To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 419
- compare with another revision
- download diff
- download tarball
- view history from revision 419
- Committer: teddy at bsnet
- Date: 2010-09-09 18:16:14 UTC
- mfrom: (237.2.35 mandos-empty-device)
- Revision ID: teddy@fukt.bsnet.se-20100909181614-oanlmvkzsiodbo3c
Merge in branch to interpret an empty device name to mean
"autodetect".
"autodetect".
- files removed:
- DBUS-API
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
31
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
36
import SocketServer as socketserver
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
61
60
import fcntl
62
61
import functools
63
62
import cPickle as pickle
64
import multiprocessing
65
import types
63
import select
66
64
67
65
import dbus
68
66
import dbus.service
83
81
SO_BINDTODEVICE = None
84
82
85
83
86
version = "1.3.1"
84
version = "1.0.14"
87
85
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
86
logger = logging.Logger(u'mandos')
90
87
syslogger = (logging.handlers.SysLogHandler
91
88
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
address = str("/dev/log")))
89
address = "/dev/log"))
93
90
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
91
(u'Mandos [%(process)d]: %(levelname)s:'
92
u' %(message)s'))
96
93
logger.addHandler(syslogger)
97
94
98
95
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
96
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
97
u' %(levelname)s:'
98
u' %(message)s'))
102
99
logger.addHandler(console)
103
100
104
101
class AvahiError(Exception):
121
118
Attributes:
122
119
interface: integer; avahi.IF_UNSPEC or an interface index.
123
120
Used to optionally bind to the specified interface.
124
name: string; Example: 'Mandos'
125
type: string; Example: '_mandos._tcp'.
121
name: string; Example: u'Mandos'
122
type: string; Example: u'_mandos._tcp'.
126
123
See <http://www.dns-sd.org/ServiceTypes.html>
127
124
port: integer; what port to announce
128
125
TXT: list of strings; TXT record for the service
137
134
"""
138
135
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
139
136
servicetype = None, port = None, TXT = None,
140
domain = "", host = "", max_renames = 32768,
137
domain = u"", host = u"", max_renames = 32768,
141
138
protocol = avahi.PROTO_UNSPEC, bus = None):
142
139
self.interface = interface
143
140
self.name = name
152
149
self.group = None # our entry group
153
150
self.server = None
154
151
self.bus = bus
155
self.entry_group_state_changed_match = None
156
152
def rename(self):
157
153
"""Derived from the Avahi example code"""
158
154
if self.rename_count >= self.max_renames:
159
logger.critical("No suitable Zeroconf service name found"
160
" after %i retries, exiting.",
155
logger.critical(u"No suitable Zeroconf service name found"
156
u" after %i retries, exiting.",
161
157
self.rename_count)
162
raise AvahiServiceError("Too many renames")
163
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
164
logger.info("Changing Zeroconf service name to %r ...",
165
self.name)
158
raise AvahiServiceError(u"Too many renames")
159
self.name = self.server.GetAlternativeServiceName(self.name)
160
logger.info(u"Changing Zeroconf service name to %r ...",
161
unicode(self.name))
166
162
syslogger.setFormatter(logging.Formatter
167
('Mandos (%s) [%%(process)d]:'
168
' %%(levelname)s: %%(message)s'
163
(u'Mandos (%s) [%%(process)d]:'
164
u' %%(levelname)s: %%(message)s'
169
165
% self.name))
170
166
self.remove()
171
try:
172
self.add()
173
except dbus.exceptions.DBusException as error:
174
logger.critical("DBusException: %s", error)
175
self.cleanup()
176
os._exit(1)
167
self.add()
177
168
self.rename_count += 1
178
169
def remove(self):
179
170
"""Derived from the Avahi example code"""
180
if self.entry_group_state_changed_match is not None:
181
self.entry_group_state_changed_match.remove()
182
self.entry_group_state_changed_match = None
183
171
if self.group is not None:
184
172
self.group.Reset()
185
173
def add(self):
186
174
"""Derived from the Avahi example code"""
187
self.remove()
188
175
if self.group is None:
189
176
self.group = dbus.Interface(
190
177
self.bus.get_object(avahi.DBUS_NAME,
191
178
self.server.EntryGroupNew()),
192
179
avahi.DBUS_INTERFACE_ENTRY_GROUP)
193
self.entry_group_state_changed_match = (
194
self.group.connect_to_signal(
195
'StateChanged', self .entry_group_state_changed))
196
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
180
self.group.connect_to_signal('StateChanged',
181
self
182
.entry_group_state_changed)
183
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
197
184
self.name, self.type)
198
185
self.group.AddService(
199
186
self.interface,
206
193
self.group.Commit()
207
194
def entry_group_state_changed(self, state, error):
208
195
"""Derived from the Avahi example code"""
209
logger.debug("Avahi entry group state change: %i", state)
196
logger.debug(u"Avahi entry group state change: %i", state)
210
197
211
198
if state == avahi.ENTRY_GROUP_ESTABLISHED:
212
logger.debug("Zeroconf service established.")
199
logger.debug(u"Zeroconf service established.")
213
200
elif state == avahi.ENTRY_GROUP_COLLISION:
214
logger.info("Zeroconf service name collision.")
201
logger.warning(u"Zeroconf service name collision.")
215
202
self.rename()
216
203
elif state == avahi.ENTRY_GROUP_FAILURE:
217
logger.critical("Avahi: Error in group state changed %s",
204
logger.critical(u"Avahi: Error in group state changed %s",
218
205
unicode(error))
219
raise AvahiGroupError("State changed: %s"
206
raise AvahiGroupError(u"State changed: %s"
220
207
% unicode(error))
221
208
def cleanup(self):
222
209
"""Derived from the Avahi example code"""
223
210
if self.group is not None:
224
try:
225
self.group.Free()
226
except (dbus.exceptions.UnknownMethodException,
227
dbus.exceptions.DBusException) as e:
228
pass
211
self.group.Free()
229
212
self.group = None
230
self.remove()
231
def server_state_changed(self, state, error=None):
213
def server_state_changed(self, state):
232
214
"""Derived from the Avahi example code"""
233
logger.debug("Avahi server state change: %i", state)
234
bad_states = { avahi.SERVER_INVALID:
235
"Zeroconf server invalid",
236
avahi.SERVER_REGISTERING: None,
237
avahi.SERVER_COLLISION:
238
"Zeroconf server name collision",
239
avahi.SERVER_FAILURE:
240
"Zeroconf server failure" }
241
if state in bad_states:
242
if bad_states[state] is not None:
243
if error is None:
244
logger.error(bad_states[state])
245
else:
246
logger.error(bad_states[state] + ": %r", error)
247
self.cleanup()
215
logger.debug(u"Avahi server state change: %i", state)
216
if state == avahi.SERVER_COLLISION:
217
logger.error(u"Zeroconf server name collision")
218
self.remove()
248
219
elif state == avahi.SERVER_RUNNING:
249
220
self.add()
250
else:
251
if error is None:
252
logger.debug("Unknown state: %r", state)
253
else:
254
logger.debug("Unknown state: %r: %r", state, error)
255
221
def activate(self):
256
222
"""Derived from the Avahi example code"""
257
223
if self.server is None:
258
224
self.server = dbus.Interface(
259
225
self.bus.get_object(avahi.DBUS_NAME,
260
avahi.DBUS_PATH_SERVER,
261
follow_name_owner_changes=True),
226
avahi.DBUS_PATH_SERVER),
262
227
avahi.DBUS_INTERFACE_SERVER)
263
self.server.connect_to_signal("StateChanged",
228
self.server.connect_to_signal(u"StateChanged",
264
229
self.server_state_changed)
265
230
self.server_state_changed(self.server.GetState())
266
231
267
232
268
def _timedelta_to_milliseconds(td):
269
"Convert a datetime.timedelta() to milliseconds"
270
return ((td.days * 24 * 60 * 60 * 1000)
271
+ (td.seconds * 1000)
272
+ (td.microseconds // 1000))
273
274
233
class Client(object):
275
234
"""A representation of a client host served by this server.
276
235
277
236
Attributes:
278
_approved: bool(); 'None' if not yet approved/disapproved
279
approval_delay: datetime.timedelta(); Time to wait for approval
280
approval_duration: datetime.timedelta(); Duration of one approval
237
name: string; from the config file, used in log messages and
238
D-Bus identifiers
239
fingerprint: string (40 or 32 hexadecimal digits); used to
240
uniquely identify the client
241
secret: bytestring; sent verbatim (over TLS) to client
242
host: string; available for use by the checker command
243
created: datetime.datetime(); (UTC) object creation
244
last_enabled: datetime.datetime(); (UTC)
245
enabled: bool()
246
last_checked_ok: datetime.datetime(); (UTC) or None
247
timeout: datetime.timedelta(); How long from last_checked_ok
248
until this client is disabled
249
interval: datetime.timedelta(); How often to start a new checker
250
disable_hook: If set, called by disable() as disable_hook(self)
281
251
checker: subprocess.Popen(); a running checker process used
282
252
to see if the client lives.
283
253
'None' if no process is running.
284
checker_callback_tag: a gobject event source tag, or None
285
checker_command: string; External command which is run to check
286
if client lives. %() expansions are done at
254
checker_initiator_tag: a gobject event source tag, or None
255
disable_initiator_tag: - '' -
256
checker_callback_tag: - '' -
257
checker_command: string; External command which is run to check if
258
client lives. %() expansions are done at
287
259
runtime with vars(self) as dict, so that for
288
260
instance %(name)s can be used in the command.
289
checker_initiator_tag: a gobject event source tag, or None
290
created: datetime.datetime(); (UTC) object creation
291
261
current_checker_command: string; current running checker_command
292
disable_hook: If set, called by disable() as disable_hook(self)
293
disable_initiator_tag: a gobject event source tag, or None
294
enabled: bool()
295
fingerprint: string (40 or 32 hexadecimal digits); used to
296
uniquely identify the client
297
host: string; available for use by the checker command
298
interval: datetime.timedelta(); How often to start a new checker
299
last_approval_request: datetime.datetime(); (UTC) or None
300
last_checked_ok: datetime.datetime(); (UTC) or None
301
last_enabled: datetime.datetime(); (UTC)
302
name: string; from the config file, used in log messages and
303
D-Bus identifiers
304
secret: bytestring; sent verbatim (over TLS) to client
305
timeout: datetime.timedelta(); How long from last_checked_ok
306
until this client is disabled
307
extended_timeout: extra long timeout when password has been sent
308
runtime_expansions: Allowed attributes for runtime expansion.
