To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 423
- compare with another revision
- download diff
- download tarball
- view history from revision 423
- Committer: Teddy Hogeborn
- Date: 2010-09-12 03:00:40 UTC
- Revision ID: teddy@fukt.bsnet.se-20100912030040-b0uopyennste9fdh
Documentation changes:
* DBUS-API: New file documenting the server D-Bus interface.
* clients.conf: Add examples of new approval settings.
* debian/mandos.docs: Added "DBUS-API".
* mandos-clients.conf.xml (OPTIONS): Added "approved_by_default",
"approval_delay", and
"approval_duration".
* mandos.xml (D-BUS INTERFACE): Refer to the "DBUS-API" file.
(BUGS): Remove mention of lack of a remote query interface.
* DBUS-API: New file documenting the server D-Bus interface.
* clients.conf: Add examples of new approval settings.
* debian/mandos.docs: Added "DBUS-API".
* mandos-clients.conf.xml (OPTIONS): Added "approved_by_default",
"approval_delay", and
"approval_duration".
* mandos.xml (D-BUS INTERFACE): Refer to the "DBUS-API" file.
(BUGS): Remove mention of lack of a remote query interface.
- files removed:
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
31
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
36
import SocketServer as socketserver
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
62
61
import functools
63
62
import cPickle as pickle
64
63
import multiprocessing
65
import types
66
64
67
65
import dbus
68
66
import dbus.service
83
81
SO_BINDTODEVICE = None
84
82
85
83
86
version = "1.3.1"
84
version = "1.0.14"
87
85
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
90
88
syslogger = (logging.handlers.SysLogHandler
91
89
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
address = str("/dev/log")))
90
address = "/dev/log"))
93
91
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
96
94
logger.addHandler(syslogger)
97
95
98
96
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
102
100
logger.addHandler(console)
103
101
104
102
class AvahiError(Exception):
121
119
Attributes:
122
120
interface: integer; avahi.IF_UNSPEC or an interface index.
123
121
Used to optionally bind to the specified interface.
124
name: string; Example: 'Mandos'
125
type: string; Example: '_mandos._tcp'.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
126
124
See <http://www.dns-sd.org/ServiceTypes.html>
127
125
port: integer; what port to announce
128
126
TXT: list of strings; TXT record for the service
137
135
"""
138
136
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
139
137
servicetype = None, port = None, TXT = None,
140
domain = "", host = "", max_renames = 32768,
138
domain = u"", host = u"", max_renames = 32768,
141
139
protocol = avahi.PROTO_UNSPEC, bus = None):
142
140
self.interface = interface
143
141
self.name = name
152
150
self.group = None # our entry group
153
151
self.server = None
154
152
self.bus = bus
155
self.entry_group_state_changed_match = None
156
153
def rename(self):
157
154
"""Derived from the Avahi example code"""
158
155
if self.rename_count >= self.max_renames:
159
logger.critical("No suitable Zeroconf service name found"
160
" after %i retries, exiting.",
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
161
158
self.rename_count)
162
raise AvahiServiceError("Too many renames")
159
raise AvahiServiceError(u"Too many renames")
163
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
164
logger.info("Changing Zeroconf service name to %r ...",
161
logger.info(u"Changing Zeroconf service name to %r ...",
165
162
self.name)
166
163
syslogger.setFormatter(logging.Formatter
167
('Mandos (%s) [%%(process)d]:'
168
' %%(levelname)s: %%(message)s'
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
169
166
% self.name))
170
167
self.remove()
171
168
try:
172
169
self.add()
173
except dbus.exceptions.DBusException as error:
174
logger.critical("DBusException: %s", error)
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
175
172
self.cleanup()
176
173
os._exit(1)
177
174
self.rename_count += 1
178
175
def remove(self):
179
176
"""Derived from the Avahi example code"""
180
if self.entry_group_state_changed_match is not None:
181
self.entry_group_state_changed_match.remove()
182
self.entry_group_state_changed_match = None
183
177
if self.group is not None:
184
178
self.group.Reset()
185
179
def add(self):
186
180
"""Derived from the Avahi example code"""
187
self.remove()
188
181
if self.group is None:
189
182
self.group = dbus.Interface(
190
183
self.bus.get_object(avahi.DBUS_NAME,
191
184
self.server.EntryGroupNew()),
192
185
avahi.DBUS_INTERFACE_ENTRY_GROUP)
193
self.entry_group_state_changed_match = (
194
self.group.connect_to_signal(
195
'StateChanged', self .entry_group_state_changed))
196
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
186
self.group.connect_to_signal('StateChanged',
187
self
188
.entry_group_state_changed)
189
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
197
190
self.name, self.type)
198
191
self.group.AddService(
199
192
self.interface,
206
199
self.group.Commit()
207
200
def entry_group_state_changed(self, state, error):
208
201
"""Derived from the Avahi example code"""
209
logger.debug("Avahi entry group state change: %i", state)
202
logger.debug(u"Avahi entry group state change: %i", state)
210
203
211
204
if state == avahi.ENTRY_GROUP_ESTABLISHED:
212
logger.debug("Zeroconf service established.")
205
logger.debug(u"Zeroconf service established.")
213
206
elif state == avahi.ENTRY_GROUP_COLLISION:
214
logger.info("Zeroconf service name collision.")
207
logger.warning(u"Zeroconf service name collision.")
215
208
self.rename()
216
209
elif state == avahi.ENTRY_GROUP_FAILURE:
217
logger.critical("Avahi: Error in group state changed %s",
210
logger.critical(u"Avahi: Error in group state changed %s",
218
211
unicode(error))
219
raise AvahiGroupError("State changed: %s"
212
raise AvahiGroupError(u"State changed: %s"
220
213
% unicode(error))
221
214
def cleanup(self):
222
215
"""Derived from the Avahi example code"""
223
216
if self.group is not None:
224
try:
225
self.group.Free()
226
except (dbus.exceptions.UnknownMethodException,
227
dbus.exceptions.DBusException) as e:
228
pass
217
self.group.Free()
229
218
self.group = None
230
self.remove()
231
def server_state_changed(self, state, error=None):
219
def server_state_changed(self, state):
232
220
"""Derived from the Avahi example code"""
233
logger.debug("Avahi server state change: %i", state)
234
bad_states = { avahi.SERVER_INVALID:
235
"Zeroconf server invalid",
236
avahi.SERVER_REGISTERING: None,
237
avahi.SERVER_COLLISION:
238
"Zeroconf server name collision",
239
avahi.SERVER_FAILURE:
240
"Zeroconf server failure" }
241
if state in bad_states:
242
if bad_states[state] is not None:
243
if error is None:
244
logger.error(bad_states[state])
245
else:
246
logger.error(bad_states[state] + ": %r", error)
247
self.cleanup()
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
224
self.remove()
248
225
elif state == avahi.SERVER_RUNNING:
249
226
self.add()
250
else:
251
if error is None:
252
logger.debug("Unknown state: %r", state)
253
else:
254
logger.debug("Unknown state: %r: %r", state, error)
255
227
def activate(self):
256
228
"""Derived from the Avahi example code"""
257
229
if self.server is None:
258
230
self.server = dbus.Interface(
259
231
self.bus.get_object(avahi.DBUS_NAME,
260
avahi.DBUS_PATH_SERVER,
261
follow_name_owner_changes=True),
232
avahi.DBUS_PATH_SERVER),
262
233
avahi.DBUS_INTERFACE_SERVER)
263
self.server.connect_to_signal("StateChanged",
234
self.server.connect_to_signal(u"StateChanged",
264
235
self.server_state_changed)
265
236
self.server_state_changed(self.server.GetState())
266
237
267
238
268
def _timedelta_to_milliseconds(td):
269
"Convert a datetime.timedelta() to milliseconds"
270
return ((td.days * 24 * 60 * 60 * 1000)
271
+ (td.seconds * 1000)
272
+ (td.microseconds // 1000))
273
274
239
class Client(object):
275
240
"""A representation of a client host served by this server.
276
241
277
242
Attributes:
278
_approved: bool(); 'None' if not yet approved/disapproved
279
approval_delay: datetime.timedelta(); Time to wait for approval
280
approval_duration: datetime.timedelta(); Duration of one approval
243
name: string; from the config file, used in log messages and
244
D-Bus identifiers
245
fingerprint: string (40 or 32 hexadecimal digits); used to
246
uniquely identify the client
247
secret: bytestring; sent verbatim (over TLS) to client
248
host: string; available for use by the checker command
249
created: datetime.datetime(); (UTC) object creation
250
last_enabled: datetime.datetime(); (UTC)
251
enabled: bool()
252
last_checked_ok: datetime.datetime(); (UTC) or None
253
timeout: datetime.timedelta(); How long from last_checked_ok
254
until this client is disabled
255
interval: datetime.timedelta(); How often to start a new checker
256
disable_hook: If set, called by disable() as disable_hook(self)
281
257
checker: subprocess.Popen(); a running checker process used
282
258
to see if the client lives.
283
259
'None' if no process is running.
284
checker_callback_tag: a gobject event source tag, or None
285
checker_command: string; External command which is run to check
286
if client lives. %() expansions are done at
260
checker_initiator_tag: a gobject event source tag, or None
261
disable_initiator_tag: - '' -
262
checker_callback_tag: - '' -
263
checker_command: string; External command which is run to check if
264
client lives. %() expansions are done at
287
265
runtime with vars(self) as dict, so that for
288
266
instance %(name)s can be used in the command.
289
checker_initiator_tag: a gobject event source tag, or None
290
created: datetime.datetime(); (UTC) object creation
291
267
current_checker_command: string; current running checker_command
292
disable_hook: If set, called by disable() as disable_hook(self)
293
disable_initiator_tag: a gobject event source tag, or None
294
enabled: bool()
295
fingerprint: string (40 or 32 hexadecimal digits); used to
296
uniquely identify the client
297
host: string; available for use by the checker command
298
interval: datetime.timedelta(); How often to start a new checker
299
last_approval_request: datetime.datetime(); (UTC) or None
300
last_checked_ok: datetime.datetime(); (UTC) or None
301
last_enabled: datetime.datetime(); (UTC)
302
name: string; from the config file, used in log messages and
303
D-Bus identifiers
304
secret: bytestring; sent verbatim (over TLS) to client
305
timeout: datetime.timedelta(); How long from last_checked_ok
306
until this client is disabled
307
extended_timeout: extra long timeout when password has been sent
308
runtime_expansions: Allowed attributes for runtime expansion.
