To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 435
- compare with another revision
- download diff
- download tarball
- view history from revision 435
- Committer: teddy at bsnet
- Date: 2010-09-23 20:14:08 UTC
- Revision ID: teddy@fukt.bsnet.se-20100923201408-4vcvjmml000fr8y5
* Makefile (DOCS): Added "plymouth.8mandos".
(install-server): Also install "mandos-monitor.8" and
"mandos-ctl.8".
(install-client-nokey): Also install "plymouth.8mandos".
(uninstall-server): Also remove "mandos-monitor.8" and
"mandos-ctl.8".
(uninstall-client): Also remove "plymouth.8mandos".
* plugins.d/plymouth.xml: New.
(install-server): Also install "mandos-monitor.8" and
"mandos-ctl.8".
(install-client-nokey): Also install "plymouth.8mandos".
(uninstall-server): Also remove "mandos-monitor.8" and
"mandos-ctl.8".
(uninstall-client): Also remove "plymouth.8mandos".
* plugins.d/plymouth.xml: New.
- files removed:
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@recompile.se>.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
36
import SocketServer as socketserver
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
62
61
import functools
63
62
import cPickle as pickle
64
63
import multiprocessing
65
import types
66
64
67
65
import dbus
68
66
import dbus.service
83
81
SO_BINDTODEVICE = None
84
82
85
83
86
version = "1.3.1"
84
version = "1.0.14"
87
85
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
90
88
syslogger = (logging.handlers.SysLogHandler
91
89
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
address = str("/dev/log")))
90
address = "/dev/log"))
93
91
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
96
94
logger.addHandler(syslogger)
97
95
98
96
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
102
100
logger.addHandler(console)
103
101
104
102
class AvahiError(Exception):
121
119
Attributes:
122
120
interface: integer; avahi.IF_UNSPEC or an interface index.
123
121
Used to optionally bind to the specified interface.
124
name: string; Example: 'Mandos'
125
type: string; Example: '_mandos._tcp'.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
126
124
See <http://www.dns-sd.org/ServiceTypes.html>
127
125
port: integer; what port to announce
128
126
TXT: list of strings; TXT record for the service
137
135
"""
138
136
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
139
137
servicetype = None, port = None, TXT = None,
140
domain = "", host = "", max_renames = 32768,
138
domain = u"", host = u"", max_renames = 32768,
141
139
protocol = avahi.PROTO_UNSPEC, bus = None):
142
140
self.interface = interface
143
141
self.name = name
152
150
self.group = None # our entry group
153
151
self.server = None
154
152
self.bus = bus
155
self.entry_group_state_changed_match = None
156
153
def rename(self):
157
154
"""Derived from the Avahi example code"""
158
155
if self.rename_count >= self.max_renames:
159
logger.critical("No suitable Zeroconf service name found"
160
" after %i retries, exiting.",
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
161
158
self.rename_count)
162
raise AvahiServiceError("Too many renames")
159
raise AvahiServiceError(u"Too many renames")
163
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
164
logger.info("Changing Zeroconf service name to %r ...",
161
logger.info(u"Changing Zeroconf service name to %r ...",
165
162
self.name)
166
163
syslogger.setFormatter(logging.Formatter
167
('Mandos (%s) [%%(process)d]:'
168
' %%(levelname)s: %%(message)s'
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
169
166
% self.name))
170
167
self.remove()
171
168
try:
172
169
self.add()
173
except dbus.exceptions.DBusException as error:
174
logger.critical("DBusException: %s", error)
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
175
172
self.cleanup()
176
173
os._exit(1)
177
174
self.rename_count += 1
178
175
def remove(self):
179
176
"""Derived from the Avahi example code"""
180
if self.entry_group_state_changed_match is not None:
181
self.entry_group_state_changed_match.remove()
182
self.entry_group_state_changed_match = None
183
177
if self.group is not None:
184
178
self.group.Reset()
185
179
def add(self):
186
180
"""Derived from the Avahi example code"""
187
self.remove()
188
181
if self.group is None:
189
182
self.group = dbus.Interface(
190
183
self.bus.get_object(avahi.DBUS_NAME,
191
184
self.server.EntryGroupNew()),
192
185
avahi.DBUS_INTERFACE_ENTRY_GROUP)
193
self.entry_group_state_changed_match = (
194
self.group.connect_to_signal(
195
'StateChanged', self .entry_group_state_changed))
196
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
186
self.group.connect_to_signal('StateChanged',
187
self
188
.entry_group_state_changed)
189
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
197
190
self.name, self.type)
198
191
self.group.AddService(
199
192
self.interface,
206
199
self.group.Commit()
207
200
def entry_group_state_changed(self, state, error):
208
201
"""Derived from the Avahi example code"""
209
logger.debug("Avahi entry group state change: %i", state)
202
logger.debug(u"Avahi entry group state change: %i", state)
210
203
211
204
if state == avahi.ENTRY_GROUP_ESTABLISHED:
212
logger.debug("Zeroconf service established.")
205
logger.debug(u"Zeroconf service established.")
213
206
elif state == avahi.ENTRY_GROUP_COLLISION:
214
logger.info("Zeroconf service name collision.")
207
logger.warning(u"Zeroconf service name collision.")
215
208
self.rename()
216
209
elif state == avahi.ENTRY_GROUP_FAILURE:
217
logger.critical("Avahi: Error in group state changed %s",
210
logger.critical(u"Avahi: Error in group state changed %s",
218
211
unicode(error))
219
raise AvahiGroupError("State changed: %s"
212
raise AvahiGroupError(u"State changed: %s"
220
213
% unicode(error))
221
214
def cleanup(self):
222
215
"""Derived from the Avahi example code"""
223
216
if self.group is not None:
224
try:
225
self.group.Free()
226
except (dbus.exceptions.UnknownMethodException,
227
dbus.exceptions.DBusException) as e:
228
pass
217
self.group.Free()
229
218
self.group = None
230
self.remove()
231
def server_state_changed(self, state, error=None):
219
def server_state_changed(self, state):
232
220
"""Derived from the Avahi example code"""
233
logger.debug("Avahi server state change: %i", state)
234
bad_states = { avahi.SERVER_INVALID:
235
"Zeroconf server invalid",
236
avahi.SERVER_REGISTERING: None,
237
avahi.SERVER_COLLISION:
238
"Zeroconf server name collision",
239
avahi.SERVER_FAILURE:
240
"Zeroconf server failure" }
241
if state in bad_states:
242
if bad_states[state] is not None:
243
if error is None:
244
logger.error(bad_states[state])
245
else:
246
logger.error(bad_states[state] + ": %r", error)
247
self.cleanup()
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
224
self.remove()
248
225
elif state == avahi.SERVER_RUNNING:
249
226
self.add()
250
else:
251
if error is None:
252
logger.debug("Unknown state: %r", state)
253
else:
254
logger.debug("Unknown state: %r: %r", state, error)
255
227
def activate(self):
256
228
"""Derived from the Avahi example code"""
257
229
if self.server is None:
258
230
self.server = dbus.Interface(
259
231
self.bus.get_object(avahi.DBUS_NAME,
260
avahi.DBUS_PATH_SERVER,
261
follow_name_owner_changes=True),
232
avahi.DBUS_PATH_SERVER),
262
233
avahi.DBUS_INTERFACE_SERVER)
263
self.server.connect_to_signal("StateChanged",
234
self.server.connect_to_signal(u"StateChanged",
264
235
self.server_state_changed)
265
236
self.server_state_changed(self.server.GetState())
266
237
267
238
268
def _timedelta_to_milliseconds(td):
269
"Convert a datetime.timedelta() to milliseconds"
270
return ((td.days * 24 * 60 * 60 * 1000)
271
+ (td.seconds * 1000)
272
+ (td.microseconds // 1000))
273
274
239
class Client(object):
275
240
"""A representation of a client host served by this server.
276
241
277
242
Attributes:
278
_approved: bool(); 'None' if not yet approved/disapproved
279
approval_delay: datetime.timedelta(); Time to wait for approval
280
approval_duration: datetime.timedelta(); Duration of one approval
243
name: string; from the config file, used in log messages and
244
D-Bus identifiers
245
fingerprint: string (40 or 32 hexadecimal digits); used to
246
uniquely identify the client
247
secret: bytestring; sent verbatim (over TLS) to client
248
host: string; available for use by the checker command
249
created: datetime.datetime(); (UTC) object creation
250
last_enabled: datetime.datetime(); (UTC)
251
enabled: bool()
252
last_checked_ok: datetime.datetime(); (UTC) or None
253
timeout: datetime.timedelta(); How long from last_checked_ok
254
until this client is disabled
255
interval: datetime.timedelta(); How often to start a new checker
256
disable_hook: If set, called by disable() as disable_hook(self)
281
257
checker: subprocess.Popen(); a running checker process used
282
258
to see if the client lives.
283
259
'None' if no process is running.
284
checker_callback_tag: a gobject event source tag, or None
285
checker_command: string; External command which is run to check
286
if client lives. %() expansions are done at
260
checker_initiator_tag: a gobject event source tag, or None
261
disable_initiator_tag: - '' -
262
checker_callback_tag: - '' -
263
checker_command: string; External command which is run to check if
264
client lives. %() expansions are done at
287
265
runtime with vars(self) as dict, so that for
288
266
instance %(name)s can be used in the command.
