88
80
except ImportError:
89
81
SO_BINDTODEVICE = None
92
stored_state_file = "clients.pickle"
94
logger = logging.getLogger()
86
logger = logging.Logger(u'mandos')
95
87
syslogger = (logging.handlers.SysLogHandler
96
88
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
97
address = str("/dev/log")))
100
if_nametoindex = (ctypes.cdll.LoadLibrary
101
(ctypes.util.find_library("c"))
103
except (OSError, AttributeError):
104
def if_nametoindex(interface):
105
"Get an interface index the hard way, i.e. using fcntl()"
106
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
107
with contextlib.closing(socket.socket()) as s:
108
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
struct.pack(str("16s16x"),
111
interface_index = struct.unpack(str("I"),
113
return interface_index
116
def initlogger(debug, level=logging.WARNING):
117
"""init logger and add loglevel"""
119
syslogger.setFormatter(logging.Formatter
120
('Mandos [%(process)d]: %(levelname)s:'
122
logger.addHandler(syslogger)
125
console = logging.StreamHandler()
126
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
130
logger.addHandler(console)
131
logger.setLevel(level)
134
class PGPError(Exception):
135
"""Exception if encryption/decryption fails"""
139
class PGPEngine(object):
140
"""A simple class for OpenPGP symmetric encryption & decryption"""
142
self.gnupg = GnuPGInterface.GnuPG()
143
self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
self.gnupg = GnuPGInterface.GnuPG()
145
self.gnupg.options.meta_interactive = False
146
self.gnupg.options.homedir = self.tempdir
147
self.gnupg.options.extra_args.extend(['--force-mdc',
154
def __exit__(self, exc_type, exc_value, traceback):
162
if self.tempdir is not None:
163
# Delete contents of tempdir
164
for root, dirs, files in os.walk(self.tempdir,
166
for filename in files:
167
os.remove(os.path.join(root, filename))
169
os.rmdir(os.path.join(root, dirname))
171
os.rmdir(self.tempdir)
174
def password_encode(self, password):
175
# Passphrase can not be empty and can not contain newlines or
176
# NUL bytes. So we prefix it and hex encode it.
177
return b"mandos" + binascii.hexlify(password)
179
def encrypt(self, data, password):
180
self.gnupg.passphrase = self.password_encode(password)
181
with open(os.devnull, "w") as devnull:
183
proc = self.gnupg.run(['--symmetric'],
184
create_fhs=['stdin', 'stdout'],
185
attach_fhs={'stderr': devnull})
186
with contextlib.closing(proc.handles['stdin']) as f:
188
with contextlib.closing(proc.handles['stdout']) as f:
189
ciphertext = f.read()
193
self.gnupg.passphrase = None
196
def decrypt(self, data, password):
197
self.gnupg.passphrase = self.password_encode(password)
198
with open(os.devnull, "w") as devnull:
200
proc = self.gnupg.run(['--decrypt'],
201
create_fhs=['stdin', 'stdout'],
202
attach_fhs={'stderr': devnull})
203
with contextlib.closing(proc.handles['stdin']) as f:
205
with contextlib.closing(proc.handles['stdout']) as f:
206
decrypted_plaintext = f.read()
210
self.gnupg.passphrase = None
211
return decrypted_plaintext
89
address = "/dev/log"))
90
syslogger.setFormatter(logging.Formatter
91
(u'Mandos [%(process)d]: %(levelname)s:'
93
logger.addHandler(syslogger)
95
console = logging.StreamHandler()
96
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
99
logger.addHandler(console)
214
101
class AvahiError(Exception):
215
102
def __init__(self, value, *args, **kwargs):
315
191
dbus.UInt16(self.port),
316
192
avahi.string_array_to_txt_array(self.TXT))
317
193
self.group.Commit()
319
194
def entry_group_state_changed(self, state, error):
320
195
"""Derived from the Avahi example code"""
321
logger.debug("Avahi entry group state change: %i", state)
196
logger.debug(u"Avahi entry group state change: %i", state)
323
198
if state == avahi.ENTRY_GROUP_ESTABLISHED:
324
logger.debug("Zeroconf service established.")
199
logger.debug(u"Zeroconf service established.")
325
200
elif state == avahi.ENTRY_GROUP_COLLISION:
326
logger.info("Zeroconf service name collision.")
201
logger.warning(u"Zeroconf service name collision.")
328
203
elif state == avahi.ENTRY_GROUP_FAILURE:
329
logger.critical("Avahi: Error in group state changed %s",
204
logger.critical(u"Avahi: Error in group state changed %s",
331
raise AvahiGroupError("State changed: {0!s}"
206
raise AvahiGroupError(u"State changed: %s"
334
208
def cleanup(self):
335
209
"""Derived from the Avahi example code"""
336
210
if self.group is not None:
339
except (dbus.exceptions.UnknownMethodException,
340
dbus.exceptions.DBusException):
342
212
self.group = None
345
def server_state_changed(self, state, error=None):
213
def server_state_changed(self, state):
346
214
"""Derived from the Avahi example code"""
347
logger.debug("Avahi server state change: %i", state)
348
bad_states = { avahi.SERVER_INVALID:
349
"Zeroconf server invalid",
350
avahi.SERVER_REGISTERING: None,
351
avahi.SERVER_COLLISION:
352
"Zeroconf server name collision",
353
avahi.SERVER_FAILURE:
354
"Zeroconf server failure" }
355
if state in bad_states:
356
if bad_states[state] is not None:
358
logger.error(bad_states[state])
360
logger.error(bad_states[state] + ": %r", error)
215
logger.debug(u"Avahi server state change: %i", state)
216
if state == avahi.SERVER_COLLISION:
217
logger.error(u"Zeroconf server name collision")
362
219
elif state == avahi.SERVER_RUNNING:
366
logger.debug("Unknown state: %r", state)
368
logger.debug("Unknown state: %r: %r", state, error)
370
221
def activate(self):
371
222
"""Derived from the Avahi example code"""
372
223
if self.server is None:
373
224
self.server = dbus.Interface(
374
225
self.bus.get_object(avahi.DBUS_NAME,
375
avahi.DBUS_PATH_SERVER,
376
follow_name_owner_changes=True),
226
avahi.DBUS_PATH_SERVER),
377
227
avahi.DBUS_INTERFACE_SERVER)
378
self.server.connect_to_signal("StateChanged",
228
self.server.connect_to_signal(u"StateChanged",
379
229
self.server_state_changed)
380
230
self.server_state_changed(self.server.GetState())
383
class AvahiServiceToSyslog(AvahiService):
385
"""Add the new name to the syslog messages"""
386
ret = AvahiService.rename(self)
387
syslogger.setFormatter(logging.Formatter
388
('Mandos ({0}) [%(process)d]:'
389
' %(levelname)s: %(message)s'
394
def timedelta_to_milliseconds(td):
395
"Convert a datetime.timedelta() to milliseconds"
396
return ((td.days * 24 * 60 * 60 * 1000)
397
+ (td.seconds * 1000)
398
+ (td.microseconds // 1000))
401
233
class Client(object):
402
234
"""A representation of a client host served by this server.
405
approved: bool(); 'None' if not yet approved/disapproved
406
approval_delay: datetime.timedelta(); Time to wait for approval
407
approval_duration: datetime.timedelta(); Duration of one approval
237
name: string; from the config file, used in log messages and
239
fingerprint: string (40 or 32 hexadecimal digits); used to
240
uniquely identify the client
241
secret: bytestring; sent verbatim (over TLS) to client
242
host: string; available for use by the checker command
243
created: datetime.datetime(); (UTC) object creation
244
last_enabled: datetime.datetime(); (UTC)
246
last_checked_ok: datetime.datetime(); (UTC) or None
247
timeout: datetime.timedelta(); How long from last_checked_ok
248
until this client is disabled
249
interval: datetime.timedelta(); How often to start a new checker
250
disable_hook: If set, called by disable() as disable_hook(self)
408
251
checker: subprocess.Popen(); a running checker process used
409
252
to see if the client lives.
410
253
'None' if no process is running.
411
checker_callback_tag: a gobject event source tag, or None
412
checker_command: string; External command which is run to check
413
if client lives. %() expansions are done at
254
checker_initiator_tag: a gobject event source tag, or None
255
disable_initiator_tag: - '' -
256
checker_callback_tag: - '' -
257
checker_command: string; External command which is run to check if
258
client lives. %() expansions are done at
414
259
runtime with vars(self) as dict, so that for
415
260
instance %(name)s can be used in the command.
416
checker_initiator_tag: a gobject event source tag, or None
417
created: datetime.datetime(); (UTC) object creation
418
client_structure: Object describing what attributes a client has
419
and is used for storing the client at exit
420
261
current_checker_command: string; current running checker_command
421
disable_initiator_tag: a gobject event source tag, or None
423
fingerprint: string (40 or 32 hexadecimal digits); used to
424
uniquely identify the client
425
host: string; available for use by the checker command
426
interval: datetime.timedelta(); How often to start a new checker
427
last_approval_request: datetime.datetime(); (UTC) or None
428
last_checked_ok: datetime.datetime(); (UTC) or None
429
last_checker_status: integer between 0 and 255 reflecting exit
430
status of last checker. -1 reflects crashed
431
checker, -2 means no checker completed yet.
432
last_enabled: datetime.datetime(); (UTC) or None
433
name: string; from the config file, used in log messages and
435
secret: bytestring; sent verbatim (over TLS) to client
436
timeout: datetime.timedelta(); How long from last_checked_ok
437
until this client is disabled
438
extended_timeout: extra long timeout when secret has been sent
439
runtime_expansions: Allowed attributes for runtime expansion.