309
expires: datetime.datetime(); time (UTC) when a client will be
310
disabled, or None
268
approval_delay: datetime.timedelta(); Time to wait for approval
269
_approved: bool(); 'None' if not yet approved/disapproved
270
approval_duration: datetime.timedelta(); Duration of one approval
311
271
"""
312
272
313
runtime_expansions = ("approval_delay", "approval_duration",
314
"created", "enabled", "fingerprint",
315
"host", "interval", "last_checked_ok",
316
"last_enabled", "name", "timeout")
273
@staticmethod
274
def _timedelta_to_milliseconds(td):
275
"Convert a datetime.timedelta() to milliseconds"
276
return ((td.days * 24 * 60 * 60 * 1000)
277
+ (td.seconds * 1000)
278
+ (td.microseconds // 1000))
317
279
318
280
def timeout_milliseconds(self):
319
281
"Return the 'timeout' attribute in milliseconds"
320
return _timedelta_to_milliseconds(self.timeout)
321
322
def extended_timeout_milliseconds(self):
323
"Return the 'extended_timeout' attribute in milliseconds"
324
return _timedelta_to_milliseconds(self.extended_timeout)
282
return self._timedelta_to_milliseconds(self.timeout)
325
283
326
284
def interval_milliseconds(self):
327
285
"Return the 'interval' attribute in milliseconds"
328
return _timedelta_to_milliseconds(self.interval)
329
286
return self._timedelta_to_milliseconds(self.interval)
287
330
288
def approval_delay_milliseconds(self):
331
return _timedelta_to_milliseconds(self.approval_delay)
289
return self._timedelta_to_milliseconds(self.approval_delay)
332
290
333
291
def __init__(self, name = None, disable_hook=None, config=None):
334
292
"""Note: the 'checker' key in 'config' sets the
337
295
self.name = name
338
296
if config is None:
339
297
config = {}
340
logger.debug("Creating client %r", self.name)
298
logger.debug(u"Creating client %r", self.name)
341
299
# Uppercase and remove spaces from fingerprint for later
342
300
# comparison purposes with return value from the fingerprint()
343
301
# function
344
self.fingerprint = (config["fingerprint"].upper()
345
.replace(" ", ""))
346
logger.debug(" Fingerprint: %s", self.fingerprint)
347
if "secret" in config:
348
self.secret = config["secret"].decode("base64")
349
elif "secfile" in config:
302
self.fingerprint = (config[u"fingerprint"].upper()
303
.replace(u" ", u""))
304
logger.debug(u" Fingerprint: %s", self.fingerprint)
305
if u"secret" in config:
306
self.secret = config[u"secret"].decode(u"base64")
307
elif u"secfile" in config:
350
308
with open(os.path.expanduser(os.path.expandvars
351
(config["secfile"])),
309
(config[u"secfile"])),
352
310
"rb") as secfile:
353
311
self.secret = secfile.read()
354
312
else:
355
raise TypeError("No secret or secfile for client %s"
313
raise TypeError(u"No secret or secfile for client %s"
356
314
% self.name)
357
self.host = config.get("host", "")
315
self.host = config.get(u"host", u"")
358
316
self.created = datetime.datetime.utcnow()
359
317
self.enabled = False
360
self.last_approval_request = None
361
318
self.last_enabled = None
362
319
self.last_checked_ok = None
363
self.timeout = string_to_delta(config["timeout"])
364
self.extended_timeout = string_to_delta(config["extended_timeout"])
365
self.interval = string_to_delta(config["interval"])
320
self.timeout = string_to_delta(config[u"timeout"])
321
self.interval = string_to_delta(config[u"interval"])
366
322
self.disable_hook = disable_hook
367
323
self.checker = None
368
324
self.checker_initiator_tag = None
369
325
self.disable_initiator_tag = None
370
self.expires = None
371
326
self.checker_callback_tag = None
372
self.checker_command = config["checker"]
327
self.checker_command = config[u"checker"]
373
328
self.current_checker_command = None
374
329
self.last_connect = None
375
330
self._approved = None
376
self.approved_by_default = config.get("approved_by_default",
331
self.approved_by_default = config.get(u"approved_by_default",
377
332
True)
378
333
self.approvals_pending = 0
379
334
self.approval_delay = string_to_delta(
380
config["approval_delay"])
335
config[u"approval_delay"])
381
336
self.approval_duration = string_to_delta(
382
config["approval_duration"])
337
config[u"approval_duration"])
383
338
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
384
339
385
340
def send_changedstate(self):
389
344
390
345
def enable(self):
391
346
"""Start this client's checker and timeout hooks"""
392
if getattr(self, "enabled", False):
347
if getattr(self, u"enabled", False):
393
348
# Already enabled
394
349
return
395
350
self.send_changedstate()
351
self.last_enabled = datetime.datetime.utcnow()
396
352
# Schedule a new checker to be started an 'interval' from now,
397
353
# and every interval from then on.
398
354
self.checker_initiator_tag = (gobject.timeout_add
399
355
(self.interval_milliseconds(),
400
356
self.start_checker))
401
357
# Schedule a disable() when 'timeout' has passed
402
self.expires = datetime.datetime.utcnow() + self.timeout
403
358
self.disable_initiator_tag = (gobject.timeout_add
404
359
(self.timeout_milliseconds(),
405
360
self.disable))
406
361
self.enabled = True
407
self.last_enabled = datetime.datetime.utcnow()
408
362
# Also start a new checker *right now*.
409
363
self.start_checker()
410
364
415
369
if not quiet:
416
370
self.send_changedstate()
417
371
if not quiet:
418
logger.info("Disabling client %s", self.name)
419
if getattr(self, "disable_initiator_tag", False):
372
logger.info(u"Disabling client %s", self.name)
373
if getattr(self, u"disable_initiator_tag", False):
420
374
gobject.source_remove(self.disable_initiator_tag)
421
375
self.disable_initiator_tag = None
422
self.expires = None
423
if getattr(self, "checker_initiator_tag", False):
376
if getattr(self, u"checker_initiator_tag", False):
424
377
gobject.source_remove(self.checker_initiator_tag)
425
378
self.checker_initiator_tag = None
426
379
self.stop_checker()
441
394
if os.WIFEXITED(condition):
442
395
exitstatus = os.WEXITSTATUS(condition)
443
396
if exitstatus == 0:
444
logger.info("Checker for %(name)s succeeded",
397
logger.info(u"Checker for %(name)s succeeded",
445
398
vars(self))
446
399
self.checked_ok()
447
400
else:
448
logger.info("Checker for %(name)s failed",
401
logger.info(u"Checker for %(name)s failed",
449
402
vars(self))
450
403
else:
451
logger.warning("Checker for %(name)s crashed?",
404
logger.warning(u"Checker for %(name)s crashed?",
452
405
vars(self))
453
406
454
def checked_ok(self, timeout=None):
407
def checked_ok(self):
455
408
"""Bump up the timeout for this client.
456
409
457
410
This should only be called when the client has been seen,
458
411
alive and well.
459
412
"""
460
if timeout is None:
461
timeout = self.timeout
462
413
self.last_checked_ok = datetime.datetime.utcnow()
463
414
gobject.source_remove(self.disable_initiator_tag)
464
self.expires = datetime.datetime.utcnow() + timeout
465
415
self.disable_initiator_tag = (gobject.timeout_add
466
(_timedelta_to_milliseconds(timeout),
416
(self.timeout_milliseconds(),
467
417
self.disable))
468
418
469
def need_approval(self):
470
self.last_approval_request = datetime.datetime.utcnow()
471
472
419
def start_checker(self):
473
420
"""Start a new checker subprocess if one is not running.
474
421
486
433
# If a checker exists, make sure it is not a zombie
487
434
try:
488
435
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
489
except (AttributeError, OSError) as error:
436
except (AttributeError, OSError), error:
490
437
if (isinstance(error, OSError)
491
438
and error.errno != errno.ECHILD):
492
439
raise error
493
440
else:
494
441
if pid:
495
logger.warning("Checker was a zombie")
442
logger.warning(u"Checker was a zombie")
496
443
gobject.source_remove(self.checker_callback_tag)
497
444
self.checker_callback(pid, status,
498
445
self.current_checker_command)
503
450
command = self.checker_command % self.host
504
451
except TypeError:
505
452
# Escape attributes for the shell
506
escaped_attrs = dict(
507
(attr,
508
re.escape(unicode(str(getattr(self, attr, "")),
509
errors=
510
'replace')))
511
for attr in
512
self.runtime_expansions)
513
453
escaped_attrs = dict((key,
454
re.escape(unicode(str(val),
455
errors=
456
u'replace')))
457
for key, val in
458
vars(self).iteritems())
514
459
try:
515
460
command = self.checker_command % escaped_attrs
516
except TypeError as error:
517
logger.error('Could not format string "%s":'
518
' %s', self.checker_command, error)
461
except TypeError, error:
462
logger.error(u'Could not format string "%s":'
463
u' %s', self.checker_command, error)
519
464
return True # Try again later
520
465
self.current_checker_command = command
521
466
try:
522
logger.info("Starting checker %r for %s",
467
logger.info(u"Starting checker %r for %s",
523
468
command, self.name)
524
469
# We don't need to redirect stdout and stderr, since
525
470
# in normal mode, that is already done by daemon(),
527
472
# always replaced by /dev/null.)
528
473
self.checker = subprocess.Popen(command,
529
474
close_fds=True,
530
shell=True, cwd="/")
475
shell=True, cwd=u"/")
531
476
self.checker_callback_tag = (gobject.child_watch_add
532
477
(self.checker.pid,
533
478
self.checker_callback,
538
483
if pid:
539
484
gobject.source_remove(self.checker_callback_tag)
540
485
self.checker_callback(pid, status, command)
541
except OSError as error:
542
logger.error("Failed to start subprocess: %s",
486
except OSError, error:
487
logger.error(u"Failed to start subprocess: %s",
543
488
error)
544
489
# Re-run this periodically if run by gobject.timeout_add
545
490
return True
549
494
if self.checker_callback_tag:
550
495
gobject.source_remove(self.checker_callback_tag)
551
496
self.checker_callback_tag = None
552
if getattr(self, "checker", None) is None:
497
if getattr(self, u"checker", None) is None:
553
498
return
554
logger.debug("Stopping checker for %(name)s", vars(self))
499
logger.debug(u"Stopping checker for %(name)s", vars(self))
555
500
try:
556
501
os.kill(self.checker.pid, signal.SIGTERM)
557
502
#time.sleep(0.5)
558
503
#if self.checker.poll() is None:
559
504
# os.kill(self.checker.pid, signal.SIGKILL)
560
except OSError as error:
505
except OSError, error:
561
506
if error.errno != errno.ESRCH: # No such process
562
507
raise
563
508
self.checker = None
564
509
565
566
def dbus_service_property(dbus_interface, signature="v",
567
access="readwrite", byte_arrays=False):
510
def dbus_service_property(dbus_interface, signature=u"v",
511
access=u"readwrite", byte_arrays=False):
568
512
"""Decorators for marking methods of a DBusObjectWithProperties to
569
513
become properties on the D-Bus.
