To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 419
- compare with another revision
- download diff
- download tarball
- view history from revision 419
- Committer: teddy at bsnet
- Date: 2010-09-09 18:16:14 UTC
- mfrom: (237.2.35 mandos-empty-device)
- Revision ID: teddy@fukt.bsnet.se-20100909181614-oanlmvkzsiodbo3c
Merge in branch to interpret an empty device name to mean
"autodetect".
"autodetect".
- files removed:
- DBUS-API
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
31
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
36
import SocketServer as socketserver
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
61
60
import fcntl
62
61
import functools
63
62
import cPickle as pickle
64
import multiprocessing
65
import types
63
import select
66
64
67
65
import dbus
68
66
import dbus.service
83
81
SO_BINDTODEVICE = None
84
82
85
83
86
version = "1.3.1"
84
version = "1.0.14"
87
85
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
86
logger = logging.Logger(u'mandos')
90
87
syslogger = (logging.handlers.SysLogHandler
91
88
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
address = str("/dev/log")))
89
address = "/dev/log"))
93
90
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
91
(u'Mandos [%(process)d]: %(levelname)s:'
92
u' %(message)s'))
96
93
logger.addHandler(syslogger)
97
94
98
95
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
96
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
97
u' %(levelname)s:'
98
u' %(message)s'))
102
99
logger.addHandler(console)
103
100
104
101
class AvahiError(Exception):
121
118
Attributes:
122
119
interface: integer; avahi.IF_UNSPEC or an interface index.
123
120
Used to optionally bind to the specified interface.
124
name: string; Example: 'Mandos'
125
type: string; Example: '_mandos._tcp'.
121
name: string; Example: u'Mandos'
122
type: string; Example: u'_mandos._tcp'.
126
123
See <http://www.dns-sd.org/ServiceTypes.html>
127
124
port: integer; what port to announce
128
125
TXT: list of strings; TXT record for the service
137
134
"""
138
135
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
139
136
servicetype = None, port = None, TXT = None,
140
domain = "", host = "", max_renames = 32768,
137
domain = u"", host = u"", max_renames = 32768,
141
138
protocol = avahi.PROTO_UNSPEC, bus = None):
142
139
self.interface = interface
143
140
self.name = name
152
149
self.group = None # our entry group
153
150
self.server = None
154
151
self.bus = bus
155
self.entry_group_state_changed_match = None
156
152
def rename(self):
157
153
"""Derived from the Avahi example code"""
158
154
if self.rename_count >= self.max_renames:
159
logger.critical("No suitable Zeroconf service name found"
160
" after %i retries, exiting.",
155
logger.critical(u"No suitable Zeroconf service name found"
156
u" after %i retries, exiting.",
161
157
self.rename_count)
162
raise AvahiServiceError("Too many renames")
163
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
164
logger.info("Changing Zeroconf service name to %r ...",
165
self.name)
158
raise AvahiServiceError(u"Too many renames")
159
self.name = self.server.GetAlternativeServiceName(self.name)
160
logger.info(u"Changing Zeroconf service name to %r ...",
161
unicode(self.name))
166
162
syslogger.setFormatter(logging.Formatter
167
('Mandos (%s) [%%(process)d]:'
168
' %%(levelname)s: %%(message)s'
163
(u'Mandos (%s) [%%(process)d]:'
164
u' %%(levelname)s: %%(message)s'
169
165
% self.name))
170
166
self.remove()
171
try:
172
self.add()
173
except dbus.exceptions.DBusException as error:
174
logger.critical("DBusException: %s", error)
175
self.cleanup()
176
os._exit(1)
167
self.add()
177
168
self.rename_count += 1
178
169
def remove(self):
179
170
"""Derived from the Avahi example code"""
180
if self.entry_group_state_changed_match is not None:
181
self.entry_group_state_changed_match.remove()
182
self.entry_group_state_changed_match = None
183
171
if self.group is not None:
184
172
self.group.Reset()
185
173
def add(self):
186
174
"""Derived from the Avahi example code"""
187
self.remove()
188
175
if self.group is None:
189
176
self.group = dbus.Interface(
190
177
self.bus.get_object(avahi.DBUS_NAME,
191
178
self.server.EntryGroupNew()),
192
179
avahi.DBUS_INTERFACE_ENTRY_GROUP)
193
self.entry_group_state_changed_match = (
194
self.group.connect_to_signal(
195
'StateChanged', self .entry_group_state_changed))
196
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
180
self.group.connect_to_signal('StateChanged',
181
self
182
.entry_group_state_changed)
183
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
197
184
self.name, self.type)
198
185
self.group.AddService(
199
186
self.interface,
206
193
self.group.Commit()
207
194
def entry_group_state_changed(self, state, error):
208
195
"""Derived from the Avahi example code"""
209
logger.debug("Avahi entry group state change: %i", state)
196
logger.debug(u"Avahi entry group state change: %i", state)
210
197
211
198
if state == avahi.ENTRY_GROUP_ESTABLISHED:
212
logger.debug("Zeroconf service established.")
199
logger.debug(u"Zeroconf service established.")
213
200
elif state == avahi.ENTRY_GROUP_COLLISION:
214
logger.info("Zeroconf service name collision.")
201
logger.warning(u"Zeroconf service name collision.")
215
202
self.rename()
216
203
elif state == avahi.ENTRY_GROUP_FAILURE:
217
logger.critical("Avahi: Error in group state changed %s",
204
logger.critical(u"Avahi: Error in group state changed %s",
218
205
unicode(error))
219
raise AvahiGroupError("State changed: %s"
206
raise AvahiGroupError(u"State changed: %s"
220
207
% unicode(error))
221
208
def cleanup(self):
222
209
"""Derived from the Avahi example code"""
223
210
if self.group is not None:
224
try:
225
self.group.Free()
226
except (dbus.exceptions.UnknownMethodException,
227
dbus.exceptions.DBusException) as e:
228
pass
211
self.group.Free()
229
212
self.group = None
230
self.remove()
231
def server_state_changed(self, state, error=None):
213
def server_state_changed(self, state):
232
214
"""Derived from the Avahi example code"""
233
logger.debug("Avahi server state change: %i", state)
234
bad_states = { avahi.SERVER_INVALID:
235
"Zeroconf server invalid",
236
avahi.SERVER_REGISTERING: None,
237
avahi.SERVER_COLLISION:
238
"Zeroconf server name collision",
239
avahi.SERVER_FAILURE:
240
"Zeroconf server failure" }
241
if state in bad_states:
242
if bad_states[state] is not None:
243
if error is None:
244
logger.error(bad_states[state])
245
else:
246
logger.error(bad_states[state] + ": %r", error)
247
self.cleanup()
215
logger.debug(u"Avahi server state change: %i", state)
216
if state == avahi.SERVER_COLLISION:
217
logger.error(u"Zeroconf server name collision")
218
self.remove()
248
219
elif state == avahi.SERVER_RUNNING:
249
220
self.add()
250
else:
251
if error is None:
252
logger.debug("Unknown state: %r", state)
253
else:
254
logger.debug("Unknown state: %r: %r", state, error)
255
221
def activate(self):
256
222
"""Derived from the Avahi example code"""
257
223
if self.server is None:
258
224
self.server = dbus.Interface(
259
225
self.bus.get_object(avahi.DBUS_NAME,
260
avahi.DBUS_PATH_SERVER,
261
follow_name_owner_changes=True),
226
avahi.DBUS_PATH_SERVER),
262
227
avahi.DBUS_INTERFACE_SERVER)
263
self.server.connect_to_signal("StateChanged",
228
self.server.connect_to_signal(u"StateChanged",
264
229
self.server_state_changed)
265
230
self.server_state_changed(self.server.GetState())
266
231
267
232
268
def _timedelta_to_milliseconds(td):
269
"Convert a datetime.timedelta() to milliseconds"
270
return ((td.days * 24 * 60 * 60 * 1000)
271
+ (td.seconds * 1000)
272
+ (td.microseconds // 1000))
273
274
233
class Client(object):
275
234
"""A representation of a client host served by this server.
276
235
277
236
Attributes:
278
_approved: bool(); 'None' if not yet approved/disapproved
279
approval_delay: datetime.timedelta(); Time to wait for approval
280
approval_duration: datetime.timedelta(); Duration of one approval
237
name: string; from the config file, used in log messages and
238
D-Bus identifiers
239
fingerprint: string (40 or 32 hexadecimal digits); used to
240
uniquely identify the client
241
secret: bytestring; sent verbatim (over TLS) to client
242
host: string; available for use by the checker command
243
created: datetime.datetime(); (UTC) object creation
244
last_enabled: datetime.datetime(); (UTC)
245
enabled: bool()
246
last_checked_ok: datetime.datetime(); (UTC) or None
247
timeout: datetime.timedelta(); How long from last_checked_ok
248
until this client is disabled
249
interval: datetime.timedelta(); How often to start a new checker
250
disable_hook: If set, called by disable() as disable_hook(self)
281
251
checker: subprocess.Popen(); a running checker process used
282
252
to see if the client lives.
283
253
'None' if no process is running.
284
checker_callback_tag: a gobject event source tag, or None
285
checker_command: string; External command which is run to check
286
if client lives. %() expansions are done at
254
checker_initiator_tag: a gobject event source tag, or None
255
disable_initiator_tag: - '' -
256
checker_callback_tag: - '' -
257
checker_command: string; External command which is run to check if
258
client lives. %() expansions are done at
287
259
runtime with vars(self) as dict, so that for
288
260
instance %(name)s can be used in the command.
289
checker_initiator_tag: a gobject event source tag, or None
290
created: datetime.datetime(); (UTC) object creation
291
261
current_checker_command: string; current running checker_command
292
disable_hook: If set, called by disable() as disable_hook(self)
293
disable_initiator_tag: a gobject event source tag, or None
294
enabled: bool()
295
fingerprint: string (40 or 32 hexadecimal digits); used to
296
uniquely identify the client
297
host: string; available for use by the checker command
298
interval: datetime.timedelta(); How often to start a new checker
299
last_approval_request: datetime.datetime(); (UTC) or None
300
last_checked_ok: datetime.datetime(); (UTC) or None
301
last_enabled: datetime.datetime(); (UTC)
302
name: string; from the config file, used in log messages and
303
D-Bus identifiers
304
secret: bytestring; sent verbatim (over TLS) to client
305
timeout: datetime.timedelta(); How long from last_checked_ok
306
until this client is disabled
307
extended_timeout: extra long timeout when password has been sent
308
runtime_expansions: Allowed attributes for runtime expansion.