440
expires: datetime.datetime(); time (UTC) when a client will be
444
runtime_expansions = ("approval_delay", "approval_duration",
445
"created", "enabled", "expires",
446
"fingerprint", "host", "interval",
447
"last_approval_request", "last_checked_ok",
448
"last_enabled", "name", "timeout")
449
client_defaults = { "timeout": "5m",
450
"extended_timeout": "15m",
452
"checker": "fping -q -- %%(host)s",
454
"approval_delay": "0s",
455
"approval_duration": "1s",
456
"approved_by_default": "True",
265
def _timedelta_to_milliseconds(td):
266
"Convert a datetime.timedelta() to milliseconds"
267
return ((td.days * 24 * 60 * 60 * 1000)
268
+ (td.seconds * 1000)
269
+ (td.microseconds // 1000))
460
271
def timeout_milliseconds(self):
461
272
"Return the 'timeout' attribute in milliseconds"
462
return timedelta_to_milliseconds(self.timeout)
464
def extended_timeout_milliseconds(self):
465
"Return the 'extended_timeout' attribute in milliseconds"
466
return timedelta_to_milliseconds(self.extended_timeout)
273
return self._timedelta_to_milliseconds(self.timeout)
468
275
def interval_milliseconds(self):
469
276
"Return the 'interval' attribute in milliseconds"
470
return timedelta_to_milliseconds(self.interval)
472
def approval_delay_milliseconds(self):
473
return timedelta_to_milliseconds(self.approval_delay)
476
def config_parser(config):
477
"""Construct a new dict of client settings of this form:
478
{ client_name: {setting_name: value, ...}, ...}
479
with exceptions for any special settings as defined above.
480
NOTE: Must be a pure function. Must return the same result
481
value given the same arguments.
484
for client_name in config.sections():
485
section = dict(config.items(client_name))
486
client = settings[client_name] = {}
488
client["host"] = section["host"]
489
# Reformat values from string types to Python types
490
client["approved_by_default"] = config.getboolean(
491
client_name, "approved_by_default")
492
client["enabled"] = config.getboolean(client_name,
495
client["fingerprint"] = (section["fingerprint"].upper()
497
if "secret" in section:
498
client["secret"] = section["secret"].decode("base64")
499
elif "secfile" in section:
500
with open(os.path.expanduser(os.path.expandvars
501
(section["secfile"])),
503
client["secret"] = secfile.read()
505
raise TypeError("No secret or secfile for section {0}"
507
client["timeout"] = string_to_delta(section["timeout"])
508
client["extended_timeout"] = string_to_delta(
509
section["extended_timeout"])
510
client["interval"] = string_to_delta(section["interval"])
511
client["approval_delay"] = string_to_delta(
512
section["approval_delay"])
513
client["approval_duration"] = string_to_delta(
514
section["approval_duration"])
515
client["checker_command"] = section["checker"]
516
client["last_approval_request"] = None
517
client["last_checked_ok"] = None
518
client["last_checker_status"] = -2
522
def __init__(self, settings, name = None):
277
return self._timedelta_to_milliseconds(self.interval)
279
def __init__(self, name = None, disable_hook=None, config=None):
280
"""Note: the 'checker' key in 'config' sets the
281
'checker_command' attribute and *not* the 'checker'
524
# adding all client settings
525
for setting, value in settings.iteritems():
526
setattr(self, setting, value)
529
if not hasattr(self, "last_enabled"):
530
self.last_enabled = datetime.datetime.utcnow()
531
if not hasattr(self, "expires"):
532
self.expires = (datetime.datetime.utcnow()
535
self.last_enabled = None
538
logger.debug("Creating client %r", self.name)
286
logger.debug(u"Creating client %r", self.name)
539
287
# Uppercase and remove spaces from fingerprint for later
540
288
# comparison purposes with return value from the fingerprint()
542
logger.debug(" Fingerprint: %s", self.fingerprint)
543
self.created = settings.get("created",
544
datetime.datetime.utcnow())
546
# attributes specific for this server instance
290
self.fingerprint = (config[u"fingerprint"].upper()
292
logger.debug(u" Fingerprint: %s", self.fingerprint)
293
if u"secret" in config:
294
self.secret = config[u"secret"].decode(u"base64")
295
elif u"secfile" in config:
296
with open(os.path.expanduser(os.path.expandvars
297
(config[u"secfile"])),
299
self.secret = secfile.read()
301
raise TypeError(u"No secret or secfile for client %s"
303
self.host = config.get(u"host", u"")
304
self.created = datetime.datetime.utcnow()
306
self.last_enabled = None
307
self.last_checked_ok = None
308
self.timeout = string_to_delta(config[u"timeout"])
309
self.interval = string_to_delta(config[u"interval"])
310
self.disable_hook = disable_hook
547
311
self.checker = None
548
312
self.checker_initiator_tag = None
549
313
self.disable_initiator_tag = None
550
314
self.checker_callback_tag = None
315
self.checker_command = config[u"checker"]
551
316
self.current_checker_command = None
553
self.approvals_pending = 0
554
self.changedstate = (multiprocessing_manager
555
.Condition(multiprocessing_manager
557
self.client_structure = [attr for attr in
558
self.__dict__.iterkeys()
559
if not attr.startswith("_")]
560
self.client_structure.append("client_structure")
562
for name, t in inspect.getmembers(type(self),
566
if not name.startswith("_"):
567
self.client_structure.append(name)
569
# Send notice to process children that client state has changed
570
def send_changedstate(self):
571
with self.changedstate:
572
self.changedstate.notify_all()
317
self.last_connect = None
574
319
def enable(self):
575
320
"""Start this client's checker and timeout hooks"""
576
if getattr(self, "enabled", False):
321
if getattr(self, u"enabled", False):
577
322
# Already enabled
579
self.expires = datetime.datetime.utcnow() + self.timeout
581
324
self.last_enabled = datetime.datetime.utcnow()
583
self.send_changedstate()
585
def disable(self, quiet=True):
586
"""Disable this client."""
587
if not getattr(self, "enabled", False):
590
logger.info("Disabling client %s", self.name)
591
if getattr(self, "disable_initiator_tag", None) is not None:
592
gobject.source_remove(self.disable_initiator_tag)
593
self.disable_initiator_tag = None
595
if getattr(self, "checker_initiator_tag", None) is not None:
596
gobject.source_remove(self.checker_initiator_tag)
597
self.checker_initiator_tag = None
601
self.send_changedstate()
602
# Do not run this again if called by a gobject.timeout_add
608
def init_checker(self):
609
325
# Schedule a new checker to be started an 'interval' from now,
610
326
# and every interval from then on.
611
if self.checker_initiator_tag is not None:
612
gobject.source_remove(self.checker_initiator_tag)
613
327
self.checker_initiator_tag = (gobject.timeout_add
614
328
(self.interval_milliseconds(),
615
329
self.start_checker))
616
330
# Schedule a disable() when 'timeout' has passed
617
if self.disable_initiator_tag is not None:
618
gobject.source_remove(self.disable_initiator_tag)
619
331
self.disable_initiator_tag = (gobject.timeout_add
620
332
(self.timeout_milliseconds(),
622
335
# Also start a new checker *right now*.
623
336
self.start_checker()
338
def disable(self, quiet=True):
339
"""Disable this client."""
340
if not getattr(self, "enabled", False):
343
logger.info(u"Disabling client %s", self.name)
344
if getattr(self, u"disable_initiator_tag", False):
345
gobject.source_remove(self.disable_initiator_tag)
346
self.disable_initiator_tag = None
347
if getattr(self, u"checker_initiator_tag", False):
348
gobject.source_remove(self.checker_initiator_tag)
349
self.checker_initiator_tag = None
351
if self.disable_hook:
352
self.disable_hook(self)
354
# Do not run this again if called by a gobject.timeout_add
358
self.disable_hook = None
625
361
def checker_callback(self, pid, condition, command):
626
362
"""The checker has completed, so take appropriate actions."""
627
363
self.checker_callback_tag = None
628
364
self.checker = None
629
365
if os.WIFEXITED(condition):
630
self.last_checker_status = os.WEXITSTATUS(condition)
631
if self.last_checker_status == 0:
632
logger.info("Checker for %(name)s succeeded",
366
exitstatus = os.WEXITSTATUS(condition)
368
logger.info(u"Checker for %(name)s succeeded",
634
370
self.checked_ok()
636
logger.info("Checker for %(name)s failed",
372
logger.info(u"Checker for %(name)s failed",
639
self.last_checker_status = -1
640
logger.warning("Checker for %(name)s crashed?",
375
logger.warning(u"Checker for %(name)s crashed?",
643
378
def checked_ok(self):
644
"""Assert that the client has been seen, alive and well."""
379
"""Bump up the timeout for this client.
381
This should only be called when the client has been seen,
645
384
self.last_checked_ok = datetime.datetime.utcnow()
646
self.last_checker_status = 0
649
def bump_timeout(self, timeout=None):
650
"""Bump up the timeout for this client."""
652
timeout = self.timeout
653
if self.disable_initiator_tag is not None:
654
gobject.source_remove(self.disable_initiator_tag)
655
self.disable_initiator_tag = None
656
if getattr(self, "enabled", False):
657
self.disable_initiator_tag = (gobject.timeout_add
658
(timedelta_to_milliseconds
659
(timeout), self.disable))
660
self.expires = datetime.datetime.utcnow() + timeout
662
def need_approval(self):
663
self.last_approval_request = datetime.datetime.utcnow()
385
gobject.source_remove(self.disable_initiator_tag)
386
self.disable_initiator_tag = (gobject.timeout_add
387
(self.timeout_milliseconds(),
665
390
def start_checker(self):
666
391
"""Start a new checker subprocess if one is not running.
