1010
@dbus_service_property(_interface, signature="b",
1011
access="readwrite")
1012
def ApprovedByDefault_dbus_property(self, value=None):
1013
if value is None: # get
1014
return dbus.Boolean(self.approved_by_default)
1015
old_value = self.approved_by_default
1016
self.approved_by_default = bool(value)
1017
# Emit D-Bus signal
1018
if old_value != self.approved_by_default:
1019
self.PropertyChanged(dbus.String("ApprovedByDefault"),
1020
dbus.Boolean(value, variant_level=1))
1021
1022
# ApprovalDelay - property
1023
@dbus_service_property(_interface, signature="t",
1024
access="readwrite")
1025
def ApprovalDelay_dbus_property(self, value=None):
1026
if value is None: # get
1027
return dbus.UInt64(self.approval_delay_milliseconds())
1028
old_value = self.approval_delay
1029
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1030
# Emit D-Bus signal
1031
if old_value != self.approval_delay:
1032
self.PropertyChanged(dbus.String("ApprovalDelay"),
1033
dbus.UInt64(value, variant_level=1))
1034
1035
# ApprovalDuration - property
1036
@dbus_service_property(_interface, signature="t",
1037
access="readwrite")
1038
def ApprovalDuration_dbus_property(self, value=None):
1039
if value is None: # get
1040
return dbus.UInt64(self._timedelta_to_milliseconds(
1041
self.approval_duration))
1042
old_value = self.approval_duration
1043
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1044
# Emit D-Bus signal
1045
if old_value != self.approval_duration:
1046
self.PropertyChanged(dbus.String("ApprovalDuration"),
1047
dbus.UInt64(value, variant_level=1))
1048
1049
# Name - property
1050
@dbus_service_property(_interface, signature="s", access="read")
1051
def Name_dbus_property(self):
844
# name - property
845
@dbus_service_property(_interface, signature=u"s", access=u"read")
846
def name_dbus_property(self):
1052
847
return dbus.String(self.name)
1053
848
1054
# Fingerprint - property
1055
@dbus_service_property(_interface, signature="s", access="read")
1056
def Fingerprint_dbus_property(self):
849
# fingerprint - property
850
@dbus_service_property(_interface, signature=u"s", access=u"read")
851
def fingerprint_dbus_property(self):
1057
852
return dbus.String(self.fingerprint)
1058
853
1059
# Host - property
1060
@dbus_service_property(_interface, signature="s",
1061
access="readwrite")
1062
def Host_dbus_property(self, value=None):
854
# host - property
855
@dbus_service_property(_interface, signature=u"s",
856
access=u"readwrite")
857
def host_dbus_property(self, value=None):
1063
858
if value is None: # get
1064
859
return dbus.String(self.host)
1065
old_value = self.host
1066
860
self.host = value
1067
861
# Emit D-Bus signal
1068
if old_value != self.host:
1069
self.PropertyChanged(dbus.String("Host"),
1070
dbus.String(value, variant_level=1))
862
self.PropertyChanged(dbus.String(u"host"),
863
dbus.String(value, variant_level=1))
1071
864
1072
# Created - property
1073
@dbus_service_property(_interface, signature="s", access="read")
1074
def Created_dbus_property(self):
865
# created - property
866
@dbus_service_property(_interface, signature=u"s", access=u"read")
867
def created_dbus_property(self):
1075
868
return dbus.String(self._datetime_to_dbus(self.created))
1076
869
1077
# LastEnabled - property
1078
@dbus_service_property(_interface, signature="s", access="read")
1079
def LastEnabled_dbus_property(self):
1080
return self._datetime_to_dbus(self.last_enabled)
870
# last_enabled - property
871
@dbus_service_property(_interface, signature=u"s", access=u"read")
872
def last_enabled_dbus_property(self):
873
if self.last_enabled is None:
874
return dbus.String(u"")
875
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1081
876
1082
# Enabled - property
1083
@dbus_service_property(_interface, signature="b",
1084
access="readwrite")
1085
def Enabled_dbus_property(self, value=None):
877
# enabled - property
878
@dbus_service_property(_interface, signature=u"b",
879
access=u"readwrite")
880
def enabled_dbus_property(self, value=None):
1086
881
if value is None: # get
1087
882
return dbus.Boolean(self.enabled)
1088
883
if value:
1090
885
else:
1091
886
self.disable()
1092
887
1093
# LastCheckedOK - property
1094
@dbus_service_property(_interface, signature="s",
1095
access="readwrite")
1096
def LastCheckedOK_dbus_property(self, value=None):
888
# last_checked_ok - property
889
@dbus_service_property(_interface, signature=u"s",
890
access=u"readwrite")
891
def last_checked_ok_dbus_property(self, value=None):
1097
892
if value is not None:
1098
893
self.checked_ok()
1099
894
return
1100
return self._datetime_to_dbus(self.last_checked_ok)
1101
1102
# Expires - property
1103
@dbus_service_property(_interface, signature="s", access="read")
1104
def Expires_dbus_property(self):
1105
return self._datetime_to_dbus(self.expires)
1106
1107
# LastApprovalRequest - property
1108
@dbus_service_property(_interface, signature="s", access="read")
1109
def LastApprovalRequest_dbus_property(self):
1110
return self._datetime_to_dbus(self.last_approval_request)
1111
1112
# Timeout - property
1113
@dbus_service_property(_interface, signature="t",
1114
access="readwrite")
1115
def Timeout_dbus_property(self, value=None):
895
if self.last_checked_ok is None:
896
return dbus.String(u"")
897
return dbus.String(self._datetime_to_dbus(self
898
.last_checked_ok))
899
900
# timeout - property
901
@dbus_service_property(_interface, signature=u"t",
902
access=u"readwrite")
903
def timeout_dbus_property(self, value=None):
1116
904
if value is None: # get
1117
905
return dbus.UInt64(self.timeout_milliseconds())
1118
old_value = self.timeout
1119
906
self.timeout = datetime.timedelta(0, 0, 0, value)
1120
907
# Emit D-Bus signal
1121
if old_value != self.timeout:
1122
self.PropertyChanged(dbus.String("Timeout"),
1123
dbus.UInt64(value, variant_level=1))
1124
if getattr(self, "disable_initiator_tag", None) is None:
908
self.PropertyChanged(dbus.String(u"timeout"),
909
dbus.UInt64(value, variant_level=1))
910
if getattr(self, u"disable_initiator_tag", None) is None:
1125
911
return
1126
912
# Reschedule timeout
1127
913
gobject.source_remove(self.disable_initiator_tag)
1128
914
self.disable_initiator_tag = None
1129
self.expires = None
1130
915
time_to_die = (self.
