To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 403
- compare with another revision
- download diff
- download tarball
- view history from revision 403
- Committer: Teddy Hogeborn
- Date: 2009-11-05 02:12:57 UTC
- Revision ID: teddy@fukt.bsnet.se-20091105021257-l2b5nb1v4pc2tupw
* mandos (ClientDBus.disable): Bug fix: complete rename of "log" and
"signal" to "quiet".
"signal" to "quiet".
- files removed:
- DBUS-API
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
31
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
36
import SocketServer as socketserver
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
56
55
import logging
57
56
import logging.handlers
58
57
import pwd
59
import contextlib
58
from contextlib import closing
60
59
import struct
61
60
import fcntl
62
61
import functools
63
import cPickle as pickle
64
import multiprocessing
65
62
66
63
import dbus
67
64
import dbus.service
82
79
SO_BINDTODEVICE = None
83
80
84
81
85
version = "1.3.1"
82
version = "1.0.14"
86
83
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
84
logger = logging.Logger(u'mandos')
89
85
syslogger = (logging.handlers.SysLogHandler
90
86
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
address = str("/dev/log")))
87
address = "/dev/log"))
92
88
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
89
(u'Mandos [%(process)d]: %(levelname)s:'
90
u' %(message)s'))
95
91
logger.addHandler(syslogger)
96
92
97
93
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
100
' %(message)s'))
94
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
95
u' %(levelname)s:'
96
u' %(message)s'))
101
97
logger.addHandler(console)
102
98
103
99
class AvahiError(Exception):
120
116
Attributes:
121
117
interface: integer; avahi.IF_UNSPEC or an interface index.
122
118
Used to optionally bind to the specified interface.
123
name: string; Example: 'Mandos'
124
type: string; Example: '_mandos._tcp'.
119
name: string; Example: u'Mandos'
120
type: string; Example: u'_mandos._tcp'.
125
121
See <http://www.dns-sd.org/ServiceTypes.html>
126
122
port: integer; what port to announce
127
123
TXT: list of strings; TXT record for the service
136
132
"""
137
133
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
134
servicetype = None, port = None, TXT = None,
139
domain = "", host = "", max_renames = 32768,
135
domain = u"", host = u"", max_renames = 32768,
140
136
protocol = avahi.PROTO_UNSPEC, bus = None):
141
137
self.interface = interface
142
138
self.name = name
151
147
self.group = None # our entry group
152
148
self.server = None
153
149
self.bus = bus
154
self.entry_group_state_changed_match = None
155
150
def rename(self):
156
151
"""Derived from the Avahi example code"""
157
152
if self.rename_count >= self.max_renames:
158
logger.critical("No suitable Zeroconf service name found"
159
" after %i retries, exiting.",
153
logger.critical(u"No suitable Zeroconf service name found"
154
u" after %i retries, exiting.",
160
155
self.rename_count)
161
raise AvahiServiceError("Too many renames")
162
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
163
logger.info("Changing Zeroconf service name to %r ...",
164
self.name)
156
raise AvahiServiceError(u"Too many renames")
157
self.name = self.server.GetAlternativeServiceName(self.name)
158
logger.info(u"Changing Zeroconf service name to %r ...",
159
unicode(self.name))
165
160
syslogger.setFormatter(logging.Formatter
166
('Mandos (%s) [%%(process)d]:'
167
' %%(levelname)s: %%(message)s'
161
(u'Mandos (%s) [%%(process)d]:'
162
u' %%(levelname)s: %%(message)s'
168
163
% self.name))
169
164
self.remove()
170
try:
171
self.add()
172
except dbus.exceptions.DBusException as error:
173
logger.critical("DBusException: %s", error)
174
self.cleanup()
175
os._exit(1)
165
self.add()
176
166
self.rename_count += 1
177
167
def remove(self):
178
168
"""Derived from the Avahi example code"""
179
if self.entry_group_state_changed_match is not None:
180
self.entry_group_state_changed_match.remove()
181
self.entry_group_state_changed_match = None
182
169
if self.group is not None:
183
170
self.group.Reset()
184
171
def add(self):
185
172
"""Derived from the Avahi example code"""
186
self.remove()
187
173
if self.group is None:
188
174
self.group = dbus.Interface(
189
175
self.bus.get_object(avahi.DBUS_NAME,
190
176
self.server.EntryGroupNew()),
191
177
avahi.DBUS_INTERFACE_ENTRY_GROUP)
192
self.entry_group_state_changed_match = (
193
self.group.connect_to_signal(
194
'StateChanged', self .entry_group_state_changed))
195
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
178
self.group.connect_to_signal('StateChanged',
179
self
180
.entry_group_state_changed)
181
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
196
182
self.name, self.type)
197
183
self.group.AddService(
198
184
self.interface,
205
191
self.group.Commit()
206
192
def entry_group_state_changed(self, state, error):
207
193
"""Derived from the Avahi example code"""
208
logger.debug("Avahi entry group state change: %i", state)
194
logger.debug(u"Avahi state change: %i", state)
209
195
210
196
if state == avahi.ENTRY_GROUP_ESTABLISHED:
211
logger.debug("Zeroconf service established.")
197
logger.debug(u"Zeroconf service established.")
212
198
elif state == avahi.ENTRY_GROUP_COLLISION:
213
logger.info("Zeroconf service name collision.")
199
logger.warning(u"Zeroconf service name collision.")
214
200
self.rename()
215
201
elif state == avahi.ENTRY_GROUP_FAILURE:
216
logger.critical("Avahi: Error in group state changed %s",
202
logger.critical(u"Avahi: Error in group state changed %s",
217
203
unicode(error))
218
raise AvahiGroupError("State changed: %s"
204
raise AvahiGroupError(u"State changed: %s"
219
205
% unicode(error))
220
206
def cleanup(self):
221
207
"""Derived from the Avahi example code"""
222
208
if self.group is not None:
223
try:
224
self.group.Free()
225
except (dbus.exceptions.UnknownMethodException,
226
dbus.exceptions.DBusException) as e:
227
pass
209
self.group.Free()
228
210
self.group = None
229
self.remove()
230
def server_state_changed(self, state, error=None):
211
def server_state_changed(self, state):
231
212
"""Derived from the Avahi example code"""
232
logger.debug("Avahi server state change: %i", state)
233
bad_states = { avahi.SERVER_INVALID:
234
"Zeroconf server invalid",
235
avahi.SERVER_REGISTERING: None,
236
avahi.SERVER_COLLISION:
237
"Zeroconf server name collision",
238
avahi.SERVER_FAILURE:
239
"Zeroconf server failure" }
240
if state in bad_states:
241
if bad_states[state] is not None:
242
if error is None:
243
logger.error(bad_states[state])
244
else:
245
logger.error(bad_states[state] + ": %r", error)
246
self.cleanup()
213
if state == avahi.SERVER_COLLISION:
214
logger.error(u"Zeroconf server name collision")
215
self.remove()
247
216
elif state == avahi.SERVER_RUNNING:
248
217
self.add()
249
else:
250
if error is None:
251
logger.debug("Unknown state: %r", state)
252
else:
253
logger.debug("Unknown state: %r: %r", state, error)
254
218
def activate(self):
255
219
"""Derived from the Avahi example code"""
256
220
if self.server is None:
257
221
self.server = dbus.Interface(
258
222
self.bus.get_object(avahi.DBUS_NAME,
259
avahi.DBUS_PATH_SERVER,
260
follow_name_owner_changes=True),
223
avahi.DBUS_PATH_SERVER),
261
224
avahi.DBUS_INTERFACE_SERVER)
262
self.server.connect_to_signal("StateChanged",
225
self.server.connect_to_signal(u"StateChanged",
263
226
self.server_state_changed)
264
227
self.server_state_changed(self.server.GetState())
265
228
268
231
"""A representation of a client host served by this server.
269
232
270
233
Attributes:
271
_approved: bool(); 'None' if not yet approved/disapproved
272
approval_delay: datetime.timedelta(); Time to wait for approval
273
approval_duration: datetime.timedelta(); Duration of one approval
234
name: string; from the config file, used in log messages and
235
D-Bus identifiers
236
fingerprint: string (40 or 32 hexadecimal digits); used to
237
uniquely identify the client
238
secret: bytestring; sent verbatim (over TLS) to client
239
host: string; available for use by the checker command
240
created: datetime.datetime(); (UTC) object creation
241
last_enabled: datetime.datetime(); (UTC)
242
enabled: bool()
243
last_checked_ok: datetime.datetime(); (UTC) or None
244
timeout: datetime.timedelta(); How long from last_checked_ok
245
until this client is invalid
246
interval: datetime.timedelta(); How often to start a new checker
247
disable_hook: If set, called by disable() as disable_hook(self)
274
248
checker: subprocess.Popen(); a running checker process used
275
249
to see if the client lives.
276
250
'None' if no process is running.
277
checker_callback_tag: a gobject event source tag, or None
278
checker_command: string; External command which is run to check
279
if client lives. %() expansions are done at
251
checker_initiator_tag: a gobject event source tag, or None
252
disable_initiator_tag: - '' -
253
checker_callback_tag: - '' -
254
checker_command: string; External command which is run to check if
255
client lives. %() expansions are done at
280
256
runtime with vars(self) as dict, so that for
281
257
instance %(name)s can be used in the command.
282
checker_initiator_tag: a gobject event source tag, or None
283
created: datetime.datetime(); (UTC) object creation
284
258
current_checker_command: string; current running checker_command
285
disable_hook: If set, called by disable() as disable_hook(self)
286
disable_initiator_tag: a gobject event source tag, or None
287
enabled: bool()
288
fingerprint: string (40 or 32 hexadecimal digits); used to
289
uniquely identify the client
290
host: string; available for use by the checker command
291
interval: datetime.timedelta(); How often to start a new checker
292
last_approval_request: datetime.datetime(); (UTC) or None
293
last_checked_ok: datetime.datetime(); (UTC) or None
294
last_enabled: datetime.datetime(); (UTC)
295
name: string; from the config file, used in log messages and
296
D-Bus identifiers
297
secret: bytestring; sent verbatim (over TLS) to client
298
timeout: datetime.timedelta(); How long from last_checked_ok
299
until this client is disabled
300
extended_timeout: extra long timeout when password has been sent
301
runtime_expansions: Allowed attributes for runtime expansion.
