To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 413
- compare with another revision
- download diff
- download tarball
- view history from revision 413
- Committer: Teddy Hogeborn
- Date: 2009-12-27 03:35:58 UTC
- Revision ID: teddy@fukt.bsnet.se-20091227033558-y57wv1u4cls3i8kq
TODO file changes.
- files removed:
- DBUS-API
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
31
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
36
import SocketServer as socketserver
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
61
60
import fcntl
62
61
import functools
63
62
import cPickle as pickle
64
import multiprocessing
65
63
66
64
import dbus
67
65
import dbus.service
82
80
SO_BINDTODEVICE = None
83
81
84
82
85
version = "1.3.1"
83
version = "1.0.14"
86
84
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
85
logger = logging.Logger(u'mandos')
89
86
syslogger = (logging.handlers.SysLogHandler
90
87
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
address = str("/dev/log")))
88
address = "/dev/log"))
92
89
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
90
(u'Mandos [%(process)d]: %(levelname)s:'
91
u' %(message)s'))
95
92
logger.addHandler(syslogger)
96
93
97
94
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
100
' %(message)s'))
95
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
96
u' %(levelname)s:'
97
u' %(message)s'))
101
98
logger.addHandler(console)
102
99
103
100
class AvahiError(Exception):
120
117
Attributes:
121
118
interface: integer; avahi.IF_UNSPEC or an interface index.
122
119
Used to optionally bind to the specified interface.
123
name: string; Example: 'Mandos'
124
type: string; Example: '_mandos._tcp'.
120
name: string; Example: u'Mandos'
121
type: string; Example: u'_mandos._tcp'.
125
122
See <http://www.dns-sd.org/ServiceTypes.html>
126
123
port: integer; what port to announce
127
124
TXT: list of strings; TXT record for the service
136
133
"""
137
134
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
135
servicetype = None, port = None, TXT = None,
139
domain = "", host = "", max_renames = 32768,
136
domain = u"", host = u"", max_renames = 32768,
140
137
protocol = avahi.PROTO_UNSPEC, bus = None):
141
138
self.interface = interface
142
139
self.name = name
151
148
self.group = None # our entry group
152
149
self.server = None
153
150
self.bus = bus
154
self.entry_group_state_changed_match = None
155
151
def rename(self):
156
152
"""Derived from the Avahi example code"""
157
153
if self.rename_count >= self.max_renames:
158
logger.critical("No suitable Zeroconf service name found"
159
" after %i retries, exiting.",
154
logger.critical(u"No suitable Zeroconf service name found"
155
u" after %i retries, exiting.",
160
156
self.rename_count)
161
raise AvahiServiceError("Too many renames")
162
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
163
logger.info("Changing Zeroconf service name to %r ...",
164
self.name)
157
raise AvahiServiceError(u"Too many renames")
158
self.name = self.server.GetAlternativeServiceName(self.name)
159
logger.info(u"Changing Zeroconf service name to %r ...",
160
unicode(self.name))
165
161
syslogger.setFormatter(logging.Formatter
166
('Mandos (%s) [%%(process)d]:'
167
' %%(levelname)s: %%(message)s'
162
(u'Mandos (%s) [%%(process)d]:'
163
u' %%(levelname)s: %%(message)s'
168
164
% self.name))
169
165
self.remove()
170
try:
171
self.add()
172
except dbus.exceptions.DBusException as error:
173
logger.critical("DBusException: %s", error)
174
self.cleanup()
175
os._exit(1)
166
self.add()
176
167
self.rename_count += 1
177
168
def remove(self):
178
169
"""Derived from the Avahi example code"""
179
if self.entry_group_state_changed_match is not None:
180
self.entry_group_state_changed_match.remove()
181
self.entry_group_state_changed_match = None
182
170
if self.group is not None:
183
171
self.group.Reset()
184
172
def add(self):
185
173
"""Derived from the Avahi example code"""
186
self.remove()
187
174
if self.group is None:
188
175
self.group = dbus.Interface(
189
176
self.bus.get_object(avahi.DBUS_NAME,
190
177
self.server.EntryGroupNew()),
191
178
avahi.DBUS_INTERFACE_ENTRY_GROUP)
192
self.entry_group_state_changed_match = (
193
self.group.connect_to_signal(
194
'StateChanged', self .entry_group_state_changed))
195
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
179
self.group.connect_to_signal('StateChanged',
180
self
181
.entry_group_state_changed)
182
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
196
183
self.name, self.type)
197
184
self.group.AddService(
198
185
self.interface,
205
192
self.group.Commit()
206
193
def entry_group_state_changed(self, state, error):
207
194
"""Derived from the Avahi example code"""
208
logger.debug("Avahi entry group state change: %i", state)
195
logger.debug(u"Avahi state change: %i", state)
209
196
210
197
if state == avahi.ENTRY_GROUP_ESTABLISHED:
211
logger.debug("Zeroconf service established.")
198
logger.debug(u"Zeroconf service established.")
212
199
elif state == avahi.ENTRY_GROUP_COLLISION:
213
logger.info("Zeroconf service name collision.")
200
logger.warning(u"Zeroconf service name collision.")
214
201
self.rename()
215
202
elif state == avahi.ENTRY_GROUP_FAILURE:
216
logger.critical("Avahi: Error in group state changed %s",
203
logger.critical(u"Avahi: Error in group state changed %s",
217
204
unicode(error))
218
raise AvahiGroupError("State changed: %s"
205
raise AvahiGroupError(u"State changed: %s"
219
206
% unicode(error))
220
207
def cleanup(self):
221
208
"""Derived from the Avahi example code"""
222
209
if self.group is not None:
223
try:
224
self.group.Free()
225
except (dbus.exceptions.UnknownMethodException,
226
dbus.exceptions.DBusException) as e:
227
pass
210
self.group.Free()
228
211
self.group = None
229
self.remove()
230
def server_state_changed(self, state, error=None):
212
def server_state_changed(self, state):
231
213
"""Derived from the Avahi example code"""
232
logger.debug("Avahi server state change: %i", state)
233
bad_states = { avahi.SERVER_INVALID:
234
"Zeroconf server invalid",
235
avahi.SERVER_REGISTERING: None,
236
avahi.SERVER_COLLISION:
237
"Zeroconf server name collision",
238
avahi.SERVER_FAILURE:
239
"Zeroconf server failure" }
240
if state in bad_states:
241
if bad_states[state] is not None:
242
if error is None:
243
logger.error(bad_states[state])
244
else:
245
logger.error(bad_states[state] + ": %r", error)
246
self.cleanup()
214
if state == avahi.SERVER_COLLISION:
215
logger.error(u"Zeroconf server name collision")
216
self.remove()
247
217
elif state == avahi.SERVER_RUNNING:
248
218
self.add()
249
else:
250
if error is None:
251
logger.debug("Unknown state: %r", state)
252
else:
253
logger.debug("Unknown state: %r: %r", state, error)
254
219
def activate(self):
255
220
"""Derived from the Avahi example code"""
256
221
if self.server is None:
257
222
self.server = dbus.Interface(
258
223
self.bus.get_object(avahi.DBUS_NAME,
259
avahi.DBUS_PATH_SERVER,
260
follow_name_owner_changes=True),
224
avahi.DBUS_PATH_SERVER),
261
225
avahi.DBUS_INTERFACE_SERVER)
262
self.server.connect_to_signal("StateChanged",
226
self.server.connect_to_signal(u"StateChanged",
263
227
self.server_state_changed)
264
228
self.server_state_changed(self.server.GetState())
265
229
268
232
"""A representation of a client host served by this server.
269
233
270
234
Attributes:
271
_approved: bool(); 'None' if not yet approved/disapproved
272
approval_delay: datetime.timedelta(); Time to wait for approval
273
approval_duration: datetime.timedelta(); Duration of one approval
235
name: string; from the config file, used in log messages and
236
D-Bus identifiers
237
fingerprint: string (40 or 32 hexadecimal digits); used to
238
uniquely identify the client
239
secret: bytestring; sent verbatim (over TLS) to client
240
host: string; available for use by the checker command
241
created: datetime.datetime(); (UTC) object creation
242
last_enabled: datetime.datetime(); (UTC)
243
enabled: bool()
244
last_checked_ok: datetime.datetime(); (UTC) or None
245
timeout: datetime.timedelta(); How long from last_checked_ok
246
until this client is disabled
247
interval: datetime.timedelta(); How often to start a new checker
248
disable_hook: If set, called by disable() as disable_hook(self)
274
249
checker: subprocess.Popen(); a running checker process used
275
250
to see if the client lives.
276
251
'None' if no process is running.
277
checker_callback_tag: a gobject event source tag, or None
278
checker_command: string; External command which is run to check
279
if client lives. %() expansions are done at
252
checker_initiator_tag: a gobject event source tag, or None
253
disable_initiator_tag: - '' -
254
checker_callback_tag: - '' -
255
checker_command: string; External command which is run to check if
256
client lives. %() expansions are done at
280
257
runtime with vars(self) as dict, so that for
281
258
instance %(name)s can be used in the command.
282
checker_initiator_tag: a gobject event source tag, or None
283
created: datetime.datetime(); (UTC) object creation
284
259
current_checker_command: string; current running checker_command
285
disable_hook: If set, called by disable() as disable_hook(self)
286
disable_initiator_tag: a gobject event source tag, or None
287
enabled: bool()
288
fingerprint: string (40 or 32 hexadecimal digits); used to
289
uniquely identify the client
290
host: string; available for use by the checker command
291
interval: datetime.timedelta(); How often to start a new checker
292
last_approval_request: datetime.datetime(); (UTC) or None
293
last_checked_ok: datetime.datetime(); (UTC) or None
294
last_enabled: datetime.datetime(); (UTC)
295
name: string; from the config file, used in log messages and
296
D-Bus identifiers
297
secret: bytestring; sent verbatim (over TLS) to client
298
timeout: datetime.timedelta(); How long from last_checked_ok
299
until this client is disabled
300
extended_timeout: extra long timeout when password has been sent
301
runtime_expansions: Allowed attributes for runtime expansion.