309
expires: datetime.datetime(); time (UTC) when a client will be
310
disabled, or None
311
262
"""
312
263
313
runtime_expansions = ("approval_delay", "approval_duration",
314
"created", "enabled", "fingerprint",
315
"host", "interval", "last_checked_ok",
316
"last_enabled", "name", "timeout")
264
@staticmethod
265
def _timedelta_to_milliseconds(td):
266
"Convert a datetime.timedelta() to milliseconds"
267
return ((td.days * 24 * 60 * 60 * 1000)
268
+ (td.seconds * 1000)
269
+ (td.microseconds // 1000))
317
270
318
271
def timeout_milliseconds(self):
319
272
"Return the 'timeout' attribute in milliseconds"
320
return _timedelta_to_milliseconds(self.timeout)
321
322
def extended_timeout_milliseconds(self):
323
"Return the 'extended_timeout' attribute in milliseconds"
324
return _timedelta_to_milliseconds(self.extended_timeout)
273
return self._timedelta_to_milliseconds(self.timeout)
325
274
326
275
def interval_milliseconds(self):
327
276
"Return the 'interval' attribute in milliseconds"
328
return _timedelta_to_milliseconds(self.interval)
329
330
def approval_delay_milliseconds(self):
331
return _timedelta_to_milliseconds(self.approval_delay)
277
return self._timedelta_to_milliseconds(self.interval)
332
278
333
279
def __init__(self, name = None, disable_hook=None, config=None):
334
280
"""Note: the 'checker' key in 'config' sets the
337
283
self.name = name
338
284
if config is None:
339
285
config = {}
340
logger.debug("Creating client %r", self.name)
286
logger.debug(u"Creating client %r", self.name)
341
287
# Uppercase and remove spaces from fingerprint for later
342
288
# comparison purposes with return value from the fingerprint()
343
289
# function
344
self.fingerprint = (config["fingerprint"].upper()
345
.replace(" ", ""))
346
logger.debug(" Fingerprint: %s", self.fingerprint)
347
if "secret" in config:
348
self.secret = config["secret"].decode("base64")
349
elif "secfile" in config:
290
self.fingerprint = (config[u"fingerprint"].upper()
291
.replace(u" ", u""))
292
logger.debug(u" Fingerprint: %s", self.fingerprint)
293
if u"secret" in config:
294
self.secret = config[u"secret"].decode(u"base64")
295
elif u"secfile" in config:
350
296
with open(os.path.expanduser(os.path.expandvars
351
(config["secfile"])),
297
(config[u"secfile"])),
352
298
"rb") as secfile:
353
299
self.secret = secfile.read()
354
300
else:
355
raise TypeError("No secret or secfile for client %s"
301
raise TypeError(u"No secret or secfile for client %s"
356
302
% self.name)
357
self.host = config.get("host", "")
303
self.host = config.get(u"host", u"")
358
304
self.created = datetime.datetime.utcnow()
359
305
self.enabled = False
360
self.last_approval_request = None
361
306
self.last_enabled = None
362
307
self.last_checked_ok = None
363
self.timeout = string_to_delta(config["timeout"])
364
self.extended_timeout = string_to_delta(config["extended_timeout"])
365
self.interval = string_to_delta(config["interval"])
308
self.timeout = string_to_delta(config[u"timeout"])
309
self.interval = string_to_delta(config[u"interval"])
366
310
self.disable_hook = disable_hook
367
311
self.checker = None
368
312
self.checker_initiator_tag = None
369
313
self.disable_initiator_tag = None
370
self.expires = None
371
314
self.checker_callback_tag = None
372
self.checker_command = config["checker"]
315
self.checker_command = config[u"checker"]
373
316
self.current_checker_command = None
374
317
self.last_connect = None
375
self._approved = None
376
self.approved_by_default = config.get("approved_by_default",
377
True)
378
self.approvals_pending = 0
379
self.approval_delay = string_to_delta(
380
config["approval_delay"])
381
self.approval_duration = string_to_delta(
382
config["approval_duration"])
383
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
384
318
385
def send_changedstate(self):
386
self.changedstate.acquire()
387
self.changedstate.notify_all()
388
self.changedstate.release()
389
390
319
def enable(self):
391
320
"""Start this client's checker and timeout hooks"""
392
if getattr(self, "enabled", False):
321
if getattr(self, u"enabled", False):
393
322
# Already enabled
394
323
return
395
self.send_changedstate()
324
self.last_enabled = datetime.datetime.utcnow()
396
325
# Schedule a new checker to be started an 'interval' from now,
397
326
# and every interval from then on.
398
327
self.checker_initiator_tag = (gobject.timeout_add
399
328
(self.interval_milliseconds(),
400
329
self.start_checker))
401
330
# Schedule a disable() when 'timeout' has passed
402
self.expires = datetime.datetime.utcnow() + self.timeout
403
331
self.disable_initiator_tag = (gobject.timeout_add
404
332
(self.timeout_milliseconds(),
405
333
self.disable))
406
334
self.enabled = True
407
self.last_enabled = datetime.datetime.utcnow()
408
335
# Also start a new checker *right now*.
409
336
self.start_checker()
410
337
413
340
if not getattr(self, "enabled", False):
414
341
return False
415
342
if not quiet:
416
self.send_changedstate()
417
if not quiet:
418
logger.info("Disabling client %s", self.name)
419
if getattr(self, "disable_initiator_tag", False):
343
logger.info(u"Disabling client %s", self.name)
344
if getattr(self, u"disable_initiator_tag", False):
420
345
gobject.source_remove(self.disable_initiator_tag)
421
346
self.disable_initiator_tag = None
422
self.expires = None
423
if getattr(self, "checker_initiator_tag", False):
347
if getattr(self, u"checker_initiator_tag", False):
424
348
gobject.source_remove(self.checker_initiator_tag)
425
349
self.checker_initiator_tag = None
426
350
self.stop_checker()
441
365
if os.WIFEXITED(condition):
442
366
exitstatus = os.WEXITSTATUS(condition)
443
367
if exitstatus == 0:
444
logger.info("Checker for %(name)s succeeded",
368
logger.info(u"Checker for %(name)s succeeded",
445
369
vars(self))
446
370
self.checked_ok()
447
371
else:
448
logger.info("Checker for %(name)s failed",
372
logger.info(u"Checker for %(name)s failed",
449
373
vars(self))
450
374
else:
451
logger.warning("Checker for %(name)s crashed?",
375
logger.warning(u"Checker for %(name)s crashed?",
452
376
vars(self))
453
377
454
def checked_ok(self, timeout=None):
378
def checked_ok(self):
455
379
"""Bump up the timeout for this client.
456
380
457
381
This should only be called when the client has been seen,
458
382
alive and well.
459
383
"""
460
if timeout is None:
461
timeout = self.timeout
462
384
self.last_checked_ok = datetime.datetime.utcnow()
463
385
gobject.source_remove(self.disable_initiator_tag)
464
self.expires = datetime.datetime.utcnow() + timeout
465
386
self.disable_initiator_tag = (gobject.timeout_add
466
(_timedelta_to_milliseconds(timeout),
387
(self.timeout_milliseconds(),
467
388
self.disable))
468
389
469
def need_approval(self):
470
self.last_approval_request = datetime.datetime.utcnow()
471
472
390
def start_checker(self):
473
391
"""Start a new checker subprocess if one is not running.
474
392
486
404
# If a checker exists, make sure it is not a zombie
487
405
try:
488
406
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
489
except (AttributeError, OSError) as error:
407
except (AttributeError, OSError), error:
490
408
if (isinstance(error, OSError)
491
409
and error.errno != errno.ECHILD):
492
410
raise error
493
411
else:
494
412
if pid:
495
logger.warning("Checker was a zombie")
413
logger.warning(u"Checker was a zombie")
496
414
gobject.source_remove(self.checker_callback_tag)
497
415
self.checker_callback(pid, status,
498
416
self.current_checker_command)
503
421
command = self.checker_command % self.host
504
422
except TypeError:
505
423
# Escape attributes for the shell
506
escaped_attrs = dict(
507
(attr,
508
re.escape(unicode(str(getattr(self, attr, "")),
509
errors=
510
'replace')))
511
for attr in
512
self.runtime_expansions)
513
424
escaped_attrs = dict((key,
425
re.escape(unicode(str(val),
426
errors=
427
u'replace')))
428
for key, val in
429
vars(self).iteritems())
514
430
try:
515
431
command = self.checker_command % escaped_attrs
516
except TypeError as error:
517
logger.error('Could not format string "%s":'
518
' %s', self.checker_command, error)
432
except TypeError, error:
433
logger.error(u'Could not format string "%s":'
434
u' %s', self.checker_command, error)
519
435
return True # Try again later
520
436
self.current_checker_command = command
521
437
try:
522
logger.info("Starting checker %r for %s",
438
logger.info(u"Starting checker %r for %s",
523
439
command, self.name)
524
440
# We don't need to redirect stdout and stderr, since
525
441
# in normal mode, that is already done by daemon(),
527
443
# always replaced by /dev/null.)
528
444
self.checker = subprocess.Popen(command,
529
445
close_fds=True,
530
shell=True, cwd="/")
446
shell=True, cwd=u"/")
531
447
self.checker_callback_tag = (gobject.child_watch_add
532
448
(self.checker.pid,
533
449
self.checker_callback,
538
454
if pid:
539
455
gobject.source_remove(self.checker_callback_tag)
540
456
self.checker_callback(pid, status, command)
541
except OSError as error:
542
logger.error("Failed to start subprocess: %s",
457
except OSError, error:
458
logger.error(u"Failed to start subprocess: %s",
543
459
error)
544
460
# Re-run this periodically if run by gobject.timeout_add
545
461
return True
549
465
if self.checker_callback_tag:
550
466
gobject.source_remove(self.checker_callback_tag)
551
467
self.checker_callback_tag = None
552
if getattr(self, "checker", None) is None:
468
if getattr(self, u"checker", None) is None:
553
469
return
554
logger.debug("Stopping checker for %(name)s", vars(self))
470
logger.debug(u"Stopping checker for %(name)s", vars(self))
555
471
try:
556
472
os.kill(self.checker.pid, signal.SIGTERM)
557
473
#time.sleep(0.5)
558
474
#if self.checker.poll() is None:
559
475
# os.kill(self.checker.pid, signal.SIGKILL)
560
except OSError as error:
476
except OSError, error:
561
477
if error.errno != errno.ESRCH: # No such process
562
478
raise
563
479
self.checker = None
564
480
565
481
566
def dbus_service_property(dbus_interface, signature="v",
567
access="readwrite", byte_arrays=False):
482
def dbus_service_property(dbus_interface, signature=u"v",
483
access=u"readwrite", byte_arrays=False):
568
484
"""Decorators for marking methods of a DBusObjectWithProperties to
569
485
become properties on the D-Bus.
570
486
577
493
"""
578
494
# Encoding deeply encoded byte arrays is not supported yet by the
579
495
# "Set" method, so we fail early here:
580
if byte_arrays and signature != "ay":
581
raise ValueError("Byte arrays not supported for non-'ay'"
582
" signature %r" % signature)
496
if byte_arrays and signature != u"ay":
497
raise ValueError(u"Byte arrays not supported for non-'ay'"
498
u" signature %r" % signature)
583
499
def decorator(func):
584
500
func._dbus_is_property = True
585
501
func._dbus_interface = dbus_interface
586
502
func._dbus_signature = signature
587
503
func._dbus_access = access
588
504
func._dbus_name = func.__name__
589
if func._dbus_name.endswith("_dbus_property"):
505
if func._dbus_name.endswith(u"_dbus_property"):
590
506
func._dbus_name = func._dbus_name[:-14]
591
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
507
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
592
508
return func
593
509
return decorator
594
510
614
530
615
531
class DBusObjectWithProperties(dbus.service.Object):
616
532
"""A D-Bus object with properties.
617
533
618
534
Classes inheriting from this can use the dbus_service_property
619
535
decorator to expose methods as D-Bus properties. It exposes the
620
536
standard Get(), Set(), and GetAll() methods on the D-Bus.