302
expires: datetime.datetime(); time (UTC) when a client will be
303
disabled, or None
304
259
"""
305
260
306
runtime_expansions = ("approval_delay", "approval_duration",
307
"created", "enabled", "fingerprint",
308
"host", "interval", "last_checked_ok",
309
"last_enabled", "name", "timeout")
310
311
261
@staticmethod
312
262
def _timedelta_to_milliseconds(td):
313
263
"Convert a datetime.timedelta() to milliseconds"
318
268
def timeout_milliseconds(self):
319
269
"Return the 'timeout' attribute in milliseconds"
320
270
return self._timedelta_to_milliseconds(self.timeout)
321
322
def extended_timeout_milliseconds(self):
323
"Return the 'extended_timeout' attribute in milliseconds"
324
return self._timedelta_to_milliseconds(self.extended_timeout)
325
271
326
272
def interval_milliseconds(self):
327
273
"Return the 'interval' attribute in milliseconds"
328
274
return self._timedelta_to_milliseconds(self.interval)
329
330
def approval_delay_milliseconds(self):
331
return self._timedelta_to_milliseconds(self.approval_delay)
332
275
333
276
def __init__(self, name = None, disable_hook=None, config=None):
334
277
"""Note: the 'checker' key in 'config' sets the
337
280
self.name = name
338
281
if config is None:
339
282
config = {}
340
logger.debug("Creating client %r", self.name)
283
logger.debug(u"Creating client %r", self.name)
341
284
# Uppercase and remove spaces from fingerprint for later
342
285
# comparison purposes with return value from the fingerprint()
343
286
# function
344
self.fingerprint = (config["fingerprint"].upper()
345
.replace(" ", ""))
346
logger.debug(" Fingerprint: %s", self.fingerprint)
347
if "secret" in config:
348
self.secret = config["secret"].decode("base64")
349
elif "secfile" in config:
350
with open(os.path.expanduser(os.path.expandvars
351
(config["secfile"])),
352
"rb") as secfile:
287
self.fingerprint = (config[u"fingerprint"].upper()
288
.replace(u" ", u""))
289
logger.debug(u" Fingerprint: %s", self.fingerprint)
290
if u"secret" in config:
291
self.secret = config[u"secret"].decode(u"base64")
292
elif u"secfile" in config:
293
with closing(open(os.path.expanduser
294
(os.path.expandvars
295
(config[u"secfile"])),
296
"rb")) as secfile:
353
297
self.secret = secfile.read()
354
298
else:
355
raise TypeError("No secret or secfile for client %s"
299
raise TypeError(u"No secret or secfile for client %s"
356
300
% self.name)
357
self.host = config.get("host", "")
301
self.host = config.get(u"host", u"")
358
302
self.created = datetime.datetime.utcnow()
359
303
self.enabled = False
360
self.last_approval_request = None
361
304
self.last_enabled = None
362
305
self.last_checked_ok = None
363
self.timeout = string_to_delta(config["timeout"])
364
self.extended_timeout = string_to_delta(config["extended_timeout"])
365
self.interval = string_to_delta(config["interval"])
306
self.timeout = string_to_delta(config[u"timeout"])
307
self.interval = string_to_delta(config[u"interval"])
366
308
self.disable_hook = disable_hook
367
309
self.checker = None
368
310
self.checker_initiator_tag = None
369
311
self.disable_initiator_tag = None
370
self.expires = None
371
312
self.checker_callback_tag = None
372
self.checker_command = config["checker"]
313
self.checker_command = config[u"checker"]
373
314
self.current_checker_command = None
374
315
self.last_connect = None
375
self._approved = None
376
self.approved_by_default = config.get("approved_by_default",
377
True)
378
self.approvals_pending = 0
379
self.approval_delay = string_to_delta(
380
config["approval_delay"])
381
self.approval_duration = string_to_delta(
382
config["approval_duration"])
383
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
384
316
385
def send_changedstate(self):
386
self.changedstate.acquire()
387
self.changedstate.notify_all()
388
self.changedstate.release()
389
390
317
def enable(self):
391
318
"""Start this client's checker and timeout hooks"""
392
if getattr(self, "enabled", False):
319
if getattr(self, u"enabled", False):
393
320
# Already enabled
394
321
return
395
self.send_changedstate()
396
322
self.last_enabled = datetime.datetime.utcnow()
397
323
# Schedule a new checker to be started an 'interval' from now,
398
324
# and every interval from then on.
400
326
(self.interval_milliseconds(),
401
327
self.start_checker))
402
328
# Schedule a disable() when 'timeout' has passed
403
self.expires = datetime.datetime.utcnow() + self.timeout
404
329
self.disable_initiator_tag = (gobject.timeout_add
405
330
(self.timeout_milliseconds(),
406
331
self.disable))
413
338
if not getattr(self, "enabled", False):
414
339
return False
415
340
if not quiet:
416
self.send_changedstate()
417
if not quiet:
418
logger.info("Disabling client %s", self.name)
419
if getattr(self, "disable_initiator_tag", False):
341
logger.info(u"Disabling client %s", self.name)
342
if getattr(self, u"disable_initiator_tag", False):
420
343
gobject.source_remove(self.disable_initiator_tag)
421
344
self.disable_initiator_tag = None
422
self.expires = None
423
if getattr(self, "checker_initiator_tag", False):
345
if getattr(self, u"checker_initiator_tag", False):
424
346
gobject.source_remove(self.checker_initiator_tag)
425
347
self.checker_initiator_tag = None
426
348
self.stop_checker()
441
363
if os.WIFEXITED(condition):
442
364
exitstatus = os.WEXITSTATUS(condition)
443
365
if exitstatus == 0:
444
logger.info("Checker for %(name)s succeeded",
366
logger.info(u"Checker for %(name)s succeeded",
445
367
vars(self))
446
368
self.checked_ok()
447
369
else:
448
logger.info("Checker for %(name)s failed",
370
logger.info(u"Checker for %(name)s failed",
449
371
vars(self))
450
372
else:
451
logger.warning("Checker for %(name)s crashed?",
373
logger.warning(u"Checker for %(name)s crashed?",
452
374
vars(self))
453
375
454
def checked_ok(self, timeout=None):
376
def checked_ok(self):
455
377
"""Bump up the timeout for this client.
456
378
457
379
This should only be called when the client has been seen,
458
380
alive and well.
459
381
"""
460
if timeout is None:
461
timeout = self.timeout
462
382
self.last_checked_ok = datetime.datetime.utcnow()
463
383
gobject.source_remove(self.disable_initiator_tag)
464
self.expires = datetime.datetime.utcnow() + timeout
465
384
self.disable_initiator_tag = (gobject.timeout_add
466
(self._timedelta_to_milliseconds(timeout),
385
(self.timeout_milliseconds(),
467
386
self.disable))
468
387
469
def need_approval(self):
470
self.last_approval_request = datetime.datetime.utcnow()
471
472
388
def start_checker(self):
473
389
"""Start a new checker subprocess if one is not running.
474
390
480
396
# client would inevitably timeout, since no checker would get
481
397
# a chance to run to completion. If we instead leave running
482
398
# checkers alone, the checker would have to take more time
483
# than 'timeout' for the client to be disabled, which is as it
484
# should be.
399
# than 'timeout' for the client to be declared invalid, which
400
# is as it should be.
485
401
486
402
# If a checker exists, make sure it is not a zombie
487
403
try:
488
404
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
489
except (AttributeError, OSError) as error:
405
except (AttributeError, OSError), error:
490
406
if (isinstance(error, OSError)
491
407
and error.errno != errno.ECHILD):
492
408
raise error
493
409
else:
494
410
if pid:
495
logger.warning("Checker was a zombie")
411
logger.warning(u"Checker was a zombie")
496
412
gobject.source_remove(self.checker_callback_tag)
497
413
self.checker_callback(pid, status,
498
414
self.current_checker_command)
503
419
command = self.checker_command % self.host
504
420
except TypeError:
505
421
# Escape attributes for the shell
506
escaped_attrs = dict(
507
(attr,
508
re.escape(unicode(str(getattr(self, attr, "")),
509
errors=
510
'replace')))
511
for attr in
512
self.runtime_expansions)
513
422
escaped_attrs = dict((key,
423
re.escape(unicode(str(val),
424
errors=
425
u'replace')))
426
for key, val in
427
vars(self).iteritems())
514
428
try:
515
429
command = self.checker_command % escaped_attrs
516
except TypeError as error:
517
logger.error('Could not format string "%s":'
518
' %s', self.checker_command, error)
430
except TypeError, error:
431
logger.error(u'Could not format string "%s":'
432
u' %s', self.checker_command, error)
519
433
return True # Try again later
520
434
self.current_checker_command = command
521
435
try:
522
logger.info("Starting checker %r for %s",
436
logger.info(u"Starting checker %r for %s",
523
437
command, self.name)
524
438
# We don't need to redirect stdout and stderr, since
525
439
# in normal mode, that is already done by daemon(),
527
441
# always replaced by /dev/null.)
528
442
self.checker = subprocess.Popen(command,
529
443
close_fds=True,
530
shell=True, cwd="/")
444
shell=True, cwd=u"/")
531
445
self.checker_callback_tag = (gobject.child_watch_add
532
446
(self.checker.pid,
533
447
self.checker_callback,
538
452
if pid:
539
453
gobject.source_remove(self.checker_callback_tag)
540
454
self.checker_callback(pid, status, command)
541
except OSError as error:
542
logger.error("Failed to start subprocess: %s",
455
except OSError, error:
456
logger.error(u"Failed to start subprocess: %s",
543
457
error)
544
458
# Re-run this periodically if run by gobject.timeout_add
545
459
return True
549
463
if self.checker_callback_tag:
550
464
gobject.source_remove(self.checker_callback_tag)
551
465
self.checker_callback_tag = None
552
if getattr(self, "checker", None) is None:
466
if getattr(self, u"checker", None) is None:
553
467
return
554
logger.debug("Stopping checker for %(name)s", vars(self))
468
logger.debug(u"Stopping checker for %(name)s", vars(self))
555
469
try:
556
470
os.kill(self.checker.pid, signal.SIGTERM)
557
471
#time.sleep(0.5)
558
472
#if self.checker.poll() is None:
559
473
# os.kill(self.checker.pid, signal.SIGKILL)
560
except OSError as error:
474
except OSError, error:
561
475
if error.errno != errno.ESRCH: # No such process
562
476
raise
563
477
self.checker = None
564
565
def dbus_service_property(dbus_interface, signature="v",
566
access="readwrite", byte_arrays=False):
478
479
def still_valid(self):
480
"""Has the timeout not yet passed for this client?"""
481
if not getattr(self, u"enabled", False):
482
return False
483
now = datetime.datetime.utcnow()
484
if self.last_checked_ok is None:
485
return now < (self.created + self.timeout)
486
else:
487
return now < (self.last_checked_ok + self.timeout)
488
489
490
def dbus_service_property(dbus_interface, signature=u"v",
491
access=u"readwrite", byte_arrays=False):
567
492
"""Decorators for marking methods of a DBusObjectWithProperties to
568
493
become properties on the D-Bus.
569
494
574
499
dbus.service.method, except there is only "signature", since the
575
500
type from Get() and the type sent to Set() is the same.
576
501
"""
577
# Encoding deeply encoded byte arrays is not supported yet by the
578
# "Set" method, so we fail early here:
579
if byte_arrays and signature != "ay":
580
raise ValueError("Byte arrays not supported for non-'ay'"
581
" signature %r" % signature)
582
502
def decorator(func):
583
503
func._dbus_is_property = True
584
504
func._dbus_interface = dbus_interface
585
505
func._dbus_signature = signature
586
506
func._dbus_access = access
587
507
func._dbus_name = func.__name__
588
if func._dbus_name.endswith("_dbus_property"):
508
if func._dbus_name.endswith(u"_dbus_property"):
589
509
func._dbus_name = func._dbus_name[:-14]
590
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
510
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
591
511
return func
592
512
return decorator
593
513
621
541
622
542
@staticmethod
623
543
def _is_dbus_property(obj):
624
return getattr(obj, "_dbus_is_property", False)
544
return getattr(obj, u"_dbus_is_property", False)
625
545
626
546
def _get_all_dbus_properties(self):
627
547
"""Returns a generator of (name, attribute) pairs
635
555
property with the specified name and interface.