570
514
577
521
"""
578
522
# Encoding deeply encoded byte arrays is not supported yet by the
579
523
# "Set" method, so we fail early here:
580
if byte_arrays and signature != "ay":
581
raise ValueError("Byte arrays not supported for non-'ay'"
582
" signature %r" % signature)
524
if byte_arrays and signature != u"ay":
525
raise ValueError(u"Byte arrays not supported for non-'ay'"
526
u" signature %r" % signature)
583
527
def decorator(func):
584
528
func._dbus_is_property = True
585
529
func._dbus_interface = dbus_interface
586
530
func._dbus_signature = signature
587
531
func._dbus_access = access
588
532
func._dbus_name = func.__name__
589
if func._dbus_name.endswith("_dbus_property"):
533
if func._dbus_name.endswith(u"_dbus_property"):
590
534
func._dbus_name = func._dbus_name[:-14]
591
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
535
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
592
536
return func
593
537
return decorator
594
538
614
558
615
559
class DBusObjectWithProperties(dbus.service.Object):
616
560
"""A D-Bus object with properties.
617
561
618
562
Classes inheriting from this can use the dbus_service_property
619
563
decorator to expose methods as D-Bus properties. It exposes the
620
564
standard Get(), Set(), and GetAll() methods on the D-Bus.
622
566
623
567
@staticmethod
624
568
def _is_dbus_property(obj):
625
return getattr(obj, "_dbus_is_property", False)
569
return getattr(obj, u"_dbus_is_property", False)
626
570
627
571
def _get_all_dbus_properties(self):
628
572
"""Returns a generator of (name, attribute) pairs
629
573
"""
630
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
631
for cls in self.__class__.__mro__
632
for name, prop in inspect.getmembers(cls, self._is_dbus_property))
574
return ((prop._dbus_name, prop)
575
for name, prop in
576
inspect.getmembers(self, self._is_dbus_property))
633
577
634
578
def _get_dbus_property(self, interface_name, property_name):
635
579
"""Returns a bound method if one exists which is a D-Bus
636
580
property with the specified name and interface.
637
581
"""
638
for cls in self.__class__.__mro__:
639
for name, value in inspect.getmembers(cls, self._is_dbus_property):
640
if value._dbus_name == property_name and value._dbus_interface == interface_name:
641
return value.__get__(self)
642
582
for name in (property_name,
583
property_name + u"_dbus_property"):
584
prop = getattr(self, name, None)
585
if (prop is None
586
or not self._is_dbus_property(prop)
587
or prop._dbus_name != property_name
588
or (interface_name and prop._dbus_interface
589
and interface_name != prop._dbus_interface)):
590
continue
591
return prop
643
592
# No such property
644
raise DBusPropertyNotFound(self.dbus_object_path + ":"
645
+ interface_name + "."
593
raise DBusPropertyNotFound(self.dbus_object_path + u":"
594
+ interface_name + u"."
646
595
+ property_name)
647
596
648
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
649
out_signature="v")
597
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
598
out_signature=u"v")
650
599
def Get(self, interface_name, property_name):
651
600
"""Standard D-Bus property Get() method, see D-Bus standard.
652
601
"""
653
602
prop = self._get_dbus_property(interface_name, property_name)
654
if prop._dbus_access == "write":
603
if prop._dbus_access == u"write":
655
604
raise DBusPropertyAccessException(property_name)
656
605
value = prop()
657
if not hasattr(value, "variant_level"):
606
if not hasattr(value, u"variant_level"):
658
607
return value
659
608
return type(value)(value, variant_level=value.variant_level+1)
660
609
661
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
610
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
662
611
def Set(self, interface_name, property_name, value):
663
612
"""Standard D-Bus property Set() method, see D-Bus standard.
664
613
"""
665
614
prop = self._get_dbus_property(interface_name, property_name)
666
if prop._dbus_access == "read":
615
if prop._dbus_access == u"read":
667
616
raise DBusPropertyAccessException(property_name)
668
if prop._dbus_get_args_options["byte_arrays"]:
617
if prop._dbus_get_args_options[u"byte_arrays"]:
669
618
# The byte_arrays option is not supported yet on
670
619
# signatures other than "ay".
671
if prop._dbus_signature != "ay":
620
if prop._dbus_signature != u"ay":
672
621
raise ValueError
673
622
value = dbus.ByteArray(''.join(unichr(byte)
674
623
for byte in value))
675
624
prop(value)
676
625
677
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
678
out_signature="a{sv}")
626
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
627
out_signature=u"a{sv}")
679
628
def GetAll(self, interface_name):
680
629
"""Standard D-Bus property GetAll() method, see D-Bus
681
630
standard.
682
631
683
632
Note: Will not include properties with access="write".
684
633
"""
685
634
all = {}
689
638
# Interface non-empty but did not match
690
639
continue
691
640
# Ignore write-only properties
692
if prop._dbus_access == "write":
641
if prop._dbus_access == u"write":
693
642
continue
694
643
value = prop()
695
if not hasattr(value, "variant_level"):
644
if not hasattr(value, u"variant_level"):
696
645
all[name] = value
697
646
continue
698
647
all[name] = type(value)(value, variant_level=
699
648
value.variant_level+1)
700
return dbus.Dictionary(all, signature="sv")
649
return dbus.Dictionary(all, signature=u"sv")
701
650
702
651
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
703
out_signature="s",
652
out_signature=u"s",
704
653
path_keyword='object_path',
705
654
connection_keyword='connection')
706
655
def Introspect(self, object_path, connection):
711
660
try:
712
661
document = xml.dom.minidom.parseString(xmlstring)
713
662
def make_tag(document, name, prop):
714
e = document.createElement("property")
715
e.setAttribute("name", name)
716
e.setAttribute("type", prop._dbus_signature)
717
e.setAttribute("access", prop._dbus_access)
663
e = document.createElement(u"property")
664
e.setAttribute(u"name", name)
665
e.setAttribute(u"type", prop._dbus_signature)
666
e.setAttribute(u"access", prop._dbus_access)
718
667
return e
719
for if_tag in document.getElementsByTagName("interface"):
668
for if_tag in document.getElementsByTagName(u"interface"):
720
669
for tag in (make_tag(document, name, prop)
721
670
for name, prop
722
671
in self._get_all_dbus_properties()
723
672
if prop._dbus_interface
724
== if_tag.getAttribute("name")):
673
== if_tag.getAttribute(u"name")):
725
674
if_tag.appendChild(tag)
726
675
# Add the names to the return values for the
727
676
# "org.freedesktop.DBus.Properties" methods
728
if (if_tag.getAttribute("name")
729
== "org.freedesktop.DBus.Properties"):
730
for cn in if_tag.getElementsByTagName("method"):
731
if cn.getAttribute("name") == "Get":
732
for arg in cn.getElementsByTagName("arg"):
733
if (arg.getAttribute("direction")
734
== "out"):
735
arg.setAttribute("name", "value")
736
elif cn.getAttribute("name") == "GetAll":
737
for arg in cn.getElementsByTagName("arg"):
738
if (arg.getAttribute("direction")
739
== "out"):
740
arg.setAttribute("name", "props")
741
xmlstring = document.toxml("utf-8")
677
if (if_tag.getAttribute(u"name")
678
== u"org.freedesktop.DBus.Properties"):
679
for cn in if_tag.getElementsByTagName(u"method"):
680
if cn.getAttribute(u"name") == u"Get":
681
for arg in cn.getElementsByTagName(u"arg"):
682
if (arg.getAttribute(u"direction")
683
== u"out"):
684
arg.setAttribute(u"name", u"value")
685
elif cn.getAttribute(u"name") == u"GetAll":
686
for arg in cn.getElementsByTagName(u"arg"):
687
if (arg.getAttribute(u"direction")
688
== u"out"):
689
arg.setAttribute(u"name", u"props")
690
xmlstring = document.toxml(u"utf-8")
742
691
document.unlink()
743
692
except (AttributeError, xml.dom.DOMException,
744
xml.parsers.expat.ExpatError) as error:
745
logger.error("Failed to override Introspection method",
693
xml.parsers.expat.ExpatError), error:
694
logger.error(u"Failed to override Introspection method",
746
695
error)
747
696
return xmlstring
748
697
749
698
750
def datetime_to_dbus (dt, variant_level=0):
751
"""Convert a UTC datetime.datetime() to a D-Bus type."""
752
if dt is None:
753
return dbus.String("", variant_level = variant_level)
754
return dbus.String(dt.isoformat(),
755
variant_level=variant_level)
756
757
class transitional_dbus_metaclass(DBusObjectWithProperties.__metaclass__):
758
def __new__(mcs, name, bases, attr):
759
for attrname, old_dbusobj in inspect.getmembers(bases[0]):
760
new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")
761
if (getattr(old_dbusobj, "_dbus_is_signal", False)
762
and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):
763
unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,
764
old_dbusobj.__closure__))["func"].cell_contents
765
newfunc = types.FunctionType(unwrappedfunc.func_code,
766
unwrappedfunc.func_globals,
767
unwrappedfunc.func_name,
768
unwrappedfunc.func_defaults,
769
unwrappedfunc.func_closure)
770
new_dbusfunc = dbus.service.signal(
771
new_interface, old_dbusobj._dbus_signature)(newfunc)
772
attr["_transitional_" + attrname] = new_dbusfunc
773
774
def fixscope(func1, func2):
775
def newcall(*args, **kwargs):
776
func1(*args, **kwargs)
777
func2(*args, **kwargs)
778
return newcall
779
780
attr[attrname] = fixscope(old_dbusobj, new_dbusfunc)
781
782
elif (getattr(old_dbusobj, "_dbus_is_method", False)
783
and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):
784
new_dbusfunc = (dbus.service.method
785
(new_interface,
786
old_dbusobj._dbus_in_signature,
787
old_dbusobj._dbus_out_signature)
788
(types.FunctionType
789
(old_dbusobj.func_code,
790
old_dbusobj.func_globals,
791
old_dbusobj.func_name,
792
old_dbusobj.func_defaults,
793
old_dbusobj.func_closure)))
794
795
attr[attrname] = new_dbusfunc
796
elif (getattr(old_dbusobj, "_dbus_is_property", False)
797
and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):
798
new_dbusfunc = (dbus_service_property
799
(new_interface,
800
old_dbusobj._dbus_signature,
801
old_dbusobj._dbus_access,
802
old_dbusobj._dbus_get_args_options["byte_arrays"])
803
(types.FunctionType
804
(old_dbusobj.func_code,
805
old_dbusobj.func_globals,
806
old_dbusobj.func_name,
807
old_dbusobj.func_defaults,
808
old_dbusobj.func_closure)))
809
810
attr[attrname] = new_dbusfunc
811
return type.__new__(mcs, name, bases, attr)
812
813
699
class ClientDBus(Client, DBusObjectWithProperties):
814
700
"""A Client class using D-Bus
815
701
817
703
dbus_object_path: dbus.ObjectPath
818
704
bus: dbus.SystemBus()
819
705
"""
820
821
runtime_expansions = (Client.runtime_expansions
822
+ ("dbus_object_path",))
823
824
706
# dbus.service.Object doesn't use super(), so we can't either.
825
707
826
708
def __init__(self, bus = None, *args, **kwargs):
829
711
Client.__init__(self, *args, **kwargs)
830
712
# Only now, when this client is initialized, can it show up on
831
713
# the D-Bus
832
client_object_name = unicode(self.name).translate(
833
{ord("."): ord("_"),
834
ord("-"): ord("_")})
835
714
self.dbus_object_path = (dbus.ObjectPath
836
("/clients/" + client_object_name))
715
(u"/clients/"
716
+ self.name.replace(u".", u"_")))
837
717
DBusObjectWithProperties.__init__(self, self.bus,
838
718
self.dbus_object_path)
839
719
840
def notifychangeproperty(transform_func,
841
dbus_name, type_func=lambda x: x,
842
variant_level=1):
843
""" Modify a variable so that its a property that announce its
844
changes to DBus.