622
538
623
539
@staticmethod
624
540
def _is_dbus_property(obj):
625
return getattr(obj, "_dbus_is_property", False)
541
return getattr(obj, u"_dbus_is_property", False)
626
542
627
543
def _get_all_dbus_properties(self):
628
544
"""Returns a generator of (name, attribute) pairs
631
547
for name, prop in
632
548
inspect.getmembers(self, self._is_dbus_property))
633
549
634
# def _get_dbus_property(self, interface_name, property_name):
635
# """Returns a bound method if one exists which is a D-Bus
636
# property with the specified name and interface.
637
# """
638
# print("get_property({0!r}, {1!r}".format(interface_name, property_name),file=sys.stderr)
639
# print(dir(self), sys.stderr)
640
# for name in (property_name,
641
# property_name + "_dbus_property"):
642
# prop = getattr(self, name, None)
643
# if (prop is None
644
# or not self._is_dbus_property(prop)
645
# or prop._dbus_name != property_name
646
# or (interface_name and prop._dbus_interface
647
# and interface_name != prop._dbus_interface)):
648
# continue
649
# return prop
650
# # No such property
651
# raise DBusPropertyNotFound(self.dbus_object_path + ":"
652
# + interface_name + "."
653
# + property_name)
654
655
550
def _get_dbus_property(self, interface_name, property_name):
656
551
"""Returns a bound method if one exists which is a D-Bus
657
552
property with the specified name and interface.
658
553
"""
659
for name, value in inspect.getmembers(self, self._is_dbus_property):
660
if value._dbus_name == property_name and value._dbus_interface == interface_name:
661
return value
662
554
for name in (property_name,
555
property_name + u"_dbus_property"):
556
prop = getattr(self, name, None)
557
if (prop is None
558
or not self._is_dbus_property(prop)
559
or prop._dbus_name != property_name
560
or (interface_name and prop._dbus_interface
561
and interface_name != prop._dbus_interface)):
562
continue
563
return prop
663
564
# No such property
664
raise DBusPropertyNotFound(self.dbus_object_path + ":"
665
+ interface_name + "."
565
raise DBusPropertyNotFound(self.dbus_object_path + u":"
566
+ interface_name + u"."
666
567
+ property_name)
667
668
568
669
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
670
out_signature="v")
569
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
570
out_signature=u"v")
671
571
def Get(self, interface_name, property_name):
672
572
"""Standard D-Bus property Get() method, see D-Bus standard.
673
573
"""
674
574
prop = self._get_dbus_property(interface_name, property_name)
675
if prop._dbus_access == "write":
575
if prop._dbus_access == u"write":
676
576
raise DBusPropertyAccessException(property_name)
677
577
value = prop()
678
if not hasattr(value, "variant_level"):
578
if not hasattr(value, u"variant_level"):
679
579
return value
680
580
return type(value)(value, variant_level=value.variant_level+1)
681
581
682
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
582
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
683
583
def Set(self, interface_name, property_name, value):
684
584
"""Standard D-Bus property Set() method, see D-Bus standard.
685
585
"""
686
586
prop = self._get_dbus_property(interface_name, property_name)
687
if prop._dbus_access == "read":
587
if prop._dbus_access == u"read":
688
588
raise DBusPropertyAccessException(property_name)
689
if prop._dbus_get_args_options["byte_arrays"]:
589
if prop._dbus_get_args_options[u"byte_arrays"]:
690
590
# The byte_arrays option is not supported yet on
691
591
# signatures other than "ay".
692
if prop._dbus_signature != "ay":
592
if prop._dbus_signature != u"ay":
693
593
raise ValueError
694
594
value = dbus.ByteArray(''.join(unichr(byte)
695
595
for byte in value))
696
596
prop(value)
697
597
698
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
699
out_signature="a{sv}")
598
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
599
out_signature=u"a{sv}")
700
600
def GetAll(self, interface_name):
701
601
"""Standard D-Bus property GetAll() method, see D-Bus
702
602
standard.
703
603
704
604
Note: Will not include properties with access="write".
705
605
"""
706
606
all = {}
710
610
# Interface non-empty but did not match
711
611
continue
712
612
# Ignore write-only properties
713
if prop._dbus_access == "write":
613
if prop._dbus_access == u"write":
714
614
continue
715
615
value = prop()
716
if not hasattr(value, "variant_level"):
616
if not hasattr(value, u"variant_level"):
717
617
all[name] = value
718
618
continue
719
619
all[name] = type(value)(value, variant_level=
720
620
value.variant_level+1)
721
return dbus.Dictionary(all, signature="sv")
621
return dbus.Dictionary(all, signature=u"sv")
722
622
723
623
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
724
out_signature="s",
624
out_signature=u"s",
725
625
path_keyword='object_path',
726
626
connection_keyword='connection')
727
627
def Introspect(self, object_path, connection):
732
632
try:
733
633
document = xml.dom.minidom.parseString(xmlstring)
734
634
def make_tag(document, name, prop):
735
e = document.createElement("property")
736
e.setAttribute("name", name)
737
e.setAttribute("type", prop._dbus_signature)
738
e.setAttribute("access", prop._dbus_access)
635
e = document.createElement(u"property")
636
e.setAttribute(u"name", name)
637
e.setAttribute(u"type", prop._dbus_signature)
638
e.setAttribute(u"access", prop._dbus_access)
739
639
return e
740
for if_tag in document.getElementsByTagName("interface"):
640
for if_tag in document.getElementsByTagName(u"interface"):
741
641
for tag in (make_tag(document, name, prop)
742
642
for name, prop
743
643
in self._get_all_dbus_properties()
744
644
if prop._dbus_interface
745
== if_tag.getAttribute("name")):
645
== if_tag.getAttribute(u"name")):
746
646
if_tag.appendChild(tag)
747
647
# Add the names to the return values for the
748
648
# "org.freedesktop.DBus.Properties" methods
749
if (if_tag.getAttribute("name")
750
== "org.freedesktop.DBus.Properties"):
751
for cn in if_tag.getElementsByTagName("method"):
752
if cn.getAttribute("name") == "Get":
753
for arg in cn.getElementsByTagName("arg"):
754
if (arg.getAttribute("direction")
755
== "out"):
756
arg.setAttribute("name", "value")
757
elif cn.getAttribute("name") == "GetAll":
758
for arg in cn.getElementsByTagName("arg"):
759
if (arg.getAttribute("direction")
760
== "out"):
761
arg.setAttribute("name", "props")
762
xmlstring = document.toxml("utf-8")
649
if (if_tag.getAttribute(u"name")
650
== u"org.freedesktop.DBus.Properties"):
651
for cn in if_tag.getElementsByTagName(u"method"):
652
if cn.getAttribute(u"name") == u"Get":
653
for arg in cn.getElementsByTagName(u"arg"):
654
if (arg.getAttribute(u"direction")
655
== u"out"):
656
arg.setAttribute(u"name", u"value")
657
elif cn.getAttribute(u"name") == u"GetAll":
658
for arg in cn.getElementsByTagName(u"arg"):
659
if (arg.getAttribute(u"direction")
660
== u"out"):
661
arg.setAttribute(u"name", u"props")
662
xmlstring = document.toxml(u"utf-8")
763
663
document.unlink()
764
664
except (AttributeError, xml.dom.DOMException,
765
xml.parsers.expat.ExpatError) as error:
766
logger.error("Failed to override Introspection method",
665
xml.parsers.expat.ExpatError), error:
666
logger.error(u"Failed to override Introspection method",
767
667
error)
768
668
return xmlstring
769
669
770
670
771
def datetime_to_dbus (dt, variant_level=0):
772
"""Convert a UTC datetime.datetime() to a D-Bus type."""
773
if dt is None:
774
return dbus.String("", variant_level = variant_level)
775
return dbus.String(dt.isoformat(),
776
variant_level=variant_level)
777
778
class transitional_clientdbus(DBusObjectWithProperties.__metaclass__):
779
def __new__(mcs, name, bases, attr):
780
for key, old_dbusobj in attr.items():
781
new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")
782
if getattr(old_dbusobj, "_dbus_is_signal", False):
783
unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,
784
old_dbusobj.__closure__))["func"].cell_contents
785
newfunc = types.FunctionType(unwrappedfunc.func_code,
786
unwrappedfunc.func_globals,
787
unwrappedfunc.func_name,
788
unwrappedfunc.func_defaults,
789
unwrappedfunc.func_closure)
790
new_dbusfunc = dbus.service.signal(
791
new_interface, old_dbusobj._dbus_signature)(newfunc)
792
attr["_transitional_{0}_1".format(key)] = new_dbusfunc
793
attr["_transitional_{0}_0".format(key)] = old_dbusobj
794
def fixscope(func1, func2):
795
def newcall(*args, **kwargs):
796
func1(*args, **kwargs)
797
func2(*args, **kwargs)
798
return newcall
799
800
attr[key] = fixscope(
801
old_dbusobj, attr["_transitional_{0}_1".format(key)])
802
803
if getattr(old_dbusobj, "_dbus_is_method", False):
804
new_dbusfunc = (dbus.service.method
805
(new_interface,
806
old_dbusobj._dbus_in_signature,
807
old_dbusobj._dbus_out_signature)
808
(types.FunctionType
809
(old_dbusobj.func_code,
810
old_dbusobj.func_globals,
811
old_dbusobj.func_name,
812
old_dbusobj.func_defaults,
813
old_dbusobj.func_closure)))
814
815
attr["_transitional_{0}".format(key)] = new_dbusfunc
816
if getattr(old_dbusobj, "_dbus_is_property", False):
817
new_dbusfunc = (dbus_service_property
818
(new_interface,
819
old_dbusobj._dbus_signature,
820
old_dbusobj._dbus_access,
821
old_dbusobj._dbus_get_args_options["byte_arrays"])
822
(types.FunctionType
823
(old_dbusobj.func_code,
824
old_dbusobj.func_globals,
825
old_dbusobj.func_name,
826
old_dbusobj.func_defaults,
827
old_dbusobj.func_closure)))
828
829
attr["_transitional_{0}".format(key)] = new_dbusfunc
830
return type.__new__(mcs, name, bases, attr)
831
832
671
class ClientDBus(Client, DBusObjectWithProperties):
833
672
"""A Client class using D-Bus
834
673
836
675
dbus_object_path: dbus.ObjectPath
837
676
bus: dbus.SystemBus()
838
677
"""
839
840
runtime_expansions = (Client.runtime_expansions
841
+ ("dbus_object_path",))
842
843
__metaclass__ = transitional_clientdbus
844
845
678
# dbus.service.Object doesn't use super(), so we can't either.
846
679
847
680
def __init__(self, bus = None, *args, **kwargs):
848
self._approvals_pending = 0
849
681
self.bus = bus
850
682
Client.__init__(self, *args, **kwargs)
851
683
# Only now, when this client is initialized, can it show up on
852
684
# the D-Bus
853
client_object_name = unicode(self.name).translate(
854
{ord("."): ord("_"),
855
ord("-"): ord("_")})
856
685
self.dbus_object_path = (dbus.ObjectPath
857
("/clients/" + client_object_name))
686
(u"/clients/"
687
+ self.name.replace(u".", u"_")))
858
688
DBusObjectWithProperties.__init__(self, self.bus,
859
689
self.dbus_object_path)
860
861
def notifychangeproperty(transform_func,
862
dbus_name, type_func=lambda x: x,
863
variant_level=1):
864
""" Modify a variable so that its a property that announce its
865
changes to DBus.
866
transform_fun: Function that takes a value and transform it to
867
DBus type.
