To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 419
- compare with another revision
- download diff
- download tarball
- view history from revision 419
- Committer: teddy at bsnet
- Date: 2010-09-09 18:16:14 UTC
- mfrom: (237.2.35 mandos-empty-device)
- Revision ID: teddy@fukt.bsnet.se-20100909181614-oanlmvkzsiodbo3c
Merge in branch to interpret an empty device name to mean
"autodetect".
"autodetect".
- files removed:
- DBUS-API
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2010 Teddy Hogeborn
15
# Copyright © 2008-2010 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
31
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import division, absolute_import, unicode_literals
34
from __future__ import division, with_statement, absolute_import
35
35
36
36
import SocketServer as socketserver
37
37
import socket
60
60
import fcntl
61
61
import functools
62
62
import cPickle as pickle
63
import multiprocessing
63
import select
64
64
65
65
import dbus
66
66
import dbus.service
81
81
SO_BINDTODEVICE = None
82
82
83
83
84
version = "1.2.3"
84
version = "1.0.14"
85
85
86
#logger = logging.getLogger('mandos')
87
logger = logging.Logger('mandos')
86
logger = logging.Logger(u'mandos')
88
87
syslogger = (logging.handlers.SysLogHandler
89
88
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
90
89
address = "/dev/log"))
91
90
syslogger.setFormatter(logging.Formatter
92
('Mandos [%(process)d]: %(levelname)s:'
93
' %(message)s'))
91
(u'Mandos [%(process)d]: %(levelname)s:'
92
u' %(message)s'))
94
93
logger.addHandler(syslogger)
95
94
96
95
console = logging.StreamHandler()
97
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
98
' %(levelname)s:'
99
' %(message)s'))
96
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
97
u' %(levelname)s:'
98
u' %(message)s'))
100
99
logger.addHandler(console)
101
100
102
101
class AvahiError(Exception):
119
118
Attributes:
120
119
interface: integer; avahi.IF_UNSPEC or an interface index.
121
120
Used to optionally bind to the specified interface.
122
name: string; Example: 'Mandos'
123
type: string; Example: '_mandos._tcp'.
121
name: string; Example: u'Mandos'
122
type: string; Example: u'_mandos._tcp'.
124
123
See <http://www.dns-sd.org/ServiceTypes.html>
125
124
port: integer; what port to announce
126
125
TXT: list of strings; TXT record for the service
135
134
"""
136
135
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
137
136
servicetype = None, port = None, TXT = None,
138
domain = "", host = "", max_renames = 32768,
137
domain = u"", host = u"", max_renames = 32768,
139
138
protocol = avahi.PROTO_UNSPEC, bus = None):
140
139
self.interface = interface
141
140
self.name = name
153
152
def rename(self):
154
153
"""Derived from the Avahi example code"""
155
154
if self.rename_count >= self.max_renames:
156
logger.critical("No suitable Zeroconf service name found"
157
" after %i retries, exiting.",
155
logger.critical(u"No suitable Zeroconf service name found"
156
u" after %i retries, exiting.",
158
157
self.rename_count)
159
raise AvahiServiceError("Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
161
logger.info("Changing Zeroconf service name to %r ...",
162
self.name)
158
raise AvahiServiceError(u"Too many renames")
159
self.name = self.server.GetAlternativeServiceName(self.name)
160
logger.info(u"Changing Zeroconf service name to %r ...",
161
unicode(self.name))
163
162
syslogger.setFormatter(logging.Formatter
164
('Mandos (%s) [%%(process)d]:'
165
' %%(levelname)s: %%(message)s'
163
(u'Mandos (%s) [%%(process)d]:'
164
u' %%(levelname)s: %%(message)s'
166
165
% self.name))
167
166
self.remove()
168
try:
169
self.add()
170
except dbus.exceptions.DBusException, error:
171
logger.critical("DBusException: %s", error)
172
self.cleanup()
173
os._exit(1)
167
self.add()
174
168
self.rename_count += 1
175
169
def remove(self):
176
170
"""Derived from the Avahi example code"""
186
180
self.group.connect_to_signal('StateChanged',
187
181
self
188
182
.entry_group_state_changed)
189
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
183
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
190
184
self.name, self.type)
191
185
self.group.AddService(
192
186
self.interface,
199
193
self.group.Commit()
200
194
def entry_group_state_changed(self, state, error):
201
195
"""Derived from the Avahi example code"""
202
logger.debug("Avahi entry group state change: %i", state)
196
logger.debug(u"Avahi entry group state change: %i", state)
203
197
204
198
if state == avahi.ENTRY_GROUP_ESTABLISHED:
205
logger.debug("Zeroconf service established.")
199
logger.debug(u"Zeroconf service established.")
206
200
elif state == avahi.ENTRY_GROUP_COLLISION:
207
logger.info("Zeroconf service name collision.")
201
logger.warning(u"Zeroconf service name collision.")
208
202
self.rename()
209
203
elif state == avahi.ENTRY_GROUP_FAILURE:
210
logger.critical("Avahi: Error in group state changed %s",
204
logger.critical(u"Avahi: Error in group state changed %s",
211
205
unicode(error))
212
raise AvahiGroupError("State changed: %s"
206
raise AvahiGroupError(u"State changed: %s"
213
207
% unicode(error))
214
208
def cleanup(self):
215
209
"""Derived from the Avahi example code"""
218
212
self.group = None
219
213
def server_state_changed(self, state):
220
214
"""Derived from the Avahi example code"""
221
logger.debug("Avahi server state change: %i", state)
215
logger.debug(u"Avahi server state change: %i", state)
222
216
if state == avahi.SERVER_COLLISION:
223
logger.error("Zeroconf server name collision")
217
logger.error(u"Zeroconf server name collision")
224
218
self.remove()
225
219
elif state == avahi.SERVER_RUNNING:
226
220
self.add()
231
225
self.bus.get_object(avahi.DBUS_NAME,
232
226
avahi.DBUS_PATH_SERVER),
233
227
avahi.DBUS_INTERFACE_SERVER)
234
self.server.connect_to_signal("StateChanged",
228
self.server.connect_to_signal(u"StateChanged",
235
229
self.server_state_changed)
236
230
self.server_state_changed(self.server.GetState())
237
231
240
234
"""A representation of a client host served by this server.
241
235
242
236
Attributes:
243
_approved: bool(); 'None' if not yet approved/disapproved
244
approval_delay: datetime.timedelta(); Time to wait for approval
245
approval_duration: datetime.timedelta(); Duration of one approval
237
name: string; from the config file, used in log messages and
238
D-Bus identifiers
239
fingerprint: string (40 or 32 hexadecimal digits); used to
240
uniquely identify the client
241
secret: bytestring; sent verbatim (over TLS) to client
242
host: string; available for use by the checker command
243
created: datetime.datetime(); (UTC) object creation
244
last_enabled: datetime.datetime(); (UTC)
245
enabled: bool()
246
last_checked_ok: datetime.datetime(); (UTC) or None
247
timeout: datetime.timedelta(); How long from last_checked_ok
248
until this client is disabled
249
interval: datetime.timedelta(); How often to start a new checker
250
disable_hook: If set, called by disable() as disable_hook(self)
246
251
checker: subprocess.Popen(); a running checker process used
247
252
to see if the client lives.
248
253
'None' if no process is running.
249
checker_callback_tag: a gobject event source tag, or None
250
checker_command: string; External command which is run to check
251
if client lives. %() expansions are done at
254
checker_initiator_tag: a gobject event source tag, or None
255
disable_initiator_tag: - '' -
256
checker_callback_tag: - '' -
257
checker_command: string; External command which is run to check if
258
client lives. %() expansions are done at
252
259
runtime with vars(self) as dict, so that for
253
260
instance %(name)s can be used in the command.
254
checker_initiator_tag: a gobject event source tag, or None
255
created: datetime.datetime(); (UTC) object creation
256
261
current_checker_command: string; current running checker_command
257
disable_hook: If set, called by disable() as disable_hook(self)
258
disable_initiator_tag: a gobject event source tag, or None
259
enabled: bool()
260
fingerprint: string (40 or 32 hexadecimal digits); used to
261
uniquely identify the client
262
host: string; available for use by the checker command
263
interval: datetime.timedelta(); How often to start a new checker
264
last_approval_request: datetime.datetime(); (UTC) or None
265
last_checked_ok: datetime.datetime(); (UTC) or None
266
last_enabled: datetime.datetime(); (UTC)
267
name: string; from the config file, used in log messages and
268
D-Bus identifiers
269
secret: bytestring; sent verbatim (over TLS) to client
270
timeout: datetime.timedelta(); How long from last_checked_ok
271
until this client is disabled
272
runtime_expansions: Allowed attributes for runtime expansion.