837
531
class DBusObjectWithProperties(dbus.service.Object):
838
532
"""A D-Bus object with properties.
840
534
Classes inheriting from this can use the dbus_service_property
841
535
decorator to expose methods as D-Bus properties. It exposes the
842
536
standard Get(), Set(), and GetAll() methods on the D-Bus.
846
def _is_dbus_thing(thing):
847
"""Returns a function testing if an attribute is a D-Bus thing
849
If called like _is_dbus_thing("method") it returns a function
850
suitable for use as predicate to inspect.getmembers().
852
return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
540
def _is_dbus_property(obj):
541
return getattr(obj, u"_dbus_is_property", False)
855
def _get_all_dbus_things(self, thing):
543
def _get_all_dbus_properties(self):
856
544
"""Returns a generator of (name, attribute) pairs
858
return ((getattr(athing.__get__(self), "_dbus_name",
860
athing.__get__(self))
861
for cls in self.__class__.__mro__
863
inspect.getmembers(cls,
864
self._is_dbus_thing(thing)))
546
return ((prop._dbus_name, prop)
548
inspect.getmembers(self, self._is_dbus_property))
866
550
def _get_dbus_property(self, interface_name, property_name):
867
551
"""Returns a bound method if one exists which is a D-Bus
868
552
property with the specified name and interface.
870
for cls in self.__class__.__mro__:
871
for name, value in (inspect.getmembers
873
self._is_dbus_thing("property"))):
874
if (value._dbus_name == property_name
875
and value._dbus_interface == interface_name):
876
return value.__get__(self)
554
for name in (property_name,
555
property_name + u"_dbus_property"):
556
prop = getattr(self, name, None)
558
or not self._is_dbus_property(prop)
559
or prop._dbus_name != property_name
560
or (interface_name and prop._dbus_interface
561
and interface_name != prop._dbus_interface)):
878
564
# No such property
879
raise DBusPropertyNotFound(self.dbus_object_path + ":"
880
+ interface_name + "."
565
raise DBusPropertyNotFound(self.dbus_object_path + u":"
566
+ interface_name + u"."
883
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
569
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
885
571
def Get(self, interface_name, property_name):
886
572
"""Standard D-Bus property Get() method, see D-Bus standard.
888
574
prop = self._get_dbus_property(interface_name, property_name)
889
if prop._dbus_access == "write":
575
if prop._dbus_access == u"write":
890
576
raise DBusPropertyAccessException(property_name)
892
if not hasattr(value, "variant_level"):
578
if not hasattr(value, u"variant_level"):
894
580
return type(value)(value, variant_level=value.variant_level+1)
896
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
582
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
897
583
def Set(self, interface_name, property_name, value):
898
584
"""Standard D-Bus property Set() method, see D-Bus standard.
900
586
prop = self._get_dbus_property(interface_name, property_name)
901
if prop._dbus_access == "read":
587
if prop._dbus_access == u"read":
902
588
raise DBusPropertyAccessException(property_name)
903
if prop._dbus_get_args_options["byte_arrays"]:
589
if prop._dbus_get_args_options[u"byte_arrays"]:
904
590
# The byte_arrays option is not supported yet on
905
591
# signatures other than "ay".
906
if prop._dbus_signature != "ay":
592
if prop._dbus_signature != u"ay":
908
value = dbus.ByteArray(b''.join(chr(byte)
594
value = dbus.ByteArray(''.join(unichr(byte)
912
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
913
out_signature="a{sv}")
598
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
599
out_signature=u"a{sv}")
914
600
def GetAll(self, interface_name):
915
601
"""Standard D-Bus property GetAll() method, see D-Bus
918
604
Note: Will not include properties with access="write".
921
for name, prop in self._get_all_dbus_things("property"):
607
for name, prop in self._get_all_dbus_properties():
922
608
if (interface_name
923
609
and interface_name != prop._dbus_interface):
924
610
# Interface non-empty but did not match
926
612
# Ignore write-only properties
927
if prop._dbus_access == "write":
613
if prop._dbus_access == u"write":
930
if not hasattr(value, "variant_level"):
931
properties[name] = value
616
if not hasattr(value, u"variant_level"):
933
properties[name] = type(value)(value, variant_level=
934
value.variant_level+1)
935
return dbus.Dictionary(properties, signature="sv")
619
all[name] = type(value)(value, variant_level=
620
value.variant_level+1)
621
return dbus.Dictionary(all, signature=u"sv")
937
623
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
939
625
path_keyword='object_path',
940
626
connection_keyword='connection')
941
627
def Introspect(self, object_path, connection):
942
"""Overloading of standard D-Bus method.
944
Inserts property tags and interface annotation tags.
628
"""Standard D-Bus method, overloaded to insert property tags.
946
630
xmlstring = dbus.service.Object.Introspect(self, object_path,
949
633
document = xml.dom.minidom.parseString(xmlstring)
950
634
def make_tag(document, name, prop):
951
e = document.createElement("property")
952
e.setAttribute("name", name)
953
e.setAttribute("type", prop._dbus_signature)
954
e.setAttribute("access", prop._dbus_access)
635
e = document.createElement(u"property")
636
e.setAttribute(u"name", name)
637
e.setAttribute(u"type", prop._dbus_signature)
638
e.setAttribute(u"access", prop._dbus_access)
956
for if_tag in document.getElementsByTagName("interface"):
640
for if_tag in document.getElementsByTagName(u"interface"):
958
641
for tag in (make_tag(document, name, prop)
960
in self._get_all_dbus_things("property")
643
in self._get_all_dbus_properties()
961
644
if prop._dbus_interface
962
== if_tag.getAttribute("name")):
645
== if_tag.getAttribute(u"name")):
963
646
if_tag.appendChild(tag)
964
# Add annotation tags
965
for typ in ("method", "signal", "property"):
966
for tag in if_tag.getElementsByTagName(typ):
968
for name, prop in (self.
969
_get_all_dbus_things(typ)):
970
if (name == tag.getAttribute("name")
971
and prop._dbus_interface
972
== if_tag.getAttribute("name")):
973
annots.update(getattr
977
for name, value in annots.iteritems():
978
ann_tag = document.createElement(
980
ann_tag.setAttribute("name", name)
981
ann_tag.setAttribute("value", value)
982
tag.appendChild(ann_tag)
983
# Add interface annotation tags
984
for annotation, value in dict(
985
itertools.chain.from_iterable(
986
annotations().iteritems()
987
for name, annotations in
988
self._get_all_dbus_things("interface")
989
if name == if_tag.getAttribute("name")
991
ann_tag = document.createElement("annotation")
992
ann_tag.setAttribute("name", annotation)
993
ann_tag.setAttribute("value", value)
994
if_tag.appendChild(ann_tag)
995
647
# Add the names to the return values for the
996
648
# "org.freedesktop.DBus.Properties" methods
997
if (if_tag.getAttribute("name")
998
== "org.freedesktop.DBus.Properties"):
999
for cn in if_tag.getElementsByTagName("method"):
1000
if cn.getAttribute("name") == "Get":
1001
for arg in cn.getElementsByTagName("arg"):
1002
if (arg.getAttribute("direction")
1004
arg.setAttribute("name", "value")
1005
elif cn.getAttribute("name") == "GetAll":
1006
for arg in cn.getElementsByTagName("arg"):
1007
if (arg.getAttribute("direction")
1009
arg.setAttribute("name", "props")
1010
xmlstring = document.toxml("utf-8")
649
if (if_tag.getAttribute(u"name")
650
== u"org.freedesktop.DBus.Properties"):
651
for cn in if_tag.getElementsByTagName(u"method"):
652
if cn.getAttribute(u"name") == u"Get":
653
for arg in cn.getElementsByTagName(u"arg"):
654
if (arg.getAttribute(u"direction")
656
arg.setAttribute(u"name", u"value")
657
elif cn.getAttribute(u"name") == u"GetAll":
658
for arg in cn.getElementsByTagName(u"arg"):
659
if (arg.getAttribute(u"direction")
661
arg.setAttribute(u"name", u"props")
662
xmlstring = document.toxml(u"utf-8")
1011
663
document.unlink()
1012
664
except (AttributeError, xml.dom.DOMException,
1013
xml.parsers.expat.ExpatError) as error:
1014
logger.error("Failed to override Introspection method",
665
xml.parsers.expat.ExpatError), error:
666
logger.error(u"Failed to override Introspection method",
1016
668
return xmlstring
1019
def datetime_to_dbus(dt, variant_level=0):
1020
"""Convert a UTC datetime.datetime() to a D-Bus type."""
1022
return dbus.String("", variant_level = variant_level)
1023
return dbus.String(dt.isoformat(),
1024
variant_level=variant_level)
1027
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1028
"""A class decorator; applied to a subclass of
1029
dbus.service.Object, it will add alternate D-Bus attributes with
1030
interface names according to the "alt_interface_names" mapping.
1033
@alternate_dbus_interfaces({"org.example.Interface":
1034
"net.example.AlternateInterface"})
1035
class SampleDBusObject(dbus.service.Object):
1036
@dbus.service.method("org.example.Interface")
1037
def SampleDBusMethod():
1040
The above "SampleDBusMethod" on "SampleDBusObject" will be
1041
reachable via two interfaces: "org.example.Interface" and
1042
"net.example.AlternateInterface", the latter of which will have
1043
its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1044
"true", unless "deprecate" is passed with a False value.