868
dbus_name: DBus name of the variable
869
type_func: Function that transform the value before sending it
870
to DBus
871
variant_level: DBus variant level. default: 1
872
"""
873
real_value = [None,]
874
def setter(self, value):
875
old_value = real_value[0]
876
real_value[0] = value
877
if hasattr(self, "dbus_object_path"):
878
if type_func(old_value) != type_func(real_value[0]):
879
dbus_value = transform_func(type_func(real_value[0]),
880
variant_level)
881
self.PropertyChanged(dbus.String(dbus_name),
882
dbus_value)
883
884
return property(lambda self: real_value[0], setter)
885
886
887
expires = notifychangeproperty(datetime_to_dbus, "Expires")
888
approvals_pending = notifychangeproperty(dbus.Boolean,
889
"ApprovalPending",
890
type_func = bool)
891
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
892
last_enabled = notifychangeproperty(datetime_to_dbus,
893
"LastEnabled")
894
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
895
type_func = lambda checker: checker is not None)
896
last_checked_ok = notifychangeproperty(datetime_to_dbus,
897
"LastCheckedOK")
898
last_approval_request = notifychangeproperty(datetime_to_dbus,
899
"LastApprovalRequest")
900
approved_by_default = notifychangeproperty(dbus.Boolean,
901
"ApprovedByDefault")
902
approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",
903
type_func = _timedelta_to_milliseconds)
904
approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",
905
type_func = _timedelta_to_milliseconds)
906
host = notifychangeproperty(dbus.String, "Host")
907
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
908
type_func = _timedelta_to_milliseconds)
909
extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",
910
type_func = _timedelta_to_milliseconds)
911
interval = notifychangeproperty(dbus.UInt16, "Interval",
912
type_func = _timedelta_to_milliseconds)
913
checker_command = notifychangeproperty(dbus.String, "Checker")
914
915
del notifychangeproperty
690
691
@staticmethod
692
def _datetime_to_dbus(dt, variant_level=0):
693
"""Convert a UTC datetime.datetime() to a D-Bus type."""
694
return dbus.String(dt.isoformat(),
695
variant_level=variant_level)
696
697
def enable(self):
698
oldstate = getattr(self, u"enabled", False)
699
r = Client.enable(self)
700
if oldstate != self.enabled:
701
# Emit D-Bus signals
702
self.PropertyChanged(dbus.String(u"enabled"),
703
dbus.Boolean(True, variant_level=1))
704
self.PropertyChanged(
705
dbus.String(u"last_enabled"),
706
self._datetime_to_dbus(self.last_enabled,
707
variant_level=1))
708
return r
709
710
def disable(self, quiet = False):
711
oldstate = getattr(self, u"enabled", False)
712
r = Client.disable(self, quiet=quiet)
713
if not quiet and oldstate != self.enabled:
714
# Emit D-Bus signal
715
self.PropertyChanged(dbus.String(u"enabled"),
716
dbus.Boolean(False, variant_level=1))
717
return r
916
718
917
719
def __del__(self, *args, **kwargs):
918
720
try:
919
721
self.remove_from_connection()
920
722
except LookupError:
921
723
pass
922
if hasattr(DBusObjectWithProperties, "__del__"):
724
if hasattr(DBusObjectWithProperties, u"__del__"):
923
725
DBusObjectWithProperties.__del__(self, *args, **kwargs)
924
726
Client.__del__(self, *args, **kwargs)
925
727
927
729
*args, **kwargs):
928
730
self.checker_callback_tag = None
929
731
self.checker = None
732
# Emit D-Bus signal
733
self.PropertyChanged(dbus.String(u"checker_running"),
734
dbus.Boolean(False, variant_level=1))
930
735
if os.WIFEXITED(condition):
931
736
exitstatus = os.WEXITSTATUS(condition)
932
737
# Emit D-Bus signal
942
747
return Client.checker_callback(self, pid, condition, command,
943
748
*args, **kwargs)
944
749
750
def checked_ok(self, *args, **kwargs):
751
r = Client.checked_ok(self, *args, **kwargs)
752
# Emit D-Bus signal
753
self.PropertyChanged(
754
dbus.String(u"last_checked_ok"),
755
(self._datetime_to_dbus(self.last_checked_ok,
756
variant_level=1)))
757
return r
758
945
759
def start_checker(self, *args, **kwargs):
946
760
old_checker = self.checker
947
761
if self.checker is not None:
954
768
and old_checker_pid != self.checker.pid):
955
769
# Emit D-Bus signal
956
770
self.CheckerStarted(self.current_checker_command)
957
return r
958
959
def _reset_approved(self):
960
self._approved = None
961
return False
962
963
def approve(self, value=True):
964
self.send_changedstate()
965
self._approved = value
966
gobject.timeout_add(_timedelta_to_milliseconds
967
(self.approval_duration),
968
self._reset_approved)
969
771
self.PropertyChanged(
772
dbus.String(u"checker_running"),
773
dbus.Boolean(True, variant_level=1))
774
return r
775
776
def stop_checker(self, *args, **kwargs):
777
old_checker = getattr(self, u"checker", None)
778
r = Client.stop_checker(self, *args, **kwargs)
779
if (old_checker is not None
780
and getattr(self, u"checker", None) is None):
781
self.PropertyChanged(dbus.String(u"checker_running"),
782
dbus.Boolean(False, variant_level=1))
783
return r
970
784
971
785
## D-Bus methods, signals & properties
972
_interface = "se.bsnet.fukt.Mandos.Client"
973
786
_interface = u"se.bsnet.fukt.Mandos.Client"
787
974
788
## Signals
975
789
976
790
# CheckerCompleted - signal
977
@dbus.service.signal(_interface, signature="nxs")
791
@dbus.service.signal(_interface, signature=u"nxs")
978
792
def CheckerCompleted(self, exitcode, waitstatus, command):
979
793
"D-Bus signal"
980
794
pass
981
795
982
796
# CheckerStarted - signal
983
@dbus.service.signal(_interface, signature="s")
797
@dbus.service.signal(_interface, signature=u"s")
984
798
def CheckerStarted(self, command):
985
799
"D-Bus signal"
986
800
pass
987
801
988
802
# PropertyChanged - signal
989
@dbus.service.signal(_interface, signature="sv")
803
@dbus.service.signal(_interface, signature=u"sv")
990
804
def PropertyChanged(self, property, value):
991
805
"D-Bus signal"
992
806
pass
994
808
# GotSecret - signal
995
809
@dbus.service.signal(_interface)
996
810
def GotSecret(self):
997
"""D-Bus signal
998
Is sent after a successful transfer of secret from the Mandos
999
server to mandos-client
1000
"""
811
"D-Bus signal"
1001
812
pass
1002
813
1003
814
# Rejected - signal
1004
@dbus.service.signal(_interface, signature="s")
1005
def Rejected(self, reason):
815
@dbus.service.signal(_interface)
816
def Rejected(self):
1006
817
"D-Bus signal"
1007
818
pass
1008
819
1009
# NeedApproval - signal
1010
@dbus.service.signal(_interface, signature="tb")
1011
def NeedApproval(self, timeout, default):
1012
"D-Bus signal"
1013
return self.need_approval()
1014
1015
820
## Methods
1016
821
1017
# Approve - method
1018
@dbus.service.method(_interface, in_signature="b")
1019
def Approve(self, value):
1020
self.approve(value)
1021
1022
822
# CheckedOK - method
1023
823
@dbus.service.method(_interface)
1024
824
def CheckedOK(self):
1025
self.checked_ok()
825
return self.checked_ok()
1026
826
1027
827
# Enable - method
1028
828
@dbus.service.method(_interface)
1049
849
1050
850
## Properties
1051
851
1052
# ApprovalPending - property
1053
@dbus_service_property(_interface, signature="b", access="read")
1054
def ApprovalPending_dbus_property(self):
1055
return dbus.Boolean(bool(self.approvals_pending))
1056
1057
# ApprovedByDefault - property
1058
@dbus_service_property(_interface, signature="b",
1059
access="readwrite")
1060
def ApprovedByDefault_dbus_property(self, value=None):
1061
if value is None: # get
1062
return dbus.Boolean(self.approved_by_default)
1063
self.approved_by_default = bool(value)
1064
1065
# ApprovalDelay - property
1066
@dbus_service_property(_interface, signature="t",
1067
access="readwrite")
1068
def ApprovalDelay_dbus_property(self, value=None):
1069
if value is None: # get
1070
return dbus.UInt64(self.approval_delay_milliseconds())
1071
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1072
1073
# ApprovalDuration - property
1074
@dbus_service_property(_interface, signature="t",
1075
access="readwrite")
1076
def ApprovalDuration_dbus_property(self, value=None):
1077
if value is None: # get
1078
return dbus.UInt64(_timedelta_to_milliseconds(
1079
self.approval_duration))
1080
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1081
1082
# Name - property
1083
@dbus_service_property(_interface, signature="s", access="read")
1084
def Name_dbus_property(self):
852
# name - property
853
@dbus_service_property(_interface, signature=u"s", access=u"read")
854
def name_dbus_property(self):
1085
855
return dbus.String(self.name)
1086
856
1087
# Fingerprint - property
1088
@dbus_service_property(_interface, signature="s", access="read")
1089
def Fingerprint_dbus_property(self):
857
# fingerprint - property
858
@dbus_service_property(_interface, signature=u"s", access=u"read")
859
def fingerprint_dbus_property(self):
1090
860
return dbus.String(self.fingerprint)
1091
861
1092
# Host - property
1093
@dbus_service_property(_interface, signature="s",
1094
access="readwrite")
1095
def Host_dbus_property(self, value=None):
862
# host - property
863
@dbus_service_property(_interface, signature=u"s",
864
access=u"readwrite")
865
def host_dbus_property(self, value=None):
1096
866
if value is None: # get
1097
867
return dbus.String(self.host)
1098
868
self.host = value
1099
1100
# Created - property
1101
@dbus_service_property(_interface, signature="s", access="read")
1102
def Created_dbus_property(self):
1103
return dbus.String(datetime_to_dbus(self.created))
1104
1105
# LastEnabled - property
1106
@dbus_service_property(_interface, signature="s", access="read")
1107
def LastEnabled_dbus_property(self):
1108
return datetime_to_dbus(self.last_enabled)
1109
1110
# Enabled - property
1111
@dbus_service_property(_interface, signature="b",
1112
access="readwrite")
1113
def Enabled_dbus_property(self, value=None):
869
# Emit D-Bus signal
870
self.PropertyChanged(dbus.String(u"host"),
871
dbus.String(value, variant_level=1))
872
873
# created - property
874
@dbus_service_property(_interface, signature=u"s", access=u"read")
875
def created_dbus_property(self):
876
return dbus.String(self._datetime_to_dbus(self.created))
877
878
# last_enabled - property
879
@dbus_service_property(_interface, signature=u"s", access=u"read")
880
def last_enabled_dbus_property(self):
881
if self.last_enabled is None:
882
return dbus.String(u"")
883
return dbus.String(self._datetime_to_dbus(self.last_enabled))
884
885
# enabled - property
886
@dbus_service_property(_interface, signature=u"b",
887
access=u"readwrite")
888
def enabled_dbus_property(self, value=None):
1114
889
if value is None: # get
1115
890
return dbus.Boolean(self.enabled)
1116
891
if value:
1118
893
else:
1119
894
self.disable()
1120
895
1121
# LastCheckedOK - property
1122
@dbus_service_property(_interface, signature="s",
1123
access="readwrite")
1124
def LastCheckedOK_dbus_property(self, value=None):
896
# last_checked_ok - property
897
@dbus_service_property(_interface, signature=u"s",
898
access=u"readwrite")
899
def last_checked_ok_dbus_property(self, value=None):
1125
900
if value is not None:
1126
901
self.checked_ok()
1127
902
return
1128
return datetime_to_dbus(self.last_checked_ok)
1129
1130
# Expires - property
1131
@dbus_service_property(_interface, signature="s", access="read")
1132
def Expires_dbus_property(self):
1133
return datetime_to_dbus(self.expires)
1134
1135
# LastApprovalRequest - property
1136
@dbus_service_property(_interface, signature="s", access="read")
1137
def LastApprovalRequest_dbus_property(self):
1138
return datetime_to_dbus(self.last_approval_request)
1139
1140
# Timeout - property
1141
@dbus_service_property(_interface, signature="t",
1142
access="readwrite")
1143
def Timeout_dbus_property(self, value=None):
903
if self.last_checked_ok is None:
904
return dbus.String(u"")
905
return dbus.String(self._datetime_to_dbus(self
906
.last_checked_ok))
907
908
# timeout - property
909
@dbus_service_property(_interface, signature=u"t",
910
access=u"readwrite")
911
def timeout_dbus_property(self, value=None):
1144
912
if value is None: # get
1145
913
return dbus.UInt64(self.timeout_milliseconds())
1146
914
self.timeout = datetime.timedelta(0, 0, 0, value)
1147
if getattr(self, "disable_initiator_tag", None) is None:
915
# Emit D-Bus signal
916
self.PropertyChanged(dbus.String(u"timeout"),
917
dbus.UInt64(value, variant_level=1))
918
if getattr(self, u"disable_initiator_tag", None) is None:
1148
919
return
1149
920
# Reschedule timeout
1150
921
gobject.source_remove(self.disable_initiator_tag)
1151
922
self.disable_initiator_tag = None
1152
self.expires = None
1153
923
time_to_die = (self.
