To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 389
- compare with another revision
- download diff
- download tarball
- view history from revision 389
- Committer: Teddy Hogeborn
- Date: 2009-10-18 08:47:40 UTC
- Revision ID: teddy@fukt.bsnet.se-20091018084740-fa1qgm22lg125r10
* plugins.d/splashy.c: Use exit codes from <sysexits.h>.
- files removed:
- DBUS-API
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
31
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
36
import SocketServer as socketserver
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
56
55
import logging
57
56
import logging.handlers
58
57
import pwd
59
import contextlib
58
from contextlib import closing
60
59
import struct
61
60
import fcntl
62
61
import functools
63
import cPickle as pickle
64
import multiprocessing
65
62
66
63
import dbus
67
64
import dbus.service
82
79
SO_BINDTODEVICE = None
83
80
84
81
85
version = "1.3.1"
82
version = "1.0.12"
86
83
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
84
logger = logging.Logger(u'mandos')
89
85
syslogger = (logging.handlers.SysLogHandler
90
86
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
address = str("/dev/log")))
87
address = "/dev/log"))
92
88
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
89
(u'Mandos [%(process)d]: %(levelname)s:'
90
u' %(message)s'))
95
91
logger.addHandler(syslogger)
96
92
97
93
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
100
' %(message)s'))
94
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
95
u' %(levelname)s:'
96
u' %(message)s'))
101
97
logger.addHandler(console)
102
98
103
99
class AvahiError(Exception):
120
116
Attributes:
121
117
interface: integer; avahi.IF_UNSPEC or an interface index.
122
118
Used to optionally bind to the specified interface.
123
name: string; Example: 'Mandos'
124
type: string; Example: '_mandos._tcp'.
119
name: string; Example: u'Mandos'
120
type: string; Example: u'_mandos._tcp'.
125
121
See <http://www.dns-sd.org/ServiceTypes.html>
126
122
port: integer; what port to announce
127
123
TXT: list of strings; TXT record for the service
136
132
"""
137
133
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
134
servicetype = None, port = None, TXT = None,
139
domain = "", host = "", max_renames = 32768,
135
domain = u"", host = u"", max_renames = 32768,
140
136
protocol = avahi.PROTO_UNSPEC, bus = None):
141
137
self.interface = interface
142
138
self.name = name
151
147
self.group = None # our entry group
152
148
self.server = None
153
149
self.bus = bus
154
self.entry_group_state_changed_match = None
155
150
def rename(self):
156
151
"""Derived from the Avahi example code"""
157
152
if self.rename_count >= self.max_renames:
158
logger.critical("No suitable Zeroconf service name found"
159
" after %i retries, exiting.",
153
logger.critical(u"No suitable Zeroconf service name found"
154
u" after %i retries, exiting.",
160
155
self.rename_count)
161
raise AvahiServiceError("Too many renames")
162
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
163
logger.info("Changing Zeroconf service name to %r ...",
164
self.name)
156
raise AvahiServiceError(u"Too many renames")
157
self.name = self.server.GetAlternativeServiceName(self.name)
158
logger.info(u"Changing Zeroconf service name to %r ...",
159
unicode(self.name))
165
160
syslogger.setFormatter(logging.Formatter
166
('Mandos (%s) [%%(process)d]:'
167
' %%(levelname)s: %%(message)s'
161
(u'Mandos (%s) [%%(process)d]:'
162
u' %%(levelname)s: %%(message)s'
168
163
% self.name))
169
164
self.remove()
170
try:
171
self.add()
172
except dbus.exceptions.DBusException as error:
173
logger.critical("DBusException: %s", error)
174
self.cleanup()
175
os._exit(1)
165
self.add()
176
166
self.rename_count += 1
177
167
def remove(self):
178
168
"""Derived from the Avahi example code"""
179
if self.entry_group_state_changed_match is not None:
180
self.entry_group_state_changed_match.remove()
181
self.entry_group_state_changed_match = None
182
169
if self.group is not None:
183
170
self.group.Reset()
184
171
def add(self):
185
172
"""Derived from the Avahi example code"""
186
self.remove()
187
173
if self.group is None:
188
174
self.group = dbus.Interface(
189
175
self.bus.get_object(avahi.DBUS_NAME,
190
176
self.server.EntryGroupNew()),
191
177
avahi.DBUS_INTERFACE_ENTRY_GROUP)
192
self.entry_group_state_changed_match = (
193
self.group.connect_to_signal(
194
'StateChanged', self .entry_group_state_changed))
195
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
178
self.group.connect_to_signal('StateChanged',
179
self
180
.entry_group_state_changed)
181
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
196
182
self.name, self.type)
197
183
self.group.AddService(
198
184
self.interface,
205
191
self.group.Commit()
206
192
def entry_group_state_changed(self, state, error):
207
193
"""Derived from the Avahi example code"""
208
logger.debug("Avahi entry group state change: %i", state)
194
logger.debug(u"Avahi state change: %i", state)
209
195
210
196
if state == avahi.ENTRY_GROUP_ESTABLISHED:
211
logger.debug("Zeroconf service established.")
197
logger.debug(u"Zeroconf service established.")
212
198
elif state == avahi.ENTRY_GROUP_COLLISION:
213
logger.info("Zeroconf service name collision.")
199
logger.warning(u"Zeroconf service name collision.")
214
200
self.rename()
215
201
elif state == avahi.ENTRY_GROUP_FAILURE:
216
logger.critical("Avahi: Error in group state changed %s",
202
logger.critical(u"Avahi: Error in group state changed %s",
217
203
unicode(error))
218
raise AvahiGroupError("State changed: %s"
204
raise AvahiGroupError(u"State changed: %s"
219
205
% unicode(error))
220
206
def cleanup(self):
221
207
"""Derived from the Avahi example code"""
222
208
if self.group is not None:
223
try:
224
self.group.Free()
225
except (dbus.exceptions.UnknownMethodException,
226
dbus.exceptions.DBusException) as e:
227
pass
209
self.group.Free()
228
210
self.group = None
229
self.remove()
230
def server_state_changed(self, state, error=None):
211
def server_state_changed(self, state):
231
212
"""Derived from the Avahi example code"""
232
logger.debug("Avahi server state change: %i", state)
233
bad_states = { avahi.SERVER_INVALID:
234
"Zeroconf server invalid",
235
avahi.SERVER_REGISTERING: None,
236
avahi.SERVER_COLLISION:
237
"Zeroconf server name collision",
238
avahi.SERVER_FAILURE:
239
"Zeroconf server failure" }
240
if state in bad_states:
241
if bad_states[state] is not None:
242
if error is None:
243
logger.error(bad_states[state])
244
else:
245
logger.error(bad_states[state] + ": %r", error)
246
self.cleanup()
213
if state == avahi.SERVER_COLLISION:
214
logger.error(u"Zeroconf server name collision")
215
self.remove()
247
216
elif state == avahi.SERVER_RUNNING:
248
217
self.add()
249
else:
250
if error is None:
251
logger.debug("Unknown state: %r", state)
252
else:
253
logger.debug("Unknown state: %r: %r", state, error)
254
218
def activate(self):
255
219
"""Derived from the Avahi example code"""
256
220
if self.server is None:
257
221
self.server = dbus.Interface(
258
222
self.bus.get_object(avahi.DBUS_NAME,
259
avahi.DBUS_PATH_SERVER,
260
follow_name_owner_changes=True),
223
avahi.DBUS_PATH_SERVER),
261
224
avahi.DBUS_INTERFACE_SERVER)
262
self.server.connect_to_signal("StateChanged",
225
self.server.connect_to_signal(u"StateChanged",
263
226
self.server_state_changed)
264
227
self.server_state_changed(self.server.GetState())
265
228
266
229
267
def _timedelta_to_milliseconds(td):
268
"Convert a datetime.timedelta() to milliseconds"
269
return ((td.days * 24 * 60 * 60 * 1000)
270
+ (td.seconds * 1000)
271
+ (td.microseconds // 1000))
272
273
230
class Client(object):
274
231
"""A representation of a client host served by this server.
275
232
276
233
Attributes:
277
_approved: bool(); 'None' if not yet approved/disapproved
278
approval_delay: datetime.timedelta(); Time to wait for approval
279
approval_duration: datetime.timedelta(); Duration of one approval
234
name: string; from the config file, used in log messages and
235
D-Bus identifiers
236
fingerprint: string (40 or 32 hexadecimal digits); used to
237
uniquely identify the client
238
secret: bytestring; sent verbatim (over TLS) to client
239
host: string; available for use by the checker command
240
created: datetime.datetime(); (UTC) object creation
241
last_enabled: datetime.datetime(); (UTC)
242
enabled: bool()
243
last_checked_ok: datetime.datetime(); (UTC) or None
244
timeout: datetime.timedelta(); How long from last_checked_ok
245
until this client is invalid
246
interval: datetime.timedelta(); How often to start a new checker
247
disable_hook: If set, called by disable() as disable_hook(self)
280
248
checker: subprocess.Popen(); a running checker process used
281
249
to see if the client lives.
282
250
'None' if no process is running.
283
checker_callback_tag: a gobject event source tag, or None
284
checker_command: string; External command which is run to check
285
if client lives. %() expansions are done at
251
checker_initiator_tag: a gobject event source tag, or None
252
disable_initiator_tag: - '' -
253
checker_callback_tag: - '' -
254
checker_command: string; External command which is run to check if
255
client lives. %() expansions are done at
286
256
runtime with vars(self) as dict, so that for
287
257
instance %(name)s can be used in the command.
288
checker_initiator_tag: a gobject event source tag, or None
289
created: datetime.datetime(); (UTC) object creation
290
258
current_checker_command: string; current running checker_command
291
disable_hook: If set, called by disable() as disable_hook(self)
292
disable_initiator_tag: a gobject event source tag, or None
293
enabled: bool()
294
fingerprint: string (40 or 32 hexadecimal digits); used to
295
uniquely identify the client
296
host: string; available for use by the checker command
297
interval: datetime.timedelta(); How often to start a new checker
298
last_approval_request: datetime.datetime(); (UTC) or None
299
last_checked_ok: datetime.datetime(); (UTC) or None
300
last_enabled: datetime.datetime(); (UTC)
301
name: string; from the config file, used in log messages and
302
D-Bus identifiers
303
secret: bytestring; sent verbatim (over TLS) to client
304
timeout: datetime.timedelta(); How long from last_checked_ok
305
until this client is disabled
306
extended_timeout: extra long timeout when password has been sent
307
runtime_expansions: Allowed attributes for runtime expansion.