273
262
"""
274
263
275
runtime_expansions = ("approval_delay", "approval_duration",
276
"created", "enabled", "fingerprint",
277
"host", "interval", "last_checked_ok",
278
"last_enabled", "name", "timeout")
279
280
264
@staticmethod
281
265
def _timedelta_to_milliseconds(td):
282
266
"Convert a datetime.timedelta() to milliseconds"
291
275
def interval_milliseconds(self):
292
276
"Return the 'interval' attribute in milliseconds"
293
277
return self._timedelta_to_milliseconds(self.interval)
294
295
def approval_delay_milliseconds(self):
296
return self._timedelta_to_milliseconds(self.approval_delay)
297
278
298
279
def __init__(self, name = None, disable_hook=None, config=None):
299
280
"""Note: the 'checker' key in 'config' sets the
302
283
self.name = name
303
284
if config is None:
304
285
config = {}
305
logger.debug("Creating client %r", self.name)
286
logger.debug(u"Creating client %r", self.name)
306
287
# Uppercase and remove spaces from fingerprint for later
307
288
# comparison purposes with return value from the fingerprint()
308
289
# function
309
self.fingerprint = (config["fingerprint"].upper()
310
.replace(" ", ""))
311
logger.debug(" Fingerprint: %s", self.fingerprint)
312
if "secret" in config:
313
self.secret = config["secret"].decode("base64")
314
elif "secfile" in config:
290
self.fingerprint = (config[u"fingerprint"].upper()
291
.replace(u" ", u""))
292
logger.debug(u" Fingerprint: %s", self.fingerprint)
293
if u"secret" in config:
294
self.secret = config[u"secret"].decode(u"base64")
295
elif u"secfile" in config:
315
296
with open(os.path.expanduser(os.path.expandvars
316
(config["secfile"])),
297
(config[u"secfile"])),
317
298
"rb") as secfile:
318
299
self.secret = secfile.read()
319
300
else:
320
raise TypeError("No secret or secfile for client %s"
301
raise TypeError(u"No secret or secfile for client %s"
321
302
% self.name)
322
self.host = config.get("host", "")
303
self.host = config.get(u"host", u"")
323
304
self.created = datetime.datetime.utcnow()
324
305
self.enabled = False
325
self.last_approval_request = None
326
306
self.last_enabled = None
327
307
self.last_checked_ok = None
328
self.timeout = string_to_delta(config["timeout"])
329
self.interval = string_to_delta(config["interval"])
308
self.timeout = string_to_delta(config[u"timeout"])
309
self.interval = string_to_delta(config[u"interval"])
330
310
self.disable_hook = disable_hook
331
311
self.checker = None
332
312
self.checker_initiator_tag = None
333
313
self.disable_initiator_tag = None
334
314
self.checker_callback_tag = None
335
self.checker_command = config["checker"]
315
self.checker_command = config[u"checker"]
336
316
self.current_checker_command = None
337
317
self.last_connect = None
338
self._approved = None
339
self.approved_by_default = config.get("approved_by_default",
340
True)
341
self.approvals_pending = 0
342
self.approval_delay = string_to_delta(
343
config["approval_delay"])
344
self.approval_duration = string_to_delta(
345
config["approval_duration"])
346
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
347
318
348
def send_changedstate(self):
349
self.changedstate.acquire()
350
self.changedstate.notify_all()
351
self.changedstate.release()
352
353
319
def enable(self):
354
320
"""Start this client's checker and timeout hooks"""
355
if getattr(self, "enabled", False):
321
if getattr(self, u"enabled", False):
356
322
# Already enabled
357
323
return
358
self.send_changedstate()
359
324
self.last_enabled = datetime.datetime.utcnow()
360
325
# Schedule a new checker to be started an 'interval' from now,
361
326
# and every interval from then on.
375
340
if not getattr(self, "enabled", False):
376
341
return False
377
342
if not quiet:
378
self.send_changedstate()
379
if not quiet:
380
logger.info("Disabling client %s", self.name)
381
if getattr(self, "disable_initiator_tag", False):
343
logger.info(u"Disabling client %s", self.name)
344
if getattr(self, u"disable_initiator_tag", False):
382
345
gobject.source_remove(self.disable_initiator_tag)
383
346
self.disable_initiator_tag = None
384
if getattr(self, "checker_initiator_tag", False):
347
if getattr(self, u"checker_initiator_tag", False):
385
348
gobject.source_remove(self.checker_initiator_tag)
386
349
self.checker_initiator_tag = None
387
350
self.stop_checker()
402
365
if os.WIFEXITED(condition):
403
366
exitstatus = os.WEXITSTATUS(condition)
404
367
if exitstatus == 0:
405
logger.info("Checker for %(name)s succeeded",
368
logger.info(u"Checker for %(name)s succeeded",
406
369
vars(self))
407
370
self.checked_ok()
408
371
else:
409
logger.info("Checker for %(name)s failed",
372
logger.info(u"Checker for %(name)s failed",
410
373
vars(self))
411
374
else:
412
logger.warning("Checker for %(name)s crashed?",
375
logger.warning(u"Checker for %(name)s crashed?",
413
376
vars(self))
414
377
415
378
def checked_ok(self):
424
387
(self.timeout_milliseconds(),
425
388
self.disable))
426
389
427
def need_approval(self):
428
self.last_approval_request = datetime.datetime.utcnow()
429
430
390
def start_checker(self):
431
391
"""Start a new checker subprocess if one is not running.
432
392
450
410
raise error
451
411
else:
452
412
if pid:
453
logger.warning("Checker was a zombie")
413
logger.warning(u"Checker was a zombie")
454
414
gobject.source_remove(self.checker_callback_tag)
455
415
self.checker_callback(pid, status,
456
416
self.current_checker_command)
461
421
command = self.checker_command % self.host
462
422
except TypeError:
463
423
# Escape attributes for the shell
464
escaped_attrs = dict(
465
(attr,
466
re.escape(unicode(str(getattr(self, attr, "")),
467
errors=
468
'replace')))
469
for attr in
470
self.runtime_expansions)
471
424
escaped_attrs = dict((key,
425
re.escape(unicode(str(val),
426
errors=
427
u'replace')))
428
for key, val in
429
vars(self).iteritems())
472
430
try:
473
431
command = self.checker_command % escaped_attrs
474
432
except TypeError, error:
475
logger.error('Could not format string "%s":'
476
' %s', self.checker_command, error)
433
logger.error(u'Could not format string "%s":'
434
u' %s', self.checker_command, error)
477
435
return True # Try again later
478
436
self.current_checker_command = command
479
437
try:
480
logger.info("Starting checker %r for %s",
438
logger.info(u"Starting checker %r for %s",
481
439
command, self.name)
482
440
# We don't need to redirect stdout and stderr, since
483
441
# in normal mode, that is already done by daemon(),
485
443
# always replaced by /dev/null.)
486
444
self.checker = subprocess.Popen(command,
487
445
close_fds=True,
488
shell=True, cwd="/")
446
shell=True, cwd=u"/")
489
447
self.checker_callback_tag = (gobject.child_watch_add
490
448
(self.checker.pid,
491
449
self.checker_callback,
497
455
gobject.source_remove(self.checker_callback_tag)
498
456
self.checker_callback(pid, status, command)
499
457
except OSError, error:
500
logger.error("Failed to start subprocess: %s",
458
logger.error(u"Failed to start subprocess: %s",
501
459
error)
502
460
# Re-run this periodically if run by gobject.timeout_add
503
461
return True
507
465
if self.checker_callback_tag:
508
466
gobject.source_remove(self.checker_callback_tag)
509
467
self.checker_callback_tag = None
510
if getattr(self, "checker", None) is None:
468
if getattr(self, u"checker", None) is None:
511
469
return
512
logger.debug("Stopping checker for %(name)s", vars(self))
470
logger.debug(u"Stopping checker for %(name)s", vars(self))
513
471
try:
514
472
os.kill(self.checker.pid, signal.SIGTERM)
515
473
#time.sleep(0.5)
520
478
raise
521
479
self.checker = None
522
480
523
def dbus_service_property(dbus_interface, signature="v",
524
access="readwrite", byte_arrays=False):
481
482
def dbus_service_property(dbus_interface, signature=u"v",
483
access=u"readwrite", byte_arrays=False):
525
484
"""Decorators for marking methods of a DBusObjectWithProperties to
526
485
become properties on the D-Bus.
527
486
534
493
"""
535
494
# Encoding deeply encoded byte arrays is not supported yet by the
536
495
# "Set" method, so we fail early here:
537
if byte_arrays and signature != "ay":
538
raise ValueError("Byte arrays not supported for non-'ay'"
539
" signature %r" % signature)
496
if byte_arrays and signature != u"ay":
497
raise ValueError(u"Byte arrays not supported for non-'ay'"
498
u" signature %r" % signature)
540
499
def decorator(func):
541
500
func._dbus_is_property = True
542
501
func._dbus_interface = dbus_interface
543
502
func._dbus_signature = signature
544
503
func._dbus_access = access
545
504
func._dbus_name = func.__name__
546
if func._dbus_name.endswith("_dbus_property"):
505
if func._dbus_name.endswith(u"_dbus_property"):
547
506
func._dbus_name = func._dbus_name[:-14]
548
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
507
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
549
508
return func
550
509
return decorator
551
510
579
538
580
539
@staticmethod
581
540
def _is_dbus_property(obj):
582
return getattr(obj, "_dbus_is_property", False)
541
return getattr(obj, u"_dbus_is_property", False)
583
542
584
543
def _get_all_dbus_properties(self):
585
544
"""Returns a generator of (name, attribute) pairs
593
552
property with the specified name and interface.
594
553
"""
595
554
for name in (property_name,
596
property_name + "_dbus_property"):
555
property_name + u"_dbus_property"):
597
556
prop = getattr(self, name, None)
598
557
if (prop is None
599
558
or not self._is_dbus_property(prop)
603
562
continue
604
563
return prop
605
564
# No such property
606
raise DBusPropertyNotFound(self.dbus_object_path + ":"
607
+ interface_name + "."
565
raise DBusPropertyNotFound(self.dbus_object_path + u":"
566
+ interface_name + u"."
608
567
+ property_name)
609
568
610
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
611
out_signature="v")
569
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
570
out_signature=u"v")
612
571
def Get(self, interface_name, property_name):
613
572
"""Standard D-Bus property Get() method, see D-Bus standard.
614
573
"""
615
574
prop = self._get_dbus_property(interface_name, property_name)
616
if prop._dbus_access == "write":
575
if prop._dbus_access == u"write":
617
576
raise DBusPropertyAccessException(property_name)
618
577
value = prop()
619
if not hasattr(value, "variant_level"):
578
if not hasattr(value, u"variant_level"):
620
579
return value
621
580
return type(value)(value, variant_level=value.variant_level+1)
622
581
623
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
582
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
624
583
def Set(self, interface_name, property_name, value):
625
584
"""Standard D-Bus property Set() method, see D-Bus standard.
626
585
"""
627
586
prop = self._get_dbus_property(interface_name, property_name)
628
if prop._dbus_access == "read":
587
if prop._dbus_access == u"read":
629
588
raise DBusPropertyAccessException(property_name)
630
if prop._dbus_get_args_options["byte_arrays"]:
589
if prop._dbus_get_args_options[u"byte_arrays"]:
631
590
# The byte_arrays option is not supported yet on
632
591
# signatures other than "ay".
633
if prop._dbus_signature != "ay":
592
if prop._dbus_signature != u"ay":
634
593
raise ValueError
635
594
value = dbus.ByteArray(''.join(unichr(byte)
636
595
for byte in value))
637
596
prop(value)
638
597
639
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
640
out_signature="a{sv}")
598
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
599
out_signature=u"a{sv}")
641
600
def GetAll(self, interface_name):
642
601
"""Standard D-Bus property GetAll() method, see D-Bus
643
602
standard.