289
checker_initiator_tag: a gobject event source tag, or None
290
created: datetime.datetime(); (UTC) object creation
291
267
current_checker_command: string; current running checker_command
292
disable_hook: If set, called by disable() as disable_hook(self)
293
disable_initiator_tag: a gobject event source tag, or None
294
enabled: bool()
295
fingerprint: string (40 or 32 hexadecimal digits); used to
296
uniquely identify the client
297
host: string; available for use by the checker command
298
interval: datetime.timedelta(); How often to start a new checker
299
last_approval_request: datetime.datetime(); (UTC) or None
300
last_checked_ok: datetime.datetime(); (UTC) or None
301
last_enabled: datetime.datetime(); (UTC)
302
name: string; from the config file, used in log messages and
303
D-Bus identifiers
304
secret: bytestring; sent verbatim (over TLS) to client
305
timeout: datetime.timedelta(); How long from last_checked_ok
306
until this client is disabled
307
extended_timeout: extra long timeout when password has been sent
308
runtime_expansions: Allowed attributes for runtime expansion.
309
expires: datetime.datetime(); time (UTC) when a client will be
310
disabled, or None
268
approval_delay: datetime.timedelta(); Time to wait for approval
269
_approved: bool(); 'None' if not yet approved/disapproved
270
approval_duration: datetime.timedelta(); Duration of one approval
311
271
"""
312
272
313
runtime_expansions = ("approval_delay", "approval_duration",
314
"created", "enabled", "fingerprint",
315
"host", "interval", "last_checked_ok",
316
"last_enabled", "name", "timeout")
273
@staticmethod
274
def _timedelta_to_milliseconds(td):
275
"Convert a datetime.timedelta() to milliseconds"
276
return ((td.days * 24 * 60 * 60 * 1000)
277
+ (td.seconds * 1000)
278
+ (td.microseconds // 1000))
317
279
318
280
def timeout_milliseconds(self):
319
281
"Return the 'timeout' attribute in milliseconds"
320
return _timedelta_to_milliseconds(self.timeout)
321
322
def extended_timeout_milliseconds(self):
323
"Return the 'extended_timeout' attribute in milliseconds"
324
return _timedelta_to_milliseconds(self.extended_timeout)
282
return self._timedelta_to_milliseconds(self.timeout)
325
283
326
284
def interval_milliseconds(self):
327
285
"Return the 'interval' attribute in milliseconds"
328
return _timedelta_to_milliseconds(self.interval)
329
286
return self._timedelta_to_milliseconds(self.interval)
287
330
288
def approval_delay_milliseconds(self):
331
return _timedelta_to_milliseconds(self.approval_delay)
289
return self._timedelta_to_milliseconds(self.approval_delay)
332
290
333
291
def __init__(self, name = None, disable_hook=None, config=None):
334
292
"""Note: the 'checker' key in 'config' sets the
337
295
self.name = name
338
296
if config is None:
339
297
config = {}
340
logger.debug("Creating client %r", self.name)
298
logger.debug(u"Creating client %r", self.name)
341
299
# Uppercase and remove spaces from fingerprint for later
342
300
# comparison purposes with return value from the fingerprint()
343
301
# function
344
self.fingerprint = (config["fingerprint"].upper()
345
.replace(" ", ""))
346
logger.debug(" Fingerprint: %s", self.fingerprint)
347
if "secret" in config:
348
self.secret = config["secret"].decode("base64")
349
elif "secfile" in config:
302
self.fingerprint = (config[u"fingerprint"].upper()
303
.replace(u" ", u""))
304
logger.debug(u" Fingerprint: %s", self.fingerprint)
305
if u"secret" in config:
306
self.secret = config[u"secret"].decode(u"base64")
307
elif u"secfile" in config:
350
308
with open(os.path.expanduser(os.path.expandvars
351
(config["secfile"])),
309
(config[u"secfile"])),
352
310
"rb") as secfile:
353
311
self.secret = secfile.read()
354
312
else:
355
raise TypeError("No secret or secfile for client %s"
313
raise TypeError(u"No secret or secfile for client %s"
356
314
% self.name)
357
self.host = config.get("host", "")
315
self.host = config.get(u"host", u"")
358
316
self.created = datetime.datetime.utcnow()
359
317
self.enabled = False
360
self.last_approval_request = None
361
318
self.last_enabled = None
362
319
self.last_checked_ok = None
363
self.timeout = string_to_delta(config["timeout"])
364
self.extended_timeout = string_to_delta(config["extended_timeout"])
365
self.interval = string_to_delta(config["interval"])
320
self.timeout = string_to_delta(config[u"timeout"])
321
self.interval = string_to_delta(config[u"interval"])
366
322
self.disable_hook = disable_hook
367
323
self.checker = None
368
324
self.checker_initiator_tag = None
369
325
self.disable_initiator_tag = None
370
self.expires = None
371
326
self.checker_callback_tag = None
372
self.checker_command = config["checker"]
327
self.checker_command = config[u"checker"]
373
328
self.current_checker_command = None
374
329
self.last_connect = None
375
330
self._approved = None
376
self.approved_by_default = config.get("approved_by_default",
331
self.approved_by_default = config.get(u"approved_by_default",
377
332
True)
378
333
self.approvals_pending = 0
379
334
self.approval_delay = string_to_delta(
380
config["approval_delay"])
335
config[u"approval_delay"])
381
336
self.approval_duration = string_to_delta(
382
config["approval_duration"])
337
config[u"approval_duration"])
383
338
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
384
339
385
340
def send_changedstate(self):
389
344
390
345
def enable(self):
391
346
"""Start this client's checker and timeout hooks"""
392
if getattr(self, "enabled", False):
347
if getattr(self, u"enabled", False):
393
348
# Already enabled
394
349
return
395
350
self.send_changedstate()
351
self.last_enabled = datetime.datetime.utcnow()
396
352
# Schedule a new checker to be started an 'interval' from now,
397
353
# and every interval from then on.
398
354
self.checker_initiator_tag = (gobject.timeout_add
399
355
(self.interval_milliseconds(),
400
356
self.start_checker))
401
357
# Schedule a disable() when 'timeout' has passed
402
self.expires = datetime.datetime.utcnow() + self.timeout
403
358
self.disable_initiator_tag = (gobject.timeout_add
404
359
(self.timeout_milliseconds(),
405
360
self.disable))
406
361
self.enabled = True
407
self.last_enabled = datetime.datetime.utcnow()
408
362
# Also start a new checker *right now*.
409
363
self.start_checker()
410
364
415
369
if not quiet:
416
370
self.send_changedstate()
417
371
if not quiet:
418
logger.info("Disabling client %s", self.name)
419
if getattr(self, "disable_initiator_tag", False):
372
logger.info(u"Disabling client %s", self.name)
373
if getattr(self, u"disable_initiator_tag", False):
420
374
gobject.source_remove(self.disable_initiator_tag)
421
375
self.disable_initiator_tag = None
422
self.expires = None
423
if getattr(self, "checker_initiator_tag", False):
376
if getattr(self, u"checker_initiator_tag", False):
424
377
gobject.source_remove(self.checker_initiator_tag)
425
378
self.checker_initiator_tag = None
426
379
self.stop_checker()
441
394
if os.WIFEXITED(condition):
442
395
exitstatus = os.WEXITSTATUS(condition)
443
396
if exitstatus == 0:
444
logger.info("Checker for %(name)s succeeded",
397
logger.info(u"Checker for %(name)s succeeded",
445
398
vars(self))
446
399
self.checked_ok()
447
400
else:
448
logger.info("Checker for %(name)s failed",
401
logger.info(u"Checker for %(name)s failed",
449
402
vars(self))
450
403
else:
451
logger.warning("Checker for %(name)s crashed?",
404
logger.warning(u"Checker for %(name)s crashed?",
452
405
vars(self))
453
406
454
def checked_ok(self, timeout=None):
407
def checked_ok(self):
455
408
"""Bump up the timeout for this client.
456
409
457
410
This should only be called when the client has been seen,
458
411
alive and well.
459
412
"""
460
if timeout is None:
461
timeout = self.timeout
462
413
self.last_checked_ok = datetime.datetime.utcnow()
463
414
gobject.source_remove(self.disable_initiator_tag)
464
self.expires = datetime.datetime.utcnow() + timeout
465
415
self.disable_initiator_tag = (gobject.timeout_add
466
(_timedelta_to_milliseconds(timeout),
416
(self.timeout_milliseconds(),
467
417
self.disable))
468
418
469
def need_approval(self):
470
self.last_approval_request = datetime.datetime.utcnow()
471
472
419
def start_checker(self):
473
420
"""Start a new checker subprocess if one is not running.