308
expires: datetime.datetime(); time (UTC) when a client will be
309
disabled, or None
310
259
"""
311
260
312
runtime_expansions = ("approval_delay", "approval_duration",
313
"created", "enabled", "fingerprint",
314
"host", "interval", "last_checked_ok",
315
"last_enabled", "name", "timeout")
261
@staticmethod
262
def _timedelta_to_milliseconds(td):
263
"Convert a datetime.timedelta() to milliseconds"
264
return ((td.days * 24 * 60 * 60 * 1000)
265
+ (td.seconds * 1000)
266
+ (td.microseconds // 1000))
316
267
317
268
def timeout_milliseconds(self):
318
269
"Return the 'timeout' attribute in milliseconds"
319
return _timedelta_to_milliseconds(self.timeout)
320
321
def extended_timeout_milliseconds(self):
322
"Return the 'extended_timeout' attribute in milliseconds"
323
return _timedelta_to_milliseconds(self.extended_timeout)
270
return self._timedelta_to_milliseconds(self.timeout)
324
271
325
272
def interval_milliseconds(self):
326
273
"Return the 'interval' attribute in milliseconds"
327
return _timedelta_to_milliseconds(self.interval)
328
329
def approval_delay_milliseconds(self):
330
return _timedelta_to_milliseconds(self.approval_delay)
274
return self._timedelta_to_milliseconds(self.interval)
331
275
332
276
def __init__(self, name = None, disable_hook=None, config=None):
333
277
"""Note: the 'checker' key in 'config' sets the
336
280
self.name = name
337
281
if config is None:
338
282
config = {}
339
logger.debug("Creating client %r", self.name)
283
logger.debug(u"Creating client %r", self.name)
340
284
# Uppercase and remove spaces from fingerprint for later
341
285
# comparison purposes with return value from the fingerprint()
342
286
# function
343
self.fingerprint = (config["fingerprint"].upper()
344
.replace(" ", ""))
345
logger.debug(" Fingerprint: %s", self.fingerprint)
346
if "secret" in config:
347
self.secret = config["secret"].decode("base64")
348
elif "secfile" in config:
349
with open(os.path.expanduser(os.path.expandvars
350
(config["secfile"])),
351
"rb") as secfile:
287
self.fingerprint = (config[u"fingerprint"].upper()
288
.replace(u" ", u""))
289
logger.debug(u" Fingerprint: %s", self.fingerprint)
290
if u"secret" in config:
291
self.secret = config[u"secret"].decode(u"base64")
292
elif u"secfile" in config:
293
with closing(open(os.path.expanduser
294
(os.path.expandvars
295
(config[u"secfile"])),
296
"rb")) as secfile:
352
297
self.secret = secfile.read()
353
298
else:
354
raise TypeError("No secret or secfile for client %s"
299
raise TypeError(u"No secret or secfile for client %s"
355
300
% self.name)
356
self.host = config.get("host", "")
301
self.host = config.get(u"host", u"")
357
302
self.created = datetime.datetime.utcnow()
358
303
self.enabled = False
359
self.last_approval_request = None
360
304
self.last_enabled = None
361
305
self.last_checked_ok = None
362
self.timeout = string_to_delta(config["timeout"])
363
self.extended_timeout = string_to_delta(config["extended_timeout"])
364
self.interval = string_to_delta(config["interval"])
306
self.timeout = string_to_delta(config[u"timeout"])
307
self.interval = string_to_delta(config[u"interval"])
365
308
self.disable_hook = disable_hook
366
309
self.checker = None
367
310
self.checker_initiator_tag = None
368
311
self.disable_initiator_tag = None
369
self.expires = None
370
312
self.checker_callback_tag = None
371
self.checker_command = config["checker"]
313
self.checker_command = config[u"checker"]
372
314
self.current_checker_command = None
373
315
self.last_connect = None
374
self._approved = None
375
self.approved_by_default = config.get("approved_by_default",
376
True)
377
self.approvals_pending = 0
378
self.approval_delay = string_to_delta(
379
config["approval_delay"])
380
self.approval_duration = string_to_delta(
381
config["approval_duration"])
382
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
383
316
384
def send_changedstate(self):
385
self.changedstate.acquire()
386
self.changedstate.notify_all()
387
self.changedstate.release()
388
389
317
def enable(self):
390
318
"""Start this client's checker and timeout hooks"""
391
if getattr(self, "enabled", False):
319
if getattr(self, u"enabled", False):
392
320
# Already enabled
393
321
return
394
self.send_changedstate()
322
self.last_enabled = datetime.datetime.utcnow()
395
323
# Schedule a new checker to be started an 'interval' from now,
396
324
# and every interval from then on.
397
325
self.checker_initiator_tag = (gobject.timeout_add
398
326
(self.interval_milliseconds(),
399
327
self.start_checker))
328
# Also start a new checker *right now*.
329
self.start_checker()
400
330
# Schedule a disable() when 'timeout' has passed
401
self.expires = datetime.datetime.utcnow() + self.timeout
402
331
self.disable_initiator_tag = (gobject.timeout_add
403
332
(self.timeout_milliseconds(),
404
333
self.disable))
405
334
self.enabled = True
406
self.last_enabled = datetime.datetime.utcnow()
407
# Also start a new checker *right now*.
408
self.start_checker()
409
335
410
def disable(self, quiet=True):
336
def disable(self):
411
337
"""Disable this client."""
412
338
if not getattr(self, "enabled", False):
413
339
return False
414
if not quiet:
415
self.send_changedstate()
416
if not quiet:
417
logger.info("Disabling client %s", self.name)
418
if getattr(self, "disable_initiator_tag", False):
340
logger.info(u"Disabling client %s", self.name)
341
if getattr(self, u"disable_initiator_tag", False):
419
342
gobject.source_remove(self.disable_initiator_tag)
420
343
self.disable_initiator_tag = None
421
self.expires = None
422
if getattr(self, "checker_initiator_tag", False):
344
if getattr(self, u"checker_initiator_tag", False):
423
345
gobject.source_remove(self.checker_initiator_tag)
424
346
self.checker_initiator_tag = None
425
347
self.stop_checker()
440
362
if os.WIFEXITED(condition):
441
363
exitstatus = os.WEXITSTATUS(condition)
442
364
if exitstatus == 0:
443
logger.info("Checker for %(name)s succeeded",
365
logger.info(u"Checker for %(name)s succeeded",
444
366
vars(self))
445
367
self.checked_ok()
446
368
else:
447
logger.info("Checker for %(name)s failed",
369
logger.info(u"Checker for %(name)s failed",
448
370
vars(self))
449
371
else:
450
logger.warning("Checker for %(name)s crashed?",
372
logger.warning(u"Checker for %(name)s crashed?",
451
373
vars(self))
452
374
453
def checked_ok(self, timeout=None):
375
def checked_ok(self):
454
376
"""Bump up the timeout for this client.
455
377
456
378
This should only be called when the client has been seen,
457
379
alive and well.
458
380
"""
459
if timeout is None:
460
timeout = self.timeout
461
381
self.last_checked_ok = datetime.datetime.utcnow()
462
382
gobject.source_remove(self.disable_initiator_tag)
463
self.expires = datetime.datetime.utcnow() + timeout
464
383
self.disable_initiator_tag = (gobject.timeout_add
465
(_timedelta_to_milliseconds(timeout),
384
(self.timeout_milliseconds(),
466
385
self.disable))
467
386
468
def need_approval(self):
469
self.last_approval_request = datetime.datetime.utcnow()
470
471
387
def start_checker(self):
472
388
"""Start a new checker subprocess if one is not running.
473
389
479
395
# client would inevitably timeout, since no checker would get
480
396
# a chance to run to completion. If we instead leave running
481
397
# checkers alone, the checker would have to take more time
482
# than 'timeout' for the client to be disabled, which is as it
483
# should be.
398
# than 'timeout' for the client to be declared invalid, which
399
# is as it should be.
484
400
485
401
# If a checker exists, make sure it is not a zombie
486
402
try:
487
403
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
488
except (AttributeError, OSError) as error:
404
except (AttributeError, OSError), error:
489
405
if (isinstance(error, OSError)
490
406
and error.errno != errno.ECHILD):
491
407
raise error
492
408
else:
493
409
if pid:
494
logger.warning("Checker was a zombie")
410
logger.warning(u"Checker was a zombie")
495
411
gobject.source_remove(self.checker_callback_tag)
496
412
self.checker_callback(pid, status,
497
413
self.current_checker_command)
502
418
command = self.checker_command % self.host
503
419
except TypeError:
504
420
# Escape attributes for the shell
505
escaped_attrs = dict(
506
(attr,
507
re.escape(unicode(str(getattr(self, attr, "")),
508
errors=
509
'replace')))
510
for attr in
511
self.runtime_expansions)
512
421
escaped_attrs = dict((key,
422
re.escape(unicode(str(val),
423
errors=
424
u'replace')))
425
for key, val in
426
vars(self).iteritems())
513
427
try:
514
428
command = self.checker_command % escaped_attrs
515
except TypeError as error:
516
logger.error('Could not format string "%s":'
517
' %s', self.checker_command, error)
429
except TypeError, error:
430
logger.error(u'Could not format string "%s":'
431
u' %s', self.checker_command, error)
518
432
return True # Try again later
519
433
self.current_checker_command = command
520
434
try:
521
logger.info("Starting checker %r for %s",
435
logger.info(u"Starting checker %r for %s",
522
436
command, self.name)
523
437
# We don't need to redirect stdout and stderr, since
524
438
# in normal mode, that is already done by daemon(),
526
440
# always replaced by /dev/null.)
527
441
self.checker = subprocess.Popen(command,
528
442
close_fds=True,
529
shell=True, cwd="/")
443
shell=True, cwd=u"/")
530
444
self.checker_callback_tag = (gobject.child_watch_add
531
445
(self.checker.pid,
532
446
self.checker_callback,
537
451
if pid:
538
452
gobject.source_remove(self.checker_callback_tag)
539
453
self.checker_callback(pid, status, command)
540
except OSError as error:
541
logger.error("Failed to start subprocess: %s",
454
except OSError, error:
455
logger.error(u"Failed to start subprocess: %s",
542
456
error)
543
457
# Re-run this periodically if run by gobject.timeout_add
544
458
return True
548
462
if self.checker_callback_tag:
549
463
gobject.source_remove(self.checker_callback_tag)
550
464
self.checker_callback_tag = None
551
if getattr(self, "checker", None) is None:
465
if getattr(self, u"checker", None) is None:
552
466
return
553
logger.debug("Stopping checker for %(name)s", vars(self))
467
logger.debug(u"Stopping checker for %(name)s", vars(self))
554
468
try:
555
469
os.kill(self.checker.pid, signal.SIGTERM)
556
#time.sleep(0.5)
470
#os.sleep(0.5)
557
471
#if self.checker.poll() is None:
558
472
# os.kill(self.checker.pid, signal.SIGKILL)
559
except OSError as error:
473
except OSError, error:
560
474
if error.errno != errno.ESRCH: # No such process
561
475
raise
562
476
self.checker = None
563
564
565
def dbus_service_property(dbus_interface, signature="v",
566
access="readwrite", byte_arrays=False):
477
478
def still_valid(self):
479
"""Has the timeout not yet passed for this client?"""
480
if not getattr(self, u"enabled", False):
481
return False
482
now = datetime.datetime.utcnow()
483
if self.last_checked_ok is None:
484
return now < (self.created + self.timeout)
485
else:
486
return now < (self.last_checked_ok + self.timeout)
487
488
489
def dbus_service_property(dbus_interface, signature=u"v",
490
access=u"readwrite", byte_arrays=False):
567
491
"""Decorators for marking methods of a DBusObjectWithProperties to
568
492
become properties on the D-Bus.
569
493
574
498
dbus.service.method, except there is only "signature", since the
575
499
type from Get() and the type sent to Set() is the same.