1131
916
_timedelta_to_milliseconds((self
1132
917
.last_checked_ok
1137
922
# The timeout has passed
1138
923
self.disable()
1139
924
else:
1140
self.expires = (datetime.datetime.utcnow()
1141
+ datetime.timedelta(milliseconds = time_to_die))
1142
925
self.disable_initiator_tag = (gobject.timeout_add
1143
926
(time_to_die, self.disable))
1144
1145
# ExtendedTimeout - property
1146
@dbus_service_property(_interface, signature="t",
1147
access="readwrite")
1148
def ExtendedTimeout_dbus_property(self, value=None):
1149
if value is None: # get
1150
return dbus.UInt64(self.extended_timeout_milliseconds())
1151
old_value = self.extended_timeout
1152
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1153
# Emit D-Bus signal
1154
if old_value != self.extended_timeout:
1155
self.PropertyChanged(dbus.String("ExtendedTimeout"),
1156
dbus.UInt64(value, variant_level=1))
1157
1158
# Interval - property
1159
@dbus_service_property(_interface, signature="t",
1160
access="readwrite")
1161
def Interval_dbus_property(self, value=None):
927
928
# interval - property
929
@dbus_service_property(_interface, signature=u"t",
930
access=u"readwrite")
931
def interval_dbus_property(self, value=None):
1162
932
if value is None: # get
1163
933
return dbus.UInt64(self.interval_milliseconds())
1164
old_value = self.interval
1165
934
self.interval = datetime.timedelta(0, 0, 0, value)
1166
935
# Emit D-Bus signal
1167
if old_value != self.interval:
1168
self.PropertyChanged(dbus.String("Interval"),
1169
dbus.UInt64(value, variant_level=1))
1170
if getattr(self, "checker_initiator_tag", None) is None:
936
self.PropertyChanged(dbus.String(u"interval"),
937
dbus.UInt64(value, variant_level=1))
938
if getattr(self, u"checker_initiator_tag", None) is None:
1171
939
return
1172
940
# Reschedule checker run
1173
941
gobject.source_remove(self.checker_initiator_tag)
1175
943
(value, self.start_checker))
1176
944
self.start_checker() # Start one now, too
1177
945
1178
# Checker - property
1179
@dbus_service_property(_interface, signature="s",
1180
access="readwrite")
1181
def Checker_dbus_property(self, value=None):
946
# checker - property
947
@dbus_service_property(_interface, signature=u"s",
948
access=u"readwrite")
949
def checker_dbus_property(self, value=None):
1182
950
if value is None: # get
1183
951
return dbus.String(self.checker_command)
1184
old_value = self.checker_command
1185
952
self.checker_command = value
1186
953
# Emit D-Bus signal
1187
if old_value != self.checker_command:
1188
self.PropertyChanged(dbus.String("Checker"),
1189
dbus.String(self.checker_command,
1190
variant_level=1))
954
self.PropertyChanged(dbus.String(u"checker"),
955
dbus.String(self.checker_command,
956
variant_level=1))
1191
957
1192
# CheckerRunning - property
1193
@dbus_service_property(_interface, signature="b",
1194
access="readwrite")
1195
def CheckerRunning_dbus_property(self, value=None):
958
# checker_running - property
959
@dbus_service_property(_interface, signature=u"b",
960
access=u"readwrite")
961
def checker_running_dbus_property(self, value=None):
1196
962
if value is None: # get
1197
963
return dbus.Boolean(self.checker is not None)
1198
964
if value:
1200
966
else:
1201
967
self.stop_checker()
1202
968
1203
# ObjectPath - property
1204
@dbus_service_property(_interface, signature="o", access="read")
1205
def ObjectPath_dbus_property(self):
969
# object_path - property
970
@dbus_service_property(_interface, signature=u"o", access=u"read")
971
def object_path_dbus_property(self):
1206
972
return self.dbus_object_path # is already a dbus.ObjectPath
1207
973
1208
# Secret = property
1209
@dbus_service_property(_interface, signature="ay",
1210
access="write", byte_arrays=True)
1211
def Secret_dbus_property(self, value):
974
# secret = property
975
@dbus_service_property(_interface, signature=u"ay",
976
access=u"write", byte_arrays=True)
977
def secret_dbus_property(self, value):
1212
978
self.secret = str(value)
1213
979
1214
980
del _interface
1215
981
1216
982
1217
class ProxyClient(object):
1218
def __init__(self, child_pipe, fpr, address):
1219
self._pipe = child_pipe
1220
self._pipe.send(('init', fpr, address))
1221
if not self._pipe.recv():
1222
raise KeyError()
1223
1224
def __getattribute__(self, name):
1225
if(name == '_pipe'):
1226
return super(ProxyClient, self).__getattribute__(name)
1227
self._pipe.send(('getattr', name))
1228
data = self._pipe.recv()
1229
if data[0] == 'data':
1230
return data[1]
1231
if data[0] == 'function':
1232
def func(*args, **kwargs):
1233
self._pipe.send(('funcall', name, args, kwargs))
1234
return self._pipe.recv()[1]
1235
return func
1236
1237
def __setattr__(self, name, value):
1238
if(name == '_pipe'):
1239
return super(ProxyClient, self).__setattr__(name, value)
1240
self._pipe.send(('setattr', name, value))
1241
1242
1243
983
class ClientHandler(socketserver.BaseRequestHandler, object):
1244
984
"""A class to handle client connections.
1245
985
1247
987
Note: This will run in its own forked process."""
1248
988
1249
989
def handle(self):
1250
with contextlib.closing(self.server.child_pipe) as child_pipe:
1251
logger.info("TCP connection from: %s",
1252
unicode(self.client_address))
1253
logger.debug("Pipe FD: %d",
1254
self.server.child_pipe.fileno())
1255
990
logger.info(u"TCP connection from: %s",
991
unicode(self.client_address))
992
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
993
# Open IPC pipe to parent process
994
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
1256
995
session = (gnutls.connection
1257
996
.ClientSession(self.request,
1258
997
gnutls.connection
1259
998
.X509Credentials()))
1260
999
1000
line = self.request.makefile().readline()
1001
logger.debug(u"Protocol version: %r", line)
1002
try:
1003
if int(line.strip().split()[0]) > 1:
1004
raise RuntimeError
1005
except (ValueError, IndexError, RuntimeError), error:
1006
logger.error(u"Unknown protocol version: %s", error)