474
421
486
433
# If a checker exists, make sure it is not a zombie
487
434
try:
488
435
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
489
except (AttributeError, OSError) as error:
436
except (AttributeError, OSError), error:
490
437
if (isinstance(error, OSError)
491
438
and error.errno != errno.ECHILD):
492
439
raise error
493
440
else:
494
441
if pid:
495
logger.warning("Checker was a zombie")
442
logger.warning(u"Checker was a zombie")
496
443
gobject.source_remove(self.checker_callback_tag)
497
444
self.checker_callback(pid, status,
498
445
self.current_checker_command)
503
450
command = self.checker_command % self.host
504
451
except TypeError:
505
452
# Escape attributes for the shell
506
escaped_attrs = dict(
507
(attr,
508
re.escape(unicode(str(getattr(self, attr, "")),
509
errors=
510
'replace')))
511
for attr in
512
self.runtime_expansions)
513
453
escaped_attrs = dict((key,
454
re.escape(unicode(str(val),
455
errors=
456
u'replace')))
457
for key, val in
458
vars(self).iteritems())
514
459
try:
515
460
command = self.checker_command % escaped_attrs
516
except TypeError as error:
517
logger.error('Could not format string "%s":'
518
' %s', self.checker_command, error)
461
except TypeError, error:
462
logger.error(u'Could not format string "%s":'
463
u' %s', self.checker_command, error)
519
464
return True # Try again later
520
465
self.current_checker_command = command
521
466
try:
522
logger.info("Starting checker %r for %s",
467
logger.info(u"Starting checker %r for %s",
523
468
command, self.name)
524
469
# We don't need to redirect stdout and stderr, since
525
470
# in normal mode, that is already done by daemon(),
527
472
# always replaced by /dev/null.)
528
473
self.checker = subprocess.Popen(command,
529
474
close_fds=True,
530
shell=True, cwd="/")
475
shell=True, cwd=u"/")
531
476
self.checker_callback_tag = (gobject.child_watch_add
532
477
(self.checker.pid,
533
478
self.checker_callback,
538
483
if pid:
539
484
gobject.source_remove(self.checker_callback_tag)
540
485
self.checker_callback(pid, status, command)
541
except OSError as error:
542
logger.error("Failed to start subprocess: %s",
486
except OSError, error:
487
logger.error(u"Failed to start subprocess: %s",
543
488
error)
544
489
# Re-run this periodically if run by gobject.timeout_add
545
490
return True
549
494
if self.checker_callback_tag:
550
495
gobject.source_remove(self.checker_callback_tag)
551
496
self.checker_callback_tag = None
552
if getattr(self, "checker", None) is None:
497
if getattr(self, u"checker", None) is None:
553
498
return
554
logger.debug("Stopping checker for %(name)s", vars(self))
499
logger.debug(u"Stopping checker for %(name)s", vars(self))
555
500
try:
556
501
os.kill(self.checker.pid, signal.SIGTERM)
557
502
#time.sleep(0.5)
558
503
#if self.checker.poll() is None:
559
504
# os.kill(self.checker.pid, signal.SIGKILL)
560
except OSError as error:
505
except OSError, error:
561
506
if error.errno != errno.ESRCH: # No such process
562
507
raise
563
508
self.checker = None
564
509
565
566
def dbus_service_property(dbus_interface, signature="v",
567
access="readwrite", byte_arrays=False):
510
def dbus_service_property(dbus_interface, signature=u"v",
511
access=u"readwrite", byte_arrays=False):
568
512
"""Decorators for marking methods of a DBusObjectWithProperties to
569
513
become properties on the D-Bus.
570
514
577
521
"""
578
522
# Encoding deeply encoded byte arrays is not supported yet by the
579
523
# "Set" method, so we fail early here:
580
if byte_arrays and signature != "ay":
581
raise ValueError("Byte arrays not supported for non-'ay'"
582
" signature %r" % signature)
524
if byte_arrays and signature != u"ay":
525
raise ValueError(u"Byte arrays not supported for non-'ay'"
526
u" signature %r" % signature)
583
527
def decorator(func):
584
528
func._dbus_is_property = True
585
529
func._dbus_interface = dbus_interface
586
530
func._dbus_signature = signature
587
531
func._dbus_access = access
588
532
func._dbus_name = func.__name__
589
if func._dbus_name.endswith("_dbus_property"):
533
if func._dbus_name.endswith(u"_dbus_property"):
590
534
func._dbus_name = func._dbus_name[:-14]
591
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
535
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
592
536
return func
593
537
return decorator
594
538
614
558
615
559
class DBusObjectWithProperties(dbus.service.Object):
616
560
"""A D-Bus object with properties.
617
561
618
562
Classes inheriting from this can use the dbus_service_property
619
563
decorator to expose methods as D-Bus properties. It exposes the
620
564
standard Get(), Set(), and GetAll() methods on the D-Bus.
622
566
623
567
@staticmethod
624
568
def _is_dbus_property(obj):
625
return getattr(obj, "_dbus_is_property", False)
569
return getattr(obj, u"_dbus_is_property", False)
626
570
627
571
def _get_all_dbus_properties(self):
628
572
"""Returns a generator of (name, attribute) pairs
629
573
"""
630
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
631
for cls in self.__class__.__mro__
632
for name, prop in inspect.getmembers(cls, self._is_dbus_property))
574
return ((prop._dbus_name, prop)
575
for name, prop in
576
inspect.getmembers(self, self._is_dbus_property))
633
577
634
578
def _get_dbus_property(self, interface_name, property_name):
635
579
"""Returns a bound method if one exists which is a D-Bus
636
580
property with the specified name and interface.
637
581
"""
638
for cls in self.__class__.__mro__:
639
for name, value in inspect.getmembers(cls, self._is_dbus_property):
640
if value._dbus_name == property_name and value._dbus_interface == interface_name:
641
return value.__get__(self)
642
582
for name in (property_name,
583
property_name + u"_dbus_property"):
584
prop = getattr(self, name, None)
585
if (prop is None
586
or not self._is_dbus_property(prop)
587
or prop._dbus_name != property_name
588
or (interface_name and prop._dbus_interface
589
and interface_name != prop._dbus_interface)):
590
continue
591
return prop
643
592
# No such property
644
raise DBusPropertyNotFound(self.dbus_object_path + ":"
645
+ interface_name + "."
593
raise DBusPropertyNotFound(self.dbus_object_path + u":"
594
+ interface_name + u"."
646
595
+ property_name)
647
596
648
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
649
out_signature="v")
597
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
598
out_signature=u"v")
650
599
def Get(self, interface_name, property_name):
651
600
"""Standard D-Bus property Get() method, see D-Bus standard.
652
601
"""
653
602
prop = self._get_dbus_property(interface_name, property_name)
654
if prop._dbus_access == "write":
603
if prop._dbus_access == u"write":
655
604
raise DBusPropertyAccessException(property_name)
656
605
value = prop()
657
if not hasattr(value, "variant_level"):
606
if not hasattr(value, u"variant_level"):
658
607
return value
659
608
return type(value)(value, variant_level=value.variant_level+1)
660
609
661
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
610
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
662
611
def Set(self, interface_name, property_name, value):
663
612
"""Standard D-Bus property Set() method, see D-Bus standard.
664
613
"""
665
614
prop = self._get_dbus_property(interface_name, property_name)
666
if prop._dbus_access == "read":
615
if prop._dbus_access == u"read":
667
616
raise DBusPropertyAccessException(property_name)
668
if prop._dbus_get_args_options["byte_arrays"]:
617
if prop._dbus_get_args_options[u"byte_arrays"]:
669
618
# The byte_arrays option is not supported yet on
670
619
# signatures other than "ay".
671
if prop._dbus_signature != "ay":
620
if prop._dbus_signature != u"ay":
672
621
raise ValueError
673
622
value = dbus.ByteArray(''.join(unichr(byte)
674
623
for byte in value))
675
624
prop(value)
676
625
677
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
678
out_signature="a{sv}")
626
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
627
out_signature=u"a{sv}")
679
628
def GetAll(self, interface_name):
680
629
"""Standard D-Bus property GetAll() method, see D-Bus
681
630
standard.
682
631
683
632
Note: Will not include properties with access="write".
684
633
"""
685
634
all = {}
689
638
# Interface non-empty but did not match
690
639
continue
691
640
# Ignore write-only properties
692
if prop._dbus_access == "write":
641
if prop._dbus_access == u"write":
693
642
continue
694
643
value = prop()
695
if not hasattr(value, "variant_level"):
644
if not hasattr(value, u"variant_level"):
696
645
all[name] = value
697
646
continue
698
647
all[name] = type(value)(value, variant_level=
699
648
value.variant_level+1)
700
return dbus.Dictionary(all, signature="sv")
649
return dbus.Dictionary(all, signature=u"sv")
701
650
702
651
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
703
out_signature="s",
652
out_signature=u"s",
704
653
path_keyword='object_path',
705
654
connection_keyword='connection')
706
655
def Introspect(self, object_path, connection):
711
660
try:
712
661
document = xml.dom.minidom.parseString(xmlstring)
713
662
def make_tag(document, name, prop):
714
e = document.createElement("property")
715
e.setAttribute("name", name)
716
e.setAttribute("type", prop._dbus_signature)
717
e.setAttribute("access", prop._dbus_access)
663
e = document.createElement(u"property")
664
e.setAttribute(u"name", name)
665
e.setAttribute(u"type", prop._dbus_signature)
666
e.setAttribute(u"access", prop._dbus_access)
718
667
return e
719
for if_tag in document.getElementsByTagName("interface"):
668
for if_tag in document.getElementsByTagName(u"interface"):
720
669
for tag in (make_tag(document, name, prop)
721
670
for name, prop
722
671
in self._get_all_dbus_properties()
723
672
if prop._dbus_interface
724
== if_tag.getAttribute("name")):
673
== if_tag.getAttribute(u"name")):
725
674
if_tag.appendChild(tag)
726
675
# Add the names to the return values for the
727
676
# "org.freedesktop.DBus.Properties" methods
728
if (if_tag.getAttribute("name")
729
== "org.freedesktop.DBus.Properties"):
730
for cn in if_tag.getElementsByTagName("method"):
731
if cn.getAttribute("name") == "Get":
732
for arg in cn.getElementsByTagName("arg"):
733
if (arg.getAttribute("direction")
734
== "out"):
735
arg.setAttribute("name", "value")
736
elif cn.getAttribute("name") == "GetAll":
737
for arg in cn.getElementsByTagName("arg"):
738
if (arg.getAttribute("direction")
739
== "out"):
740
arg.setAttribute("name", "props")
741
xmlstring = document.toxml("utf-8")
677
if (if_tag.getAttribute(u"name")
678
== u"org.freedesktop.DBus.Properties"):
679
for cn in if_tag.getElementsByTagName(u"method"):
680
if cn.getAttribute(u"name") == u"Get":
681
for arg in cn.getElementsByTagName(u"arg"):
682
if (arg.getAttribute(u"direction")
683
== u"out"):
684
arg.setAttribute(u"name", u"value")
685
elif cn.getAttribute(u"name") == u"GetAll":
686
for arg in cn.getElementsByTagName(u"arg"):
687
if (arg.getAttribute(u"direction")
688
== u"out"):
689
arg.setAttribute(u"name", u"props")
690
xmlstring = document.toxml(u"utf-8")
742
691
document.unlink()
743
692
except (AttributeError, xml.dom.DOMException,
744
xml.parsers.expat.ExpatError) as error:
745
logger.error("Failed to override Introspection method",
693
xml.parsers.expat.ExpatError), error:
694
logger.error(u"Failed to override Introspection method",
746
695
error)
747
696
return xmlstring
748
697
749
698
750
def datetime_to_dbus (dt, variant_level=0):
751
"""Convert a UTC datetime.datetime() to a D-Bus type."""