576
500
"""
577
# Encoding deeply encoded byte arrays is not supported yet by the
578
# "Set" method, so we fail early here:
579
if byte_arrays and signature != "ay":
580
raise ValueError("Byte arrays not supported for non-'ay'"
581
" signature %r" % signature)
582
501
def decorator(func):
583
502
func._dbus_is_property = True
584
503
func._dbus_interface = dbus_interface
585
504
func._dbus_signature = signature
586
505
func._dbus_access = access
587
506
func._dbus_name = func.__name__
588
if func._dbus_name.endswith("_dbus_property"):
507
if func._dbus_name.endswith(u"_dbus_property"):
589
508
func._dbus_name = func._dbus_name[:-14]
590
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
509
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
591
510
return func
592
511
return decorator
593
512
613
532
614
533
class DBusObjectWithProperties(dbus.service.Object):
615
534
"""A D-Bus object with properties.
616
535
617
536
Classes inheriting from this can use the dbus_service_property
618
537
decorator to expose methods as D-Bus properties. It exposes the
619
538
standard Get(), Set(), and GetAll() methods on the D-Bus.
621
540
622
541
@staticmethod
623
542
def _is_dbus_property(obj):
624
return getattr(obj, "_dbus_is_property", False)
543
return getattr(obj, u"_dbus_is_property", False)
625
544
626
545
def _get_all_dbus_properties(self):
627
546
"""Returns a generator of (name, attribute) pairs
635
554
property with the specified name and interface.
636
555
"""
637
556
for name in (property_name,
638
property_name + "_dbus_property"):
557
property_name + u"_dbus_property"):
639
558
prop = getattr(self, name, None)
640
559
if (prop is None
641
560
or not self._is_dbus_property(prop)
645
564
continue
646
565
return prop
647
566
# No such property
648
raise DBusPropertyNotFound(self.dbus_object_path + ":"
649
+ interface_name + "."
567
raise DBusPropertyNotFound(self.dbus_object_path + u":"
568
+ interface_name + u"."
650
569
+ property_name)
651
570
652
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
653
out_signature="v")
571
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
572
out_signature=u"v")
654
573
def Get(self, interface_name, property_name):
655
574
"""Standard D-Bus property Get() method, see D-Bus standard.
656
575
"""
657
576
prop = self._get_dbus_property(interface_name, property_name)
658
if prop._dbus_access == "write":
577
if prop._dbus_access == u"write":
659
578
raise DBusPropertyAccessException(property_name)
660
579
value = prop()
661
if not hasattr(value, "variant_level"):
580
if not hasattr(value, u"variant_level"):
662
581
return value
663
582
return type(value)(value, variant_level=value.variant_level+1)
664
583
665
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
584
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
666
585
def Set(self, interface_name, property_name, value):
667
586
"""Standard D-Bus property Set() method, see D-Bus standard.
668
587
"""
669
588
prop = self._get_dbus_property(interface_name, property_name)
670
if prop._dbus_access == "read":
589
if prop._dbus_access == u"read":
671
590
raise DBusPropertyAccessException(property_name)
672
if prop._dbus_get_args_options["byte_arrays"]:
673
# The byte_arrays option is not supported yet on
674
# signatures other than "ay".
675
if prop._dbus_signature != "ay":
676
raise ValueError
591
if prop._dbus_get_args_options[u"byte_arrays"]:
677
592
value = dbus.ByteArray(''.join(unichr(byte)
678
593
for byte in value))
679
594
prop(value)
680
595
681
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
682
out_signature="a{sv}")
596
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
597
out_signature=u"a{sv}")
683
598
def GetAll(self, interface_name):
684
599
"""Standard D-Bus property GetAll() method, see D-Bus
685
600
standard.
686
601
687
602
Note: Will not include properties with access="write".
688
603
"""
689
604
all = {}
693
608
# Interface non-empty but did not match
694
609
continue
695
610
# Ignore write-only properties
696
if prop._dbus_access == "write":
611
if prop._dbus_access == u"write":
697
612
continue
698
613
value = prop()
699
if not hasattr(value, "variant_level"):
614
if not hasattr(value, u"variant_level"):
700
615
all[name] = value
701
616
continue
702
617
all[name] = type(value)(value, variant_level=
703
618
value.variant_level+1)
704
return dbus.Dictionary(all, signature="sv")
619
return dbus.Dictionary(all, signature=u"sv")
705
620
706
621
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
707
out_signature="s",
622
out_signature=u"s",
708
623
path_keyword='object_path',
709
624
connection_keyword='connection')
710
625
def Introspect(self, object_path, connection):
715
630
try:
716
631
document = xml.dom.minidom.parseString(xmlstring)
717
632
def make_tag(document, name, prop):
718
e = document.createElement("property")
719
e.setAttribute("name", name)
720
e.setAttribute("type", prop._dbus_signature)
721
e.setAttribute("access", prop._dbus_access)
633
e = document.createElement(u"property")
634
e.setAttribute(u"name", name)
635
e.setAttribute(u"type", prop._dbus_signature)
636
e.setAttribute(u"access", prop._dbus_access)
722
637
return e
723
for if_tag in document.getElementsByTagName("interface"):
638
for if_tag in document.getElementsByTagName(u"interface"):
724
639
for tag in (make_tag(document, name, prop)
725
640
for name, prop
726
641
in self._get_all_dbus_properties()
727
642
if prop._dbus_interface
728
== if_tag.getAttribute("name")):
643
== if_tag.getAttribute(u"name")):
729
644
if_tag.appendChild(tag)
730
645
# Add the names to the return values for the
731
646
# "org.freedesktop.DBus.Properties" methods
732
if (if_tag.getAttribute("name")
733
== "org.freedesktop.DBus.Properties"):
734
for cn in if_tag.getElementsByTagName("method"):
735
if cn.getAttribute("name") == "Get":
736
for arg in cn.getElementsByTagName("arg"):
737
if (arg.getAttribute("direction")
738
== "out"):
739
arg.setAttribute("name", "value")
740
elif cn.getAttribute("name") == "GetAll":
741
for arg in cn.getElementsByTagName("arg"):
742
if (arg.getAttribute("direction")
743
== "out"):
744
arg.setAttribute("name", "props")
745
xmlstring = document.toxml("utf-8")
647
if (if_tag.getAttribute(u"name")
648
== u"org.freedesktop.DBus.Properties"):
649
for cn in if_tag.getElementsByTagName(u"method"):
650
if cn.getAttribute(u"name") == u"Get":
651
for arg in cn.getElementsByTagName(u"arg"):
652
if (arg.getAttribute(u"direction")
653
== u"out"):
654
arg.setAttribute(u"name", u"value")
655
elif cn.getAttribute(u"name") == u"GetAll":
656
for arg in cn.getElementsByTagName(u"arg"):
657
if (arg.getAttribute(u"direction")
658
== u"out"):
659
arg.setAttribute(u"name", u"props")
660
xmlstring = document.toxml(u"utf-8")
746
661
document.unlink()
747
662
except (AttributeError, xml.dom.DOMException,
748
xml.parsers.expat.ExpatError) as error:
749
logger.error("Failed to override Introspection method",
663
xml.parsers.expat.ExpatError), error:
664
logger.error(u"Failed to override Introspection method",
750
665
error)
751
666
return xmlstring
752
667
753
668
754
def datetime_to_dbus (dt, variant_level=0):
755
"""Convert a UTC datetime.datetime() to a D-Bus type."""
756
if dt is None:
757
return dbus.String("", variant_level = variant_level)
758
return dbus.String(dt.isoformat(),
759
variant_level=variant_level)
760
761
762
669
class ClientDBus(Client, DBusObjectWithProperties):
763
670
"""A Client class using D-Bus
764
671
766
673
dbus_object_path: dbus.ObjectPath
767
674
bus: dbus.SystemBus()
768
675
"""
769
770
runtime_expansions = (Client.runtime_expansions
771
+ ("dbus_object_path",))
772
773
676
# dbus.service.Object doesn't use super(), so we can't either.
774
677
775
678
def __init__(self, bus = None, *args, **kwargs):
776
self._approvals_pending = 0
777
679
self.bus = bus
778
680
Client.__init__(self, *args, **kwargs)
779
681
# Only now, when this client is initialized, can it show up on
780
682
# the D-Bus
781
client_object_name = unicode(self.name).translate(
782
{ord("."): ord("_"),
783
ord("-"): ord("_")})
784
683
self.dbus_object_path = (dbus.ObjectPath
785
("/clients/" + client_object_name))
684
(u"/clients/"
685
+ self.name.replace(u".", u"_")))
786
686
DBusObjectWithProperties.__init__(self, self.bus,
787
687
self.dbus_object_path)
788
789
def notifychangeproperty(transform_func,
790
dbus_name, type_func=lambda x: x,
791
variant_level=1):
792
""" Modify a variable so that its a property that announce its
793
changes to DBus.
794
transform_fun: Function that takes a value and transform it to
795
DBus type.
796
dbus_name: DBus name of the variable
797
type_func: Function that transform the value before sending it
798
to DBus
799
variant_level: DBus variant level. default: 1
800
"""
801
real_value = [None,]
802
def setter(self, value):
803
old_value = real_value[0]
804
real_value[0] = value
805
if hasattr(self, "dbus_object_path"):
806
if type_func(old_value) != type_func(real_value[0]):
807
dbus_value = transform_func(type_func(real_value[0]),
808
variant_level)
809
self.PropertyChanged(dbus.String(dbus_name),
810
dbus_value)
811
812
return property(lambda self: real_value[0], setter)
813
814
815
expires = notifychangeproperty(datetime_to_dbus, "Expires")
816
approvals_pending = notifychangeproperty(dbus.Boolean,
817
"ApprovalPending",
818
type_func = bool)
819
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
820
last_enabled = notifychangeproperty(datetime_to_dbus,
821
"LastEnabled")
822
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
823
type_func = lambda checker: checker is not None)
824
last_checked_ok = notifychangeproperty(datetime_to_dbus,
825
"LastCheckedOK")
826
last_approval_request = notifychangeproperty(datetime_to_dbus,
827
"LastApprovalRequest")
828
approved_by_default = notifychangeproperty(dbus.Boolean,
829
"ApprovedByDefault")
830
approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",
831
type_func = _timedelta_to_milliseconds)
832
approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",
833
type_func = _timedelta_to_milliseconds)
834
host = notifychangeproperty(dbus.String, "Host")
835
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
836
type_func = _timedelta_to_milliseconds)
837
extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",
838
type_func = _timedelta_to_milliseconds)
839
interval = notifychangeproperty(dbus.UInt16, "Interval",
840
type_func = _timedelta_to_milliseconds)
841
checker_command = notifychangeproperty(dbus.String, "Checker")
842
843
del notifychangeproperty
688
689
@staticmethod
690
def _datetime_to_dbus(dt, variant_level=0):
691
"""Convert a UTC datetime.datetime() to a D-Bus type."""