845
transform_fun: Function that takes a value and transform it to
846
DBus type.
847
dbus_name: DBus name of the variable
848
type_func: Function that transform the value before sending it
849
to DBus
850
variant_level: DBus variant level. default: 1
851
"""
852
real_value = [None,]
853
def setter(self, value):
854
old_value = real_value[0]
855
real_value[0] = value
856
if hasattr(self, "dbus_object_path"):
857
if type_func(old_value) != type_func(real_value[0]):
858
dbus_value = transform_func(type_func(real_value[0]),
859
variant_level)
860
self.PropertyChanged(dbus.String(dbus_name),
861
dbus_value)
862
863
return property(lambda self: real_value[0], setter)
864
865
866
expires = notifychangeproperty(datetime_to_dbus, "Expires")
867
approvals_pending = notifychangeproperty(dbus.Boolean,
868
"ApprovalPending",
869
type_func = bool)
870
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
871
last_enabled = notifychangeproperty(datetime_to_dbus,
872
"LastEnabled")
873
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
874
type_func = lambda checker: checker is not None)
875
last_checked_ok = notifychangeproperty(datetime_to_dbus,
876
"LastCheckedOK")
877
last_approval_request = notifychangeproperty(datetime_to_dbus,
878
"LastApprovalRequest")
879
approved_by_default = notifychangeproperty(dbus.Boolean,
880
"ApprovedByDefault")
881
approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",
882
type_func = _timedelta_to_milliseconds)
883
approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",
884
type_func = _timedelta_to_milliseconds)
885
host = notifychangeproperty(dbus.String, "Host")
886
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
887
type_func = _timedelta_to_milliseconds)
888
extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",
889
type_func = _timedelta_to_milliseconds)
890
interval = notifychangeproperty(dbus.UInt16, "Interval",
891
type_func = _timedelta_to_milliseconds)
892
checker_command = notifychangeproperty(dbus.String, "Checker")
893
894
del notifychangeproperty
720
def _get_approvals_pending(self):
721
return self._approvals_pending
722
def _set_approvals_pending(self, value):
723
old_value = self._approvals_pending
724
self._approvals_pending = value
725
bval = bool(value)
726
if (hasattr(self, "dbus_object_path")
727
and bval is not bool(old_value)):
728
dbus_bool = dbus.Boolean(bval, variant_level=1)
729
self.PropertyChanged(dbus.String(u"ApprovalPending"),
730
dbus_bool)
731
732
approvals_pending = property(_get_approvals_pending,
733
_set_approvals_pending)
734
del _get_approvals_pending, _set_approvals_pending
735
736
@staticmethod
737
def _datetime_to_dbus(dt, variant_level=0):
738
"""Convert a UTC datetime.datetime() to a D-Bus type."""
739
return dbus.String(dt.isoformat(),
740
variant_level=variant_level)
741
742
def enable(self):
743
oldstate = getattr(self, u"enabled", False)
744
r = Client.enable(self)
745
if oldstate != self.enabled:
746
# Emit D-Bus signals
747
self.PropertyChanged(dbus.String(u"Enabled"),
748
dbus.Boolean(True, variant_level=1))
749
self.PropertyChanged(
750
dbus.String(u"LastEnabled"),
751
self._datetime_to_dbus(self.last_enabled,
752
variant_level=1))
753
return r
754
755
def disable(self, quiet = False):
756
oldstate = getattr(self, u"enabled", False)
757
r = Client.disable(self, quiet=quiet)
758
if not quiet and oldstate != self.enabled:
759
# Emit D-Bus signal
760
self.PropertyChanged(dbus.String(u"Enabled"),
761
dbus.Boolean(False, variant_level=1))
762
return r
895
763
896
764
def __del__(self, *args, **kwargs):
897
765
try:
898
766
self.remove_from_connection()
899
767
except LookupError:
900
768
pass
901
if hasattr(DBusObjectWithProperties, "__del__"):
769
if hasattr(DBusObjectWithProperties, u"__del__"):
902
770
DBusObjectWithProperties.__del__(self, *args, **kwargs)
903
771
Client.__del__(self, *args, **kwargs)
904
772
906
774
*args, **kwargs):
907
775
self.checker_callback_tag = None
908
776
self.checker = None
777
# Emit D-Bus signal
778
self.PropertyChanged(dbus.String(u"CheckerRunning"),
779
dbus.Boolean(False, variant_level=1))
909
780
if os.WIFEXITED(condition):
910
781
exitstatus = os.WEXITSTATUS(condition)
911
782
# Emit D-Bus signal
921
792
return Client.checker_callback(self, pid, condition, command,
922
793
*args, **kwargs)
923
794
795
def checked_ok(self, *args, **kwargs):
796
r = Client.checked_ok(self, *args, **kwargs)
797
# Emit D-Bus signal
798
self.PropertyChanged(
799
dbus.String(u"LastCheckedOK"),
800
(self._datetime_to_dbus(self.last_checked_ok,
801
variant_level=1)))
802
return r
803
924
804
def start_checker(self, *args, **kwargs):
925
805
old_checker = self.checker
926
806
if self.checker is not None:
933
813
and old_checker_pid != self.checker.pid):
934
814
# Emit D-Bus signal
935
815
self.CheckerStarted(self.current_checker_command)
816
self.PropertyChanged(
817
dbus.String(u"CheckerRunning"),
818
dbus.Boolean(True, variant_level=1))
936
819
return r
937
820
821
def stop_checker(self, *args, **kwargs):
822
old_checker = getattr(self, u"checker", None)
823
r = Client.stop_checker(self, *args, **kwargs)
824
if (old_checker is not None
825
and getattr(self, u"checker", None) is None):
826
self.PropertyChanged(dbus.String(u"CheckerRunning"),
827
dbus.Boolean(False, variant_level=1))
828
return r
829
938
830
def _reset_approved(self):
939
831
self._approved = None
940
832
return False
942
834
def approve(self, value=True):
943
835
self.send_changedstate()
944
836
self._approved = value
945
gobject.timeout_add(_timedelta_to_milliseconds
837
gobject.timeout_add(self._timedelta_to_milliseconds
946
838
(self.approval_duration),
947
839
self._reset_approved)
948
840
949
841
950
842
## D-Bus methods, signals & properties
951
_interface = "se.bsnet.fukt.Mandos.Client"
843
_interface = u"se.bsnet.fukt.Mandos.Client"
952
844
953
845
## Signals
954
846
955
847
# CheckerCompleted - signal
956
@dbus.service.signal(_interface, signature="nxs")
848
@dbus.service.signal(_interface, signature=u"nxs")
957
849
def CheckerCompleted(self, exitcode, waitstatus, command):
958
850
"D-Bus signal"
959
851
pass
960
852
961
853
# CheckerStarted - signal
962
@dbus.service.signal(_interface, signature="s")
854
@dbus.service.signal(_interface, signature=u"s")
963
855
def CheckerStarted(self, command):
964
856
"D-Bus signal"
965
857
pass
966
858
967
859
# PropertyChanged - signal
968
@dbus.service.signal(_interface, signature="sv")
860
@dbus.service.signal(_interface, signature=u"sv")
969
861
def PropertyChanged(self, property, value):
970
862
"D-Bus signal"
971
863
pass
980
872
pass
981
873
982
874
# Rejected - signal
983
@dbus.service.signal(_interface, signature="s")
875
@dbus.service.signal(_interface, signature=u"s")
984
876
def Rejected(self, reason):
985
877
"D-Bus signal"
986
878
pass
987
879
988
880
# NeedApproval - signal
989
@dbus.service.signal(_interface, signature="tb")
881
@dbus.service.signal(_interface, signature=u"tb")
990
882
def NeedApproval(self, timeout, default):
991
883
"D-Bus signal"
992
return self.need_approval()
884
pass
993
885
994
886
## Methods
995
887
996
888
# Approve - method
997
@dbus.service.method(_interface, in_signature="b")
889
@dbus.service.method(_interface, in_signature=u"b")
998
890
def Approve(self, value):
999
891
self.approve(value)
1000
892
1001
893
# CheckedOK - method
1002
894
@dbus.service.method(_interface)
1003
895
def CheckedOK(self):
1004
self.checked_ok()
896
return self.checked_ok()
1005
897
1006
898
# Enable - method
1007
899
@dbus.service.method(_interface)
1029
921
## Properties
1030
922
1031
923
# ApprovalPending - property
1032
@dbus_service_property(_interface, signature="b", access="read")
924
@dbus_service_property(_interface, signature=u"b", access=u"read")
1033
925
def ApprovalPending_dbus_property(self):
1034
926
return dbus.Boolean(bool(self.approvals_pending))
1035
927
1036
928
# ApprovedByDefault - property
1037
@dbus_service_property(_interface, signature="b",
1038
access="readwrite")
929
@dbus_service_property(_interface, signature=u"b",
930
access=u"readwrite")
1039
931
def ApprovedByDefault_dbus_property(self, value=None):
1040
932
if value is None: # get
1041
933
return dbus.Boolean(self.approved_by_default)
1042
934
self.approved_by_default = bool(value)
935
# Emit D-Bus signal
936
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
937
dbus.Boolean(value, variant_level=1))
1043
938
1044
939
# ApprovalDelay - property
1045
@dbus_service_property(_interface, signature="t",
1046
access="readwrite")
940
@dbus_service_property(_interface, signature=u"t",
941
access=u"readwrite")
1047
942
def ApprovalDelay_dbus_property(self, value=None):
1048
943
if value is None: # get
1049
944