752
if dt is None:
753
return dbus.String("", variant_level = variant_level)
754
return dbus.String(dt.isoformat(),
755
variant_level=variant_level)
756
757
class AlternateDBusNamesMetaclass(DBusObjectWithProperties.__metaclass__):
758
"""Applied to an empty subclass of a D-Bus object, this metaclass
759
will add additional D-Bus attributes matching a certain pattern.
760
"""
761
def __new__(mcs, name, bases, attr):
762
# Go through all the base classes which could have D-Bus
763
# methods, signals, or properties in them
764
for base in (b for b in bases
765
if issubclass(b, dbus.service.Object)):
766
# Go though all attributes of the base class
767
for attrname, attribute in inspect.getmembers(base):
768
# Ignore non-D-Bus attributes, and D-Bus attributes
769
# with the wrong interface name
770
if (not hasattr(attribute, "_dbus_interface")
771
or not attribute._dbus_interface
772
.startswith("se.recompile.Mandos")):
773
continue
774
# Create an alternate D-Bus interface name based on
775
# the current name
776
alt_interface = (attribute._dbus_interface
777
.replace("se.recompile.Mandos",
778
"se.bsnet.fukt.Mandos"))
779
# Is this a D-Bus signal?
780
if getattr(attribute, "_dbus_is_signal", False):
781
# Extract the original non-method function by
782
# black magic
783
nonmethod_func = (dict(
784
zip(attribute.func_code.co_freevars,
785
attribute.__closure__))["func"]
786
.cell_contents)
787
# Create a new, but exactly alike, function
788
# object, and decorate it to be a new D-Bus signal
789
# with the alternate D-Bus interface name
790
new_function = (dbus.service.signal
791
(alt_interface,
792
attribute._dbus_signature)
793
(types.FunctionType(
794
nonmethod_func.func_code,
795
nonmethod_func.func_globals,
796
nonmethod_func.func_name,
797
nonmethod_func.func_defaults,
798
nonmethod_func.func_closure)))
799
# Define a creator of a function to call both the
800
# old and new functions, so both the old and new
801
# signals gets sent when the function is called
802
def fixscope(func1, func2):
803
"""This function is a scope container to pass
804
func1 and func2 to the "call_both" function
805
outside of its arguments"""
806
def call_both(*args, **kwargs):
807
"""This function will emit two D-Bus
808
signals by calling func1 and func2"""
809
func1(*args, **kwargs)
810
func2(*args, **kwargs)
811
return call_both
812
# Create the "call_both" function and add it to
813
# the class
814
attr[attrname] = fixscope(attribute,
815
new_function)
816
# Is this a D-Bus method?
817
elif getattr(attribute, "_dbus_is_method", False):
818
# Create a new, but exactly alike, function
819
# object. Decorate it to be a new D-Bus method
820
# with the alternate D-Bus interface name. Add it
821
# to the class.
822
attr[attrname] = (dbus.service.method
823
(alt_interface,
824
attribute._dbus_in_signature,
825
attribute._dbus_out_signature)
826
(types.FunctionType
827
(attribute.func_code,
828
attribute.func_globals,
829
attribute.func_name,
830
attribute.func_defaults,
831
attribute.func_closure)))
832
# Is this a D-Bus property?
833
elif getattr(attribute, "_dbus_is_property", False):
834
# Create a new, but exactly alike, function
835
# object, and decorate it to be a new D-Bus
836
# property with the alternate D-Bus interface
837
# name. Add it to the class.
838
attr[attrname] = (dbus_service_property
839
(alt_interface,
840
attribute._dbus_signature,
841
attribute._dbus_access,
842
attribute
843
._dbus_get_args_options
844
["byte_arrays"])
845
(types.FunctionType
846
(attribute.func_code,
847
attribute.func_globals,
848
attribute.func_name,
849
attribute.func_defaults,
850
attribute.func_closure)))
851
return type.__new__(mcs, name, bases, attr)
852
853
699
class ClientDBus(Client, DBusObjectWithProperties):
854
700
"""A Client class using D-Bus
855
701
857
703
dbus_object_path: dbus.ObjectPath
858
704
bus: dbus.SystemBus()
859
705
"""
860
861
runtime_expansions = (Client.runtime_expansions
862
+ ("dbus_object_path",))
863
864
706
# dbus.service.Object doesn't use super(), so we can't either.
865
707
866
708
def __init__(self, bus = None, *args, **kwargs):
869
711
Client.__init__(self, *args, **kwargs)
870
712
# Only now, when this client is initialized, can it show up on
871
713
# the D-Bus
872
client_object_name = unicode(self.name).translate(
873
{ord("."): ord("_"),
874
ord("-"): ord("_")})
875
714
self.dbus_object_path = (dbus.ObjectPath
876
("/clients/" + client_object_name))
715
(u"/clients/"
716
+ self.name.replace(u".", u"_")))
877
717
DBusObjectWithProperties.__init__(self, self.bus,
878
718
self.dbus_object_path)
879
719
880
def notifychangeproperty(transform_func,
881
dbus_name, type_func=lambda x: x,
882
variant_level=1):
883
""" Modify a variable so that it's a property which announces
884
its changes to DBus.
720
def _get_approvals_pending(self):
721
return self._approvals_pending
722
def _set_approvals_pending(self, value):
723
old_value = self._approvals_pending
724
self._approvals_pending = value
725
bval = bool(value)
726
if (hasattr(self, "dbus_object_path")
727
and bval is not bool(old_value)):
728
dbus_bool = dbus.Boolean(bval, variant_level=1)
729
self.PropertyChanged(dbus.String(u"ApprovalPending"),
730
dbus_bool)
885
731
886
transform_fun: Function that takes a value and transforms it
887
to a D-Bus type.
888
dbus_name: D-Bus name of the variable
889
type_func: Function that transform the value before sending it
890
to the D-Bus. Default: no transform
891
variant_level: D-Bus variant level. Default: 1
892
"""
893
real_value = [None,]
894
def setter(self, value):
895
old_value = real_value[0]
896
real_value[0] = value
897
if hasattr(self, "dbus_object_path"):
898
if type_func(old_value) != type_func(real_value[0]):
899
dbus_value = transform_func(type_func(real_value[0]),
900
variant_level)
901
self.PropertyChanged(dbus.String(dbus_name),
902
dbus_value)
903
904
return property(lambda self: real_value[0], setter)
905
906
907
expires = notifychangeproperty(datetime_to_dbus, "Expires")
908
approvals_pending = notifychangeproperty(dbus.Boolean,
909
"ApprovalPending",
910
type_func = bool)
911
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
912
last_enabled = notifychangeproperty(datetime_to_dbus,
913
"LastEnabled")
914
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
915
type_func = lambda checker: checker is not None)
916
last_checked_ok = notifychangeproperty(datetime_to_dbus,
917
"LastCheckedOK")
918
last_approval_request = notifychangeproperty(datetime_to_dbus,
919
"LastApprovalRequest")
920
approved_by_default = notifychangeproperty(dbus.Boolean,
921
"ApprovedByDefault")
922
approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",
923
type_func = _timedelta_to_milliseconds)
924
approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",
925
type_func = _timedelta_to_milliseconds)
926
host = notifychangeproperty(dbus.String, "Host")
927
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
928
type_func = _timedelta_to_milliseconds)
929
extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",
930
type_func = _timedelta_to_milliseconds)
931
interval = notifychangeproperty(dbus.UInt16, "Interval",
932
type_func = _timedelta_to_milliseconds)
933
checker_command = notifychangeproperty(dbus.String, "Checker")
934
935
del notifychangeproperty
732
approvals_pending = property(_get_approvals_pending,
733
_set_approvals_pending)
734
del _get_approvals_pending, _set_approvals_pending
735
736
@staticmethod
737
def _datetime_to_dbus(dt, variant_level=0):
738
"""Convert a UTC datetime.datetime() to a D-Bus type."""