1007
return
1008
1261
1009
# Note: gnutls.connection.X509Credentials is really a
1262
1010
# generic GnuTLS certificate credentials object so long as
1263
1011
# no X.509 keys are added to it. Therefore, we can use it
1264
1012
# here despite using OpenPGP certificates.
1265
1266
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1267
# "+AES-256-CBC", "+SHA1",
1268
# "+COMP-NULL", "+CTYPE-OPENPGP",
1269
# "+DHE-DSS"))
1013
1014
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1015
# u"+AES-256-CBC", u"+SHA1",
1016
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1017
# u"+DHE-DSS"))
1270
1018
# Use a fallback default, since this MUST be set.
1271
1019
priority = self.server.gnutls_priority
1272
1020
if priority is None:
1273
priority = "NORMAL"
1021
priority = u"NORMAL"
1274
1022
(gnutls.library.functions
1275
1023
.gnutls_priority_set_direct(session._c_object,
1276
1024
priority, None))
1277
1278
# Start communication using the Mandos protocol
1279
# Get protocol number
1280
line = self.request.makefile().readline()
1281
logger.debug("Protocol version: %r", line)
1282
try:
1283
if int(line.strip().split()[0]) > 1:
1284
raise RuntimeError
1285
except (ValueError, IndexError, RuntimeError) as error:
1286
logger.error("Unknown protocol version: %s", error)
1287
return
1288
1289
# Start GnuTLS connection
1025
1290
1026
try:
1291
1027
session.handshake()
1292
except gnutls.errors.GNUTLSError as error:
1293
logger.warning("Handshake failed: %s", error)
1028
except gnutls.errors.GNUTLSError, error:
1029
logger.warning(u"Handshake failed: %s", error)
1294
1030
# Do not run session.bye() here: the session is not
1295
1031
# established. Just abandon the request.
1296
1032
return
1297
logger.debug("Handshake succeeded")
1298
1299
approval_required = False
1033
logger.debug(u"Handshake succeeded")
1300
1034
try:
1301
try:
1302
fpr = self.fingerprint(self.peer_certificate
1303
(session))
1304
except (TypeError,
1305
gnutls.errors.GNUTLSError) as error:
1306
logger.warning("Bad certificate: %s", error)
1307
return
1308
logger.debug("Fingerprint: %s", fpr)
1309
1310
try:
1311
client = ProxyClient(child_pipe, fpr,
1312
self.client_address)
1313
except KeyError:
1314
return
1315
1316
if client.approval_delay:
1317
delay = client.approval_delay
1318
client.approvals_pending += 1
1319
approval_required = True
1320
1321
while True:
1322
if not client.enabled:
1323
logger.info("Client %s is disabled",
1324
client.name)
1325
if self.server.use_dbus:
1326
# Emit D-Bus signal
1327
client.Rejected("Disabled")
1328
return
1329
1330
if client._approved or not client.approval_delay:
1331
#We are approved or approval is disabled
1332
break
1333
elif client._approved is None:
1334
logger.info("Client %s needs approval",
1335
client.name)
1336
if self.server.use_dbus:
1337
# Emit D-Bus signal
1338
client.NeedApproval(
1339
client.approval_delay_milliseconds(),
1340
client.approved_by_default)
1341
else:
1342
logger.warning("Client %s was not approved",
1343
client.name)
1344
if self.server.use_dbus:
1345
# Emit D-Bus signal
1346
client.Rejected("Denied")
1347
return
1348
1349
#wait until timeout or approved
1350
#x = float(client._timedelta_to_milliseconds(delay))
1351
time = datetime.datetime.now()
1352
client.changedstate.acquire()
1353
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1354
client.changedstate.release()
1355
time2 = datetime.datetime.now()
1356
if (time2 - time) >= delay:
1357
if not client.approved_by_default:
1358
logger.warning("Client %s timed out while"
1359
" waiting for approval",
1360
client.name)
1361
if self.server.use_dbus:
1362
# Emit D-Bus signal
1363
client.Rejected("Approval timed out")
1364
return
1365
else:
1366
break
1367
else:
1368
delay -= time2 - time
1369
1370
sent_size = 0
1371
while sent_size < len(client.secret):
1372
try:
1373
sent = session.send(client.secret[sent_size:])
1374
except gnutls.errors.GNUTLSError as error:
1375
logger.warning("gnutls send failed")
1376
return
1377
logger.debug("Sent: %d, remaining: %d",
1378
sent, len(client.secret)
1379
- (sent_size + sent))
1380
sent_size += sent
1381
1382
logger.info("Sending secret to %s", client.name)
1383
# bump the timeout as if seen
1384
client.checked_ok(client.extended_timeout)
1385
if self.server.use_dbus:
1386
# Emit D-Bus signal
1387
client.GotSecret()
1035
fpr = self.fingerprint(self.peer_certificate(session))
1036
except (TypeError, gnutls.errors.GNUTLSError), error:
1037
logger.warning(u"Bad certificate: %s", error)
1038
session.bye()
1039
return
1040
logger.debug(u"Fingerprint: %s", fpr)
1388
1041
1389
finally:
1390
if approval_required:
1391
client.approvals_pending -= 1
1392
try:
1393
session.bye()
1394
except gnutls.errors.GNUTLSError as error:
1395
logger.warning("GnuTLS bye failed")
1042
for c in self.server.clients:
1043
if c.fingerprint == fpr:
1044
client = c
1045
break
1046
else:
1047
ipc.write(u"NOTFOUND %s %s\n"
1048
% (fpr, unicode(self.client_address)))
1049
session.bye()
1050
return
1051
# Have to check if client.still_valid(), since it is
1052
# possible that the client timed out while establishing
1053
# the GnuTLS session.
1054
if not client.still_valid():
1055
ipc.write(u"INVALID %s\n" % client.name)
1056
session.bye()
1057
return
1058
ipc.write(u"SENDING %s\n" % client.name)
1059
sent_size = 0
1060
while sent_size < len(client.secret):
1061
sent = session.send(client.secret[sent_size:])
1062
logger.debug(u"Sent: %d, remaining: %d",
1063
sent, len(client.secret)
1064
- (sent_size + sent))
1065
sent_size += sent
1066
session.bye()
1396
1067
1397
1068
@staticmethod
1398
1069
def peer_certificate(session):
1408
1079
.gnutls_certificate_get_peers
1409
1080
(session._c_object, ctypes.byref(list_size)))
1410
1081
if not bool(cert_list) and list_size.value != 0:
1411
raise gnutls.errors.GNUTLSError("error getting peer"
1412
" certificate")
1082
raise gnutls.errors.GNUTLSError(u"error getting peer"
1083
u" certificate")
1413
1084
if list_size.value == 0:
1414
1085
return None
1415
1086
cert = cert_list[0]
1441
1112
if crtverify.value != 0:
1442
1113
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1443
1114
raise (gnutls.errors.CertificateSecurityError
1444
("Verify failed"))
1115
(u"Verify failed"))
1445
1116
# New buffer for the fingerprint
1446
1117
buf = ctypes.create_string_buffer(20)
1447
1118
buf_len = ctypes.c_size_t()
1454
1125
# Convert the buffer to a Python bytestring
1455
1126
fpr = ctypes.string_at(buf, buf_len.value)
1456
1127
# Convert the bytestring to hexadecimal notation
1457
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1128
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1458
1129
return hex_fpr
1459
1130
1460
1131
1461
class MultiprocessingMixIn(object):
1462
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1463
def sub_process_main(self, request, address):
1464
try:
1465
self.finish_request(request, address)
1466
except:
1467
self.handle_error(request, address)
1468
self.close_request(request)
1469
1470
def process_request(self, request, address):
1471
"""Start a new process to process the request."""