302
expires: datetime.datetime(); time (UTC) when a client will be
303
disabled, or None
304
260
"""
305
261
306
runtime_expansions = ("approval_delay", "approval_duration",
307
"created", "enabled", "fingerprint",
308
"host", "interval", "last_checked_ok",
309
"last_enabled", "name", "timeout")
310
311
262
@staticmethod
312
263
def _timedelta_to_milliseconds(td):
313
264
"Convert a datetime.timedelta() to milliseconds"
318
269
def timeout_milliseconds(self):
319
270
"Return the 'timeout' attribute in milliseconds"
320
271
return self._timedelta_to_milliseconds(self.timeout)
321
322
def extended_timeout_milliseconds(self):
323
"Return the 'extended_timeout' attribute in milliseconds"
324
return self._timedelta_to_milliseconds(self.extended_timeout)
325
272
326
273
def interval_milliseconds(self):
327
274
"Return the 'interval' attribute in milliseconds"
328
275
return self._timedelta_to_milliseconds(self.interval)
329
330
def approval_delay_milliseconds(self):
331
return self._timedelta_to_milliseconds(self.approval_delay)
332
276
333
277
def __init__(self, name = None, disable_hook=None, config=None):
334
278
"""Note: the 'checker' key in 'config' sets the
337
281
self.name = name
338
282
if config is None:
339
283
config = {}
340
logger.debug("Creating client %r", self.name)
284
logger.debug(u"Creating client %r", self.name)
341
285
# Uppercase and remove spaces from fingerprint for later
342
286
# comparison purposes with return value from the fingerprint()
343
287
# function
344
self.fingerprint = (config["fingerprint"].upper()
345
.replace(" ", ""))
346
logger.debug(" Fingerprint: %s", self.fingerprint)
347
if "secret" in config:
348
self.secret = config["secret"].decode("base64")
349
elif "secfile" in config:
288
self.fingerprint = (config[u"fingerprint"].upper()
289
.replace(u" ", u""))
290
logger.debug(u" Fingerprint: %s", self.fingerprint)
291
if u"secret" in config:
292
self.secret = config[u"secret"].decode(u"base64")
293
elif u"secfile" in config:
350
294
with open(os.path.expanduser(os.path.expandvars
351
(config["secfile"])),
295
(config[u"secfile"])),
352
296
"rb") as secfile:
353
297
self.secret = secfile.read()
354
298
else:
355
raise TypeError("No secret or secfile for client %s"
299
raise TypeError(u"No secret or secfile for client %s"
356
300
% self.name)
357
self.host = config.get("host", "")
301
self.host = config.get(u"host", u"")
358
302
self.created = datetime.datetime.utcnow()
359
303
self.enabled = False
360
self.last_approval_request = None
361
304
self.last_enabled = None
362
305
self.last_checked_ok = None
363
self.timeout = string_to_delta(config["timeout"])
364
self.extended_timeout = string_to_delta(config["extended_timeout"])
365
self.interval = string_to_delta(config["interval"])
306
self.timeout = string_to_delta(config[u"timeout"])
307
self.interval = string_to_delta(config[u"interval"])
366
308
self.disable_hook = disable_hook
367
309
self.checker = None
368
310
self.checker_initiator_tag = None
369
311
self.disable_initiator_tag = None
370
self.expires = None
371
312
self.checker_callback_tag = None
372
self.checker_command = config["checker"]
313
self.checker_command = config[u"checker"]
373
314
self.current_checker_command = None
374
315
self.last_connect = None
375
self._approved = None
376
self.approved_by_default = config.get("approved_by_default",
377
True)
378
self.approvals_pending = 0
379
self.approval_delay = string_to_delta(
380
config["approval_delay"])
381
self.approval_duration = string_to_delta(
382
config["approval_duration"])
383
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
384
316
385
def send_changedstate(self):
386
self.changedstate.acquire()
387
self.changedstate.notify_all()
388
self.changedstate.release()
389
390
317
def enable(self):
391
318
"""Start this client's checker and timeout hooks"""
392
if getattr(self, "enabled", False):
319
if getattr(self, u"enabled", False):
393
320
# Already enabled
394
321
return
395
self.send_changedstate()
396
322
self.last_enabled = datetime.datetime.utcnow()
397
323
# Schedule a new checker to be started an 'interval' from now,
398
324
# and every interval from then on.
400
326
(self.interval_milliseconds(),
401
327
self.start_checker))
402
328
# Schedule a disable() when 'timeout' has passed
403
self.expires = datetime.datetime.utcnow() + self.timeout
404
329
self.disable_initiator_tag = (gobject.timeout_add
405
330
(self.timeout_milliseconds(),
406
331
self.disable))
413
338
if not getattr(self, "enabled", False):
414
339
return False
415
340
if not quiet:
416
self.send_changedstate()
417
if not quiet:
418
logger.info("Disabling client %s", self.name)
419
if getattr(self, "disable_initiator_tag", False):
341
logger.info(u"Disabling client %s", self.name)
342
if getattr(self, u"disable_initiator_tag", False):
420
343
gobject.source_remove(self.disable_initiator_tag)
421
344
self.disable_initiator_tag = None
422
self.expires = None
423
if getattr(self, "checker_initiator_tag", False):
345
if getattr(self, u"checker_initiator_tag", False):
424
346
gobject.source_remove(self.checker_initiator_tag)
425
347
self.checker_initiator_tag = None
426
348
self.stop_checker()
441
363
if os.WIFEXITED(condition):
442
364
exitstatus = os.WEXITSTATUS(condition)
443
365
if exitstatus == 0:
444
logger.info("Checker for %(name)s succeeded",
366
logger.info(u"Checker for %(name)s succeeded",
445
367
vars(self))
446
368
self.checked_ok()
447
369
else:
448
logger.info("Checker for %(name)s failed",
370
logger.info(u"Checker for %(name)s failed",
449
371
vars(self))
450
372
else:
451
logger.warning("Checker for %(name)s crashed?",
373
logger.warning(u"Checker for %(name)s crashed?",
452
374
vars(self))
453
375
454
def checked_ok(self, timeout=None):
376
def checked_ok(self):
455
377
"""Bump up the timeout for this client.
456
378
457
379
This should only be called when the client has been seen,
458
380
alive and well.
459
381
"""
460
if timeout is None:
461
timeout = self.timeout
462
382
self.last_checked_ok = datetime.datetime.utcnow()
463
383
gobject.source_remove(self.disable_initiator_tag)
464
self.expires = datetime.datetime.utcnow() + timeout
465
384
self.disable_initiator_tag = (gobject.timeout_add
466
(self._timedelta_to_milliseconds(timeout),
385
(self.timeout_milliseconds(),
467
386
self.disable))
468
387
469
def need_approval(self):
470
self.last_approval_request = datetime.datetime.utcnow()
471
472
388
def start_checker(self):
473
389
"""Start a new checker subprocess if one is not running.
474
390
486
402
# If a checker exists, make sure it is not a zombie
487
403
try:
488
404
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
489
except (AttributeError, OSError) as error:
405
except (AttributeError, OSError), error:
490
406
if (isinstance(error, OSError)
491
407
and error.errno != errno.ECHILD):
492
408
raise error
493
409
else:
494
410
if pid:
495
logger.warning("Checker was a zombie")
411
logger.warning(u"Checker was a zombie")
496
412
gobject.source_remove(self.checker_callback_tag)
497
413
self.checker_callback(pid, status,
498
414
self.current_checker_command)
503
419
command = self.checker_command % self.host
504
420
except TypeError:
505
421
# Escape attributes for the shell
506
escaped_attrs = dict(
507
(attr,
508
re.escape(unicode(str(getattr(self, attr, "")),
509
errors=
510
'replace')))
511
for attr in
512
self.runtime_expansions)
513
422
escaped_attrs = dict((key,
423
re.escape(unicode(str(val),
424
errors=
425
u'replace')))
426
for key, val in
427
vars(self).iteritems())
514
428
try:
515
429
command = self.checker_command % escaped_attrs
516
except TypeError as error:
517
logger.error('Could not format string "%s":'
518
' %s', self.checker_command, error)
430
except TypeError, error:
431
logger.error(u'Could not format string "%s":'
432
u' %s', self.checker_command, error)
519
433
return True # Try again later
520
434
self.current_checker_command = command
521
435
try:
522
logger.info("Starting checker %r for %s",
436
logger.info(u"Starting checker %r for %s",
523
437
command, self.name)
524
438
# We don't need to redirect stdout and stderr, since
525
439
# in normal mode, that is already done by daemon(),
527
441
# always replaced by /dev/null.)
528
442
self.checker = subprocess.Popen(command,
529
443
close_fds=True,
530
shell=True, cwd="/")
444
shell=True, cwd=u"/")
531
445
self.checker_callback_tag = (gobject.child_watch_add
532
446
(self.checker.pid,
533
447
self.checker_callback,
538
452
if pid:
539
453
gobject.source_remove(self.checker_callback_tag)
540
454
self.checker_callback(pid, status, command)
541
except OSError as error:
542
logger.error("Failed to start subprocess: %s",
455
except OSError, error:
456
logger.error(u"Failed to start subprocess: %s",
543
457
error)
544
458
# Re-run this periodically if run by gobject.timeout_add
545
459
return True
549
463
if self.checker_callback_tag:
550
464
gobject.source_remove(self.checker_callback_tag)
551
465
self.checker_callback_tag = None
552
if getattr(self, "checker", None) is None:
466
if getattr(self, u"checker", None) is None:
553
467
return
554
logger.debug("Stopping checker for %(name)s", vars(self))
468
logger.debug(u"Stopping checker for %(name)s", vars(self))
555
469
try:
556
470
os.kill(self.checker.pid, signal.SIGTERM)
557
471
#time.sleep(0.5)
558
472
#if self.checker.poll() is None:
559
473
# os.kill(self.checker.pid, signal.SIGKILL)
560
except OSError as error:
474
except OSError, error:
561
475
if error.errno != errno.ESRCH: # No such process
562
476
raise
563
477
self.checker = None
564
478
565
def dbus_service_property(dbus_interface, signature="v",
566
access="readwrite", byte_arrays=False):
479
480
def dbus_service_property(dbus_interface, signature=u"v",
481
access=u"readwrite", byte_arrays=False):
567
482
"""Decorators for marking methods of a DBusObjectWithProperties to
568
483
become properties on the D-Bus.
569
484
576
491
"""
577
492
# Encoding deeply encoded byte arrays is not supported yet by the
578
493
# "Set" method, so we fail early here:
579
if byte_arrays and signature != "ay":
580
raise ValueError("Byte arrays not supported for non-'ay'"
581
" signature %r" % signature)
494
if byte_arrays and signature != u"ay":
495
raise ValueError(u"Byte arrays not supported for non-'ay'"
496
u" signature %r" % signature)
582
497
def decorator(func):
583
498
func._dbus_is_property = True
584
499
func._dbus_interface = dbus_interface
585
500
func._dbus_signature = signature
586
501
func._dbus_access = access
587
502
func._dbus_name = func.__name__
588
if func._dbus_name.endswith("_dbus_property"):
503
if func._dbus_name.endswith(u"_dbus_property"):
589
504
func._dbus_name = func._dbus_name[:-14]
590
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
505
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
591
506
return func
592
507
return decorator
593
508
621
536
622
537
@staticmethod
623
538
def _is_dbus_property(obj):
624
return getattr(obj, "_dbus_is_property", False)
539
return getattr(obj, u"_dbus_is_property", False)
625
540
626
541
def _get_all_dbus_properties(self):
627
542
"""Returns a generator of (name, attribute) pairs
635
550
property with the specified name and interface.
636
551
"""
637
552
for name in (property_name,
638
property_name + "_dbus_property"):
553
property_name + u"_dbus_property"):
639
554
prop = getattr(self, name, None)
640
555
if (prop is None
641
556
or not self._is_dbus_property(prop)
645
560
continue
646
561
return prop
647
562
# No such property
648
raise DBusPropertyNotFound(self.dbus_object_path + ":"
649
+ interface_name + "."