return dbus.UInt64(self.approval_delay_milliseconds())
1050
945
self.approval_delay = datetime.timedelta(0, 0, 0, value)
946
# Emit D-Bus signal
947
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
948
dbus.UInt64(value, variant_level=1))
1051
949
1052
950
# ApprovalDuration - property
1053
@dbus_service_property(_interface, signature="t",
1054
access="readwrite")
951
@dbus_service_property(_interface, signature=u"t",
952
access=u"readwrite")
1055
953
def ApprovalDuration_dbus_property(self, value=None):
1056
954
if value is None: # get
1057
return dbus.UInt64(_timedelta_to_milliseconds(
955
return dbus.UInt64(self._timedelta_to_milliseconds(
1058
956
self.approval_duration))
1059
957
self.approval_duration = datetime.timedelta(0, 0, 0, value)
958
# Emit D-Bus signal
959
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
960
dbus.UInt64(value, variant_level=1))
1060
961
1061
962
# Name - property
1062
@dbus_service_property(_interface, signature="s", access="read")
963
@dbus_service_property(_interface, signature=u"s", access=u"read")
1063
964
def Name_dbus_property(self):
1064
965
return dbus.String(self.name)
1065
966
1066
967
# Fingerprint - property
1067
@dbus_service_property(_interface, signature="s", access="read")
968
@dbus_service_property(_interface, signature=u"s", access=u"read")
1068
969
def Fingerprint_dbus_property(self):
1069
970
return dbus.String(self.fingerprint)
1070
971
1071
972
# Host - property
1072
@dbus_service_property(_interface, signature="s",
1073
access="readwrite")
973
@dbus_service_property(_interface, signature=u"s",
974
access=u"readwrite")
1074
975
def Host_dbus_property(self, value=None):
1075
976
if value is None: # get
1076
977
return dbus.String(self.host)
1077
978
self.host = value
979
# Emit D-Bus signal
980
self.PropertyChanged(dbus.String(u"Host"),
981
dbus.String(value, variant_level=1))
1078
982
1079
983
# Created - property
1080
@dbus_service_property(_interface, signature="s", access="read")
984
@dbus_service_property(_interface, signature=u"s", access=u"read")
1081
985
def Created_dbus_property(self):
1082
return dbus.String(datetime_to_dbus(self.created))
986
return dbus.String(self._datetime_to_dbus(self.created))
1083
987
1084
988
# LastEnabled - property
1085
@dbus_service_property(_interface, signature="s", access="read")
989
@dbus_service_property(_interface, signature=u"s", access=u"read")
1086
990
def LastEnabled_dbus_property(self):
1087
return datetime_to_dbus(self.last_enabled)
991
if self.last_enabled is None:
992
return dbus.String(u"")
993
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1088
994
1089
995
# Enabled - property
1090
@dbus_service_property(_interface, signature="b",
1091
access="readwrite")
996
@dbus_service_property(_interface, signature=u"b",
997
access=u"readwrite")
1092
998
def Enabled_dbus_property(self, value=None):
1093
999
if value is None: # get
1094
1000
return dbus.Boolean(self.enabled)
1098
1004
self.disable()
1099
1005
1100
1006
# LastCheckedOK - property
1101
@dbus_service_property(_interface, signature="s",
1102
access="readwrite")
1007
@dbus_service_property(_interface, signature=u"s",
1008
access=u"readwrite")
1103
1009
def LastCheckedOK_dbus_property(self, value=None):
1104
1010
if value is not None:
1105
1011
self.checked_ok()
1106
1012
return
1107
return datetime_to_dbus(self.last_checked_ok)
1108
1109
# Expires - property
1110
@dbus_service_property(_interface, signature="s", access="read")
1111
def Expires_dbus_property(self):
1112
return datetime_to_dbus(self.expires)
1113
1114
# LastApprovalRequest - property
1115
@dbus_service_property(_interface, signature="s", access="read")
1116
def LastApprovalRequest_dbus_property(self):
1117
return datetime_to_dbus(self.last_approval_request)
1013
if self.last_checked_ok is None:
1014
return dbus.String(u"")
1015
return dbus.String(self._datetime_to_dbus(self
1016
.last_checked_ok))
1118
1017
1119
1018
# Timeout - property
1120
@dbus_service_property(_interface, signature="t",
1121
access="readwrite")
1019
@dbus_service_property(_interface, signature=u"t",
1020
access=u"readwrite")
1122
1021
def Timeout_dbus_property(self, value=None):
1123
1022
if value is None: # get
1124
1023
return dbus.UInt64(self.timeout_milliseconds())
1125
1024
self.timeout = datetime.timedelta(0, 0, 0, value)
1126
if getattr(self, "disable_initiator_tag", None) is None:
1025
# Emit D-Bus signal
1026
self.PropertyChanged(dbus.String(u"Timeout"),
1027
dbus.UInt64(value, variant_level=1))
1028
if getattr(self, u"disable_initiator_tag", None) is None:
1127
1029
return
1128
1030
# Reschedule timeout
1129
1031
gobject.source_remove(self.disable_initiator_tag)
1130
1032
self.disable_initiator_tag = None
1131
self.expires = None
1132
1033
time_to_die = (self.
1133
1034
_timedelta_to_milliseconds((self
1134
1035
.last_checked_ok
1139
1040
# The timeout has passed
1140
1041
self.disable()
1141
1042
else:
1142
self.expires = (datetime.datetime.utcnow()
1143
+ datetime.timedelta(milliseconds = time_to_die))
1144
1043
self.disable_initiator_tag = (gobject.timeout_add
1145
1044
(time_to_die, self.disable))
1146
1045
1147
# ExtendedTimeout - property
1148
@dbus_service_property(_interface, signature="t",
1149
access="readwrite")
1150
def ExtendedTimeout_dbus_property(self, value=None):
1151
if value is None: # get
1152
return dbus.UInt64(self.extended_timeout_milliseconds())
1153
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1154
1155
1046
# Interval - property
1156
@dbus_service_property(_interface, signature="t",
1157
access="readwrite")
1047
@dbus_service_property(_interface, signature=u"t",
1048
access=u"readwrite")
1158
1049
def Interval_dbus_property(self, value=None):
1159
1050
if value is None: # get
1160
1051
return dbus.UInt64(self.interval_milliseconds())
1161
1052
self.interval = datetime.timedelta(0, 0, 0, value)
1162
if getattr(self, "checker_initiator_tag", None) is None:
1053
# Emit D-Bus signal
1054
self.PropertyChanged(dbus.String(u"Interval"),
1055
dbus.UInt64(value, variant_level=1))
1056
if getattr(self, u"checker_initiator_tag", None) is None:
1163
1057
return
1164
1058
# Reschedule checker run
1165
1059
gobject.source_remove(self.checker_initiator_tag)
1166
1060
self.checker_initiator_tag = (gobject.timeout_add
1167
1061
(value, self.start_checker))
1168
1062
self.start_checker() # Start one now, too
1169
1063
1170
1064
# Checker - property
1171
@dbus_service_property(_interface, signature="s",
1172
access="readwrite")
1065
@dbus_service_property(_interface, signature=u"s",
1066
access=u"readwrite")
1173
1067
def Checker_dbus_property(self, value=None):
1174
1068
if value is None: # get
1175
1069
return dbus.String(self.checker_command)
1176
1070
self.checker_command = value
1071
# Emit D-Bus signal
1072
self.PropertyChanged(dbus.String(u"Checker"),
1073
dbus.String(self.checker_command,
1074
variant_level=1))
1177
1075
1178
1076
# CheckerRunning - property
1179
@dbus_service_property(_interface, signature="b",
1180
access="readwrite")
1077
@dbus_service_property(_interface, signature=u"b",
1078
access=u"readwrite")
1181
1079
def CheckerRunning_dbus_property(self, value=None):
1182
1080
if value is None: # get
1183
1081
return dbus.Boolean(self.checker is not None)
1187
1085
self.stop_checker()
1188
1086
1189
1087
# ObjectPath - property
1190
@dbus_service_property(_interface, signature="o", access="read")
1088
@dbus_service_property(_interface, signature=u"o", access=u"read")
1191
1089
def ObjectPath_dbus_property(self):
1192
1090
return self.dbus_object_path # is already a dbus.ObjectPath
1193
1091
1194
1092
# Secret = property
1195
@dbus_service_property(_interface, signature="ay",
1196
access="write", byte_arrays=True)
1093
@dbus_service_property(_interface, signature=u"ay",
1094
access=u"write", byte_arrays=True)
1197
1095
def Secret_dbus_property(self, value):
1198
1096
self.secret = str(value)
1199
1097
1206
1104
self._pipe.send(('init', fpr, address))
1207
1105
if not self._pipe.recv():
1208
1106
raise KeyError()
1209
1107
1210
1108
def __getattribute__(self, name):
1211
1109
if(name == '_pipe'):
1212
1110
return super(ProxyClient, self).__getattribute__(name)
1219
1117
self._pipe.send(('funcall', name, args, kwargs))
1220
1118
return self._pipe.recv()[1]
1221
1119
return func
1222
1120
1223
1121
def __setattr__(self, name, value):
1224
1122
if(name == '_pipe'):
1225
1123
return super(ProxyClient, self).__setattr__(name, value)
1226
1124
self._pipe.send(('setattr', name, value))
1227
1125
1228
class ClientDBusTransitional(ClientDBus):
1229
__metaclass__ = transitional_dbus_metaclass
1230
1126
1231
1127
class ClientHandler(socketserver.BaseRequestHandler, object):
1232
1128
"""A class to handle client connections.