1472
multiprocessing.Process(target = self.sub_process_main,
1473
args = (request, address)).start()
1474
1475
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1476
""" adds a pipe to the MixIn """
1132
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
1133
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
1477
1134
def process_request(self, request, client_address):
1478
1135
"""Overrides and wraps the original process_request().
1479
1136
1480
1137
This function creates a new pipe in self.pipe
1481
1138
"""
1482
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1483
1484
super(MultiprocessingMixInWithPipe,
1139
self.pipe = os.pipe()
1140
super(ForkingMixInWithPipe,
1485
1141
self).process_request(request, client_address)
1486
self.child_pipe.close()
1487
self.add_pipe(parent_pipe)
1488
1489
def add_pipe(self, parent_pipe):
1142
os.close(self.pipe[1]) # close write end
1143
self.add_pipe(self.pipe[0])
1144
def add_pipe(self, pipe):
1490
1145
"""Dummy function; override as necessary"""
1491
raise NotImplementedError
1492
1493
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1146
os.close(pipe)
1147
1148
1149
class IPv6_TCPServer(ForkingMixInWithPipe,
1494
1150
socketserver.TCPServer, object):
1495
1151
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1496
1152
1512
1168
bind to an address or port if they were not specified."""
1513
1169
if self.interface is not None:
1514
1170
if SO_BINDTODEVICE is None:
1515
logger.error("SO_BINDTODEVICE does not exist;"
1516
" cannot bind to interface %s",
1171
logger.error(u"SO_BINDTODEVICE does not exist;"
1172
u" cannot bind to interface %s",
1517
1173
self.interface)
1518
1174
else:
1519
1175
try:
1520
1176
self.socket.setsockopt(socket.SOL_SOCKET,
1521
1177
SO_BINDTODEVICE,
1522
1178
str(self.interface
1523
+ '\0'))
1524
except socket.error as error:
1179
+ u'\0'))
1180
except socket.error, error:
1525
1181
if error[0] == errno.EPERM:
1526
logger.error("No permission to"
1527
" bind to interface %s",
1182
logger.error(u"No permission to"
1183
u" bind to interface %s",
1528
1184
self.interface)
1529
1185
elif error[0] == errno.ENOPROTOOPT:
1530
logger.error("SO_BINDTODEVICE not available;"
1531
" cannot bind to interface %s",
1186
logger.error(u"SO_BINDTODEVICE not available;"
1187
u" cannot bind to interface %s",
1532
1188
self.interface)
1533
1189
else:
1534
1190
raise
1536
1192
if self.server_address[0] or self.server_address[1]:
1537
1193
if not self.server_address[0]:
1538
1194
if self.address_family == socket.AF_INET6:
1539
any_address = "::" # in6addr_any
1195
any_address = u"::" # in6addr_any
1540
1196
else:
1541
1197
any_address = socket.INADDR_ANY
1542
1198
self.server_address = (any_address,
1581
1237
return socketserver.TCPServer.server_activate(self)
1582
1238
def enable(self):
1583
1239
self.enabled = True
1584
def add_pipe(self, parent_pipe):
1240
def add_pipe(self, pipe):
1585
1241
# Call "handle_ipc" for both data and EOF events
1586
gobject.io_add_watch(parent_pipe.fileno(),
1587
gobject.IO_IN | gobject.IO_HUP,
1588
functools.partial(self.handle_ipc,
1589
parent_pipe = parent_pipe))
1590
1591
def handle_ipc(self, source, condition, parent_pipe=None,
1592
client_object=None):
1242
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1243
self.handle_ipc)
1244
def handle_ipc(self, source, condition, file_objects={}):
1593
1245
condition_names = {
1594
gobject.IO_IN: "IN", # There is data to read.
1595
gobject.IO_OUT: "OUT", # Data can be written (without
1246
gobject.IO_IN: u"IN", # There is data to read.
1247
gobject.IO_OUT: u"OUT", # Data can be written (without
1596
1248
# blocking).
1597
gobject.IO_PRI: "PRI", # There is urgent data to read.
1598
gobject.IO_ERR: "ERR", # Error condition.
1599
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1249
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1250
gobject.IO_ERR: u"ERR", # Error condition.