563
raise DBusPropertyNotFound(self.dbus_object_path + u":"
564
+ interface_name + u"."
650
565
+ property_name)
651
566
652
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
653
out_signature="v")
567
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
568
out_signature=u"v")
654
569
def Get(self, interface_name, property_name):
655
570
"""Standard D-Bus property Get() method, see D-Bus standard.
656
571
"""
657
572
prop = self._get_dbus_property(interface_name, property_name)
658
if prop._dbus_access == "write":
573
if prop._dbus_access == u"write":
659
574
raise DBusPropertyAccessException(property_name)
660
575
value = prop()
661
if not hasattr(value, "variant_level"):
576
if not hasattr(value, u"variant_level"):
662
577
return value
663
578
return type(value)(value, variant_level=value.variant_level+1)
664
579
665
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
580
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
666
581
def Set(self, interface_name, property_name, value):
667
582
"""Standard D-Bus property Set() method, see D-Bus standard.
668
583
"""
669
584
prop = self._get_dbus_property(interface_name, property_name)
670
if prop._dbus_access == "read":
585
if prop._dbus_access == u"read":
671
586
raise DBusPropertyAccessException(property_name)
672
if prop._dbus_get_args_options["byte_arrays"]:
587
if prop._dbus_get_args_options[u"byte_arrays"]:
673
588
# The byte_arrays option is not supported yet on
674
589
# signatures other than "ay".
675
if prop._dbus_signature != "ay":
590
if prop._dbus_signature != u"ay":
676
591
raise ValueError
677
592
value = dbus.ByteArray(''.join(unichr(byte)
678
593
for byte in value))
679
594
prop(value)
680
595
681
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
682
out_signature="a{sv}")
596
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
597
out_signature=u"a{sv}")
683
598
def GetAll(self, interface_name):
684
599
"""Standard D-Bus property GetAll() method, see D-Bus
685
600
standard.
693
608
# Interface non-empty but did not match
694
609
continue
695
610
# Ignore write-only properties
696
if prop._dbus_access == "write":
611
if prop._dbus_access == u"write":
697
612
continue
698
613
value = prop()
699
if not hasattr(value, "variant_level"):
614
if not hasattr(value, u"variant_level"):
700
615
all[name] = value
701
616
continue
702
617
all[name] = type(value)(value, variant_level=
703
618
value.variant_level+1)
704
return dbus.Dictionary(all, signature="sv")
619
return dbus.Dictionary(all, signature=u"sv")
705
620
706
621
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
707
out_signature="s",
622
out_signature=u"s",
708
623
path_keyword='object_path',
709
624
connection_keyword='connection')
710
625
def Introspect(self, object_path, connection):
715
630
try:
716
631
document = xml.dom.minidom.parseString(xmlstring)
717
632
def make_tag(document, name, prop):
718
e = document.createElement("property")
719
e.setAttribute("name", name)
720
e.setAttribute("type", prop._dbus_signature)
721
e.setAttribute("access", prop._dbus_access)
633
e = document.createElement(u"property")
634
e.setAttribute(u"name", name)
635
e.setAttribute(u"type", prop._dbus_signature)
636
e.setAttribute(u"access", prop._dbus_access)
722
637
return e
723
for if_tag in document.getElementsByTagName("interface"):
638
for if_tag in document.getElementsByTagName(u"interface"):
724
639
for tag in (make_tag(document, name, prop)
725
640
for name, prop
726
641
in self._get_all_dbus_properties()
727
642
if prop._dbus_interface
728
== if_tag.getAttribute("name")):
643
== if_tag.getAttribute(u"name")):
729
644
if_tag.appendChild(tag)
730
645
# Add the names to the return values for the
731
646
# "org.freedesktop.DBus.Properties" methods
732
if (if_tag.getAttribute("name")
733
== "org.freedesktop.DBus.Properties"):
734
for cn in if_tag.getElementsByTagName("method"):
735
if cn.getAttribute("name") == "Get":
736
for arg in cn.getElementsByTagName("arg"):
737
if (arg.getAttribute("direction")
738
== "out"):
739
arg.setAttribute("name", "value")
740
elif cn.getAttribute("name") == "GetAll":
741
for arg in cn.getElementsByTagName("arg"):
742
if (arg.getAttribute("direction")
743
== "out"):
744
arg.setAttribute("name", "props")
745
xmlstring = document.toxml("utf-8")
647
if (if_tag.getAttribute(u"name")
648
== u"org.freedesktop.DBus.Properties"):
649
for cn in if_tag.getElementsByTagName(u"method"):
650
if cn.getAttribute(u"name") == u"Get":
651
for arg in cn.getElementsByTagName(u"arg"):
652
if (arg.getAttribute(u"direction")
653
== u"out"):
654
arg.setAttribute(u"name", u"value")
655
elif cn.getAttribute(u"name") == u"GetAll":
656
for arg in cn.getElementsByTagName(u"arg"):
657
if (arg.getAttribute(u"direction")
658
== u"out"):
659
arg.setAttribute(u"name", u"props")
660
xmlstring = document.toxml(u"utf-8")
746
661
document.unlink()
747
662
except (AttributeError, xml.dom.DOMException,
748
xml.parsers.expat.ExpatError) as error:
749
logger.error("Failed to override Introspection method",
663
xml.parsers.expat.ExpatError), error:
664
logger.error(u"Failed to override Introspection method",
750
665
error)
751
666
return xmlstring
752
667
758
673
dbus_object_path: dbus.ObjectPath
759
674
bus: dbus.SystemBus()
760
675
"""
761
762
runtime_expansions = (Client.runtime_expansions
763
+ ("dbus_object_path",))
764
765
676
# dbus.service.Object doesn't use super(), so we can't either.
766
677
767
678
def __init__(self, bus = None, *args, **kwargs):
768
self._approvals_pending = 0
769
679
self.bus = bus
770
680
Client.__init__(self, *args, **kwargs)
771
681
# Only now, when this client is initialized, can it show up on
772
682
# the D-Bus
773
client_object_name = unicode(self.name).translate(
774
{ord("."): ord("_"),
775
ord("-"): ord("_")})
776
683
self.dbus_object_path = (dbus.ObjectPath
777
("/clients/" + client_object_name))
684
(u"/clients/"
685
+ self.name.replace(u".", u"_")))
778
686
DBusObjectWithProperties.__init__(self, self.bus,
779
687
self.dbus_object_path)
780
def _set_expires(self, value):
781
old_value = getattr(self, "_expires", None)
782
self._expires = value
783
if hasattr(self, "dbus_object_path") and old_value != value:
784
dbus_time = (self._datetime_to_dbus(self._expires,
785
variant_level=1))
786
self.PropertyChanged(dbus.String("Expires"),
787
dbus_time)
788
expires = property(lambda self: self._expires, _set_expires)
789
del _set_expires
790
791
def _get_approvals_pending(self):
792
return self._approvals_pending
793
def _set_approvals_pending(self, value):
794
old_value = self._approvals_pending
795
self._approvals_pending = value
796
bval = bool(value)
797
if (hasattr(self, "dbus_object_path")
798
and bval is not bool(old_value)):
799
dbus_bool = dbus.Boolean(bval, variant_level=1)
800
self.PropertyChanged(dbus.String("ApprovalPending"),
801
dbus_bool)
802
803
approvals_pending = property(_get_approvals_pending,
804
_set_approvals_pending)
805
del _get_approvals_pending, _set_approvals_pending
806
688
807
689
@staticmethod
808
690
def _datetime_to_dbus(dt, variant_level=0):
809
691
"""Convert a UTC datetime.datetime() to a D-Bus type."""
810
if dt is None:
811
return dbus.String("", variant_level = variant_level)
812
692
return dbus.String(dt.isoformat(),
813
693
variant_level=variant_level)
814
694
815
695
def enable(self):
816
oldstate = getattr(self, "enabled", False)
696
oldstate = getattr(self, u"enabled", False)
817
697
r = Client.enable(self)
818
698
if oldstate != self.enabled:
819
699
# Emit D-Bus signals
820
self.PropertyChanged(dbus.String("Enabled"),
700
self.PropertyChanged(dbus.String(u"enabled"),
821
701
dbus.Boolean(True, variant_level=1))
822
702
self.PropertyChanged(
823
dbus.String("LastEnabled"),
703
dbus.String(u"last_enabled"),
824
704
self._datetime_to_dbus(self.last_enabled,
825
705
variant_level=1))
826
706
return r
827
707
828
708
def disable(self, quiet = False):
829
oldstate = getattr(self, "enabled", False)
709
oldstate = getattr(self, u"enabled", False)
830
710
r = Client.disable(self, quiet=quiet)
831
711
if not quiet and oldstate != self.enabled:
832
712
# Emit D-Bus signal
833
self.PropertyChanged(dbus.String("Enabled"),
713
self.PropertyChanged(dbus.String(u"enabled"),
834
714
dbus.Boolean(False, variant_level=1))
835
715
return r
836
716
839
719
self.remove_from_connection()
840
720
except LookupError:
841
721
pass
842
if hasattr(DBusObjectWithProperties, "__del__"):
722
if hasattr(DBusObjectWithProperties, u"__del__"):
843
723
DBusObjectWithProperties.__del__(self, *args, **kwargs)
844
724
Client.__del__(self, *args, **kwargs)
845
725
848
728
self.checker_callback_tag = None
849
729
self.checker = None
850
730
# Emit D-Bus signal
851
self.PropertyChanged(dbus.String("CheckerRunning"),
731
self.PropertyChanged(dbus.String(u"checker_running"),
852
732
dbus.Boolean(False, variant_level=1))
853
733
if os.WIFEXITED(condition):
854
734
exitstatus = os.WEXITSTATUS(condition)
866
746
*args, **kwargs)
867
747
868
748
def checked_ok(self, *args, **kwargs):
869
Client.checked_ok(self, *args, **kwargs)
749
r = Client.checked_ok(self, *args, **kwargs)
870
750
# Emit D-Bus signal
871
751
self.PropertyChanged(
872
dbus.String("LastCheckedOK"),
752
dbus.String(u"last_checked_ok"),
873
753
(self._datetime_to_dbus(self.last_checked_ok,
874
754
variant_level=1)))
875
876
def need_approval(self, *args, **kwargs):
877
r = Client.need_approval(self, *args, **kwargs)
878
# Emit D-Bus signal
879
self.PropertyChanged(
880
dbus.String("LastApprovalRequest"),
881
(self._datetime_to_dbus(self.last_approval_request,
882
variant_level=1)))
883
755
return r
884
756
885
757
def start_checker(self, *args, **kwargs):
895
767
# Emit D-Bus signal
896