1154
924
_timedelta_to_milliseconds((self
1155
925
.last_checked_ok
1160
930
# The timeout has passed
1161
931
self.disable()
1162
932
else:
1163
self.expires = (datetime.datetime.utcnow()
1164
+ datetime.timedelta(milliseconds = time_to_die))
1165
933
self.disable_initiator_tag = (gobject.timeout_add
1166
934
(time_to_die, self.disable))
1167
935
1168
# ExtendedTimeout - property
1169
@dbus_service_property(_interface, signature="t",
1170
access="readwrite")
1171
def ExtendedTimeout_dbus_property(self, value=None):
1172
if value is None: # get
1173
return dbus.UInt64(self.extended_timeout_milliseconds())
1174
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1175
1176
# Interval - property
1177
@dbus_service_property(_interface, signature="t",
1178
access="readwrite")
1179
def Interval_dbus_property(self, value=None):
936
# interval - property
937
@dbus_service_property(_interface, signature=u"t",
938
access=u"readwrite")
939
def interval_dbus_property(self, value=None):
1180
940
if value is None: # get
1181
941
return dbus.UInt64(self.interval_milliseconds())
1182
942
self.interval = datetime.timedelta(0, 0, 0, value)
1183
if getattr(self, "checker_initiator_tag", None) is None:
943
# Emit D-Bus signal
944
self.PropertyChanged(dbus.String(u"interval"),
945
dbus.UInt64(value, variant_level=1))
946
if getattr(self, u"checker_initiator_tag", None) is None:
1184
947
return
1185
948
# Reschedule checker run
1186
949
gobject.source_remove(self.checker_initiator_tag)
1187
950
self.checker_initiator_tag = (gobject.timeout_add
1188
951
(value, self.start_checker))
1189
952
self.start_checker() # Start one now, too
1190
1191
# Checker - property
1192
@dbus_service_property(_interface, signature="s",
1193
access="readwrite")
1194
def Checker_dbus_property(self, value=None):
953
954
# checker - property
955
@dbus_service_property(_interface, signature=u"s",
956
access=u"readwrite")
957
def checker_dbus_property(self, value=None):
1195
958
if value is None: # get
1196
959
return dbus.String(self.checker_command)
1197
960
self.checker_command = value
961
# Emit D-Bus signal
962
self.PropertyChanged(dbus.String(u"checker"),
963
dbus.String(self.checker_command,
964
variant_level=1))
1198
965
1199
# CheckerRunning - property
1200
@dbus_service_property(_interface, signature="b",
1201
access="readwrite")
1202
def CheckerRunning_dbus_property(self, value=None):
966
# checker_running - property
967
@dbus_service_property(_interface, signature=u"b",
968
access=u"readwrite")
969
def checker_running_dbus_property(self, value=None):
1203
970
if value is None: # get
1204
971
return dbus.Boolean(self.checker is not None)
1205
972
if value:
1207
974
else:
1208
975
self.stop_checker()
1209
976
1210
# ObjectPath - property
1211
@dbus_service_property(_interface, signature="o", access="read")
1212
def ObjectPath_dbus_property(self):
977
# object_path - property
978
@dbus_service_property(_interface, signature=u"o", access=u"read")
979
def object_path_dbus_property(self):
1213
980
return self.dbus_object_path # is already a dbus.ObjectPath
1214
981
1215
# Secret = property
1216
@dbus_service_property(_interface, signature="ay",
1217
access="write", byte_arrays=True)
1218
def Secret_dbus_property(self, value):
982
# secret = property
983
@dbus_service_property(_interface, signature=u"ay",
984
access=u"write", byte_arrays=True)
985
def secret_dbus_property(self, value):
1219
986
self.secret = str(value)
1220
987
1221
988
del _interface
1222
989
1223
990
1224
class ProxyClient(object):
1225
def __init__(self, child_pipe, fpr, address):
1226
self._pipe = child_pipe
1227
self._pipe.send(('init', fpr, address))
1228
if not self._pipe.recv():
1229
raise KeyError()
1230
1231
def __getattribute__(self, name):
1232
if(name == '_pipe'):
1233
return super(ProxyClient, self).__getattribute__(name)
1234
self._pipe.send(('getattr', name))
1235
data = self._pipe.recv()
1236
if data[0] == 'data':
1237
return data[1]
1238
if data[0] == 'function':
1239
def func(*args, **kwargs):
1240
self._pipe.send(('funcall', name, args, kwargs))
1241
return self._pipe.recv()[1]
1242
return func
1243
1244
def __setattr__(self, name, value):
1245
if(name == '_pipe'):
1246
return super(ProxyClient, self).__setattr__(name, value)
1247
self._pipe.send(('setattr', name, value))
1248
1249
1250
991
class ClientHandler(socketserver.BaseRequestHandler, object):
1251
992
"""A class to handle client connections.
1252
993
1254
995
Note: This will run in its own forked process."""
1255
996
1256
997
def handle(self):
1257
with contextlib.closing(self.server.child_pipe) as child_pipe:
1258
logger.info("TCP connection from: %s",
1259
unicode(self.client_address))
1260
logger.debug("Pipe FD: %d",
1261
self.server.child_pipe.fileno())
1262
998
logger.info(u"TCP connection from: %s",
999
unicode(self.client_address))
1000
logger.debug(u"IPC Pipe FD: %d",
1001
self.server.child_pipe[1].fileno())
1002
# Open IPC pipe to parent process
1003
with contextlib.nested(self.server.child_pipe[1],
1004
self.server.parent_pipe[0]
1005
) as (ipc, ipc_return):
1263
1006
session = (gnutls.connection
1264
1007
.ClientSession(self.request,
1265
1008
gnutls.connection
1270
1013
# no X.509 keys are added to it. Therefore, we can use it
1271
1014
# here despite using OpenPGP certificates.
1272
1015
1273
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1274
# "+AES-256-CBC", "+SHA1",
1275
# "+COMP-NULL", "+CTYPE-OPENPGP",
1276
# "+DHE-DSS"))
1016
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1017
# u"+AES-256-CBC", u"+SHA1",
1018
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1019
# u"+DHE-DSS"))
1277
1020
# Use a fallback default, since this MUST be set.
1278
1021
priority = self.server.gnutls_priority
1279
1022
if priority is None:
1280
priority = "NORMAL"
1023
priority = u"NORMAL"
1281
1024
(gnutls.library.functions
1282
1025
.gnutls_priority_set_direct(session._c_object,
1283
1026
priority, None))
1285
1028
# Start communication using the Mandos protocol
1286
1029
# Get protocol number
1287
1030
line = self.request.makefile().readline()
1288
logger.debug("Protocol version: %r", line)
1031
logger.debug(u"Protocol version: %r", line)
1289
1032
try:
1290
1033
if int(line.strip().split()[0]) > 1:
1291
1034
raise RuntimeError
1292
except (ValueError, IndexError, RuntimeError) as error:
1293
logger.error("Unknown protocol version: %s", error)
1035
except (ValueError, IndexError, RuntimeError), error:
1036
logger.error(u"Unknown protocol version: %s", error)
1294
1037
return
1295
1038
1296
1039
# Start GnuTLS connection
1297
1040
try:
1298
1041
session.handshake()
1299
except gnutls.errors.GNUTLSError as error:
1300
logger.warning("Handshake failed: %s", error)
1042
except gnutls.errors.GNUTLSError, error:
1043
logger.warning(u"Handshake failed: %s", error)
1301
1044
# Do not run session.bye() here: the session is not
1302
1045
# established. Just abandon the request.
1303
1046
return
1304
logger.debug("Handshake succeeded")
1305
1306
approval_required = False
1047
logger.debug(u"Handshake succeeded")
1307
1048
try:
1308
1049
try:
1309
1050
fpr = self.fingerprint(self.peer_certificate
1310
1051
(session))
1311
except (TypeError,
1312
gnutls.errors.GNUTLSError) as error:
1313
logger.warning("Bad certificate: %s", error)
1314
return
1315
logger.debug("Fingerprint: %s", fpr)
1316
1317
try:
1318
client = ProxyClient(child_pipe, fpr,
1319
self.client_address)
1320
except KeyError:
1321
return
1322
1323
if client.approval_delay:
1324
delay = client.approval_delay
1325
client.approvals_pending += 1
1326
approval_required = True
1327
1328
while True:
1329
if not client.enabled:
1330
logger.info("Client %s is disabled",
1331
client.name)
1332
if self.server.use_dbus:
1333
# Emit D-Bus signal
1334
client.Rejected("Disabled")
1335
return
1336
1337
if client._approved or not client.approval_delay:
1338
#We are approved or approval is disabled
1052
except (TypeError, gnutls.errors.GNUTLSError), error:
1053
logger.warning(u"Bad certificate: %s", error)
1054
return
1055
logger.debug(u"Fingerprint: %s", fpr)
1056
1057
for c in self.server.clients:
1058
if c.fingerprint == fpr:
1059
client = c
1339
1060
break
1340
elif client._approved is None:
1341
logger.info("Client %s needs approval",
1342
client.name)
1343
if self.server.use_dbus:
1344
# Emit D-Bus signal
1345
client.NeedApproval(
1346
client.approval_delay_milliseconds(),
1347
client.approved_by_default)
1348
else:
1349
logger.warning("Client %s was not approved",
1350
client.name)
1351
if self.server.use_dbus:
1352
# Emit D-Bus signal
1353
client.Rejected("Denied")
1354
return
1355
1356
#wait until timeout or approved
1357
#x = float(client._timedelta_to_milliseconds(delay))
1358
time = datetime.datetime.now()
1359
client.changedstate.acquire()
1360
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1361
client.changedstate.release()
1362
time2 = datetime.datetime.now()
1363
if (time2 - time) >= delay:
1364
if not client.approved_by_default:
1365
logger.warning("Client %s timed out while"
1366
" waiting for approval",
1367
client.name)
1368
if self.server.use_dbus:
1369
# Emit D-Bus signal
1370
client.Rejected("Approval timed out")
1371
return
1372
else:
1373
break
1374
else:
1375
delay -= time2 - time
1376
1061
else:
1062
ipc.write(u"NOTFOUND %s %s\n"
1063
% (fpr, unicode(self.client_address)))
1064
return
1065
1066
class ClientProxy(object):
1067
"""Client proxy object. Not for calling methods."""