636
556
"""
637
557
for name in (property_name,
638
property_name + "_dbus_property"):
558
property_name + u"_dbus_property"):
639
559
prop = getattr(self, name, None)
640
560
if (prop is None
641
561
or not self._is_dbus_property(prop)
645
565
continue
646
566
return prop
647
567
# No such property
648
raise DBusPropertyNotFound(self.dbus_object_path + ":"
649
+ interface_name + "."
568
raise DBusPropertyNotFound(self.dbus_object_path + u":"
569
+ interface_name + u"."
650
570
+ property_name)
651
571
652
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
653
out_signature="v")
572
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
573
out_signature=u"v")
654
574
def Get(self, interface_name, property_name):
655
575
"""Standard D-Bus property Get() method, see D-Bus standard.
656
576
"""
657
577
prop = self._get_dbus_property(interface_name, property_name)
658
if prop._dbus_access == "write":
578
if prop._dbus_access == u"write":
659
579
raise DBusPropertyAccessException(property_name)
660
580
value = prop()
661
if not hasattr(value, "variant_level"):
581
if not hasattr(value, u"variant_level"):
662
582
return value
663
583
return type(value)(value, variant_level=value.variant_level+1)
664
584
665
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
585
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
666
586
def Set(self, interface_name, property_name, value):
667
587
"""Standard D-Bus property Set() method, see D-Bus standard.
668
588
"""
669
589
prop = self._get_dbus_property(interface_name, property_name)
670
if prop._dbus_access == "read":
590
if prop._dbus_access == u"read":
671
591
raise DBusPropertyAccessException(property_name)
672
if prop._dbus_get_args_options["byte_arrays"]:
673
# The byte_arrays option is not supported yet on
674
# signatures other than "ay".
675
if prop._dbus_signature != "ay":
676
raise ValueError
592
if prop._dbus_get_args_options[u"byte_arrays"]:
677
593
value = dbus.ByteArray(''.join(unichr(byte)
678
594
for byte in value))
679
595
prop(value)
680
596
681
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
682
out_signature="a{sv}")
597
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
598
out_signature=u"a{sv}")
683
599
def GetAll(self, interface_name):
684
600
"""Standard D-Bus property GetAll() method, see D-Bus
685
601
standard.
693
609
# Interface non-empty but did not match
694
610
continue
695
611
# Ignore write-only properties
696
if prop._dbus_access == "write":
612
if prop._dbus_access == u"write":
697
613
continue
698
614
value = prop()
699
if not hasattr(value, "variant_level"):
615
if not hasattr(value, u"variant_level"):
700
616
all[name] = value
701
617
continue
702
618
all[name] = type(value)(value, variant_level=
703
619
value.variant_level+1)
704
return dbus.Dictionary(all, signature="sv")
620
return dbus.Dictionary(all, signature=u"sv")
705
621
706
622
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
707
out_signature="s",
623
out_signature=u"s",
708
624
path_keyword='object_path',
709
625
connection_keyword='connection')
710
626
def Introspect(self, object_path, connection):
715
631
try:
716
632
document = xml.dom.minidom.parseString(xmlstring)
717
633
def make_tag(document, name, prop):
718
e = document.createElement("property")
719
e.setAttribute("name", name)
720
e.setAttribute("type", prop._dbus_signature)
721
e.setAttribute("access", prop._dbus_access)
634
e = document.createElement(u"property")
635
e.setAttribute(u"name", name)
636
e.setAttribute(u"type", prop._dbus_signature)
637
e.setAttribute(u"access", prop._dbus_access)
722
638
return e
723
for if_tag in document.getElementsByTagName("interface"):
639
for if_tag in document.getElementsByTagName(u"interface"):
724
640
for tag in (make_tag(document, name, prop)
725
641
for name, prop
726
642
in self._get_all_dbus_properties()
727
643
if prop._dbus_interface
728
== if_tag.getAttribute("name")):
644
== if_tag.getAttribute(u"name")):
729
645
if_tag.appendChild(tag)
730
646
# Add the names to the return values for the
731
647
# "org.freedesktop.DBus.Properties" methods
732
if (if_tag.getAttribute("name")
733
== "org.freedesktop.DBus.Properties"):
734
for cn in if_tag.getElementsByTagName("method"):
735
if cn.getAttribute("name") == "Get":
736
for arg in cn.getElementsByTagName("arg"):
737
if (arg.getAttribute("direction")
738
== "out"):
739
arg.setAttribute("name", "value")
740
elif cn.getAttribute("name") == "GetAll":
741
for arg in cn.getElementsByTagName("arg"):
742
if (arg.getAttribute("direction")
743
== "out"):
744
arg.setAttribute("name", "props")
745
xmlstring = document.toxml("utf-8")
648
if (if_tag.getAttribute(u"name")
649
== u"org.freedesktop.DBus.Properties"):
650
for cn in if_tag.getElementsByTagName(u"method"):
651
if cn.getAttribute(u"name") == u"Get":
652
for arg in cn.getElementsByTagName(u"arg"):
653
if (arg.getAttribute(u"direction")
654
== u"out"):
655
arg.setAttribute(u"name", u"value")
656
elif cn.getAttribute(u"name") == u"GetAll":
657
for arg in cn.getElementsByTagName(u"arg"):
658
if (arg.getAttribute(u"direction")
659
== u"out"):
660
arg.setAttribute(u"name", u"props")
661
xmlstring = document.toxml(u"utf-8")
746
662
document.unlink()
747
663
except (AttributeError, xml.dom.DOMException,
748
xml.parsers.expat.ExpatError) as error:
749
logger.error("Failed to override Introspection method",
664
xml.parsers.expat.ExpatError), error:
665
logger.error(u"Failed to override Introspection method",
750
666
error)
751
667
return xmlstring
752
668
758
674
dbus_object_path: dbus.ObjectPath
759
675
bus: dbus.SystemBus()
760
676
"""
761
762
runtime_expansions = (Client.runtime_expansions
763
+ ("dbus_object_path",))
764
765
677
# dbus.service.Object doesn't use super(), so we can't either.
766
678
767
679
def __init__(self, bus = None, *args, **kwargs):
768
self._approvals_pending = 0
769
680
self.bus = bus
770
681
Client.__init__(self, *args, **kwargs)
771
682
# Only now, when this client is initialized, can it show up on
772
683
# the D-Bus
773
client_object_name = unicode(self.name).translate(
774
{ord("."): ord("_"),
775
ord("-"): ord("_")})
776
684
self.dbus_object_path = (dbus.ObjectPath
777
("/clients/" + client_object_name))
685
(u"/clients/"
686
+ self.name.replace(u".", u"_")))
778
687
DBusObjectWithProperties.__init__(self, self.bus,
779
688
self.dbus_object_path)
780
def _set_expires(self, value):
781
old_value = getattr(self, "_expires", None)
782
self._expires = value
783
if hasattr(self, "dbus_object_path") and old_value != value:
784
dbus_time = (self._datetime_to_dbus(self._expires,
785
variant_level=1))
786
self.PropertyChanged(dbus.String("Expires"),
787
dbus_time)
788
expires = property(lambda self: self._expires, _set_expires)
789
del _set_expires
790
791
def _get_approvals_pending(self):
792
return self._approvals_pending
793
def _set_approvals_pending(self, value):
794
old_value = self._approvals_pending
795
self._approvals_pending = value
796
bval = bool(value)
797
if (hasattr(self, "dbus_object_path")
798
and bval is not bool(old_value)):
799
dbus_bool = dbus.Boolean(bval, variant_level=1)
800
self.PropertyChanged(dbus.String("ApprovalPending"),
801
dbus_bool)
802
803
approvals_pending = property(_get_approvals_pending,
804
_set_approvals_pending)
805
del _get_approvals_pending, _set_approvals_pending
806
689
807
690
@staticmethod
808
691
def _datetime_to_dbus(dt, variant_level=0):
809
692
"""Convert a UTC datetime.datetime() to a D-Bus type."""