309
expires: datetime.datetime(); time (UTC) when a client will be
310
disabled, or None
311
262
"""
312
263
313
runtime_expansions = ("approval_delay", "approval_duration",
314
"created", "enabled", "fingerprint",
315
"host", "interval", "last_checked_ok",
316
"last_enabled", "name", "timeout")
264
@staticmethod
265
def _timedelta_to_milliseconds(td):
266
"Convert a datetime.timedelta() to milliseconds"
267
return ((td.days * 24 * 60 * 60 * 1000)
268
+ (td.seconds * 1000)
269
+ (td.microseconds // 1000))
317
270
318
271
def timeout_milliseconds(self):
319
272
"Return the 'timeout' attribute in milliseconds"
320
return _timedelta_to_milliseconds(self.timeout)
321
322
def extended_timeout_milliseconds(self):
323
"Return the 'extended_timeout' attribute in milliseconds"
324
return _timedelta_to_milliseconds(self.extended_timeout)
273
return self._timedelta_to_milliseconds(self.timeout)
325
274
326
275
def interval_milliseconds(self):
327
276
"Return the 'interval' attribute in milliseconds"
328
return _timedelta_to_milliseconds(self.interval)
329
330
def approval_delay_milliseconds(self):
331
return _timedelta_to_milliseconds(self.approval_delay)
277
return self._timedelta_to_milliseconds(self.interval)
332
278
333
279
def __init__(self, name = None, disable_hook=None, config=None):
334
280
"""Note: the 'checker' key in 'config' sets the
337
283
self.name = name
338
284
if config is None:
339
285
config = {}
340
logger.debug("Creating client %r", self.name)
286
logger.debug(u"Creating client %r", self.name)
341
287
# Uppercase and remove spaces from fingerprint for later
342
288
# comparison purposes with return value from the fingerprint()
343
289
# function
344
self.fingerprint = (config["fingerprint"].upper()
345
.replace(" ", ""))
346
logger.debug(" Fingerprint: %s", self.fingerprint)
347
if "secret" in config:
348
self.secret = config["secret"].decode("base64")
349
elif "secfile" in config:
290
self.fingerprint = (config[u"fingerprint"].upper()
291
.replace(u" ", u""))
292
logger.debug(u" Fingerprint: %s", self.fingerprint)
293
if u"secret" in config:
294
self.secret = config[u"secret"].decode(u"base64")
295
elif u"secfile" in config:
350
296
with open(os.path.expanduser(os.path.expandvars
351
(config["secfile"])),
297
(config[u"secfile"])),
352
298
"rb") as secfile:
353
299
self.secret = secfile.read()
354
300
else:
355
raise TypeError("No secret or secfile for client %s"
301
raise TypeError(u"No secret or secfile for client %s"
356
302
% self.name)
357
self.host = config.get("host", "")
303
self.host = config.get(u"host", u"")
358
304
self.created = datetime.datetime.utcnow()
359
305
self.enabled = False
360
self.last_approval_request = None
361
306
self.last_enabled = None
362
307
self.last_checked_ok = None
363
self.timeout = string_to_delta(config["timeout"])
364
self.extended_timeout = string_to_delta(config["extended_timeout"])
365
self.interval = string_to_delta(config["interval"])
308
self.timeout = string_to_delta(config[u"timeout"])
309
self.interval = string_to_delta(config[u"interval"])
366
310
self.disable_hook = disable_hook
367
311
self.checker = None
368
312
self.checker_initiator_tag = None
369
313
self.disable_initiator_tag = None
370
self.expires = None
371
314
self.checker_callback_tag = None
372
self.checker_command = config["checker"]
315
self.checker_command = config[u"checker"]
373
316
self.current_checker_command = None
374
317
self.last_connect = None
375
self._approved = None
376
self.approved_by_default = config.get("approved_by_default",
377
True)
378
self.approvals_pending = 0
379
self.approval_delay = string_to_delta(
380
config["approval_delay"])
381
self.approval_duration = string_to_delta(
382
config["approval_duration"])
383
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
384
318
385
def send_changedstate(self):
386
self.changedstate.acquire()
387
self.changedstate.notify_all()
388
self.changedstate.release()
389
390
319
def enable(self):
391
320
"""Start this client's checker and timeout hooks"""
392
if getattr(self, "enabled", False):
321
if getattr(self, u"enabled", False):
393
322
# Already enabled
394
323
return
395
self.send_changedstate()
324
self.last_enabled = datetime.datetime.utcnow()
396
325
# Schedule a new checker to be started an 'interval' from now,
397
326
# and every interval from then on.
398
327
self.checker_initiator_tag = (gobject.timeout_add
399
328
(self.interval_milliseconds(),
400
329
self.start_checker))
401
330
# Schedule a disable() when 'timeout' has passed
402
self.expires = datetime.datetime.utcnow() + self.timeout
403
331
self.disable_initiator_tag = (gobject.timeout_add
404
332
(self.timeout_milliseconds(),
405
333
self.disable))
406
334
self.enabled = True
407
self.last_enabled = datetime.datetime.utcnow()
408
335
# Also start a new checker *right now*.
409
336
self.start_checker()
410
337
413
340
if not getattr(self, "enabled", False):
414
341
return False
415
342
if not quiet:
416
self.send_changedstate()
417
if not quiet:
418
logger.info("Disabling client %s", self.name)
419
if getattr(self, "disable_initiator_tag", False):
343
logger.info(u"Disabling client %s", self.name)
344
if getattr(self, u"disable_initiator_tag", False):
420
345
gobject.source_remove(self.disable_initiator_tag)
421
346
self.disable_initiator_tag = None
422
self.expires = None
423
if getattr(self, "checker_initiator_tag", False):
347
if getattr(self, u"checker_initiator_tag", False):
424
348
gobject.source_remove(self.checker_initiator_tag)
425
349
self.checker_initiator_tag = None
426
350
self.stop_checker()
441
365
if os.WIFEXITED(condition):
442
366
exitstatus = os.WEXITSTATUS(condition)
443
367
if exitstatus == 0:
444
logger.info("Checker for %(name)s succeeded",
368
logger.info(u"Checker for %(name)s succeeded",
445
369
vars(self))
446
370
self.checked_ok()
447
371
else:
448
logger.info("Checker for %(name)s failed",
372
logger.info(u"Checker for %(name)s failed",
449
373
vars(self))
450
374
else:
451
logger.warning("Checker for %(name)s crashed?",
375
logger.warning(u"Checker for %(name)s crashed?",
452
376
vars(self))
453
377
454
def checked_ok(self, timeout=None):
378
def checked_ok(self):
455
379
"""Bump up the timeout for this client.
456
380
457
381
This should only be called when the client has been seen,
458
382
alive and well.
459
383
"""
460
if timeout is None:
461
timeout = self.timeout
462
384
self.last_checked_ok = datetime.datetime.utcnow()
463
385
gobject.source_remove(self.disable_initiator_tag)
464
self.expires = datetime.datetime.utcnow() + timeout
465
386
self.disable_initiator_tag = (gobject.timeout_add
466
(_timedelta_to_milliseconds(timeout),
387
(self.timeout_milliseconds(),
467
388
self.disable))
468
389
469
def need_approval(self):
470
self.last_approval_request = datetime.datetime.utcnow()
471
472
390
def start_checker(self):
473
391
"""Start a new checker subprocess if one is not running.
474
392
486
404
# If a checker exists, make sure it is not a zombie
487
405
try:
488
406
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
489
except (AttributeError, OSError) as error:
407
except (AttributeError, OSError), error:
490
408
if (isinstance(error, OSError)
491
409
and error.errno != errno.ECHILD):
492
410
raise error
493
411
else:
494
412
if pid:
495
logger.warning("Checker was a zombie")
413
logger.warning(u"Checker was a zombie")
496
414
gobject.source_remove(self.checker_callback_tag)
497
415
self.checker_callback(pid, status,
498
416
self.current_checker_command)
503
421
command = self.checker_command % self.host
504
422
except TypeError:
505
423
# Escape attributes for the shell
506
escaped_attrs = dict(
507
(attr,
508
re.escape(unicode(str(getattr(self, attr, "")),
509
errors=
510
'replace')))
511
for attr in
512
self.runtime_expansions)
513
424
escaped_attrs = dict((key,
425
re.escape(unicode(str(val),
426
errors=
427
u'replace')))
428
for key, val in
429
vars(self).iteritems())
514
430
try:
515
431
command = self.checker_command % escaped_attrs
516
except TypeError as error:
517
logger.error('Could not format string "%s":'
518
' %s', self.checker_command, error)
432
except TypeError, error:
433
logger.error(u'Could not format string "%s":'
434
u' %s', self.checker_command, error)
519
435
return True # Try again later
520
436
self.current_checker_command = command
521
437
try:
522
logger.info("Starting checker %r for %s",
438
logger.info(u"Starting checker %r for %s",
523
439
command, self.name)
524
440
# We don't need to redirect stdout and stderr, since
525
441
# in normal mode, that is already done by daemon(),
527
443
# always replaced by /dev/null.)
528
444
self.checker = subprocess.Popen(command,
529
445
close_fds=True,
530
shell=True, cwd="/")
446
shell=True, cwd=u"/")
531
447
self.checker_callback_tag = (gobject.child_watch_add
532
448
(self.checker.pid,
533
449
self.checker_callback,
538
454
if pid:
539
455
gobject.source_remove(self.checker_callback_tag)
540
456
self.checker_callback(pid, status, command)
541
except OSError as error:
542
logger.error("Failed to start subprocess: %s",
457
except OSError, error:
458
logger.error(u"Failed to start subprocess: %s",
543
459
error)
544
460
# Re-run this periodically if run by gobject.timeout_add
545
461
return True
549
465
if self.checker_callback_tag:
550
466
gobject.source_remove(self.checker_callback_tag)
551
467
self.checker_callback_tag = None
552
if getattr(self, "checker", None) is None:
468
if getattr(self, u"checker", None) is None:
553
469
return
554
logger.debug("Stopping checker for %(name)s", vars(self))
470
logger.debug(u"Stopping checker for %(name)s", vars(self))
555
471
try:
556
472
os.kill(self.checker.pid, signal.SIGTERM)
557
473
#time.sleep(0.5)
558
474
#if self.checker.poll() is None:
559
475
# os.kill(self.checker.pid, signal.SIGKILL)
560
except OSError as error:
476
except OSError, error:
561
477
if error.errno != errno.ESRCH: # No such process
562
478
raise
563
479
self.checker = None
564
480
565
481
566
def dbus_service_property(dbus_interface, signature="v",
567
access="readwrite", byte_arrays=False):
482
def dbus_service_property(dbus_interface, signature=u"v",
483
access=u"readwrite", byte_arrays=False):
568
484
"""Decorators for marking methods of a DBusObjectWithProperties to
569
485
become properties on the D-Bus.
570
486
577
493
"""
578
494
# Encoding deeply encoded byte arrays is not supported yet by the
579
495
# "Set" method, so we fail early here:
580
if byte_arrays and signature != "ay":
581
raise ValueError("Byte arrays not supported for non-'ay'"
582
" signature %r" % signature)
496
if byte_arrays and signature != u"ay":
497
raise ValueError(u"Byte arrays not supported for non-'ay'"
498
u" signature %r" % signature)
583
499
def decorator(func):
584
500
func._dbus_is_property = True
585
501
func._dbus_interface = dbus_interface
586
502
func._dbus_signature = signature
587
503
func._dbus_access = access
588
504
func._dbus_name = func.__name__
589
if func._dbus_name.endswith("_dbus_property"):
505
if func._dbus_name.endswith(u"_dbus_property"):
590
506
func._dbus_name = func._dbus_name[:-14]
591
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
507
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
592
508
return func
593
509
return decorator
594
510
614
530
615
531
class DBusObjectWithProperties(dbus.service.Object):
616
532
"""A D-Bus object with properties.
617
533
618
534
Classes inheriting from this can use the dbus_service_property
619
535
decorator to expose methods as D-Bus properties. It exposes the
620
536
standard Get(), Set(), and GetAll() methods on the D-Bus.
622
538
623
539
@staticmethod
624
540
def _is_dbus_property(obj):
625
return getattr(obj, "_dbus_is_property", False)
541
return getattr(obj, u"_dbus_is_property", False)
626
542
627
543
def _get_all_dbus_properties(self):
628
544
"""Returns a generator of (name, attribute) pairs
629
545
"""
630
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
631
for cls in self.__class__.__mro__
632
for name, prop in inspect.getmembers(cls, self._is_dbus_property))
546
return ((prop._dbus_name, prop)
547
for name, prop in
548
inspect.getmembers(self, self._is_dbus_property))
633
549
634
550
def _get_dbus_property(self, interface_name, property_name):
635
551
"""Returns a bound method if one exists which is a D-Bus
636
552
property with the specified name and interface.