739
return dbus.String(dt.isoformat(),
740
variant_level=variant_level)
741
742
def enable(self):
743
oldstate = getattr(self, u"enabled", False)
744
r = Client.enable(self)
745
if oldstate != self.enabled:
746
# Emit D-Bus signals
747
self.PropertyChanged(dbus.String(u"Enabled"),
748
dbus.Boolean(True, variant_level=1))
749
self.PropertyChanged(
750
dbus.String(u"LastEnabled"),
751
self._datetime_to_dbus(self.last_enabled,
752
variant_level=1))
753
return r
754
755
def disable(self, quiet = False):
756
oldstate = getattr(self, u"enabled", False)
757
r = Client.disable(self, quiet=quiet)
758
if not quiet and oldstate != self.enabled:
759
# Emit D-Bus signal
760
self.PropertyChanged(dbus.String(u"Enabled"),
761
dbus.Boolean(False, variant_level=1))
762
return r
936
763
937
764
def __del__(self, *args, **kwargs):
938
765
try:
939
766
self.remove_from_connection()
940
767
except LookupError:
941
768
pass
942
if hasattr(DBusObjectWithProperties, "__del__"):
769
if hasattr(DBusObjectWithProperties, u"__del__"):
943
770
DBusObjectWithProperties.__del__(self, *args, **kwargs)
944
771
Client.__del__(self, *args, **kwargs)
945
772
947
774
*args, **kwargs):
948
775
self.checker_callback_tag = None
949
776
self.checker = None
777
# Emit D-Bus signal
778
self.PropertyChanged(dbus.String(u"CheckerRunning"),
779
dbus.Boolean(False, variant_level=1))
950
780
if os.WIFEXITED(condition):
951
781
exitstatus = os.WEXITSTATUS(condition)
952
782
# Emit D-Bus signal
962
792
return Client.checker_callback(self, pid, condition, command,
963
793
*args, **kwargs)
964
794
795
def checked_ok(self, *args, **kwargs):
796
r = Client.checked_ok(self, *args, **kwargs)
797
# Emit D-Bus signal
798
self.PropertyChanged(
799
dbus.String(u"LastCheckedOK"),
800
(self._datetime_to_dbus(self.last_checked_ok,
801
variant_level=1)))
802
return r
803
965
804
def start_checker(self, *args, **kwargs):
966
805
old_checker = self.checker
967
806
if self.checker is not None:
974
813
and old_checker_pid != self.checker.pid):
975
814
# Emit D-Bus signal
976
815
self.CheckerStarted(self.current_checker_command)
816
self.PropertyChanged(
817
dbus.String(u"CheckerRunning"),
818
dbus.Boolean(True, variant_level=1))
977
819
return r
978
820
821
def stop_checker(self, *args, **kwargs):
822
old_checker = getattr(self, u"checker", None)
823
r = Client.stop_checker(self, *args, **kwargs)
824
if (old_checker is not None
825
and getattr(self, u"checker", None) is None):
826
self.PropertyChanged(dbus.String(u"CheckerRunning"),
827
dbus.Boolean(False, variant_level=1))
828
return r
829
979
830
def _reset_approved(self):
980
831
self._approved = None
981
832
return False
983
834
def approve(self, value=True):
984
835
self.send_changedstate()
985
836
self._approved = value
986
gobject.timeout_add(_timedelta_to_milliseconds
837
gobject.timeout_add(self._timedelta_to_milliseconds
987
838
(self.approval_duration),
988
839
self._reset_approved)
989
840
990
841
991
842
## D-Bus methods, signals & properties
992
_interface = "se.recompile.Mandos.Client"
843
_interface = u"se.bsnet.fukt.Mandos.Client"
993
844
994
845
## Signals
995
846
996
847
# CheckerCompleted - signal
997
@dbus.service.signal(_interface, signature="nxs")
848
@dbus.service.signal(_interface, signature=u"nxs")
998
849
def CheckerCompleted(self, exitcode, waitstatus, command):
999
850
"D-Bus signal"
1000
851
pass
1001
852
1002
853
# CheckerStarted - signal
1003
@dbus.service.signal(_interface, signature="s")
854
@dbus.service.signal(_interface, signature=u"s")
1004
855
def CheckerStarted(self, command):
1005
856
"D-Bus signal"
1006
857
pass
1007
858
1008
859
# PropertyChanged - signal
1009
@dbus.service.signal(_interface, signature="sv")
860
@dbus.service.signal(_interface, signature=u"sv")
1010
861
def PropertyChanged(self, property, value):
1011
862
"D-Bus signal"
1012
863
pass
1021
872
pass
1022
873
1023
874
# Rejected - signal
1024
@dbus.service.signal(_interface, signature="s")
875
@dbus.service.signal(_interface, signature=u"s")
1025
876
def Rejected(self, reason):
1026
877
"D-Bus signal"
1027
878
pass
1028
879
1029
880
# NeedApproval - signal
1030
@dbus.service.signal(_interface, signature="tb")
881
@dbus.service.signal(_interface, signature=u"tb")
1031
882
def NeedApproval(self, timeout, default):
1032
883
"D-Bus signal"
1033
return self.need_approval()
884
pass
1034
885
1035
886
## Methods
1036
887
1037
888
# Approve - method
1038
@dbus.service.method(_interface, in_signature="b")
889
@dbus.service.method(_interface, in_signature=u"b")
1039
890
def Approve(self, value):
1040
891
self.approve(value)
1041
892
1042
893
# CheckedOK - method
1043
894
@dbus.service.method(_interface)
1044
895
def CheckedOK(self):
1045
self.checked_ok()
896
return self.checked_ok()
1046
897
1047
898
# Enable - method
1048
899
@dbus.service.method(_interface)
1070
921
## Properties
1071
922
1072
923
# ApprovalPending - property
1073
@dbus_service_property(_interface, signature="b", access="read")
924
@dbus_service_property(_interface, signature=u"b", access=u"read")
1074
925
def ApprovalPending_dbus_property(self):
1075
926
return dbus.Boolean(bool(self.approvals_pending))
1076
927
1077
928
# ApprovedByDefault - property
1078
@dbus_service_property(_interface, signature="b",
1079
access="readwrite")
929
@dbus_service_property(_interface, signature=u"b",
930
access=u"readwrite")
1080
931
def ApprovedByDefault_dbus_property(self, value=None):
1081
932
if value is None: # get
1082
933
return dbus.Boolean(self.approved_by_default)
1083
934
self.approved_by_default = bool(value)
935
# Emit D-Bus signal
936
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
937
dbus.Boolean(value, variant_level=1))
1084
938
1085
939
# ApprovalDelay - property
1086
@dbus_service_property(_interface, signature="t",
1087
access="readwrite")
940
@dbus_service_property(_interface, signature=u"t",
941
access=u"readwrite")
1088
942
def ApprovalDelay_dbus_property(self, value=None):
1089
943
if value is None: # get
1090
944
return dbus.UInt64(self.approval_delay_milliseconds())
1091
945
self.approval_delay = datetime.timedelta(0, 0, 0, value)
946
# Emit D-Bus signal
947
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
948
dbus.UInt64(value, variant_level=1))
1092
949
1093
950
# ApprovalDuration - property
1094
@dbus_service_property(_interface, signature="t",
1095
access="readwrite")
951
@dbus_service_property(_interface, signature=u"t",
952
access=u"readwrite")
1096
953
def ApprovalDuration_dbus_property(self, value=None):
1097
954
if value is None: # get
1098
return dbus.UInt64(_timedelta_to_milliseconds(
955
return dbus.UInt64(self._timedelta_to_milliseconds(
1099
956
self.approval_duration))
1100
957
self.approval_duration = datetime.timedelta(0, 0, 0, value)
958
# Emit D-Bus signal
959
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
960
dbus.UInt64(value, variant_level=1))
1101
961
1102
962
# Name - property
1103
@dbus_service_property(_interface, signature="s", access="read")
963
@dbus_service_property(_interface, signature=u"s", access=u"read")
1104
964
def Name_dbus_property(self):
1105
965
return dbus.String(self.name)
1106
966
1107
967
# Fingerprint - property
1108
@dbus_service_property(_interface, signature="s", access="read")
968
@dbus_service_property(_interface, signature=u"s", access=u"read")
1109
969
def Fingerprint_dbus_property(self):
1110
970
return dbus.String(self.fingerprint)
1111
971
1112
972
# Host - property
1113
@dbus_service_property(_interface, signature="s",
1114
access="readwrite")
973
@dbus_service_property(_interface, signature=u"s",
974
access=u"readwrite")
1115
975
def Host_dbus_property(self, value=None):
1116
976
if value is None: # get
1117
977
return dbus.String(self.host)
1118
978
self.host = value
979
# Emit D-Bus signal
980
self.PropertyChanged(dbus.String(u"Host"),
981
dbus.String(value, variant_level=1))
1119
982
1120
983
# Created - property
1121
@dbus_service_property(_interface, signature="s", access="read")
984
@dbus_service_property(_interface, signature=u"s", access=u"read")
1122
985
def Created_dbus_property(self):
1123
return dbus.String(datetime_to_dbus(self.created))
986
return dbus.String(self._datetime_to_dbus(self.created))
1124
987
1125
988
# LastEnabled - property
1126
@dbus_service_property(_interface, signature="s", access="read")
989
@dbus_service_property(_interface, signature=u"s", access=u"read")
1127
990
def LastEnabled_dbus_property(self):
1128
return datetime_to_dbus(self.last_enabled)
991
if self.last_enabled is None:
992
return dbus.String(u"")
993
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1129
994
1130
995
# Enabled - property
1131
@dbus_service_property(_interface, signature="b",
1132
access="readwrite")
996
@dbus_service_property(_interface, signature=u"b",
997
access=u"readwrite")
1133
998
def Enabled_dbus_property(self, value=None):
1134
999
if value is None: # get
1135
1000
return dbus.Boolean(self.enabled)
1139
1004
self.disable()
1140
1005
1141
1006
# LastCheckedOK - property
1142
@dbus_service_property(_interface, signature="s",
1143
access="readwrite")
1007
@dbus_service_property(_interface, signature=u"s",
1008
access=u"readwrite")
1144
1009
def LastCheckedOK_dbus_property(self, value=None):
1145
1010
if value is not None:
1146
1011
self.checked_ok()
1147
1012
return
1148
return datetime_to_dbus(self.last_checked_ok)
1149
1150
# Expires - property
1151
@dbus_service_property(_interface, signature="s", access="read")
1152
def Expires_dbus_property(self):
1153
return datetime_to_dbus(self.expires)
1154
1155
# LastApprovalRequest - property
1156
@dbus_service_property(_interface, signature="s", access="read")
1157
def LastApprovalRequest_dbus_property(self):
1158
return datetime_to_dbus(self.last_approval_request)
1013
if self.last_checked_ok is None:
1014
return dbus.String(u"")
1015
return dbus.String(self._datetime_to_dbus(self
1016
.last_checked_ok))
1159
1017
1160
1018
# Timeout - property
1161
@dbus_service_property(_interface, signature="t",
1162
access="readwrite")
1019
@dbus_service_property(_interface, signature=u"t",
1020
access=u"readwrite")
1163
1021
def Timeout_dbus_property(self, value=None):
1164
1022
if value is None: # get
1165
1023
return dbus.UInt64(self.timeout_milliseconds())
1166
1024
self.timeout = datetime.timedelta(0, 0, 0, value)
1167
if getattr(self, "disable_initiator_tag", None) is None:
1025
# Emit D-Bus signal
1026
self.PropertyChanged(dbus.String(u"Timeout"),
1027
dbus.UInt64(value, variant_level=1))
1028
if getattr(self, u"disable_initiator_tag", None) is None:
1168
1029
return
1169
1030
# Reschedule timeout
1170
1031
gobject.source_remove(self.disable_initiator_tag)
1171
1032
self.disable_initiator_tag = None
1172
self.expires = None
1173
1033
time_to_die = (self.