692
return dbus.String(dt.isoformat(),
693
variant_level=variant_level)
694
695
def enable(self):
696
oldstate = getattr(self, u"enabled", False)
697
r = Client.enable(self)
698
if oldstate != self.enabled:
699
# Emit D-Bus signals
700
self.PropertyChanged(dbus.String(u"enabled"),
701
dbus.Boolean(True, variant_level=1))
702
self.PropertyChanged(
703
dbus.String(u"last_enabled"),
704
self._datetime_to_dbus(self.last_enabled,
705
variant_level=1))
706
return r
707
708
def disable(self, signal = True):
709
oldstate = getattr(self, u"enabled", False)
710
r = Client.disable(self)
711
if signal and oldstate != self.enabled:
712
# Emit D-Bus signal
713
self.PropertyChanged(dbus.String(u"enabled"),
714
dbus.Boolean(False, variant_level=1))
715
return r
844
716
845
717
def __del__(self, *args, **kwargs):
846
718
try:
847
719
self.remove_from_connection()
848
720
except LookupError:
849
721
pass
850
if hasattr(DBusObjectWithProperties, "__del__"):
722
if hasattr(DBusObjectWithProperties, u"__del__"):
851
723
DBusObjectWithProperties.__del__(self, *args, **kwargs)
852
724
Client.__del__(self, *args, **kwargs)
853
725
855
727
*args, **kwargs):
856
728
self.checker_callback_tag = None
857
729
self.checker = None
730
# Emit D-Bus signal
731
self.PropertyChanged(dbus.String(u"checker_running"),
732
dbus.Boolean(False, variant_level=1))
858
733
if os.WIFEXITED(condition):
859
734
exitstatus = os.WEXITSTATUS(condition)
860
735
# Emit D-Bus signal
870
745
return Client.checker_callback(self, pid, condition, command,
871
746
*args, **kwargs)
872
747
748
def checked_ok(self, *args, **kwargs):
749
r = Client.checked_ok(self, *args, **kwargs)
750
# Emit D-Bus signal
751
self.PropertyChanged(
752
dbus.String(u"last_checked_ok"),
753
(self._datetime_to_dbus(self.last_checked_ok,
754
variant_level=1)))
755
return r
756
873
757
def start_checker(self, *args, **kwargs):
874
758
old_checker = self.checker
875
759
if self.checker is not None:
882
766
and old_checker_pid != self.checker.pid):
883
767
# Emit D-Bus signal
884
768
self.CheckerStarted(self.current_checker_command)
885
return r
886
887
def _reset_approved(self):
888
self._approved = None
889
return False
890
891
def approve(self, value=True):
892
self.send_changedstate()
893
self._approved = value
894
gobject.timeout_add(_timedelta_to_milliseconds
895
(self.approval_duration),
896
self._reset_approved)
897
898
899
## D-Bus methods, signals & properties
900
_interface = "se.bsnet.fukt.Mandos.Client"
901
902
## Signals
769
self.PropertyChanged(
770
dbus.String(u"checker_running"),
771
dbus.Boolean(True, variant_level=1))
772
return r
773
774
def stop_checker(self, *args, **kwargs):
775
old_checker = getattr(self, u"checker", None)
776
r = Client.stop_checker(self, *args, **kwargs)
777
if (old_checker is not None
778
and getattr(self, u"checker", None) is None):
779
self.PropertyChanged(dbus.String(u"checker_running"),
780
dbus.Boolean(False, variant_level=1))
781
return r
782
783
## D-Bus methods & signals
784
_interface = u"se.bsnet.fukt.Mandos.Client"
785
786
# CheckedOK - method
787
@dbus.service.method(_interface)
788
def CheckedOK(self):
789
return self.checked_ok()
903
790
904
791
# CheckerCompleted - signal
905
@dbus.service.signal(_interface, signature="nxs")
792
@dbus.service.signal(_interface, signature=u"nxs")
906
793
def CheckerCompleted(self, exitcode, waitstatus, command):
907
794
"D-Bus signal"
908
795
pass
909
796
910
797
# CheckerStarted - signal
911
@dbus.service.signal(_interface, signature="s")
798
@dbus.service.signal(_interface, signature=u"s")
912
799
def CheckerStarted(self, command):
913
800
"D-Bus signal"
914
801
pass
915
802
916
803
# PropertyChanged - signal
917
@dbus.service.signal(_interface, signature="sv")
804
@dbus.service.signal(_interface, signature=u"sv")
918
805
def PropertyChanged(self, property, value):
919
806
"D-Bus signal"
920
807
pass
922
809
# GotSecret - signal
923
810
@dbus.service.signal(_interface)
924
811
def GotSecret(self):
925
"""D-Bus signal
926
Is sent after a successful transfer of secret from the Mandos
927
server to mandos-client
928
"""
812
"D-Bus signal"
929
813
pass
930
814
931
815
# Rejected - signal
932
@dbus.service.signal(_interface, signature="s")
933
def Rejected(self, reason):
816
@dbus.service.signal(_interface)
817
def Rejected(self):
934
818
"D-Bus signal"
935
819
pass
936
820
937
# NeedApproval - signal
938
@dbus.service.signal(_interface, signature="tb")
939
def NeedApproval(self, timeout, default):
940
"D-Bus signal"
941
return self.need_approval()
942
943
## Methods
944
945
# Approve - method
946
@dbus.service.method(_interface, in_signature="b")
947
def Approve(self, value):
948
self.approve(value)
949
950
# CheckedOK - method
951
@dbus.service.method(_interface)
952
def CheckedOK(self):
953
self.checked_ok()
954
955
821
# Enable - method
956
822
@dbus.service.method(_interface)
957
823
def Enable(self):
975
841
def StopChecker(self):
976
842
self.stop_checker()
977
843
978
## Properties
979
980
# ApprovalPending - property
981
@dbus_service_property(_interface, signature="b", access="read")
982
def ApprovalPending_dbus_property(self):
983
return dbus.Boolean(bool(self.approvals_pending))
984
985
# ApprovedByDefault - property
986
@dbus_service_property(_interface, signature="b",
987
access="readwrite")
988
def ApprovedByDefault_dbus_property(self, value=None):
989
if value is None: # get
990
return dbus.Boolean(self.approved_by_default)
991
self.approved_by_default = bool(value)
992
993
# ApprovalDelay - property
994
@dbus_service_property(_interface, signature="t",
995
access="readwrite")
996
def ApprovalDelay_dbus_property(self, value=None):
997
if value is None: # get
998
return dbus.UInt64(self.approval_delay_milliseconds())
999
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1000
1001
# ApprovalDuration - property
1002
@dbus_service_property(_interface, signature="t",
1003
access="readwrite")
1004
def ApprovalDuration_dbus_property(self, value=None):
1005
if value is None: # get
1006
return dbus.UInt64(_timedelta_to_milliseconds(
1007
self.approval_duration))
1008
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1009
1010
# Name - property
1011
@dbus_service_property(_interface, signature="s", access="read")
1012
def Name_dbus_property(self):
844
# name - property
845
@dbus_service_property(_interface, signature=u"s", access=u"read")
846
def name_dbus_property(self):
1013
847
return dbus.String(self.name)
1014
848
1015
# Fingerprint - property
1016
@dbus_service_property(_interface, signature="s", access="read")
1017
def Fingerprint_dbus_property(self):
849
# fingerprint - property
850
@dbus_service_property(_interface, signature=u"s", access=u"read")
851
def fingerprint_dbus_property(self):
1018
852
return dbus.String(self.fingerprint)
1019
853
1020
# Host - property
1021
@dbus_service_property(_interface, signature="s",
1022
access="readwrite")
1023
def Host_dbus_property(self, value=None):
854
# host - property
855
@dbus_service_property(_interface, signature=u"s",
856
access=u"readwrite")
857
def host_dbus_property(self, value=None):
1024
858
if value is None: # get
1025
859
return dbus.String(self.host)
1026
860
self.host = value
1027
1028
# Created - property
1029
@dbus_service_property(_interface, signature="s", access="read")
1030
def Created_dbus_property(self):
1031
return dbus.String(datetime_to_dbus(self.created))
1032
1033
# LastEnabled - property
1034
@dbus_service_property(_interface, signature="s", access="read")
1035
def LastEnabled_dbus_property(self):
1036
return datetime_to_dbus(self.last_enabled)
1037
1038
# Enabled - property
1039
@dbus_service_property(_interface, signature="b",
1040
access="readwrite")
1041
def Enabled_dbus_property(self, value=None):
861
# Emit D-Bus signal
862
self.PropertyChanged(dbus.String(u"host"),
863
dbus.String(value, variant_level=1))
864
865
# created - property
866
@dbus_service_property(_interface, signature=u"s", access=u"read")
867
def created_dbus_property(self):
868
return dbus.String(self._datetime_to_dbus(self.created))
869
870
# last_enabled - property
871
@dbus_service_property(_interface, signature=u"s", access=u"read")
872
def last_enabled_dbus_property(self):
873
if self.last_enabled is None:
874
return dbus.String(u"")
875
return dbus.String(self._datetime_to_dbus(self.last_enabled))
876
877
# enabled - property
878
@dbus_service_property(_interface, signature=u"b",
879
access=u"readwrite")
880
def enabled_dbus_property(self, value=None):
1042
881
if value is None: # get
1043
882
return dbus.Boolean(self.enabled)
1044
883
if value:
1046
885
else:
1047
886
self.disable()
1048
887
1049
# LastCheckedOK - property
1050
@dbus_service_property(_interface, signature="s",
1051
access="readwrite")
1052
def LastCheckedOK_dbus_property(self, value=None):
888
# last_checked_ok - property
889
@dbus_service_property(_interface, signature=u"s",
890
access=u"readwrite")
891
def last_checked_ok_dbus_property(self, value=None):
1053
892
if value is not None:
1054
893
self.checked_ok()
1055
894
return
1056
return datetime_to_dbus(self.last_checked_ok)
1057
1058
# Expires - property
1059
@dbus_service_property(_interface, signature="s", access="read")
1060
def Expires_dbus_property(self):
1061
return datetime_to_dbus(self.expires)
1062
1063
# LastApprovalRequest - property
1064
@dbus_service_property(_interface, signature="s", access="read")
1065
def LastApprovalRequest_dbus_property(self):
1066
return datetime_to_dbus(self.last_approval_request)
1067
1068
# Timeout - property
1069
@dbus_service_property(_interface, signature="t",
1070
access="readwrite")
1071
def Timeout_dbus_property(self, value=None):
895
if self.last_checked_ok is None:
896
return dbus.String(u"")
897
return dbus.String(self._datetime_to_dbus(self
898
.last_checked_ok))
899
900
# timeout - property
901
@dbus_service_property(_interface, signature=u"t",
902
access=u"readwrite")
903
def timeout_dbus_property(self, value=None):
1072
904
if value is None: # get
1073
905
return dbus.UInt64(self.timeout_milliseconds())
1074
906
self.timeout = datetime.timedelta(0, 0, 0, value)
1075
if getattr(self, "disable_initiator_tag", None) is None:
907
# Emit D-Bus signal
908
self.PropertyChanged(dbus.String(u"timeout"),
909
dbus.UInt64(value, variant_level=1))
910
if getattr(self, u"disable_initiator_tag", None) is None:
1076
911
return
1077
912
# Reschedule timeout
1078
913
gobject.source_remove(self.disable_initiator_tag)
1079
914
self.disable_initiator_tag = None
1080
self.expires = None
1081
915
time_to_die = (self.