651
610
# Interface non-empty but did not match
652
611
continue
653
612
# Ignore write-only properties
654
if prop._dbus_access == "write":
613
if prop._dbus_access == u"write":
655
614
continue
656
615
value = prop()
657
if not hasattr(value, "variant_level"):
616
if not hasattr(value, u"variant_level"):
658
617
all[name] = value
659
618
continue
660
619
all[name] = type(value)(value, variant_level=
661
620
value.variant_level+1)
662
return dbus.Dictionary(all, signature="sv")
621
return dbus.Dictionary(all, signature=u"sv")
663
622
664
623
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
665
out_signature="s",
624
out_signature=u"s",
666
625
path_keyword='object_path',
667
626
connection_keyword='connection')
668
627
def Introspect(self, object_path, connection):
673
632
try:
674
633
document = xml.dom.minidom.parseString(xmlstring)
675
634
def make_tag(document, name, prop):
676
e = document.createElement("property")
677
e.setAttribute("name", name)
678
e.setAttribute("type", prop._dbus_signature)
679
e.setAttribute("access", prop._dbus_access)
635
e = document.createElement(u"property")
636
e.setAttribute(u"name", name)
637
e.setAttribute(u"type", prop._dbus_signature)
638
e.setAttribute(u"access", prop._dbus_access)
680
639
return e
681
for if_tag in document.getElementsByTagName("interface"):
640
for if_tag in document.getElementsByTagName(u"interface"):
682
641
for tag in (make_tag(document, name, prop)
683
642
for name, prop
684
643
in self._get_all_dbus_properties()
685
644
if prop._dbus_interface
686
== if_tag.getAttribute("name")):
645
== if_tag.getAttribute(u"name")):
687
646
if_tag.appendChild(tag)
688
647
# Add the names to the return values for the
689
648
# "org.freedesktop.DBus.Properties" methods
690
if (if_tag.getAttribute("name")
691
== "org.freedesktop.DBus.Properties"):
692
for cn in if_tag.getElementsByTagName("method"):
693
if cn.getAttribute("name") == "Get":
694
for arg in cn.getElementsByTagName("arg"):
695
if (arg.getAttribute("direction")
696
== "out"):
697
arg.setAttribute("name", "value")
698
elif cn.getAttribute("name") == "GetAll":
699
for arg in cn.getElementsByTagName("arg"):
700
if (arg.getAttribute("direction")
701
== "out"):
702
arg.setAttribute("name", "props")
703
xmlstring = document.toxml("utf-8")
649
if (if_tag.getAttribute(u"name")
650
== u"org.freedesktop.DBus.Properties"):
651
for cn in if_tag.getElementsByTagName(u"method"):
652
if cn.getAttribute(u"name") == u"Get":
653
for arg in cn.getElementsByTagName(u"arg"):
654
if (arg.getAttribute(u"direction")
655
== u"out"):
656
arg.setAttribute(u"name", u"value")
657
elif cn.getAttribute(u"name") == u"GetAll":
658
for arg in cn.getElementsByTagName(u"arg"):
659
if (arg.getAttribute(u"direction")
660
== u"out"):
661
arg.setAttribute(u"name", u"props")
662
xmlstring = document.toxml(u"utf-8")
704
663
document.unlink()
705
664
except (AttributeError, xml.dom.DOMException,
706
665
xml.parsers.expat.ExpatError), error:
707
logger.error("Failed to override Introspection method",
666
logger.error(u"Failed to override Introspection method",
708
667
error)
709
668
return xmlstring
710
669
716
675
dbus_object_path: dbus.ObjectPath
717
676
bus: dbus.SystemBus()
718
677
"""
719
720
runtime_expansions = (Client.runtime_expansions
721
+ ("dbus_object_path",))
722
723
678
# dbus.service.Object doesn't use super(), so we can't either.
724
679
725
680
def __init__(self, bus = None, *args, **kwargs):
726
self._approvals_pending = 0
727
681
self.bus = bus
728
682
Client.__init__(self, *args, **kwargs)
729
683
# Only now, when this client is initialized, can it show up on
730
684
# the D-Bus
731
client_object_name = unicode(self.name).translate(
732
{ord("."): ord("_"),
733
ord("-"): ord("_")})
734
685
self.dbus_object_path = (dbus.ObjectPath
735
("/clients/" + client_object_name))
686
(u"/clients/"
687
+ self.name.replace(u".", u"_")))
736
688
DBusObjectWithProperties.__init__(self, self.bus,
737
689
self.dbus_object_path)
738
739
def _get_approvals_pending(self):
740
return self._approvals_pending
741
def _set_approvals_pending(self, value):
742
old_value = self._approvals_pending
743
self._approvals_pending = value
744
bval = bool(value)
745
if (hasattr(self, "dbus_object_path")
746
and bval is not bool(old_value)):
747
dbus_bool = dbus.Boolean(bval, variant_level=1)
748
self.PropertyChanged(dbus.String("ApprovalPending"),
749
dbus_bool)
750
751
approvals_pending = property(_get_approvals_pending,
752
_set_approvals_pending)
753
del _get_approvals_pending, _set_approvals_pending
754
690
755
691
@staticmethod
756
692
def _datetime_to_dbus(dt, variant_level=0):
759
695
variant_level=variant_level)
760
696
761
697
def enable(self):
762
oldstate = getattr(self, "enabled", False)
698
oldstate = getattr(self, u"enabled", False)
763
699
r = Client.enable(self)
764
700
if oldstate != self.enabled:
765
701
# Emit D-Bus signals
766
self.PropertyChanged(dbus.String("Enabled"),
702
self.PropertyChanged(dbus.String(u"enabled"),
767
703
dbus.Boolean(True, variant_level=1))
768
704
self.PropertyChanged(
769
dbus.String("LastEnabled"),
705
dbus.String(u"last_enabled"),
770
706
self._datetime_to_dbus(self.last_enabled,
771
707
variant_level=1))
772
708
return r
773
709
774
710
def disable(self, quiet = False):
775
oldstate = getattr(self, "enabled", False)
711
oldstate = getattr(self, u"enabled", False)
776
712
r = Client.disable(self, quiet=quiet)
777
713
if not quiet and oldstate != self.enabled:
778
714
# Emit D-Bus signal
779
self.PropertyChanged(dbus.String("Enabled"),
715
self.PropertyChanged(dbus.String(u"enabled"),
780
716
dbus.Boolean(False, variant_level=1))
781
717
return r
782
718
785
721
self.remove_from_connection()
786
722
except LookupError:
787
723
pass
788
if hasattr(DBusObjectWithProperties, "__del__"):
724
if hasattr(DBusObjectWithProperties, u"__del__"):
789
725
DBusObjectWithProperties.__del__(self, *args, **kwargs)
790
726
Client.__del__(self, *args, **kwargs)
791
727
794
730
self.checker_callback_tag = None
795
731
self.checker = None
796
732
# Emit D-Bus signal
797
self.PropertyChanged(dbus.String("CheckerRunning"),
733
self.PropertyChanged(dbus.String(u"checker_running"),
798
734
dbus.Boolean(False, variant_level=1))
799
735
if os.WIFEXITED(condition):
800
736
exitstatus = os.WEXITSTATUS(condition)
815
751
r = Client.checked_ok(self, *args, **kwargs)
816
752
# Emit D-Bus signal
817
753
self.PropertyChanged(
818
dbus.String("LastCheckedOK"),
754
dbus.String(u"last_checked_ok"),
819
755
(self._datetime_to_dbus(self.last_checked_ok,
820
756
variant_level=1)))
821
757
return r
822
758
823
def need_approval(self, *args, **kwargs):
824
r = Client.need_approval(self, *args, **kwargs)
825
# Emit D-Bus signal
826
self.PropertyChanged(
827
dbus.String("LastApprovalRequest"),
828
(self._datetime_to_dbus(self.last_approval_request,
829
variant_level=1)))
830
return r
831
832
759
def start_checker(self, *args, **kwargs):
833
760
old_checker = self.checker
834
761
if self.checker is not None:
842
769
# Emit D-Bus signal
843
770
self.CheckerStarted(self.current_checker_command)
844
771
self.PropertyChanged(
845
dbus.String("CheckerRunning"),
772
dbus.String(u"checker_running"),
846
773
dbus.Boolean(True, variant_level=1))
847
774
return r
848
775
849
776
def stop_checker(self, *args, **kwargs):
850
old_checker = getattr(self, "checker", None)
777
old_checker = getattr(self, u"checker", None)
851
778
r = Client.stop_checker(self, *args, **kwargs)
852
779
if (old_checker is not None
853
and getattr(self, "checker", None) is None):
854
self.PropertyChanged(dbus.String("CheckerRunning"),
780
and getattr(self, u"checker", None) is None):
781
self.PropertyChanged(dbus.String(u"checker_running"),
855
782
dbus.Boolean(False, variant_level=1))
856
783
return r
857
858
def _reset_approved(self):
859
self._approved = None
860
return False
861
862
def approve(self, value=True):
863
self.send_changedstate()
864
self._approved = value
865
gobject.timeout_add(self._timedelta_to_milliseconds
866
(self.approval_duration),
867
self._reset_approved)
868
869
784
870
785
## D-Bus methods, signals & properties
871
_interface = "se.bsnet.fukt.Mandos.Client"
786
_interface = u"se.bsnet.fukt.Mandos.Client"
872
787
873
788
## Signals
874
789
875
790
# CheckerCompleted - signal
876
@dbus.service.signal(_interface, signature="nxs")
791
@dbus.service.signal(_interface, signature=u"nxs")
877
792
def CheckerCompleted(self, exitcode, waitstatus, command):
878
793
"D-Bus signal"
879
794
pass
880
795
881
796
# CheckerStarted - signal
882
@dbus.service.signal(_interface, signature="s")
797
@dbus.service.signal(_interface, signature=u"s")
883
798
def CheckerStarted(self, command):
884
799
"D-Bus signal"
885
800
pass
886
801
887
802
# PropertyChanged - signal
888
@dbus.service.signal(_interface, signature="sv")
803
@dbus.service.signal(_interface, signature=u"sv")
889
804
def PropertyChanged(self, property, value):
890
805
"D-Bus signal"
891
806
pass
893
808
# GotSecret - signal
894
809
@dbus.service.signal(_interface)
895
810
def GotSecret(self):
896
"""D-Bus signal
897
Is sent after a successful transfer of secret from the Mandos
898
server to mandos-client
899
"""
811
"D-Bus signal"
900
812
pass
901
813
902
814
# Rejected - signal
903
@dbus.service.signal(_interface, signature="s")
904
def Rejected(self, reason):
815
@dbus.service.signal(_interface)
816
def Rejected(self):
905
817
"D-Bus signal"
906
818
pass
907
819
908
# NeedApproval - signal
909
@dbus.service.signal(_interface, signature="tb")
910
def NeedApproval(self, timeout, default):
911
"D-Bus signal"
912
return self.need_approval()
913
914
820
## Methods
915
821
916
# Approve - method
917
@dbus.service.method(_interface, in_signature="b")
918
def Approve(self, value):
919
self.approve(value)
920
921
822
# CheckedOK - method
922