1174
1034
_timedelta_to_milliseconds((self
1175
1035
.last_checked_ok
1180
1040
# The timeout has passed
1181
1041
self.disable()
1182
1042
else:
1183
self.expires = (datetime.datetime.utcnow()
1184
+ datetime.timedelta(milliseconds = time_to_die))
1185
1043
self.disable_initiator_tag = (gobject.timeout_add
1186
1044
(time_to_die, self.disable))
1187
1045
1188
# ExtendedTimeout - property
1189
@dbus_service_property(_interface, signature="t",
1190
access="readwrite")
1191
def ExtendedTimeout_dbus_property(self, value=None):
1192
if value is None: # get
1193
return dbus.UInt64(self.extended_timeout_milliseconds())
1194
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1195
1196
1046
# Interval - property
1197
@dbus_service_property(_interface, signature="t",
1198
access="readwrite")
1047
@dbus_service_property(_interface, signature=u"t",
1048
access=u"readwrite")
1199
1049
def Interval_dbus_property(self, value=None):
1200
1050
if value is None: # get
1201
1051
return dbus.UInt64(self.interval_milliseconds())
1202
1052
self.interval = datetime.timedelta(0, 0, 0, value)
1203
if getattr(self, "checker_initiator_tag", None) is None:
1053
# Emit D-Bus signal
1054
self.PropertyChanged(dbus.String(u"Interval"),
1055
dbus.UInt64(value, variant_level=1))
1056
if getattr(self, u"checker_initiator_tag", None) is None:
1204
1057
return
1205
1058
# Reschedule checker run
1206
1059
gobject.source_remove(self.checker_initiator_tag)
1207
1060
self.checker_initiator_tag = (gobject.timeout_add
1208
1061
(value, self.start_checker))
1209
1062
self.start_checker() # Start one now, too
1210
1063
1211
1064
# Checker - property
1212
@dbus_service_property(_interface, signature="s",
1213
access="readwrite")
1065
@dbus_service_property(_interface, signature=u"s",
1066
access=u"readwrite")
1214
1067
def Checker_dbus_property(self, value=None):
1215
1068
if value is None: # get
1216
1069
return dbus.String(self.checker_command)
1217
1070
self.checker_command = value
1071
# Emit D-Bus signal
1072
self.PropertyChanged(dbus.String(u"Checker"),
1073
dbus.String(self.checker_command,
1074
variant_level=1))
1218
1075
1219
1076
# CheckerRunning - property
1220
@dbus_service_property(_interface, signature="b",
1221
access="readwrite")
1077
@dbus_service_property(_interface, signature=u"b",
1078
access=u"readwrite")
1222
1079
def CheckerRunning_dbus_property(self, value=None):
1223
1080
if value is None: # get
1224
1081
return dbus.Boolean(self.checker is not None)
1228
1085
self.stop_checker()
1229
1086
1230
1087
# ObjectPath - property
1231
@dbus_service_property(_interface, signature="o", access="read")
1088
@dbus_service_property(_interface, signature=u"o", access=u"read")
1232
1089
def ObjectPath_dbus_property(self):
1233
1090
return self.dbus_object_path # is already a dbus.ObjectPath
1234
1091
1235
1092
# Secret = property
1236
@dbus_service_property(_interface, signature="ay",
1237
access="write", byte_arrays=True)
1093
@dbus_service_property(_interface, signature=u"ay",
1094
access=u"write", byte_arrays=True)
1238
1095
def Secret_dbus_property(self, value):
1239
1096
self.secret = str(value)
1240
1097
1247
1104
self._pipe.send(('init', fpr, address))
1248
1105
if not self._pipe.recv():
1249
1106
raise KeyError()
1250
1107
1251
1108
def __getattribute__(self, name):
1252
1109
if(name == '_pipe'):
1253
1110
return super(ProxyClient, self).__getattribute__(name)
1260
1117
self._pipe.send(('funcall', name, args, kwargs))
1261
1118
return self._pipe.recv()[1]
1262
1119
return func
1263
1120
1264
1121
def __setattr__(self, name, value):
1265
1122
if(name == '_pipe'):
1266
1123
return super(ProxyClient, self).__setattr__(name, value)
1267
1124
self._pipe.send(('setattr', name, value))
1268
1125
1269
class ClientDBusTransitional(ClientDBus):
1270
__metaclass__ = AlternateDBusNamesMetaclass
1271
1126
1272
1127
class ClientHandler(socketserver.BaseRequestHandler, object):
1273
1128
"""A class to handle client connections.
1277
1132
1278
1133
def handle(self):
1279
1134
with contextlib.closing(self.server.child_pipe) as child_pipe:
1280
logger.info("TCP connection from: %s",
1135
logger.info(u"TCP connection from: %s",
1281
1136
unicode(self.client_address))
1282
logger.debug("Pipe FD: %d",
1137
logger.debug(u"Pipe FD: %d",
1283
1138
self.server.child_pipe.fileno())
1284
1139
1285
1140
session = (gnutls.connection
1286
1141
.ClientSession(self.request,
1287
1142
gnutls.connection
1288
1143
.X509Credentials()))
1289
1144
1290
1145
# Note: gnutls.connection.X509Credentials is really a
1291
1146
# generic GnuTLS certificate credentials object so long as
1292
1147
# no X.509 keys are added to it. Therefore, we can use it
1293
1148
# here despite using OpenPGP certificates.
1294
1295
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1296
# "+AES-256-CBC", "+SHA1",
1297
# "+COMP-NULL", "+CTYPE-OPENPGP",
1298
# "+DHE-DSS"))
1149
1150
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1151
# u"+AES-256-CBC", u"+SHA1",
1152
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1153
# u"+DHE-DSS"))
1299
1154
# Use a fallback default, since this MUST be set.
1300
1155
priority = self.server.gnutls_priority
1301
1156
if priority is None:
1302
priority = "NORMAL"
1157
priority = u"NORMAL"
1303
1158
(gnutls.library.functions
1304
1159
.gnutls_priority_set_direct(session._c_object,
1305
1160
priority, None))
1306
1161
1307
1162
# Start communication using the Mandos protocol
1308
1163
# Get protocol number
1309
1164
line = self.request.makefile().readline()
1310
logger.debug("Protocol version: %r", line)
1165
logger.debug(u"Protocol version: %r", line)
1311
1166
try:
1312
1167
if int(line.strip().split()[0]) > 1:
1313
1168
raise RuntimeError
1314
except (ValueError, IndexError, RuntimeError) as error:
1315
logger.error("Unknown protocol version: %s", error)
1169
except (ValueError, IndexError, RuntimeError), error:
1170
logger.error(u"Unknown protocol version: %s", error)
1316
1171
return
1317
1172
1318
1173
# Start GnuTLS connection
1319
1174
try:
1320
1175
session.handshake()
1321
except gnutls.errors.GNUTLSError as error:
1322
logger.warning("Handshake failed: %s", error)
1176
except gnutls.errors.GNUTLSError, error:
1177
logger.warning(u"Handshake failed: %s", error)