1046
This works for methods and signals, and also for D-Bus properties
1047
(from DBusObjectWithProperties) and interfaces (from the
1048
dbus_interface_annotations decorator).
1051
for orig_interface_name, alt_interface_name in (
1052
alt_interface_names.iteritems()):
1054
interface_names = set()
1055
# Go though all attributes of the class
1056
for attrname, attribute in inspect.getmembers(cls):
1057
# Ignore non-D-Bus attributes, and D-Bus attributes
1058
# with the wrong interface name
1059
if (not hasattr(attribute, "_dbus_interface")
1060
or not attribute._dbus_interface
1061
.startswith(orig_interface_name)):
1063
# Create an alternate D-Bus interface name based on
1065
alt_interface = (attribute._dbus_interface
1066
.replace(orig_interface_name,
1067
alt_interface_name))
1068
interface_names.add(alt_interface)
1069
# Is this a D-Bus signal?
1070
if getattr(attribute, "_dbus_is_signal", False):
1071
# Extract the original non-method function by
1073
nonmethod_func = (dict(
1074
zip(attribute.func_code.co_freevars,
1075
attribute.__closure__))["func"]
1077
# Create a new, but exactly alike, function
1078
# object, and decorate it to be a new D-Bus signal
1079
# with the alternate D-Bus interface name
1080
new_function = (dbus.service.signal
1082
attribute._dbus_signature)
1083
(types.FunctionType(
1084
nonmethod_func.func_code,
1085
nonmethod_func.func_globals,
1086
nonmethod_func.func_name,
1087
nonmethod_func.func_defaults,
1088
nonmethod_func.func_closure)))
1089
# Copy annotations, if any
1091
new_function._dbus_annotations = (
1092
dict(attribute._dbus_annotations))
1093
except AttributeError:
1095
# Define a creator of a function to call both the
1096
# original and alternate functions, so both the
1097
# original and alternate signals gets sent when
1098
# the function is called
1099
def fixscope(func1, func2):
1100
"""This function is a scope container to pass
1101
func1 and func2 to the "call_both" function
1102
outside of its arguments"""
1103
def call_both(*args, **kwargs):
1104
"""This function will emit two D-Bus
1105
signals by calling func1 and func2"""
1106
func1(*args, **kwargs)
1107
func2(*args, **kwargs)
1109
# Create the "call_both" function and add it to
1111
attr[attrname] = fixscope(attribute, new_function)
1112
# Is this a D-Bus method?
1113
elif getattr(attribute, "_dbus_is_method", False):
1114
# Create a new, but exactly alike, function
1115
# object. Decorate it to be a new D-Bus method
1116
# with the alternate D-Bus interface name. Add it
1118
attr[attrname] = (dbus.service.method
1120
attribute._dbus_in_signature,
1121
attribute._dbus_out_signature)
1123
(attribute.func_code,
1124
attribute.func_globals,
1125
attribute.func_name,
1126
attribute.func_defaults,
1127
attribute.func_closure)))
1128
# Copy annotations, if any
1130
attr[attrname]._dbus_annotations = (
1131
dict(attribute._dbus_annotations))
1132
except AttributeError:
1134
# Is this a D-Bus property?
1135
elif getattr(attribute, "_dbus_is_property", False):
1136
# Create a new, but exactly alike, function
1137
# object, and decorate it to be a new D-Bus
1138
# property with the alternate D-Bus interface
1139
# name. Add it to the class.
1140
attr[attrname] = (dbus_service_property
1142
attribute._dbus_signature,
1143
attribute._dbus_access,
1145
._dbus_get_args_options
1148
(attribute.func_code,
1149
attribute.func_globals,
1150
attribute.func_name,
1151
attribute.func_defaults,
1152
attribute.func_closure)))
1153
# Copy annotations, if any
1155
attr[attrname]._dbus_annotations = (
1156
dict(attribute._dbus_annotations))
1157
except AttributeError:
1159
# Is this a D-Bus interface?
1160
elif getattr(attribute, "_dbus_is_interface", False):
1161
# Create a new, but exactly alike, function
1162
# object. Decorate it to be a new D-Bus interface
1163
# with the alternate D-Bus interface name. Add it
1165
attr[attrname] = (dbus_interface_annotations
1168
(attribute.func_code,
1169
attribute.func_globals,
1170
attribute.func_name,
1171
attribute.func_defaults,
1172
attribute.func_closure)))
1174
# Deprecate all alternate interfaces
1175
iname="_AlternateDBusNames_interface_annotation{0}"
1176
for interface_name in interface_names:
1177
@dbus_interface_annotations(interface_name)
1179
return { "org.freedesktop.DBus.Deprecated":
1181
# Find an unused name
1182
for aname in (iname.format(i)
1183
for i in itertools.count()):
1184
if aname not in attr:
1188
# Replace the class with a new subclass of it with
1189
# methods, signals, etc. as created above.
1190
cls = type(b"{0}Alternate".format(cls.__name__),
1196
@alternate_dbus_interfaces({"se.recompile.Mandos":
1197
"se.bsnet.fukt.Mandos"})
1198
671
class ClientDBus(Client, DBusObjectWithProperties):
1199
672
"""A Client class using D-Bus
1213
682
Client.__init__(self, *args, **kwargs)
1214
683
# Only now, when this client is initialized, can it show up on
1216
client_object_name = unicode(self.name).translate(
1217
{ord("."): ord("_"),
1218
ord("-"): ord("_")})
1219
685
self.dbus_object_path = (dbus.ObjectPath
1220
("/clients/" + client_object_name))
687
+ self.name.replace(u".", u"_")))
1221
688
DBusObjectWithProperties.__init__(self, self.bus,
1222
689
self.dbus_object_path)
1224
def notifychangeproperty(transform_func,
1225
dbus_name, type_func=lambda x: x,
1227
""" Modify a variable so that it's a property which announces
1228
its changes to DBus.
1230
transform_fun: Function that takes a value and a variant_level
1231
and transforms it to a D-Bus type.
1232
dbus_name: D-Bus name of the variable
1233
type_func: Function that transform the value before sending it
1234
to the D-Bus. Default: no transform
1235
variant_level: D-Bus variant level. Default: 1
1237
attrname = "_{0}".format(dbus_name)
1238
def setter(self, value):
1239
if hasattr(self, "dbus_object_path"):
1240
if (not hasattr(self, attrname) or
1241
type_func(getattr(self, attrname, None))
1242
!= type_func(value)):
1243
dbus_value = transform_func(type_func(value),
1246
self.PropertyChanged(dbus.String(dbus_name),
1248
setattr(self, attrname, value)
1250
return property(lambda self: getattr(self, attrname), setter)
1252
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1253
approvals_pending = notifychangeproperty(dbus.Boolean,
1256
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1257
last_enabled = notifychangeproperty(datetime_to_dbus,
1259
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1260
type_func = lambda checker:
1261
checker is not None)
1262
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1264
last_checker_status = notifychangeproperty(dbus.Int16,
1265
"LastCheckerStatus")
1266
last_approval_request = notifychangeproperty(
1267
datetime_to_dbus, "LastApprovalRequest")
1268
approved_by_default = notifychangeproperty(dbus.Boolean,
1269
"ApprovedByDefault")
1270
approval_delay = notifychangeproperty(dbus.UInt64,
1273
timedelta_to_milliseconds)
1274
approval_duration = notifychangeproperty(
1275
dbus.UInt64, "ApprovalDuration",
1276
type_func = timedelta_to_milliseconds)
1277
host = notifychangeproperty(dbus.String, "Host")
1278
timeout = notifychangeproperty(dbus.UInt64, "Timeout",
1280
timedelta_to_milliseconds)
1281
extended_timeout = notifychangeproperty(
1282
dbus.UInt64, "ExtendedTimeout",
1283
type_func = timedelta_to_milliseconds)
1284
interval = notifychangeproperty(dbus.UInt64,
1287
timedelta_to_milliseconds)
1288
checker_command = notifychangeproperty(dbus.String, "Checker")
1290
del notifychangeproperty
692
def _datetime_to_dbus(dt, variant_level=0):
693
"""Convert a UTC datetime.datetime() to a D-Bus type."""