1068
def __init__(self, client):
1069
self.client = client
1070
def __getattr__(self, name):
1071
if name.startswith("ipc_"):
1072
def tempfunc():
1073
ipc.write("%s %s\n" % (name[4:].upper(),
1074
self.client.name))
1075
return tempfunc
1076
if not hasattr(self.client, name):
1077
raise AttributeError
1078
ipc.write(u"GETATTR %s %s\n"
1079
% (name, self.client.fingerprint))
1080
return pickle.load(ipc_return)
1081
clientproxy = ClientProxy(client)
1082
# Have to check if client.enabled, since it is
1083
# possible that the client was disabled since the
1084
# GnuTLS session was established.
1085
if not clientproxy.enabled:
1086
clientproxy.ipc_disabled()
1087
return
1088
1089
clientproxy.ipc_sending()
1377
1090
sent_size = 0
1378
1091
while sent_size < len(client.secret):
1379
try:
1380
sent = session.send(client.secret[sent_size:])
1381
except gnutls.errors.GNUTLSError as error:
1382
logger.warning("gnutls send failed")
1383
return
1384
logger.debug("Sent: %d, remaining: %d",
1092
sent = session.send(client.secret[sent_size:])
1093
logger.debug(u"Sent: %d, remaining: %d",
1385
1094
sent, len(client.secret)
1386
1095
- (sent_size + sent))
1387
1096
sent_size += sent
1388
1389
logger.info("Sending secret to %s", client.name)
1390
# bump the timeout as if seen
1391
client.checked_ok(client.extended_timeout)
1392
if self.server.use_dbus:
1393
# Emit D-Bus signal
1394
client.GotSecret()
1395
1396
1097
finally:
1397
if approval_required:
1398
client.approvals_pending -= 1
1399
try:
1400
session.bye()
1401
except gnutls.errors.GNUTLSError as error:
1402
logger.warning("GnuTLS bye failed")
1098
session.bye()
1403
1099
1404
1100
@staticmethod
1405
1101
def peer_certificate(session):
1415
1111
.gnutls_certificate_get_peers
1416
1112
(session._c_object, ctypes.byref(list_size)))
1417
1113
if not bool(cert_list) and list_size.value != 0:
1418
raise gnutls.errors.GNUTLSError("error getting peer"
1419
" certificate")
1114
raise gnutls.errors.GNUTLSError(u"error getting peer"
1115
u" certificate")
1420
1116
if list_size.value == 0:
1421
1117
return None
1422
1118
cert = cert_list[0]
1448
1144
if crtverify.value != 0:
1449
1145
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1450
1146
raise (gnutls.errors.CertificateSecurityError
1451
("Verify failed"))
1147
(u"Verify failed"))
1452
1148
# New buffer for the fingerprint
1453
1149
buf = ctypes.create_string_buffer(20)
1454
1150
buf_len = ctypes.c_size_t()
1461
1157
# Convert the buffer to a Python bytestring
1462
1158
fpr = ctypes.string_at(buf, buf_len.value)
1463
1159
# Convert the bytestring to hexadecimal notation
1464
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1160
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1465
1161
return hex_fpr
1466
1162
1467
1163
1468
class MultiprocessingMixIn(object):
1469
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1470
def sub_process_main(self, request, address):
1471
try:
1472
self.finish_request(request, address)
1473
except:
1474
self.handle_error(request, address)
1475
self.close_request(request)
1476
1477
def process_request(self, request, address):
1478
"""Start a new process to process the request."""
1479
multiprocessing.Process(target = self.sub_process_main,
1480
args = (request, address)).start()
1481
1482
1483
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1484
""" adds a pipe to the MixIn """
1164
class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):
1165
"""Like socketserver.ForkingMixIn, but also pass a pipe pair."""
1485
1166
def process_request(self, request, client_address):
1486
1167
"""Overrides and wraps the original process_request().
1487
1168
1488
1169
This function creates a new pipe in self.pipe
1489
1170
"""
1490
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1491
1492
super(MultiprocessingMixInWithPipe,
1171
# Child writes to child_pipe
1172
self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
1173
# Parent writes to parent_pipe
1174
self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
1175
super(ForkingMixInWithPipes,
1493
1176
self).process_request(request, client_address)
1494
self.child_pipe.close()
1495
self.add_pipe(parent_pipe)
1496
1497
def add_pipe(self, parent_pipe):
1177
# Close unused ends for parent
1178
self.parent_pipe[0].close() # close read end
1179
self.child_pipe[1].close() # close write end
1180
self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])
1181
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1498
1182
"""Dummy function; override as necessary"""
1499
raise NotImplementedError
1500
1501
1502
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1183
child_pipe_fd.close()
1184
parent_pipe_fd.close()
1185
1186
1187
class IPv6_TCPServer(ForkingMixInWithPipes,
1503
1188
socketserver.TCPServer, object):
1504
1189
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1505
1190
1521
1206
bind to an address or port if they were not specified."""
1522
1207
if self.interface is not None:
1523
1208
if SO_BINDTODEVICE is None:
1524
logger.error("SO_BINDTODEVICE does not exist;"
1525
" cannot bind to interface %s",
1209
logger.error(u"SO_BINDTODEVICE does not exist;"
1210
u" cannot bind to interface %s",
1526
1211
self.interface)
1527
1212
else:
1528
1213
try:
1529
1214
self.socket.setsockopt(socket.SOL_SOCKET,
1530
1215
SO_BINDTODEVICE,
1531
1216
str(self.interface
1532
+ '\0'))
1533
except socket.error as error:
1217
+ u'\0'))
1218
except socket.error, error:
1534
1219
if error[0] == errno.EPERM:
1535
logger.error("No permission to"
1536
" bind to interface %s",
1220
logger.error(u"No permission to"
1221
u" bind to interface %s",
1537
1222
self.interface)
1538
1223
elif error[0] == errno.ENOPROTOOPT:
1539
logger.error("SO_BINDTODEVICE not available;"
1540
" cannot bind to interface %s",
1224
logger.error(u"SO_BINDTODEVICE not available;"
1225
u" cannot bind to interface %s",
1541
1226
self.interface)
1542
1227
else:
1543
1228
raise
1545
1230
if self.server_address[0] or self.server_address[1]:
1546
1231
if not self.server_address[0]:
1547
1232
if self.address_family == socket.AF_INET6:
1548
any_address = "::" # in6addr_any
1233
any_address = u"::" # in6addr_any
1549
1234
else:
1550
1235
any_address = socket.INADDR_ANY
1551
1236
self.server_address = (any_address,
1590
1275
return socketserver.TCPServer.server_activate(self)
1591
1276
def enable(self):
1592
1277
self.enabled = True
1593
def add_pipe(self, parent_pipe):
1278
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1594
1279
# Call "handle_ipc" for both data and EOF events
1595
gobject.io_add_watch(parent_pipe.fileno(),
1280
gobject.io_add_watch(child_pipe_fd.fileno(),
1596
1281
gobject.IO_IN | gobject.IO_HUP,
1597
1282
functools.partial(self.handle_ipc,
1598
parent_pipe = parent_pipe))
1599
1600
def handle_ipc(self, source, condition, parent_pipe=None,
1601
client_object=None):
1283
reply = parent_pipe_fd,
1284
sender= child_pipe_fd))
1285
def handle_ipc(self, source, condition, reply=None, sender=None):
1602
1286
condition_names = {
1603
gobject.IO_IN: "IN", # There is data to read.
1604
gobject.IO_OUT: "OUT", # Data can be written (without
1287
gobject.IO_IN: u"IN", # There is data to read.
1288
gobject.IO_OUT: u"OUT", # Data can be written (without
1605
1289
# blocking).
1606
gobject.IO_PRI: "PRI", # There is urgent data to read.
1607
gobject.IO_ERR: "ERR", # Error condition.
1608
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1290
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1291
gobject.IO_ERR: u"ERR", # Error condition.