810
if dt is None:
811
return dbus.String("", variant_level = variant_level)
812
693
return dbus.String(dt.isoformat(),
813
694
variant_level=variant_level)
814
695
815
696
def enable(self):
816
oldstate = getattr(self, "enabled", False)
697
oldstate = getattr(self, u"enabled", False)
817
698
r = Client.enable(self)
818
699
if oldstate != self.enabled:
819
700
# Emit D-Bus signals
820
self.PropertyChanged(dbus.String("Enabled"),
701
self.PropertyChanged(dbus.String(u"enabled"),
821
702
dbus.Boolean(True, variant_level=1))
822
703
self.PropertyChanged(
823
dbus.String("LastEnabled"),
704
dbus.String(u"last_enabled"),
824
705
self._datetime_to_dbus(self.last_enabled,
825
706
variant_level=1))
826
707
return r
827
708
828
709
def disable(self, quiet = False):
829
oldstate = getattr(self, "enabled", False)
710
oldstate = getattr(self, u"enabled", False)
830
711
r = Client.disable(self, quiet=quiet)
831
712
if not quiet and oldstate != self.enabled:
832
713
# Emit D-Bus signal
833
self.PropertyChanged(dbus.String("Enabled"),
714
self.PropertyChanged(dbus.String(u"enabled"),
834
715
dbus.Boolean(False, variant_level=1))
835
716
return r
836
717
839
720
self.remove_from_connection()
840
721
except LookupError:
841
722
pass
842
if hasattr(DBusObjectWithProperties, "__del__"):
723
if hasattr(DBusObjectWithProperties, u"__del__"):
843
724
DBusObjectWithProperties.__del__(self, *args, **kwargs)
844
725
Client.__del__(self, *args, **kwargs)
845
726
848
729
self.checker_callback_tag = None
849
730
self.checker = None
850
731
# Emit D-Bus signal
851
self.PropertyChanged(dbus.String("CheckerRunning"),
732
self.PropertyChanged(dbus.String(u"checker_running"),
852
733
dbus.Boolean(False, variant_level=1))
853
734
if os.WIFEXITED(condition):
854
735
exitstatus = os.WEXITSTATUS(condition)
866
747
*args, **kwargs)
867
748
868
749
def checked_ok(self, *args, **kwargs):
869
Client.checked_ok(self, *args, **kwargs)
750
r = Client.checked_ok(self, *args, **kwargs)
870
751
# Emit D-Bus signal
871
752
self.PropertyChanged(
872
dbus.String("LastCheckedOK"),
753
dbus.String(u"last_checked_ok"),
873
754
(self._datetime_to_dbus(self.last_checked_ok,
874
755
variant_level=1)))
875
876
def need_approval(self, *args, **kwargs):
877
r = Client.need_approval(self, *args, **kwargs)
878
# Emit D-Bus signal
879
self.PropertyChanged(
880
dbus.String("LastApprovalRequest"),
881
(self._datetime_to_dbus(self.last_approval_request,
882
variant_level=1)))
883
756
return r
884
757
885
758
def start_checker(self, *args, **kwargs):
895
768
# Emit D-Bus signal
896
769
self.CheckerStarted(self.current_checker_command)
897
770
self.PropertyChanged(
898
dbus.String("CheckerRunning"),
771
dbus.String(u"checker_running"),
899
772
dbus.Boolean(True, variant_level=1))
900
773
return r
901
774
902
775
def stop_checker(self, *args, **kwargs):
903
old_checker = getattr(self, "checker", None)
776
old_checker = getattr(self, u"checker", None)
904
777
r = Client.stop_checker(self, *args, **kwargs)
905
778
if (old_checker is not None
906
and getattr(self, "checker", None) is None):
907
self.PropertyChanged(dbus.String("CheckerRunning"),
779
and getattr(self, u"checker", None) is None):
780
self.PropertyChanged(dbus.String(u"checker_running"),
908
781
dbus.Boolean(False, variant_level=1))
909
782
return r
910
911
def _reset_approved(self):
912
self._approved = None
913
return False
914
915
def approve(self, value=True):
916
self.send_changedstate()
917
self._approved = value
918
gobject.timeout_add(self._timedelta_to_milliseconds
919
(self.approval_duration),
920
self._reset_approved)
921
922
923
## D-Bus methods, signals & properties
924
_interface = "se.bsnet.fukt.Mandos.Client"
925
926
## Signals
783
784
## D-Bus methods & signals
785
_interface = u"se.bsnet.fukt.Mandos.Client"
786
787
# CheckedOK - method
788
@dbus.service.method(_interface)
789
def CheckedOK(self):
790
return self.checked_ok()
927
791
928
792
# CheckerCompleted - signal
929
@dbus.service.signal(_interface, signature="nxs")
793
@dbus.service.signal(_interface, signature=u"nxs")
930
794
def CheckerCompleted(self, exitcode, waitstatus, command):
931
795
"D-Bus signal"
932
796
pass
933
797
934
798
# CheckerStarted - signal
935
@dbus.service.signal(_interface, signature="s")
799
@dbus.service.signal(_interface, signature=u"s")
936
800
def CheckerStarted(self, command):
937
801
"D-Bus signal"
938
802
pass
939
803
940
804
# PropertyChanged - signal
941
@dbus.service.signal(_interface, signature="sv")
805
@dbus.service.signal(_interface, signature=u"sv")
942
806
def PropertyChanged(self, property, value):
943
807
"D-Bus signal"
944
808
pass
946
810
# GotSecret - signal
947
811
@dbus.service.signal(_interface)
948
812
def GotSecret(self):
949
"""D-Bus signal
950
Is sent after a successful transfer of secret from the Mandos
951
server to mandos-client
952
"""
813
"D-Bus signal"
953
814
pass
954
815
955
816
# Rejected - signal
956
@dbus.service.signal(_interface, signature="s")
957
def Rejected(self, reason):
817
@dbus.service.signal(_interface)
818
def Rejected(self):
958
819
"D-Bus signal"
959
820
pass
960
821
961
# NeedApproval - signal
962
@dbus.service.signal(_interface, signature="tb")
963
def NeedApproval(self, timeout, default):
964
"D-Bus signal"
965
return self.need_approval()
966
967
## Methods
968
969
# Approve - method
970
@dbus.service.method(_interface, in_signature="b")
971
def Approve(self, value):
972
self.approve(value)
973
974
# CheckedOK - method
975
@dbus.service.method(_interface)
976
def CheckedOK(self):
977
self.checked_ok()
978
979
822
# Enable - method
980
823
@dbus.service.method(_interface)
981
824
def Enable(self):
999
842
def StopChecker(self):
1000
843
self.stop_checker()
1001
844
1002
## Properties
1003
1004
# ApprovalPending - property
1005
@dbus_service_property(_interface, signature="b", access="read")
1006
def ApprovalPending_dbus_property(self):
1007
return dbus.Boolean(bool(self.approvals_pending))
1008
1009
# ApprovedByDefault - property
1010
@dbus_service_property(_interface, signature="b",
1011
access="readwrite")
1012
def ApprovedByDefault_dbus_property(self, value=None):
1013
if value is None: # get
1014
return dbus.Boolean(self.approved_by_default)
1015
old_value = self.approved_by_default
1016
self.approved_by_default = bool(value)
1017
# Emit D-Bus signal
1018
if old_value != self.approved_by_default:
1019
self.PropertyChanged(dbus.String("ApprovedByDefault"),
1020
dbus.Boolean(value, variant_level=1))
1021
1022
# ApprovalDelay - property
1023
@dbus_service_property(_interface, signature="t",
1024
access="readwrite")
1025
def ApprovalDelay_dbus_property(self, value=None):
1026
if value is None: # get
1027
return dbus.UInt64(self.approval_delay_milliseconds())
1028
old_value = self.approval_delay
1029
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1030
# Emit D-Bus signal
1031
if old_value != self.approval_delay:
1032
self.PropertyChanged(dbus.String("ApprovalDelay"),
1033
dbus.UInt64(value, variant_level=1))
1034
1035
# ApprovalDuration - property
1036
@dbus_service_property(_interface, signature="t",
1037
access="readwrite")
1038
def ApprovalDuration_dbus_property(self, value=None):
1039
if value is None: # get
1040
return dbus.UInt64(self._timedelta_to_milliseconds(
1041
self.approval_duration))
1042
old_value = self.approval_duration
1043
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1044
# Emit D-Bus signal
1045
if old_value != self.approval_duration:
1046
self.PropertyChanged(dbus.String("ApprovalDuration"),
1047
dbus.UInt64(value, variant_level=1))
1048
1049
# Name - property
1050
@dbus_service_property(_interface, signature="s", access="read")
1051
def Name_dbus_property(self):
845
# name - property
846
@dbus_service_property(_interface, signature=u"s", access=u"read")
847
def name_dbus_property(self):
1052
848
return dbus.String(self.name)
1053
849
1054
# Fingerprint - property
1055
@dbus_service_property(_interface, signature="s", access="read")
1056
def Fingerprint_dbus_property(self):
850
# fingerprint - property
851
@dbus_service_property(_interface, signature=u"s", access=u"read")
852
def fingerprint_dbus_property(self):
1057
853
return dbus.String(self.fingerprint)
1058
854
1059
# Host - property
1060
@dbus_service_property(_interface, signature="s",
1061
access="readwrite")
1062
def Host_dbus_property(self, value=None):
855
# host - property
856
@dbus_service_property(_interface, signature=u"s",
857
access=u"readwrite")
858
def host_dbus_property(self, value=None):
1063
859
if value is None: # get
1064
860
return dbus.String(self.host)
1065
old_value = self.host
1066
861
self.host = value
1067
862
# Emit D-Bus signal
1068
if old_value != self.host:
1069
self.PropertyChanged(dbus.String("Host"),
1070
dbus.String(value, variant_level=1))
863
self.PropertyChanged(dbus.String(u"host"),
864
dbus.String(value, variant_level=1))
1071
865
1072
# Created - property
1073
@dbus_service_property(_interface, signature="s", access="read")
1074
def Created_dbus_property(self):
866
# created - property
867
@dbus_service_property(_interface, signature=u"s", access=u"read")
868
def created_dbus_property(self):
1075
869
return dbus.String(self._datetime_to_dbus(self.created))
1076
870
1077
# LastEnabled - property
1078
@dbus_service_property(_interface, signature="s", access="read")
1079
def LastEnabled_dbus_property(self):
1080
return self._datetime_to_dbus(self.last_enabled)
871
# last_enabled - property
872
@dbus_service_property(_interface, signature=u"s", access=u"read")
873
def last_enabled_dbus_property(self):
874
if self.last_enabled is None:
875
return dbus.String(u"")
876
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1081
877
1082
# Enabled - property
1083
@dbus_service_property(_interface, signature="b",
1084
access="readwrite")
1085
def Enabled_dbus_property(self, value=None):
878
# enabled - property
879
@dbus_service_property(_interface, signature=u"b",
880
access=u"readwrite")
881
def enabled_dbus_property(self, value=None):
1086
882
if value is None: # get
1087
883
return dbus.Boolean(self.enabled)
1088
884
if value:
1090
886
else:
1091
887
self.disable()
1092
888
1093
# LastCheckedOK - property
1094
@dbus_service_property(_interface, signature="s",
1095
access="readwrite")
1096
def LastCheckedOK_dbus_property(self, value=None):
889
# last_checked_ok - property
890
@dbus_service_property(_interface, signature=u"s",
891
access=u"readwrite")
892
def last_checked_ok_dbus_property(self, value=None):
1097
893
if value is not None:
1098
894
self.checked_ok()
1099
895
return
1100
return self._datetime_to_dbus(self.last_checked_ok)
1101
1102
# Expires - property
1103
@dbus_service_property(_interface, signature="s", access="read")
1104
def Expires_dbus_property(self):
1105
return self._datetime_to_dbus(self.expires)
1106
1107
# LastApprovalRequest - property
1108
@dbus_service_property(_interface, signature="s", access="read")
1109
def LastApprovalRequest_dbus_property(self):
1110
return self._datetime_to_dbus(self.last_approval_request)
1111
1112
# Timeout - property
1113
@dbus_service_property(_interface, signature="t",
1114
access="readwrite")
1115
def Timeout_dbus_property(self, value=None):
896
if self.last_checked_ok is None:
897
return dbus.String(u"")
898
return dbus.String(self._datetime_to_dbus(self
899
.last_checked_ok))
900
901
# timeout - property
902
@dbus_service_property(_interface, signature=u"t",
903
access=u"readwrite")
904
def timeout_dbus_property(self, value=None):
1116
905
if value is None: # get
1117
906
return dbus.UInt64(self.timeout_milliseconds())
1118
old_value = self.timeout
1119
907
self.timeout = datetime.timedelta(0, 0, 0, value)
1120
908
# Emit D-Bus signal
1121
if old_value != self.timeout:
1122
self.PropertyChanged(dbus.String("Timeout"),
1123
dbus.UInt64(value, variant_level=1))
1124
if getattr(self, "disable_initiator_tag", None) is None:
909
self.PropertyChanged(dbus.String(u"timeout"),
910
dbus.UInt64(value, variant_level=1))
911
if getattr(self, u"disable_initiator_tag", None) is None:
1125
912
return
1126
913
# Reschedule timeout
1127
914
gobject.source_remove(self.disable_initiator_tag)
1128
915
self.disable_initiator_tag = None
1129
self.expires = None
1130
916
time_to_die = (self.