694
return dbus.String(dt.isoformat(),
695
variant_level=variant_level)
698
oldstate = getattr(self, u"enabled", False)
699
r = Client.enable(self)
700
if oldstate != self.enabled:
702
self.PropertyChanged(dbus.String(u"enabled"),
703
dbus.Boolean(True, variant_level=1))
704
self.PropertyChanged(
705
dbus.String(u"last_enabled"),
706
self._datetime_to_dbus(self.last_enabled,
710
def disable(self, quiet = False):
711
oldstate = getattr(self, u"enabled", False)
712
r = Client.disable(self, quiet=quiet)
713
if not quiet and oldstate != self.enabled:
715
self.PropertyChanged(dbus.String(u"enabled"),
716
dbus.Boolean(False, variant_level=1))
1292
719
def __del__(self, *args, **kwargs):
1294
721
self.remove_from_connection()
1295
722
except LookupError:
1297
if hasattr(DBusObjectWithProperties, "__del__"):
724
if hasattr(DBusObjectWithProperties, u"__del__"):
1298
725
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1299
726
Client.__del__(self, *args, **kwargs)
1433
# ApprovalPending - property
1434
@dbus_service_property(_interface, signature="b", access="read")
1435
def ApprovalPending_dbus_property(self):
1436
return dbus.Boolean(bool(self.approvals_pending))
1438
# ApprovedByDefault - property
1439
@dbus_service_property(_interface, signature="b",
1441
def ApprovedByDefault_dbus_property(self, value=None):
1442
if value is None: # get
1443
return dbus.Boolean(self.approved_by_default)
1444
self.approved_by_default = bool(value)
1446
# ApprovalDelay - property
1447
@dbus_service_property(_interface, signature="t",
1449
def ApprovalDelay_dbus_property(self, value=None):
1450
if value is None: # get
1451
return dbus.UInt64(self.approval_delay_milliseconds())
1452
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1454
# ApprovalDuration - property
1455
@dbus_service_property(_interface, signature="t",
1457
def ApprovalDuration_dbus_property(self, value=None):
1458
if value is None: # get
1459
return dbus.UInt64(timedelta_to_milliseconds(
1460
self.approval_duration))
1461
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1464
@dbus_service_property(_interface, signature="s", access="read")
1465
def Name_dbus_property(self):
853
@dbus_service_property(_interface, signature=u"s", access=u"read")
854
def name_dbus_property(self):
1466
855
return dbus.String(self.name)
1468
# Fingerprint - property
1469
@dbus_service_property(_interface, signature="s", access="read")
1470
def Fingerprint_dbus_property(self):
857
# fingerprint - property
858
@dbus_service_property(_interface, signature=u"s", access=u"read")
859
def fingerprint_dbus_property(self):
1471
860
return dbus.String(self.fingerprint)
1474
@dbus_service_property(_interface, signature="s",
1476
def Host_dbus_property(self, value=None):
863
@dbus_service_property(_interface, signature=u"s",
865
def host_dbus_property(self, value=None):
1477
866
if value is None: # get
1478
867
return dbus.String(self.host)
1479
self.host = unicode(value)
1481
# Created - property
1482
@dbus_service_property(_interface, signature="s", access="read")
1483
def Created_dbus_property(self):
1484
return datetime_to_dbus(self.created)
1486
# LastEnabled - property
1487
@dbus_service_property(_interface, signature="s", access="read")
1488
def LastEnabled_dbus_property(self):
1489
return datetime_to_dbus(self.last_enabled)
1491
# Enabled - property
1492
@dbus_service_property(_interface, signature="b",
1494
def Enabled_dbus_property(self, value=None):
870
self.PropertyChanged(dbus.String(u"host"),
871
dbus.String(value, variant_level=1))
874
@dbus_service_property(_interface, signature=u"s", access=u"read")
875
def created_dbus_property(self):
876
return dbus.String(self._datetime_to_dbus(self.created))
878
# last_enabled - property
879
@dbus_service_property(_interface, signature=u"s", access=u"read")
880
def last_enabled_dbus_property(self):
881
if self.last_enabled is None:
882
return dbus.String(u"")
883
return dbus.String(self._datetime_to_dbus(self.last_enabled))
886
@dbus_service_property(_interface, signature=u"b",
888
def enabled_dbus_property(self, value=None):
1495
889
if value is None: # get
1496
890
return dbus.Boolean(self.enabled)
1502
# LastCheckedOK - property
1503
@dbus_service_property(_interface, signature="s",
1505
def LastCheckedOK_dbus_property(self, value=None):
896
# last_checked_ok - property
897
@dbus_service_property(_interface, signature=u"s",
899
def last_checked_ok_dbus_property(self, value=None):
1506
900
if value is not None:
1507
901
self.checked_ok()
1509
return datetime_to_dbus(self.last_checked_ok)
1511
# LastCheckerStatus - property
1512
@dbus_service_property(_interface, signature="n",
1514
def LastCheckerStatus_dbus_property(self):
1515
return dbus.Int16(self.last_checker_status)
1517
# Expires - property
1518
@dbus_service_property(_interface, signature="s", access="read")
1519
def Expires_dbus_property(self):
1520
return datetime_to_dbus(self.expires)
1522
# LastApprovalRequest - property
1523
@dbus_service_property(_interface, signature="s", access="read")
1524
def LastApprovalRequest_dbus_property(self):
1525
return datetime_to_dbus(self.last_approval_request)
1527
# Timeout - property
1528
@dbus_service_property(_interface, signature="t",
1530
def Timeout_dbus_property(self, value=None):
903
if self.last_checked_ok is None:
904
return dbus.String(u"")
905
return dbus.String(self._datetime_to_dbus(self
909
@dbus_service_property(_interface, signature=u"t",
911
def timeout_dbus_property(self, value=None):
1531
912
if value is None: # get
1532
913
return dbus.UInt64(self.timeout_milliseconds())
1533
old_timeout = self.timeout
1534
914
self.timeout = datetime.timedelta(0, 0, 0, value)
1535
# Reschedule disabling
1537
now = datetime.datetime.utcnow()
1538
self.expires += self.timeout - old_timeout
1539
if self.expires <= now:
1540
# The timeout has passed
1543
if (getattr(self, "disable_initiator_tag", None)
1546
gobject.source_remove(self.disable_initiator_tag)
1547
self.disable_initiator_tag = (
1548
gobject.timeout_add(
1549
timedelta_to_milliseconds(self.expires - now),
1552
# ExtendedTimeout - property
1553
@dbus_service_property(_interface, signature="t",
1555
def ExtendedTimeout_dbus_property(self, value=None):
1556
if value is None: # get
1557
return dbus.UInt64(self.extended_timeout_milliseconds())
1558
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1560
# Interval - property
1561
@dbus_service_property(_interface, signature="t",
1563
def Interval_dbus_property(self, value=None):
916
self.PropertyChanged(dbus.String(u"timeout"),
917
dbus.UInt64(value, variant_level=1))
918
if getattr(self, u"disable_initiator_tag", None) is None:
921
gobject.source_remove(self.disable_initiator_tag)
922
self.disable_initiator_tag = None
924
_timedelta_to_milliseconds((self
930
# The timeout has passed
933
self.disable_initiator_tag = (gobject.timeout_add
934
(time_to_die, self.disable))
936
# interval - property
937
@dbus_service_property(_interface, signature=u"t",
939
def interval_dbus_property(self, value=None):
1564
940
if value is None: # get
1565
941
return dbus.UInt64(self.interval_milliseconds())
1566
942
self.interval = datetime.timedelta(0, 0, 0, value)
1567
if getattr(self, "checker_initiator_tag", None) is None:
944
self.PropertyChanged(dbus.String(u"interval"),
945
dbus.UInt64(value, variant_level=1))
946
if getattr(self, u"checker_initiator_tag", None) is None:
1570
# Reschedule checker run
1571
gobject.source_remove(self.checker_initiator_tag)
1572
self.checker_initiator_tag = (gobject.timeout_add
1573
(value, self.start_checker))
1574
self.start_checker() # Start one now, too
1576
# Checker - property
1577
@dbus_service_property(_interface, signature="s",
1579
def Checker_dbus_property(self, value=None):
948
# Reschedule checker run
949
gobject.source_remove(self.checker_initiator_tag)
950
self.checker_initiator_tag = (gobject.timeout_add
951
(value, self.start_checker))
952
self.start_checker() # Start one now, too
955
@dbus_service_property(_interface, signature=u"s",
957
def checker_dbus_property(self, value=None):
1580
958
if value is None: # get
1581
959
return dbus.String(self.checker_command)
1582
self.checker_command = unicode(value)
960
self.checker_command = value
962
self.PropertyChanged(dbus.String(u"checker"),
963
dbus.String(self.checker_command,
1584
# CheckerRunning - property
1585
@dbus_service_property(_interface, signature="b",
1587
def CheckerRunning_dbus_property(self, value=None):
966
# checker_running - property
967
@dbus_service_property(_interface, signature=u"b",
969
def checker_running_dbus_property(self, value=None):
1588
970
if value is None: # get
1589
971
return dbus.Boolean(self.checker is not None)
1670
1028
# Start communication using the Mandos protocol
1671
1029
# Get protocol number
1672
1030
line = self.request.makefile().readline()
1673
logger.debug("Protocol version: %r", line)
1031
logger.debug(u"Protocol version: %r", line)
1675
1033
if int(line.strip().split()[0]) > 1:
1676
1034
raise RuntimeError
1677
except (ValueError, IndexError, RuntimeError) as error:
1678
logger.error("Unknown protocol version: %s", error)
1035
except (ValueError, IndexError, RuntimeError), error:
1036
logger.error(u"Unknown protocol version: %s", error)
1681
1039
# Start GnuTLS connection
1683
1041
session.handshake()
1684
except gnutls.errors.GNUTLSError as error:
1685
logger.warning("Handshake failed: %s", error)
1042
except gnutls.errors.GNUTLSError, error:
1043
logger.warning(u"Handshake failed: %s", error)
1686
1044
# Do not run session.bye() here: the session is not
1687
1045
# established. Just abandon the request.
1689
logger.debug("Handshake succeeded")
1691
approval_required = False
1047
logger.debug(u"Handshake succeeded")
1694
1050
fpr = self.fingerprint(self.peer_certificate
1697
gnutls.errors.GNUTLSError) as error:
1698
logger.warning("Bad certificate: %s", error)
1700
logger.debug("Fingerprint: %s", fpr)
1703
client = ProxyClient(child_pipe, fpr,
1704
self.client_address)
1708
if client.approval_delay:
1709
delay = client.approval_delay
1710
client.approvals_pending += 1
1711
approval_required = True
1714
if not client.enabled:
1715
logger.info("Client %s is disabled",
1717
if self.server.use_dbus:
1719
client.Rejected("Disabled")
1722
if client.approved or not client.approval_delay:
1723
#We are approved or approval is disabled
1052
except (TypeError, gnutls.errors.GNUTLSError), error:
1053
logger.warning(u"Bad certificate: %s", error)
1055
logger.debug(u"Fingerprint: %s", fpr)
1057
for c in self.server.clients:
1058
if c.fingerprint == fpr:
1725
elif client.approved is None:
1726
logger.info("Client %s needs approval",
1728
if self.server.use_dbus:
1730
client.NeedApproval(
1731
client.approval_delay_milliseconds(),
1732
client.approved_by_default)
1734
logger.warning("Client %s was not approved",
1736
if self.server.use_dbus:
1738
client.Rejected("Denied")
1741
#wait until timeout or approved
1742
time = datetime.datetime.now()
1743
client.changedstate.acquire()
1744
client.changedstate.wait(
1745
float(timedelta_to_milliseconds(delay)
1747
client.changedstate.release()
1748
time2 = datetime.datetime.now()
1749
if (time2 - time) >= delay:
1750
if not client.approved_by_default:
1751
logger.warning("Client %s timed out while"
1752
" waiting for approval",
1754
if self.server.use_dbus:
1756
client.Rejected("Approval timed out")
1761
delay -= time2 - time
1062
ipc.write(u"NOTFOUND %s %s\n"
1063
% (fpr, unicode(self.client_address)))
1066
class ClientProxy(object):
1067
"""Client proxy object. Not for calling methods."""