1323
1178
# Do not run session.bye() here: the session is not
1324
1179
# established. Just abandon the request.
1325
1180
return
1326
logger.debug("Handshake succeeded")
1327
1181
logger.debug(u"Handshake succeeded")
1182
1328
1183
approval_required = False
1329
1184
try:
1330
1185
try:
1331
1186
fpr = self.fingerprint(self.peer_certificate
1332
1187
(session))
1333
except (TypeError,
1334
gnutls.errors.GNUTLSError) as error:
1335
logger.warning("Bad certificate: %s", error)
1188
except (TypeError, gnutls.errors.GNUTLSError), error:
1189
logger.warning(u"Bad certificate: %s", error)
1336
1190
return
1337
logger.debug("Fingerprint: %s", fpr)
1338
1191
logger.debug(u"Fingerprint: %s", fpr)
1192
1339
1193
try:
1340
1194
client = ProxyClient(child_pipe, fpr,
1341
1195
self.client_address)
1349
1203
1350
1204
while True:
1351
1205
if not client.enabled:
1352
logger.info("Client %s is disabled",
1206
logger.warning(u"Client %s is disabled",
1353
1207
client.name)
1354
1208
if self.server.use_dbus:
1355
1209
# Emit D-Bus signal
1360
1214
#We are approved or approval is disabled
1361
1215
break
1362
1216
elif client._approved is None:
1363
logger.info("Client %s needs approval",
1217
logger.info(u"Client %s needs approval",
1364
1218
client.name)
1365
1219
if self.server.use_dbus:
1366
1220
# Emit D-Bus signal
1368
1222
client.approval_delay_milliseconds(),
1369
1223
client.approved_by_default)
1370
1224
else:
1371
logger.warning("Client %s was not approved",
1225
logger.warning(u"Client %s was not approved",
1372
1226
client.name)
1373
1227
if self.server.use_dbus:
1374
1228
# Emit D-Bus signal
1400
1254
while sent_size < len(client.secret):
1401
1255
try:
1402
1256
sent = session.send(client.secret[sent_size:])
1403
except gnutls.errors.GNUTLSError as error:
1257
except (gnutls.errors.GNUTLSError), error:
1404
1258
logger.warning("gnutls send failed")
1405
1259
return
1406
logger.debug("Sent: %d, remaining: %d",
1260
logger.debug(u"Sent: %d, remaining: %d",
1407
1261
sent, len(client.secret)
1408
1262
- (sent_size + sent))
1409
1263
sent_size += sent
1410
1411
logger.info("Sending secret to %s", client.name)
1264
1265
logger.info(u"Sending secret to %s", client.name)
1412
1266
# bump the timeout as if seen
1413
client.checked_ok(client.extended_timeout)
1267
client.checked_ok()
1414
1268
if self.server.use_dbus:
1415
1269
# Emit D-Bus signal
1416
1270
client.GotSecret()
1420
1274
client.approvals_pending -= 1
1421
1275
try:
1422
1276
session.bye()
1423
except gnutls.errors.GNUTLSError as error:
1277
except (gnutls.errors.GNUTLSError), error:
1424
1278
logger.warning("GnuTLS bye failed")
1425
1279
1426
1280
@staticmethod
1437
1291
.gnutls_certificate_get_peers
1438
1292
(session._c_object, ctypes.byref(list_size)))
1439
1293
if not bool(cert_list) and list_size.value != 0:
1440
raise gnutls.errors.GNUTLSError("error getting peer"
1441
" certificate")
1294
raise gnutls.errors.GNUTLSError(u"error getting peer"
1295
u" certificate")
1442
1296
if list_size.value == 0:
1443
1297
return None
1444
1298
cert = cert_list[0]
1470
1324
if crtverify.value != 0:
1471
1325
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1472
1326
raise (gnutls.errors.CertificateSecurityError
1473
("Verify failed"))
1327
(u"Verify failed"))
1474
1328
# New buffer for the fingerprint
1475
1329
buf = ctypes.create_string_buffer(20)
1476
1330
buf_len = ctypes.c_size_t()
1483
1337
# Convert the buffer to a Python bytestring
1484
1338
fpr = ctypes.string_at(buf, buf_len.value)
1485
1339
# Convert the bytestring to hexadecimal notation
1486
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1340
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1487
1341
return hex_fpr
1488
1342
1489
1343
1501
1355
multiprocessing.Process(target = self.sub_process_main,
1502
1356
args = (request, address)).start()
1503
1357
1504
1505
1358
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1506
1359
""" adds a pipe to the MixIn """
1507
1360
def process_request(self, request, client_address):
1510
1363
This function creates a new pipe in self.pipe
1511
1364
"""
1512
1365
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1513
1366
1514
1367
super(MultiprocessingMixInWithPipe,
1515
1368
self).process_request(request, client_address)
1516
1369
self.child_pipe.close()
1517
1370
self.add_pipe(parent_pipe)
1518
1371
1519
1372
def add_pipe(self, parent_pipe):
1520
1373
"""Dummy function; override as necessary"""
1521
raise NotImplementedError
1522
1374
pass
1523
1375
1524
1376
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1525
1377
socketserver.TCPServer, object):
1543
1395
bind to an address or port if they were not specified."""
1544
1396
if self.interface is not None:
1545
1397
if SO_BINDTODEVICE is None:
1546
logger.error("SO_BINDTODEVICE does not exist;"
1547
" cannot bind to interface %s",
1398
logger.error(u"SO_BINDTODEVICE does not exist;"
1399
u" cannot bind to interface %s",
1548
1400
self.interface)
1549
1401
else:
1550
1402
try:
1551
1403
self.socket.setsockopt(socket.SOL_SOCKET,
1552
1404
SO_BINDTODEVICE,
1553
1405
str(self.interface
1554
+ '\0'))
1555
except socket.error as error:
1406
+ u'\0'))
1407
except socket.error, error:
1556
1408
if error[0] == errno.EPERM:
1557
logger.error("No permission to"
1558
" bind to interface %s",
1409
logger.error(u"No permission to"
1410
u" bind to interface %s",
1559
1411
self.interface)
1560
1412
elif error[0] == errno.ENOPROTOOPT:
1561
logger.error("SO_BINDTODEVICE not available;"
1562
" cannot bind to interface %s",
1413
logger.error(u"SO_BINDTODEVICE not available;"
1414
u" cannot bind to interface %s",
1563
1415
self.interface)
1564
1416
else:
1565
1417
raise
1567
1419
if self.server_address[0] or self.server_address[1]:
1568
1420
if not self.server_address[0]:
1569
1421
if self.address_family == socket.AF_INET6:
1570
any_address = "::" # in6addr_any
1422
any_address = u"::" # in6addr_any
1571
1423
else:
1572
1424
any_address = socket.INADDR_ANY
1573
1425
self.server_address = (any_address,
1622
1474
def handle_ipc(self, source, condition, parent_pipe=None,
1623
1475
client_object=None):
1624
1476
condition_names = {
1625
gobject.IO_IN: "IN", # There is data to read.
1626
gobject.IO_OUT: "OUT", # Data can be written (without
1477
gobject.IO_IN: u"IN", # There is data to read.
1478
gobject.IO_OUT: u"OUT", # Data can be written (without
1627
1479
# blocking).
1628
gobject.IO_PRI: "PRI", # There is urgent data to read.
1629
gobject.IO_ERR: "ERR", # Error condition.
1630
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1480
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1481
gobject.IO_ERR: u"ERR", # Error condition.
1482
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1631
1483
# broken, usually for pipes and
1632
1484
# sockets).
1633
1485
}
1652
1504
client = c
1653
1505
break
1654
1506
else:
1655
logger.info("Client not found for fingerprint: %s, ad"
1656
"dress: %s", fpr, address)
1507
logger.warning(u"Client not found for fingerprint: %s, ad"
1508
u"dress: %s", fpr, address)
1657
1509
if self.use_dbus:
1658
1510
# Emit D-Bus signal
1659
mandos_dbus_service.ClientNotFound(fpr, address[0])
1511
mandos_dbus_service.ClientNotFound(fpr, address)
1660
1512
parent_pipe.send(False)
1661
1513
return False
1662
1514
1674
1526
kwargs = request[3]
1675
1527
1676
1528
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1677
1529
1678
1530
if command == 'getattr':
1679
1531
attrname = request[1]
1680
1532
if callable(client_object.__getattribute__(attrname)):
1686
1538
attrname = request[1]
1687
1539
value = request[2]
1688
1540
setattr(client_object, attrname, value)
1689
1541
1690
1542
return True
1691
1543
1692
1544
1693
1545
def string_to_delta(interval):
1694
1546
"""Parse a string and return a datetime.timedelta
1695
1547
1696
>>> string_to_delta('7d')
1548
>>> string_to_delta(u'7d')
1697
1549
datetime.timedelta(7)
1698
>>> string_to_delta('60s')
1550
>>> string_to_delta(u'60s')
1699
1551
datetime.timedelta(0, 60)
1700
>>> string_to_delta('60m')
1552
>>> string_to_delta(u'60m')
1701
1553
datetime.timedelta(0, 3600)
1702
>>> string_to_delta('24h')
1554
>>> string_to_delta(u'24h')
1703
1555
datetime.timedelta(1)
1704
>>> string_to_delta('1w')
1556
>>> string_to_delta(u'1w')
1705
1557
datetime.timedelta(7)
1706
>>> string_to_delta('5m 30s')
1558
>>> string_to_delta(u'5m 30s')
1707
1559
datetime.timedelta(0, 330)
1708
1560
"""
1709
1561
timevalue = datetime.timedelta(0)
1711
1563
try:
1712
1564
suffix = unicode(s[-1])
1713
1565
value = int(s[:-1])
1714
if suffix == "d":
1566
if suffix == u"d":
1715
1567
delta = datetime.timedelta(value)
1716
elif suffix == "s":
1568
elif suffix == u"s":
1717
1569
delta = datetime.timedelta(0, value)
1718
elif suffix == "m":
1570
elif suffix == u"m":
1719
1571
delta = datetime.timedelta(0, 0, 0, 0, value)
1720
elif suffix == "h":
1572
elif suffix == u"h":
1721
1573
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1722
elif suffix == "w":
1574
elif suffix == u"w":
1723
1575
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1724
1576
else:
1725
raise ValueError("Unknown suffix %r" % suffix)
1726
except (ValueError, IndexError) as e:
1727
raise ValueError(*(e.args))
1577
raise ValueError(u"Unknown suffix %r" % suffix)
1578
except (ValueError, IndexError), e:
1579