1131
917
_timedelta_to_milliseconds((self
1132
918
.last_checked_ok
1137
923
# The timeout has passed
1138
924
self.disable()
1139
925
else:
1140
self.expires = (datetime.datetime.utcnow()
1141
+ datetime.timedelta(milliseconds = time_to_die))
1142
926
self.disable_initiator_tag = (gobject.timeout_add
1143
927
(time_to_die, self.disable))
1144
1145
# ExtendedTimeout - property
1146
@dbus_service_property(_interface, signature="t",
1147
access="readwrite")
1148
def ExtendedTimeout_dbus_property(self, value=None):
1149
if value is None: # get
1150
return dbus.UInt64(self.extended_timeout_milliseconds())
1151
old_value = self.extended_timeout
1152
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1153
# Emit D-Bus signal
1154
if old_value != self.extended_timeout:
1155
self.PropertyChanged(dbus.String("ExtendedTimeout"),
1156
dbus.UInt64(value, variant_level=1))
1157
1158
# Interval - property
1159
@dbus_service_property(_interface, signature="t",
1160
access="readwrite")
1161
def Interval_dbus_property(self, value=None):
928
929
# interval - property
930
@dbus_service_property(_interface, signature=u"t",
931
access=u"readwrite")
932
def interval_dbus_property(self, value=None):
1162
933
if value is None: # get
1163
934
return dbus.UInt64(self.interval_milliseconds())
1164
old_value = self.interval
1165
935
self.interval = datetime.timedelta(0, 0, 0, value)
1166
936
# Emit D-Bus signal
1167
if old_value != self.interval:
1168
self.PropertyChanged(dbus.String("Interval"),
1169
dbus.UInt64(value, variant_level=1))
1170
if getattr(self, "checker_initiator_tag", None) is None:
937
self.PropertyChanged(dbus.String(u"interval"),
938
dbus.UInt64(value, variant_level=1))
939
if getattr(self, u"checker_initiator_tag", None) is None:
1171
940
return
1172
941
# Reschedule checker run
1173
942
gobject.source_remove(self.checker_initiator_tag)
1175
944
(value, self.start_checker))
1176
945
self.start_checker() # Start one now, too
1177
946
1178
# Checker - property
1179
@dbus_service_property(_interface, signature="s",
1180
access="readwrite")
1181
def Checker_dbus_property(self, value=None):
947
# checker - property
948
@dbus_service_property(_interface, signature=u"s",
949
access=u"readwrite")
950
def checker_dbus_property(self, value=None):
1182
951
if value is None: # get
1183
952
return dbus.String(self.checker_command)
1184
old_value = self.checker_command
1185
953
self.checker_command = value
1186
954
# Emit D-Bus signal
1187
if old_value != self.checker_command:
1188
self.PropertyChanged(dbus.String("Checker"),
1189
dbus.String(self.checker_command,
1190
variant_level=1))
955
self.PropertyChanged(dbus.String(u"checker"),
956
dbus.String(self.checker_command,
957
variant_level=1))
1191
958
1192
# CheckerRunning - property
1193
@dbus_service_property(_interface, signature="b",
1194
access="readwrite")
1195
def CheckerRunning_dbus_property(self, value=None):
959
# checker_running - property
960
@dbus_service_property(_interface, signature=u"b",
961
access=u"readwrite")
962
def checker_running_dbus_property(self, value=None):
1196
963
if value is None: # get
1197
964
return dbus.Boolean(self.checker is not None)
1198
965
if value:
1200
967
else:
1201
968
self.stop_checker()
1202
969
1203
# ObjectPath - property
1204
@dbus_service_property(_interface, signature="o", access="read")
1205
def ObjectPath_dbus_property(self):
970
# object_path - property
971
@dbus_service_property(_interface, signature=u"o", access=u"read")
972
def object_path_dbus_property(self):
1206
973
return self.dbus_object_path # is already a dbus.ObjectPath
1207
974
1208
# Secret = property
1209
@dbus_service_property(_interface, signature="ay",
1210
access="write", byte_arrays=True)
1211
def Secret_dbus_property(self, value):
975
# secret = property
976
@dbus_service_property(_interface, signature=u"ay",
977
access=u"write", byte_arrays=True)
978
def secret_dbus_property(self, value):
1212
979
self.secret = str(value)
1213
980
1214
981
del _interface
1215
982
1216
983
1217
class ProxyClient(object):
1218
def __init__(self, child_pipe, fpr, address):
1219
self._pipe = child_pipe
1220
self._pipe.send(('init', fpr, address))
1221
if not self._pipe.recv():
1222
raise KeyError()
1223
1224
def __getattribute__(self, name):
1225
if(name == '_pipe'):
1226
return super(ProxyClient, self).__getattribute__(name)
1227
self._pipe.send(('getattr', name))
1228
data = self._pipe.recv()
1229
if data[0] == 'data':
1230
return data[1]
1231
if data[0] == 'function':
1232
def func(*args, **kwargs):
1233
self._pipe.send(('funcall', name, args, kwargs))
1234
return self._pipe.recv()[1]
1235
return func
1236
1237
def __setattr__(self, name, value):
1238
if(name == '_pipe'):
1239
return super(ProxyClient, self).__setattr__(name, value)
1240
self._pipe.send(('setattr', name, value))
1241
1242
1243
984
class ClientHandler(socketserver.BaseRequestHandler, object):
1244
985
"""A class to handle client connections.
1245
986
1247
988
Note: This will run in its own forked process."""
1248
989
1249
990
def handle(self):
1250
with contextlib.closing(self.server.child_pipe) as child_pipe:
1251
logger.info("TCP connection from: %s",
1252
unicode(self.client_address))
1253
logger.debug("Pipe FD: %d",
1254
self.server.child_pipe.fileno())
1255
991
logger.info(u"TCP connection from: %s",
992
unicode(self.client_address))
993
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
994
# Open IPC pipe to parent process
995
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
1256
996
session = (gnutls.connection
1257
997
.ClientSession(self.request,
1258
998
gnutls.connection
1259
999
.X509Credentials()))
1260
1000
1001
line = self.request.makefile().readline()
1002
logger.debug(u"Protocol version: %r", line)
1003
try:
1004
if int(line.strip().split()[0]) > 1:
1005
raise RuntimeError
1006
except (ValueError, IndexError, RuntimeError), error:
1007
logger.error(u"Unknown protocol version: %s", error)
1008
return
1009
1261
1010
# Note: gnutls.connection.X509Credentials is really a
1262
1011
# generic GnuTLS certificate credentials object so long as
1263
1012
# no X.509 keys are added to it. Therefore, we can use it
1264
1013
# here despite using OpenPGP certificates.
1265
1266
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1267
# "+AES-256-CBC", "+SHA1",
1268
# "+COMP-NULL", "+CTYPE-OPENPGP",
1269
# "+DHE-DSS"))
1014
1015
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1016
# u"+AES-256-CBC", u"+SHA1",
1017
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1018
# u"+DHE-DSS"))
1270
1019
# Use a fallback default, since this MUST be set.
1271
1020
priority = self.server.gnutls_priority
1272
1021
if priority is None:
1273
priority = "NORMAL"
1022
priority = u"NORMAL"
1274
1023
(gnutls.library.functions
1275
1024
.gnutls_priority_set_direct(session._c_object,
1276
1025
priority, None))
1277
1278
# Start communication using the Mandos protocol
1279
# Get protocol number
1280
line = self.request.makefile().readline()
1281
logger.debug("Protocol version: %r", line)
1282
try:
1283
if int(line.strip().split()[0]) > 1:
1284
raise RuntimeError
1285
except (ValueError, IndexError, RuntimeError) as error:
1286
logger.error("Unknown protocol version: %s", error)
1287
return
1288
1289
# Start GnuTLS connection
1026
1290
1027
try:
1291
1028
session.handshake()
1292
except gnutls.errors.GNUTLSError as error:
1293
logger.warning("Handshake failed: %s", error)
1029
except gnutls.errors.GNUTLSError, error:
1030
logger.warning(u"Handshake failed: %s", error)
1294
1031
# Do not run session.bye() here: the session is not
1295
1032
# established. Just abandon the request.
1296
1033
return
1297
logger.debug("Handshake succeeded")
1298
1299
approval_required = False
1034
logger.debug(u"Handshake succeeded")
1300
1035
try:
1301
try:
1302
fpr = self.fingerprint(self.peer_certificate
1303
(session))
1304
except (TypeError,
1305
gnutls.errors.GNUTLSError) as error:
1306
logger.warning("Bad certificate: %s", error)
1307
return
1308
logger.debug("Fingerprint: %s", fpr)
1309
1310
try:
1311
client = ProxyClient(child_pipe, fpr,
1312
self.client_address)
1313
except KeyError:
1314
return
1315
1316
if client.approval_delay:
1317
delay = client.approval_delay
1318
client.approvals_pending += 1
1319
approval_required = True
1320
1321
while True:
1322
if not client.enabled:
1323
logger.info("Client %s is disabled",
1324
client.name)
1325
if self.server.use_dbus:
1326
# Emit D-Bus signal
1327
client.Rejected("Disabled")
1328
return
1329
1330
if client._approved or not client.approval_delay:
1331
#We are approved or approval is disabled
1332
break
1333
elif client._approved is None:
1334
logger.info("Client %s needs approval",
1335
client.name)
1336
if self.server.use_dbus:
1337
# Emit D-Bus signal
1338
client.NeedApproval(
1339
client.approval_delay_milliseconds(),
1340
client.approved_by_default)
1341
else:
1342
logger.warning("Client %s was not approved",
1343
client.name)
1344
if self.server.use_dbus:
1345
# Emit D-Bus signal
1346
client.Rejected("Denied")
1347
return
1348
1349
#wait until timeout or approved
1350
#x = float(client._timedelta_to_milliseconds(delay))
1351
time = datetime.datetime.now()
1352
client.changedstate.acquire()
1353
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1354
client.changedstate.release()
1355
time2 = datetime.datetime.now()
1356
if (time2 - time) >= delay:
1357
if not client.approved_by_default:
1358
logger.warning("Client %s timed out while"
1359
" waiting for approval",
1360
client.name)
1361
if self.server.use_dbus:
1362
# Emit D-Bus signal
1363
client.Rejected("Approval timed out")
1364
return
1365
else:
1366
break
1367
else:
1368
delay -= time2 - time
1369
1370
sent_size = 0
1371
while sent_size < len(client.secret):
1372
try:
1373
sent = session.send(client.secret[sent_size:])
1374
except gnutls.errors.GNUTLSError as error:
1375
logger.warning("gnutls send failed")
1376
return
1377
logger.debug("Sent: %d, remaining: %d",
1378
sent, len(client.secret)
1379
- (sent_size + sent))
1380
sent_size += sent
1381
1382
logger.info("Sending secret to %s", client.name)
1383
# bump the timeout as if seen
1384
client.checked_ok(client.extended_timeout)
1385
if self.server.use_dbus:
1386
# Emit D-Bus signal
1387
client.GotSecret()
1036
fpr = self.fingerprint(self.peer_certificate(session))
1037
except (TypeError, gnutls.errors.GNUTLSError), error:
1038
logger.warning(u"Bad certificate: %s", error)
1039
session.bye()
1040
return
1041
logger.debug(u"Fingerprint: %s", fpr)
1388
1042
1389
finally:
1390
if approval_required:
1391
client.approvals_pending -= 1
1392
try:
1393
session.bye()
1394
except gnutls.errors.GNUTLSError as error:
1395
logger.warning("GnuTLS bye failed")
1043
for c in self.server.clients:
1044
if c.fingerprint == fpr:
1045
client = c
1046
break
1047
else:
1048
ipc.write(u"NOTFOUND %s %s\n"
1049
% (fpr, unicode(self.client_address)))
1050
session.bye()