1068
def __init__(self, client):
1069
self.client = client
1070
def __getattr__(self, name):
1071
if name.startswith("ipc_"):
1073
ipc.write("%s %s\n" % (name[4:].upper(),
1076
if not hasattr(self.client, name):
1077
raise AttributeError
1078
ipc.write(u"GETATTR %s %s\n"
1079
% (name, self.client.fingerprint))
1080
return pickle.load(ipc_return)
1081
clientproxy = ClientProxy(client)
1082
# Have to check if client.enabled, since it is
1083
# possible that the client was disabled since the
1084
# GnuTLS session was established.
1085
if not clientproxy.enabled:
1086
clientproxy.ipc_disabled()
1089
clientproxy.ipc_sending()
1764
1091
while sent_size < len(client.secret):
1766
sent = session.send(client.secret[sent_size:])
1767
except gnutls.errors.GNUTLSError as error:
1768
logger.warning("gnutls send failed",
1771
logger.debug("Sent: %d, remaining: %d",
1092
sent = session.send(client.secret[sent_size:])
1093
logger.debug(u"Sent: %d, remaining: %d",
1772
1094
sent, len(client.secret)
1773
1095
- (sent_size + sent))
1774
1096
sent_size += sent
1776
logger.info("Sending secret to %s", client.name)
1777
# bump the timeout using extended_timeout
1778
client.bump_timeout(client.extended_timeout)
1779
if self.server.use_dbus:
1784
if approval_required:
1785
client.approvals_pending -= 1
1788
except gnutls.errors.GNUTLSError as error:
1789
logger.warning("GnuTLS bye failed",
1793
1101
def peer_certificate(session):
1899
1194
use_ipv6: Boolean; to use IPv6 or not
1901
1196
def __init__(self, server_address, RequestHandlerClass,
1902
interface=None, use_ipv6=True, socketfd=None):
1903
"""If socketfd is set, use that file descriptor instead of
1904
creating a new one with socket.socket().
1197
interface=None, use_ipv6=True):
1906
1198
self.interface = interface
1908
1200
self.address_family = socket.AF_INET6
1909
if socketfd is not None:
1910
# Save the file descriptor
1911
self.socketfd = socketfd
1912
# Save the original socket.socket() function
1913
self.socket_socket = socket.socket
1914
# To implement --socket, we monkey patch socket.socket.
1916
# (When socketserver.TCPServer is a new-style class, we
1917
# could make self.socket into a property instead of monkey
1918
# patching socket.socket.)
1920
# Create a one-time-only replacement for socket.socket()
1921
@functools.wraps(socket.socket)
1922
def socket_wrapper(*args, **kwargs):
1923
# Restore original function so subsequent calls are
1925
socket.socket = self.socket_socket
1926
del self.socket_socket
1927
# This time only, return a new socket object from the
1928
# saved file descriptor.
1929
return socket.fromfd(self.socketfd, *args, **kwargs)
1930
# Replace socket.socket() function with wrapper
1931
socket.socket = socket_wrapper
1932
# The socketserver.TCPServer.__init__ will call
1933
# socket.socket(), which might be our replacement,
1934
# socket_wrapper(), if socketfd was set.
1935
1201
socketserver.TCPServer.__init__(self, server_address,
1936
1202
RequestHandlerClass)
1938
1203
def server_bind(self):
1939
1204
"""This overrides the normal server_bind() function
1940
1205
to bind to an interface if one was specified, and also NOT to
1941
1206
bind to an address or port if they were not specified."""
1942
1207
if self.interface is not None:
1943
1208
if SO_BINDTODEVICE is None:
1944
logger.error("SO_BINDTODEVICE does not exist;"
1945
" cannot bind to interface %s",
1209
logger.error(u"SO_BINDTODEVICE does not exist;"
1210
u" cannot bind to interface %s",
1946
1211
self.interface)
1949
1214
self.socket.setsockopt(socket.SOL_SOCKET,
1950
1215
SO_BINDTODEVICE,
1951
str(self.interface + '\0'))
1952
except socket.error as error:
1953
if error.errno == errno.EPERM:
1954
logger.error("No permission to bind to"
1955
" interface %s", self.interface)
1956
elif error.errno == errno.ENOPROTOOPT:
1957
logger.error("SO_BINDTODEVICE not available;"
1958
" cannot bind to interface %s",
1960
elif error.errno == errno.ENODEV:
1961
logger.error("Interface %s does not exist,"
1962
" cannot bind", self.interface)
1218
except socket.error, error:
1219
if error[0] == errno.EPERM:
1220
logger.error(u"No permission to"
1221
u" bind to interface %s",
1223
elif error[0] == errno.ENOPROTOOPT:
1224
logger.error(u"SO_BINDTODEVICE not available;"
1225
u" cannot bind to interface %s",
1965
1229
# Only bind(2) the socket if we really need to.
1966
1230
if self.server_address[0] or self.server_address[1]:
1967
1231
if not self.server_address[0]:
1968
1232
if self.address_family == socket.AF_INET6:
1969
any_address = "::" # in6addr_any
1233
any_address = u"::" # in6addr_any
1971
1235
any_address = socket.INADDR_ANY
1972
1236
self.server_address = (any_address,
1996
1260
def __init__(self, server_address, RequestHandlerClass,
1997
1261
interface=None, use_ipv6=True, clients=None,
1998
gnutls_priority=None, use_dbus=True, socketfd=None):
1262
gnutls_priority=None, use_dbus=True):
1999
1263
self.enabled = False
2000
1264
self.clients = clients
2001
1265
if self.clients is None:
1266
self.clients = set()
2003
1267
self.use_dbus = use_dbus
2004
1268
self.gnutls_priority = gnutls_priority
2005
1269
IPv6_TCPServer.__init__(self, server_address,
2006
1270
RequestHandlerClass,
2007
1271
interface = interface,
2008
use_ipv6 = use_ipv6,
2009
socketfd = socketfd)
1272
use_ipv6 = use_ipv6)
2010
1273
def server_activate(self):
2011
1274
if self.enabled:
2012
1275
return socketserver.TCPServer.server_activate(self)
2014
1276
def enable(self):
2015
1277
self.enabled = True
2017
def add_pipe(self, parent_pipe, proc):
1278
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
2018
1279
# Call "handle_ipc" for both data and EOF events
2019
gobject.io_add_watch(parent_pipe.fileno(),
1280
gobject.io_add_watch(child_pipe_fd.fileno(),
2020
1281
gobject.IO_IN | gobject.IO_HUP,
2021
1282
functools.partial(self.handle_ipc,
2026
def handle_ipc(self, source, condition, parent_pipe=None,
2027
proc = None, client_object=None):
2028
# error, or the other end of multiprocessing.Pipe has closed
2029
if condition & (gobject.IO_ERR | gobject.IO_HUP):
2030
# Wait for other process to exit
2034
# Read a request from the child
2035
request = parent_pipe.recv()
2036
command = request[0]
2038
if command == 'init':
2040
address = request[2]
2042
for c in self.clients.itervalues():
2043
if c.fingerprint == fpr:
2047
logger.info("Client not found for fingerprint: %s, ad"
2048
"dress: %s", fpr, address)
2051
mandos_dbus_service.ClientNotFound(fpr,
2053
parent_pipe.send(False)
2056
gobject.io_add_watch(parent_pipe.fileno(),
2057
gobject.IO_IN | gobject.IO_HUP,
2058
functools.partial(self.handle_ipc,
2064
parent_pipe.send(True)
2065
# remove the old hook in favor of the new above hook on
2068
if command == 'funcall':
2069
funcname = request[1]
2073
parent_pipe.send(('data', getattr(client_object,
2077
if command == 'getattr':
2078
attrname = request[1]
2079
if callable(client_object.__getattribute__(attrname)):
2080
parent_pipe.send(('function',))
2082
parent_pipe.send(('data', client_object
2083
.__getattribute__(attrname)))
2085
if command == 'setattr':
2086
attrname = request[1]
2088
setattr(client_object, attrname, value)
1283
reply = parent_pipe_fd,
1284
sender= child_pipe_fd))
1285
def handle_ipc(self, source, condition, reply=None, sender=None):
1287
gobject.IO_IN: u"IN", # There is data to read.