768
self.CheckerStarted(self.current_checker_command)
897
769
self.PropertyChanged(
898
dbus.String("CheckerRunning"),
770
dbus.String(u"checker_running"),
899
771
dbus.Boolean(True, variant_level=1))
900
772
return r
901
773
902
774
def stop_checker(self, *args, **kwargs):
903
old_checker = getattr(self, "checker", None)
775
old_checker = getattr(self, u"checker", None)
904
776
r = Client.stop_checker(self, *args, **kwargs)
905
777
if (old_checker is not None
906
and getattr(self, "checker", None) is None):
907
self.PropertyChanged(dbus.String("CheckerRunning"),
778
and getattr(self, u"checker", None) is None):
779
self.PropertyChanged(dbus.String(u"checker_running"),
908
780
dbus.Boolean(False, variant_level=1))
909
781
return r
910
911
def _reset_approved(self):
912
self._approved = None
913
return False
914
915
def approve(self, value=True):
916
self.send_changedstate()
917
self._approved = value
918
gobject.timeout_add(self._timedelta_to_milliseconds
919
(self.approval_duration),
920
self._reset_approved)
921
922
923
## D-Bus methods, signals & properties
924
_interface = "se.bsnet.fukt.Mandos.Client"
925
926
## Signals
782
783
## D-Bus methods & signals
784
_interface = u"se.bsnet.fukt.Mandos.Client"
785
786
# CheckedOK - method
787
@dbus.service.method(_interface)
788
def CheckedOK(self):
789
return self.checked_ok()
927
790
928
791
# CheckerCompleted - signal
929
@dbus.service.signal(_interface, signature="nxs")
792
@dbus.service.signal(_interface, signature=u"nxs")
930
793
def CheckerCompleted(self, exitcode, waitstatus, command):
931
794
"D-Bus signal"
932
795
pass
933
796
934
797
# CheckerStarted - signal
935
@dbus.service.signal(_interface, signature="s")
798
@dbus.service.signal(_interface, signature=u"s")
936
799
def CheckerStarted(self, command):
937
800
"D-Bus signal"
938
801
pass
939
802
940
803
# PropertyChanged - signal
941
@dbus.service.signal(_interface, signature="sv")
804
@dbus.service.signal(_interface, signature=u"sv")
942
805
def PropertyChanged(self, property, value):
943
806
"D-Bus signal"
944
807
pass
946
809
# GotSecret - signal
947
810
@dbus.service.signal(_interface)
948
811
def GotSecret(self):
949
"""D-Bus signal
950
Is sent after a successful transfer of secret from the Mandos
951
server to mandos-client
952
"""
812
"D-Bus signal"
953
813
pass
954
814
955
815
# Rejected - signal
956
@dbus.service.signal(_interface, signature="s")
957
def Rejected(self, reason):
816
@dbus.service.signal(_interface)
817
def Rejected(self):
958
818
"D-Bus signal"
959
819
pass
960
820
961
# NeedApproval - signal
962
@dbus.service.signal(_interface, signature="tb")
963
def NeedApproval(self, timeout, default):
964
"D-Bus signal"
965
return self.need_approval()
966
967
## Methods
968
969
# Approve - method
970
@dbus.service.method(_interface, in_signature="b")
971
def Approve(self, value):
972
self.approve(value)
973
974
# CheckedOK - method
975
@dbus.service.method(_interface)
976
def CheckedOK(self):
977
self.checked_ok()
978
979
821
# Enable - method
980
822
@dbus.service.method(_interface)
981
823
def Enable(self):
999
841
def StopChecker(self):
1000
842
self.stop_checker()
1001
843
1002
## Properties
1003
1004
# ApprovalPending - property
1005
@dbus_service_property(_interface, signature="b", access="read")
1006
def ApprovalPending_dbus_property(self):
1007
return dbus.Boolean(bool(self.approvals_pending))
1008
1009
# ApprovedByDefault - property
1010
@dbus_service_property(_interface, signature="b",
1011
access="readwrite")
1012
def ApprovedByDefault_dbus_property(self, value=None):
1013
if value is None: # get
1014
return dbus.Boolean(self.approved_by_default)
1015
old_value = self.approved_by_default
1016
self.approved_by_default = bool(value)
1017
# Emit D-Bus signal
1018
if old_value != self.approved_by_default:
1019
self.PropertyChanged(dbus.String("ApprovedByDefault"),
1020
dbus.Boolean(value, variant_level=1))
1021
1022
# ApprovalDelay - property
1023
@dbus_service_property(_interface, signature="t",
1024
access="readwrite")
1025
def ApprovalDelay_dbus_property(self, value=None):
1026
if value is None: # get
1027
return dbus.UInt64(self.approval_delay_milliseconds())
1028
old_value = self.approval_delay
1029
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1030
# Emit D-Bus signal
1031
if old_value != self.approval_delay:
1032
self.PropertyChanged(dbus.String("ApprovalDelay"),
1033
dbus.UInt64(value, variant_level=1))
1034
1035
# ApprovalDuration - property
1036
@dbus_service_property(_interface, signature="t",
1037
access="readwrite")
1038
def ApprovalDuration_dbus_property(self, value=None):
1039
if value is None: # get
1040
return dbus.UInt64(self._timedelta_to_milliseconds(
1041
self.approval_duration))
1042
old_value = self.approval_duration
1043
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1044
# Emit D-Bus signal
1045
if old_value != self.approval_duration:
1046
self.PropertyChanged(dbus.String("ApprovalDuration"),
1047
dbus.UInt64(value, variant_level=1))
1048
1049
# Name - property
1050
@dbus_service_property(_interface, signature="s", access="read")
1051
def Name_dbus_property(self):
844
# name - property
845
@dbus_service_property(_interface, signature=u"s", access=u"read")
846
def name_dbus_property(self):
1052
847
return dbus.String(self.name)
1053
848
1054
# Fingerprint - property
1055
@dbus_service_property(_interface, signature="s", access="read")
1056
def Fingerprint_dbus_property(self):
849
# fingerprint - property
850
@dbus_service_property(_interface, signature=u"s", access=u"read")
851
def fingerprint_dbus_property(self):
1057
852
return dbus.String(self.fingerprint)
1058
853
1059
# Host - property
1060
@dbus_service_property(_interface, signature="s",
1061
access="readwrite")
1062
def Host_dbus_property(self, value=None):
854
# host - property
855
@dbus_service_property(_interface, signature=u"s",
856
access=u"readwrite")
857
def host_dbus_property(self, value=None):
1063
858
if value is None: # get
1064
859
return dbus.String(self.host)
1065
old_value = self.host
1066
860
self.host = value
1067
861
# Emit D-Bus signal
1068
if old_value != self.host:
1069
self.PropertyChanged(dbus.String("Host"),
1070
dbus.String(value, variant_level=1))
862
self.PropertyChanged(dbus.String(u"host"),
863
dbus.String(value, variant_level=1))
1071
864
1072
# Created - property
1073
@dbus_service_property(_interface, signature="s", access="read")
1074
def Created_dbus_property(self):
865
# created - property
866
@dbus_service_property(_interface, signature=u"s", access=u"read")
867
def created_dbus_property(self):
1075
868
return dbus.String(self._datetime_to_dbus(self.created))
1076
869
1077
# LastEnabled - property
1078
@dbus_service_property(_interface, signature="s", access="read")
1079
def LastEnabled_dbus_property(self):
1080
return self._datetime_to_dbus(self.last_enabled)
870
# last_enabled - property
871
@dbus_service_property(_interface, signature=u"s", access=u"read")
872
def last_enabled_dbus_property(self):
873
if self.last_enabled is None:
874
return dbus.String(u"")
875
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1081
876
1082
# Enabled - property
1083
@dbus_service_property(_interface, signature="b",
1084
access="readwrite")
1085
def Enabled_dbus_property(self, value=None):
877
# enabled - property
878
@dbus_service_property(_interface, signature=u"b",
879
access=u"readwrite")
880
def enabled_dbus_property(self, value=None):
1086
881
if value is None: # get
1087
882
return dbus.Boolean(self.enabled)
1088
883
if value:
1090
885
else:
1091
886
self.disable()
1092
887
1093
# LastCheckedOK - property
1094
@dbus_service_property(_interface, signature="s",
1095
access="readwrite")
1096
def LastCheckedOK_dbus_property(self, value=None):
888
# last_checked_ok - property
889
@dbus_service_property(_interface, signature=u"s",
890
access=u"readwrite")
891
def last_checked_ok_dbus_property(self, value=None):
1097
892
if value is not None:
1098
893
self.checked_ok()
1099
894
return
1100
return self._datetime_to_dbus(self.last_checked_ok)
1101
1102
# Expires - property
1103
@dbus_service_property(_interface, signature="s", access="read")
1104
def Expires_dbus_property(self):
1105
return self._datetime_to_dbus(self.expires)
1106
1107
# LastApprovalRequest - property
1108
@dbus_service_property(_interface, signature="s", access="read")
1109
def LastApprovalRequest_dbus_property(self):
1110
return self._datetime_to_dbus(self.last_approval_request)
1111
1112
# Timeout - property
1113
@dbus_service_property(_interface, signature="t",
1114
access="readwrite")
1115
def Timeout_dbus_property(self, value=None):
895
if self.last_checked_ok is None:
896
return dbus.String(u"")
897
return dbus.String(self._datetime_to_dbus(self
898
.last_checked_ok))
899
900
# timeout - property
901
@dbus_service_property(_interface, signature=u"t",
902
access=u"readwrite")
903
def timeout_dbus_property(self, value=None):
1116
904
if value is None: # get
1117
905
return dbus.UInt64(self.timeout_milliseconds())
1118
old_value = self.timeout
1119
906
self.timeout = datetime.timedelta(0, 0, 0, value)
1120
907
# Emit D-Bus signal
1121
if old_value != self.timeout:
1122
self.PropertyChanged(dbus.String("Timeout"),
1123
dbus.UInt64(value, variant_level=1))
1124
if getattr(self, "disable_initiator_tag", None) is None:
908
self.PropertyChanged(dbus.String(u"timeout"),
909
dbus.UInt64(value, variant_level=1))
910
if getattr(self, u"disable_initiator_tag", None) is None:
1125
911
return
1126
912
# Reschedule timeout
1127
913
gobject.source_remove(self.disable_initiator_tag)
1128
914
self.disable_initiator_tag = None
1129
self.expires = None
1130
915
time_to_die = (self.