1051
return
1052
# Have to check if client.still_valid(), since it is
1053
# possible that the client timed out while establishing
1054
# the GnuTLS session.
1055
if not client.still_valid():
1056
ipc.write(u"INVALID %s\n" % client.name)
1057
session.bye()
1058
return
1059
ipc.write(u"SENDING %s\n" % client.name)
1060
sent_size = 0
1061
while sent_size < len(client.secret):
1062
sent = session.send(client.secret[sent_size:])
1063
logger.debug(u"Sent: %d, remaining: %d",
1064
sent, len(client.secret)
1065
- (sent_size + sent))
1066
sent_size += sent
1067
session.bye()
1396
1068
1397
1069
@staticmethod
1398
1070
def peer_certificate(session):
1408
1080
.gnutls_certificate_get_peers
1409
1081
(session._c_object, ctypes.byref(list_size)))
1410
1082
if not bool(cert_list) and list_size.value != 0:
1411
raise gnutls.errors.GNUTLSError("error getting peer"
1412
" certificate")
1083
raise gnutls.errors.GNUTLSError(u"error getting peer"
1084
u" certificate")
1413
1085
if list_size.value == 0:
1414
1086
return None
1415
1087
cert = cert_list[0]
1441
1113
if crtverify.value != 0:
1442
1114
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1443
1115
raise (gnutls.errors.CertificateSecurityError
1444
("Verify failed"))
1116
(u"Verify failed"))
1445
1117
# New buffer for the fingerprint
1446
1118
buf = ctypes.create_string_buffer(20)
1447
1119
buf_len = ctypes.c_size_t()
1454
1126
# Convert the buffer to a Python bytestring
1455
1127
fpr = ctypes.string_at(buf, buf_len.value)
1456
1128
# Convert the bytestring to hexadecimal notation
1457
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1129
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1458
1130
return hex_fpr
1459
1131
1460
1132
1461
class MultiprocessingMixIn(object):
1462
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1463
def sub_process_main(self, request, address):
1464
try:
1465
self.finish_request(request, address)
1466
except:
1467
self.handle_error(request, address)
1468
self.close_request(request)
1469
1470
def process_request(self, request, address):
1471
"""Start a new process to process the request."""
1472
multiprocessing.Process(target = self.sub_process_main,
1473
args = (request, address)).start()
1474
1475
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1476
""" adds a pipe to the MixIn """
1133
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
1134
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
1477
1135
def process_request(self, request, client_address):
1478
1136
"""Overrides and wraps the original process_request().
1479
1137
1480
1138
This function creates a new pipe in self.pipe
1481
1139
"""
1482
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1483
1484
super(MultiprocessingMixInWithPipe,
1140
self.pipe = os.pipe()
1141
super(ForkingMixInWithPipe,
1485
1142
self).process_request(request, client_address)
1486
self.child_pipe.close()
1487
self.add_pipe(parent_pipe)
1488
1489
def add_pipe(self, parent_pipe):
1143
os.close(self.pipe[1]) # close write end
1144
self.add_pipe(self.pipe[0])
1145
def add_pipe(self, pipe):
1490
1146
"""Dummy function; override as necessary"""
1491
raise NotImplementedError
1492
1493
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1147
os.close(pipe)
1148
1149
1150
class IPv6_TCPServer(ForkingMixInWithPipe,
1494
1151
socketserver.TCPServer, object):
1495
1152
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1496
1153
1512
1169
bind to an address or port if they were not specified."""
1513
1170
if self.interface is not None:
1514
1171
if SO_BINDTODEVICE is None:
1515
logger.error("SO_BINDTODEVICE does not exist;"
1516
" cannot bind to interface %s",
1172
logger.error(u"SO_BINDTODEVICE does not exist;"
1173
u" cannot bind to interface %s",
1517
1174
self.interface)
1518
1175
else:
1519
1176
try:
1520
1177
self.socket.setsockopt(socket.SOL_SOCKET,
1521
1178
SO_BINDTODEVICE,
1522
1179
str(self.interface
1523
+ '\0'))
1524
except socket.error as error:
1180
+ u'\0'))
1181
except socket.error, error:
1525
1182
if error[0] == errno.EPERM:
1526
logger.error("No permission to"
1527
" bind to interface %s",
1183
logger.error(u"No permission to"
1184
u" bind to interface %s",
1528
1185
self.interface)
1529
1186
elif error[0] == errno.ENOPROTOOPT:
1530
logger.error("SO_BINDTODEVICE not available;"
1531
" cannot bind to interface %s",
1187
logger.error(u"SO_BINDTODEVICE not available;"
1188
u" cannot bind to interface %s",
1532
1189
self.interface)
1533
1190
else:
1534
1191
raise
1536
1193
if self.server_address[0] or self.server_address[1]:
1537
1194
if not self.server_address[0]:
1538
1195
if self.address_family == socket.AF_INET6:
1539
any_address = "::" # in6addr_any
1196
any_address = u"::" # in6addr_any
1540
1197
else:
1541
1198
any_address = socket.INADDR_ANY
1542
1199
self.server_address = (any_address,
1581
1238
return socketserver.TCPServer.server_activate(self)
1582
1239
def enable(self):
1583
1240
self.enabled = True
1584
def add_pipe(self, parent_pipe):
1241
def add_pipe(self, pipe):
1585
1242
# Call "handle_ipc" for both data and EOF events
1586
gobject.io_add_watch(parent_pipe.fileno(),
1587
gobject.IO_IN | gobject.IO_HUP,
1588
functools.partial(self.handle_ipc,
1589
parent_pipe = parent_pipe))
1590
1591
def handle_ipc(self, source, condition, parent_pipe=None,
1592
client_object=None):
1243
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1244
self.handle_ipc)
1245
def handle_ipc(self, source, condition, file_objects={}):
1593
1246
condition_names = {
1594
gobject.IO_IN: "IN", # There is data to read.
1595
gobject.IO_OUT: "OUT", # Data can be written (without
1247
gobject.IO_IN: u"IN", # There is data to read.
1248
gobject.IO_OUT: u"OUT", # Data can be written (without
1596
1249
# blocking).
1597
gobject.IO_PRI: "PRI", # There is urgent data to read.
1598
gobject.IO_ERR: "ERR", # Error condition.
1599
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1250
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1251
gobject.IO_ERR: u"ERR", # Error condition.
1252
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1600
1253
# broken, usually for pipes and
1601
1254
# sockets).
1602
1255
}
1604
1257
for cond, name in
1605
1258
condition_names.iteritems()
1606
1259
if cond & condition)
1607
# error or the other end of multiprocessing.Pipe has closed
1608
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1609
return False
1610
1611
# Read a request from the child
1612
request = parent_pipe.recv()
1613
command = request[0]
1614
1615
if command == 'init':
1616
fpr = request[1]
1617
address = request[2]
1618
1619
for c in self.clients:
1620
if c.fingerprint == fpr:
1621
client = c
1622
break
1623
else:
1624
logger.info("Client not found for fingerprint: %s, ad"
1625
"dress: %s", fpr, address)
1626
if self.use_dbus:
1627
# Emit D-Bus signal
1628
mandos_dbus_service.ClientNotFound(fpr, address[0])
1629
parent_pipe.send(False)
1630
return False
1631
1632
gobject.io_add_watch(parent_pipe.fileno(),
1633
gobject.IO_IN | gobject.IO_HUP,
1634
functools.partial(self.handle_ipc,
1635
parent_pipe = parent_pipe,
1636
client_object = client))
1637
parent_pipe.send(True)
1638
# remove the old hook in favor of the new above hook on same fileno
1639
return False
1640
if command == 'funcall':
1641
funcname = request[1]
1642
args = request[2]
1643
kwargs = request[3]
1644
1645
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1646
1647
if command == 'getattr':
1648
attrname = request[1]
1649
if callable(client_object.__getattribute__(attrname)):
1650
parent_pipe.send(('function',))
1651
else:
1652
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1653
1654
if command == 'setattr':
1655
attrname = request[1]
1656
value = request[2]
1657
setattr(client_object, attrname, value)
1658
1260
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1261
conditions_string)
1262
1263
# Turn the pipe file descriptor into a Python file object
1264
if source not in file_objects:
1265
file_objects[source] = os.fdopen(source, u"r", 1)
1266
1267
# Read a line from the file object
1268
cmdline = file_objects[source].readline()
1269
if not cmdline: # Empty line means end of file
1270
# close the IPC pipe
1271
file_objects[source].close()
1272
del file_objects[source]
1273
1274
# Stop calling this function
1275
return False
1276
1277
logger.debug(u"IPC command: %r", cmdline)
1278
1279
# Parse and act on command
1280
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1281
1282
if cmd == u"NOTFOUND":
1283
logger.warning(u"Client not found for fingerprint: %s",
1284
args)
1285
if self.use_dbus:
1286
# Emit D-Bus signal
1287
mandos_dbus_service.ClientNotFound(args)
1288
elif cmd == u"INVALID":
1289
for client in self.clients:
1290
if client.name == args:
1291
logger.warning(u"Client %s is invalid", args)
1292
if self.use_dbus:
1293
# Emit D-Bus signal
1294
client.Rejected()
1295
break
1296
else:
1297
logger.error(u"Unknown client %s is invalid", args)
1298
elif cmd == u"SENDING":
1299
for client in self.clients:
1300
if client.name == args:
1301
logger.info(u"Sending secret to %s", client.name)
1302
client.checked_ok()
1303
if self.use_dbus:
1304
# Emit D-Bus signal
1305
client.GotSecret()
1306
break
1307
else:
1308
logger.error(u"Sending secret to unknown client %s",
1309
args)
1310
else:
1311
logger.error(u"Unknown IPC command: %r", cmdline)
1312
1313
# Keep calling this function
1659
1314
return True
1660
1315
1661
1316
1662
1317
def string_to_delta(interval):
1663
1318
"""Parse a string and return a datetime.timedelta
1664
1319
1665
>>> string_to_delta('7d')
1320
>>> string_to_delta(u'7d')
1666
1321
datetime.timedelta(7)
1667
>>> string_to_delta('60s')
1322
>>> string_to_delta(u'60s')
1668
1323
datetime.timedelta(0, 60)
1669
>>> string_to_delta('60m')
1324
>>> string_to_delta(u'60m')
1670
1325
datetime.timedelta(0, 3600)
1671
>>> string_to_delta('24h')
1326
>>> string_to_delta(u'24h')
1672
1327
datetime.timedelta(1)
1673
>>> string_to_delta('1w')
1328
>>> string_to_delta(u'1w')
1674
1329
datetime.timedelta(7)
1675
>>> string_to_delta('5m 30s')
1330
>>> string_to_delta(u'5m 30s')
1676
1331
datetime.timedelta(0, 330)
1677
1332
"""
1678
1333
timevalue = datetime.timedelta(0)
1680
1335
try:
1681
1336
suffix = unicode(s[-1])
1682
1337
value = int(s[:-1])
1683
if suffix == "d":
1338
if suffix == u"d":
1684
1339
delta = datetime.timedelta(value)
1685
elif suffix == "s":
1340
elif suffix == u"s":
1686
1341
delta = datetime.timedelta(0, value)
1687
elif suffix == "m":
1342
elif suffix == u"m":
1688
1343
delta = datetime.timedelta(0, 0, 0, 0, value)
1689
elif suffix == "h":
1344
elif suffix == u"h":
1690
1345
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1691