823
@dbus.service.method(_interface)
923
824
def CheckedOK(self):
948
849
949
850
## Properties
950
851
951
# ApprovalPending - property
952
@dbus_service_property(_interface, signature="b", access="read")
953
def ApprovalPending_dbus_property(self):
954
return dbus.Boolean(bool(self.approvals_pending))
955
956
# ApprovedByDefault - property
957
@dbus_service_property(_interface, signature="b",
958
access="readwrite")
959
def ApprovedByDefault_dbus_property(self, value=None):
960
if value is None: # get
961
return dbus.Boolean(self.approved_by_default)
962
self.approved_by_default = bool(value)
963
# Emit D-Bus signal
964
self.PropertyChanged(dbus.String("ApprovedByDefault"),
965
dbus.Boolean(value, variant_level=1))
966
967
# ApprovalDelay - property
968
@dbus_service_property(_interface, signature="t",
969
access="readwrite")
970
def ApprovalDelay_dbus_property(self, value=None):
971
if value is None: # get
972
return dbus.UInt64(self.approval_delay_milliseconds())
973
self.approval_delay = datetime.timedelta(0, 0, 0, value)
974
# Emit D-Bus signal
975
self.PropertyChanged(dbus.String("ApprovalDelay"),
976
dbus.UInt64(value, variant_level=1))
977
978
# ApprovalDuration - property
979
@dbus_service_property(_interface, signature="t",
980
access="readwrite")
981
def ApprovalDuration_dbus_property(self, value=None):
982
if value is None: # get
983
return dbus.UInt64(self._timedelta_to_milliseconds(
984
self.approval_duration))
985
self.approval_duration = datetime.timedelta(0, 0, 0, value)
986
# Emit D-Bus signal
987
self.PropertyChanged(dbus.String("ApprovalDuration"),
988
dbus.UInt64(value, variant_level=1))
989
990
# Name - property
991
@dbus_service_property(_interface, signature="s", access="read")
992
def Name_dbus_property(self):
852
# name - property
853
@dbus_service_property(_interface, signature=u"s", access=u"read")
854
def name_dbus_property(self):
993
855
return dbus.String(self.name)
994
856
995
# Fingerprint - property
996
@dbus_service_property(_interface, signature="s", access="read")
997
def Fingerprint_dbus_property(self):
857
# fingerprint - property
858
@dbus_service_property(_interface, signature=u"s", access=u"read")
859
def fingerprint_dbus_property(self):
998
860
return dbus.String(self.fingerprint)
999
861
1000
# Host - property
1001
@dbus_service_property(_interface, signature="s",
1002
access="readwrite")
1003
def Host_dbus_property(self, value=None):
862
# host - property
863
@dbus_service_property(_interface, signature=u"s",
864
access=u"readwrite")
865
def host_dbus_property(self, value=None):
1004
866
if value is None: # get
1005
867
return dbus.String(self.host)
1006
868
self.host = value
1007
869
# Emit D-Bus signal
1008
self.PropertyChanged(dbus.String("Host"),
870
self.PropertyChanged(dbus.String(u"host"),
1009
871
dbus.String(value, variant_level=1))
1010
872
1011
# Created - property
1012
@dbus_service_property(_interface, signature="s", access="read")
1013
def Created_dbus_property(self):
873
# created - property
874
@dbus_service_property(_interface, signature=u"s", access=u"read")
875
def created_dbus_property(self):
1014
876
return dbus.String(self._datetime_to_dbus(self.created))
1015
877
1016
# LastEnabled - property
1017
@dbus_service_property(_interface, signature="s", access="read")
1018
def LastEnabled_dbus_property(self):
878
# last_enabled - property
879
@dbus_service_property(_interface, signature=u"s", access=u"read")
880
def last_enabled_dbus_property(self):
1019
881
if self.last_enabled is None:
1020
return dbus.String("")
882
return dbus.String(u"")
1021
883
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1022
884
1023
# Enabled - property
1024
@dbus_service_property(_interface, signature="b",
1025
access="readwrite")
1026
def Enabled_dbus_property(self, value=None):
885
# enabled - property
886
@dbus_service_property(_interface, signature=u"b",
887
access=u"readwrite")
888
def enabled_dbus_property(self, value=None):
1027
889
if value is None: # get
1028
890
return dbus.Boolean(self.enabled)
1029
891
if value:
1031
893
else:
1032
894
self.disable()
1033
895
1034
# LastCheckedOK - property
1035
@dbus_service_property(_interface, signature="s",
1036
access="readwrite")
1037
def LastCheckedOK_dbus_property(self, value=None):
896
# last_checked_ok - property
897
@dbus_service_property(_interface, signature=u"s",
898
access=u"readwrite")
899
def last_checked_ok_dbus_property(self, value=None):
1038
900
if value is not None:
1039
901
self.checked_ok()
1040
902
return
1041
903
if self.last_checked_ok is None:
1042
return dbus.String("")
904
return dbus.String(u"")
1043
905
return dbus.String(self._datetime_to_dbus(self
1044
906
.last_checked_ok))
1045
907
1046
# LastApprovalRequest - property
1047
@dbus_service_property(_interface, signature="s", access="read")
1048
def LastApprovalRequest_dbus_property(self):
1049
if self.last_approval_request is None:
1050
return dbus.String("")
1051
return dbus.String(self.
1052
_datetime_to_dbus(self
1053
.last_approval_request))
1054
1055
# Timeout - property
1056
@dbus_service_property(_interface, signature="t",
1057
access="readwrite")
1058
def Timeout_dbus_property(self, value=None):
908
# timeout - property
909
@dbus_service_property(_interface, signature=u"t",
910
access=u"readwrite")
911
def timeout_dbus_property(self, value=None):
1059
912
if value is None: # get
1060
913
return dbus.UInt64(self.timeout_milliseconds())
1061
914
self.timeout = datetime.timedelta(0, 0, 0, value)
1062
915
# Emit D-Bus signal
1063
self.PropertyChanged(dbus.String("Timeout"),
916
self.PropertyChanged(dbus.String(u"timeout"),
1064
917
dbus.UInt64(value, variant_level=1))
1065
if getattr(self, "disable_initiator_tag", None) is None:
918
if getattr(self, u"disable_initiator_tag", None) is None:
1066
919
return
1067
920
# Reschedule timeout
1068
921
gobject.source_remove(self.disable_initiator_tag)
1080
933
self.disable_initiator_tag = (gobject.timeout_add
1081
934
(time_to_die, self.disable))
1082
935
1083
# Interval - property
1084
@dbus_service_property(_interface, signature="t",
1085
access="readwrite")
1086
def Interval_dbus_property(self, value=None):
936
# interval - property
937
@dbus_service_property(_interface, signature=u"t",
938
access=u"readwrite")
939
def interval_dbus_property(self, value=None):
1087
940
if value is None: # get
1088
941
return dbus.UInt64(self.interval_milliseconds())
1089
942
self.interval = datetime.timedelta(0, 0, 0, value)
1090
943
# Emit D-Bus signal
1091
self.PropertyChanged(dbus.String("Interval"),
944
self.PropertyChanged(dbus.String(u"interval"),
1092
945
dbus.UInt64(value, variant_level=1))
1093
if getattr(self, "checker_initiator_tag", None) is None:
946
if getattr(self, u"checker_initiator_tag", None) is None:
1094
947
return
1095
948
# Reschedule checker run
1096
949
gobject.source_remove(self.checker_initiator_tag)
1098
951
(value, self.start_checker))
1099
952
self.start_checker() # Start one now, too
1100
953
1101
# Checker - property
1102
@dbus_service_property(_interface, signature="s",
1103
access="readwrite")
1104
def Checker_dbus_property(self, value=None):
954
# checker - property
955
@dbus_service_property(_interface, signature=u"s",
956
access=u"readwrite")
957
def checker_dbus_property(self, value=None):
1105
958
if value is None: # get
1106
959
return dbus.String(self.checker_command)
1107
960
self.checker_command = value
1108
961
# Emit D-Bus signal
1109
self.PropertyChanged(dbus.String("Checker"),
962
self.PropertyChanged(dbus.String(u"checker"),
1110
963
dbus.String(self.checker_command,
1111
964
variant_level=1))
1112
965
1113
# CheckerRunning - property
1114
@dbus_service_property(_interface, signature="b",
1115
access="readwrite")
1116
def CheckerRunning_dbus_property(self, value=None):
966
# checker_running - property
967
@dbus_service_property(_interface, signature=u"b",
968
access=u"readwrite")
969
def checker_running_dbus_property(self, value=None):
1117
970
if value is None: # get
1118
971
return dbus.Boolean(self.checker is not None)
1119
972
if value:
1121
974
else:
1122
975
self.stop_checker()
1123
976
1124
# ObjectPath - property
1125
@dbus_service_property(_interface, signature="o", access="read")
1126
def ObjectPath_dbus_property(self):
977
# object_path - property
978
@dbus_service_property(_interface, signature=u"o", access=u"read")
979
def object_path_dbus_property(self):
1127
980
return self.dbus_object_path # is already a dbus.ObjectPath
1128
981
1129
# Secret = property
1130
@dbus_service_property(_interface, signature="ay",
1131
access="write", byte_arrays=True)
1132
def Secret_dbus_property(self, value):
982
# secret = property
983
@dbus_service_property(_interface, signature=u"ay",
984
access=u"write", byte_arrays=True)
985
def secret_dbus_property(self, value):
1133
986
self.secret = str(value)
1134
987
1135
988
del _interface
1136
989
1137
990
1138
class ProxyClient(object):
1139
def __init__(self, child_pipe, fpr, address):
1140
self._pipe = child_pipe
1141
self._pipe.send(('init', fpr, address))
1142
if not self._pipe.recv():
1143
raise KeyError()
1144
1145
def __getattribute__(self, name):
1146
if(name == '_pipe'):
1147
return super(ProxyClient, self).__getattribute__(name)
1148
self._pipe.send(('getattr', name))
1149
data = self._pipe.recv()
1150
if data[0] == 'data':
1151
return data[1]
1152
if data[0] == 'function':
1153
def func(*args, **kwargs):
1154
self._pipe.send(('funcall', name, args, kwargs))
1155
return self._pipe.recv()[1]
1156
return func
1157
1158
def __setattr__(self, name, value):
1159
if(name == '_pipe'):
1160
return super(ProxyClient, self).__setattr__(name, value)
1161
self._pipe.send(('setattr', name, value))
1162
1163
1164
991
class ClientHandler(socketserver.BaseRequestHandler, object):
1165
992
"""A class to handle client connections.