637
553
"""
638
for cls in self.__class__.__mro__:
639
for name, value in inspect.getmembers(cls, self._is_dbus_property):
640
if value._dbus_name == property_name and value._dbus_interface == interface_name:
641
return value.__get__(self)
642
554
for name in (property_name,
555
property_name + u"_dbus_property"):
556
prop = getattr(self, name, None)
557
if (prop is None
558
or not self._is_dbus_property(prop)
559
or prop._dbus_name != property_name
560
or (interface_name and prop._dbus_interface
561
and interface_name != prop._dbus_interface)):
562
continue
563
return prop
643
564
# No such property
644
raise DBusPropertyNotFound(self.dbus_object_path + ":"
645
+ interface_name + "."
565
raise DBusPropertyNotFound(self.dbus_object_path + u":"
566
+ interface_name + u"."
646
567
+ property_name)
647
648
568
649
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
650
out_signature="v")
569
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
570
out_signature=u"v")
651
571
def Get(self, interface_name, property_name):
652
572
"""Standard D-Bus property Get() method, see D-Bus standard.
653
573
"""
654
574
prop = self._get_dbus_property(interface_name, property_name)
655
if prop._dbus_access == "write":
575
if prop._dbus_access == u"write":
656
576
raise DBusPropertyAccessException(property_name)
657
577
value = prop()
658
if not hasattr(value, "variant_level"):
578
if not hasattr(value, u"variant_level"):
659
579
return value
660
580
return type(value)(value, variant_level=value.variant_level+1)
661
581
662
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
582
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
663
583
def Set(self, interface_name, property_name, value):
664
584
"""Standard D-Bus property Set() method, see D-Bus standard.
665
585
"""
666
586
prop = self._get_dbus_property(interface_name, property_name)
667
if prop._dbus_access == "read":
587
if prop._dbus_access == u"read":
668
588
raise DBusPropertyAccessException(property_name)
669
if prop._dbus_get_args_options["byte_arrays"]:
589
if prop._dbus_get_args_options[u"byte_arrays"]:
670
590
# The byte_arrays option is not supported yet on
671
591
# signatures other than "ay".
672
if prop._dbus_signature != "ay":
592
if prop._dbus_signature != u"ay":
673
593
raise ValueError
674
594
value = dbus.ByteArray(''.join(unichr(byte)
675
595
for byte in value))
676
596
prop(value)
677
597
678
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
679
out_signature="a{sv}")
598
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
599
out_signature=u"a{sv}")
680
600
def GetAll(self, interface_name):
681
601
"""Standard D-Bus property GetAll() method, see D-Bus
682
602
standard.
683
603
684
604
Note: Will not include properties with access="write".
685
605
"""
686
606
all = {}
690
610
# Interface non-empty but did not match
691
611
continue
692
612
# Ignore write-only properties
693
if prop._dbus_access == "write":
613
if prop._dbus_access == u"write":
694
614
continue
695
615
value = prop()
696
if not hasattr(value, "variant_level"):
616
if not hasattr(value, u"variant_level"):
697
617
all[name] = value
698
618
continue
699
619
all[name] = type(value)(value, variant_level=
700
620
value.variant_level+1)
701
return dbus.Dictionary(all, signature="sv")
621
return dbus.Dictionary(all, signature=u"sv")
702
622
703
623
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
704
out_signature="s",
624
out_signature=u"s",
705
625
path_keyword='object_path',
706
626
connection_keyword='connection')
707
627
def Introspect(self, object_path, connection):
712
632
try:
713
633
document = xml.dom.minidom.parseString(xmlstring)
714
634
def make_tag(document, name, prop):
715
e = document.createElement("property")
716
e.setAttribute("name", name)
717
e.setAttribute("type", prop._dbus_signature)
718
e.setAttribute("access", prop._dbus_access)
635
e = document.createElement(u"property")
636
e.setAttribute(u"name", name)
637
e.setAttribute(u"type", prop._dbus_signature)
638
e.setAttribute(u"access", prop._dbus_access)
719
639
return e
720
for if_tag in document.getElementsByTagName("interface"):
640
for if_tag in document.getElementsByTagName(u"interface"):
721
641
for tag in (make_tag(document, name, prop)
722
642
for name, prop
723
643
in self._get_all_dbus_properties()
724
644
if prop._dbus_interface
725
== if_tag.getAttribute("name")):
645
== if_tag.getAttribute(u"name")):
726
646
if_tag.appendChild(tag)
727
647
# Add the names to the return values for the
728
648
# "org.freedesktop.DBus.Properties" methods
729
if (if_tag.getAttribute("name")
730
== "org.freedesktop.DBus.Properties"):
731
for cn in if_tag.getElementsByTagName("method"):
732
if cn.getAttribute("name") == "Get":
733
for arg in cn.getElementsByTagName("arg"):
734
if (arg.getAttribute("direction")
735
== "out"):
736
arg.setAttribute("name", "value")
737
elif cn.getAttribute("name") == "GetAll":
738
for arg in cn.getElementsByTagName("arg"):
739
if (arg.getAttribute("direction")
740
== "out"):
741
arg.setAttribute("name", "props")
742
xmlstring = document.toxml("utf-8")
649
if (if_tag.getAttribute(u"name")
650
== u"org.freedesktop.DBus.Properties"):
651
for cn in if_tag.getElementsByTagName(u"method"):
652
if cn.getAttribute(u"name") == u"Get":
653
for arg in cn.getElementsByTagName(u"arg"):
654
if (arg.getAttribute(u"direction")
655
== u"out"):
656
arg.setAttribute(u"name", u"value")
657
elif cn.getAttribute(u"name") == u"GetAll":
658
for arg in cn.getElementsByTagName(u"arg"):
659
if (arg.getAttribute(u"direction")
660
== u"out"):
661
arg.setAttribute(u"name", u"props")
662
xmlstring = document.toxml(u"utf-8")
743
663
document.unlink()
744
664
except (AttributeError, xml.dom.DOMException,
745
xml.parsers.expat.ExpatError) as error:
746
logger.error("Failed to override Introspection method",
665
xml.parsers.expat.ExpatError), error:
666
logger.error(u"Failed to override Introspection method",
747
667
error)
748
668
return xmlstring
749
669
750
670
751
def datetime_to_dbus (dt, variant_level=0):
752
"""Convert a UTC datetime.datetime() to a D-Bus type."""
753
if dt is None:
754
return dbus.String("", variant_level = variant_level)
755
return dbus.String(dt.isoformat(),
756
variant_level=variant_level)
757
758
class transitional_dbus_metaclass(DBusObjectWithProperties.__metaclass__):
759
def __new__(mcs, name, bases, attr):
760
for attrname, old_dbusobj in inspect.getmembers(bases[0]):
761
new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")
762
if (getattr(old_dbusobj, "_dbus_is_signal", False)
763
and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):
764
unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,
765
old_dbusobj.__closure__))["func"].cell_contents
766
newfunc = types.FunctionType(unwrappedfunc.func_code,
767
unwrappedfunc.func_globals,
768
unwrappedfunc.func_name,
769
unwrappedfunc.func_defaults,
770
unwrappedfunc.func_closure)
771
new_dbusfunc = dbus.service.signal(
772
new_interface, old_dbusobj._dbus_signature)(newfunc)
773
attr["_transitional_" + attrname] = new_dbusfunc
774
775
def fixscope(func1, func2):
776
def newcall(*args, **kwargs):
777
func1(*args, **kwargs)
778
func2(*args, **kwargs)
779
return newcall
780
781
attr[attrname] = fixscope(old_dbusobj, new_dbusfunc)
782
783
elif (getattr(old_dbusobj, "_dbus_is_method", False)
784
and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):
785
new_dbusfunc = (dbus.service.method
786
(new_interface,
787
old_dbusobj._dbus_in_signature,
788
old_dbusobj._dbus_out_signature)
789
(types.FunctionType
790
(old_dbusobj.func_code,
791
old_dbusobj.func_globals,
792
old_dbusobj.func_name,
793
old_dbusobj.func_defaults,
794
old_dbusobj.func_closure)))
795
796
attr[attrname] = new_dbusfunc
797
elif (getattr(old_dbusobj, "_dbus_is_property", False)
798
and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):
799
new_dbusfunc = (dbus_service_property
800
(new_interface,
801
old_dbusobj._dbus_signature,
802
old_dbusobj._dbus_access,
803
old_dbusobj._dbus_get_args_options["byte_arrays"])
804
(types.FunctionType
805
(old_dbusobj.func_code,
806
old_dbusobj.func_globals,
807
old_dbusobj.func_name,
808
old_dbusobj.func_defaults,
809
old_dbusobj.func_closure)))
810
811
attr[attrname] = new_dbusfunc
812
return type.__new__(mcs, name, bases, attr)
813
814
671
class ClientDBus(Client, DBusObjectWithProperties):
815
672
"""A Client class using D-Bus
816
673
818
675
dbus_object_path: dbus.ObjectPath
819
676
bus: dbus.SystemBus()
820
677
"""
821
822
runtime_expansions = (Client.runtime_expansions
823
+ ("dbus_object_path",))
824
825
678
# dbus.service.Object doesn't use super(), so we can't either.
826
679
827
680
def __init__(self, bus = None, *args, **kwargs):
828
self._approvals_pending = 0
829
681
self.bus = bus
830
682
Client.__init__(self, *args, **kwargs)
831
683
# Only now, when this client is initialized, can it show up on
832
684
# the D-Bus
833
client_object_name = unicode(self.name).translate(
834
{ord("."): ord("_"),
835
ord("-"): ord("_")})
836
685
self.dbus_object_path = (dbus.ObjectPath
837
("/clients/" + client_object_name))
686
(u"/clients/"
687
+ self.name.replace(u".", u"_")))
838
688
DBusObjectWithProperties.__init__(self, self.bus,
839
689
self.dbus_object_path)
840
841
def notifychangeproperty(transform_func,
842
dbus_name, type_func=lambda x: x,
843
variant_level=1):
844
""" Modify a variable so that its a property that announce its
845
changes to DBus.
846
transform_fun: Function that takes a value and transform it to
847
DBus type.
848
dbus_name: DBus name of the variable
849
type_func: Function that transform the value before sending it
850
to DBus
851
variant_level: DBus variant level. default: 1
852
"""
853
real_value = [None,]
854
def setter(self, value):
855
old_value = real_value[0]
856
real_value[0] = value
857
if hasattr(self, "dbus_object_path"):
858
if type_func(old_value) != type_func(real_value[0]):
859
dbus_value = transform_func(type_func(real_value[0]),
860
variant_level)
861
self.PropertyChanged(dbus.String(dbus_name),
862
dbus_value)
863
864
return property(lambda self: real_value[0], setter)
865
866
867
expires = notifychangeproperty(datetime_to_dbus, "Expires")
868
approvals_pending = notifychangeproperty(dbus.Boolean,
869
"ApprovalPending",
870
type_func = bool)
871
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
872
last_enabled = notifychangeproperty(datetime_to_dbus,
873
"LastEnabled")
874
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
875
type_func = lambda checker: checker is not None)
876
last_checked_ok = notifychangeproperty(datetime_to_dbus,
877
"LastCheckedOK")
878
last_approval_request = notifychangeproperty(datetime_to_dbus,
879
"LastApprovalRequest")
880
approved_by_default = notifychangeproperty(dbus.Boolean,
881
"ApprovedByDefault")
882
approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",
883
type_func = _timedelta_to_milliseconds)
884
approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",
885
type_func = _timedelta_to_milliseconds)
886
host = notifychangeproperty(dbus.String, "Host")
887
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
888
type_func = _timedelta_to_milliseconds)
889
extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",
890
type_func = _timedelta_to_milliseconds)
891
interval = notifychangeproperty(dbus.UInt16, "Interval",
892
type_func = _timedelta_to_milliseconds)
893
checker_command = notifychangeproperty(dbus.String, "Checker")
894
895
del notifychangeproperty
690
691
@staticmethod
692
def _datetime_to_dbus(dt, variant_level=0):
693
"""Convert a UTC datetime.datetime() to a D-Bus type."""