1236
1132
1237
1133
def handle(self):
1238
1134
with contextlib.closing(self.server.child_pipe) as child_pipe:
1239
logger.info("TCP connection from: %s",
1135
logger.info(u"TCP connection from: %s",
1240
1136
unicode(self.client_address))
1241
logger.debug("Pipe FD: %d",
1137
logger.debug(u"Pipe FD: %d",
1242
1138
self.server.child_pipe.fileno())
1243
1139
1244
1140
session = (gnutls.connection
1245
1141
.ClientSession(self.request,
1246
1142
gnutls.connection
1247
1143
.X509Credentials()))
1248
1144
1249
1145
# Note: gnutls.connection.X509Credentials is really a
1250
1146
# generic GnuTLS certificate credentials object so long as
1251
1147
# no X.509 keys are added to it. Therefore, we can use it
1252
1148
# here despite using OpenPGP certificates.
1253
1254
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1255
# "+AES-256-CBC", "+SHA1",
1256
# "+COMP-NULL", "+CTYPE-OPENPGP",
1257
# "+DHE-DSS"))
1149
1150
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1151
# u"+AES-256-CBC", u"+SHA1",
1152
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1153
# u"+DHE-DSS"))
1258
1154
# Use a fallback default, since this MUST be set.
1259
1155
priority = self.server.gnutls_priority
1260
1156
if priority is None:
1261
priority = "NORMAL"
1157
priority = u"NORMAL"
1262
1158
(gnutls.library.functions
1263
1159
.gnutls_priority_set_direct(session._c_object,
1264
1160
priority, None))
1265
1161
1266
1162
# Start communication using the Mandos protocol
1267
1163
# Get protocol number
1268
1164
line = self.request.makefile().readline()
1269
logger.debug("Protocol version: %r", line)
1165
logger.debug(u"Protocol version: %r", line)
1270
1166
try:
1271
1167
if int(line.strip().split()[0]) > 1:
1272
1168
raise RuntimeError
1273
except (ValueError, IndexError, RuntimeError) as error:
1274
logger.error("Unknown protocol version: %s", error)
1169
except (ValueError, IndexError, RuntimeError), error:
1170
logger.error(u"Unknown protocol version: %s", error)
1275
1171
return
1276
1172
1277
1173
# Start GnuTLS connection
1278
1174
try:
1279
1175
session.handshake()
1280
except gnutls.errors.GNUTLSError as error:
1281
logger.warning("Handshake failed: %s", error)
1176
except gnutls.errors.GNUTLSError, error:
1177
logger.warning(u"Handshake failed: %s", error)
1282
1178
# Do not run session.bye() here: the session is not
1283
1179
# established. Just abandon the request.
1284
1180
return
1285
logger.debug("Handshake succeeded")
1286
1181
logger.debug(u"Handshake succeeded")
1182
1287
1183
approval_required = False
1288
1184
try:
1289
1185
try:
1290
1186
fpr = self.fingerprint(self.peer_certificate
1291
1187
(session))
1292
except (TypeError,
1293
gnutls.errors.GNUTLSError) as error:
1294
logger.warning("Bad certificate: %s", error)
1188
except (TypeError, gnutls.errors.GNUTLSError), error:
1189
logger.warning(u"Bad certificate: %s", error)
1295
1190
return
1296
logger.debug("Fingerprint: %s", fpr)
1297
1191
logger.debug(u"Fingerprint: %s", fpr)
1192
1298
1193
try:
1299
1194
client = ProxyClient(child_pipe, fpr,
1300
1195
self.client_address)
1308
1203
1309
1204
while True:
1310
1205
if not client.enabled:
1311
logger.info("Client %s is disabled",
1206
logger.warning(u"Client %s is disabled",
1312
1207
client.name)
1313
1208
if self.server.use_dbus:
1314
1209
# Emit D-Bus signal
1319
1214
#We are approved or approval is disabled
1320
1215
break
1321
1216
elif client._approved is None:
1322
logger.info("Client %s needs approval",
1217
logger.info(u"Client %s needs approval",
1323
1218
client.name)
1324
1219
if self.server.use_dbus:
1325
1220
# Emit D-Bus signal
1327
1222
client.approval_delay_milliseconds(),
1328
1223
client.approved_by_default)
1329
1224
else:
1330
logger.warning("Client %s was not approved",
1225
logger.warning(u"Client %s was not approved",
1331
1226
client.name)
1332
1227
if self.server.use_dbus:
1333
1228
# Emit D-Bus signal
1348
1243
client.name)
1349
1244
if self.server.use_dbus:
1350
1245
# Emit D-Bus signal
1351
client.Rejected("Approval timed out")
1246
client.Rejected("Timed out")
1352
1247
return
1353
1248
else:
1354
1249
break
1359
1254
while sent_size < len(client.secret):
1360
1255
try:
1361
1256
sent = session.send(client.secret[sent_size:])
1362
except gnutls.errors.GNUTLSError as error:
1257
except (gnutls.errors.GNUTLSError), error:
1363
1258
logger.warning("gnutls send failed")
1364
1259
return
1365
logger.debug("Sent: %d, remaining: %d",
1260
logger.debug(u"Sent: %d, remaining: %d",
1366
1261
sent, len(client.secret)
1367
1262
- (sent_size + sent))
1368
1263
sent_size += sent
1369
1370
logger.info("Sending secret to %s", client.name)
1264
1265
logger.info(u"Sending secret to %s", client.name)
1371
1266
# bump the timeout as if seen
1372
client.checked_ok(client.extended_timeout)
1267
client.checked_ok()
1373
1268
if self.server.use_dbus:
1374
1269
# Emit D-Bus signal
1375
1270
client.GotSecret()
1379
1274
client.approvals_pending -= 1
1380
1275
try:
1381
1276
session.bye()
1382
except gnutls.errors.GNUTLSError as error:
1277
except (gnutls.errors.GNUTLSError), error:
1383
1278
logger.warning("GnuTLS bye failed")
1384
1279
1385
1280
@staticmethod
1396
1291
.gnutls_certificate_get_peers
1397
1292
(session._c_object, ctypes.byref(list_size)))
1398
1293
if not bool(cert_list) and list_size.value != 0:
1399
raise gnutls.errors.GNUTLSError("error getting peer"
1400
" certificate")
1294
raise gnutls.errors.GNUTLSError(u"error getting peer"
1295
u" certificate")
1401
1296
if list_size.value == 0:
1402
1297
return None
1403
1298
cert = cert_list[0]
1429
1324
if crtverify.value != 0:
1430
1325
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1431
1326
raise (gnutls.errors.CertificateSecurityError
1432
("Verify failed"))
1327
(u"Verify failed"))
1433
1328
# New buffer for the fingerprint
1434
1329
buf = ctypes.create_string_buffer(20)
1435
1330
buf_len = ctypes.c_size_t()
1442
1337
# Convert the buffer to a Python bytestring
1443
1338
fpr = ctypes.string_at(buf, buf_len.value)
1444
1339
# Convert the bytestring to hexadecimal notation
1445
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1340
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1446
1341
return hex_fpr
1447
1342
1448
1343
1460
1355
multiprocessing.Process(target = self.sub_process_main,
1461
1356
args = (request, address)).start()
1462
1357
1463
1464
1358
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1465
1359
""" adds a pipe to the MixIn """
1466
1360
def process_request(self, request, client_address):
1469
1363
This function creates a new pipe in self.pipe
1470
1364
"""
1471
1365
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1472
1366
1473
1367
super(MultiprocessingMixInWithPipe,
1474
1368
self).process_request(request, client_address)
1475
1369
self.child_pipe.close()
1476
1370
self.add_pipe(parent_pipe)
1477
1371
1478
1372
def add_pipe(self, parent_pipe):
1479
1373
"""Dummy function; override as necessary"""
1480
raise NotImplementedError
1481
1374
pass
1482
1375
1483
1376
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1484
1377
socketserver.TCPServer, object):
1502
1395
bind to an address or port if they were not specified."""
1503
1396
if self.interface is not None:
1504
1397
if SO_BINDTODEVICE is None:
1505
logger.error("SO_BINDTODEVICE does not exist;"
1506
" cannot bind to interface %s",
1398
logger.error(u"SO_BINDTODEVICE does not exist;"
1399
u" cannot bind to interface %s",
1507
1400
self.interface)
1508
1401
else:
1509
1402
try:
1510
1403
self.socket.setsockopt(socket.SOL_SOCKET,
1511
1404
SO_BINDTODEVICE,
1512
1405
str(self.interface
1513
+ '\0'))
1514
except socket.error as error:
1406
+ u'\0'))
1407
except socket.error, error:
1515
1408
if error[0] == errno.EPERM:
1516
logger.error("No permission to"
1517
" bind to interface %s",
1409
logger.error(u"No permission to"
1410
u" bind to interface %s",
1518
1411
self.interface)
1519
1412
elif error[0] == errno.ENOPROTOOPT:
1520
logger.error("SO_BINDTODEVICE not available;"
1521
" cannot bind to interface %s",
1413
logger.error(u"SO_BINDTODEVICE not available;"
1414
u" cannot bind to interface %s",
1522
1415
self.interface)
1523
1416
else:
1524
1417
raise
1526
1419
if self.server_address[0] or self.server_address[1]:
1527
1420
if not self.server_address[0]:
1528
1421
if self.address_family == socket.AF_INET6:
1529
any_address = "::" # in6addr_any
1422
any_address = u"::" # in6addr_any
1530
1423
else:
1531
1424
any_address = socket.INADDR_ANY
1532
1425
self.server_address = (any_address,
1581
1474
def handle_ipc(self, source, condition, parent_pipe=None,
1582
1475
client_object=None):
1583
1476
condition_names = {
1584
gobject.IO_IN: "IN", # There is data to read.
1585
gobject.IO_OUT: "OUT", # Data can be written (without
1477
gobject.IO_IN: u"IN", # There is data to read.
1478
gobject.IO_OUT: u"OUT", # Data can be written (without
1586
1479
# blocking).
1587
gobject.IO_PRI: "PRI", # There is urgent data to read.
1588
gobject.IO_ERR: "ERR", # Error condition.
1589
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1480
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1481
gobject.IO_ERR: u"ERR", # Error condition.