1251
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1600
1252
# broken, usually for pipes and
1601
1253
# sockets).
1602
1254
}
1604
1256
for cond, name in
1605
1257
condition_names.iteritems()
1606
1258
if cond & condition)
1607
# error or the other end of multiprocessing.Pipe has closed
1608
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1609
return False
1610
1611
# Read a request from the child
1612
request = parent_pipe.recv()
1613
command = request[0]
1614
1615
if command == 'init':
1616
fpr = request[1]
1617
address = request[2]
1618
1619
for c in self.clients:
1620
if c.fingerprint == fpr:
1621
client = c
1622
break
1623
else:
1624
logger.info("Client not found for fingerprint: %s, ad"
1625
"dress: %s", fpr, address)
1626
if self.use_dbus:
1627
# Emit D-Bus signal
1628
mandos_dbus_service.ClientNotFound(fpr, address[0])
1629
parent_pipe.send(False)
1630
return False
1631
1632
gobject.io_add_watch(parent_pipe.fileno(),
1633
gobject.IO_IN | gobject.IO_HUP,
1634
functools.partial(self.handle_ipc,
1635
parent_pipe = parent_pipe,
1636
client_object = client))
1637
parent_pipe.send(True)
1638
# remove the old hook in favor of the new above hook on same fileno
1639
return False
1640
if command == 'funcall':
1641
funcname = request[1]
1642
args = request[2]
1643
kwargs = request[3]
1644
1645
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1646
1647
if command == 'getattr':
1648
attrname = request[1]
1649
if callable(client_object.__getattribute__(attrname)):
1650
parent_pipe.send(('function',))
1651
else:
1652
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1653
1654
if command == 'setattr':
1655
attrname = request[1]
1656
value = request[2]
1657
setattr(client_object, attrname, value)
1658
1259
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1260
conditions_string)
1261
1262
# Turn the pipe file descriptor into a Python file object
1263
if source not in file_objects:
1264
file_objects[source] = os.fdopen(source, u"r", 1)
1265
1266
# Read a line from the file object
1267
cmdline = file_objects[source].readline()
1268
if not cmdline: # Empty line means end of file
1269
# close the IPC pipe
1270
file_objects[source].close()
1271
del file_objects[source]
1272
1273
# Stop calling this function
1274
return False
1275
1276
logger.debug(u"IPC command: %r", cmdline)
1277
1278
# Parse and act on command
1279
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1280
1281
if cmd == u"NOTFOUND":
1282
logger.warning(u"Client not found for fingerprint: %s",
1283
args)
1284
if self.use_dbus:
1285
# Emit D-Bus signal
1286
mandos_dbus_service.ClientNotFound(args)
1287
elif cmd == u"INVALID":
1288
for client in self.clients:
1289
if client.name == args:
1290
logger.warning(u"Client %s is invalid", args)
1291
if self.use_dbus:
1292
# Emit D-Bus signal
1293
client.Rejected()
1294
break
1295
else:
1296
logger.error(u"Unknown client %s is invalid", args)
1297
elif cmd == u"SENDING":
1298
for client in self.clients:
1299
if client.name == args:
1300
logger.info(u"Sending secret to %s", client.name)
1301
client.checked_ok()
1302
if self.use_dbus:
1303
# Emit D-Bus signal
1304
client.GotSecret()
1305
break
1306
else:
1307
logger.error(u"Sending secret to unknown client %s",
1308
args)
1309
else:
1310
logger.error(u"Unknown IPC command: %r", cmdline)
1311
1312
# Keep calling this function
1659
1313
return True
1660
1314
1661
1315
1662
1316
def string_to_delta(interval):
1663
1317
"""Parse a string and return a datetime.timedelta
1664
1318
1665
>>> string_to_delta('7d')
1319
>>> string_to_delta(u'7d')
1666
1320
datetime.timedelta(7)
1667
>>> string_to_delta('60s')
1321
>>> string_to_delta(u'60s')
1668
1322
datetime.timedelta(0, 60)
1669
>>> string_to_delta('60m')
1323
>>> string_to_delta(u'60m')
1670
1324
datetime.timedelta(0, 3600)
1671
>>> string_to_delta('24h')
1325
>>> string_to_delta(u'24h')
1672
1326
datetime.timedelta(1)
1673
>>> string_to_delta('1w')
1327
>>> string_to_delta(u'1w')
1674
1328
datetime.timedelta(7)
1675
>>> string_to_delta('5m 30s')
1329
>>> string_to_delta(u'5m 30s')
1676
1330
datetime.timedelta(0, 330)
1677
1331
"""
1678
1332
timevalue = datetime.timedelta(0)
1680
1334
try:
1681
1335
suffix = unicode(s[-1])
1682
1336
value = int(s[:-1])
1683
if suffix == "d":
1337
if suffix == u"d":
1684
1338
delta = datetime.timedelta(value)
1685
elif suffix == "s":
1339
elif suffix == u"s":
1686
1340
delta = datetime.timedelta(0, value)
1687
elif suffix == "m":
1341
elif suffix == u"m":
1688
1342
delta = datetime.timedelta(0, 0, 0, 0, value)
1689
elif suffix == "h":
1343
elif suffix == u"h":
1690
1344
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1691
elif suffix == "w":
1345
elif suffix == u"w":
1692
1346
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1693
1347
else:
1694
raise ValueError("Unknown suffix %r" % suffix)
1695
except (ValueError, IndexError) as e:
1696
raise ValueError(*(e.args))
1348
raise ValueError
1349
except (ValueError, IndexError):
1350
raise ValueError
1697
1351
timevalue += delta
1698
1352
return timevalue
1699
1353
1705
1359
global if_nametoindex
1706
1360
try:
1707
1361
if_nametoindex = (ctypes.cdll.LoadLibrary
1708
(ctypes.util.find_library("c"))
1362
(ctypes.util.find_library(u"c"))
1709
1363
.if_nametoindex)
1710
1364
except (OSError, AttributeError):
1711
logger.warning("Doing if_nametoindex the hard way")
1365
logger.warning(u"Doing if_nametoindex the hard way")
1712
1366
def if_nametoindex(interface):
1713
1367
"Get an interface index the hard way, i.e. using fcntl()"
1714
1368
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1715
with contextlib.closing(socket.socket()) as s:
1369
with closing(socket.socket()) as s:
1716
1370
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1717
struct.pack(str("16s16x"),
1371
struct.pack(str(u"16s16x"),
1718
1372
interface))
1719
interface_index = struct.unpack(str("I"),
1373
interface_index = struct.unpack(str(u"I"),
1720
1374
ifreq[16:20])[0]
1721
1375
return interface_index
1722
1376
return if_nametoindex(interface)
1730
1384
sys.exit()
1731
1385
os.setsid()
1732
1386
if not nochdir:
1733
os.chdir("/")
1387
os.chdir(u"/")