1166
993
1168
995
Note: This will run in its own forked process."""
1169
996
1170
997
def handle(self):
1171
with contextlib.closing(self.server.child_pipe) as child_pipe:
1172
logger.info("TCP connection from: %s",
1173
unicode(self.client_address))
1174
logger.debug("Pipe FD: %d",
1175
self.server.child_pipe.fileno())
1176
998
logger.info(u"TCP connection from: %s",
999
unicode(self.client_address))
1000
logger.debug(u"IPC Pipe FD: %d",
1001
self.server.child_pipe[1].fileno())
1002
# Open IPC pipe to parent process
1003
with contextlib.nested(self.server.child_pipe[1],
1004
self.server.parent_pipe[0]
1005
) as (ipc, ipc_return):
1177
1006
session = (gnutls.connection
1178
1007
.ClientSession(self.request,
1179
1008
gnutls.connection
1180
1009
.X509Credentials()))
1181
1010
1182
1011
# Note: gnutls.connection.X509Credentials is really a
1183
1012
# generic GnuTLS certificate credentials object so long as
1184
1013
# no X.509 keys are added to it. Therefore, we can use it
1185
1014
# here despite using OpenPGP certificates.
1186
1187
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1188
# "+AES-256-CBC", "+SHA1",
1189
# "+COMP-NULL", "+CTYPE-OPENPGP",
1190
# "+DHE-DSS"))
1015
1016
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1017
# u"+AES-256-CBC", u"+SHA1",
1018
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1019
# u"+DHE-DSS"))
1191
1020
# Use a fallback default, since this MUST be set.
1192
1021
priority = self.server.gnutls_priority
1193
1022
if priority is None:
1194
priority = "NORMAL"
1023
priority = u"NORMAL"
1195
1024
(gnutls.library.functions
1196
1025
.gnutls_priority_set_direct(session._c_object,
1197
1026
priority, None))
1198
1027
1199
1028
# Start communication using the Mandos protocol
1200
1029
# Get protocol number
1201
1030
line = self.request.makefile().readline()
1202
logger.debug("Protocol version: %r", line)
1031
logger.debug(u"Protocol version: %r", line)
1203
1032
try:
1204
1033
if int(line.strip().split()[0]) > 1:
1205
1034
raise RuntimeError
1206
1035
except (ValueError, IndexError, RuntimeError), error:
1207
logger.error("Unknown protocol version: %s", error)
1036
logger.error(u"Unknown protocol version: %s", error)
1208
1037
return
1209
1038
1210
1039
# Start GnuTLS connection
1211
1040
try:
1212
1041
session.handshake()
1213
1042
except gnutls.errors.GNUTLSError, error:
1214
logger.warning("Handshake failed: %s", error)
1043
logger.warning(u"Handshake failed: %s", error)
1215
1044
# Do not run session.bye() here: the session is not
1216
1045
# established. Just abandon the request.
1217
1046
return
1218
logger.debug("Handshake succeeded")
1219
1220
approval_required = False
1047
logger.debug(u"Handshake succeeded")
1221
1048
try:
1222
1049
try:
1223
1050
fpr = self.fingerprint(self.peer_certificate
1224
1051
(session))
1225
1052
except (TypeError, gnutls.errors.GNUTLSError), error:
1226
logger.warning("Bad certificate: %s", error)
1053
logger.warning(u"Bad certificate: %s", error)
1227
1054
return
1228
logger.debug("Fingerprint: %s", fpr)
1055
logger.debug(u"Fingerprint: %s", fpr)
1229
1056
1230
try:
1231
client = ProxyClient(child_pipe, fpr,
1232
self.client_address)
1233
except KeyError:
1234
return
1235
1236
if client.approval_delay:
1237
delay = client.approval_delay
1238
client.approvals_pending += 1
1239
approval_required = True
1240
1241
while True:
1242
if not client.enabled:
1243
logger.warning("Client %s is disabled",
1244
client.name)
1245
if self.server.use_dbus:
1246
# Emit D-Bus signal
1247
client.Rejected("Disabled")
1248
return
1249
1250
if client._approved or not client.approval_delay:
1251
#We are approved or approval is disabled
1057
for c in self.server.clients:
1058
if c.fingerprint == fpr:
1059
client = c
1252
1060
break
1253
elif client._approved is None:
1254
logger.info("Client %s needs approval",
1255
client.name)
1256
if self.server.use_dbus:
1257
# Emit D-Bus signal
1258
client.NeedApproval(
1259
client.approval_delay_milliseconds(),
1260
client.approved_by_default)
1261
else:
1262
logger.warning("Client %s was not approved",
1263
client.name)
1264
if self.server.use_dbus:
1265
# Emit D-Bus signal
1266
client.Rejected("Denied")
1267
return
1268
1269
#wait until timeout or approved
1270
#x = float(client._timedelta_to_milliseconds(delay))
1271
time = datetime.datetime.now()
1272
client.changedstate.acquire()
1273
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1274
client.changedstate.release()
1275
time2 = datetime.datetime.now()
1276
if (time2 - time) >= delay:
1277
if not client.approved_by_default:
1278
logger.warning("Client %s timed out while"
1279
" waiting for approval",
1280
client.name)
1281
if self.server.use_dbus:
1282
# Emit D-Bus signal
1283
client.Rejected("Approval timed out")
1284
return
1285
else:
1286
break
1287
else:
1288
delay -= time2 - time
1289
1061
else:
1062
ipc.write(u"NOTFOUND %s %s\n"
1063
% (fpr, unicode(self.client_address)))
1064
return
1065
1066
class ClientProxy(object):
1067
"""Client proxy object. Not for calling methods."""
1068
def __init__(self, client):
1069
self.client = client
1070
def __getattr__(self, name):
1071
if name.startswith("ipc_"):
1072
def tempfunc():
1073
ipc.write("%s %s\n" % (name[4:].upper(),
1074
self.client.name))
1075
return tempfunc
1076
if not hasattr(self.client, name):
1077
raise AttributeError
1078
ipc.write(u"GETATTR %s %s\n"
1079
% (name, self.client.fingerprint))
1080
return pickle.load(ipc_return)
1081
clientproxy = ClientProxy(client)
1082
# Have to check if client.enabled, since it is
1083
# possible that the client was disabled since the
1084
# GnuTLS session was established.
1085
if not clientproxy.enabled:
1086
clientproxy.ipc_disabled()
1087
return
1088
1089
clientproxy.ipc_sending()
1290
1090
sent_size = 0
1291
1091
while sent_size < len(client.secret):
1292
try:
1293
sent = session.send(client.secret[sent_size:])
1294
except (gnutls.errors.GNUTLSError), error:
1295
logger.warning("gnutls send failed")
1296
return
1297
logger.debug("Sent: %d, remaining: %d",
1092
sent = session.send(client.secret[sent_size:])
1093
logger.debug(u"Sent: %d, remaining: %d",
1298
1094
sent, len(client.secret)
1299
1095
- (sent_size + sent))
1300
1096
sent_size += sent
1301
1302
logger.info("Sending secret to %s", client.name)
1303
# bump the timeout as if seen
1304
client.checked_ok()
1305
if self.server.use_dbus:
1306
# Emit D-Bus signal
1307
client.GotSecret()
1308
1309
1097
finally:
1310
if approval_required:
1311
client.approvals_pending -= 1
1312
try:
1313
session.bye()
1314
except (gnutls.errors.GNUTLSError), error:
1315
logger.warning("GnuTLS bye failed")
1098
session.bye()
1316
1099
1317
1100
@staticmethod
1318
1101
def peer_certificate(session):
1328
1111
.gnutls_certificate_get_peers
1329
1112
(session._c_object, ctypes.byref(list_size)))
1330
1113
if not bool(cert_list) and list_size.value != 0:
1331
raise gnutls.errors.GNUTLSError("error getting peer"
1332
" certificate")
1114
raise gnutls.errors.GNUTLSError(u"error getting peer"
1115
u" certificate")
1333
1116
if list_size.value == 0:
1334
1117
return None
1335
1118
cert = cert_list[0]
1361
1144
if crtverify.value != 0:
1362
1145
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1363
1146
raise (gnutls.errors.CertificateSecurityError
1364
("Verify failed"))
1147
(u"Verify failed"))
1365
1148
# New buffer for the fingerprint
1366
1149
buf = ctypes.create_string_buffer(20)
1367
1150
buf_len = ctypes.c_size_t()
1374
1157
# Convert the buffer to a Python bytestring
1375
1158
fpr = ctypes.string_at(buf, buf_len.value)
1376
1159
# Convert the bytestring to hexadecimal notation
1377
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1160
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1378
1161
return hex_fpr
1379
1162
1380
1163
1381
class MultiprocessingMixIn(object):
1382
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1383
def sub_process_main(self, request, address):
1384
try:
1385
self.finish_request(request, address)
1386
except:
1387
self.handle_error(request, address)
1388
self.close_request(request)
1389
1390
def process_request(self, request, address):
1391
"""Start a new process to process the request."""