elif suffix == "w":
1346
elif suffix == u"w":
1692
1347
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1693
1348
else:
1694
raise ValueError("Unknown suffix %r" % suffix)
1695
except (ValueError, IndexError) as e:
1696
raise ValueError(*(e.args))
1349
raise ValueError(u"Unknown suffix %r" % suffix)
1350
except (ValueError, IndexError), e:
1351
raise ValueError(e.message)
1697
1352
timevalue += delta
1698
1353
return timevalue
1699
1354
1705
1360
global if_nametoindex
1706
1361
try:
1707
1362
if_nametoindex = (ctypes.cdll.LoadLibrary
1708
(ctypes.util.find_library("c"))
1363
(ctypes.util.find_library(u"c"))
1709
1364
.if_nametoindex)
1710
1365
except (OSError, AttributeError):
1711
logger.warning("Doing if_nametoindex the hard way")
1366
logger.warning(u"Doing if_nametoindex the hard way")
1712
1367
def if_nametoindex(interface):
1713
1368
"Get an interface index the hard way, i.e. using fcntl()"
1714
1369
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1715
with contextlib.closing(socket.socket()) as s:
1370
with closing(socket.socket()) as s:
1716
1371
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1717
struct.pack(str("16s16x"),
1372
struct.pack(str(u"16s16x"),
1718
1373
interface))
1719
interface_index = struct.unpack(str("I"),
1374
interface_index = struct.unpack(str(u"I"),
1720
1375
ifreq[16:20])[0]
1721
1376
return interface_index
1722
1377
return if_nametoindex(interface)
1730
1385
sys.exit()
1731
1386
os.setsid()
1732
1387
if not nochdir:
1733
os.chdir("/")
1388
os.chdir(u"/")
1734
1389
if os.fork():
1735
1390
sys.exit()
1736
1391
if not noclose:
1738
1393
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1739
1394
if not stat.S_ISCHR(os.fstat(null).st_mode):
1740
1395
raise OSError(errno.ENODEV,
1741
"%s not a character device"
1396
u"%s not a character device"
1742
1397
% os.path.devnull)
1743
1398
os.dup2(null, sys.stdin.fileno())
1744
1399
os.dup2(null, sys.stdout.fileno())
1752
1407
##################################################################
1753
1408
# Parsing of options, both command line and config file
1754
1409
1755
parser = argparse.ArgumentParser()
1756
parser.add_argument("-v", "--version", action="version",
1757
version = "%%(prog)s %s" % version,
1758
help="show version number and exit")
1759
parser.add_argument("-i", "--interface", metavar="IF",
1760
help="Bind to interface IF")
1761
parser.add_argument("-a", "--address",
1762
help="Address to listen for requests on")
1763
parser.add_argument("-p", "--port", type=int,
1764
help="Port number to receive requests on")
1765
parser.add_argument("--check", action="store_true",
1766
help="Run self-test")
1767
parser.add_argument("--debug", action="store_true",
1768
help="Debug mode; run in foreground and log"
1769
" to terminal")
1770
parser.add_argument("--debuglevel", metavar="LEVEL",
1771
help="Debug level for stdout output")
1772
parser.add_argument("--priority", help="GnuTLS"
1773
" priority string (see GnuTLS documentation)")
1774
parser.add_argument("--servicename",
1775
metavar="NAME", help="Zeroconf service name")
1776
parser.add_argument("--configdir",
1777
default="/etc/mandos", metavar="DIR",
1778
help="Directory to search for configuration"
1779
" files")
1780
parser.add_argument("--no-dbus", action="store_false",
1781
dest="use_dbus", help="Do not provide D-Bus"
1782
" system bus interface")
1783
parser.add_argument("--no-ipv6", action="store_false",
1784
dest="use_ipv6", help="Do not use IPv6")
1785
options = parser.parse_args()
1410
parser = optparse.OptionParser(version = "%%prog %s" % version)
1411
parser.add_option("-i", u"--interface", type=u"string",
1412
metavar="IF", help=u"Bind to interface IF")
1413
parser.add_option("-a", u"--address", type=u"string",
1414
help=u"Address to listen for requests on")
1415
parser.add_option("-p", u"--port", type=u"int",
1416
help=u"Port number to receive requests on")
1417
parser.add_option("--check", action=u"store_true",
1418
help=u"Run self-test")
1419
parser.add_option("--debug", action=u"store_true",
1420
help=u"Debug mode; run in foreground and log to"
1421
u" terminal")
1422
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1423
u" priority string (see GnuTLS documentation)")
1424
parser.add_option("--servicename", type=u"string",
1425
metavar=u"NAME", help=u"Zeroconf service name")
1426
parser.add_option("--configdir", type=u"string",
1427
default=u"/etc/mandos", metavar=u"DIR",
1428
help=u"Directory to search for configuration"
1429
u" files")
1430
parser.add_option("--no-dbus", action=u"store_false",
1431
dest=u"use_dbus", help=u"Do not provide D-Bus"
1432
u" system bus interface")
1433
parser.add_option("--no-ipv6", action=u"store_false",
1434
dest=u"use_ipv6", help=u"Do not use IPv6")
1435
options = parser.parse_args()[0]
1786
1436
1787
1437
if options.check:
1788
1438
import doctest
1790
1440
sys.exit()
1791
1441
1792
1442
# Default values for config file for server-global settings
1793
server_defaults = { "interface": "",
1794
"address": "",
1795
"port": "",
1796
"debug": "False",
1797
"priority":
1798
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1799
"servicename": "Mandos",
1800
"use_dbus": "True",
1801
"use_ipv6": "True",
1802
"debuglevel": "",
1443
server_defaults = { u"interface": u"",
1444
u"address": u"",
1445
u"port": u"",
1446
u"debug": u"False",
1447
u"priority":
1448
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1449
u"servicename": u"Mandos",
1450
u"use_dbus": u"True",
1451
u"use_ipv6": u"True",
1803
1452
}
1804
1453
1805
1454
# Parse config file for server-global settings
1806
1455
server_config = configparser.SafeConfigParser(server_defaults)
1807
1456
del server_defaults
1808
1457
server_config.read(os.path.join(options.configdir,
1809
"mandos.conf"))
1458
u"mandos.conf"))
1810
1459
# Convert the SafeConfigParser object to a dict
1811
1460
server_settings = server_config.defaults()
1812
1461
# Use the appropriate methods on the non-string config options
1813
for option in ("debug", "use_dbus", "use_ipv6"):
1814
server_settings[option] = server_config.getboolean("DEFAULT",
1462
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1463
server_settings[option] = server_config.getboolean(u"DEFAULT",
1815
1464
option)
1816
1465
if server_settings["port"]:
1817
server_settings["port"] = server_config.getint("DEFAULT",
1818
"port")
1466
server_settings["port"] = server_config.getint(u"DEFAULT",
1467
u"port")
1819
1468
del server_config
1820
1469
1821
1470
# Override the settings from the config file with command line
1822
1471
# options, if set.
1823
for option in ("interface", "address", "port", "debug",
1824
"priority", "servicename", "configdir",
1825
"use_dbus", "use_ipv6", "debuglevel"):
1472
for option in (u"interface", u"address", u"port", u"debug",
1473
u"priority", u"servicename", u"configdir",
1474
u"use_dbus", u"use_ipv6"):
1826
1475
value = getattr(options, option)
1827
1476
if value is not None:
1828
1477
server_settings[option] = value
1836
1485
##################################################################
1837
1486
1838
1487
# For convenience
1839
debug = server_settings["debug"]
1840
debuglevel = server_settings["debuglevel"]
1841
use_dbus = server_settings["use_dbus"]
1842
use_ipv6 = server_settings["use_ipv6"]
1843
1844
if server_settings["servicename"] != "Mandos":
1488
debug = server_settings[u"debug"]
1489
use_dbus = server_settings[u"use_dbus"]
1490
use_ipv6 = server_settings[u"use_ipv6"]
1491
1492
if not debug:
1493
syslogger.setLevel(logging.WARNING)
1494
console.setLevel(logging.WARNING)
1495
1496
if server_settings[u"servicename"] != u"Mandos":
1845
1497
syslogger.setFormatter(logging.Formatter
1846
('Mandos (%s) [%%(process)d]:'
1847
' %%(levelname)s: %%(message)s'
1848
% server_settings["servicename"]))
1498
(u'Mandos (%s) [%%(process)d]:'
1499
u' %%(levelname)s: %%(message)s'
1500
% server_settings[u"servicename"]))
1849
1501
1850
1502
# Parse config file with clients
1851
client_defaults = { "timeout": "5m",
1852
"extended_timeout": "15m",
1853
"interval": "2m",
1854
"checker": "fping -q -- %%(host)s",
1855
"host": "",
1856
"approval_delay": "0s",
1857
"approval_duration": "1s",
1503
client_defaults = { u"timeout": u"1h",
1504
u"interval": u"5m",
1505
u"checker": u"fping -q -- %%(host)s",
1506
u"host": u"",
1858
1507
}
1859
1508
client_config = configparser.SafeConfigParser(client_defaults)
1860
client_config.read(os.path.join(server_settings["configdir"],
1861
"clients.conf"))
1509
client_config.read(os.path.join(server_settings[u"configdir"],
1510
u"clients.conf"))
1862
1511
1863
1512
global mandos_dbus_service
1864
1513
mandos_dbus_service = None
1865
1514
1866
tcp_server = MandosServer((server_settings["address"],
1867
server_settings["port"]),
1515
tcp_server = MandosServer((server_settings[u"address"],
1516
server_settings[u"port"]),
1868
1517
ClientHandler,
1869
interface=(server_settings["interface"]
1870
or None),
1518
interface=server_settings[u"interface"],
1871
1519
use_ipv6=use_ipv6,
1872
1520
gnutls_priority=
1873
server_settings["priority"],
1521
server_settings[u"priority"],
1874
1522
use_dbus=use_dbus)
1875
if not debug:
1876
pidfilename = "/var/run/mandos.pid"
1877
try:
1878
pidfile = open(pidfilename, "w")
1879
except IOError:
1880
logger.error("Could not open file %r", pidfilename)
1523
pidfilename = u"/var/run/mandos.pid"
1524
try:
1525
pidfile = open(pidfilename, u"w")
1526
except IOError:
1527
logger.error(u"Could not open file %r", pidfilename)
1881
1528
1882
1529
try:
1883
uid = pwd.getpwnam("_mandos").pw_uid
1884
gid = pwd.getpwnam("_mandos").pw_gid
1530
uid = pwd.getpwnam(u"_mandos").pw_uid
1531
gid = pwd.getpwnam(u"_mandos").pw_gid
1885
1532
except KeyError:
1886
1533
try:
1887
uid = pwd.getpwnam("mandos").pw_uid
1888
gid = pwd.getpwnam("mandos").pw_gid
1534
uid = pwd.getpwnam(u"mandos").pw_uid
1535
gid = pwd.getpwnam(u"mandos").pw_gid
1889
1536
except KeyError:
1890
1537
try:
1891
uid = pwd.getpwnam("nobody").pw_uid
1892
gid = pwd.getpwnam("nobody").pw_gid
1538
uid = pwd.getpwnam(u"nobody").pw_uid
1539
gid = pwd.getpwnam(u"nobody").pw_gid
1893
1540
except KeyError:
1894
1541
uid = 65534
1895
1542
gid = 65534
1896
1543
try:
1897
1544
os.setgid(gid)
1898
1545
os.setuid(uid)
1899
except OSError as error:
1546
except OSError, error:
1900
1547
if error[0] != errno.EPERM:
1901
1548
raise error
1902
1549
1903
if not debug and not debuglevel:
1904
syslogger.setLevel(logging.WARNING)
1905
console.setLevel(logging.WARNING)
1906
if debuglevel:
1907
level = getattr(logging, debuglevel.upper())
1908
syslogger.setLevel(level)
1909
console.setLevel(level)
1910
1550
# Enable all possible GnuTLS debugging
1911
1551
if debug:
1912
# Enable all possible GnuTLS debugging
1913
1914
1552
# "Use a log level over 10 to enable all debugging options."
1915
1553
# - GnuTLS manual
1916
1554
gnutls.library.functions.gnutls_global_set_log_level(11)
1917
1555
1918
1556
@gnutls.library.types.gnutls_log_func
1919
1557
def debug_gnutls(level, string):
1920
logger.debug("GnuTLS: %s", string[:-1])
1558
logger.debug(u"GnuTLS: %s", string[:-1])
1921
1559
1922
1560
(gnutls.library.functions
1923
1561
.gnutls_global_set_log_function(debug_gnutls))
1924
1925
# Redirect stdin so all checkers get /dev/null
1926
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1927
os.dup2(null, sys.stdin.fileno())
1928
if null > 2:
1929
os.close(null)
1930
else:
1931
# No console logging
1932
logger.removeHandler(console)
1933
1934
# Need to fork before connecting to D-Bus
1935
if not debug:
1936
# Close all input and output, do double fork, etc.
1937
daemon()
1938
1562
1939
1563
global main_loop
1940
1564
# From the Avahi example code
1944
1568
# End of Avahi example code
1945
1569
if use_dbus:
1946
1570
try:
1947
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1571
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1948
1572
bus, do_not_queue=True)
1949
except dbus.exceptions.NameExistsException as e:
1950
logger.error(unicode(e) + ", disabling D-Bus")
1573
except dbus.exceptions.NameExistsException, e:
1574
logger.error(unicode(e) + u", disabling D-Bus")
1951
1575
use_dbus = False
1952
server_settings["use_dbus"] = False
1576
server_settings[u"use_dbus"] = False
1953
1577
tcp_server.use_dbus = False
1954
1578
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1955
service = AvahiService(name = server_settings["servicename"],
1956
servicetype = "_mandos._tcp",
1579
service = AvahiService(name = server_settings[u"servicename"],
1580
servicetype = u"_mandos._tcp",
1957
1581
protocol = protocol, bus = bus)
1958
1582
if server_settings["interface"]:
1959
1583
service.interface = (if_nametoindex
1960
(str(server_settings["interface"])))
1961
1962
global multiprocessing_manager
1963
multiprocessing_manager = multiprocessing.Manager()
1584
(str(server_settings[u"interface"])))
1964
1585
1965
1586
client_class = Client
1966
1587
if use_dbus:
1967
1588
client_class = functools.partial(ClientDBus, bus = bus)
1968
def client_config_items(config, section):
1969
special_settings = {
1970
"approved_by_default":
1971
lambda: config.getboolean(section,
1972
"approved_by_default"),
1973
}
1974
for name, value in config.items(section):
1975
try:
1976
yield (name, special_settings[name]())
1977
except KeyError:
1978
yield (name, value)
1979
1980
1589
tcp_server.clients.update(set(
1981
1590
client_class(name = section,
1982
config= dict(client_config_items(
1983
client_config, section)))
1591
config= dict(client_config.items(section)))
1984
1592
for section in client_config.sections()))
1985
1593
if not tcp_server.clients:
1986
logger.warning("No clients defined")
1987
1594
logger.warning(u"No clients defined")
1595
1596
if debug:
1597
# Redirect stdin so all checkers get /dev/null
1598
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1599
os.dup2(null, sys.stdin.fileno())
1600
if null > 2:
1601
os.close(null)
1602
else:
1603
# No console logging
1604
logger.removeHandler(console)
1605
# Close all input and output, do double fork, etc.
1606
daemon()
1607
1608
try:
1609
with closing(pidfile):
1610
pid = os.getpid()
1611
pidfile.write(str(pid) + "\n")
1612
del pidfile
1613
except IOError:
1614
logger.error(u"Could not write to file %r with PID %d",
1615
pidfilename, pid)
1616
except NameError:
1617
# "pidfile" was never created
1618
pass
1619
del pidfilename
1620
1988
1621
if not debug:
1989
try:
1990
with pidfile:
1991
pid = os.getpid()
1992
pidfile.write(str(pid) + "\n".encode("utf-8"))
1993
del pidfile
1994
except IOError:
1995
logger.error("Could not write to file %r with PID %d",
1996
pidfilename, pid)
1997
except NameError:
1998
# "pidfile" was never created
1999
pass
2000
del pidfilename
2001
2002
1622
signal.signal(signal.SIGINT, signal.SIG_IGN)
2003
2004
1623
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2005
1624
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2006
1625
2008
1627
class MandosDBusService(dbus.service.Object):
2009
1628
"""A D-Bus proxy object"""
2010
1629
def __init__(self):
2011
dbus.service.Object.__init__(self, bus, "/")
2012
_interface = "se.bsnet.fukt.Mandos"
2013
2014
@dbus.service.signal(_interface, signature="o")
2015
def ClientAdded(self, objpath):
2016
"D-Bus signal"
2017
pass
2018
2019
@dbus.service.signal(_interface, signature="ss")
2020
def ClientNotFound(self, fingerprint, address):
2021
"D-Bus signal"
2022
pass
2023
2024
@dbus.service.signal(_interface, signature="os")
1630
dbus.service.Object.__init__(self, bus, u"/")
1631
_interface = u"se.bsnet.fukt.Mandos"
1632
1633
@dbus.service.signal(_interface, signature=u"oa{sv}")
1634
def ClientAdded(self, objpath, properties):
1635
"D-Bus signal"
1636
pass
1637
1638
@dbus.service.signal(_interface, signature=u"s")
1639
def ClientNotFound(self, fingerprint):
1640
"D-Bus signal"
1641
pass
1642
1643
@dbus.service.signal(_interface, signature=u"os")
2025
1644
def ClientRemoved(self, objpath, name):
2026
1645
"D-Bus signal"
2027
1646
pass
2028
1647
2029
@dbus.service.method(_interface, out_signature="ao")
1648
@dbus.service.method(_interface, out_signature=u"ao")
2030
1649
def GetAllClients(self):
2031
1650
"D-Bus method"
2032
1651
return dbus.Array(c.dbus_object_path
2033
1652
for c in tcp_server.clients)
2034
1653
2035
1654
@dbus.service.method(_interface,
2036
out_signature="a{oa{sv}}")
1655
out_signature=u"a{oa{sv}}")
2037
1656
def GetAllClientsWithProperties(self):
2038
1657
"D-Bus method"
2039
1658
return dbus.Dictionary(
2040
((c.dbus_object_path, c.GetAll(""))
1659
((c.dbus_object_path, c.GetAll(u""))
2041
1660
for c in tcp_server.clients),
2042
signature="oa{sv}")
1661
signature=u"oa{sv}")
2043
1662
2044
@dbus.service.method(_interface, in_signature="o")
1663
@dbus.service.method(_interface, in_signature=u"o")
2045
1664
def RemoveClient(self, object_path):
2046
1665
"D-Bus method"
2047
1666
for c in tcp_server.clients:
2080
1699
for client in tcp_server.clients:
2081
1700
if use_dbus:
2082
1701
# Emit D-Bus signal
2083
mandos_dbus_service.ClientAdded(client.dbus_object_path)
1702
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1703
client.GetAll(u""))
2084
1704
client.enable()
2085
1705
2086
1706
tcp_server.enable()
2089
1709
# Find out what port we got
2090
1710
service.port = tcp_server.socket.getsockname()[1]
2091
1711
if use_ipv6:
2092
logger.info("Now listening on address %r, port %d,"
1712
logger.info(u"Now listening on address %r, port %d,"
2093
1713
" flowinfo %d, scope_id %d"
2094
1714
% tcp_server.socket.getsockname())
2095
1715
else: # IPv4
2096
logger.info("Now listening on address %r, port %d"
1716
logger.info(u"Now listening on address %r, port %d"
2097
1717
% tcp_server.socket.getsockname())
2098
1718
2099
1719
#service.interface = tcp_server.socket.getsockname()[3]
2102
1722
# From the Avahi example code
2103
1723
try:
2104
1724
service.activate()
2105
except dbus.exceptions.DBusException as error:
2106
logger.critical("DBusException: %s", error)
1725
except dbus.exceptions.DBusException, error:
1726
logger.critical(u"DBusException: %s", error)
2107
1727
cleanup()
2108
1728
sys.exit(1)
2109
1729
# End of Avahi example code
2113
1733
(tcp_server.handle_request
2114
1734
(*args[2:], **kwargs) or True))
2115
1735
2116
logger.debug("Starting main loop")
1736
logger.debug(u"Starting main loop")
2117
1737
main_loop.run()
2118
except AvahiError as error:
2119
logger.critical("AvahiError: %s", error)
1738
except AvahiError, error:
1739
logger.critical(u"AvahiError: %s", error)
2120
1740
cleanup()
2121
1741
sys.exit(1)
2122
1742
except KeyboardInterrupt:
2123
1743
if debug:
2124
print("", file=sys.stderr)
2125
logger.debug("Server received KeyboardInterrupt")
2126
logger.debug("Server exiting")
1744
print >> sys.stderr
1745
logger.debug(u"Server received KeyboardInterrupt")
1746
logger.debug(u"Server exiting")
2127
1747
# Must run before the D-Bus bus name gets deregistered
2128
1748
cleanup()
2129
1749
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0