1482
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1590
1483
# broken, usually for pipes and
1591
1484
# sockets).
1592
1485
}
1594
1487
for cond, name in
1595
1488
condition_names.iteritems()
1596
1489
if cond & condition)
1490
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1491
conditions_string)
1492
1597
1493
# error or the other end of multiprocessing.Pipe has closed
1598
1494
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1599
1495
return False
1600
1496
1601
1497
# Read a request from the child
1602
1498
request = parent_pipe.recv()
1499
logger.debug(u"IPC request: %s", repr(request))
1603
1500
command = request[0]
1604
1501
1605
1502
if command == 'init':
1611
1508
client = c
1612
1509
break
1613
1510
else:
1614
logger.info("Client not found for fingerprint: %s, ad"
1615
"dress: %s", fpr, address)
1511
logger.warning(u"Client not found for fingerprint: %s, ad"
1512
u"dress: %s", fpr, address)
1616
1513
if self.use_dbus:
1617
1514
# Emit D-Bus signal
1618
mandos_dbus_service.ClientNotFound(fpr, address[0])
1515
mandos_dbus_service.ClientNotFound(fpr, address)
1619
1516
parent_pipe.send(False)
1620
1517
return False
1621
1518
1633
1530
kwargs = request[3]
1634
1531
1635
1532
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1636
1533
1637
1534
if command == 'getattr':
1638
1535
attrname = request[1]
1639
1536
if callable(client_object.__getattribute__(attrname)):
1645
1542
attrname = request[1]
1646
1543
value = request[2]
1647
1544
setattr(client_object, attrname, value)
1648
1545
1649
1546
return True
1650
1547
1651
1548
1652
1549
def string_to_delta(interval):
1653
1550
"""Parse a string and return a datetime.timedelta
1654
1551
1655
>>> string_to_delta('7d')
1552
>>> string_to_delta(u'7d')
1656
1553
datetime.timedelta(7)
1657
>>> string_to_delta('60s')
1554
>>> string_to_delta(u'60s')
1658
1555
datetime.timedelta(0, 60)
1659
>>> string_to_delta('60m')
1556
>>> string_to_delta(u'60m')
1660
1557
datetime.timedelta(0, 3600)
1661
>>> string_to_delta('24h')
1558
>>> string_to_delta(u'24h')
1662
1559
datetime.timedelta(1)
1663
>>> string_to_delta('1w')
1560
>>> string_to_delta(u'1w')
1664
1561
datetime.timedelta(7)
1665
>>> string_to_delta('5m 30s')
1562
>>> string_to_delta(u'5m 30s')
1666
1563
datetime.timedelta(0, 330)
1667
1564
"""
1668
1565
timevalue = datetime.timedelta(0)
1670
1567
try:
1671
1568
suffix = unicode(s[-1])
1672
1569
value = int(s[:-1])
1673
if suffix == "d":
1570
if suffix == u"d":
1674
1571
delta = datetime.timedelta(value)
1675
elif suffix == "s":
1572
elif suffix == u"s":
1676
1573
delta = datetime.timedelta(0, value)
1677
elif suffix == "m":
1574
elif suffix == u"m":
1678
1575
delta = datetime.timedelta(0, 0, 0, 0, value)
1679
elif suffix == "h":
1576
elif suffix == u"h":
1680
1577
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1681
elif suffix == "w":
1578
elif suffix == u"w":
1682
1579
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1683
1580
else:
1684
raise ValueError("Unknown suffix %r" % suffix)
1685
except (ValueError, IndexError) as e:
1686
raise ValueError(*(e.args))
1581
raise ValueError(u"Unknown suffix %r" % suffix)
1582
except (ValueError, IndexError), e:
1583
raise ValueError(e.message)
1687
1584
timevalue += delta
1688
1585
return timevalue
1689
1586
1695
1592
global if_nametoindex
1696
1593
try:
1697
1594
if_nametoindex = (ctypes.cdll.LoadLibrary
1698
(ctypes.util.find_library("c"))
1595
(ctypes.util.find_library(u"c"))
1699
1596
.if_nametoindex)
1700
1597
except (OSError, AttributeError):
1701
logger.warning("Doing if_nametoindex the hard way")
1598
logger.warning(u"Doing if_nametoindex the hard way")
1702
1599
def if_nametoindex(interface):
1703
1600
"Get an interface index the hard way, i.e. using fcntl()"
1704
1601
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1705
1602
with contextlib.closing(socket.socket()) as s:
1706
1603
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1707
struct.pack(str("16s16x"),
1604
struct.pack(str(u"16s16x"),
1708
1605
interface))
1709
interface_index = struct.unpack(str("I"),
1606
interface_index = struct.unpack(str(u"I"),
1710
1607
ifreq[16:20])[0]
1711
1608
return interface_index
1712
1609
return if_nametoindex(interface)
1720
1617
sys.exit()
1721
1618
os.setsid()
1722
1619
if not nochdir:
1723
os.chdir("/")
1620
os.chdir(u"/")
1724
1621
if os.fork():
1725
1622
sys.exit()
1726
1623
if not noclose:
1728
1625
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1729
1626
if not stat.S_ISCHR(os.fstat(null).st_mode):
1730
1627
raise OSError(errno.ENODEV,
1731
"%s not a character device"
1628
u"%s not a character device"
1732
1629
% os.path.devnull)
1733
1630
os.dup2(null, sys.stdin.fileno())
1734
1631
os.dup2(null, sys.stdout.fileno())
1742
1639
##################################################################
1743
1640
# Parsing of options, both command line and config file
1744
1641
1745
parser = argparse.ArgumentParser()
1746
parser.add_argument("-v", "--version", action="version",
1747
version = "%%(prog)s %s" % version,
1748
help="show version number and exit")
1749
parser.add_argument("-i", "--interface", metavar="IF",
1750
help="Bind to interface IF")
1751
parser.add_argument("-a", "--address",
1752
help="Address to listen for requests on")
1753
parser.add_argument("-p", "--port", type=int,
1754
help="Port number to receive requests on")
1755
parser.add_argument("--check", action="store_true",
1756
help="Run self-test")
1757
parser.add_argument("--debug", action="store_true",
1758
help="Debug mode; run in foreground and log"
1759
" to terminal")
1760
parser.add_argument("--debuglevel", metavar="LEVEL",
1761
help="Debug level for stdout output")
1762
parser.add_argument("--priority", help="GnuTLS"
1763
" priority string (see GnuTLS documentation)")
1764
parser.add_argument("--servicename",
1765
metavar="NAME", help="Zeroconf service name")
1766
parser.add_argument("--configdir",
1767
default="/etc/mandos", metavar="DIR",
1768
help="Directory to search for configuration"
1769
" files")
1770
parser.add_argument("--no-dbus", action="store_false",
1771
dest="use_dbus", help="Do not provide D-Bus"
1772
" system bus interface")
1773
parser.add_argument("--no-ipv6", action="store_false",
1774
dest="use_ipv6", help="Do not use IPv6")
1775
options = parser.parse_args()
1642
parser = optparse.OptionParser(version = "%%prog %s" % version)
1643
parser.add_option("-i", u"--interface", type=u"string",
1644
metavar="IF", help=u"Bind to interface IF")
1645
parser.add_option("-a", u"--address", type=u"string",
1646
help=u"Address to listen for requests on")
1647
parser.add_option("-p", u"--port", type=u"int",
1648
help=u"Port number to receive requests on")
1649
parser.add_option("--check", action=u"store_true",
1650
help=u"Run self-test")
1651
parser.add_option("--debug", action=u"store_true",
1652
help=u"Debug mode; run in foreground and log to"
1653
u" terminal")
1654
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1655
help=u"Debug level for stdout output")
1656
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1657
u" priority string (see GnuTLS documentation)")
1658
parser.add_option("--servicename", type=u"string",
1659
metavar=u"NAME", help=u"Zeroconf service name")
1660
parser.add_option("--configdir", type=u"string",
1661
default=u"/etc/mandos", metavar=u"DIR",
1662
help=u"Directory to search for configuration"
1663
u" files")
1664
parser.add_option("--no-dbus", action=u"store_false",
1665
dest=u"use_dbus", help=u"Do not provide D-Bus"
1666
u" system bus interface")
1667
parser.add_option("--no-ipv6", action=u"store_false",
1668
dest=u"use_ipv6", help=u"Do not use IPv6")
1669
options = parser.parse_args()[0]
1776
1670
1777
1671
if options.check:
1778
1672
import doctest
1780
1674
sys.exit()
1781
1675
1782
1676
# Default values for config file for server-global settings
1783
server_defaults = { "interface": "",
1784
"address": "",
1785
"port": "",
1786
"debug": "False",
1787
"priority":
1788
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1789
"servicename": "Mandos",
1790
"use_dbus": "True",
1791
"use_ipv6": "True",
1792
"debuglevel": "",
1677
server_defaults = { u"interface": u"",
1678
u"address": u"",
1679
u"port": u"",
1680
u"debug": u"False",
1681
u"priority":
1682
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1683
u"servicename": u"Mandos",
1684
u"use_dbus": u"True",
1685
u"use_ipv6": u"True",
1686
u"debuglevel": u"",
1793
1687
}
1794
1688
1795
1689
# Parse config file for server-global settings
1796
1690
server_config = configparser.SafeConfigParser(server_defaults)
1797
1691
del server_defaults
1798
1692
server_config.read(os.path.join(options.configdir,
1799
"mandos.conf"))
1693
u"mandos.conf"))
1800
1694
# Convert the SafeConfigParser object to a dict
1801
1695
server_settings = server_config.defaults()
1802
1696
# Use the appropriate methods on the non-string config options
1803
for option in ("debug", "use_dbus", "use_ipv6"):
1804
server_settings[option] = server_config.getboolean("DEFAULT",
1697
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1698
server_settings[option] = server_config.getboolean(u"DEFAULT",
1805
1699
option)
1806
1700
if server_settings["port"]:
1807
server_settings["port"] = server_config.getint("DEFAULT",
1808
"port")
1701
server_settings["port"] = server_config.getint(u"DEFAULT",
1702
u"port")