1392
multiprocessing.Process(target = self.sub_process_main,
1393
args = (request, address)).start()
1394
1395
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1396
""" adds a pipe to the MixIn """
1164
class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):
1165
"""Like socketserver.ForkingMixIn, but also pass a pipe pair."""
1397
1166
def process_request(self, request, client_address):
1398
1167
"""Overrides and wraps the original process_request().
1399
1168
1400
1169
This function creates a new pipe in self.pipe
1401
1170
"""
1402
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1403
1404
super(MultiprocessingMixInWithPipe,
1171
# Child writes to child_pipe
1172
self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
1173
# Parent writes to parent_pipe
1174
self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))
1175
super(ForkingMixInWithPipes,
1405
1176
self).process_request(request, client_address)
1406
self.child_pipe.close()
1407
self.add_pipe(parent_pipe)
1408
1409
def add_pipe(self, parent_pipe):
1177
# Close unused ends for parent
1178
self.parent_pipe[0].close() # close read end
1179
self.child_pipe[1].close() # close write end
1180
self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])
1181
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1410
1182
"""Dummy function; override as necessary"""
1411
pass
1412
1413
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1183
child_pipe_fd.close()
1184
parent_pipe_fd.close()
1185
1186
1187
class IPv6_TCPServer(ForkingMixInWithPipes,
1414
1188
socketserver.TCPServer, object):
1415
1189
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1416
1190
1432
1206
bind to an address or port if they were not specified."""
1433
1207
if self.interface is not None:
1434
1208
if SO_BINDTODEVICE is None:
1435
logger.error("SO_BINDTODEVICE does not exist;"
1436
" cannot bind to interface %s",
1209
logger.error(u"SO_BINDTODEVICE does not exist;"
1210
u" cannot bind to interface %s",
1437
1211
self.interface)
1438
1212
else:
1439
1213
try:
1440
1214
self.socket.setsockopt(socket.SOL_SOCKET,
1441
1215
SO_BINDTODEVICE,
1442
1216
str(self.interface
1443
+ '\0'))
1217
+ u'\0'))
1444
1218
except socket.error, error:
1445
1219
if error[0] == errno.EPERM:
1446
logger.error("No permission to"
1447
" bind to interface %s",
1220
logger.error(u"No permission to"
1221
u" bind to interface %s",
1448
1222
self.interface)
1449
1223
elif error[0] == errno.ENOPROTOOPT:
1450
logger.error("SO_BINDTODEVICE not available;"
1451
" cannot bind to interface %s",
1224
logger.error(u"SO_BINDTODEVICE not available;"
1225
u" cannot bind to interface %s",
1452
1226
self.interface)
1453
1227
else:
1454
1228
raise
1456
1230
if self.server_address[0] or self.server_address[1]:
1457
1231
if not self.server_address[0]:
1458
1232
if self.address_family == socket.AF_INET6:
1459
any_address = "::" # in6addr_any
1233
any_address = u"::" # in6addr_any
1460
1234
else:
1461
1235
any_address = socket.INADDR_ANY
1462
1236
self.server_address = (any_address,
1501
1275
return socketserver.TCPServer.server_activate(self)
1502
1276
def enable(self):
1503
1277
self.enabled = True
1504
def add_pipe(self, parent_pipe):
1278
def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):
1505
1279
# Call "handle_ipc" for both data and EOF events
1506
gobject.io_add_watch(parent_pipe.fileno(),
1280
gobject.io_add_watch(child_pipe_fd.fileno(),
1507
1281
gobject.IO_IN | gobject.IO_HUP,
1508
1282
functools.partial(self.handle_ipc,
1509
parent_pipe = parent_pipe))
1510
1511
def handle_ipc(self, source, condition, parent_pipe=None,
1512
client_object=None):
1283
reply = parent_pipe_fd,
1284
sender= child_pipe_fd))
1285
def handle_ipc(self, source, condition, reply=None, sender=None):
1513
1286
condition_names = {
1514
gobject.IO_IN: "IN", # There is data to read.
1515
gobject.IO_OUT: "OUT", # Data can be written (without
1287
gobject.IO_IN: u"IN", # There is data to read.
1288
gobject.IO_OUT: u"OUT", # Data can be written (without
1516
1289
# blocking).
1517
gobject.IO_PRI: "PRI", # There is urgent data to read.
1518
gobject.IO_ERR: "ERR", # Error condition.
1519
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1290
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1291
gobject.IO_ERR: u"ERR", # Error condition.
1292
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1520
1293
# broken, usually for pipes and
1521
1294
# sockets).
1522
1295
}
1524
1297
for cond, name in
1525
1298
condition_names.iteritems()
1526
1299
if cond & condition)
1527
# error or the other end of multiprocessing.Pipe has closed
1528
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1529
return False
1530
1531
# Read a request from the child
1532
request = parent_pipe.recv()
1533
command = request[0]
1534
1535
if command == 'init':
1536
fpr = request[1]
1537
address = request[2]
1538
1539
for c in self.clients:
1540
if c.fingerprint == fpr:
1541
client = c
1542
break
1543
else:
1544
logger.warning("Client not found for fingerprint: %s, ad"
1545
"dress: %s", fpr, address)
1546
if self.use_dbus:
1547
# Emit D-Bus signal
1548
mandos_dbus_service.ClientNotFound(fpr, address[0])
1549
parent_pipe.send(False)
1550
return False
1551
1552
gobject.io_add_watch(parent_pipe.fileno(),
1553
gobject.IO_IN | gobject.IO_HUP,
1554
functools.partial(self.handle_ipc,
1555
parent_pipe = parent_pipe,
1556
client_object = client))
1557
parent_pipe.send(True)
1558
# remove the old hook in favor of the new above hook on same fileno
1559
return False
1560
if command == 'funcall':
1561
funcname = request[1]
1562
args = request[2]
1563
kwargs = request[3]
1564
1565
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1566
1567
if command == 'getattr':
1568
attrname = request[1]
1569
if callable(client_object.__getattribute__(attrname)):
1570
parent_pipe.send(('function',))
1571
else:
1572
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1573
1574
if command == 'setattr':
1575
attrname = request[1]
1576
value = request[2]
1577
setattr(client_object, attrname, value)
1578
1300
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1301
conditions_string)
1302
1303
# Read a line from the file object
1304
cmdline = sender.readline()
1305
if not cmdline: # Empty line means end of file
1306
# close the IPC pipes
1307
sender.close()
1308
reply.close()
1309
1310
# Stop calling this function
1311
return False
1312
1313
logger.debug(u"IPC command: %r", cmdline)
1314
1315
# Parse and act on command
1316
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1317
1318
if cmd == u"NOTFOUND":
1319
fpr, address = args.split(None, 1)
1320
logger.warning(u"Client not found for fingerprint: %s, ad"
1321
u"dress: %s", fpr, address)
1322
if self.use_dbus:
1323
# Emit D-Bus signal
1324
mandos_dbus_service.ClientNotFound(fpr, address)
1325
elif cmd == u"DISABLED":
1326
for client in self.clients:
1327
if client.name == args:
1328
logger.warning(u"Client %s is disabled", args)
1329
if self.use_dbus:
1330
# Emit D-Bus signal
1331
client.Rejected()
1332
break
1333
else:
1334
logger.error(u"Unknown client %s is disabled", args)
1335
elif cmd == u"SENDING":
1336
for client in self.clients:
1337
if client.name == args:
1338
logger.info(u"Sending secret to %s", client.name)
1339
client.checked_ok()
1340
if self.use_dbus:
1341
# Emit D-Bus signal
1342
client.GotSecret()
1343
break
1344
else:
1345
logger.error(u"Sending secret to unknown client %s",
1346
args)
1347
elif cmd == u"GETATTR":
1348
attr_name, fpr = args.split(None, 1)
1349
for client in self.clients:
1350
if client.fingerprint == fpr:
1351
attr_value = getattr(client, attr_name, None)
1352
logger.debug("IPC reply: %r", attr_value)
1353
pickle.dump(attr_value, reply)
1354
break
1355
else:
1356
logger.error(u"Client %s on address %s requesting "
1357
u"attribute %s not found", fpr, address,
1358
attr_name)
1359
pickle.dump(None, reply)
1360
else:
1361
logger.error(u"Unknown IPC command: %r", cmdline)
1362
1363
# Keep calling this function
1579
1364
return True
1580
1365
1581
1366
1582
1367
def string_to_delta(interval):
1583
1368
"""Parse a string and return a datetime.timedelta
1584
1369
1585
>>> string_to_delta('7d')
1370
>>> string_to_delta(u'7d')
1586
1371
datetime.timedelta(7)
1587
>>> string_to_delta('60s')
1372
>>> string_to_delta(u'60s')
1588
1373
datetime.timedelta(0, 60)
1589
>>> string_to_delta('60m')
1374
>>> string_to_delta(u'60m')
1590
1375
datetime.timedelta(0, 3600)
1591
>>> string_to_delta('24h')
1376
>>> string_to_delta(u'24h')
1592
1377
datetime.timedelta(1)
1593
>>> string_to_delta('1w')
1378
>>> string_to_delta(u'1w')
1594
1379
datetime.timedelta(7)
1595
>>> string_to_delta('5m 30s')
1380
>>> string_to_delta(u'5m 30s')
1596
1381
datetime.timedelta(0, 330)
1597
1382
"""
1598
1383
timevalue = datetime.timedelta(0)
1600
1385
try:
1601
1386
suffix = unicode(s[-1])
1602
1387
value = int(s[:-1])
1603
if suffix == "d":
1388
if suffix == u"d":
1604
1389
delta = datetime.timedelta(value)
1605
elif suffix == "s":
1390
elif suffix == u"s":
1606
1391
delta = datetime.timedelta(0, value)
1607
elif suffix == "m":
1392
elif suffix == u"m":
1608
1393
delta = datetime.timedelta(0, 0, 0, 0, value)
1609
elif suffix == "h":
1394
elif suffix == u"h":
1610
1395
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1611
elif suffix == "w":
1396
elif suffix == u"w":
1612
1397
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1613
1398
else:
1614
raise ValueError("Unknown suffix %r" % suffix)
1399
raise ValueError(u"Unknown suffix %r" % suffix)
1615
1400
except (ValueError, IndexError), e:
1616
1401
raise ValueError(e.message)
1617
1402
timevalue += delta
1625
1410
global if_nametoindex
1626
1411
try:
1627
1412
if_nametoindex = (ctypes.cdll.LoadLibrary