1131
916
_timedelta_to_milliseconds((self
1132
917
.last_checked_ok
1137
922
# The timeout has passed
1138
923
self.disable()
1139
924
else:
1140
self.expires = (datetime.datetime.utcnow()
1141
+ datetime.timedelta(milliseconds = time_to_die))
1142
925
self.disable_initiator_tag = (gobject.timeout_add
1143
926
(time_to_die, self.disable))
1144
1145
# ExtendedTimeout - property
1146
@dbus_service_property(_interface, signature="t",
1147
access="readwrite")
1148
def ExtendedTimeout_dbus_property(self, value=None):
1149
if value is None: # get
1150
return dbus.UInt64(self.extended_timeout_milliseconds())
1151
old_value = self.extended_timeout
1152
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1153
# Emit D-Bus signal
1154
if old_value != self.extended_timeout:
1155
self.PropertyChanged(dbus.String("ExtendedTimeout"),
1156
dbus.UInt64(value, variant_level=1))
1157
1158
# Interval - property
1159
@dbus_service_property(_interface, signature="t",
1160
access="readwrite")
1161
def Interval_dbus_property(self, value=None):
927
928
# interval - property
929
@dbus_service_property(_interface, signature=u"t",
930
access=u"readwrite")
931
def interval_dbus_property(self, value=None):
1162
932
if value is None: # get
1163
933
return dbus.UInt64(self.interval_milliseconds())
1164
old_value = self.interval
1165
934
self.interval = datetime.timedelta(0, 0, 0, value)
1166
935
# Emit D-Bus signal
1167
if old_value != self.interval:
1168
self.PropertyChanged(dbus.String("Interval"),
1169
dbus.UInt64(value, variant_level=1))
1170
if getattr(self, "checker_initiator_tag", None) is None:
936
self.PropertyChanged(dbus.String(u"interval"),
937
dbus.UInt64(value, variant_level=1))
938
if getattr(self, u"checker_initiator_tag", None) is None:
1171
939
return
1172
940
# Reschedule checker run
1173
941
gobject.source_remove(self.checker_initiator_tag)
1175
943
(value, self.start_checker))
1176
944
self.start_checker() # Start one now, too
1177
945
1178
# Checker - property
1179
@dbus_service_property(_interface, signature="s",
1180
access="readwrite")
1181
def Checker_dbus_property(self, value=None):
946
# checker - property
947
@dbus_service_property(_interface, signature=u"s",
948
access=u"readwrite")
949
def checker_dbus_property(self, value=None):
1182
950
if value is None: # get
1183
951
return dbus.String(self.checker_command)
1184
old_value = self.checker_command
1185
952
self.checker_command = value
1186
953
# Emit D-Bus signal
1187
if old_value != self.checker_command:
1188
self.PropertyChanged(dbus.String("Checker"),
1189
dbus.String(self.checker_command,
1190
variant_level=1))
954
self.PropertyChanged(dbus.String(u"checker"),
955
dbus.String(self.checker_command,
956
variant_level=1))
1191
957
1192
# CheckerRunning - property
1193
@dbus_service_property(_interface, signature="b",
1194
access="readwrite")
1195
def CheckerRunning_dbus_property(self, value=None):
958
# checker_running - property
959
@dbus_service_property(_interface, signature=u"b",
960
access=u"readwrite")
961
def checker_running_dbus_property(self, value=None):
1196
962
if value is None: # get
1197
963
return dbus.Boolean(self.checker is not None)
1198
964
if value:
1200
966
else:
1201
967
self.stop_checker()
1202
968
1203
# ObjectPath - property
1204
@dbus_service_property(_interface, signature="o", access="read")
1205
def ObjectPath_dbus_property(self):
969
# object_path - property
970
@dbus_service_property(_interface, signature=u"o", access=u"read")
971
def object_path_dbus_property(self):
1206
972
return self.dbus_object_path # is already a dbus.ObjectPath
1207
973
1208
# Secret = property
1209
@dbus_service_property(_interface, signature="ay",
1210
access="write", byte_arrays=True)
1211
def Secret_dbus_property(self, value):
974
# secret = property
975
@dbus_service_property(_interface, signature=u"ay",
976
access=u"write", byte_arrays=True)
977
def secret_dbus_property(self, value):
1212
978
self.secret = str(value)
1213
979
1214
980
del _interface
1215
981
1216
982
1217
class ProxyClient(object):
1218
def __init__(self, child_pipe, fpr, address):
1219
self._pipe = child_pipe
1220
self._pipe.send(('init', fpr, address))
1221
if not self._pipe.recv():
1222
raise KeyError()
1223
1224
def __getattribute__(self, name):
1225
if(name == '_pipe'):
1226
return super(ProxyClient, self).__getattribute__(name)
1227
self._pipe.send(('getattr', name))
1228
data = self._pipe.recv()
1229
if data[0] == 'data':
1230
return data[1]
1231
if data[0] == 'function':
1232
def func(*args, **kwargs):
1233
self._pipe.send(('funcall', name, args, kwargs))
1234
return self._pipe.recv()[1]
1235
return func
1236
1237
def __setattr__(self, name, value):
1238
if(name == '_pipe'):
1239
return super(ProxyClient, self).__setattr__(name, value)
1240
self._pipe.send(('setattr', name, value))
1241
1242
1243
983
class ClientHandler(socketserver.BaseRequestHandler, object):
1244
984
"""A class to handle client connections.
1245
985
1247
987
Note: This will run in its own forked process."""
1248
988
1249
989
def handle(self):
1250
with contextlib.closing(self.server.child_pipe) as child_pipe:
1251
logger.info("TCP connection from: %s",
1252
unicode(self.client_address))
1253
logger.debug("Pipe FD: %d",
1254
self.server.child_pipe.fileno())
1255
990
logger.info(u"TCP connection from: %s",
991
unicode(self.client_address))
992
logger.debug(u"IPC Pipe FD: %d", self.server.child_pipe[1])
993
# Open IPC pipe to parent process
994
with contextlib.nested(os.fdopen(self.server.child_pipe[1],
995
u"w", 1),
996
os.fdopen(self.server.parent_pipe[0],
997
u"r", 0)) as (ipc,
998
ipc_return):
1256
999
session = (gnutls.connection
1257
1000
.ClientSession(self.request,
1258
1001
gnutls.connection
1259
1002
.X509Credentials()))
1260
1003
1004
line = self.request.makefile().readline()
1005
logger.debug(u"Protocol version: %r", line)
1006
try:
1007
if int(line.strip().split()[0]) > 1:
1008
raise RuntimeError
1009
except (ValueError, IndexError, RuntimeError), error:
1010
logger.error(u"Unknown protocol version: %s", error)
1011
return
1012
1261
1013
# Note: gnutls.connection.X509Credentials is really a
1262
1014
# generic GnuTLS certificate credentials object so long as
1263
1015
# no X.509 keys are added to it. Therefore, we can use it
1264
1016
# here despite using OpenPGP certificates.
1265
1266
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1267
# "+AES-256-CBC", "+SHA1",
1268
# "+COMP-NULL", "+CTYPE-OPENPGP",
1269
# "+DHE-DSS"))
1017
1018
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1019
# u"+AES-256-CBC", u"+SHA1",
1020
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1021
# u"+DHE-DSS"))
1270
1022
# Use a fallback default, since this MUST be set.
1271
1023
priority = self.server.gnutls_priority
1272
1024
if priority is None:
1273
priority = "NORMAL"
1025
priority = u"NORMAL"
1274
1026
(gnutls.library.functions
1275
1027
.gnutls_priority_set_direct(session._c_object,
1276
1028
priority, None))
1277
1278
# Start communication using the Mandos protocol
1279
# Get protocol number
1280
line = self.request.makefile().readline()
1281
logger.debug("Protocol version: %r", line)
1282
try:
1283
if int(line.strip().split()[0]) > 1:
1284
raise RuntimeError
1285
except (ValueError, IndexError, RuntimeError) as error:
1286
logger.error("Unknown protocol version: %s", error)
1287
return
1288
1289
# Start GnuTLS connection
1029
1290
1030
try:
1291
1031
session.handshake()
1292
except gnutls.errors.GNUTLSError as error:
1293
logger.warning("Handshake failed: %s", error)
1032
except gnutls.errors.GNUTLSError, error:
1033
logger.warning(u"Handshake failed: %s", error)
1294
1034
# Do not run session.bye() here: the session is not
1295
1035
# established. Just abandon the request.
1296
1036
return
1297
logger.debug("Handshake succeeded")
1298
1299
approval_required = False
1037
logger.debug(u"Handshake succeeded")
1300
1038
try:
1301
1039
try:
1302
1040
fpr = self.fingerprint(self.peer_certificate
1303
1041
(session))
1304
except (TypeError,
1305
gnutls.errors.GNUTLSError) as error:
1306
logger.warning("Bad certificate: %s", error)
1042
except (TypeError, gnutls.errors.GNUTLSError), error:
1043
logger.warning(u"Bad certificate: %s", error)
1307
1044
return
1308
logger.debug("Fingerprint: %s", fpr)
1045
logger.debug(u"Fingerprint: %s", fpr)
1309
1046
1310
try:
1311
client = ProxyClient(child_pipe, fpr,
1312
self.client_address)
1313
except KeyError:
1314
return
1315
1316
if client.approval_delay:
1317
delay = client.approval_delay
1318
client.approvals_pending += 1
1319
approval_required = True
1320
1321
while True:
1322
if not client.enabled:
1323
logger.info("Client %s is disabled",
1324
client.name)
1325
if self.server.use_dbus:
1326
# Emit D-Bus signal
1327
client.Rejected("Disabled")
1328
return
1329
1330
if client._approved or not client.approval_delay:
1331
#We are approved or approval is disabled
1047
for c in self.server.clients:
1048
if c.fingerprint == fpr:
1049
client = c
1332
1050
break
1333
elif client._approved is None:
1334
logger.info("Client %s needs approval",
1335
client.name)
1336
if self.server.use_dbus:
1337
# Emit D-Bus signal
1338
client.NeedApproval(
1339
client.approval_delay_milliseconds(),
1340
client.approved_by_default)
1341
else:
1342
logger.warning("Client %s was not approved",
1343
client.name)
1344
if self.server.use_dbus:
1345
# Emit D-Bus signal
1346
client.Rejected("Denied")
1347
return
1348
1349
#wait until timeout or approved
1350
#x = float(client._timedelta_to_milliseconds(delay))
1351
time = datetime.datetime.now()
1352
client.changedstate.acquire()
1353
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1354
client.changedstate.release()
1355
time2 = datetime.datetime.now()
1356
if (time2 - time) >= delay:
1357
if not client.approved_by_default:
1358
logger.warning("Client %s timed out while"
1359
" waiting for approval",
1360
client.name)
1361
if self.server.use_dbus:
1362
# Emit D-Bus signal
1363
client.Rejected("Approval timed out")
1364
return
1365
else:
1366
break
1367
else:
1368
delay -= time2 - time
1369
1051
else:
1052
ipc.write(u"NOTFOUND %s %s\n"
1053
% (fpr, unicode(self.client_address)))