694
return dbus.String(dt.isoformat(),
695
variant_level=variant_level)
696
697
def enable(self):
698
oldstate = getattr(self, u"enabled", False)
699
r = Client.enable(self)
700
if oldstate != self.enabled:
701
# Emit D-Bus signals
702
self.PropertyChanged(dbus.String(u"enabled"),
703
dbus.Boolean(True, variant_level=1))
704
self.PropertyChanged(
705
dbus.String(u"last_enabled"),
706
self._datetime_to_dbus(self.last_enabled,
707
variant_level=1))
708
return r
709
710
def disable(self, quiet = False):
711
oldstate = getattr(self, u"enabled", False)
712
r = Client.disable(self, quiet=quiet)
713
if not quiet and oldstate != self.enabled:
714
# Emit D-Bus signal
715
self.PropertyChanged(dbus.String(u"enabled"),
716
dbus.Boolean(False, variant_level=1))
717
return r
896
718
897
719
def __del__(self, *args, **kwargs):
898
720
try:
899
721
self.remove_from_connection()
900
722
except LookupError:
901
723
pass
902
if hasattr(DBusObjectWithProperties, "__del__"):
724
if hasattr(DBusObjectWithProperties, u"__del__"):
903
725
DBusObjectWithProperties.__del__(self, *args, **kwargs)
904
726
Client.__del__(self, *args, **kwargs)
905
727
907
729
*args, **kwargs):
908
730
self.checker_callback_tag = None
909
731
self.checker = None
732
# Emit D-Bus signal
733
self.PropertyChanged(dbus.String(u"checker_running"),
734
dbus.Boolean(False, variant_level=1))
910
735
if os.WIFEXITED(condition):
911
736
exitstatus = os.WEXITSTATUS(condition)
912
737
# Emit D-Bus signal
922
747
return Client.checker_callback(self, pid, condition, command,
923
748
*args, **kwargs)
924
749
750
def checked_ok(self, *args, **kwargs):
751
r = Client.checked_ok(self, *args, **kwargs)
752
# Emit D-Bus signal
753
self.PropertyChanged(
754
dbus.String(u"last_checked_ok"),
755
(self._datetime_to_dbus(self.last_checked_ok,
756
variant_level=1)))
757
return r
758
925
759
def start_checker(self, *args, **kwargs):
926
760
old_checker = self.checker
927
761
if self.checker is not None:
934
768
and old_checker_pid != self.checker.pid):
935
769
# Emit D-Bus signal
936
770
self.CheckerStarted(self.current_checker_command)
937
return r
938
939
def _reset_approved(self):
940
self._approved = None
941
return False
942
943
def approve(self, value=True):
944
self.send_changedstate()
945
self._approved = value
946
gobject.timeout_add(_timedelta_to_milliseconds
947
(self.approval_duration),
948
self._reset_approved)
949
771
self.PropertyChanged(
772
dbus.String(u"checker_running"),
773
dbus.Boolean(True, variant_level=1))
774
return r
775
776
def stop_checker(self, *args, **kwargs):
777
old_checker = getattr(self, u"checker", None)
778
r = Client.stop_checker(self, *args, **kwargs)
779
if (old_checker is not None
780
and getattr(self, u"checker", None) is None):
781
self.PropertyChanged(dbus.String(u"checker_running"),
782
dbus.Boolean(False, variant_level=1))
783
return r
950
784
951
785
## D-Bus methods, signals & properties
952
_interface = "se.bsnet.fukt.Mandos.Client"
953
786
_interface = u"se.bsnet.fukt.Mandos.Client"
787
954
788
## Signals
955
789
956
790
# CheckerCompleted - signal
957
@dbus.service.signal(_interface, signature="nxs")
791
@dbus.service.signal(_interface, signature=u"nxs")
958
792
def CheckerCompleted(self, exitcode, waitstatus, command):
959
793
"D-Bus signal"
960
794
pass
961
795
962
796
# CheckerStarted - signal
963
@dbus.service.signal(_interface, signature="s")
797
@dbus.service.signal(_interface, signature=u"s")
964
798
def CheckerStarted(self, command):
965
799
"D-Bus signal"
966
800
pass
967
801
968
802
# PropertyChanged - signal
969
@dbus.service.signal(_interface, signature="sv")
803
@dbus.service.signal(_interface, signature=u"sv")
970
804
def PropertyChanged(self, property, value):
971
805
"D-Bus signal"
972
806
pass
974
808
# GotSecret - signal
975
809
@dbus.service.signal(_interface)
976
810
def GotSecret(self):
977
"""D-Bus signal
978
Is sent after a successful transfer of secret from the Mandos
979
server to mandos-client
980
"""
811
"D-Bus signal"
981
812
pass
982
813
983
814
# Rejected - signal
984
@dbus.service.signal(_interface, signature="s")
985
def Rejected(self, reason):
815
@dbus.service.signal(_interface)
816
def Rejected(self):
986
817
"D-Bus signal"
987
818
pass
988
819
989
# NeedApproval - signal
990
@dbus.service.signal(_interface, signature="tb")
991
def NeedApproval(self, timeout, default):
992
"D-Bus signal"
993
return self.need_approval()
994
995
820
## Methods
996
821
997
# Approve - method
998
@dbus.service.method(_interface, in_signature="b")
999
def Approve(self, value):
1000
self.approve(value)
1001
1002
822
# CheckedOK - method
1003
823
@dbus.service.method(_interface)
1004
824
def CheckedOK(self):
1005
self.checked_ok()
825
return self.checked_ok()
1006
826
1007
827
# Enable - method
1008
828
@dbus.service.method(_interface)
1029
849
1030
850
## Properties
1031
851
1032
# ApprovalPending - property
1033
@dbus_service_property(_interface, signature="b", access="read")
1034
def ApprovalPending_dbus_property(self):
1035
return dbus.Boolean(bool(self.approvals_pending))
1036
1037
# ApprovedByDefault - property
1038
@dbus_service_property(_interface, signature="b",
1039
access="readwrite")
1040
def ApprovedByDefault_dbus_property(self, value=None):
1041
if value is None: # get
1042
return dbus.Boolean(self.approved_by_default)
1043
self.approved_by_default = bool(value)
1044
1045
# ApprovalDelay - property
1046
@dbus_service_property(_interface, signature="t",
1047
access="readwrite")
1048
def ApprovalDelay_dbus_property(self, value=None):
1049
if value is None: # get
1050
return dbus.UInt64(self.approval_delay_milliseconds())
1051
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1052
1053
# ApprovalDuration - property
1054
@dbus_service_property(_interface, signature="t",
1055
access="readwrite")
1056
def ApprovalDuration_dbus_property(self, value=None):
1057
if value is None: # get
1058
return dbus.UInt64(_timedelta_to_milliseconds(
1059
self.approval_duration))
1060
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1061
1062
# Name - property
1063
@dbus_service_property(_interface, signature="s", access="read")
1064
def Name_dbus_property(self):
852
# name - property
853
@dbus_service_property(_interface, signature=u"s", access=u"read")
854
def name_dbus_property(self):
1065
855
return dbus.String(self.name)
1066
856
1067
# Fingerprint - property
1068
@dbus_service_property(_interface, signature="s", access="read")
1069
def Fingerprint_dbus_property(self):
857
# fingerprint - property
858
@dbus_service_property(_interface, signature=u"s", access=u"read")
859
def fingerprint_dbus_property(self):
1070
860
return dbus.String(self.fingerprint)
1071
861
1072
# Host - property
1073
@dbus_service_property(_interface, signature="s",
1074
access="readwrite")
1075
def Host_dbus_property(self, value=None):
862
# host - property
863
@dbus_service_property(_interface, signature=u"s",
864
access=u"readwrite")
865
def host_dbus_property(self, value=None):
1076
866
if value is None: # get
1077
867
return dbus.String(self.host)
1078
868
self.host = value
1079
1080
# Created - property
1081
@dbus_service_property(_interface, signature="s", access="read")
1082
def Created_dbus_property(self):
1083
return dbus.String(datetime_to_dbus(self.created))
1084
1085
# LastEnabled - property
1086
@dbus_service_property(_interface, signature="s", access="read")
1087
def LastEnabled_dbus_property(self):
1088
return datetime_to_dbus(self.last_enabled)
1089
1090
# Enabled - property
1091
@dbus_service_property(_interface, signature="b",
1092
access="readwrite")
1093
def Enabled_dbus_property(self, value=None):
869
# Emit D-Bus signal
870
self.PropertyChanged(dbus.String(u"host"),
871
dbus.String(value, variant_level=1))
872
873
# created - property
874
@dbus_service_property(_interface, signature=u"s", access=u"read")
875
def created_dbus_property(self):
876
return dbus.String(self._datetime_to_dbus(self.created))
877
878
# last_enabled - property
879
@dbus_service_property(_interface, signature=u"s", access=u"read")
880
def last_enabled_dbus_property(self):
881
if self.last_enabled is None:
882
return dbus.String(u"")
883
return dbus.String(self._datetime_to_dbus(self.last_enabled))
884
885
# enabled - property
886
@dbus_service_property(_interface, signature=u"b",
887
access=u"readwrite")
888
def enabled_dbus_property(self, value=None):
1094
889
if value is None: # get
1095
890
return dbus.Boolean(self.enabled)
1096
891
if value:
1098
893
else:
1099
894
self.disable()
1100
895
1101
# LastCheckedOK - property
1102
@dbus_service_property(_interface, signature="s",
1103
access="readwrite")
1104
def LastCheckedOK_dbus_property(self, value=None):
896
# last_checked_ok - property
897
@dbus_service_property(_interface, signature=u"s",
898
access=u"readwrite")
899
def last_checked_ok_dbus_property(self, value=None):
1105
900
if value is not None:
1106
901
self.checked_ok()
1107
902
return
1108
return datetime_to_dbus(self.last_checked_ok)
1109
1110
# Expires - property
1111
@dbus_service_property(_interface, signature="s", access="read")
1112
def Expires_dbus_property(self):
1113
return datetime_to_dbus(self.expires)
1114
1115
# LastApprovalRequest - property
1116
@dbus_service_property(_interface, signature="s", access="read")
1117
def LastApprovalRequest_dbus_property(self):
1118
return datetime_to_dbus(self.last_approval_request)
1119
1120
# Timeout - property
1121
@dbus_service_property(_interface, signature="t",
1122
access="readwrite")
1123
def Timeout_dbus_property(self, value=None):
903
if self.last_checked_ok is None:
904
return dbus.String(u"")
905
return dbus.String(self._datetime_to_dbus(self
906
.last_checked_ok))
907
908
# timeout - property
909
@dbus_service_property(_interface, signature=u"t",
910
access=u"readwrite")
911
def timeout_dbus_property(self, value=None):
1124
912
if value is None: # get
1125
913
return dbus.UInt64(self.timeout_milliseconds())
1126
914
self.timeout = datetime.timedelta(0, 0, 0, value)
1127
if getattr(self, "disable_initiator_tag", None) is None:
915
# Emit D-Bus signal
916
self.PropertyChanged(dbus.String(u"timeout"),
917
dbus.UInt64(value, variant_level=1))
918
if getattr(self, u"disable_initiator_tag", None) is None:
1128
919
return
1129
920
# Reschedule timeout
1130
921
gobject.source_remove(self.disable_initiator_tag)
1131
922
self.disable_initiator_tag = None
1132
self.expires = None
1133
923
time_to_die = (self.