1292
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1609
1293
# broken, usually for pipes and
1610
1294
# sockets).
1611
1295
}
1613
1297
for cond, name in
1614
1298
condition_names.iteritems()
1615
1299
if cond & condition)
1616
# error or the other end of multiprocessing.Pipe has closed
1617
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1618
return False
1619
1620
# Read a request from the child
1621
request = parent_pipe.recv()
1622
command = request[0]
1623
1624
if command == 'init':
1625
fpr = request[1]
1626
address = request[2]
1627
1628
for c in self.clients:
1629
if c.fingerprint == fpr:
1630
client = c
1631
break
1632
else:
1633
logger.info("Client not found for fingerprint: %s, ad"
1634
"dress: %s", fpr, address)
1635
if self.use_dbus:
1636
# Emit D-Bus signal
1637
mandos_dbus_service.ClientNotFound(fpr, address[0])
1638
parent_pipe.send(False)
1639
return False
1640
1641
gobject.io_add_watch(parent_pipe.fileno(),
1642
gobject.IO_IN | gobject.IO_HUP,
1643
functools.partial(self.handle_ipc,
1644
parent_pipe = parent_pipe,
1645
client_object = client))
1646
parent_pipe.send(True)
1647
# remove the old hook in favor of the new above hook on same fileno
1648
return False
1649
if command == 'funcall':
1650
funcname = request[1]
1651
args = request[2]
1652
kwargs = request[3]
1653
1654
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1655
1656
if command == 'getattr':
1657
attrname = request[1]
1658
if callable(client_object.__getattribute__(attrname)):
1659
parent_pipe.send(('function',))
1660
else:
1661
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1662
1663
if command == 'setattr':
1664
attrname = request[1]
1665
value = request[2]
1666
setattr(client_object, attrname, value)
1667
1300
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1301
conditions_string)
1302
1303
# Read a line from the file object
1304
cmdline = sender.readline()
1305
if not cmdline: # Empty line means end of file
1306
# close the IPC pipes
1307
sender.close()
1308
reply.close()
1309
1310
# Stop calling this function
1311
return False
1312
1313
logger.debug(u"IPC command: %r", cmdline)
1314
1315
# Parse and act on command
1316
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1317
1318
if cmd == u"NOTFOUND":
1319
fpr, address = args.split(None, 1)
1320
logger.warning(u"Client not found for fingerprint: %s, ad"
1321
u"dress: %s", fpr, address)
1322
if self.use_dbus:
1323
# Emit D-Bus signal
1324
mandos_dbus_service.ClientNotFound(fpr, address)
1325
elif cmd == u"DISABLED":
1326
for client in self.clients:
1327
if client.name == args:
1328
logger.warning(u"Client %s is disabled", args)
1329
if self.use_dbus:
1330
# Emit D-Bus signal
1331
client.Rejected()
1332
break
1333
else:
1334
logger.error(u"Unknown client %s is disabled", args)
1335
elif cmd == u"SENDING":
1336
for client in self.clients:
1337
if client.name == args:
1338
logger.info(u"Sending secret to %s", client.name)
1339
client.checked_ok()
1340
if self.use_dbus:
1341
# Emit D-Bus signal
1342
client.GotSecret()
1343
break
1344
else:
1345
logger.error(u"Sending secret to unknown client %s",
1346
args)
1347
elif cmd == u"GETATTR":
1348
attr_name, fpr = args.split(None, 1)
1349
for client in self.clients:
1350
if client.fingerprint == fpr:
1351
attr_value = getattr(client, attr_name, None)
1352
logger.debug("IPC reply: %r", attr_value)
1353
pickle.dump(attr_value, reply)
1354
break
1355
else:
1356
logger.error(u"Client %s on address %s requesting "
1357
u"attribute %s not found", fpr, address,
1358
attr_name)
1359
pickle.dump(None, reply)
1360
else:
1361
logger.error(u"Unknown IPC command: %r", cmdline)
1362
1363
# Keep calling this function
1668
1364
return True
1669
1365
1670
1366
1671
1367
def string_to_delta(interval):
1672
1368
"""Parse a string and return a datetime.timedelta
1673
1369
1674
>>> string_to_delta('7d')
1370
>>> string_to_delta(u'7d')
1675
1371
datetime.timedelta(7)
1676
>>> string_to_delta('60s')
1372
>>> string_to_delta(u'60s')
1677
1373
datetime.timedelta(0, 60)
1678
>>> string_to_delta('60m')
1374
>>> string_to_delta(u'60m')
1679
1375
datetime.timedelta(0, 3600)
1680
>>> string_to_delta('24h')
1376
>>> string_to_delta(u'24h')
1681
1377
datetime.timedelta(1)
1682
>>> string_to_delta('1w')
1378
>>> string_to_delta(u'1w')
1683
1379
datetime.timedelta(7)
1684
>>> string_to_delta('5m 30s')
1380
>>> string_to_delta(u'5m 30s')
1685
1381
datetime.timedelta(0, 330)
1686
1382
"""
1687
1383
timevalue = datetime.timedelta(0)
1689
1385
try:
1690
1386
suffix = unicode(s[-1])
1691
1387
value = int(s[:-1])
1692
if suffix == "d":
1388
if suffix == u"d":
1693
1389
delta = datetime.timedelta(value)
1694
elif suffix == "s":
1390
elif suffix == u"s":
1695
1391
delta = datetime.timedelta(0, value)
1696
elif suffix == "m":
1392
elif suffix == u"m":
1697
1393
delta = datetime.timedelta(0, 0, 0, 0, value)
1698
elif suffix == "h":
1394
elif suffix == u"h":
1699
1395
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1700
elif suffix == "w":
1396
elif suffix == u"w":
1701
1397
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1702
1398
else:
1703
raise ValueError("Unknown suffix %r" % suffix)
1704
except (ValueError, IndexError) as e:
1705
raise ValueError(*(e.args))
1399
raise ValueError(u"Unknown suffix %r" % suffix)
1400
except (ValueError, IndexError), e:
1401
raise ValueError(e.message)
1706
1402
timevalue += delta
1707
1403
return timevalue
1708
1404
1714
1410
global if_nametoindex
1715
1411
try:
1716
1412
if_nametoindex = (ctypes.cdll.LoadLibrary
1717
(ctypes.util.find_library("c"))
1413
(ctypes.util.find_library(u"c"))
1718
1414
.if_nametoindex)
1719
1415
except (OSError, AttributeError):
1720
logger.warning("Doing if_nametoindex the hard way")
1416
logger.warning(u"Doing if_nametoindex the hard way")
1721
1417
def if_nametoindex(interface):
1722
1418
"Get an interface index the hard way, i.e. using fcntl()"
1723
1419
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1724
1420
with contextlib.closing(socket.socket()) as s:
1725
1421
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1726
struct.pack(str("16s16x"),
1422
struct.pack(str(u"16s16x"),
1727
1423
interface))
1728
interface_index = struct.unpack(str("I"),
1424
interface_index = struct.unpack(str(u"I"),
1729
1425
ifreq[16:20])[0]
1730
1426
return interface_index
1731
1427
return if_nametoindex(interface)
1739
1435
sys.exit()
1740
1436
os.setsid()
1741
1437
if not nochdir:
1742
os.chdir("/")
1438
os.chdir(u"/")
1743
1439
if os.fork():
1744
1440
sys.exit()
1745
1441
if not noclose:
1747
1443
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1748
1444
if not stat.S_ISCHR(os.fstat(null).st_mode):
1749
1445
raise OSError(errno.ENODEV,
1750
"%s not a character device"
1446
u"%s not a character device"
1751
1447
% os.path.devnull)
1752
1448
os.dup2(null, sys.stdin.fileno())
1753
1449
os.dup2(null, sys.stdout.fileno())
1761
1457
##################################################################
1762
1458
# Parsing of options, both command line and config file
1763
1459
1764
parser = argparse.ArgumentParser()
1765
parser.add_argument("-v", "--version", action="version",
1766
version = "%%(prog)s %s" % version,
1767
help="show version number and exit")
1768
parser.add_argument("-i", "--interface", metavar="IF",
1769
help="Bind to interface IF")
1770
parser.add_argument("-a", "--address",
1771
help="Address to listen for requests on")
1772
parser.add_argument("-p", "--port", type=int,
1773
help="Port number to receive requests on")
1774
parser.add_argument("--check", action="store_true",
1775
help="Run self-test")
1776
parser.add_argument("--debug", action="store_true",
1777
help="Debug mode; run in foreground and log"
1778
" to terminal")
1779
parser.add_argument("--debuglevel", metavar="LEVEL",
1780
help="Debug level for stdout output")
1781
parser.add_argument("--priority", help="GnuTLS"
1782
" priority string (see GnuTLS documentation)")
1783
parser.add_argument("--servicename",
1784
metavar="NAME", help="Zeroconf service name")
1785
parser.add_argument("--configdir",
1786
default="/etc/mandos", metavar="DIR",
1787
help="Directory to search for configuration"
1788
" files")
1789
parser.add_argument("--no-dbus", action="store_false",
1790
dest="use_dbus", help="Do not provide D-Bus"
1791
" system bus interface")
1792
parser.add_argument("--no-ipv6", action="store_false",
1793
dest="use_ipv6", help="Do not use IPv6")
1794
options = parser.parse_args()
1460
parser = optparse.OptionParser(version = "%%prog %s" % version)
1461
parser.add_option("-i", u"--interface", type=u"string",
1462
metavar="IF", help=u"Bind to interface IF")
1463
parser.add_option("-a", u"--address", type=u"string",
1464
help=u"Address to listen for requests on")
1465
parser.add_option("-p", u"--port", type=u"int",
1466
help=u"Port number to receive requests on")
1467
parser.add_option("--check", action=u"store_true",
1468
help=u"Run self-test")
1469
parser.add_option("--debug", action=u"store_true",
1470
help=u"Debug mode; run in foreground and log to"
1471
u" terminal")
1472
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1473
u" priority string (see GnuTLS documentation)")
1474
parser.add_option("--servicename", type=u"string",
1475
metavar=u"NAME", help=u"Zeroconf service name")
1476
parser.add_option("--configdir", type=u"string",
1477
default=u"/etc/mandos", metavar=u"DIR",
1478
help=u"Directory to search for configuration"
1479
u" files")
1480
parser.add_option("--no-dbus", action=u"store_false",
1481
dest=u"use_dbus", help=u"Do not provide D-Bus"
1482
u" system bus interface")
1483
parser.add_option("--no-ipv6", action=u"store_false",
1484
dest=u"use_ipv6", help=u"Do not use IPv6")
1485
options = parser.parse_args()[0]
1795
1486
1796
1487
if options.check:
1797
1488
import doctest
1799
1490
sys.exit()
1800
1491
1801
1492
# Default values for config file for server-global settings
1802
server_defaults = { "interface": "",
1803
"address": "",
1804
"port": "",
1805
"debug": "False",
1806
"priority":
1807
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1808
"servicename": "Mandos",
1809
"use_dbus": "True",
1810
"use_ipv6": "True",
1811
"debuglevel": "",
1493
server_defaults = { u"interface": u"",
1494
u"address": u"",
1495
u"port": u"",
1496
u"debug": u"False",
1497
u"priority":
1498
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1499
u"servicename": u"Mandos",
1500
u"use_dbus": u"True",
1501
u"use_ipv6": u"True",
1812
1502
}
1813
1503
1814
1504
# Parse config file for server-global settings
1815
1505
server_config = configparser.SafeConfigParser(server_defaults)
1816
1506
del server_defaults
1817
1507
server_config.read(os.path.join(options.configdir,
1818
"mandos.conf"))
1508
u"mandos.conf"))
1819
1509
# Convert the SafeConfigParser object to a dict
1820
1510
server_settings = server_config.defaults()
1821
1511
# Use the appropriate methods on the non-string config options
1822
for option in ("debug", "use_dbus", "use_ipv6"):
1823
server_settings[option] = server_config.getboolean("DEFAULT",
1512
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1513
server_settings[option] = server_config.getboolean(u"DEFAULT",
1824
1514
option)
1825
1515
if server_settings["port"]:
1826
server_settings["port"] = server_config.getint("DEFAULT",
1827
"port")
1516
server_settings["port"] = server_config.getint(u"DEFAULT",
1517
u"port")