1628
(ctypes.util.find_library("c"))
1413
(ctypes.util.find_library(u"c"))
1629
1414
.if_nametoindex)
1630
1415
except (OSError, AttributeError):
1631
logger.warning("Doing if_nametoindex the hard way")
1416
logger.warning(u"Doing if_nametoindex the hard way")
1632
1417
def if_nametoindex(interface):
1633
1418
"Get an interface index the hard way, i.e. using fcntl()"
1634
1419
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1635
1420
with contextlib.closing(socket.socket()) as s:
1636
1421
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1637
struct.pack(str("16s16x"),
1422
struct.pack(str(u"16s16x"),
1638
1423
interface))
1639
interface_index = struct.unpack(str("I"),
1424
interface_index = struct.unpack(str(u"I"),
1640
1425
ifreq[16:20])[0]
1641
1426
return interface_index
1642
1427
return if_nametoindex(interface)
1650
1435
sys.exit()
1651
1436
os.setsid()
1652
1437
if not nochdir:
1653
os.chdir("/")
1438
os.chdir(u"/")
1654
1439
if os.fork():
1655
1440
sys.exit()
1656
1441
if not noclose:
1658
1443
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1659
1444
if not stat.S_ISCHR(os.fstat(null).st_mode):
1660
1445
raise OSError(errno.ENODEV,
1661
"%s not a character device"
1446
u"%s not a character device"
1662
1447
% os.path.devnull)
1663
1448
os.dup2(null, sys.stdin.fileno())
1664
1449
os.dup2(null, sys.stdout.fileno())
1673
1458
# Parsing of options, both command line and config file
1674
1459
1675
1460
parser = optparse.OptionParser(version = "%%prog %s" % version)
1676
parser.add_option("-i", "--interface", type="string",
1677
metavar="IF", help="Bind to interface IF")
1678
parser.add_option("-a", "--address", type="string",
1679
help="Address to listen for requests on")
1680
parser.add_option("-p", "--port", type="int",
1681
help="Port number to receive requests on")
1682
parser.add_option("--check", action="store_true",
1683
help="Run self-test")
1684
parser.add_option("--debug", action="store_true",
1685
help="Debug mode; run in foreground and log to"
1686
" terminal")
1687
parser.add_option("--debuglevel", type="string", metavar="LEVEL",
1688
help="Debug level for stdout output")
1689
parser.add_option("--priority", type="string", help="GnuTLS"
1690
" priority string (see GnuTLS documentation)")
1691
parser.add_option("--servicename", type="string",
1692
metavar="NAME", help="Zeroconf service name")
1693
parser.add_option("--configdir", type="string",
1694
default="/etc/mandos", metavar="DIR",
1695
help="Directory to search for configuration"
1696
" files")
1697
parser.add_option("--no-dbus", action="store_false",
1698
dest="use_dbus", help="Do not provide D-Bus"
1699
" system bus interface")
1700
parser.add_option("--no-ipv6", action="store_false",
1701
dest="use_ipv6", help="Do not use IPv6")
1461
parser.add_option("-i", u"--interface", type=u"string",
1462
metavar="IF", help=u"Bind to interface IF")
1463
parser.add_option("-a", u"--address", type=u"string",
1464
help=u"Address to listen for requests on")
1465
parser.add_option("-p", u"--port", type=u"int",
1466
help=u"Port number to receive requests on")
1467
parser.add_option("--check", action=u"store_true",
1468
help=u"Run self-test")
1469
parser.add_option("--debug", action=u"store_true",
1470
help=u"Debug mode; run in foreground and log to"
1471
u" terminal")
1472
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1473
u" priority string (see GnuTLS documentation)")
1474
parser.add_option("--servicename", type=u"string",
1475
metavar=u"NAME", help=u"Zeroconf service name")
1476
parser.add_option("--configdir", type=u"string",
1477
default=u"/etc/mandos", metavar=u"DIR",
1478
help=u"Directory to search for configuration"
1479
u" files")
1480
parser.add_option("--no-dbus", action=u"store_false",
1481
dest=u"use_dbus", help=u"Do not provide D-Bus"
1482
u" system bus interface")
1483
parser.add_option("--no-ipv6", action=u"store_false",
1484
dest=u"use_ipv6", help=u"Do not use IPv6")
1702
1485
options = parser.parse_args()[0]
1703
1486
1704
1487
if options.check:
1707
1490
sys.exit()
1708
1491
1709
1492
# Default values for config file for server-global settings
1710
server_defaults = { "interface": "",
1711
"address": "",
1712
"port": "",
1713
"debug": "False",
1714
"priority":
1715
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1716
"servicename": "Mandos",
1717
"use_dbus": "True",
1718
"use_ipv6": "True",
1719
"debuglevel": "",
1493
server_defaults = { u"interface": u"",
1494
u"address": u"",
1495
u"port": u"",
1496
u"debug": u"False",
1497
u"priority":
1498
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1499
u"servicename": u"Mandos",
1500
u"use_dbus": u"True",
1501
u"use_ipv6": u"True",
1720
1502
}
1721
1503
1722
1504
# Parse config file for server-global settings
1723
1505
server_config = configparser.SafeConfigParser(server_defaults)
1724
1506
del server_defaults
1725
1507
server_config.read(os.path.join(options.configdir,
1726
"mandos.conf"))
1508
u"mandos.conf"))
1727
1509
# Convert the SafeConfigParser object to a dict
1728
1510
server_settings = server_config.defaults()
1729
1511
# Use the appropriate methods on the non-string config options
1730
for option in ("debug", "use_dbus", "use_ipv6"):
1731
server_settings[option] = server_config.getboolean("DEFAULT",
1512
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1513
server_settings[option] = server_config.getboolean(u"DEFAULT",
1732
1514
option)
1733
1515
if server_settings["port"]:
1734
server_settings["port"] = server_config.getint("DEFAULT",
1735
"port")
1516
server_settings["port"] = server_config.getint(u"DEFAULT",
1517
u"port")
1736
1518
del server_config
1737
1519
1738
1520
# Override the settings from the config file with command line
1739
1521
# options, if set.
1740
for option in ("interface", "address", "port", "debug",
1741
"priority", "servicename", "configdir",
1742
"use_dbus", "use_ipv6", "debuglevel"):
1522
for option in (u"interface", u"address", u"port", u"debug",
1523
u"priority", u"servicename", u"configdir",
1524
u"use_dbus", u"use_ipv6"):
1743
1525
value = getattr(options, option)
1744
1526
if value is not None:
1745
1527
server_settings[option] = value
1753
1535
##################################################################
1754
1536
1755
1537
# For convenience
1756
debug = server_settings["debug"]
1757
debuglevel = server_settings["debuglevel"]
1758
use_dbus = server_settings["use_dbus"]
1759
use_ipv6 = server_settings["use_ipv6"]
1760
1761
if server_settings["servicename"] != "Mandos":
1538
debug = server_settings[u"debug"]
1539
use_dbus = server_settings[u"use_dbus"]
1540
use_ipv6 = server_settings[u"use_ipv6"]
1541
1542
if not debug:
1543
syslogger.setLevel(logging.WARNING)
1544
console.setLevel(logging.WARNING)
1545
1546
if server_settings[u"servicename"] != u"Mandos":
1762
1547
syslogger.setFormatter(logging.Formatter
1763
('Mandos (%s) [%%(process)d]:'
1764
' %%(levelname)s: %%(message)s'
1765
% server_settings["servicename"]))
1548
(u'Mandos (%s) [%%(process)d]:'
1549
u' %%(levelname)s: %%(message)s'
1550
% server_settings[u"servicename"]))
1766
1551
1767
1552
# Parse config file with clients
1768
client_defaults = { "timeout": "1h",
1769
"interval": "5m",
1770
"checker": "fping -q -- %%(host)s",
1771
"host": "",
1772
"approval_delay": "0s",
1773
"approval_duration": "1s",
1553
client_defaults = { u"timeout": u"1h",
1554
u"interval": u"5m",
1555
u"checker": u"fping -q -- %%(host)s",
1556
u"host": u"",
1774
1557
}
1775
1558
client_config = configparser.SafeConfigParser(client_defaults)
1776
client_config.read(os.path.join(server_settings["configdir"],
1777
"clients.conf"))
1559
client_config.read(os.path.join(server_settings[u"configdir"],
1560
u"clients.conf"))
1778
1561
1779
1562
global mandos_dbus_service
1780
1563
mandos_dbus_service = None
1781
1564
1782
tcp_server = MandosServer((server_settings["address"],
1783
server_settings["port"]),
1565
tcp_server = MandosServer((server_settings[u"address"],
1566
server_settings[u"port"]),
1784
1567
ClientHandler,
1785
interface=(server_settings["interface"]
1568
interface=(server_settings[u"interface"]
1786
1569
or None),
1787
1570
use_ipv6=use_ipv6,
1788
1571
gnutls_priority=
1789
server_settings["priority"],
1572
server_settings[u"priority"],
1790
1573
use_dbus=use_dbus)
1791
if not debug:
1792
pidfilename = "/var/run/mandos.pid"
1793
try:
1794
pidfile = open(pidfilename, "w")
1795
except IOError:
1796
logger.error("Could not open file %r", pidfilename)
1574
pidfilename = u"/var/run/mandos.pid"
1575
try:
1576
pidfile = open(pidfilename, u"w")
1577
except IOError:
1578
logger.error(u"Could not open file %r", pidfilename)
1797
1579
1798
1580
try:
1799
uid = pwd.getpwnam("_mandos").pw_uid
1800
gid = pwd.getpwnam("_mandos").pw_gid
1581
uid = pwd.getpwnam(u"_mandos").pw_uid
1582
gid = pwd.getpwnam(u"_mandos").pw_gid
1801
1583
except KeyError:
1802
1584
try:
1803
uid = pwd.getpwnam("mandos").pw_uid
1804
gid = pwd.getpwnam("mandos").pw_gid
1585
uid = pwd.getpwnam(u"mandos").pw_uid
1586
gid = pwd.getpwnam(u"mandos").pw_gid
1805
1587
except KeyError:
1806
1588
try:
1807
uid = pwd.getpwnam("nobody").pw_uid
1808
gid = pwd.getpwnam("nobody").pw_gid
1589
uid = pwd.getpwnam(u"nobody").pw_uid
1590
gid = pwd.getpwnam(u"nobody").pw_gid
1809
1591
except KeyError:
1810
1592
uid = 65534
1811
1593
gid = 65534
1816
1598
if error[0] != errno.EPERM:
1817
1599
raise error
1818
1600
1819
if not debug and not debuglevel:
1820
syslogger.setLevel(logging.WARNING)
1821
console.setLevel(logging.WARNING)
1822
if debuglevel:
1823
level = getattr(logging, debuglevel.upper())
1824
syslogger.setLevel(level)
1825
console.setLevel(level)
1826
1601
# Enable all possible GnuTLS debugging
1827
1602
if debug:
1828
# Enable all possible GnuTLS debugging
1829
1830
1603
# "Use a log level over 10 to enable all debugging options."
1831
1604
# - GnuTLS manual
1832
1605
gnutls.library.functions.gnutls_global_set_log_level(11)
1833
1606
1834
1607
@gnutls.library.types.gnutls_log_func
1835
1608
def debug_gnutls(level, string):
1836
logger.debug("GnuTLS: %s", string[:-1])
1609
logger.debug(u"GnuTLS: %s", string[:-1])
1837
1610
1838
1611
(gnutls.library.functions
1839
1612
.gnutls_global_set_log_function(debug_gnutls))
1840
1841
# Redirect stdin so all checkers get /dev/null
1842
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1843
os.dup2(null, sys.stdin.fileno())
1844
if null > 2:
1845
os.close(null)
1846
else:
1847
# No console logging
1848
logger.removeHandler(console)
1849
1850
# Need to fork before connecting to D-Bus
1851
if not debug:
1852
# Close all input and output, do double fork, etc.
1853
daemon()
1854
1613
1855
1614
global main_loop
1856
1615
# From the Avahi example code
1860
1619
# End of Avahi example code
1861
1620
if use_dbus:
1862
1621
try:
1863
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1622
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1864
1623
bus, do_not_queue=True)
1865
1624
except dbus.exceptions.NameExistsException, e:
1866
logger.error(unicode(e) + ", disabling D-Bus")
1625
logger.error(unicode(e) + u", disabling D-Bus")
1867
1626
use_dbus = False
1868
server_settings["use_dbus"] = False
1627
server_settings[u"use_dbus"] = False
1869
1628
tcp_server.use_dbus = False
1870
1629
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1871
service = AvahiService(name = server_settings["servicename"],
1872
servicetype = "_mandos._tcp",
1630
service = AvahiService(name = server_settings[u"servicename"],
1631
servicetype = u"_mandos._tcp",
1873
1632
protocol = protocol, bus = bus)
1874
1633
if server_settings["interface"]:
1875
1634
service.interface = (if_nametoindex
1876
(str(server_settings["interface"])))
1877
1878
global multiprocessing_manager
1879
multiprocessing_manager = multiprocessing.Manager()
1635
(str(server_settings[u"interface"])))
1880
1636
1881
1637
client_class = Client
1882
1638
if use_dbus:
1883
1639
client_class = functools.partial(ClientDBus, bus = bus)
1884
def client_config_items(config, section):
1885
special_settings = {
1886
"approved_by_default":
1887
lambda: config.getboolean(section,
1888
"approved_by_default"),
1889
}
1890
for name, value in config.items(section):
1891
try:
1892
yield (name, special_settings[name]())
1893
except KeyError:
1894
yield (name, value)
1895
1896
1640
tcp_server.clients.update(set(
1897
1641
client_class(name = section,
1898
config= dict(client_config_items(
1899
client_config, section)))
1642
config= dict(client_config.items(section)))
1900
1643
for section in client_config.sections()))
1901
1644
if not tcp_server.clients:
1902
logger.warning("No clients defined")
1903
1645
logger.warning(u"No clients defined")
1646
1647
if debug:
1648
# Redirect stdin so all checkers get /dev/null
1649
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1650
os.dup2(null, sys.stdin.fileno())
1651
if null > 2:
1652
os.close(null)
1653
else:
1654
# No console logging
1655
logger.removeHandler(console)
1656
# Close all input and output, do double fork, etc.
1657
daemon()
1658
1659
try:
1660
with pidfile:
1661
pid = os.getpid()
1662
pidfile.write(str(pid) + "\n")
1663
del pidfile
1664
except IOError:
1665
logger.error(u"Could not write to file %r with PID %d",
1666
pidfilename, pid)
1667
except NameError:
1668
# "pidfile" was never created
1669
pass
1670
del pidfilename
1671
1904
1672
if not debug:
1905
try:
1906
with pidfile:
1907
pid = os.getpid()
1908
pidfile.write(str(pid) + "\n".encode("utf-8"))
1909
del pidfile
1910
except IOError:
1911
logger.error("Could not write to file %r with PID %d",
1912
pidfilename, pid)
1913
except NameError:
1914
# "pidfile" was never created
1915
pass
1916
del pidfilename
1917
1918
1673
signal.signal(signal.SIGINT, signal.SIG_IGN)
1919
1920
1674
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1921
1675
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1922
1676
1924
1678
class MandosDBusService(dbus.service.Object):
1925
1679
"""A D-Bus proxy object"""
1926
1680
def __init__(self):
1927
dbus.service.Object.__init__(self, bus, "/")
1928
_interface = "se.bsnet.fukt.Mandos"
1681
dbus.service.Object.__init__(self, bus, u"/")
1682
_interface = u"se.bsnet.fukt.Mandos"
1929
1683
1930
@dbus.service.signal(_interface, signature="o")
1684
@dbus.service.signal(_interface, signature=u"o")
1931
1685
def ClientAdded(self, objpath):
1932
1686
"D-Bus signal"
1933
1687
pass
1934
1688
1935
@dbus.service.signal(_interface, signature="ss")
1689
@dbus.service.signal(_interface, signature=u"ss")
1936
1690
def ClientNotFound(self, fingerprint, address):
1937
1691
"D-Bus signal"
1938
1692
pass
1939
1693
1940
@dbus.service.signal(_interface, signature="os")
1694
@dbus.service.signal(_interface, signature=u"os")
1941
1695
def ClientRemoved(self, objpath, name):
1942
1696
"D-Bus signal"
1943
1697
pass
1944
1698
1945
@dbus.service.method(_interface, out_signature="ao")
1699
@dbus.service.method(_interface, out_signature=u"ao")
1946
1700
def GetAllClients(self):
1947
1701
"D-Bus method"
1948
1702
return dbus.Array(c.dbus_object_path
1949
1703
for c in tcp_server.clients)
1950
1704
1951
1705
@dbus.service.method(_interface,
1952
out_signature="a{oa{sv}}")
1706
out_signature=u"a{oa{sv}}")
1953
1707
def GetAllClientsWithProperties(self):
1954
1708
"D-Bus method"
1955
1709
return dbus.Dictionary(
1956
((c.dbus_object_path, c.GetAll(""))
1710
((c.dbus_object_path, c.GetAll(u""))
1957
1711
for c in tcp_server.clients),
1958
signature="oa{sv}")
1712
signature=u"oa{sv}")
1959
1713
1960
@dbus.service.method(_interface, in_signature="o")
1714
@dbus.service.method(_interface, in_signature=u"o")
1961
1715
def RemoveClient(self, object_path):
1962
1716
"D-Bus method"
1963
1717
for c in tcp_server.clients:
2005
1759
# Find out what port we got
2006
1760
service.port = tcp_server.socket.getsockname()[1]
2007
1761
if use_ipv6:
2008
logger.info("Now listening on address %r, port %d,"
1762
logger.info(u"Now listening on address %r, port %d,"
2009
1763
" flowinfo %d, scope_id %d"
2010
1764
% tcp_server.socket.getsockname())
2011
1765
else: # IPv4
2012
logger.info("Now listening on address %r, port %d"
1766
logger.info(u"Now listening on address %r, port %d"
2013
1767
% tcp_server.socket.getsockname())
2014
1768
2015
1769
#service.interface = tcp_server.socket.getsockname()[3]
2019
1773
try:
2020
1774
service.activate()
2021
1775
except dbus.exceptions.DBusException, error:
2022
logger.critical("DBusException: %s", error)
1776
logger.critical(u"DBusException: %s", error)
2023
1777
cleanup()
2024
1778
sys.exit(1)
2025
1779
# End of Avahi example code
2029
1783
(tcp_server.handle_request
2030
1784
(*args[2:], **kwargs) or True))
2031
1785
2032
logger.debug("Starting main loop")
1786
logger.debug(u"Starting main loop")
2033
1787
main_loop.run()
2034
1788
except AvahiError, error:
2035
logger.critical("AvahiError: %s", error)
1789
logger.critical(u"AvahiError: %s", error)
2036
1790
cleanup()
2037
1791
sys.exit(1)
2038
1792
except KeyboardInterrupt:
2039
1793
if debug:
2040
1794
print >> sys.stderr
2041
logger.debug("Server received KeyboardInterrupt")
2042
logger.debug("Server exiting")
1795
logger.debug(u"Server received KeyboardInterrupt")
1796
logger.debug(u"Server exiting")
2043
1797
# Must run before the D-Bus bus name gets deregistered
2044
1798
cleanup()
2045
1799
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0