1809
1703
del server_config
1810
1704
1811
1705
# Override the settings from the config file with command line
1812
1706
# options, if set.
1813
for option in ("interface", "address", "port", "debug",
1814
"priority", "servicename", "configdir",
1815
"use_dbus", "use_ipv6", "debuglevel"):
1707
for option in (u"interface", u"address", u"port", u"debug",
1708
u"priority", u"servicename", u"configdir",
1709
u"use_dbus", u"use_ipv6", u"debuglevel"):
1816
1710
value = getattr(options, option)
1817
1711
if value is not None:
1818
1712
server_settings[option] = value
1826
1720
##################################################################
1827
1721
1828
1722
# For convenience
1829
debug = server_settings["debug"]
1830
debuglevel = server_settings["debuglevel"]
1831
use_dbus = server_settings["use_dbus"]
1832
use_ipv6 = server_settings["use_ipv6"]
1833
1834
if server_settings["servicename"] != "Mandos":
1723
debug = server_settings[u"debug"]
1724
debuglevel = server_settings[u"debuglevel"]
1725
use_dbus = server_settings[u"use_dbus"]
1726
use_ipv6 = server_settings[u"use_ipv6"]
1727
1728
if server_settings[u"servicename"] != u"Mandos":
1835
1729
syslogger.setFormatter(logging.Formatter
1836
('Mandos (%s) [%%(process)d]:'
1837
' %%(levelname)s: %%(message)s'
1838
% server_settings["servicename"]))
1730
(u'Mandos (%s) [%%(process)d]:'
1731
u' %%(levelname)s: %%(message)s'
1732
% server_settings[u"servicename"]))
1839
1733
1840
1734
# Parse config file with clients
1841
client_defaults = { "timeout": "5m",
1842
"extended_timeout": "15m",
1843
"interval": "2m",
1844
"checker": "fping -q -- %%(host)s",
1845
"host": "",
1846
"approval_delay": "0s",
1847
"approval_duration": "1s",
1735
client_defaults = { u"timeout": u"1h",
1736
u"interval": u"5m",
1737
u"checker": u"fping -q -- %%(host)s",
1738
u"host": u"",
1739
u"approval_delay": u"0s",
1740
u"approval_duration": u"1s",
1848
1741
}
1849
1742
client_config = configparser.SafeConfigParser(client_defaults)
1850
client_config.read(os.path.join(server_settings["configdir"],
1851
"clients.conf"))
1743
client_config.read(os.path.join(server_settings[u"configdir"],
1744
u"clients.conf"))
1852
1745
1853
1746
global mandos_dbus_service
1854
1747
mandos_dbus_service = None
1855
1748
1856
tcp_server = MandosServer((server_settings["address"],
1857
server_settings["port"]),
1749
tcp_server = MandosServer((server_settings[u"address"],
1750
server_settings[u"port"]),
1858
1751
ClientHandler,
1859
interface=(server_settings["interface"]
1752
interface=(server_settings[u"interface"]
1860
1753
or None),
1861
1754
use_ipv6=use_ipv6,
1862
1755
gnutls_priority=
1863
server_settings["priority"],
1756
server_settings[u"priority"],
1864
1757
use_dbus=use_dbus)
1865
if not debug:
1866
pidfilename = "/var/run/mandos.pid"
1867
try:
1868
pidfile = open(pidfilename, "w")
1869
except IOError:
1870
logger.error("Could not open file %r", pidfilename)
1758
pidfilename = u"/var/run/mandos.pid"
1759
try:
1760
pidfile = open(pidfilename, u"w")
1761
except IOError:
1762
logger.error(u"Could not open file %r", pidfilename)
1871
1763
1872
1764
try:
1873
uid = pwd.getpwnam("_mandos").pw_uid
1874
gid = pwd.getpwnam("_mandos").pw_gid
1765
uid = pwd.getpwnam(u"_mandos").pw_uid
1766
gid = pwd.getpwnam(u"_mandos").pw_gid
1875
1767
except KeyError:
1876
1768
try:
1877
uid = pwd.getpwnam("mandos").pw_uid
1878
gid = pwd.getpwnam("mandos").pw_gid
1769
uid = pwd.getpwnam(u"mandos").pw_uid
1770
gid = pwd.getpwnam(u"mandos").pw_gid
1879
1771
except KeyError:
1880
1772
try:
1881
uid = pwd.getpwnam("nobody").pw_uid
1882
gid = pwd.getpwnam("nobody").pw_gid
1773
uid = pwd.getpwnam(u"nobody").pw_uid
1774
gid = pwd.getpwnam(u"nobody").pw_gid
1883
1775
except KeyError:
1884
1776
uid = 65534
1885
1777
gid = 65534
1886
1778
try:
1887
1779
os.setgid(gid)
1888
1780
os.setuid(uid)
1889
except OSError as error:
1781
except OSError, error:
1890
1782
if error[0] != errno.EPERM:
1891
1783
raise error
1892
1784
1897
1789
level = getattr(logging, debuglevel.upper())
1898
1790
syslogger.setLevel(level)
1899
1791
console.setLevel(level)
1900
1792
1901
1793
if debug:
1902
1794
# Enable all possible GnuTLS debugging
1903
1795
1907
1799
1908
1800
@gnutls.library.types.gnutls_log_func
1909
1801
def debug_gnutls(level, string):
1910
logger.debug("GnuTLS: %s", string[:-1])
1802
logger.debug(u"GnuTLS: %s", string[:-1])
1911
1803
1912
1804
(gnutls.library.functions
1913
1805
.gnutls_global_set_log_function(debug_gnutls))
1921
1813
# No console logging
1922
1814
logger.removeHandler(console)
1923
1815
1924
# Need to fork before connecting to D-Bus
1925
if not debug:
1926
# Close all input and output, do double fork, etc.
1927
daemon()
1928
1816
1929
1817
global main_loop
1930
1818
# From the Avahi example code
1934
1822
# End of Avahi example code
1935
1823
if use_dbus:
1936
1824
try:
1937
bus_name = dbus.service.BusName("se.recompile.Mandos",
1825
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1938
1826
bus, do_not_queue=True)
1939
bus_name_transitional = dbus.service.BusName("se.bsnet.fukt.Mandos",
1940
bus, do_not_queue=True)
1941
except dbus.exceptions.NameExistsException as e:
1942
logger.error(unicode(e) + ", disabling D-Bus")
1827
except dbus.exceptions.NameExistsException, e:
1828
logger.error(unicode(e) + u", disabling D-Bus")
1943
1829
use_dbus = False
1944
server_settings["use_dbus"] = False
1830
server_settings[u"use_dbus"] = False
1945
1831
tcp_server.use_dbus = False
1946
1832
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1947
service = AvahiService(name = server_settings["servicename"],
1948
servicetype = "_mandos._tcp",
1833
service = AvahiService(name = server_settings[u"servicename"],
1834
servicetype = u"_mandos._tcp",
1949
1835
protocol = protocol, bus = bus)
1950
1836
if server_settings["interface"]:
1951
1837
service.interface = (if_nametoindex
1952
(str(server_settings["interface"])))
1953
1838
(str(server_settings[u"interface"])))
1839
1840
if not debug:
1841
# Close all input and output, do double fork, etc.
1842
daemon()
1843
1954
1844
global multiprocessing_manager
1955
1845
multiprocessing_manager = multiprocessing.Manager()
1956
1846
1957
1847
client_class = Client
1958
1848
if use_dbus:
1959
client_class = functools.partial(ClientDBusTransitional, bus = bus)
1849
client_class = functools.partial(ClientDBus, bus = bus)
1960
1850
def client_config_items(config, section):
1961
1851
special_settings = {
1962
1852
"approved_by_default":
1975
1865
client_config, section)))
1976
1866
for section in client_config.sections()))
1977
1867
if not tcp_server.clients:
1978
logger.warning("No clients defined")
1868
logger.warning(u"No clients defined")
1979
1869
1870
try:
1871
with pidfile:
1872
pid = os.getpid()
1873
pidfile.write(str(pid) + "\n")
1874
del pidfile
1875
except IOError:
1876
logger.error(u"Could not write to file %r with PID %d",
1877
pidfilename, pid)
1878
except NameError:
1879
# "pidfile" was never created
1880
pass
1881
del pidfilename
1882
1980
1883
if not debug:
1981
try:
1982
with pidfile:
1983
pid = os.getpid()
1984
pidfile.write(str(pid) + "\n".encode("utf-8"))
1985
del pidfile
1986
except IOError:
1987
logger.error("Could not write to file %r with PID %d",
1988
pidfilename, pid)
1989
except NameError:
1990
# "pidfile" was never created
1991
pass
1992
del pidfilename
1993
1994
1884
signal.signal(signal.SIGINT, signal.SIG_IGN)
1995
1996
1885
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1997
1886
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1998
1887
2000
1889
class MandosDBusService(dbus.service.Object):
2001
1890
"""A D-Bus proxy object"""
2002
1891
def __init__(self):
2003
dbus.service.Object.__init__(self, bus, "/")
2004
_interface = "se.bsnet.fukt.Mandos"
1892
dbus.service.Object.__init__(self, bus, u"/")
1893
_interface = u"se.bsnet.fukt.Mandos"
2005
1894
2006
@dbus.service.signal(_interface, signature="o")
1895
@dbus.service.signal(_interface, signature=u"o")
2007
1896
def ClientAdded(self, objpath):
2008
1897
"D-Bus signal"
2009
1898
pass
2010
1899
2011
@dbus.service.signal(_interface, signature="ss")
1900
@dbus.service.signal(_interface, signature=u"ss")
2012
1901
def ClientNotFound(self, fingerprint, address):
2013
1902
"D-Bus signal"
2014
1903
pass
2015
1904
2016
@dbus.service.signal(_interface, signature="os")
1905
@dbus.service.signal(_interface, signature=u"os")
2017
1906
def ClientRemoved(self, objpath, name):
2018
1907
"D-Bus signal"
2019
1908
pass
2020
1909
2021
@dbus.service.method(_interface, out_signature="ao")
1910
@dbus.service.method(_interface, out_signature=u"ao")
2022
1911
def GetAllClients(self):
2023
1912
"D-Bus method"
2024
1913
return dbus.Array(c.dbus_object_path
2025
1914
for c in tcp_server.clients)
2026
1915
2027
1916
@dbus.service.method(_interface,
2028
out_signature="a{oa{sv}}")
1917
out_signature=u"a{oa{sv}}")
2029
1918
def GetAllClientsWithProperties(self):
2030
1919
"D-Bus method"
2031
1920
return dbus.Dictionary(
2032
((c.dbus_object_path, c.GetAll(""))
1921
((c.dbus_object_path, c.GetAll(u""))
2033
1922
for c in tcp_server.clients),
2034
signature="oa{sv}")
1923
signature=u"oa{sv}")
2035
1924
2036
@dbus.service.method(_interface, in_signature="o")
1925
@dbus.service.method(_interface, in_signature=u"o")
2037
1926
def RemoveClient(self, object_path):
2038
1927
"D-Bus method"
2039
1928
for c in tcp_server.clients:
2049
1938
2050
1939
del _interface
2051
1940
2052
class MandosDBusServiceTransitional(MandosDBusService):
2053
__metaclass__ = transitional_dbus_metaclass
2054
mandos_dbus_service = MandosDBusServiceTransitional()
1941
mandos_dbus_service = MandosDBusService()
2055
1942
2056
1943
def cleanup():
2057
1944
"Cleanup function; run on exit"
2083
1970
# Find out what port we got
2084
1971
service.port = tcp_server.socket.getsockname()[1]
2085
1972
if use_ipv6:
2086
logger.info("Now listening on address %r, port %d,"
1973
logger.info(u"Now listening on address %r, port %d,"
2087
1974
" flowinfo %d, scope_id %d"
2088
1975
% tcp_server.socket.getsockname())
2089
1976
else: # IPv4
2090
logger.info("Now listening on address %r, port %d"
1977
logger.info(u"Now listening on address %r, port %d"
2091
1978
% tcp_server.socket.getsockname())
2092
1979
2093
1980
#service.interface = tcp_server.socket.getsockname()[3]
2096
1983
# From the Avahi example code
2097
1984
try:
2098
1985
service.activate()
2099
except dbus.exceptions.DBusException as error:
2100
logger.critical("DBusException: %s", error)
1986
except dbus.exceptions.DBusException, error:
1987
logger.critical(u"DBusException: %s", error)
2101
1988
cleanup()
2102
1989
sys.exit(1)
2103
1990
# End of Avahi example code
2107
1994
(tcp_server.handle_request
2108
1995
(*args[2:], **kwargs) or True))
2109
1996
2110
logger.debug("Starting main loop")
1997
logger.debug(u"Starting main loop")
2111
1998
main_loop.run()
2112
except AvahiError as error:
2113
logger.critical("AvahiError: %s", error)
1999
except AvahiError, error:
2000
logger.critical(u"AvahiError: %s", error)
2114
2001
cleanup()
2115
2002
sys.exit(1)
2116
2003
except KeyboardInterrupt:
2117
2004
if debug:
2118
print("", file=sys.stderr)
2119
logger.debug("Server received KeyboardInterrupt")
2120
logger.debug("Server exiting")
2005
print >> sys.stderr
2006
logger.debug(u"Server received KeyboardInterrupt")
2007
logger.debug(u"Server exiting")
2121
2008
# Must run before the D-Bus bus name gets deregistered
2122
2009
cleanup()
2123
2010
2124
2125
2011
if __name__ == '__main__':
2126
2012
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0