1082
916
_timedelta_to_milliseconds((self
1083
917
.last_checked_ok
1088
922
# The timeout has passed
1089
923
self.disable()
1090
924
else:
1091
self.expires = (datetime.datetime.utcnow()
1092
+ datetime.timedelta(milliseconds = time_to_die))
1093
925
self.disable_initiator_tag = (gobject.timeout_add
1094
926
(time_to_die, self.disable))
1095
927
1096
# ExtendedTimeout - property
1097
@dbus_service_property(_interface, signature="t",
1098
access="readwrite")
1099
def ExtendedTimeout_dbus_property(self, value=None):
1100
if value is None: # get
1101
return dbus.UInt64(self.extended_timeout_milliseconds())
1102
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1103
1104
# Interval - property
1105
@dbus_service_property(_interface, signature="t",
1106
access="readwrite")
1107
def Interval_dbus_property(self, value=None):
928
# interval - property
929
@dbus_service_property(_interface, signature=u"t",
930
access=u"readwrite")
931
def interval_dbus_property(self, value=None):
1108
932
if value is None: # get
1109
933
return dbus.UInt64(self.interval_milliseconds())
1110
934
self.interval = datetime.timedelta(0, 0, 0, value)
1111
if getattr(self, "checker_initiator_tag", None) is None:
935
# Emit D-Bus signal
936
self.PropertyChanged(dbus.String(u"interval"),
937
dbus.UInt64(value, variant_level=1))
938
if getattr(self, u"checker_initiator_tag", None) is None:
1112
939
return
1113
940
# Reschedule checker run
1114
941
gobject.source_remove(self.checker_initiator_tag)
1115
942
self.checker_initiator_tag = (gobject.timeout_add
1116
943
(value, self.start_checker))
1117
944
self.start_checker() # Start one now, too
1118
1119
# Checker - property
1120
@dbus_service_property(_interface, signature="s",
1121
access="readwrite")
1122
def Checker_dbus_property(self, value=None):
945
946
# checker - property
947
@dbus_service_property(_interface, signature=u"s",
948
access=u"readwrite")
949
def checker_dbus_property(self, value=None):
1123
950
if value is None: # get
1124
951
return dbus.String(self.checker_command)
1125
952
self.checker_command = value
953
# Emit D-Bus signal
954
self.PropertyChanged(dbus.String(u"checker"),
955
dbus.String(self.checker_command,
956
variant_level=1))
1126
957
1127
# CheckerRunning - property
1128
@dbus_service_property(_interface, signature="b",
1129
access="readwrite")
1130
def CheckerRunning_dbus_property(self, value=None):
958
# checker_running - property
959
@dbus_service_property(_interface, signature=u"b",
960
access=u"readwrite")
961
def checker_running_dbus_property(self, value=None):
1131
962
if value is None: # get
1132
963
return dbus.Boolean(self.checker is not None)
1133
964
if value:
1135
966
else:
1136
967
self.stop_checker()
1137
968
1138
# ObjectPath - property
1139
@dbus_service_property(_interface, signature="o", access="read")
1140
def ObjectPath_dbus_property(self):
969
# object_path - property
970
@dbus_service_property(_interface, signature=u"o", access=u"read")
971
def object_path_dbus_property(self):
1141
972
return self.dbus_object_path # is already a dbus.ObjectPath
1142
973
1143
# Secret = property
1144
@dbus_service_property(_interface, signature="ay",
1145
access="write", byte_arrays=True)
1146
def Secret_dbus_property(self, value):
974
# secret = property
975
@dbus_service_property(_interface, signature=u"ay",
976
access=u"write", byte_arrays=True)
977
def secret_dbus_property(self, value):
1147
978
self.secret = str(value)
1148
979
1149
980
del _interface
1150
981
1151
982
1152
class ProxyClient(object):
1153
def __init__(self, child_pipe, fpr, address):
1154
self._pipe = child_pipe
1155
self._pipe.send(('init', fpr, address))
1156
if not self._pipe.recv():
1157
raise KeyError()
1158
1159
def __getattribute__(self, name):
1160
if(name == '_pipe'):
1161
return super(ProxyClient, self).__getattribute__(name)
1162
self._pipe.send(('getattr', name))
1163
data = self._pipe.recv()
1164
if data[0] == 'data':
1165
return data[1]
1166
if data[0] == 'function':
1167
def func(*args, **kwargs):
1168
self._pipe.send(('funcall', name, args, kwargs))
1169
return self._pipe.recv()[1]
1170
return func
1171
1172
def __setattr__(self, name, value):
1173
if(name == '_pipe'):
1174
return super(ProxyClient, self).__setattr__(name, value)
1175
self._pipe.send(('setattr', name, value))
1176
1177
1178
983
class ClientHandler(socketserver.BaseRequestHandler, object):
1179
984
"""A class to handle client connections.
1180
985
1182
987
Note: This will run in its own forked process."""
1183
988
1184
989
def handle(self):
1185
with contextlib.closing(self.server.child_pipe) as child_pipe:
1186
logger.info("TCP connection from: %s",
1187
unicode(self.client_address))
1188
logger.debug("Pipe FD: %d",
1189
self.server.child_pipe.fileno())
1190
990
logger.info(u"TCP connection from: %s",
991
unicode(self.client_address))
992
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
993
# Open IPC pipe to parent process
994
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
1191
995
session = (gnutls.connection
1192
996
.ClientSession(self.request,
1193
997
gnutls.connection
1194
998
.X509Credentials()))
1195
999
1000
line = self.request.makefile().readline()
1001
logger.debug(u"Protocol version: %r", line)
1002
try:
1003
if int(line.strip().split()[0]) > 1:
1004
raise RuntimeError
1005
except (ValueError, IndexError, RuntimeError), error:
1006
logger.error(u"Unknown protocol version: %s", error)
1007
return
1008
1196
1009
# Note: gnutls.connection.X509Credentials is really a
1197
1010
# generic GnuTLS certificate credentials object so long as
1198
1011
# no X.509 keys are added to it. Therefore, we can use it
1199
1012
# here despite using OpenPGP certificates.
1200
1013
1201
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1202
# "+AES-256-CBC", "+SHA1",
1203
# "+COMP-NULL", "+CTYPE-OPENPGP",
1204
# "+DHE-DSS"))
1014
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1015
# u"+AES-256-CBC", u"+SHA1",
1016
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1017
# u"+DHE-DSS"))
1205
1018
# Use a fallback default, since this MUST be set.
1206
1019
priority = self.server.gnutls_priority
1207
1020
if priority is None:
1208
priority = "NORMAL"
1021
priority = u"NORMAL"
1209
1022
(gnutls.library.functions
1210
1023
.gnutls_priority_set_direct(session._c_object,
1211
1024
priority, None))
1212
1025
1213
# Start communication using the Mandos protocol
1214
# Get protocol number
1215
line = self.request.makefile().readline()
1216
logger.debug("Protocol version: %r", line)
1217
try:
1218
if int(line.strip().split()[0]) > 1:
1219
raise RuntimeError
1220
except (ValueError, IndexError, RuntimeError) as error:
1221
logger.error("Unknown protocol version: %s", error)
1222
return
1223
1224
# Start GnuTLS connection
1225
1026
try:
1226
1027
session.handshake()
1227
except gnutls.errors.GNUTLSError as error:
1228
logger.warning("Handshake failed: %s", error)
1028
except gnutls.errors.GNUTLSError, error:
1029
logger.warning(u"Handshake failed: %s", error)
1229
1030
# Do not run session.bye() here: the session is not
1230
1031
# established. Just abandon the request.
1231
1032
return
1232
logger.debug("Handshake succeeded")
1233
1234
approval_required = False
1033
logger.debug(u"Handshake succeeded")
1235
1034
try:
1236
try:
1237
fpr = self.fingerprint(self.peer_certificate
1238
(session))
1239
except (TypeError,
1240
gnutls.errors.GNUTLSError) as error:
1241
logger.warning("Bad certificate: %s", error)
1242
return
1243
logger.debug("Fingerprint: %s", fpr)
1244
1245
try:
1246
client = ProxyClient(child_pipe, fpr,
1247
self.client_address)
1248
except KeyError:
1249
return
1250
1251
if client.approval_delay:
1252
delay = client.approval_delay
1253
client.approvals_pending += 1
1254
approval_required = True
1255
1256
while True:
1257
if not client.enabled:
1258
logger.info("Client %s is disabled",
1259
client.name)
1260
if self.server.use_dbus:
1261
# Emit D-Bus signal
1262
client.Rejected("Disabled")
1263
return
1264
1265
if client._approved or not client.approval_delay:
1266
#We are approved or approval is disabled
1267
break
1268
elif client._approved is None:
1269
logger.info("Client %s needs approval",
1270
client.name)
1271
if self.server.use_dbus:
1272
# Emit D-Bus signal
1273
client.NeedApproval(
1274
client.approval_delay_milliseconds(),
1275
client.approved_by_default)
1276
else:
1277
logger.warning("Client %s was not approved",
1278
client.name)
1279
if self.server.use_dbus:
1280
# Emit D-Bus signal
1281
client.Rejected("Denied")
1282
return
1283
1284
#wait until timeout or approved
1285
#x = float(client._timedelta_to_milliseconds(delay))
1286
time = datetime.datetime.now()
1287
client.changedstate.acquire()
1288
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1289
client.changedstate.release()
1290
time2 = datetime.datetime.now()
1291
if (time2 - time) >= delay:
1292
if not client.approved_by_default:
1293
logger.warning("Client %s timed out while"
1294
" waiting for approval",
1295
client.name)
1296
if self.server.use_dbus:
1297
# Emit D-Bus signal
1298
client.Rejected("Approval timed out")
1299
return
1300
else:
1301
break
1302
else:
1303
delay -= time2 - time
1304
1305
sent_size = 0
1306
while sent_size < len(client.secret):
1307
try:
1308
sent = session.send(client.secret[sent_size:])
1309
except gnutls.errors.GNUTLSError as error:
1310
logger.warning("gnutls send failed")
1311
return
1312
logger.debug("Sent: %d, remaining: %d",
1313
sent, len(client.secret)
1314
- (sent_size + sent))
1315
sent_size += sent
1316
1317
logger.info("Sending secret to %s", client.name)
1318
# bump the timeout as if seen
1319
client.checked_ok(client.extended_timeout)
1320
if self.server.use_dbus:
1321
# Emit D-Bus signal
1322
client.GotSecret()
1035
fpr = self.fingerprint(self.peer_certificate(session))
1036
except (TypeError, gnutls.errors.GNUTLSError), error:
1037
logger.warning(u"Bad certificate: %s", error)
1038
session.bye()
1039
return
1040
logger.debug(u"Fingerprint: %s", fpr)
1323
1041
1324
finally:
1325
if approval_required:
1326
client.approvals_pending -= 1
1327
try:
1328
session.bye()
1329
except gnutls.errors.GNUTLSError as error:
1330
logger.warning("GnuTLS bye failed")
1042
for c in self.server.clients:
1043
if c.fingerprint == fpr:
1044
client = c
1045
break
1046
else:
1047
ipc.write(u"NOTFOUND %s %s\n"
1048
% (fpr, unicode(self.client_address)))
1049
session.bye()