1134
924
_timedelta_to_milliseconds((self
1135
925
.last_checked_ok
1140
930
# The timeout has passed
1141
931
self.disable()
1142
932
else:
1143
self.expires = (datetime.datetime.utcnow()
1144
+ datetime.timedelta(milliseconds = time_to_die))
1145
933
self.disable_initiator_tag = (gobject.timeout_add
1146
934
(time_to_die, self.disable))
1147
935
1148
# ExtendedTimeout - property
1149
@dbus_service_property(_interface, signature="t",
1150
access="readwrite")
1151
def ExtendedTimeout_dbus_property(self, value=None):
1152
if value is None: # get
1153
return dbus.UInt64(self.extended_timeout_milliseconds())
1154
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1155
1156
# Interval - property
1157
@dbus_service_property(_interface, signature="t",
1158
access="readwrite")
1159
def Interval_dbus_property(self, value=None):
936
# interval - property
937
@dbus_service_property(_interface, signature=u"t",
938
access=u"readwrite")
939
def interval_dbus_property(self, value=None):
1160
940
if value is None: # get
1161
941
return dbus.UInt64(self.interval_milliseconds())
1162
942
self.interval = datetime.timedelta(0, 0, 0, value)
1163
if getattr(self, "checker_initiator_tag", None) is None:
943
# Emit D-Bus signal
944
self.PropertyChanged(dbus.String(u"interval"),
945
dbus.UInt64(value, variant_level=1))
946
if getattr(self, u"checker_initiator_tag", None) is None:
1164
947
return
1165
948
# Reschedule checker run
1166
949
gobject.source_remove(self.checker_initiator_tag)
1167
950
self.checker_initiator_tag = (gobject.timeout_add
1168
951
(value, self.start_checker))
1169
952
self.start_checker() # Start one now, too
1170
1171
# Checker - property
1172
@dbus_service_property(_interface, signature="s",
1173
access="readwrite")
1174
def Checker_dbus_property(self, value=None):
953
954
# checker - property
955
@dbus_service_property(_interface, signature=u"s",
956
access=u"readwrite")
957
def checker_dbus_property(self, value=None):
1175
958
if value is None: # get
1176
959
return dbus.String(self.checker_command)
1177
960
self.checker_command = value
961
# Emit D-Bus signal
962
self.PropertyChanged(dbus.String(u"checker"),
963
dbus.String(self.checker_command,
964
variant_level=1))
1178
965
1179
# CheckerRunning - property
1180
@dbus_service_property(_interface, signature="b",
1181
access="readwrite")
1182
def CheckerRunning_dbus_property(self, value=None):
966
# checker_running - property
967
@dbus_service_property(_interface, signature=u"b",
968
access=u"readwrite")
969
def checker_running_dbus_property(self, value=None):
1183
970
if value is None: # get
1184
971
return dbus.Boolean(self.checker is not None)
1185
972
if value:
1187
974
else:
1188
975
self.stop_checker()
1189
976
1190
# ObjectPath - property
1191
@dbus_service_property(_interface, signature="o", access="read")
1192
def ObjectPath_dbus_property(self):
977
# object_path - property
978
@dbus_service_property(_interface, signature=u"o", access=u"read")
979
def object_path_dbus_property(self):
1193
980
return self.dbus_object_path # is already a dbus.ObjectPath
1194
981
1195
# Secret = property
1196
@dbus_service_property(_interface, signature="ay",
1197
access="write", byte_arrays=True)
1198
def Secret_dbus_property(self, value):
982
# secret = property
983
@dbus_service_property(_interface, signature=u"ay",
984
access=u"write", byte_arrays=True)
985
def secret_dbus_property(self, value):
1199
986
self.secret = str(value)
1200
987
1201
988
del _interface
1202
989
1203
990
1204
class ProxyClient(object):
1205
def __init__(self, child_pipe, fpr, address):
1206
self._pipe = child_pipe
1207
self._pipe.send(('init', fpr, address))
1208
if not self._pipe.recv():
1209
raise KeyError()
1210
1211
def __getattribute__(self, name):
1212
if(name == '_pipe'):
1213
return super(ProxyClient, self).__getattribute__(name)
1214
self._pipe.send(('getattr', name))
1215
data = self._pipe.recv()
1216
if data[0] == 'data':
1217
return data[1]
1218
if data[0] == 'function':
1219
def func(*args, **kwargs):
1220
self._pipe.send(('funcall', name, args, kwargs))
1221
return self._pipe.recv()[1]
1222
return func
1223
1224
def __setattr__(self, name, value):
1225
if(name == '_pipe'):
1226
return super(ProxyClient, self).__setattr__(name, value)
1227
self._pipe.send(('setattr', name, value))
1228
1229
class ClientDBusTransitional(ClientDBus):
1230
__metaclass__ = transitional_dbus_metaclass
1231
1232
991
class ClientHandler(socketserver.BaseRequestHandler, object):
1233
992
"""A class to handle client connections.
1234
993
1236
995
Note: This will run in its own forked process."""
1237
996
1238
997
def handle(self):
1239
with contextlib.closing(self.server.child_pipe) as child_pipe:
1240
logger.info("TCP connection from: %s",
1241
unicode(self.client_address))
1242
logger.debug("Pipe FD: %d",
1243
self.server.child_pipe.fileno())
1244
998
logger.info(u"TCP connection from: %s",
999
unicode(self.client_address))
1000
logger.debug(u"IPC Pipe FD: %d",
1001
self.server.child_pipe[1].fileno())
1002
# Open IPC pipe to parent process
1003
with contextlib.nested(self.server.child_pipe[1],
1004
self.server.parent_pipe[0]
1005
) as (ipc, ipc_return):
1245
1006
session = (gnutls.connection
1246
1007
.ClientSession(self.request,
1247
1008
gnutls.connection
1252
1013
# no X.509 keys are added to it. Therefore, we can use it
1253
1014
# here despite using OpenPGP certificates.
1254
1015
1255
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1256
# "+AES-256-CBC", "+SHA1",
1257
# "+COMP-NULL", "+CTYPE-OPENPGP",
1258
# "+DHE-DSS"))
1016
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1017
# u"+AES-256-CBC", u"+SHA1",
1018
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1019
# u"+DHE-DSS"))
1259
1020
# Use a fallback default, since this MUST be set.
1260
1021
priority = self.server.gnutls_priority
1261
1022
if priority is None:
1262
priority = "NORMAL"
1023
priority = u"NORMAL"
1263
1024
(gnutls.library.functions
1264
1025
.gnutls_priority_set_direct(session._c_object,
1265
1026
priority, None))
1267
1028
# Start communication using the Mandos protocol
1268
1029
# Get protocol number
1269
1030
line = self.request.makefile().readline()
1270
logger.debug("Protocol version: %r", line)
1031
logger.debug(u"Protocol version: %r", line)
1271
1032
try:
1272
1033
if int(line.strip().split()[0]) > 1:
1273
1034
raise RuntimeError
1274
except (ValueError, IndexError, RuntimeError) as error:
1275
logger.error("Unknown protocol version: %s", error)
1035
except (ValueError, IndexError, RuntimeError), error:
1036
logger.error(u"Unknown protocol version: %s", error)
1276
1037
return
1277
1038
1278
1039
# Start GnuTLS connection
1279
1040
try:
1280
1041
session.handshake()
1281
except gnutls.errors.GNUTLSError as error:
1282
logger.warning("Handshake failed: %s", error)
1042
except gnutls.errors.GNUTLSError, error:
1043
logger.warning(u"Handshake failed: %s", error)
1283
1044
# Do not run session.bye() here: the session is not
1284
1045
# established. Just abandon the request.
1285
1046
return
1286
logger.debug("Handshake succeeded")
1287
1288
approval_required = False
1047
logger.debug(u"Handshake succeeded")
1289
1048
try:
1290
1049
try:
1291
1050
fpr = self.fingerprint(self.peer_certificate
1292
1051
(session))
1293
except (TypeError,
1294
gnutls.errors.GNUTLSError) as error:
1295
logger.warning("Bad certificate: %s", error)
1296
return
1297
logger.debug("Fingerprint: %s", fpr)
1298
1299
try:
1300
client = ProxyClient(child_pipe, fpr,
1301
self.client_address)
1302
except KeyError:
1303
return
1304
1305
if client.approval_delay:
1306
delay = client.approval_delay
1307
client.approvals_pending += 1
1308
approval_required = True
1309
1310
while True:
1311
if not client.enabled:
1312
logger.info("Client %s is disabled",
1313
client.name)
1314
if self.server.use_dbus:
1315
# Emit D-Bus signal
1316
client.Rejected("Disabled")
1317
return
1318
1319
if client._approved or not client.approval_delay:
1320
#We are approved or approval is disabled
1052
except (TypeError, gnutls.errors.GNUTLSError), error:
1053
logger.warning(u"Bad certificate: %s", error)
1054
return
1055
logger.debug(u"Fingerprint: %s", fpr)
1056
1057
for c in self.server.clients:
1058
if c.fingerprint == fpr:
1059
client = c
1321
1060
break
1322
elif client._approved is None:
1323
logger.info("Client %s needs approval",
1324
client.name)
1325
if self.server.use_dbus:
1326
# Emit D-Bus signal
1327
client.NeedApproval(
1328
client.approval_delay_milliseconds(),
1329
client.approved_by_default)
1330
else:
1331
logger.warning("Client %s was not approved",
1332
client.name)
1333
if self.server.use_dbus:
1334
# Emit D-Bus signal
1335
client.Rejected("Denied")
1336
return
1337
1338
#wait until timeout or approved
1339
#x = float(client._timedelta_to_milliseconds(delay))
1340
time = datetime.datetime.now()
1341
client.changedstate.acquire()
1342
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1343
client.changedstate.release()
1344
time2 = datetime.datetime.now()
1345
if (time2 - time) >= delay:
1346
if not client.approved_by_default:
1347
logger.warning("Client %s timed out while"
1348
" waiting for approval",
1349
client.name)
1350
if self.server.use_dbus:
1351
# Emit D-Bus signal
1352
client.Rejected("Approval timed out")
1353
return
1354
else:
1355
break
1356
else:
1357
delay -= time2 - time
1358
1061
else:
1062
ipc.write(u"NOTFOUND %s %s\n"
1063
% (fpr, unicode(self.client_address)))
1064
return
1065
1066
class ClientProxy(object):
1067
"""Client proxy object. Not for calling methods."""