1828
1518
del server_config
1829
1519
1830
1520
# Override the settings from the config file with command line
1831
1521
# options, if set.
1832
for option in ("interface", "address", "port", "debug",
1833
"priority", "servicename", "configdir",
1834
"use_dbus", "use_ipv6", "debuglevel"):
1522
for option in (u"interface", u"address", u"port", u"debug",
1523
u"priority", u"servicename", u"configdir",
1524
u"use_dbus", u"use_ipv6"):
1835
1525
value = getattr(options, option)
1836
1526
if value is not None:
1837
1527
server_settings[option] = value
1845
1535
##################################################################
1846
1536
1847
1537
# For convenience
1848
debug = server_settings["debug"]
1849
debuglevel = server_settings["debuglevel"]
1850
use_dbus = server_settings["use_dbus"]
1851
use_ipv6 = server_settings["use_ipv6"]
1852
1853
if server_settings["servicename"] != "Mandos":
1538
debug = server_settings[u"debug"]
1539
use_dbus = server_settings[u"use_dbus"]
1540
use_ipv6 = server_settings[u"use_ipv6"]
1541
1542
if not debug:
1543
syslogger.setLevel(logging.WARNING)
1544
console.setLevel(logging.WARNING)
1545
1546
if server_settings[u"servicename"] != u"Mandos":
1854
1547
syslogger.setFormatter(logging.Formatter
1855
('Mandos (%s) [%%(process)d]:'
1856
' %%(levelname)s: %%(message)s'
1857
% server_settings["servicename"]))
1548
(u'Mandos (%s) [%%(process)d]:'
1549
u' %%(levelname)s: %%(message)s'
1550
% server_settings[u"servicename"]))
1858
1551
1859
1552
# Parse config file with clients
1860
client_defaults = { "timeout": "5m",
1861
"extended_timeout": "15m",
1862
"interval": "2m",
1863
"checker": "fping -q -- %%(host)s",
1864
"host": "",
1865
"approval_delay": "0s",
1866
"approval_duration": "1s",
1553
client_defaults = { u"timeout": u"1h",
1554
u"interval": u"5m",
1555
u"checker": u"fping -q -- %%(host)s",
1556
u"host": u"",
1867
1557
}
1868
1558
client_config = configparser.SafeConfigParser(client_defaults)
1869
client_config.read(os.path.join(server_settings["configdir"],
1870
"clients.conf"))
1559
client_config.read(os.path.join(server_settings[u"configdir"],
1560
u"clients.conf"))
1871
1561
1872
1562
global mandos_dbus_service
1873
1563
mandos_dbus_service = None
1874
1564
1875
tcp_server = MandosServer((server_settings["address"],
1876
server_settings["port"]),
1565
tcp_server = MandosServer((server_settings[u"address"],
1566
server_settings[u"port"]),
1877
1567
ClientHandler,
1878
interface=(server_settings["interface"]
1568
interface=(server_settings[u"interface"]
1879
1569
or None),
1880
1570
use_ipv6=use_ipv6,
1881
1571
gnutls_priority=
1882
server_settings["priority"],
1572
server_settings[u"priority"],
1883
1573
use_dbus=use_dbus)
1884
if not debug:
1885
pidfilename = "/var/run/mandos.pid"
1886
try:
1887
pidfile = open(pidfilename, "w")
1888
except IOError:
1889
logger.error("Could not open file %r", pidfilename)
1574
pidfilename = u"/var/run/mandos.pid"
1575
try:
1576
pidfile = open(pidfilename, u"w")
1577
except IOError:
1578
logger.error(u"Could not open file %r", pidfilename)
1890
1579
1891
1580
try:
1892
uid = pwd.getpwnam("_mandos").pw_uid
1893
gid = pwd.getpwnam("_mandos").pw_gid
1581
uid = pwd.getpwnam(u"_mandos").pw_uid
1582
gid = pwd.getpwnam(u"_mandos").pw_gid
1894
1583
except KeyError:
1895
1584
try:
1896
uid = pwd.getpwnam("mandos").pw_uid
1897
gid = pwd.getpwnam("mandos").pw_gid
1585
uid = pwd.getpwnam(u"mandos").pw_uid
1586
gid = pwd.getpwnam(u"mandos").pw_gid
1898
1587
except KeyError:
1899
1588
try:
1900
uid = pwd.getpwnam("nobody").pw_uid
1901
gid = pwd.getpwnam("nobody").pw_gid
1589
uid = pwd.getpwnam(u"nobody").pw_uid
1590
gid = pwd.getpwnam(u"nobody").pw_gid
1902
1591
except KeyError:
1903
1592
uid = 65534
1904
1593
gid = 65534
1905
1594
try:
1906
1595
os.setgid(gid)
1907
1596
os.setuid(uid)
1908
except OSError as error:
1597
except OSError, error:
1909
1598
if error[0] != errno.EPERM:
1910
1599
raise error
1911
1600
1912
if not debug and not debuglevel:
1913
syslogger.setLevel(logging.WARNING)
1914
console.setLevel(logging.WARNING)
1915
if debuglevel:
1916
level = getattr(logging, debuglevel.upper())
1917
syslogger.setLevel(level)
1918
console.setLevel(level)
1919
1601
# Enable all possible GnuTLS debugging
1920
1602
if debug:
1921
# Enable all possible GnuTLS debugging
1922
1923
1603
# "Use a log level over 10 to enable all debugging options."
1924
1604
# - GnuTLS manual
1925
1605
gnutls.library.functions.gnutls_global_set_log_level(11)
1926
1606
1927
1607
@gnutls.library.types.gnutls_log_func
1928
1608
def debug_gnutls(level, string):
1929
logger.debug("GnuTLS: %s", string[:-1])
1609
logger.debug(u"GnuTLS: %s", string[:-1])
1930
1610
1931
1611
(gnutls.library.functions
1932
1612
.gnutls_global_set_log_function(debug_gnutls))
1933
1934
# Redirect stdin so all checkers get /dev/null
1935
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1936
os.dup2(null, sys.stdin.fileno())
1937
if null > 2:
1938
os.close(null)
1939
else:
1940
# No console logging
1941
logger.removeHandler(console)
1942
1943
# Need to fork before connecting to D-Bus
1944
if not debug:
1945
# Close all input and output, do double fork, etc.
1946
daemon()
1947
1613
1948
1614
global main_loop
1949
1615
# From the Avahi example code
1953
1619
# End of Avahi example code
1954
1620
if use_dbus:
1955
1621
try:
1956
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1957
bus, do_not_queue=True)
1958
bus_name2 = dbus.service.BusName("se.recompile.Mandos",
1959
bus, do_not_queue=True)
1960
except dbus.exceptions.NameExistsException as e:
1961
logger.error(unicode(e) + ", disabling D-Bus")
1622
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1623
bus, do_not_queue=True)
1624
except dbus.exceptions.NameExistsException, e:
1625
logger.error(unicode(e) + u", disabling D-Bus")
1962
1626
use_dbus = False
1963
server_settings["use_dbus"] = False
1627
server_settings[u"use_dbus"] = False
1964
1628
tcp_server.use_dbus = False
1965
1629
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1966
service = AvahiService(name = server_settings["servicename"],
1967
servicetype = "_mandos._tcp",
1630
service = AvahiService(name = server_settings[u"servicename"],
1631
servicetype = u"_mandos._tcp",
1968
1632
protocol = protocol, bus = bus)
1969
1633
if server_settings["interface"]:
1970
1634
service.interface = (if_nametoindex
1971
(str(server_settings["interface"])))
1972
1973
global multiprocessing_manager
1974
multiprocessing_manager = multiprocessing.Manager()
1635
(str(server_settings[u"interface"])))
1975
1636
1976
1637
client_class = Client
1977
1638
if use_dbus:
1978
1639
client_class = functools.partial(ClientDBus, bus = bus)
1979
def client_config_items(config, section):
1980
special_settings = {
1981
"approved_by_default":
1982
lambda: config.getboolean(section,
1983
"approved_by_default"),
1984
}
1985
for name, value in config.items(section):
1986
try:
1987
yield (name, special_settings[name]())
1988
except KeyError:
1989
yield (name, value)
1990
1991
1640
tcp_server.clients.update(set(
1992
1641
client_class(name = section,
1993
config= dict(client_config_items(
1994
client_config, section)))
1642
config= dict(client_config.items(section)))
1995
1643
for section in client_config.sections()))
1996
1644
if not tcp_server.clients:
1997
logger.warning("No clients defined")
1998
1645
logger.warning(u"No clients defined")
1646
1647
if debug:
1648
# Redirect stdin so all checkers get /dev/null
1649
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1650
os.dup2(null, sys.stdin.fileno())
1651
if null > 2:
1652
os.close(null)
1653
else:
1654
# No console logging
1655
logger.removeHandler(console)
1656
# Close all input and output, do double fork, etc.
1657
daemon()
1658
1659
try:
1660
with pidfile:
1661
pid = os.getpid()
1662
pidfile.write(str(pid) + "\n")
1663
del pidfile
1664
except IOError:
1665
logger.error(u"Could not write to file %r with PID %d",
1666
pidfilename, pid)
1667
except NameError:
1668
# "pidfile" was never created
1669
pass
1670
del pidfilename
1671
1999
1672
if not debug:
2000
try:
2001
with pidfile:
2002
pid = os.getpid()
2003
pidfile.write(str(pid) + "\n".encode("utf-8"))
2004
del pidfile
2005
except IOError:
2006
logger.error("Could not write to file %r with PID %d",
2007
pidfilename, pid)
2008
except NameError:
2009
# "pidfile" was never created
2010
pass
2011
del pidfilename
2012
2013
1673
signal.signal(signal.SIGINT, signal.SIG_IGN)
2014
2015
1674
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2016
1675
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2017
1676
2019
1678
class MandosDBusService(dbus.service.Object):
2020
1679
"""A D-Bus proxy object"""
2021
1680
def __init__(self):
2022
dbus.service.Object.__init__(self, bus, "/")
2023
_interface = "se.bsnet.fukt.Mandos"
1681
dbus.service.Object.__init__(self, bus, u"/")
1682
_interface = u"se.bsnet.fukt.Mandos"
2024
1683
2025
@dbus.service.signal(_interface, signature="o")
1684
@dbus.service.signal(_interface, signature=u"o")
2026
1685
def ClientAdded(self, objpath):
2027
1686
"D-Bus signal"
2028
1687
pass
2029
1688
2030
@dbus.service.signal(_interface, signature="ss")
1689
@dbus.service.signal(_interface, signature=u"ss")
2031
1690
def ClientNotFound(self, fingerprint, address):
2032
1691
"D-Bus signal"
2033
1692
pass
2034
1693
2035
@dbus.service.signal(_interface, signature="os")
1694
@dbus.service.signal(_interface, signature=u"os")
2036
1695
def ClientRemoved(self, objpath, name):
2037
1696
"D-Bus signal"
2038
1697
pass
2039
1698
2040
@dbus.service.method(_interface, out_signature="ao")
1699
@dbus.service.method(_interface, out_signature=u"ao")
2041
1700
def GetAllClients(self):
2042
1701
"D-Bus method"
2043
1702
return dbus.Array(c.dbus_object_path
2044
1703
for c in tcp_server.clients)
2045
1704
2046
1705
@dbus.service.method(_interface,
2047
out_signature="a{oa{sv}}")
1706
out_signature=u"a{oa{sv}}")
2048
1707
def GetAllClientsWithProperties(self):
2049
1708
"D-Bus method"
2050
1709
return dbus.Dictionary(
2051
((c.dbus_object_path, c.GetAll(""))
1710
((c.dbus_object_path, c.GetAll(u""))
2052
1711
for c in tcp_server.clients),
2053
signature="oa{sv}")
1712
signature=u"oa{sv}")
2054
1713
2055
@dbus.service.method(_interface, in_signature="o")
1714
@dbus.service.method(_interface, in_signature=u"o")
2056
1715
def RemoveClient(self, object_path):
2057
1716
"D-Bus method"
2058
1717
for c in tcp_server.clients:
2100
1759
# Find out what port we got
2101
1760
service.port = tcp_server.socket.getsockname()[1]
2102
1761
if use_ipv6:
2103
logger.info("Now listening on address %r, port %d,"
1762
logger.info(u"Now listening on address %r, port %d,"
2104
1763
" flowinfo %d, scope_id %d"
2105
1764
% tcp_server.socket.getsockname())
2106
1765
else: # IPv4
2107
logger.info("Now listening on address %r, port %d"
1766
logger.info(u"Now listening on address %r, port %d"
2108
1767
% tcp_server.socket.getsockname())
2109
1768
2110
1769
#service.interface = tcp_server.socket.getsockname()[3]
2113
1772
# From the Avahi example code
2114
1773
try:
2115
1774
service.activate()
2116
except dbus.exceptions.DBusException as error:
2117
logger.critical("DBusException: %s", error)
1775
except dbus.exceptions.DBusException, error:
1776
logger.critical(u"DBusException: %s", error)
2118
1777
cleanup()
2119
1778
sys.exit(1)
2120
1779
# End of Avahi example code
2124
1783
(tcp_server.handle_request
2125
1784
(*args[2:], **kwargs) or True))
2126
1785
2127
logger.debug("Starting main loop")
1786
logger.debug(u"Starting main loop")
2128
1787
main_loop.run()
2129
except AvahiError as error:
2130
logger.critical("AvahiError: %s", error)
1788
except AvahiError, error:
1789
logger.critical(u"AvahiError: %s", error)
2131
1790
cleanup()
2132
1791
sys.exit(1)
2133
1792
except KeyboardInterrupt:
2134
1793
if debug:
2135
print("", file=sys.stderr)
2136
logger.debug("Server received KeyboardInterrupt")
2137
logger.debug("Server exiting")
1794
print >> sys.stderr
1795
logger.debug(u"Server received KeyboardInterrupt")
1796
logger.debug(u"Server exiting")
2138
1797
# Must run before the D-Bus bus name gets deregistered
2139
1798
cleanup()
2140
1799
2141
2142
1800
if __name__ == '__main__':
2143
1801
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0