1734
1388
if os.fork():
1735
1389
sys.exit()
1736
1390
if not noclose:
1738
1392
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1739
1393
if not stat.S_ISCHR(os.fstat(null).st_mode):
1740
1394
raise OSError(errno.ENODEV,
1741
"%s not a character device"
1395
u"%s not a character device"
1742
1396
% os.path.devnull)
1743
1397
os.dup2(null, sys.stdin.fileno())
1744
1398
os.dup2(null, sys.stdout.fileno())
1752
1406
##################################################################
1753
1407
# Parsing of options, both command line and config file
1754
1408
1755
parser = argparse.ArgumentParser()
1756
parser.add_argument("-v", "--version", action="version",
1757
version = "%%(prog)s %s" % version,
1758
help="show version number and exit")
1759
parser.add_argument("-i", "--interface", metavar="IF",
1760
help="Bind to interface IF")
1761
parser.add_argument("-a", "--address",
1762
help="Address to listen for requests on")
1763
parser.add_argument("-p", "--port", type=int,
1764
help="Port number to receive requests on")
1765
parser.add_argument("--check", action="store_true",
1766
help="Run self-test")
1767
parser.add_argument("--debug", action="store_true",
1768
help="Debug mode; run in foreground and log"
1769
" to terminal")
1770
parser.add_argument("--debuglevel", metavar="LEVEL",
1771
help="Debug level for stdout output")
1772
parser.add_argument("--priority", help="GnuTLS"
1773
" priority string (see GnuTLS documentation)")
1774
parser.add_argument("--servicename",
1775
metavar="NAME", help="Zeroconf service name")
1776
parser.add_argument("--configdir",
1777
default="/etc/mandos", metavar="DIR",
1778
help="Directory to search for configuration"
1779
" files")
1780
parser.add_argument("--no-dbus", action="store_false",
1781
dest="use_dbus", help="Do not provide D-Bus"
1782
" system bus interface")
1783
parser.add_argument("--no-ipv6", action="store_false",
1784
dest="use_ipv6", help="Do not use IPv6")
1785
options = parser.parse_args()
1409
parser = optparse.OptionParser(version = "%%prog %s" % version)
1410
parser.add_option("-i", u"--interface", type=u"string",
1411
metavar="IF", help=u"Bind to interface IF")
1412
parser.add_option("-a", u"--address", type=u"string",
1413
help=u"Address to listen for requests on")
1414
parser.add_option("-p", u"--port", type=u"int",
1415
help=u"Port number to receive requests on")
1416
parser.add_option("--check", action=u"store_true",
1417
help=u"Run self-test")
1418
parser.add_option("--debug", action=u"store_true",
1419
help=u"Debug mode; run in foreground and log to"
1420
u" terminal")
1421
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1422
u" priority string (see GnuTLS documentation)")
1423
parser.add_option("--servicename", type=u"string",
1424
metavar=u"NAME", help=u"Zeroconf service name")
1425
parser.add_option("--configdir", type=u"string",
1426
default=u"/etc/mandos", metavar=u"DIR",
1427
help=u"Directory to search for configuration"
1428
u" files")
1429
parser.add_option("--no-dbus", action=u"store_false",
1430
dest=u"use_dbus", help=u"Do not provide D-Bus"
1431
u" system bus interface")
1432
parser.add_option("--no-ipv6", action=u"store_false",
1433
dest=u"use_ipv6", help=u"Do not use IPv6")
1434
options = parser.parse_args()[0]
1786
1435
1787
1436
if options.check:
1788
1437
import doctest
1790
1439
sys.exit()
1791
1440
1792
1441
# Default values for config file for server-global settings
1793
server_defaults = { "interface": "",
1794
"address": "",
1795
"port": "",
1796
"debug": "False",
1797
"priority":
1798
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1799
"servicename": "Mandos",
1800
"use_dbus": "True",
1801
"use_ipv6": "True",
1802
"debuglevel": "",
1442
server_defaults = { u"interface": u"",
1443
u"address": u"",
1444
u"port": u"",
1445
u"debug": u"False",
1446
u"priority":
1447
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1448
u"servicename": u"Mandos",
1449
u"use_dbus": u"True",
1450
u"use_ipv6": u"True",
1803
1451
}
1804
1452
1805
1453
# Parse config file for server-global settings
1806
1454
server_config = configparser.SafeConfigParser(server_defaults)
1807
1455
del server_defaults
1808
1456
server_config.read(os.path.join(options.configdir,
1809
"mandos.conf"))
1457
u"mandos.conf"))
1810
1458
# Convert the SafeConfigParser object to a dict
1811
1459
server_settings = server_config.defaults()
1812
1460
# Use the appropriate methods on the non-string config options
1813
for option in ("debug", "use_dbus", "use_ipv6"):
1814
server_settings[option] = server_config.getboolean("DEFAULT",
1461
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1462
server_settings[option] = server_config.getboolean(u"DEFAULT",
1815
1463
option)
1816
1464
if server_settings["port"]:
1817
server_settings["port"] = server_config.getint("DEFAULT",
1818
"port")
1465
server_settings["port"] = server_config.getint(u"DEFAULT",
1466
u"port")
1819
1467
del server_config
1820
1468
1821
1469
# Override the settings from the config file with command line
1822
1470
# options, if set.
1823
for option in ("interface", "address", "port", "debug",
1824
"priority", "servicename", "configdir",
1825
"use_dbus", "use_ipv6", "debuglevel"):
1471
for option in (u"interface", u"address", u"port", u"debug",
1472
u"priority", u"servicename", u"configdir",
1473
u"use_dbus", u"use_ipv6"):
1826
1474
value = getattr(options, option)
1827
1475
if value is not None:
1828
1476
server_settings[option] = value
1836
1484
##################################################################
1837
1485
1838
1486
# For convenience
1839
debug = server_settings["debug"]
1840
debuglevel = server_settings["debuglevel"]
1841
use_dbus = server_settings["use_dbus"]
1842
use_ipv6 = server_settings["use_ipv6"]
1843
1844
if server_settings["servicename"] != "Mandos":
1487
debug = server_settings[u"debug"]
1488
use_dbus = server_settings[u"use_dbus"]
1489
use_ipv6 = server_settings[u"use_ipv6"]
1490
1491
if not debug:
1492
syslogger.setLevel(logging.WARNING)
1493
console.setLevel(logging.WARNING)
1494
1495
if server_settings[u"servicename"] != u"Mandos":
1845
1496
syslogger.setFormatter(logging.Formatter
1846