1054
return
1055
# Have to check if client.enabled, since it is
1056
# possible that the client was disabled since the
1057
# GnuTLS session was established.
1058
ipc.write(u"GETATTR enabled %s\n" % fpr)
1059
enabled = pickle.load(ipc_return)
1060
if not enabled:
1061
ipc.write(u"DISABLED %s\n" % client.name)
1062
return
1063
ipc.write(u"SENDING %s\n" % client.name)
1370
1064
sent_size = 0
1371
1065
while sent_size < len(client.secret):
1372
try:
1373
sent = session.send(client.secret[sent_size:])
1374
except gnutls.errors.GNUTLSError as error:
1375
logger.warning("gnutls send failed")
1376
return
1377
logger.debug("Sent: %d, remaining: %d",
1066
sent = session.send(client.secret[sent_size:])
1067
logger.debug(u"Sent: %d, remaining: %d",
1378
1068
sent, len(client.secret)
1379
1069
- (sent_size + sent))
1380
1070
sent_size += sent
1381
1382
logger.info("Sending secret to %s", client.name)
1383
# bump the timeout as if seen
1384
client.checked_ok(client.extended_timeout)
1385
if self.server.use_dbus:
1386
# Emit D-Bus signal
1387
client.GotSecret()
1388
1389
1071
finally:
1390
if approval_required:
1391
client.approvals_pending -= 1
1392
try:
1393
session.bye()
1394
except gnutls.errors.GNUTLSError as error:
1395
logger.warning("GnuTLS bye failed")
1072
session.bye()
1396
1073
1397
1074
@staticmethod
1398
1075
def peer_certificate(session):
1408
1085
.gnutls_certificate_get_peers
1409
1086
(session._c_object, ctypes.byref(list_size)))
1410
1087
if not bool(cert_list) and list_size.value != 0:
1411
raise gnutls.errors.GNUTLSError("error getting peer"
1412
" certificate")
1088
raise gnutls.errors.GNUTLSError(u"error getting peer"
1089
u" certificate")
1413
1090
if list_size.value == 0:
1414
1091
return None
1415
1092
cert = cert_list[0]
1441
1118
if crtverify.value != 0:
1442
1119
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1443
1120
raise (gnutls.errors.CertificateSecurityError
1444
("Verify failed"))
1121
(u"Verify failed"))
1445
1122
# New buffer for the fingerprint
1446
1123
buf = ctypes.create_string_buffer(20)
1447
1124
buf_len = ctypes.c_size_t()
1454
1131
# Convert the buffer to a Python bytestring
1455
1132
fpr = ctypes.string_at(buf, buf_len.value)
1456
1133
# Convert the bytestring to hexadecimal notation
1457
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1134
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1458
1135
return hex_fpr
1459
1136
1460
1137
1461
class MultiprocessingMixIn(object):
1462
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1463
def sub_process_main(self, request, address):
1464
try:
1465
self.finish_request(request, address)
1466
except:
1467
self.handle_error(request, address)
1468
self.close_request(request)
1469
1470
def process_request(self, request, address):
1471
"""Start a new process to process the request."""
1472
multiprocessing.Process(target = self.sub_process_main,
1473
args = (request, address)).start()
1474
1475
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1476
""" adds a pipe to the MixIn """
1138
class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):
1139
"""Like socketserver.ForkingMixIn, but also pass a pipe pair."""
1477
1140
def process_request(self, request, client_address):
1478
1141
"""Overrides and wraps the original process_request().
1479
1142
1480
1143
This function creates a new pipe in self.pipe
1481
1144
"""
1482
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1483
1484
super(MultiprocessingMixInWithPipe,
1145
self.child_pipe = os.pipe() # Child writes here
1146
self.parent_pipe = os.pipe() # Parent writes here
1147
super(ForkingMixInWithPipes,
1485
1148
self).process_request(request, client_address)
1486
self.child_pipe.close()
1487
self.add_pipe(parent_pipe)
1488
1489
def add_pipe(self, parent_pipe):
1149
# Close unused ends for parent
1150
os.close(self.parent_pipe[0]) # close read end
1151
os.close(self.child_pipe[1]) # close write end
1152
self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])
1153
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1490
1154
"""Dummy function; override as necessary"""
1491
raise NotImplementedError
1492
1493
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1155
os.close(child_pipe_fd)
1156
os.close(parent_pipe_fd)
1157
1158
1159
class IPv6_TCPServer(ForkingMixInWithPipes,
1494
1160
socketserver.TCPServer, object):
1495
1161
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1496
1162
1512
1178
bind to an address or port if they were not specified."""
1513
1179
if self.interface is not None:
1514
1180
if SO_BINDTODEVICE is None:
1515
logger.error("SO_BINDTODEVICE does not exist;"
1516
" cannot bind to interface %s",
1181
logger.error(u"SO_BINDTODEVICE does not exist;"
1182
u" cannot bind to interface %s",
1517
1183
self.interface)
1518
1184
else:
1519
1185
try:
1520
1186
self.socket.setsockopt(socket.SOL_SOCKET,
1521
1187
SO_BINDTODEVICE,
1522
1188
str(self.interface
1523
+ '\0'))
1524
except socket.error as error:
1189
+ u'\0'))
1190
except socket.error, error:
1525
1191
if error[0] == errno.EPERM:
1526
logger.error("No permission to"
1527
" bind to interface %s",
1192
logger.error(u"No permission to"
1193
u" bind to interface %s",
1528
1194
self.interface)
1529
1195
elif error[0] == errno.ENOPROTOOPT:
1530
logger.error("SO_BINDTODEVICE not available;"
1531
" cannot bind to interface %s",
1196
logger.error(u"SO_BINDTODEVICE not available;"
1197
u" cannot bind to interface %s",
1532
1198
self.interface)
1533
1199
else:
1534
1200
raise
1536
1202
if self.server_address[0] or self.server_address[1]:
1537
1203
if not self.server_address[0]:
1538
1204
if self.address_family == socket.AF_INET6:
1539
any_address = "::" # in6addr_any
1205
any_address = u"::" # in6addr_any
1540
1206
else:
1541
1207
any_address = socket.INADDR_ANY
1542
1208
self.server_address = (any_address,
1581
1247
return socketserver.TCPServer.server_activate(self)
1582
1248
def enable(self):
1583
1249
self.enabled = True
1584
def add_pipe(self, parent_pipe):
1250
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1585
1251
# Call "handle_ipc" for both data and EOF events
1586
gobject.io_add_watch(parent_pipe.fileno(),
1252
gobject.io_add_watch(child_pipe_fd,
1587
1253
gobject.IO_IN | gobject.IO_HUP,
1588
1254
functools.partial(self.handle_ipc,
1589
parent_pipe = parent_pipe))
1590
1591
def handle_ipc(self, source, condition, parent_pipe=None,
1592
client_object=None):
1255
reply_fd
1256
=parent_pipe_fd))
1257
def handle_ipc(self, source, condition, reply_fd=None,
1258
file_objects={}):
1593
1259
condition_names = {
1594
gobject.IO_IN: "IN", # There is data to read.
1595
gobject.IO_OUT: "OUT", # Data can be written (without
1260
gobject.IO_IN: u"IN", # There is data to read.
1261
gobject.IO_OUT: u"OUT", # Data can be written (without
1596
1262
# blocking).
1597
gobject.IO_PRI: "PRI", # There is urgent data to read.
1598
gobject.IO_ERR: "ERR", # Error condition.
1599
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1263
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1264
gobject.IO_ERR: u"ERR", # Error condition.
1265
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1600
1266
# broken, usually for pipes and
1601
1267
# sockets).
1602
1268
}
1604
1270
for cond, name in
1605
1271
condition_names.iteritems()
1606
1272
if cond & condition)
1607
# error or the other end of multiprocessing.Pipe has closed
1608
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1609
return False
1610
1611
# Read a request from the child
1612
request = parent_pipe.recv()
1613
command = request[0]
1614
1615
if command == 'init':
1616
fpr = request[1]
1617
address = request[2]
1618
1619
for c in self.clients:
1620
if c.fingerprint == fpr:
1621
client = c
1622
break
1623
else:
1624
logger.info("Client not found for fingerprint: %s, ad"
1625
"dress: %s", fpr, address)
1626
if self.use_dbus:
1627
# Emit D-Bus signal
1628
mandos_dbus_service.ClientNotFound(fpr, address[0])
1629
parent_pipe.send(False)
1630
return False
1631
1632
gobject.io_add_watch(parent_pipe.fileno(),
1633
gobject.IO_IN | gobject.IO_HUP,
1634
functools.partial(self.handle_ipc,
1635
parent_pipe = parent_pipe,
1636
client_object = client))
1637
parent_pipe.send(True)
1638
# remove the old hook in favor of the new above hook on same fileno
1639
return False
1640
if command == 'funcall':
1641
funcname = request[1]
1642
args = request[2]
1643
kwargs = request[3]
1644
1645
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1646
1647
if command == 'getattr':
1648
attrname = request[1]
1649
if callable(client_object.__getattribute__(attrname)):
1650
parent_pipe.send(('function',))
1651
else:
1652
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1653
1654
if command == 'setattr':
1655
attrname = request[1]
1656
value = request[2]
1657
setattr(client_object, attrname, value)
1658
1273
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1274
conditions_string)
1275
1276
# Turn the pipe file descriptors into Python file objects
1277
if source not in file_objects:
1278
file_objects[source] = os.fdopen(source, u"r", 1)
1279
if reply_fd not in file_objects:
1280
file_objects[reply_fd] = os.fdopen(reply_fd, u"w", 0)
1281
1282
# Read a line from the file object
1283
cmdline = file_objects[source].readline()
1284
if not cmdline: # Empty line means end of file
1285
# close the IPC pipes
1286
file_objects[source].close()
1287
del file_objects[source]
1288
file_objects[reply_fd].close()
1289
del file_objects[reply_fd]
1290
1291
# Stop calling this function
1292
return False
1293
1294
logger.debug(u"IPC command: %r", cmdline)
1295
1296
# Parse and act on command
1297
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1298
1299
if cmd == u"NOTFOUND":
1300
fpr, address = args.split(None, 1)
1301
logger.warning(u"Client not found for fingerprint: %s, ad"
1302
u"dress: %s", fpr, address)
1303
if self.use_dbus:
1304
# Emit D-Bus signal
1305
mandos_dbus_service.ClientNotFound(fpr, address)
1306
elif cmd == u"DISABLED":
1307
for client in self.clients:
1308
if client.name == args:
1309
logger.warning(u"Client %s is disabled", args)
1310
if self.use_dbus:
1311
# Emit D-Bus signal
1312
client.Rejected()
1313
break
1314
else:
1315
logger.error(u"Unknown client %s is disabled", args)
1316
elif cmd == u"SENDING":
1317
for client in self.clients:
1318
if client.name == args:
1319
logger.info(u"Sending secret to %s", client.name)
1320
client.checked_ok()
1321
if self.use_dbus:
1322
# Emit D-Bus signal
1323
client.GotSecret()
1324
break
1325
else:
1326
logger.error(u"Sending secret to unknown client %s",
1327
args)
1328
elif cmd == u"GETATTR":
1329
attr_name, fpr = args.split(None, 1)
1330
for client in self.clients:
1331
if client.fingerprint == fpr:
1332
attr_value = getattr(client, attr_name, None)
1333
logger.debug("IPC reply: %r", attr_value)
1334
pickle.dump(attr_value, file_objects[reply_fd])
1335
break
1336
else:
1337
logger.error(u"Client %s on address %s requesting "
1338
u"attribute %s not found", fpr, address,
1339
attr_name)
1340
pickle.dump(None, file_objects[reply_fd])
1341
else:
1342
logger.error(u"Unknown IPC command: %r", cmdline)
1343
1344
# Keep calling this function
1659
1345
return True
1660
1346
1661
1347
1662
1348
def string_to_delta(interval):
1663
1349
"""Parse a string and return a datetime.timedelta
1664
1350
1665
>>> string_to_delta('7d')
1351
>>> string_to_delta(u'7d')
1666
1352
datetime.timedelta(7)
1667
>>> string_to_delta('60s')
1353
>>> string_to_delta(u'60s')
1668
1354
datetime.timedelta(0, 60)
1669
>>> string_to_delta('60m')
1355