1288
gobject.IO_OUT: u"OUT", # Data can be written (without
1290
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1291
gobject.IO_ERR: u"ERR", # Error condition.
1292
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1293
# broken, usually for pipes and
1296
conditions_string = ' | '.join(name
1298
condition_names.iteritems()
1299
if cond & condition)
1300
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1303
# Read a line from the file object
1304
cmdline = sender.readline()
1305
if not cmdline: # Empty line means end of file
1306
# close the IPC pipes
1310
# Stop calling this function
1313
logger.debug(u"IPC command: %r", cmdline)
1315
# Parse and act on command
1316
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1318
if cmd == u"NOTFOUND":
1319
fpr, address = args.split(None, 1)
1320
logger.warning(u"Client not found for fingerprint: %s, ad"
1321
u"dress: %s", fpr, address)
1324
mandos_dbus_service.ClientNotFound(fpr, address)
1325
elif cmd == u"DISABLED":
1326
for client in self.clients:
1327
if client.name == args:
1328
logger.warning(u"Client %s is disabled", args)
1334
logger.error(u"Unknown client %s is disabled", args)
1335
elif cmd == u"SENDING":
1336
for client in self.clients:
1337
if client.name == args:
1338
logger.info(u"Sending secret to %s", client.name)
1345
logger.error(u"Sending secret to unknown client %s",
1347
elif cmd == u"GETATTR":
1348
attr_name, fpr = args.split(None, 1)
1349
for client in self.clients:
1350
if client.fingerprint == fpr:
1351
attr_value = getattr(client, attr_name, None)
1352
logger.debug("IPC reply: %r", attr_value)
1353
pickle.dump(attr_value, reply)
1356
logger.error(u"Client %s on address %s requesting "
1357
u"attribute %s not found", fpr, address,
1359
pickle.dump(None, reply)
1361
logger.error(u"Unknown IPC command: %r", cmdline)
1363
# Keep calling this function
2093
1367
def string_to_delta(interval):
2094
1368
"""Parse a string and return a datetime.timedelta
2096
>>> string_to_delta('7d')
1370
>>> string_to_delta(u'7d')
2097
1371
datetime.timedelta(7)
2098
>>> string_to_delta('60s')
1372
>>> string_to_delta(u'60s')
2099
1373
datetime.timedelta(0, 60)
2100
>>> string_to_delta('60m')
1374
>>> string_to_delta(u'60m')
2101
1375
datetime.timedelta(0, 3600)
2102
>>> string_to_delta('24h')
1376
>>> string_to_delta(u'24h')
2103
1377
datetime.timedelta(1)
2104
>>> string_to_delta('1w')
1378
>>> string_to_delta(u'1w')
2105
1379
datetime.timedelta(7)
2106
>>> string_to_delta('5m 30s')
1380
>>> string_to_delta(u'5m 30s')
2107
1381
datetime.timedelta(0, 330)
2109
1383
timevalue = datetime.timedelta(0)
2160
1457
##################################################################
2161
1458
# Parsing of options, both command line and config file
2163
parser = argparse.ArgumentParser()
2164
parser.add_argument("-v", "--version", action="version",
2165
version = "%(prog)s {0}".format(version),
2166
help="show version number and exit")
2167
parser.add_argument("-i", "--interface", metavar="IF",
2168
help="Bind to interface IF")
2169
parser.add_argument("-a", "--address",
2170
help="Address to listen for requests on")
2171
parser.add_argument("-p", "--port", type=int,
2172
help="Port number to receive requests on")
2173
parser.add_argument("--check", action="store_true",
2174
help="Run self-test")
2175
parser.add_argument("--debug", action="store_true",
2176
help="Debug mode; run in foreground and log"
2178
parser.add_argument("--debuglevel", metavar="LEVEL",
2179
help="Debug level for stdout output")
2180
parser.add_argument("--priority", help="GnuTLS"
2181
" priority string (see GnuTLS documentation)")
2182
parser.add_argument("--servicename",
2183
metavar="NAME", help="Zeroconf service name")
2184
parser.add_argument("--configdir",
2185
default="/etc/mandos", metavar="DIR",
2186
help="Directory to search for configuration"
2188
parser.add_argument("--no-dbus", action="store_false",
2189
dest="use_dbus", help="Do not provide D-Bus"
2190
" system bus interface")
2191
parser.add_argument("--no-ipv6", action="store_false",
2192
dest="use_ipv6", help="Do not use IPv6")
2193
parser.add_argument("--no-restore", action="store_false",
2194
dest="restore", help="Do not restore stored"
2196
parser.add_argument("--socket", type=int,
2197
help="Specify a file descriptor to a network"
2198
" socket to use instead of creating one")
2199
parser.add_argument("--statedir", metavar="DIR",
2200
help="Directory to save/restore state in")
2201
parser.add_argument("--foreground", action="store_true",
2202
help="Run in foreground")
2204
options = parser.parse_args()
1460
parser = optparse.OptionParser(version = "%%prog %s" % version)
1461
parser.add_option("-i", u"--interface", type=u"string",
1462
metavar="IF", help=u"Bind to interface IF")
1463
parser.add_option("-a", u"--address", type=u"string",
1464
help=u"Address to listen for requests on")
1465
parser.add_option("-p", u"--port", type=u"int",
1466
help=u"Port number to receive requests on")
1467
parser.add_option("--check", action=u"store_true",
1468
help=u"Run self-test")
1469
parser.add_option("--debug", action=u"store_true",
1470
help=u"Debug mode; run in foreground and log to"
1472
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1473
u" priority string (see GnuTLS documentation)")
1474
parser.add_option("--servicename", type=u"string",
1475
metavar=u"NAME", help=u"Zeroconf service name")
1476
parser.add_option("--configdir", type=u"string",
1477
default=u"/etc/mandos", metavar=u"DIR",
1478
help=u"Directory to search for configuration"
1480
parser.add_option("--no-dbus", action=u"store_false",
1481
dest=u"use_dbus", help=u"Do not provide D-Bus"
1482
u" system bus interface")
1483
parser.add_option("--no-ipv6", action=u"store_false",
1484
dest=u"use_ipv6", help=u"Do not use IPv6")
1485
options = parser.parse_args()[0]
2206
1487
if options.check:
2264
1530
for option in server_settings.keys():
2265
1531
if type(server_settings[option]) is str:
2266
1532
server_settings[option] = unicode(server_settings[option])
2267
# Debug implies foreground
2268
if server_settings["debug"]:
2269
server_settings["foreground"] = True
2270
1533
# Now we have our good server settings in "server_settings"
2272
1535
##################################################################
2274
1537
# For convenience
2275
debug = server_settings["debug"]
2276
debuglevel = server_settings["debuglevel"]
2277
use_dbus = server_settings["use_dbus"]
2278
use_ipv6 = server_settings["use_ipv6"]
2279
stored_state_path = os.path.join(server_settings["statedir"],
2281
foreground = server_settings["foreground"]
2284
initlogger(debug, logging.DEBUG)
2289
level = getattr(logging, debuglevel.upper())
2290
initlogger(debug, level)
2292
if server_settings["servicename"] != "Mandos":
1538
debug = server_settings[u"debug"]
1539
use_dbus = server_settings[u"use_dbus"]
1540
use_ipv6 = server_settings[u"use_ipv6"]
1543
syslogger.setLevel(logging.WARNING)
1544
console.setLevel(logging.WARNING)
1546
if server_settings[u"servicename"] != u"Mandos":
2293
1547
syslogger.setFormatter(logging.Formatter
2294
('Mandos ({0}) [%(process)d]:'
2295
' %(levelname)s: %(message)s'
2296
.format(server_settings
1548
(u'Mandos (%s) [%%(process)d]:'
1549
u' %%(levelname)s: %%(message)s'
1550
% server_settings[u"servicename"]))
2299
1552
# Parse config file with clients
2300
client_config = configparser.SafeConfigParser(Client
2302
client_config.read(os.path.join(server_settings["configdir"],
1553
client_defaults = { u"timeout": u"1h",
1555
u"checker": u"fping -q -- %%(host)s",
1558
client_config = configparser.SafeConfigParser(client_defaults)
1559
client_config.read(os.path.join(server_settings[u"configdir"],
2305
1562
global mandos_dbus_service
2306
1563
mandos_dbus_service = None
2308
tcp_server = MandosServer((server_settings["address"],
2309
server_settings["port"]),
1565
tcp_server = MandosServer((server_settings[u"address"],
1566
server_settings[u"port"]),
2311
interface=(server_settings["interface"]
1568
interface=server_settings[u"interface"],
2313
1569
use_ipv6=use_ipv6,
2314
1570
gnutls_priority=
2315
server_settings["priority"],
2317
socketfd=(server_settings["socket"]
2320
pidfilename = "/var/run/mandos.pid"
2323
pidfile = open(pidfilename, "w")
2324
except IOError as e:
2325
logger.error("Could not open file %r", pidfilename,
1571
server_settings[u"priority"],
1573
pidfilename = u"/var/run/mandos.pid"
1575
pidfile = open(pidfilename, u"w")
1577
logger.error(u"Could not open file %r", pidfilename)
2328
for name in ("_mandos", "mandos", "nobody"):
1580
uid = pwd.getpwnam(u"_mandos").pw_uid
1581
gid = pwd.getpwnam(u"_mandos").pw_gid
2330
uid = pwd.getpwnam(name).pw_uid
2331
gid = pwd.getpwnam(name).pw_gid
1584
uid = pwd.getpwnam(u"mandos").pw_uid
1585
gid = pwd.getpwnam(u"mandos").pw_gid
2333
1586
except KeyError:
1588
uid = pwd.getpwnam(u"nobody").pw_uid
1589
gid = pwd.getpwnam(u"nobody").pw_gid
2341
except OSError as error:
2342
if error.errno != errno.EPERM:
1596
except OSError, error:
1597
if error[0] != errno.EPERM:
1600
# Enable all possible GnuTLS debugging
2346
# Enable all possible GnuTLS debugging
2348
1602
# "Use a log level over 10 to enable all debugging options."
2349
1603
# - GnuTLS manual
2350
1604
gnutls.library.functions.gnutls_global_set_log_level(11)
2352
1606
@gnutls.library.types.gnutls_log_func
2353
1607
def debug_gnutls(level, string):
2354
logger.debug("GnuTLS: %s", string[:-1])
1608
logger.debug(u"GnuTLS: %s", string[:-1])
2356
1610
(gnutls.library.functions
2357
1611
.gnutls_global_set_log_function(debug_gnutls))
2359
# Redirect stdin so all checkers get /dev/null
2360
null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
2361
os.dup2(null, sys.stdin.fileno())
2365
# Need to fork before connecting to D-Bus
2367
# Close all input and output, do double fork, etc.
2370
# multiprocessing will use threads, so before we use gobject we
2371
# need to inform gobject that threads will be used.
2372
gobject.threads_init()
2374
1613
global main_loop
2375
1614
# From the Avahi example code
2376
DBusGMainLoop(set_as_default=True)
1615
DBusGMainLoop(set_as_default=True )
2377
1616
main_loop = gobject.MainLoop()
2378
1617
bus = dbus.SystemBus()
2379
1618
# End of Avahi example code
2382
bus_name = dbus.service.BusName("se.recompile.Mandos",
1621
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
2383
1622
bus, do_not_queue=True)
2384
old_bus_name = (dbus.service.BusName
2385
("se.bsnet.fukt.Mandos", bus,
2387
except dbus.exceptions.NameExistsException as e:
2388
logger.error("Disabling D-Bus:", exc_info=e)
1623
except dbus.exceptions.NameExistsException, e:
1624
logger.error(unicode(e) + u", disabling D-Bus")
2389
1625
use_dbus = False
2390
server_settings["use_dbus"] = False
1626
server_settings[u"use_dbus"] = False
2391
1627
tcp_server.use_dbus = False
2392
1628
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2393
service = AvahiServiceToSyslog(name =
2394
server_settings["servicename"],
2395
servicetype = "_mandos._tcp",
2396
protocol = protocol, bus = bus)
1629
service = AvahiService(name = server_settings[u"servicename"],
1630
servicetype = u"_mandos._tcp",
1631
protocol = protocol, bus = bus)
2397
1632
if server_settings["interface"]:
2398
1633
service.interface = (if_nametoindex
2399
(str(server_settings["interface"])))
2401
global multiprocessing_manager
2402
multiprocessing_manager = multiprocessing.Manager()
1634
(str(server_settings[u"interface"])))
2404
1636
client_class = Client
2406
1638
client_class = functools.partial(ClientDBus, bus = bus)
2408
client_settings = Client.config_parser(client_config)
2409
old_client_settings = {}
2412
# Get client data and settings from last running state.
2413
if server_settings["restore"]:
2415
with open(stored_state_path, "rb") as stored_state:
2416
clients_data, old_client_settings = (pickle.load
2418
os.remove(stored_state_path)
2419
except IOError as e:
2420
if e.errno == errno.ENOENT:
2421
logger.warning("Could not load persistent state: {0}"
2422
.format(os.strerror(e.errno)))
2424
logger.critical("Could not load persistent state:",
2427
except EOFError as e:
2428
logger.warning("Could not load persistent state: "
2429
"EOFError:", exc_info=e)
2431
with PGPEngine() as pgp:
2432
for client_name, client in clients_data.iteritems():
2433
# Decide which value to use after restoring saved state.
2434
# We have three different values: Old config file,
2435
# new config file, and saved state.
2436
# New config value takes precedence if it differs from old
2437
# config value, otherwise use saved state.
2438
for name, value in client_settings[client_name].items():
2440
# For each value in new config, check if it
2441
# differs from the old config value (Except for
2442
# the "secret" attribute)
2443
if (name != "secret" and
2444
value != old_client_settings[client_name]
2446
client[name] = value
2450
# Clients who has passed its expire date can still be
2451
# enabled if its last checker was successful. Clients
2452
# whose checker succeeded before we stored its state is
2453
# assumed to have successfully run all checkers during
2455
if client["enabled"]:
2456
if datetime.datetime.utcnow() >= client["expires"]:
2457
if not client["last_checked_ok"]:
2459
"disabling client {0} - Client never "
2460
"performed a successful checker"
2461
.format(client_name))
2462
client["enabled"] = False
2463
elif client["last_checker_status"] != 0:
2465
"disabling client {0} - Client "
2466
"last checker failed with error code {1}"
2467
.format(client_name,
2468
client["last_checker_status"]))
2469
client["enabled"] = False
2471
client["expires"] = (datetime.datetime
2473
+ client["timeout"])
2474
logger.debug("Last checker succeeded,"
2475
" keeping {0} enabled"
2476
.format(client_name))
2478
client["secret"] = (
2479
pgp.decrypt(client["encrypted_secret"],
2480
client_settings[client_name]
2483
# If decryption fails, we use secret from new settings
2484
logger.debug("Failed to decrypt {0} old secret"
2485
.format(client_name))
2486
client["secret"] = (
2487
client_settings[client_name]["secret"])
2489
# Add/remove clients based on new changes made to config
2490
for client_name in (set(old_client_settings)
2491
- set(client_settings)):
2492
del clients_data[client_name]
2493
for client_name in (set(client_settings)
2494
- set(old_client_settings)):
2495
clients_data[client_name] = client_settings[client_name]
2497
# Create all client objects
2498
for client_name, client in clients_data.iteritems():
2499
tcp_server.clients[client_name] = client_class(
2500
name = client_name, settings = client)
1639
tcp_server.clients.update(set(
1640
client_class(name = section,
1641
config= dict(client_config.items(section)))
1642
for section in client_config.sections()))
2502
1643
if not tcp_server.clients:
2503
logger.warning("No clients defined")
2506
if pidfile is not None:
2510
pidfile.write(str(pid) + "\n".encode("utf-8"))
2512
logger.error("Could not write to file %r with PID %d",
1644
logger.warning(u"No clients defined")
1647
# Redirect stdin so all checkers get /dev/null
1648
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1649
os.dup2(null, sys.stdin.fileno())
1653
# No console logging
1654
logger.removeHandler(console)
1655
# Close all input and output, do double fork, etc.
1661
pidfile.write(str(pid) + "\n")
1664
logger.error(u"Could not write to file %r with PID %d",
1667
# "pidfile" was never created
1672
signal.signal(signal.SIGINT, signal.SIG_IGN)
2517
1673
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2518
1674
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2521
@alternate_dbus_interfaces({"se.recompile.Mandos":
2522
"se.bsnet.fukt.Mandos"})
2523
class MandosDBusService(DBusObjectWithProperties):
1677
class MandosDBusService(dbus.service.Object):
2524
1678
"""A D-Bus proxy object"""
2525
1679
def __init__(self):
2526
dbus.service.Object.__init__(self, bus, "/")
2527
_interface = "se.recompile.Mandos"
2529
@dbus_interface_annotations(_interface)
2531
return { "org.freedesktop.DBus.Property"
2532
".EmitsChangedSignal":
2535
@dbus.service.signal(_interface, signature="o")
1680
dbus.service.Object.__init__(self, bus, u"/")
1681
_interface = u"se.bsnet.fukt.Mandos"
1683
@dbus.service.signal(_interface, signature=u"o")
2536
1684
def ClientAdded(self, objpath):
2540
@dbus.service.signal(_interface, signature="ss")
1688
@dbus.service.signal(_interface, signature=u"ss")
2541
1689
def ClientNotFound(self, fingerprint, address):
2545
@dbus.service.signal(_interface, signature="os")
1693
@dbus.service.signal(_interface, signature=u"os")
2546
1694
def ClientRemoved(self, objpath, name):
2550
@dbus.service.method(_interface, out_signature="ao")
1698
@dbus.service.method(_interface, out_signature=u"ao")
2551
1699
def GetAllClients(self):
2553
1701
return dbus.Array(c.dbus_object_path
2555
tcp_server.clients.itervalues())
1702
for c in tcp_server.clients)
2557
1704
@dbus.service.method(_interface,
2558
out_signature="a{oa{sv}}")
1705
out_signature=u"a{oa{sv}}")
2559
1706
def GetAllClientsWithProperties(self):
2561
1708
return dbus.Dictionary(
2562
((c.dbus_object_path, c.GetAll(""))
2563
for c in tcp_server.clients.itervalues()),
1709
((c.dbus_object_path, c.GetAll(u""))
1710
for c in tcp_server.clients),
1711
signature=u"oa{sv}")
2566
@dbus.service.method(_interface, in_signature="o")
1713
@dbus.service.method(_interface, in_signature=u"o")
2567
1714
def RemoveClient(self, object_path):
2569
for c in tcp_server.clients.itervalues():
1716
for c in tcp_server.clients:
2570
1717
if c.dbus_object_path == object_path:
2571
del tcp_server.clients[c.name]
1718
tcp_server.clients.remove(c)
2572
1719
c.remove_from_connection()
2573
1720
# Don't signal anything except ClientRemoved
2574
1721
c.disable(quiet=True)