('Mandos (%s) [%%(process)d]:'
1847
' %%(levelname)s: %%(message)s'
1848
% server_settings["servicename"]))
1497
(u'Mandos (%s) [%%(process)d]:'
1498
u' %%(levelname)s: %%(message)s'
1499
% server_settings[u"servicename"]))
1849
1500
1850
1501
# Parse config file with clients
1851
client_defaults = { "timeout": "5m",
1852
"extended_timeout": "15m",
1853
"interval": "2m",
1854
"checker": "fping -q -- %%(host)s",
1855
"host": "",
1856
"approval_delay": "0s",
1857
"approval_duration": "1s",
1502
client_defaults = { u"timeout": u"1h",
1503
u"interval": u"5m",
1504
u"checker": u"fping -q -- %%(host)s",
1505
u"host": u"",
1858
1506
}
1859
1507
client_config = configparser.SafeConfigParser(client_defaults)
1860
client_config.read(os.path.join(server_settings["configdir"],
1861
"clients.conf"))
1508
client_config.read(os.path.join(server_settings[u"configdir"],
1509
u"clients.conf"))
1862
1510
1863
1511
global mandos_dbus_service
1864
1512
mandos_dbus_service = None
1865
1513
1866
tcp_server = MandosServer((server_settings["address"],
1867
server_settings["port"]),
1514
tcp_server = MandosServer((server_settings[u"address"],
1515
server_settings[u"port"]),
1868
1516
ClientHandler,
1869
interface=(server_settings["interface"]
1870
or None),
1517
interface=server_settings[u"interface"],
1871
1518
use_ipv6=use_ipv6,
1872
1519
gnutls_priority=
1873
server_settings["priority"],
1520
server_settings[u"priority"],
1874
1521
use_dbus=use_dbus)
1875
if not debug:
1876
pidfilename = "/var/run/mandos.pid"
1877
try:
1878
pidfile = open(pidfilename, "w")
1879
except IOError:
1880
logger.error("Could not open file %r", pidfilename)
1522
pidfilename = u"/var/run/mandos.pid"
1523
try:
1524
pidfile = open(pidfilename, u"w")
1525
except IOError:
1526
logger.error(u"Could not open file %r", pidfilename)
1881
1527
1882
1528
try:
1883
uid = pwd.getpwnam("_mandos").pw_uid
1884
gid = pwd.getpwnam("_mandos").pw_gid
1529
uid = pwd.getpwnam(u"_mandos").pw_uid
1530
gid = pwd.getpwnam(u"_mandos").pw_gid
1885
1531
except KeyError:
1886
1532
try:
1887
uid = pwd.getpwnam("mandos").pw_uid
1888
gid = pwd.getpwnam("mandos").pw_gid
1533
uid = pwd.getpwnam(u"mandos").pw_uid
1534
gid = pwd.getpwnam(u"mandos").pw_gid
1889
1535
except KeyError:
1890
1536
try:
1891
uid = pwd.getpwnam("nobody").pw_uid
1892
gid = pwd.getpwnam("nobody").pw_gid
1537
uid = pwd.getpwnam(u"nobody").pw_uid
1538
gid = pwd.getpwnam(u"nobody").pw_gid
1893
1539
except KeyError:
1894
1540
uid = 65534
1895
1541
gid = 65534
1896
1542
try:
1897
1543
os.setgid(gid)
1898
1544
os.setuid(uid)
1899
except OSError as error:
1545
except OSError, error:
1900
1546
if error[0] != errno.EPERM:
1901
1547
raise error
1902
1548
1903
if not debug and not debuglevel:
1904
syslogger.setLevel(logging.WARNING)
1905
console.setLevel(logging.WARNING)
1906
if debuglevel:
1907
level = getattr(logging, debuglevel.upper())
1908
syslogger.setLevel(level)
1909
console.setLevel(level)
1910
1549
# Enable all possible GnuTLS debugging
1911
1550
if debug:
1912
# Enable all possible GnuTLS debugging
1913
1914
1551
# "Use a log level over 10 to enable all debugging options."
1915
1552
# - GnuTLS manual
1916
1553
gnutls.library.functions.gnutls_global_set_log_level(11)
1917
1554
1918
1555
@gnutls.library.types.gnutls_log_func
1919
1556
def debug_gnutls(level, string):
1920
logger.debug("GnuTLS: %s", string[:-1])
1557
logger.debug(u"GnuTLS: %s", string[:-1])
1921
1558
1922
1559
(gnutls.library.functions
1923
1560
.gnutls_global_set_log_function(debug_gnutls))
1924
1925
# Redirect stdin so all checkers get /dev/null
1926
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1927
os.dup2(null, sys.stdin.fileno())
1928
if null > 2:
1929
os.close(null)
1930
else:
1931
# No console logging
1932
logger.removeHandler(console)
1933
1934
# Need to fork before connecting to D-Bus
1935
if not debug:
1936
# Close all input and output, do double fork, etc.
1937
daemon()
1938
1561
1939
1562
global main_loop
1940
1563
# From the Avahi example code
1943
1566
bus = dbus.SystemBus()
1944
1567
# End of Avahi example code
1945
1568
if use_dbus:
1946
try:
1947
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1948
bus, do_not_queue=True)
1949
except dbus.exceptions.NameExistsException as e:
1950
logger.error(unicode(e) + ", disabling D-Bus")
1951
use_dbus = False
1952
server_settings["use_dbus"] = False
1953
tcp_server.use_dbus = False
1569
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1954
1570
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1955
service = AvahiService(name = server_settings["servicename"],
1956
servicetype = "_mandos._tcp",
1571
service = AvahiService(name = server_settings[u"servicename"],
1572
servicetype = u"_mandos._tcp",
1957
1573
protocol = protocol, bus = bus)
1958
1574
if server_settings["interface"]:
1959
1575
service.interface = (if_nametoindex
1960
(str(server_settings["interface"])))
1961
1962
global multiprocessing_manager
1963
multiprocessing_manager = multiprocessing.Manager()
1576
(str(server_settings[u"interface"])))
1964
1577
1965
1578
client_class = Client
1966
1579
if use_dbus:
1967
1580
client_class = functools.partial(ClientDBus, bus = bus)
1968
def client_config_items(config, section):
1969
special_settings = {
1970
"approved_by_default":
1971
lambda: config.getboolean(section,
1972
"approved_by_default"),
1973
}
1974
for name, value in config.items(section):
1975
try:
1976
yield (name, special_settings[name]())
1977
except KeyError:
1978
yield (name, value)
1979
1980
1581
tcp_server.clients.update(set(
1981
1582
client_class(name = section,
1982
config= dict(client_config_items(
1983
client_config, section)))
1583
config= dict(client_config.items(section)))
1984
1584
for section in client_config.sections()))
1985
1585
if not tcp_server.clients:
1986
logger.warning("No clients defined")
1586
logger.warning(u"No clients defined")
1587
1588
if debug:
1589
# Redirect stdin so all checkers get /dev/null
1590
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1591
os.dup2(null, sys.stdin.fileno())
1592
if null > 2:
1593
os.close(null)
1594
else:
1595
# No console logging
1596
logger.removeHandler(console)