1068
def __init__(self, client):
1069
self.client = client
1070
def __getattr__(self, name):
1071
if name.startswith("ipc_"):
1072
def tempfunc():
1073
ipc.write("%s %s\n" % (name[4:].upper(),
1074
self.client.name))
1075
return tempfunc
1076
if not hasattr(self.client, name):
1077
raise AttributeError
1078
ipc.write(u"GETATTR %s %s\n"
1079
% (name, self.client.fingerprint))
1080
return pickle.load(ipc_return)
1081
clientproxy = ClientProxy(client)
1082
# Have to check if client.enabled, since it is
1083
# possible that the client was disabled since the
1084
# GnuTLS session was established.
1085
if not clientproxy.enabled:
1086
clientproxy.ipc_disabled()
1087
return
1088
1089
clientproxy.ipc_sending()
1359
1090
sent_size = 0
1360
1091
while sent_size < len(client.secret):
1361
try:
1362
sent = session.send(client.secret[sent_size:])
1363
except gnutls.errors.GNUTLSError as error:
1364
logger.warning("gnutls send failed")
1365
return
1366
logger.debug("Sent: %d, remaining: %d",
1092
sent = session.send(client.secret[sent_size:])
1093
logger.debug(u"Sent: %d, remaining: %d",
1367
1094
sent, len(client.secret)
1368
1095
- (sent_size + sent))
1369
1096
sent_size += sent
1370
1371
logger.info("Sending secret to %s", client.name)
1372
# bump the timeout as if seen
1373
client.checked_ok(client.extended_timeout)
1374
if self.server.use_dbus:
1375
# Emit D-Bus signal
1376
client.GotSecret()
1377
1378
1097
finally:
1379
if approval_required:
1380
client.approvals_pending -= 1
1381
try:
1382
session.bye()
1383
except gnutls.errors.GNUTLSError as error:
1384
logger.warning("GnuTLS bye failed")
1098
session.bye()
1385
1099
1386
1100
@staticmethod
1387
1101
def peer_certificate(session):
1397
1111
.gnutls_certificate_get_peers
1398
1112
(session._c_object, ctypes.byref(list_size)))
1399
1113
if not bool(cert_list) and list_size.value != 0:
1400
raise gnutls.errors.GNUTLSError("error getting peer"
1401
" certificate")
1114
raise gnutls.errors.GNUTLSError(u"error getting peer"
1115
u" certificate")
1402
1116
if list_size.value == 0:
1403
1117
return None
1404
1118
cert = cert_list[0]
1430
1144
if crtverify.value != 0:
1431
1145
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1432
1146
raise (gnutls.errors.CertificateSecurityError
1433
("Verify failed"))
1147
(u"Verify failed"))
1434
1148
# New buffer for the fingerprint
1435
1149
buf = ctypes.create_string_buffer(20)
1436
1150
buf_len = ctypes.c_size_t()
1443
1157
# Convert the buffer to a Python bytestring
1444
1158
fpr = ctypes.string_at(buf, buf_len.value)
1445
1159
# Convert the bytestring to hexadecimal notation
1446
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1160
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1447
1161
return hex_fpr
1448
1162
1449
1163
1450
class MultiprocessingMixIn(object):
1451
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1452
def sub_process_main(self, request, address):
1453
try:
1454
self.finish_request(request, address)
1455
except:
1456
self.handle_error(request, address)
1457
self.close_request(request)
1458
1459
def process_request(self, request, address):
1460
"""Start a new process to process the request."""
1461
multiprocessing.Process(target = self.sub_process_main,
1462
args = (request, address)).start()
1463
1464
1465
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1466
""" adds a pipe to the MixIn """
1164
class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):
1165
"""Like socketserver.ForkingMixIn, but also pass a pipe pair."""
1467
1166
def process_request(self, request, client_address):
1468
1167
"""Overrides and wraps the original process_request().
1469
1168
1470
1169
This function creates a new pipe in self.pipe
1471
1170
"""
1472
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1473
1474
super(MultiprocessingMixInWithPipe,
1171
# Child writes to child_pipe
1172
self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
1173
# Parent writes to parent_pipe
1174
self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
1175
super(ForkingMixInWithPipes,
1475
1176
self).process_request(request, client_address)
1476
self.child_pipe.close()
1477
self.add_pipe(parent_pipe)
1478
1479
def add_pipe(self, parent_pipe):
1177
# Close unused ends for parent
1178
self.parent_pipe[0].close() # close read end
1179
self.child_pipe[1].close() # close write end
1180
self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])
1181
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1480
1182
"""Dummy function; override as necessary"""
1481
raise NotImplementedError
1482
1483
1484
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1183
child_pipe_fd.close()
1184
parent_pipe_fd.close()
1185
1186
1187
class IPv6_TCPServer(ForkingMixInWithPipes,
1485
1188
socketserver.TCPServer, object):
1486
1189
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1487
1190
1503
1206
bind to an address or port if they were not specified."""
1504
1207
if self.interface is not None:
1505
1208
if SO_BINDTODEVICE is None:
1506
logger.error("SO_BINDTODEVICE does not exist;"
1507
" cannot bind to interface %s",
1209
logger.error(u"SO_BINDTODEVICE does not exist;"
1210
u" cannot bind to interface %s",
1508
1211
self.interface)
1509
1212
else:
1510
1213
try:
1511
1214
self.socket.setsockopt(socket.SOL_SOCKET,
1512
1215
SO_BINDTODEVICE,
1513
1216
str(self.interface
1514
+ '\0'))
1515
except socket.error as error:
1217
+ u'\0'))
1218
except socket.error, error:
1516
1219
if error[0] == errno.EPERM:
1517
logger.error("No permission to"
1518
" bind to interface %s",
1220
logger.error(u"No permission to"
1221
u" bind to interface %s",
1519
1222
self.interface)
1520
1223
elif error[0] == errno.ENOPROTOOPT:
1521
logger.error("SO_BINDTODEVICE not available;"
1522
" cannot bind to interface %s",
1224
logger.error(u"SO_BINDTODEVICE not available;"
1225
u" cannot bind to interface %s",
1523
1226
self.interface)
1524
1227
else:
1525
1228
raise
1527
1230
if self.server_address[0] or self.server_address[1]:
1528
1231
if not self.server_address[0]:
1529
1232
if self.address_family == socket.AF_INET6:
1530
any_address = "::" # in6addr_any
1233
any_address = u"::" # in6addr_any
1531
1234
else:
1532
1235
any_address = socket.INADDR_ANY
1533
1236
self.server_address = (any_address,
1572
1275
return socketserver.TCPServer.server_activate(self)
1573
1276
def enable(self):
1574
1277
self.enabled = True
1575
def add_pipe(self, parent_pipe):
1278
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1576
1279
# Call "handle_ipc" for both data and EOF events
1577
gobject.io_add_watch(parent_pipe.fileno(),
1280
gobject.io_add_watch(child_pipe_fd.fileno(),
1578
1281
gobject.IO_IN | gobject.IO_HUP,
1579
1282
functools.partial(self.handle_ipc,
1580
parent_pipe = parent_pipe))
1581
1582
def handle_ipc(self, source, condition, parent_pipe=None,
1583
client_object=None):
1283
reply = parent_pipe_fd,
1284
sender= child_pipe_fd))
1285
def handle_ipc(self, source, condition, reply=None, sender=None):
1584
1286
condition_names = {
1585
gobject.IO_IN: "IN", # There is data to read.
1586
gobject.IO_OUT: "OUT", # Data can be written (without
1287
gobject.IO_IN: u"IN", # There is data to read.
1288
gobject.IO_OUT: u"OUT", # Data can be written (without
1587
1289
# blocking).
1588
gobject.IO_PRI: "PRI", # There is urgent data to read.
1589
gobject.IO_ERR: "ERR", # Error condition.
1590
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1290
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1291
gobject.IO_ERR: u"ERR", # Error condition.
1292
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1591
1293
# broken, usually for pipes and
1592
1294
# sockets).
1593
1295
}
1595
1297
for cond, name in
1596
1298
condition_names.iteritems()
1597
1299
if cond & condition)
1598
# error or the other end of multiprocessing.Pipe has closed
1599
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1600
return False
1601
1602
# Read a request from the child
1603
request = parent_pipe.recv()
1604
command = request[0]
1605
1606
if command == 'init':
1607
fpr = request[1]
1608
address = request[2]
1609
1610
for c in self.clients:
1611
if c.fingerprint == fpr:
1612
client = c
1613
break
1614
else:
1615
logger.info("Client not found for fingerprint: %s, ad"
1616
"dress: %s", fpr, address)
1617
if self.use_dbus:
1618
# Emit D-Bus signal
1619
mandos_dbus_service.ClientNotFound(fpr, address[0])
1620
parent_pipe.send(False)
1621
return False
1622
1623
gobject.io_add_watch(parent_pipe.fileno(),
1624
gobject.IO_IN | gobject.IO_HUP,
1625
functools.partial(self.handle_ipc,
1626
parent_pipe = parent_pipe,
1627
client_object = client))
1628
parent_pipe.send(True)
1629
# remove the old hook in favor of the new above hook on same fileno
1630
return False
1631
if command == 'funcall':
1632
funcname = request[1]
1633
args = request[2]
1634
kwargs = request[3]
1635
1636
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1637
1638
if command == 'getattr':
1639
attrname = request[1]
1640
if callable(client_object.__getattribute__(attrname)):
1641
parent_pipe.send(('function',))
1642
else:
1643
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1644
1645
if command == 'setattr':
1646
attrname = request[1]
1647
value = request[2]
1648
setattr(client_object, attrname, value)
1649
1300
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1301
conditions_string)
1302
1303
# Read a line from the file object
1304
cmdline = sender.readline()
1305
if not cmdline: # Empty line means end of file
1306
# close the IPC pipes
1307
sender.close()
1308
reply.close()
1309
1310
# Stop calling this function
1311
return False
1312
1313
logger.debug(u"IPC command: %r", cmdline)
1314
1315
# Parse and act on command
1316
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1317
1318
if cmd == u"NOTFOUND":
1319
fpr, address = args.split(None, 1)
1320
logger.warning(u"Client not found for fingerprint: %s, ad"
1321
u"dress: %s", fpr, address)
1322
if self.use_dbus:
1323
# Emit D-Bus signal
1324
mandos_dbus_service.ClientNotFound(fpr, address)
1325
elif cmd == u"DISABLED":
1326
for client in self.clients:
1327
if client.name == args:
1328
logger.warning(u"Client %s is disabled", args)
1329
if self.use_dbus:
1330
# Emit D-Bus signal
1331
client.Rejected()
1332
break
1333
else:
1334
logger.error(u"Unknown client %s is disabled", args)
1335
elif cmd == u"SENDING":
1336
for client in self.clients:
1337
if client.name == args:
1338
logger.info(u"Sending secret to %s", client.name)
1339
client.checked_ok()
1340
if self.use_dbus:
1341
# Emit D-Bus signal
1342
client.GotSecret()
1343
break
1344
else:
1345
logger.error(u"Sending secret to unknown client %s",
1346
args)
1347
elif cmd == u"GETATTR":
1348
attr_name, fpr = args.split(None, 1)
1349
for client in self.clients:
1350
if client.fingerprint == fpr:
1351
attr_value = getattr(client, attr_name, None)
1352
logger.debug("IPC reply: %r", attr_value)
1353
pickle.dump(attr_value, reply)
1354
break
1355
else:
1356
logger.error(u"Client %s on address %s requesting "
1357
u"attribute %s not found", fpr, address,
1358
attr_name)
1359
pickle.dump(None, reply)
1360
else:
1361
logger.error(u"Unknown IPC command: %r", cmdline)
1362
1363
# Keep calling this function
1650
1364
return True
1651
1365
1652
1366
1653
1367
def string_to_delta(interval):
1654
1368
"""Parse a string and return a datetime.timedelta
1655
1369
1656
>>> string_to_delta('7d')
1370
>>> string_to_delta(u'7d')
1657
1371
datetime.timedelta(7)
1658
>>> string_to_delta('60s')
1372
>>> string_to_delta(u'60s')
1659
1373
datetime.timedelta(0, 60)
1660
>>> string_to_delta('60m')