>>> string_to_delta(u'60m')
1670
1356
datetime.timedelta(0, 3600)
1671
>>> string_to_delta('24h')
1357
>>> string_to_delta(u'24h')
1672
1358
datetime.timedelta(1)
1673
>>> string_to_delta('1w')
1359
>>> string_to_delta(u'1w')
1674
1360
datetime.timedelta(7)
1675
>>> string_to_delta('5m 30s')
1361
>>> string_to_delta(u'5m 30s')
1676
1362
datetime.timedelta(0, 330)
1677
1363
"""
1678
1364
timevalue = datetime.timedelta(0)
1680
1366
try:
1681
1367
suffix = unicode(s[-1])
1682
1368
value = int(s[:-1])
1683
if suffix == "d":
1369
if suffix == u"d":
1684
1370
delta = datetime.timedelta(value)
1685
elif suffix == "s":
1371
elif suffix == u"s":
1686
1372
delta = datetime.timedelta(0, value)
1687
elif suffix == "m":
1373
elif suffix == u"m":
1688
1374
delta = datetime.timedelta(0, 0, 0, 0, value)
1689
elif suffix == "h":
1375
elif suffix == u"h":
1690
1376
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1691
elif suffix == "w":
1377
elif suffix == u"w":
1692
1378
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1693
1379
else:
1694
raise ValueError("Unknown suffix %r" % suffix)
1695
except (ValueError, IndexError) as e:
1696
raise ValueError(*(e.args))
1380
raise ValueError(u"Unknown suffix %r" % suffix)
1381
except (ValueError, IndexError), e:
1382
raise ValueError(e.message)
1697
1383
timevalue += delta
1698
1384
return timevalue
1699
1385
1705
1391
global if_nametoindex
1706
1392
try:
1707
1393
if_nametoindex = (ctypes.cdll.LoadLibrary
1708
(ctypes.util.find_library("c"))
1394
(ctypes.util.find_library(u"c"))
1709
1395
.if_nametoindex)
1710
1396
except (OSError, AttributeError):
1711
logger.warning("Doing if_nametoindex the hard way")
1397
logger.warning(u"Doing if_nametoindex the hard way")
1712
1398
def if_nametoindex(interface):
1713
1399
"Get an interface index the hard way, i.e. using fcntl()"
1714
1400
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1715
1401
with contextlib.closing(socket.socket()) as s:
1716
1402
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1717
struct.pack(str("16s16x"),
1403
struct.pack(str(u"16s16x"),
1718
1404
interface))
1719
interface_index = struct.unpack(str("I"),
1405
interface_index = struct.unpack(str(u"I"),
1720
1406
ifreq[16:20])[0]
1721
1407
return interface_index
1722
1408
return if_nametoindex(interface)
1730
1416
sys.exit()
1731
1417
os.setsid()
1732
1418
if not nochdir:
1733
os.chdir("/")
1419
os.chdir(u"/")
1734
1420
if os.fork():
1735
1421
sys.exit()
1736
1422
if not noclose:
1738
1424
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1739
1425
if not stat.S_ISCHR(os.fstat(null).st_mode):
1740
1426
raise OSError(errno.ENODEV,
1741
"%s not a character device"
1427
u"%s not a character device"
1742
1428
% os.path.devnull)
1743
1429
os.dup2(null, sys.stdin.fileno())
1744
1430
os.dup2(null, sys.stdout.fileno())
1752
1438
##################################################################
1753
1439
# Parsing of options, both command line and config file
1754
1440
1755
parser = argparse.ArgumentParser()
1756
parser.add_argument("-v", "--version", action="version",
1757
version = "%%(prog)s %s" % version,
1758
help="show version number and exit")
1759
parser.add_argument("-i", "--interface", metavar="IF",
1760
help="Bind to interface IF")
1761
parser.add_argument("-a", "--address",
1762
help="Address to listen for requests on")
1763
parser.add_argument("-p", "--port", type=int,
1764
help="Port number to receive requests on")
1765
parser.add_argument("--check", action="store_true",
1766
help="Run self-test")
1767
parser.add_argument("--debug", action="store_true",
1768
help="Debug mode; run in foreground and log"
1769
" to terminal")
1770
parser.add_argument("--debuglevel", metavar="LEVEL",
1771
help="Debug level for stdout output")
1772
parser.add_argument("--priority", help="GnuTLS"
1773
" priority string (see GnuTLS documentation)")
1774
parser.add_argument("--servicename",
1775
metavar="NAME", help="Zeroconf service name")
1776
parser.add_argument("--configdir",
1777
default="/etc/mandos", metavar="DIR",
1778
help="Directory to search for configuration"
1779
" files")
1780
parser.add_argument("--no-dbus", action="store_false",
1781
dest="use_dbus", help="Do not provide D-Bus"
1782
" system bus interface")
1783
parser.add_argument("--no-ipv6", action="store_false",
1784
dest="use_ipv6", help="Do not use IPv6")
1785
options = parser.parse_args()
1441
parser = optparse.OptionParser(version = "%%prog %s" % version)
1442
parser.add_option("-i", u"--interface", type=u"string",
1443
metavar="IF", help=u"Bind to interface IF")
1444
parser.add_option("-a", u"--address", type=u"string",
1445
help=u"Address to listen for requests on")
1446
parser.add_option("-p", u"--port", type=u"int",
1447
help=u"Port number to receive requests on")
1448
parser.add_option("--check", action=u"store_true",
1449
help=u"Run self-test")
1450
parser.add_option("--debug", action=u"store_true",
1451
help=u"Debug mode; run in foreground and log to"
1452
u" terminal")
1453
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1454
u" priority string (see GnuTLS documentation)")
1455
parser.add_option("--servicename", type=u"string",
1456
metavar=u"NAME", help=u"Zeroconf service name")
1457
parser.add_option("--configdir", type=u"string",
1458
default=u"/etc/mandos", metavar=u"DIR",
1459
help=u"Directory to search for configuration"
1460
u" files")
1461
parser.add_option("--no-dbus", action=u"store_false",
1462
dest=u"use_dbus", help=u"Do not provide D-Bus"
1463
u" system bus interface")
1464
parser.add_option("--no-ipv6", action=u"store_false",
1465
dest=u"use_ipv6", help=u"Do not use IPv6")
1466
options = parser.parse_args()[0]
1786
1467
1787
1468
if options.check:
1788
1469
import doctest
1790
1471
sys.exit()
1791
1472
1792
1473
# Default values for config file for server-global settings
1793
server_defaults = { "interface": "",
1794
"address": "",
1795
"port": "",
1796
"debug": "False",
1797
"priority":
1798
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1799
"servicename": "Mandos",
1800
"use_dbus": "True",
1801
"use_ipv6": "True",
1802
"debuglevel": "",
1474
server_defaults = { u"interface": u"",
1475
u"address": u"",
1476
u"port": u"",
1477
u"debug": u"False",
1478
u"priority":
1479
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1480
u"servicename": u"Mandos",
1481
u"use_dbus": u"True",
1482
u"use_ipv6": u"True",
1803
1483
}
1804
1484
1805
1485
# Parse config file for server-global settings
1806
1486
server_config = configparser.SafeConfigParser(server_defaults)
1807
1487
del server_defaults
1808
1488
server_config.read(os.path.join(options.configdir,
1809
"mandos.conf"))
1489
u"mandos.conf"))
1810
1490
# Convert the SafeConfigParser object to a dict
1811
1491
server_settings = server_config.defaults()
1812
1492
# Use the appropriate methods on the non-string config options
1813
for option in ("debug", "use_dbus", "use_ipv6"):
1814
server_settings[option] = server_config.getboolean("DEFAULT",
1493
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1494
server_settings[option] = server_config.getboolean(u"DEFAULT",
1815
1495
option)
1816
1496
if server_settings["port"]:
1817
server_settings["port"] = server_config.getint("DEFAULT",
1818
"port")
1497
server_settings["port"] = server_config.getint(u"DEFAULT",
1498
u"port")
1819
1499
del server_config
1820
1500
1821
1501
# Override the settings from the config file with command line
1822
1502
# options, if set.
1823
for option in ("interface", "address", "port", "debug",
1824
"priority", "servicename", "configdir",
1825
"use_dbus", "use_ipv6", "debuglevel"):
1503
for option in (u"interface", u"address", u"port", u"debug",
1504
u"priority", u"servicename", u"configdir",
1505
u"use_dbus", u"use_ipv6"):
1826
1506
value = getattr(options, option)
1827
1507
if value is not None:
1828
1508
server_settings[option] = value
1836
1516
##################################################################
1837
1517
1838
1518
# For convenience
1839
debug = server_settings["debug"]
1840
debuglevel = server_settings["debuglevel"]
1841
use_dbus = server_settings["use_dbus"]
1842
use_ipv6 = server_settings["use_ipv6"]
1843
1844
if server_settings["servicename"] != "Mandos":
1519
debug = server_settings[u"debug"]
1520
use_dbus = server_settings[u"use_dbus"]
1521
use_ipv6 = server_settings[u"use_ipv6"]
1522
1523
if not debug:
1524
syslogger.setLevel(logging.WARNING)
1525
console.setLevel(logging.WARNING)
1526
1527
if server_settings[u"servicename"] != u"Mandos":
1845
1528
syslogger.setFormatter(logging.Formatter
1846
('Mandos (%s) [%%(process)d]:'
1847
' %%(levelname)s: %%(message)s'
1848
% server_settings["servicename"]))
1529
(u'Mandos (%s) [%%(process)d]:'
1530
u' %%(levelname)s: %%(message)s'
1531
% server_settings[u"servicename"]))
1849
1532
1850
1533
# Parse config file with clients
1851
client_defaults = { "timeout": "5m",
1852
"extended_timeout": "15m",
1853
"interval": "2m",
1854
"checker": "fping -q -- %%(host)s",
1855
"host": "",
1856
"approval_delay": "0s",
1857
"approval_duration": "1s",
1534
client_defaults = { u"timeout": u"1h",
1535
u"interval": u"5m",
1536
u"checker": u"fping -q -- %%(host)s",
1537
u"host": u"",
1858
1538
}
1859
1539
client_config = configparser.SafeConfigParser(client_defaults)
1860
client_config.read(os.path.join(server_settings["configdir"],
1861
"clients.conf"))
1540
client_config.read(os.path.join(server_settings[u"configdir"],
1541
u"clients.conf"))
1862
1542
1863
1543
global mandos_dbus_service
1864
1544
mandos_dbus_service = None
1865
1545
1866
tcp_server = MandosServer((server_settings["address"],
1867
server_settings["port"]),
1546
tcp_server = MandosServer((server_settings[u"address"],
1547
server_settings[u"port"]),
1868
1548
ClientHandler,
1869
interface=(server_settings["interface"]
1870
or None),
1549
interface=server_settings[u"interface"],
1871
1550
use_ipv6=use_ipv6,
1872
1551
gnutls_priority=
1873
server_settings["priority"],
1552
server_settings[u"priority"],
1874
1553
use_dbus=use_dbus)
1875
if not debug:
1876
pidfilename = "/var/run/mandos.pid"
1877
try:
1878
pidfile = open(pidfilename, "w")
1879
except IOError:
1880
logger.error("Could not open file %r", pidfilename)
1554
pidfilename = u"/var/run/mandos.pid"
1555
try:
1556
pidfile = open(pidfilename, u"w")
1557
except IOError:
1558
logger.error(u"Could not open file %r", pidfilename)
1881
1559
1882
1560
try:
1883
uid = pwd.getpwnam("_mandos").pw_uid
1884
gid = pwd.getpwnam("_mandos").pw_gid
1561
uid = pwd.getpwnam(u"_mandos").pw_uid
1562
gid = pwd.getpwnam(u"_mandos").pw_gid
1885
1563
except KeyError:
1886
1564
try:
1887
uid = pwd.getpwnam("mandos").pw_uid
1888
gid = pwd.getpwnam("mandos").pw_gid
1565
uid = pwd.getpwnam(u"mandos").pw_uid
1566
gid = pwd.getpwnam(u"mandos").pw_gid
1889
1567
except KeyError:
1890
1568
try:
1891
uid = pwd.getpwnam("nobody").pw_uid
1892
gid = pwd.getpwnam("nobody").pw_gid
1569
uid = pwd.getpwnam(u"nobody").pw_uid
1570
gid = pwd.getpwnam(u"nobody").pw_gid
1893
1571
except KeyError:
1894
1572
uid = 65534
1895
1573
gid = 65534
1896
1574
try:
1897
1575
os.setgid(gid)
1898
1576
os.setuid(uid)
1899
except OSError as error:
1577
except OSError, error:
1900
1578
if error[0] != errno.EPERM:
1901
1579
raise error
1902
1580
1903
if not debug and not debuglevel:
1904
syslogger.setLevel(logging.WARNING)
1905
console.setLevel(logging.WARNING)
1906
if debuglevel:
1907
level = getattr(logging, debuglevel.upper())
1908
syslogger.setLevel(level)
1909
console.setLevel(level)
1910
1581
# Enable all possible GnuTLS debugging
1911
1582
if debug:
1912
# Enable all possible GnuTLS debugging
1913
1914
1583
# "Use a log level over 10 to enable all debugging options."
1915
1584
# - GnuTLS manual
1916
1585
gnutls.library.functions.gnutls_global_set_log_level(11)
1917
1586
1918
1587
@gnutls.library.types.gnutls_log_func
1919
1588
def debug_gnutls(level, string):
1920
logger.debug("GnuTLS: %s", string[:-1])
1589
logger.debug(u"GnuTLS: %s", string[:-1])
1921
1590
1922
1591
(gnutls.library.functions
1923
1592
.gnutls_global_set_log_function(debug_gnutls))
1924
1925
# Redirect stdin so all checkers get /dev/null
1926
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1927
os.dup2(null, sys.stdin.fileno())
1928
if null > 2:
1929
os.close(null)
1930
else:
1931
# No console logging
1932
logger.removeHandler(console)
1933
1934
# Need to fork before connecting to D-Bus
1935
if not debug:
1936
# Close all input and output, do double fork, etc.
1937
daemon()
1938
1593
1939
1594
global main_loop
1940
1595
# From the Avahi example code
1944
1599
# End of Avahi example code
1945
1600
if use_dbus:
1946
1601
try:
1947
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1602
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1948
1603
bus, do_not_queue=True)
1949
except dbus.exceptions.NameExistsException as e:
1950
logger.error(unicode(e) + ", disabling D-Bus")
1604
except dbus.exceptions.NameExistsException, e:
1605
logger.error(unicode(e) + u", disabling D-Bus")
1951
1606
use_dbus = False
1952
server_settings["use_dbus"] = False
1607
server_settings[u"use_dbus"] = False
1953
1608
tcp_server.use_dbus = False
1954
1609
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1955
service = AvahiService(name = server_settings["servicename"],
1956
servicetype = "_mandos._tcp",
1610
service = AvahiService(name = server_settings[u"servicename"],
1611
servicetype = u"_mandos._tcp",
1957
1612
protocol = protocol, bus = bus)
1958
1613
if server_settings["interface"]:
1959
1614
service.interface = (if_nametoindex
1960
(str(server_settings["interface"])))
1961
1962
global multiprocessing_manager
1963
multiprocessing_manager = multiprocessing.Manager()
1615
(str(server_settings[u"interface"])))
1964
1616
1965
1617
client_class = Client
1966
1618
if use_dbus:
1967
1619
client_class = functools.partial(ClientDBus, bus = bus)
1968
def client_config_items(config, section):
1969
special_settings = {
1970
"approved_by_default":
1971
lambda: config.getboolean(section,
1972
"approved_by_default"),
1973
}
1974
for name, value in config.items(section):
1975
try:
1976
yield (name, special_settings[name]())
1977
except KeyError:
1978
yield (name, value)
1979
1980
1620
tcp_server.clients.update(set(
1981
1621
client_class(name = section,
1982
config= dict(client_config_items(
1983
client_config, section)))
1622
config= dict(client_config.items(section)))
1984
1623
for section in client_config.sections()))
1985
1624
if not tcp_server.clients:
1986
logger.warning("No clients defined")
1987
1625
logger.warning(u"No clients defined")
1626
1627
if debug:
1628
# Redirect stdin so all checkers get /dev/null
1629
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1630
os.dup2(null, sys.stdin.fileno())
1631
if null > 2:
1632
os.close(null)
1633
else:
1634
# No console logging
1635
logger.removeHandler(console)
1636
# Close all input and output, do double fork, etc.
1637
daemon()
1638
1639
try:
1640
with pidfile:
1641
pid = os.getpid()
1642
pidfile.write(str(pid) + "\n")
1643
del pidfile
1644
except IOError:
1645
logger.error(u"Could not write to file %r with PID %d",
1646
pidfilename, pid)
1647
except NameError:
1648
# "pidfile" was never created
1649
pass
1650
del pidfilename
1651
1988
1652
if not debug:
1989
try:
1990
with pidfile:
1991
pid = os.getpid()
1992
pidfile.write(str(pid) + "\n".encode("utf-8"))
1993
del pidfile
1994
except IOError:
1995
logger.error("Could not write to file %r with PID %d",
1996
pidfilename, pid)
1997
except NameError:
1998
# "pidfile" was never created
1999
pass
2000
del pidfilename
2001
2002
1653
signal.signal(signal.SIGINT, signal.SIG_IGN)
2003
2004
1654
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2005
1655
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2006
1656
2008
1658
class MandosDBusService(dbus.service.Object):
2009
1659
"""A D-Bus proxy object"""
2010
1660
def __init__(self):
2011
dbus.service.Object.__init__(self, bus, "/")
2012
_interface = "se.bsnet.fukt.Mandos"
1661
dbus.service.Object.__init__(self, bus, u"/")
1662
_interface = u"se.bsnet.fukt.Mandos"
2013
1663
2014
@dbus.service.signal(_interface, signature="o")
1664
@dbus.service.signal(_interface, signature=u"o")
2015
1665
def ClientAdded(self, objpath):
2016
1666
"D-Bus signal"
2017
1667
pass
2018
1668
2019
@dbus.service.signal(_interface, signature="ss")
1669
@dbus.service.signal(_interface, signature=u"ss")
2020
1670
def ClientNotFound(self, fingerprint, address):
2021
1671
"D-Bus signal"
2022
1672
pass
2023
1673
2024
@dbus.service.signal(_interface, signature="os")
1674
@dbus.service.signal(_interface, signature=u"os")
2025
1675
def ClientRemoved(self, objpath, name):
2026
1676
"D-Bus signal"
2027
1677
pass
2028
1678
2029
@dbus.service.method(_interface, out_signature="ao")
1679
@dbus.service.method(_interface, out_signature=u"ao")
2030
1680
def GetAllClients(self):
2031
1681
"D-Bus method"
2032
1682
return dbus.Array(c.dbus_object_path
2033
1683
for c in tcp_server.clients)
2034
1684
2035
1685
@dbus.service.method(_interface,
2036
out_signature="a{oa{sv}}")
1686
out_signature=u"a{oa{sv}}")
2037
1687
def GetAllClientsWithProperties(self):
2038
1688
"D-Bus method"
2039
1689
return dbus.Dictionary(
2040
((c.dbus_object_path, c.GetAll(""))
1690
((c.dbus_object_path, c.GetAll(u""))
2041
1691
for c in tcp_server.clients),
2042
signature="oa{sv}")
1692
signature=u"oa{sv}")
2043
1693
2044
@dbus.service.method(_interface, in_signature="o")
1694
@dbus.service.method(_interface, in_signature=u"o")
2045
1695
def RemoveClient(self, object_path):
2046
1696
"D-Bus method"
2047
1697
for c in tcp_server.clients:
2089
1739
# Find out what port we got
2090
1740
service.port = tcp_server.socket.getsockname()[1]
2091
1741
if use_ipv6:
2092
logger.info("Now listening on address %r, port %d,"
1742
logger.info(u"Now listening on address %r, port %d,"
2093
1743
" flowinfo %d, scope_id %d"
2094
1744
% tcp_server.socket.getsockname())
2095
1745
else: # IPv4
2096
logger.info("Now listening on address %r, port %d"
1746
logger.info(u"Now listening on address %r, port %d"
2097
1747
% tcp_server.socket.getsockname())
2098
1748
2099
1749
#service.interface = tcp_server.socket.getsockname()[3]
2102
1752
# From the Avahi example code
2103
1753
try:
2104
1754
service.activate()
2105
except dbus.exceptions.DBusException as error:
2106
logger.critical("DBusException: %s", error)
1755
except dbus.exceptions.DBusException, error:
1756
logger.critical(u"DBusException: %s", error)
2107
1757
cleanup()
2108
1758
sys.exit(1)
2109
1759
# End of Avahi example code
2113
1763
(tcp_server.handle_request
2114
1764
(*args[2:], **kwargs) or True))
2115
1765
2116
logger.debug("Starting main loop")
1766
logger.debug(u"Starting main loop")
2117
1767
main_loop.run()
2118
except AvahiError as error:
2119
logger.critical("AvahiError: %s", error)
1768
except AvahiError, error:
1769
logger.critical(u"AvahiError: %s", error)
2120
1770
cleanup()
2121
1771
sys.exit(1)
2122
1772
except KeyboardInterrupt:
2123
1773
if debug:
2124
print("", file=sys.stderr)
2125
logger.debug("Server received KeyboardInterrupt")
2126
logger.debug("Server exiting")
1774
print >> sys.stderr
1775
logger.debug(u"Server received KeyboardInterrupt")
1776
logger.debug(u"Server exiting")
2127
1777
# Must run before the D-Bus bus name gets deregistered
2128
1778
cleanup()
2129
1779
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0