1050
return
1051
# Have to check if client.still_valid(), since it is
1052
# possible that the client timed out while establishing
1053
# the GnuTLS session.
1054
if not client.still_valid():
1055
ipc.write(u"INVALID %s\n" % client.name)
1056
session.bye()
1057
return
1058
ipc.write(u"SENDING %s\n" % client.name)
1059
sent_size = 0
1060
while sent_size < len(client.secret):
1061
sent = session.send(client.secret[sent_size:])
1062
logger.debug(u"Sent: %d, remaining: %d",
1063
sent, len(client.secret)
1064
- (sent_size + sent))
1065
sent_size += sent
1066
session.bye()
1331
1067
1332
1068
@staticmethod
1333
1069
def peer_certificate(session):
1343
1079
.gnutls_certificate_get_peers
1344
1080
(session._c_object, ctypes.byref(list_size)))
1345
1081
if not bool(cert_list) and list_size.value != 0:
1346
raise gnutls.errors.GNUTLSError("error getting peer"
1347
" certificate")
1082
raise gnutls.errors.GNUTLSError(u"error getting peer"
1083
u" certificate")
1348
1084
if list_size.value == 0:
1349
1085
return None
1350
1086
cert = cert_list[0]
1376
1112
if crtverify.value != 0:
1377
1113
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1378
1114
raise (gnutls.errors.CertificateSecurityError
1379
("Verify failed"))
1115
(u"Verify failed"))
1380
1116
# New buffer for the fingerprint
1381
1117
buf = ctypes.create_string_buffer(20)
1382
1118
buf_len = ctypes.c_size_t()
1389
1125
# Convert the buffer to a Python bytestring
1390
1126
fpr = ctypes.string_at(buf, buf_len.value)
1391
1127
# Convert the bytestring to hexadecimal notation
1392
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1128
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1393
1129
return hex_fpr
1394
1130
1395
1131
1396
class MultiprocessingMixIn(object):
1397
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1398
def sub_process_main(self, request, address):
1399
try:
1400
self.finish_request(request, address)
1401
except:
1402
self.handle_error(request, address)
1403
self.close_request(request)
1404
1405
def process_request(self, request, address):
1406
"""Start a new process to process the request."""
1407
multiprocessing.Process(target = self.sub_process_main,
1408
args = (request, address)).start()
1409
1410
1411
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1412
""" adds a pipe to the MixIn """
1132
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
1133
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
1413
1134
def process_request(self, request, client_address):
1414
1135
"""Overrides and wraps the original process_request().
1415
1136
1416
1137
This function creates a new pipe in self.pipe
1417
1138
"""
1418
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1419
1420
super(MultiprocessingMixInWithPipe,
1139
self.pipe = os.pipe()
1140
super(ForkingMixInWithPipe,
1421
1141
self).process_request(request, client_address)
1422
self.child_pipe.close()
1423
self.add_pipe(parent_pipe)
1424
1425
def add_pipe(self, parent_pipe):
1142
os.close(self.pipe[1]) # close write end
1143
self.add_pipe(self.pipe[0])
1144
def add_pipe(self, pipe):
1426
1145
"""Dummy function; override as necessary"""
1427
raise NotImplementedError
1428
1429
1430
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1146
os.close(pipe)
1147
1148
1149
class IPv6_TCPServer(ForkingMixInWithPipe,
1431
1150
socketserver.TCPServer, object):
1432
1151
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1433
1152
1449
1168
bind to an address or port if they were not specified."""
1450
1169
if self.interface is not None:
1451
1170
if SO_BINDTODEVICE is None:
1452
logger.error("SO_BINDTODEVICE does not exist;"
1453
" cannot bind to interface %s",
1171
logger.error(u"SO_BINDTODEVICE does not exist;"
1172
u" cannot bind to interface %s",
1454
1173
self.interface)
1455
1174
else:
1456
1175
try:
1457
1176
self.socket.setsockopt(socket.SOL_SOCKET,
1458
1177
SO_BINDTODEVICE,
1459
1178
str(self.interface
1460
+ '\0'))
1461
except socket.error as error:
1179
+ u'\0'))
1180
except socket.error, error:
1462
1181
if error[0] == errno.EPERM:
1463
logger.error("No permission to"
1464
" bind to interface %s",
1182
logger.error(u"No permission to"
1183
u" bind to interface %s",
1465
1184
self.interface)
1466
1185
elif error[0] == errno.ENOPROTOOPT:
1467
logger.error("SO_BINDTODEVICE not available;"
1468
" cannot bind to interface %s",
1186
logger.error(u"SO_BINDTODEVICE not available;"
1187
u" cannot bind to interface %s",
1469
1188
self.interface)
1470
1189
else:
1471
1190
raise
1473
1192
if self.server_address[0] or self.server_address[1]:
1474
1193
if not self.server_address[0]:
1475
1194
if self.address_family == socket.AF_INET6:
1476
any_address = "::" # in6addr_any
1195
any_address = u"::" # in6addr_any
1477
1196
else:
1478
1197
any_address = socket.INADDR_ANY
1479
1198
self.server_address = (any_address,
1518
1237
return socketserver.TCPServer.server_activate(self)
1519
1238
def enable(self):
1520
1239
self.enabled = True
1521
def add_pipe(self, parent_pipe):
1240
def add_pipe(self, pipe):
1522
1241
# Call "handle_ipc" for both data and EOF events
1523
gobject.io_add_watch(parent_pipe.fileno(),
1524
gobject.IO_IN | gobject.IO_HUP,
1525
functools.partial(self.handle_ipc,
1526
parent_pipe = parent_pipe))
1527
1528
def handle_ipc(self, source, condition, parent_pipe=None,
1529
client_object=None):
1242
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1243
self.handle_ipc)
1244
def handle_ipc(self, source, condition, file_objects={}):
1530
1245
condition_names = {
1531
gobject.IO_IN: "IN", # There is data to read.
1532
gobject.IO_OUT: "OUT", # Data can be written (without
1246
gobject.IO_IN: u"IN", # There is data to read.
1247
gobject.IO_OUT: u"OUT", # Data can be written (without
1533
1248
# blocking).
1534
gobject.IO_PRI: "PRI", # There is urgent data to read.
1535
gobject.IO_ERR: "ERR", # Error condition.
1536
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1249
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1250
gobject.IO_ERR: u"ERR", # Error condition.
1251
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1537
1252
# broken, usually for pipes and
1538
1253
# sockets).
1539
1254
}
1541
1256
for cond, name in
1542
1257
condition_names.iteritems()
1543
1258
if cond & condition)
1544
# error or the other end of multiprocessing.Pipe has closed
1545
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1546
return False
1547
1548
# Read a request from the child
1549
request = parent_pipe.recv()
1550
command = request[0]
1551
1552
if command == 'init':
1553
fpr = request[1]
1554
address = request[2]
1555
1556
for c in self.clients:
1557
if c.fingerprint == fpr:
1558
client = c
1559
break
1560
else:
1561
logger.info("Client not found for fingerprint: %s, ad"
1562
"dress: %s", fpr, address)
1563
if self.use_dbus:
1564
# Emit D-Bus signal
1565
mandos_dbus_service.ClientNotFound(fpr, address[0])
1566
parent_pipe.send(False)
1567
return False
1568
1569
gobject.io_add_watch(parent_pipe.fileno(),
1570
gobject.IO_IN | gobject.IO_HUP,
1571
functools.partial(self.handle_ipc,
1572
parent_pipe = parent_pipe,
1573
client_object = client))
1574
parent_pipe.send(True)
1575
# remove the old hook in favor of the new above hook on same fileno
1576
return False
1577
if command == 'funcall':
1578
funcname = request[1]
1579
args = request[2]
1580
kwargs = request[3]
1581
1582
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1583
1584
if command == 'getattr':
1585
attrname = request[1]
1586
if callable(client_object.__getattribute__(attrname)):
1587
parent_pipe.send(('function',))
1588
else:
1589
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1590
1591
if command == 'setattr':
1592
attrname = request[1]
1593
value = request[2]
1594
setattr(client_object, attrname, value)
1595
1259
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1260
conditions_string)
1261
1262
# Turn the pipe file descriptor into a Python file object
1263
if source not in file_objects:
1264
file_objects[source] = os.fdopen(source, u"r", 1)
1265
1266
# Read a line from the file object
1267
cmdline = file_objects[source].readline()
1268
if not cmdline: # Empty line means end of file
1269
# close the IPC pipe
1270
file_objects[source].close()
1271
del file_objects[source]
1272
1273
# Stop calling this function
1274
return False
1275
1276
logger.debug(u"IPC command: %r", cmdline)
1277
1278
# Parse and act on command
1279
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1280
1281
if cmd == u"NOTFOUND":
1282
logger.warning(u"Client not found for fingerprint: %s",
1283
args)
1284
if self.use_dbus:
1285
# Emit D-Bus signal
1286
mandos_dbus_service.ClientNotFound(args)
1287
elif cmd == u"INVALID":
1288
for client in self.clients:
1289
if client.name == args:
1290
logger.warning(u"Client %s is invalid", args)
1291
if self.use_dbus:
1292
# Emit D-Bus signal
1293
client.Rejected()
1294
break
1295
else:
1296
logger.error(u"Unknown client %s is invalid", args)
1297
elif cmd == u"SENDING":
1298
for client in self.clients:
1299
if client.name == args:
1300
logger.info(u"Sending secret to %s", client.name)
1301
client.checked_ok()
1302
if self.use_dbus:
1303
# Emit D-Bus signal
1304
client.GotSecret()
1305
break
1306
else:
1307
logger.error(u"Sending secret to unknown client %s",
1308
args)
1309
else:
1310
logger.error(u"Unknown IPC command: %r", cmdline)
1311
1312
# Keep calling this function
1596
1313
return True
1597
1314
1598
1315
1599
1316
def string_to_delta(interval):
1600
1317
"""Parse a string and return a datetime.timedelta
1601
1318
1602
>>> string_to_delta('7d')
1319
>>> string_to_delta(u'7d')
1603
1320
datetime.timedelta(7)
1604
>>> string_to_delta('60s')
1321
>>> string_to_delta(u'60s')
1605
1322
datetime.timedelta(0, 60)
1606
>>> string_to_delta('60m')
1323
>>> string_to_delta(u'60m')
1607
1324
datetime.timedelta(0, 3600)
1608
>>> string_to_delta('24h')
1325
>>> string_to_delta(u'24h')
1609
1326
datetime.timedelta(1)
1610
>>> string_to_delta('1w')
1327
>>> string_to_delta(u'1w')
1611
1328
datetime.timedelta(7)
1612
>>> string_to_delta('5m 30s')
1329
>>> string_to_delta(u'5m 30s')
1613
1330
datetime.timedelta(0, 330)
1614
1331
"""
1615
1332
timevalue = datetime.timedelta(0)
1617
1334
try:
1618
1335
suffix = unicode(s[-1])
1619
1336
value = int(s[:-1])
1620
if suffix == "d":
1337
if suffix == u"d":
1621
1338
delta = datetime.timedelta(value)
1622
elif suffix == "s":
1339
elif suffix == u"s":
1623
1340
delta = datetime.timedelta(0, value)
1624
elif suffix == "m":
1341
elif suffix == u"m":
1625
1342
delta = datetime.timedelta(0, 0, 0, 0, value)
1626
elif suffix == "h":
1343
elif suffix == u"h":
1627
1344