1597
# Close all input and output, do double fork, etc.
1598
daemon()
1599
1600
try:
1601
with closing(pidfile):
1602
pid = os.getpid()
1603
pidfile.write(str(pid) + "\n")
1604
del pidfile
1605
except IOError:
1606
logger.error(u"Could not write to file %r with PID %d",
1607
pidfilename, pid)
1608
except NameError:
1609
# "pidfile" was never created
1610
pass
1611
del pidfilename
1612
1613
def cleanup():
1614
"Cleanup function; run on exit"
1615
service.cleanup()
1987
1616
1617
while tcp_server.clients:
1618
client = tcp_server.clients.pop()
1619
client.disable_hook = None
1620
client.disable()
1621
1622
atexit.register(cleanup)
1623
1988
1624
if not debug:
1989
try:
1990
with pidfile:
1991
pid = os.getpid()
1992
pidfile.write(str(pid) + "\n".encode("utf-8"))
1993
del pidfile
1994
except IOError:
1995
logger.error("Could not write to file %r with PID %d",
1996
pidfilename, pid)
1997
except NameError:
1998
# "pidfile" was never created
1999
pass
2000
del pidfilename
2001
2002
1625
signal.signal(signal.SIGINT, signal.SIG_IGN)
2003
2004
1626
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2005
1627
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2006
1628
2008
1630
class MandosDBusService(dbus.service.Object):
2009
1631
"""A D-Bus proxy object"""
2010
1632
def __init__(self):
2011
dbus.service.Object.__init__(self, bus, "/")
2012
_interface = "se.bsnet.fukt.Mandos"
2013
2014
@dbus.service.signal(_interface, signature="o")
2015
def ClientAdded(self, objpath):
2016
"D-Bus signal"
2017
pass
2018
2019
@dbus.service.signal(_interface, signature="ss")
2020
def ClientNotFound(self, fingerprint, address):
2021
"D-Bus signal"
2022
pass
2023
2024
@dbus.service.signal(_interface, signature="os")
1633
dbus.service.Object.__init__(self, bus, u"/")
1634
_interface = u"se.bsnet.fukt.Mandos"
1635
1636
@dbus.service.signal(_interface, signature=u"oa{sv}")
1637
def ClientAdded(self, objpath, properties):
1638
"D-Bus signal"
1639
pass
1640
1641
@dbus.service.signal(_interface, signature=u"s")
1642
def ClientNotFound(self, fingerprint):
1643
"D-Bus signal"
1644
pass
1645
1646
@dbus.service.signal(_interface, signature=u"os")
2025
1647
def ClientRemoved(self, objpath, name):
2026
1648
"D-Bus signal"
2027
1649
pass
2028
1650
2029
@dbus.service.method(_interface, out_signature="ao")
1651
@dbus.service.method(_interface, out_signature=u"ao")
2030
1652
def GetAllClients(self):
2031
1653
"D-Bus method"
2032
1654
return dbus.Array(c.dbus_object_path
2033
1655
for c in tcp_server.clients)
2034
1656
2035
1657
@dbus.service.method(_interface,
2036
out_signature="a{oa{sv}}")
1658
out_signature=u"a{oa{sv}}")
2037
1659
def GetAllClientsWithProperties(self):
2038
1660
"D-Bus method"
2039
1661
return dbus.Dictionary(
2040
((c.dbus_object_path, c.GetAll(""))
1662
((c.dbus_object_path, c.GetAll(u""))
2041
1663
for c in tcp_server.clients),
2042
signature="oa{sv}")
1664
signature=u"oa{sv}")
2043
1665
2044
@dbus.service.method(_interface, in_signature="o")
1666
@dbus.service.method(_interface, in_signature=u"o")
2045
1667
def RemoveClient(self, object_path):
2046
1668
"D-Bus method"
2047
1669
for c in tcp_server.clients:
2049
1671
tcp_server.clients.remove(c)
2050
1672
c.remove_from_connection()
2051
1673
# Don't signal anything except ClientRemoved
2052
c.disable(quiet=True)
1674
c.disable(signal=False)
2053
1675
# Emit D-Bus signal
2054
1676
self.ClientRemoved(object_path, c.name)
2055
1677
return
2056
raise KeyError(object_path)
1678
raise KeyError
2057
1679
2058
1680
del _interface
2059
1681
2060
1682
mandos_dbus_service = MandosDBusService()
2061
1683
2062
def cleanup():
2063
"Cleanup function; run on exit"
2064
service.cleanup()
2065
2066
while tcp_server.clients:
2067
client = tcp_server.clients.pop()
2068
if use_dbus:
2069
client.remove_from_connection()
2070
client.disable_hook = None
2071
# Don't signal anything except ClientRemoved
2072
client.disable(quiet=True)
2073
if use_dbus:
2074
# Emit D-Bus signal
2075
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2076
client.name)
2077
2078
atexit.register(cleanup)
2079
2080
1684
for client in tcp_server.clients:
2081
1685
if use_dbus:
2082
1686
# Emit D-Bus signal
2083
mandos_dbus_service.ClientAdded(client.dbus_object_path)
1687
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1688
client.GetAll(u""))
2084
1689
client.enable()
2085
1690
2086
1691
tcp_server.enable()
2089
1694
# Find out what port we got
2090
1695
service.port = tcp_server.socket.getsockname()[1]
2091
1696
if use_ipv6:
2092
logger.info("Now listening on address %r, port %d,"
1697
logger.info(u"Now listening on address %r, port %d,"
2093
1698
" flowinfo %d, scope_id %d"
2094
1699
% tcp_server.socket.getsockname())
2095
1700
else: # IPv4
2096
logger.info("Now listening on address %r, port %d"
1701
logger.info(u"Now listening on address %r, port %d"
2097
1702
% tcp_server.socket.getsockname())
2098
1703
2099
1704
#service.interface = tcp_server.socket.getsockname()[3]
2102
1707
# From the Avahi example code
2103
1708
try:
2104
1709
service.activate()
2105
except dbus.exceptions.DBusException as error:
2106
logger.critical("DBusException: %s", error)
2107
cleanup()
1710
except dbus.exceptions.DBusException, error:
1711
logger.critical(u"DBusException: %s", error)
2108
1712
sys.exit(1)
2109
1713
# End of Avahi example code
2110
1714
2113
1717
(tcp_server.handle_request
2114
1718
(*args[2:], **kwargs) or True))
2115
1719
2116
logger.debug("Starting main loop")
1720
logger.debug(u"Starting main loop")
2117
1721
main_loop.run()
2118
except AvahiError as error:
2119
logger.critical("AvahiError: %s", error)
2120
cleanup()
1722
except AvahiError, error:
1723
logger.critical(u"AvahiError: %s", error)
2121
1724
sys.exit(1)
2122
1725
except KeyboardInterrupt:
2123
1726
if debug:
2124
print("", file=sys.stderr)
2125
logger.debug("Server received KeyboardInterrupt")
2126
logger.debug("Server exiting")
2127
# Must run before the D-Bus bus name gets deregistered
2128
cleanup()
1727
print >> sys.stderr
1728
logger.debug(u"Server received KeyboardInterrupt")
1729
logger.debug(u"Server exiting")
2129
1730
2130
1731
if __name__ == '__main__':
2131
1732
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0