1374
>>> string_to_delta(u'60m')
1661
1375
datetime.timedelta(0, 3600)
1662
>>> string_to_delta('24h')
1376
>>> string_to_delta(u'24h')
1663
1377
datetime.timedelta(1)
1664
>>> string_to_delta('1w')
1378
>>> string_to_delta(u'1w')
1665
1379
datetime.timedelta(7)
1666
>>> string_to_delta('5m 30s')
1380
>>> string_to_delta(u'5m 30s')
1667
1381
datetime.timedelta(0, 330)
1668
1382
"""
1669
1383
timevalue = datetime.timedelta(0)
1671
1385
try:
1672
1386
suffix = unicode(s[-1])
1673
1387
value = int(s[:-1])
1674
if suffix == "d":
1388
if suffix == u"d":
1675
1389
delta = datetime.timedelta(value)
1676
elif suffix == "s":
1390
elif suffix == u"s":
1677
1391
delta = datetime.timedelta(0, value)
1678
elif suffix == "m":
1392
elif suffix == u"m":
1679
1393
delta = datetime.timedelta(0, 0, 0, 0, value)
1680
elif suffix == "h":
1394
elif suffix == u"h":
1681
1395
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1682
elif suffix == "w":
1396
elif suffix == u"w":
1683
1397
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1684
1398
else:
1685
raise ValueError("Unknown suffix %r" % suffix)
1686
except (ValueError, IndexError) as e:
1687
raise ValueError(*(e.args))
1399
raise ValueError(u"Unknown suffix %r" % suffix)
1400
except (ValueError, IndexError), e:
1401
raise ValueError(e.message)
1688
1402
timevalue += delta
1689
1403
return timevalue
1690
1404
1696
1410
global if_nametoindex
1697
1411
try:
1698
1412
if_nametoindex = (ctypes.cdll.LoadLibrary
1699
(ctypes.util.find_library("c"))
1413
(ctypes.util.find_library(u"c"))
1700
1414
.if_nametoindex)
1701
1415
except (OSError, AttributeError):
1702
logger.warning("Doing if_nametoindex the hard way")
1416
logger.warning(u"Doing if_nametoindex the hard way")
1703
1417
def if_nametoindex(interface):
1704
1418
"Get an interface index the hard way, i.e. using fcntl()"
1705
1419
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1706
1420
with contextlib.closing(socket.socket()) as s:
1707
1421
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1708
struct.pack(str("16s16x"),
1422
struct.pack(str(u"16s16x"),
1709
1423
interface))
1710
interface_index = struct.unpack(str("I"),
1424
interface_index = struct.unpack(str(u"I"),
1711
1425
ifreq[16:20])[0]
1712
1426
return interface_index
1713
1427
return if_nametoindex(interface)
1721
1435
sys.exit()
1722
1436
os.setsid()
1723
1437
if not nochdir:
1724
os.chdir("/")
1438
os.chdir(u"/")
1725
1439
if os.fork():
1726
1440
sys.exit()
1727
1441
if not noclose:
1729
1443
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1730
1444
if not stat.S_ISCHR(os.fstat(null).st_mode):
1731
1445
raise OSError(errno.ENODEV,
1732
"%s not a character device"
1446
u"%s not a character device"
1733
1447
% os.path.devnull)
1734
1448
os.dup2(null, sys.stdin.fileno())
1735
1449
os.dup2(null, sys.stdout.fileno())
1743
1457
##################################################################
1744
1458
# Parsing of options, both command line and config file
1745
1459
1746
parser = argparse.ArgumentParser()
1747
parser.add_argument("-v", "--version", action="version",
1748
version = "%%(prog)s %s" % version,
1749
help="show version number and exit")
1750
parser.add_argument("-i", "--interface", metavar="IF",
1751
help="Bind to interface IF")
1752
parser.add_argument("-a", "--address",
1753
help="Address to listen for requests on")
1754
parser.add_argument("-p", "--port", type=int,
1755
help="Port number to receive requests on")
1756
parser.add_argument("--check", action="store_true",
1757
help="Run self-test")
1758
parser.add_argument("--debug", action="store_true",
1759
help="Debug mode; run in foreground and log"
1760
" to terminal")
1761
parser.add_argument("--debuglevel", metavar="LEVEL",
1762
help="Debug level for stdout output")
1763
parser.add_argument("--priority", help="GnuTLS"
1764
" priority string (see GnuTLS documentation)")
1765
parser.add_argument("--servicename",
1766
metavar="NAME", help="Zeroconf service name")
1767
parser.add_argument("--configdir",
1768
default="/etc/mandos", metavar="DIR",
1769
help="Directory to search for configuration"
1770
" files")
1771
parser.add_argument("--no-dbus", action="store_false",
1772
dest="use_dbus", help="Do not provide D-Bus"
1773
" system bus interface")
1774
parser.add_argument("--no-ipv6", action="store_false",
1775
dest="use_ipv6", help="Do not use IPv6")
1776
options = parser.parse_args()
1460
parser = optparse.OptionParser(version = "%%prog %s" % version)
1461
parser.add_option("-i", u"--interface", type=u"string",
1462
metavar="IF", help=u"Bind to interface IF")
1463
parser.add_option("-a", u"--address", type=u"string",
1464
help=u"Address to listen for requests on")
1465
parser.add_option("-p", u"--port", type=u"int",
1466
help=u"Port number to receive requests on")
1467
parser.add_option("--check", action=u"store_true",
1468
help=u"Run self-test")
1469
parser.add_option("--debug", action=u"store_true",
1470
help=u"Debug mode; run in foreground and log to"
1471
u" terminal")
1472
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1473
u" priority string (see GnuTLS documentation)")
1474
parser.add_option("--servicename", type=u"string",
1475
metavar=u"NAME", help=u"Zeroconf service name")
1476
parser.add_option("--configdir", type=u"string",
1477
default=u"/etc/mandos", metavar=u"DIR",
1478
help=u"Directory to search for configuration"
1479
u" files")
1480
parser.add_option("--no-dbus", action=u"store_false",
1481
dest=u"use_dbus", help=u"Do not provide D-Bus"
1482
u" system bus interface")
1483
parser.add_option("--no-ipv6", action=u"store_false",
1484
dest=u"use_ipv6", help=u"Do not use IPv6")
1485
options = parser.parse_args()[0]
1777
1486
1778
1487
if options.check:
1779
1488
import doctest
1781
1490
sys.exit()
1782
1491
1783
1492
# Default values for config file for server-global settings
1784
server_defaults = { "interface": "",
1785
"address": "",
1786
"port": "",
1787
"debug": "False",
1788
"priority":
1789
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1790
"servicename": "Mandos",
1791
"use_dbus": "True",
1792
"use_ipv6": "True",
1793
"debuglevel": "",
1493
server_defaults = { u"interface": u"",
1494
u"address": u"",
1495
u"port": u"",
1496
u"debug": u"False",
1497
u"priority":
1498
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1499
u"servicename": u"Mandos",
1500
u"use_dbus": u"True",
1501
u"use_ipv6": u"True",
1794
1502
}
1795
1503
1796
1504
# Parse config file for server-global settings
1797
1505
server_config = configparser.SafeConfigParser(server_defaults)
1798
1506
del server_defaults
1799
1507
server_config.read(os.path.join(options.configdir,
1800
"mandos.conf"))
1508
u"mandos.conf"))
1801
1509
# Convert the SafeConfigParser object to a dict
1802
1510
server_settings = server_config.defaults()
1803
1511
# Use the appropriate methods on the non-string config options
1804
for option in ("debug", "use_dbus", "use_ipv6"):
1805
server_settings[option] = server_config.getboolean("DEFAULT",
1512
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1513
server_settings[option] = server_config.getboolean(u"DEFAULT",
1806
1514
option)
1807
1515
if server_settings["port"]:
1808
server_settings["port"] = server_config.getint("DEFAULT",
1809
"port")
1516
server_settings["port"] = server_config.getint(u"DEFAULT",
1517
u"port")
1810
1518
del server_config
1811
1519
1812
1520
# Override the settings from the config file with command line
1813
1521
# options, if set.
1814
for option in ("interface", "address", "port", "debug",
1815
"priority", "servicename", "configdir",
1816
"use_dbus", "use_ipv6", "debuglevel"):
1522
for option in (u"interface", u"address", u"port", u"debug",
1523
u"priority", u"servicename", u"configdir",
1524
u"use_dbus", u"use_ipv6"):
1817
1525
value = getattr(options, option)
1818
1526
if value is not None:
1819
1527
server_settings[option] = value
1827
1535
##################################################################
1828
1536
1829
1537
# For convenience
1830
debug = server_settings["debug"]
1831
debuglevel = server_settings["debuglevel"]
1832
use_dbus = server_settings["use_dbus"]
1833
use_ipv6 = server_settings["use_ipv6"]
1834
1835
if server_settings["servicename"] != "Mandos":
1538
debug = server_settings[u"debug"]
1539
use_dbus = server_settings[u"use_dbus"]
1540
use_ipv6 = server_settings[u"use_ipv6"]
1541
1542
if not debug:
1543
syslogger.setLevel(logging.WARNING)
1544
console.setLevel(logging.WARNING)
1545
1546
if server_settings[u"servicename"] != u"Mandos":
1836
1547
syslogger.setFormatter(logging.Formatter
1837
('Mandos (%s) [%%(process)d]:'
1838
' %%(levelname)s: %%(message)s'
1839
% server_settings["servicename"]))
1548
(u'Mandos (%s) [%%(process)d]:'
1549
u' %%(levelname)s: %%(message)s'
1550
% server_settings[u"servicename"]))
1840
1551
1841
1552
# Parse config file with clients
1842
client_defaults = { "timeout": "5m",
1843
"extended_timeout": "15m",
1844
"interval": "2m",
1845
"checker": "fping -q -- %%(host)s",
1846
"host": "",
1847
"approval_delay": "0s",
1848
"approval_duration": "1s",
1553
client_defaults = { u"timeout": u"1h",
1554
u"interval": u"5m",
1555
u"checker": u"fping -q -- %%(host)s",
1556
u"host": u"",
1849
1557
}
1850
1558
client_config = configparser.SafeConfigParser(client_defaults)
1851
client_config.read(os.path.join(server_settings["configdir"],
1852
"clients.conf"))
1559
client_config.read(os.path.join(server_settings[u"configdir"],
1560
u"clients.conf"))
1853
1561
1854
1562
global mandos_dbus_service
1855
1563
mandos_dbus_service = None
1856
1564
1857
tcp_server = MandosServer((server_settings["address"],
1858
server_settings["port"]),
1565
tcp_server = MandosServer((server_settings[u"address"],
1566
server_settings[u"port"]),
1859
1567
ClientHandler,
1860
interface=(server_settings["interface"]
1568
interface=(server_settings[u"interface"]
1861
1569
or None),
1862
1570
use_ipv6=use_ipv6,
1863
1571
gnutls_priority=
1864
server_settings["priority"],
1572
server_settings[u"priority"],
1865
1573
use_dbus=use_dbus)
1866
if not debug:
1867
pidfilename = "/var/run/mandos.pid"
1868
try:
1869
pidfile = open(pidfilename, "w")
1870
except IOError:
1871
logger.error("Could not open file %r", pidfilename)
1574
pidfilename = u"/var/run/mandos.pid"
1575
try:
1576
pidfile = open(pidfilename, u"w")
1577
except IOError:
1578
logger.error(u"Could not open file %r", pidfilename)
1872
1579
1873
1580
try:
1874
uid = pwd.getpwnam("_mandos").pw_uid
1875
gid = pwd.getpwnam("_mandos").pw_gid
1581
uid = pwd.getpwnam(u"_mandos").pw_uid
1582
gid = pwd.getpwnam(u"_mandos").pw_gid
1876
1583
except KeyError:
1877
1584
try:
1878
uid = pwd.getpwnam("mandos").pw_uid
1879
gid = pwd.getpwnam("mandos").pw_gid
1585
uid = pwd.getpwnam(u"mandos").pw_uid
1586
gid = pwd.getpwnam(u"mandos").pw_gid
1880
1587
except KeyError:
1881
1588
try:
1882
uid = pwd.getpwnam("nobody").pw_uid
1883
gid = pwd.getpwnam("nobody").pw_gid
1589
uid = pwd.getpwnam(u"nobody").pw_uid
1590
gid = pwd.getpwnam(u"nobody").pw_gid
1884
1591
except KeyError:
1885
1592
uid = 65534
1886
1593
gid = 65534
1887
1594
try:
1888
1595
os.setgid(gid)
1889
1596
os.setuid(uid)
1890
except OSError as error:
1597
except OSError, error:
1891
1598
if error[0] != errno.EPERM:
1892
1599
raise error
1893
1600
1894
if not debug and not debuglevel:
1895
syslogger.setLevel(logging.WARNING)
1896
console.setLevel(logging.WARNING)
1897
if debuglevel:
1898
level = getattr(logging, debuglevel.upper())
1899
syslogger.setLevel(level)
1900
console.setLevel(level)
1901
1601
# Enable all possible GnuTLS debugging
1902
1602
if debug:
1903
# Enable all possible GnuTLS debugging
1904
1905
1603
# "Use a log level over 10 to enable all debugging options."
1906
1604
# - GnuTLS manual
1907
1605
gnutls.library.functions.gnutls_global_set_log_level(11)
1908
1606
1909
1607
@gnutls.library.types.gnutls_log_func
1910
1608
def debug_gnutls(level, string):
1911
logger.debug("GnuTLS: %s", string[:-1])
1609
logger.debug(u"GnuTLS: %s", string[:-1])
1912
1610
1913
1611
(gnutls.library.functions
1914
1612
.gnutls_global_set_log_function(debug_gnutls))
1915
1916
# Redirect stdin so all checkers get /dev/null
1917
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1918
os.dup2(null, sys.stdin.fileno())
1919
if null > 2:
1920
os.close(null)
1921
else:
1922
# No console logging
1923
logger.removeHandler(console)
1924
1925
# Need to fork before connecting to D-Bus
1926
if not debug:
1927
# Close all input and output, do double fork, etc.
1928
daemon()
1929
1613
1930
1614
global main_loop
1931
1615
# From the Avahi example code
1935
1619
# End of Avahi example code
1936
1620
if use_dbus:
1937
1621
try:
1938
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1939
bus, do_not_queue=True)
1940
bus_name2 = dbus.service.BusName("se.recompile.Mandos",
1941
bus, do_not_queue=True)
1942
except dbus.exceptions.NameExistsException as e:
1943
logger.error(unicode(e) + ", disabling D-Bus")
1622
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1623
bus, do_not_queue=True)
1624
except dbus.exceptions.NameExistsException, e:
1625
logger.error(unicode(e) + u", disabling D-Bus")
1944
1626
use_dbus = False
1945
server_settings["use_dbus"] = False
1627
server_settings[u"use_dbus"] = False
1946
1628
tcp_server.use_dbus = False
1947
1629
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1948
service = AvahiService(name = server_settings["servicename"],
1949
servicetype = "_mandos._tcp",
1630
service = AvahiService(name = server_settings[u"servicename"],
1631
servicetype = u"_mandos._tcp",
1950
1632
protocol = protocol, bus = bus)
1951
1633
if server_settings["interface"]:
1952
1634
service.interface = (if_nametoindex
1953
(str(server_settings["interface"])))
1954
1955
global multiprocessing_manager
1956
multiprocessing_manager = multiprocessing.Manager()
1635
(str(server_settings[u"interface"])))
1957
1636
1958
1637
client_class = Client
1959
1638
if use_dbus:
1960
client_class = functools.partial(ClientDBusTransitional, bus = bus)
1961
def client_config_items(config, section):
1962
special_settings = {
1963
"approved_by_default":
1964
lambda: config.getboolean(section,
1965
"approved_by_default"),
1966
}
1967
for name, value in config.items(section):
1968
try:
1969
yield (name, special_settings[name]())
1970
except KeyError:
1971
yield (name, value)
1972
1639
client_class = functools.partial(ClientDBus, bus = bus)
1973
1640
tcp_server.clients.update(set(
1974
1641
client_class(name = section,
1975
config= dict(client_config_items(
1976
client_config, section)))
1642
config= dict(client_config.items(section)))
1977
1643
for section in client_config.sections()))
1978
1644
if not tcp_server.clients:
1979
logger.warning("No clients defined")
1980
1645
logger.warning(u"No clients defined")
1646
1647
if debug:
1648
# Redirect stdin so all checkers get /dev/null
1649
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1650
os.dup2(null, sys.stdin.fileno())
1651
if null > 2:
1652
os.close(null)
1653
else:
1654
# No console logging
1655
logger.removeHandler(console)
1656
# Close all input and output, do double fork, etc.
1657
daemon()
1658
1659
try:
1660
with pidfile:
1661
pid = os.getpid()
1662
pidfile.write(str(pid) + "\n")
1663
del pidfile
1664
except IOError:
1665
logger.error(u"Could not write to file %r with PID %d",
1666
pidfilename, pid)
1667
except NameError:
1668
# "pidfile" was never created
1669
pass
1670
del pidfilename
1671
1981
1672
if not debug:
1982
try:
1983
with pidfile:
1984
pid = os.getpid()
1985
pidfile.write(str(pid) + "\n".encode("utf-8"))
1986
del pidfile
1987
except IOError:
1988
logger.error("Could not write to file %r with PID %d",
1989
pidfilename, pid)
1990
except NameError:
1991
# "pidfile" was never created
1992
pass
1993
del pidfilename
1994
1995
1673
signal.signal(signal.SIGINT, signal.SIG_IGN)
1996
1997
1674
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1998
1675
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1999
1676
2001
1678
class MandosDBusService(dbus.service.Object):
2002
1679
"""A D-Bus proxy object"""
2003
1680
def __init__(self):
2004
dbus.service.Object.__init__(self, bus, "/")
2005
_interface = "se.bsnet.fukt.Mandos"
1681
dbus.service.Object.__init__(self, bus, u"/")
1682
_interface = u"se.bsnet.fukt.Mandos"
2006
1683
2007
@dbus.service.signal(_interface, signature="o")
1684
@dbus.service.signal(_interface, signature=u"o")
2008
1685
def ClientAdded(self, objpath):
2009
1686
"D-Bus signal"
2010
1687
pass
2011
1688
2012
@dbus.service.signal(_interface, signature="ss")
1689
@dbus.service.signal(_interface, signature=u"ss")
2013
1690
def ClientNotFound(self, fingerprint, address):
2014
1691
"D-Bus signal"
2015
1692
pass
2016
1693
2017
@dbus.service.signal(_interface, signature="os")
1694
@dbus.service.signal(_interface, signature=u"os")
2018
1695
def ClientRemoved(self, objpath, name):
2019
1696
"D-Bus signal"
2020
1697
pass
2021
1698
2022
@dbus.service.method(_interface, out_signature="ao")
1699
@dbus.service.method(_interface, out_signature=u"ao")
2023
1700
def GetAllClients(self):
2024
1701
"D-Bus method"
2025
1702
return dbus.Array(c.dbus_object_path
2026
1703
for c in tcp_server.clients)
2027
1704
2028
1705
@dbus.service.method(_interface,
2029
out_signature="a{oa{sv}}")
1706
out_signature=u"a{oa{sv}}")
2030
1707
def GetAllClientsWithProperties(self):
2031
1708
"D-Bus method"
2032
1709
return dbus.Dictionary(
2033
((c.dbus_object_path, c.GetAll(""))
1710
((c.dbus_object_path, c.GetAll(u""))
2034
1711
for c in tcp_server.clients),
2035
signature="oa{sv}")
1712
signature=u"oa{sv}")
2036
1713
2037
@dbus.service.method(_interface, in_signature="o")
1714
@dbus.service.method(_interface, in_signature=u"o")
2038
1715
def RemoveClient(self, object_path):
2039
1716
"D-Bus method"
2040
1717
for c in tcp_server.clients:
2050
1727
2051
1728
del _interface
2052
1729
2053
class MandosDBusServiceTransitional(MandosDBusService):
2054
__metaclass__ = transitional_dbus_metaclass
2055
mandos_dbus_service = MandosDBusServiceTransitional()
1730
mandos_dbus_service = MandosDBusService()
2056
1731
2057
1732
def cleanup():
2058
1733
"Cleanup function; run on exit"
2084
1759
# Find out what port we got
2085
1760
service.port = tcp_server.socket.getsockname()[1]
2086
1761
if use_ipv6:
2087
logger.info("Now listening on address %r, port %d,"
1762
logger.info(u"Now listening on address %r, port %d,"
2088
1763
" flowinfo %d, scope_id %d"
2089
1764
% tcp_server.socket.getsockname())
2090
1765
else: # IPv4
2091
logger.info("Now listening on address %r, port %d"
1766
logger.info(u"Now listening on address %r, port %d"
2092
1767
% tcp_server.socket.getsockname())
2093
1768
2094
1769
#service.interface = tcp_server.socket.getsockname()[3]
2097
1772
# From the Avahi example code
2098
1773
try:
2099
1774
service.activate()
2100
except dbus.exceptions.DBusException as error:
2101
logger.critical("DBusException: %s", error)
1775
except dbus.exceptions.DBusException, error:
1776
logger.critical(u"DBusException: %s", error)
2102
1777
cleanup()
2103
1778
sys.exit(1)
2104
1779
# End of Avahi example code
2108
1783
(tcp_server.handle_request
2109
1784
(*args[2:], **kwargs) or True))
2110
1785
2111
logger.debug("Starting main loop")
1786
logger.debug(u"Starting main loop")
2112
1787
main_loop.run()
2113
except AvahiError as error:
2114
logger.critical("AvahiError: %s", error)
1788
except AvahiError, error:
1789
logger.critical(u"AvahiError: %s", error)
2115
1790
cleanup()
2116
1791
sys.exit(1)
2117
1792
except KeyboardInterrupt:
2118
1793
if debug:
2119
print("", file=sys.stderr)
2120
logger.debug("Server received KeyboardInterrupt")
2121
logger.debug("Server exiting")
1794
print >> sys.stderr
1795
logger.debug(u"Server received KeyboardInterrupt")
1796
logger.debug(u"Server exiting")
2122
1797
# Must run before the D-Bus bus name gets deregistered
2123
1798
cleanup()
2124
1799
2125
2126
1800
if __name__ == '__main__':
2127
1801
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0