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1628
elif suffix == "w":
1345
elif suffix == u"w":
1629
1346
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1630
1347
else:
1631
raise ValueError("Unknown suffix %r" % suffix)
1632
except (ValueError, IndexError) as e:
1633
raise ValueError(*(e.args))
1348
raise ValueError
1349
except (ValueError, IndexError):
1350
raise ValueError
1634
1351
timevalue += delta
1635
1352
return timevalue
1636
1353
1642
1359
global if_nametoindex
1643
1360
try:
1644
1361
if_nametoindex = (ctypes.cdll.LoadLibrary
1645
(ctypes.util.find_library("c"))
1362
(ctypes.util.find_library(u"c"))
1646
1363
.if_nametoindex)
1647
1364
except (OSError, AttributeError):
1648
logger.warning("Doing if_nametoindex the hard way")
1365
logger.warning(u"Doing if_nametoindex the hard way")
1649
1366
def if_nametoindex(interface):
1650
1367
"Get an interface index the hard way, i.e. using fcntl()"
1651
1368
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1652
with contextlib.closing(socket.socket()) as s:
1369
with closing(socket.socket()) as s:
1653
1370
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1654
struct.pack(str("16s16x"),
1371
struct.pack(str(u"16s16x"),
1655
1372
interface))
1656
interface_index = struct.unpack(str("I"),
1373
interface_index = struct.unpack(str(u"I"),
1657
1374
ifreq[16:20])[0]
1658
1375
return interface_index
1659
1376
return if_nametoindex(interface)
1667
1384
sys.exit()
1668
1385
os.setsid()
1669
1386
if not nochdir:
1670
os.chdir("/")
1387
os.chdir(u"/")
1671
1388
if os.fork():
1672
1389
sys.exit()
1673
1390
if not noclose:
1675
1392
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1676
1393
if not stat.S_ISCHR(os.fstat(null).st_mode):
1677
1394
raise OSError(errno.ENODEV,
1678
"%s not a character device"
1395
u"%s not a character device"
1679
1396
% os.path.devnull)
1680
1397
os.dup2(null, sys.stdin.fileno())
1681
1398
os.dup2(null, sys.stdout.fileno())
1689
1406
##################################################################
1690
1407
# Parsing of options, both command line and config file
1691
1408
1692
parser = argparse.ArgumentParser()
1693
parser.add_argument("-v", "--version", action="version",
1694
version = "%%(prog)s %s" % version,
1695
help="show version number and exit")
1696
parser.add_argument("-i", "--interface", metavar="IF",
1697
help="Bind to interface IF")
1698
parser.add_argument("-a", "--address",
1699
help="Address to listen for requests on")
1700
parser.add_argument("-p", "--port", type=int,
1701
help="Port number to receive requests on")
1702
parser.add_argument("--check", action="store_true",
1703
help="Run self-test")
1704
parser.add_argument("--debug", action="store_true",
1705
help="Debug mode; run in foreground and log"
1706
" to terminal")
1707
parser.add_argument("--debuglevel", metavar="LEVEL",
1708
help="Debug level for stdout output")
1709
parser.add_argument("--priority", help="GnuTLS"
1710
" priority string (see GnuTLS documentation)")
1711
parser.add_argument("--servicename",
1712
metavar="NAME", help="Zeroconf service name")
1713
parser.add_argument("--configdir",
1714
default="/etc/mandos", metavar="DIR",
1715
help="Directory to search for configuration"
1716
" files")
1717
parser.add_argument("--no-dbus", action="store_false",
1718
dest="use_dbus", help="Do not provide D-Bus"
1719
" system bus interface")
1720
parser.add_argument("--no-ipv6", action="store_false",
1721
dest="use_ipv6", help="Do not use IPv6")
1722
options = parser.parse_args()
1409
parser = optparse.OptionParser(version = "%%prog %s" % version)
1410
parser.add_option("-i", u"--interface", type=u"string",
1411
metavar="IF", help=u"Bind to interface IF")
1412
parser.add_option("-a", u"--address", type=u"string",
1413
help=u"Address to listen for requests on")
1414
parser.add_option("-p", u"--port", type=u"int",
1415
help=u"Port number to receive requests on")
1416
parser.add_option("--check", action=u"store_true",
1417
help=u"Run self-test")
1418
parser.add_option("--debug", action=u"store_true",
1419
help=u"Debug mode; run in foreground and log to"
1420
u" terminal")
1421
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1422
u" priority string (see GnuTLS documentation)")
1423
parser.add_option("--servicename", type=u"string",
1424
metavar=u"NAME", help=u"Zeroconf service name")
1425
parser.add_option("--configdir", type=u"string",
1426
default=u"/etc/mandos", metavar=u"DIR",
1427
help=u"Directory to search for configuration"
1428
u" files")
1429
parser.add_option("--no-dbus", action=u"store_false",
1430
dest=u"use_dbus", help=u"Do not provide D-Bus"
1431
u" system bus interface")
1432
parser.add_option("--no-ipv6", action=u"store_false",
1433
dest=u"use_ipv6", help=u"Do not use IPv6")
1434
options = parser.parse_args()[0]
1723
1435
1724
1436
if options.check:
1725
1437
import doctest
1727
1439
sys.exit()
1728
1440
1729
1441
# Default values for config file for server-global settings
1730
server_defaults = { "interface": "",
1731
"address": "",
1732
"port": "",
1733
"debug": "False",
1734
"priority":
1735
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1736
"servicename": "Mandos",
1737
"use_dbus": "True",
1738
"use_ipv6": "True",
1739
"debuglevel": "",
1442
server_defaults = { u"interface": u"",
1443
u"address": u"",
1444
u"port": u"",
1445
u"debug": u"False",
1446
u"priority":
1447
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1448
u"servicename": u"Mandos",
1449
u"use_dbus": u"True",
1450
u"use_ipv6": u"True",
1740
1451
}
1741
1452
1742
1453
# Parse config file for server-global settings
1743
1454
server_config = configparser.SafeConfigParser(server_defaults)
1744
1455
del server_defaults
1745
1456
server_config.read(os.path.join(options.configdir,
1746
"mandos.conf"))
1457
u"mandos.conf"))
1747
1458
# Convert the SafeConfigParser object to a dict
1748
1459
server_settings = server_config.defaults()
1749
1460
# Use the appropriate methods on the non-string config options
1750
for option in ("debug", "use_dbus", "use_ipv6"):
1751
server_settings[option] = server_config.getboolean("DEFAULT",
1461
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1462
server_settings[option] = server_config.getboolean(u"DEFAULT",
1752
1463
option)
1753
1464
if server_settings["port"]:
1754
server_settings["port"] = server_config.getint("DEFAULT",
1755
"port")
1465
server_settings["port"] = server_config.getint(u"DEFAULT",
1466
u"port")
1756
1467
del server_config
1757
1468
1758
1469
# Override the settings from the config file with command line
1759
1470
# options, if set.
1760
for option in ("interface", "address", "port", "debug",
1761
"priority", "servicename", "configdir",
1762
"use_dbus", "use_ipv6", "debuglevel"):
1471
for option in (u"interface", u"address", u"port", u"debug",
1472
u"priority", u"servicename", u"configdir",
1473
u"use_dbus", u"use_ipv6"):
1763
1474
value = getattr(options, option)
1764
1475
if value is not None:
1765
1476
server_settings[option] = value
1773
1484
##################################################################
1774
1485
1775
1486
# For convenience
1776
debug = server_settings["debug"]
1777
debuglevel = server_settings["debuglevel"]
1778
use_dbus = server_settings["use_dbus"]
1779
use_ipv6 = server_settings["use_ipv6"]
1780
1781
if server_settings["servicename"] != "Mandos":
1487
debug = server_settings[u"debug"]
1488
use_dbus = server_settings[u"use_dbus"]
1489
use_ipv6 = server_settings[u"use_ipv6"]
1490
1491
if not debug:
1492
syslogger.setLevel(logging.WARNING)
1493
console.setLevel(logging.WARNING)
1494
1495
if server_settings[u"servicename"] != u"Mandos":
1782
1496
syslogger.setFormatter(logging.Formatter
1783
('Mandos (%s) [%%(process)d]:'
1784
' %%(levelname)s: %%(message)s'
1785
% server_settings["servicename"]))
1497
(u'Mandos (%s) [%%(process)d]:'
1498
u' %%(levelname)s: %%(message)s'
1499
% server_settings[u"servicename"]))
1786
1500
1787
1501
# Parse config file with clients
1788
client_defaults = { "timeout": "5m",
1789
"extended_timeout": "15m",
1790
"interval": "2m",
1791
"checker": "fping -q -- %%(host)s",
1792
"host": "",
1793
"approval_delay": "0s",
1794
"approval_duration": "1s",
1502
client_defaults = { u"timeout": u"1h",
1503
u"interval": u"5m",
1504
u"checker": u"fping -q -- %%(host)s",
1505
u"host": u"",
1795
1506
}
1796
1507
client_config = configparser.SafeConfigParser(client_defaults)
1797
client_config.read(os.path.join(server_settings["configdir"],
1798
"clients.conf"))
1508
client_config.read(os.path.join(server_settings[u"configdir"],
1509
u"clients.conf"))
1799
1510
1800
1511
global mandos_dbus_service
1801
1512
mandos_dbus_service = None
1802
1513
1803
tcp_server = MandosServer((server_settings["address"],
1804
server_settings["port"]),
1514
tcp_server = MandosServer((server_settings[u"address"],
1515
server_settings[u"port"]),
1805
1516
ClientHandler,
1806
interface=(server_settings["interface"]
1807
or None),
1517
interface=server_settings[u"interface"],
1808
1518
use_ipv6=use_ipv6,
1809
1519
gnutls_priority=
1810
server_settings["priority"],
1520
server_settings[u"priority"],
1811
1521
use_dbus=use_dbus)
1812
if not debug:
1813
pidfilename = "/var/run/mandos.pid"
1814
try:
1815
pidfile = open(pidfilename, "w")
1816
except IOError:
1817
logger.error("Could not open file %r", pidfilename)
1522
pidfilename = u"/var/run/mandos.pid"
1523
try:
1524
pidfile = open(pidfilename, u"w")
1525
except IOError:
1526
logger.error(u"Could not open file %r", pidfilename)
1818
1527
1819
1528
try:
1820
uid = pwd.getpwnam("_mandos").pw_uid
1821
gid = pwd.getpwnam("_mandos").pw_gid
1529
uid = pwd.getpwnam(u"_mandos").pw_uid
1530
gid = pwd.getpwnam(u"_mandos").pw_gid
1822
1531
except KeyError:
1823
1532
try:
1824
uid = pwd.getpwnam("mandos").pw_uid
1825
gid = pwd.getpwnam("mandos").pw_gid
1533
uid = pwd.getpwnam(u"mandos").pw_uid
1534
gid = pwd.getpwnam(u"mandos").pw_gid
1826
1535
except KeyError:
1827
1536
try:
1828
uid = pwd.getpwnam("nobody").pw_uid
1829
gid = pwd.getpwnam("nobody").pw_gid
1537
uid = pwd.getpwnam(u"nobody").pw_uid
1538
gid = pwd.getpwnam(u"nobody").pw_gid
1830
1539
except KeyError:
1831
1540
uid = 65534
1832
1541
gid = 65534
1833
1542
try:
1834
1543
os.setgid(gid)
1835
1544
os.setuid(uid)
1836
except OSError as error:
1545
except OSError, error:
1837
1546
if error[0] != errno.EPERM:
1838
1547
raise error
1839
1548
1840
if not debug and not debuglevel:
1841
syslogger.setLevel(logging.WARNING)
1842
console.setLevel(logging.WARNING)
1843
if debuglevel:
1844
level = getattr(logging, debuglevel.upper())
1845
syslogger.setLevel(level)
1846
console.setLevel(level)
1847
1549
# Enable all possible GnuTLS debugging
1848
1550
if debug:
1849
# Enable all possible GnuTLS debugging
1850
1851
1551
# "Use a log level over 10 to enable all debugging options."
1852
1552
# - GnuTLS manual
1853
1553
gnutls.library.functions.gnutls_global_set_log_level(11)
1854
1554
1855
1555
@gnutls.library.types.gnutls_log_func
1856
1556
def debug_gnutls(level, string):
1857
logger.debug("GnuTLS: %s", string[:-1])
1557
logger.debug(u"GnuTLS: %s", string[:-1])
1858
1558
1859
1559
(gnutls.library.functions
1860
1560
.gnutls_global_set_log_function(debug_gnutls))
1861
1862
# Redirect stdin so all checkers get /dev/null
1863
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1864
os.dup2(null, sys.stdin.fileno())
1865
if null > 2:
1866
os.close(null)
1867
else:
1868
# No console logging
1869
logger.removeHandler(console)
1870
1871
# Need to fork before connecting to D-Bus
1872
if not debug:
1873
# Close all input and output, do double fork, etc.
1874
daemon()
1875
1561
1876
1562
global main_loop
1877
1563
# From the Avahi example code
1880
1566
bus = dbus.SystemBus()
1881
1567
# End of Avahi example code
1882
1568
if use_dbus:
1883
try:
1884
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1885
bus, do_not_queue=True)
1886
except dbus.exceptions.NameExistsException as e:
1887
logger.error(unicode(e) + ", disabling D-Bus")
1888
use_dbus = False
1889
server_settings["use_dbus"] = False
1890
tcp_server.use_dbus = False
1569
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1891
1570
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1892
service = AvahiService(name = server_settings["servicename"],
1893
servicetype = "_mandos._tcp",
1571
service = AvahiService(name = server_settings[u"servicename"],
1572
servicetype = u"_mandos._tcp",
1894
1573
protocol = protocol, bus = bus)
1895
1574
if server_settings["interface"]:
1896
1575
service.interface = (if_nametoindex
1897
(str(server_settings["interface"])))
1898
1899
global multiprocessing_manager
1900
multiprocessing_manager = multiprocessing.Manager()
1576
(str(server_settings[u"interface"])))
1901
1577
1902
1578
client_class = Client
1903
1579
if use_dbus:
1904
1580
client_class = functools.partial(ClientDBus, bus = bus)
1905
def client_config_items(config, section):
1906
special_settings = {
1907
"approved_by_default":
1908
lambda: config.getboolean(section,
1909
"approved_by_default"),
1910
}
1911
for name, value in config.items(section):
1912
try:
1913
yield (name, special_settings[name]())
1914
except KeyError:
1915
yield (name, value)
1916
1917
1581
tcp_server.clients.update(set(
1918
1582
client_class(name = section,
1919
config= dict(client_config_items(
1920
client_config, section)))
1583
config= dict(client_config.items(section)))
1921
1584
for section in client_config.sections()))
1922
1585
if not tcp_server.clients:
1923
logger.warning("No clients defined")
1586
logger.warning(u"No clients defined")
1587
1588
if debug:
1589
# Redirect stdin so all checkers get /dev/null
1590
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1591
os.dup2(null, sys.stdin.fileno())
1592
if null > 2:
1593
os.close(null)
1594
else:
1595
# No console logging
1596
logger.removeHandler(console)
1597
# Close all input and output, do double fork, etc.
1598
daemon()
1599
1600
try:
1601
with closing(pidfile):
1602
pid = os.getpid()
1603
pidfile.write(str(pid) + "\n")
1604
del pidfile
1605
except IOError:
1606
logger.error(u"Could not write to file %r with PID %d",
1607
pidfilename, pid)
1608
except NameError:
1609
# "pidfile" was never created
1610
pass
1611
del pidfilename
1612
1613
def cleanup():
1614
"Cleanup function; run on exit"
1615
service.cleanup()
1924
1616
1617
while tcp_server.clients:
1618
client = tcp_server.clients.pop()
1619
client.disable_hook = None
1620
client.disable()
1621
1622
atexit.register(cleanup)
1623
1925
1624
if not debug:
1926
try:
1927
with pidfile:
1928
pid = os.getpid()
1929
pidfile.write(str(pid) + "\n".encode("utf-8"))
1930
del pidfile
1931
except IOError:
1932
logger.error("Could not write to file %r with PID %d",
1933
pidfilename, pid)
1934
except NameError:
1935
# "pidfile" was never created
1936
pass
1937
del pidfilename
1938
1939
1625
signal.signal(signal.SIGINT, signal.SIG_IGN)
1940
1941
1626
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1942
1627
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1943
1628
1945
1630
class MandosDBusService(dbus.service.Object):
1946
1631
"""A D-Bus proxy object"""
1947
1632
def __init__(self):
1948
dbus.service.Object.__init__(self, bus, "/")
1949
_interface = "se.bsnet.fukt.Mandos"
1950
1951
@dbus.service.signal(_interface, signature="o")
1952
def ClientAdded(self, objpath):
1953
"D-Bus signal"
1954
pass
1955
1956
@dbus.service.signal(_interface, signature="ss")
1957
def ClientNotFound(self, fingerprint, address):
1958
"D-Bus signal"
1959
pass
1960
1961
@dbus.service.signal(_interface, signature="os")
1633
dbus.service.Object.__init__(self, bus, u"/")
1634
_interface = u"se.bsnet.fukt.Mandos"
1635
1636
@dbus.service.signal(_interface, signature=u"oa{sv}")
1637
def ClientAdded(self, objpath, properties):
1638
"D-Bus signal"
1639
pass
1640
1641
@dbus.service.signal(_interface, signature=u"s")
1642
def ClientNotFound(self, fingerprint):
1643
"D-Bus signal"
1644
pass
1645
1646
@dbus.service.signal(_interface, signature=u"os")
1962
1647
def ClientRemoved(self, objpath, name):
1963
1648
"D-Bus signal"
1964
1649
pass
1965
1650
1966
@dbus.service.method(_interface, out_signature="ao")
1651
@dbus.service.method(_interface, out_signature=u"ao")
1967
1652
def GetAllClients(self):
1968
1653
"D-Bus method"
1969
1654
return dbus.Array(c.dbus_object_path
1970
1655
for c in tcp_server.clients)
1971
1656
1972
1657
@dbus.service.method(_interface,
1973
out_signature="a{oa{sv}}")
1658
out_signature=u"a{oa{sv}}")
1974
1659
def GetAllClientsWithProperties(self):
1975
1660
"D-Bus method"
1976
1661
return dbus.Dictionary(
1977
((c.dbus_object_path, c.GetAll(""))
1662
((c.dbus_object_path, c.GetAll(u""))
1978
1663
for c in tcp_server.clients),
1979
signature="oa{sv}")
1664
signature=u"oa{sv}")
1980
1665
1981
@dbus.service.method(_interface, in_signature="o")
1666
@dbus.service.method(_interface, in_signature=u"o")
1982
1667
def RemoveClient(self, object_path):
1983
1668
"D-Bus method"
1984
1669
for c in tcp_server.clients:
1986
1671
tcp_server.clients.remove(c)
1987
1672
c.remove_from_connection()
1988
1673
# Don't signal anything except ClientRemoved
1989
c.disable(quiet=True)
1674
c.disable(signal=False)
1990
1675
# Emit D-Bus signal
1991
1676
self.ClientRemoved(object_path, c.name)
1992
1677
return
1993
raise KeyError(object_path)
1678
raise KeyError
1994
1679
1995
1680
del _interface
1996
1681
1997
1682
mandos_dbus_service = MandosDBusService()
1998
1683
1999
def cleanup():
2000
"Cleanup function; run on exit"
2001
service.cleanup()
2002
2003
while tcp_server.clients:
2004
client = tcp_server.clients.pop()
2005
if use_dbus:
2006
client.remove_from_connection()
2007
client.disable_hook = None
2008
# Don't signal anything except ClientRemoved
2009
client.disable(quiet=True)
2010
if use_dbus:
2011
# Emit D-Bus signal
2012
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2013
client.name)
2014
2015
atexit.register(cleanup)
2016
2017
1684
for client in tcp_server.clients:
2018
1685
if use_dbus:
2019
1686
# Emit D-Bus signal
2020
mandos_dbus_service.ClientAdded(client.dbus_object_path)
1687
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1688
client.GetAll(u""))
2021
1689
client.enable()
2022
1690
2023
1691
tcp_server.enable()
2026
1694
# Find out what port we got
2027
1695
service.port = tcp_server.socket.getsockname()[1]
2028
1696
if use_ipv6:
2029
logger.info("Now listening on address %r, port %d,"
1697
logger.info(u"Now listening on address %r, port %d,"
2030
1698
" flowinfo %d, scope_id %d"
2031
1699
% tcp_server.socket.getsockname())
2032
1700
else: # IPv4
2033
logger.info("Now listening on address %r, port %d"
1701
logger.info(u"Now listening on address %r, port %d"
2034
1702
% tcp_server.socket.getsockname())
2035
1703
2036
1704
#service.interface = tcp_server.socket.getsockname()[3]
2039
1707
# From the Avahi example code
2040
1708
try:
2041
1709
service.activate()
2042
except dbus.exceptions.DBusException as error:
2043
logger.critical("DBusException: %s", error)
2044
cleanup()
1710
except dbus.exceptions.DBusException, error:
1711
logger.critical(u"DBusException: %s", error)
2045
1712
sys.exit(1)
2046
1713
# End of Avahi example code
2047
1714
2050
1717
(tcp_server.handle_request
2051
1718
(*args[2:], **kwargs) or True))
2052
1719
2053
logger.debug("Starting main loop")
1720
logger.debug(u"Starting main loop")
2054
1721
main_loop.run()
2055
except AvahiError as error:
2056
logger.critical("AvahiError: %s", error)
2057
cleanup()
1722
except AvahiError, error:
1723
logger.critical(u"AvahiError: %s", error)
2058
1724
sys.exit(1)
2059
1725
except KeyboardInterrupt:
2060
1726
if debug:
2061
print("", file=sys.stderr)
2062
logger.debug("Server received KeyboardInterrupt")
2063
logger.debug("Server exiting")
2064
# Must run before the D-Bus bus name gets deregistered
2065
cleanup()
2066
1727
print >> sys.stderr
1728
logger.debug(u"Server received KeyboardInterrupt")
1729
logger.debug(u"Server exiting")
2067
1730
2068
1731
if __name__ == '__main__':
2069
1732
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0