raise ValueError(e.message)
1728
1580
timevalue += delta
1729
1581
return timevalue
1730
1582
1736
1588
global if_nametoindex
1737
1589
try:
1738
1590
if_nametoindex = (ctypes.cdll.LoadLibrary
1739
(ctypes.util.find_library("c"))
1591
(ctypes.util.find_library(u"c"))
1740
1592
.if_nametoindex)
1741
1593
except (OSError, AttributeError):
1742
logger.warning("Doing if_nametoindex the hard way")
1594
logger.warning(u"Doing if_nametoindex the hard way")
1743
1595
def if_nametoindex(interface):
1744
1596
"Get an interface index the hard way, i.e. using fcntl()"
1745
1597
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1746
1598
with contextlib.closing(socket.socket()) as s:
1747
1599
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1748
struct.pack(str("16s16x"),
1600
struct.pack(str(u"16s16x"),
1749
1601
interface))
1750
interface_index = struct.unpack(str("I"),
1602
interface_index = struct.unpack(str(u"I"),
1751
1603
ifreq[16:20])[0]
1752
1604
return interface_index
1753
1605
return if_nametoindex(interface)
1761
1613
sys.exit()
1762
1614
os.setsid()
1763
1615
if not nochdir:
1764
os.chdir("/")
1616
os.chdir(u"/")
1765
1617
if os.fork():
1766
1618
sys.exit()
1767
1619
if not noclose:
1769
1621
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1770
1622
if not stat.S_ISCHR(os.fstat(null).st_mode):
1771
1623
raise OSError(errno.ENODEV,
1772
"%s not a character device"
1624
u"%s not a character device"
1773
1625
% os.path.devnull)
1774
1626
os.dup2(null, sys.stdin.fileno())
1775
1627
os.dup2(null, sys.stdout.fileno())
1783
1635
##################################################################
1784
1636
# Parsing of options, both command line and config file
1785
1637
1786
parser = argparse.ArgumentParser()
1787
parser.add_argument("-v", "--version", action="version",
1788
version = "%%(prog)s %s" % version,
1789
help="show version number and exit")
1790
parser.add_argument("-i", "--interface", metavar="IF",
1791
help="Bind to interface IF")
1792
parser.add_argument("-a", "--address",
1793
help="Address to listen for requests on")
1794
parser.add_argument("-p", "--port", type=int,
1795
help="Port number to receive requests on")
1796
parser.add_argument("--check", action="store_true",
1797
help="Run self-test")
1798
parser.add_argument("--debug", action="store_true",
1799
help="Debug mode; run in foreground and log"
1800
" to terminal")
1801
parser.add_argument("--debuglevel", metavar="LEVEL",
1802
help="Debug level for stdout output")
1803
parser.add_argument("--priority", help="GnuTLS"
1804
" priority string (see GnuTLS documentation)")
1805
parser.add_argument("--servicename",
1806
metavar="NAME", help="Zeroconf service name")
1807
parser.add_argument("--configdir",
1808
default="/etc/mandos", metavar="DIR",
1809
help="Directory to search for configuration"
1810
" files")
1811
parser.add_argument("--no-dbus", action="store_false",
1812
dest="use_dbus", help="Do not provide D-Bus"
1813
" system bus interface")
1814
parser.add_argument("--no-ipv6", action="store_false",
1815
dest="use_ipv6", help="Do not use IPv6")
1816
options = parser.parse_args()
1638
parser = optparse.OptionParser(version = "%%prog %s" % version)
1639
parser.add_option("-i", u"--interface", type=u"string",
1640
metavar="IF", help=u"Bind to interface IF")
1641
parser.add_option("-a", u"--address", type=u"string",
1642
help=u"Address to listen for requests on")
1643
parser.add_option("-p", u"--port", type=u"int",
1644
help=u"Port number to receive requests on")
1645
parser.add_option("--check", action=u"store_true",
1646
help=u"Run self-test")
1647
parser.add_option("--debug", action=u"store_true",
1648
help=u"Debug mode; run in foreground and log to"
1649
u" terminal")
1650
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1651
help=u"Debug level for stdout output")
1652
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1653
u" priority string (see GnuTLS documentation)")
1654
parser.add_option("--servicename", type=u"string",
1655
metavar=u"NAME", help=u"Zeroconf service name")
1656
parser.add_option("--configdir", type=u"string",
1657
default=u"/etc/mandos", metavar=u"DIR",
1658
help=u"Directory to search for configuration"
1659
u" files")
1660
parser.add_option("--no-dbus", action=u"store_false",
1661
dest=u"use_dbus", help=u"Do not provide D-Bus"
1662
u" system bus interface")
1663
parser.add_option("--no-ipv6", action=u"store_false",
1664
dest=u"use_ipv6", help=u"Do not use IPv6")
1665
options = parser.parse_args()[0]
1817
1666
1818
1667
if options.check:
1819
1668
import doctest
1821
1670
sys.exit()
1822
1671
1823
1672
# Default values for config file for server-global settings
1824
server_defaults = { "interface": "",
1825
"address": "",
1826
"port": "",
1827
"debug": "False",
1828
"priority":
1829
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1830
"servicename": "Mandos",
1831
"use_dbus": "True",
1832
"use_ipv6": "True",
1833
"debuglevel": "",
1673
server_defaults = { u"interface": u"",
1674
u"address": u"",
1675
u"port": u"",
1676
u"debug": u"False",
1677
u"priority":
1678
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1679
u"servicename": u"Mandos",
1680
u"use_dbus": u"True",
1681
u"use_ipv6": u"True",
1682
u"debuglevel": u"",
1834
1683
}
1835
1684
1836
1685
# Parse config file for server-global settings
1837
1686
server_config = configparser.SafeConfigParser(server_defaults)
1838
1687
del server_defaults
1839
1688
server_config.read(os.path.join(options.configdir,
1840
"mandos.conf"))
1689
u"mandos.conf"))
1841
1690
# Convert the SafeConfigParser object to a dict
1842
1691
server_settings = server_config.defaults()
1843
1692
# Use the appropriate methods on the non-string config options
1844
for option in ("debug", "use_dbus", "use_ipv6"):
1845
server_settings[option] = server_config.getboolean("DEFAULT",
1693
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1694
server_settings[option] = server_config.getboolean(u"DEFAULT",
1846
1695
option)
1847
1696
if server_settings["port"]:
1848
server_settings["port"] = server_config.getint("DEFAULT",
1849
"port")
1697
server_settings["port"] = server_config.getint(u"DEFAULT",
1698
u"port")
1850
1699
del server_config
1851
1700
1852
1701
# Override the settings from the config file with command line
1853
1702
# options, if set.
1854
for option in ("interface", "address", "port", "debug",
1855
"priority", "servicename", "configdir",
1856
"use_dbus", "use_ipv6", "debuglevel"):
1703
for option in (u"interface", u"address", u"port", u"debug",
1704
u"priority", u"servicename", u"configdir",
1705
u"use_dbus", u"use_ipv6", u"debuglevel"):
1857
1706
value = getattr(options, option)
1858
1707
if value is not None:
1859
1708
server_settings[option] = value
1867
1716
##################################################################
1868
1717
1869
1718
# For convenience
1870
debug = server_settings["debug"]
1871
debuglevel = server_settings["debuglevel"]
1872
use_dbus = server_settings["use_dbus"]
1873
use_ipv6 = server_settings["use_ipv6"]
1874
1875
if server_settings["servicename"] != "Mandos":
1719
debug = server_settings[u"debug"]
1720
debuglevel = server_settings[u"debuglevel"]
1721
use_dbus = server_settings[u"use_dbus"]
1722
use_ipv6 = server_settings[u"use_ipv6"]
1723
1724
if server_settings[u"servicename"] != u"Mandos":
1876
1725
syslogger.setFormatter(logging.Formatter
1877
('Mandos (%s) [%%(process)d]:'
1878
' %%(levelname)s: %%(message)s'
1879
% server_settings["servicename"]))
1726
(u'Mandos (%s) [%%(process)d]:'
1727
u' %%(levelname)s: %%(message)s'
1728
% server_settings[u"servicename"]))
1880
1729
1881
1730
# Parse config file with clients
1882
client_defaults = { "timeout": "5m",
1883
"extended_timeout": "15m",
1884
"interval": "2m",
1885
"checker": "fping -q -- %%(host)s",
1886
"host": "",
1887
"approval_delay": "0s",
1888
"approval_duration": "1s",
1731
client_defaults = { u"timeout": u"1h",
1732
u"interval": u"5m",
1733
u"checker": u"fping -q -- %%(host)s",
1734
u"host": u"",
1735
u"approval_delay": u"0s",
1736
u"approval_duration": u"1s",
1889
1737
}
1890
1738
client_config = configparser.SafeConfigParser(client_defaults)
1891
client_config.read(os.path.join(server_settings["configdir"],
1892
"clients.conf"))
1739
client_config.read(os.path.join(server_settings[u"configdir"],
1740
u"clients.conf"))
1893
1741
1894
1742
global mandos_dbus_service
1895
1743
mandos_dbus_service = None
1896
1744
1897
tcp_server = MandosServer((server_settings["address"],
1898
server_settings["port"]),
1745
tcp_server = MandosServer((server_settings[u"address"],
1746
server_settings[u"port"]),
1899
1747
ClientHandler,
1900
interface=(server_settings["interface"]
1748
interface=(server_settings[u"interface"]
1901
1749
or None),
1902
1750
use_ipv6=use_ipv6,
1903
1751
gnutls_priority=
1904
server_settings["priority"],
1752
server_settings[u"priority"],
1905
1753
use_dbus=use_dbus)
1906
if not debug:
1907
pidfilename = "/var/run/mandos.pid"
1908
try:
1909
pidfile = open(pidfilename, "w")
1910
except IOError:
1911
logger.error("Could not open file %r", pidfilename)
1754
pidfilename = u"/var/run/mandos.pid"
1755
try:
1756
pidfile = open(pidfilename, u"w")
1757
except IOError:
1758
logger.error(u"Could not open file %r", pidfilename)
1912
1759
1913
1760
try:
1914
uid = pwd.getpwnam("_mandos").pw_uid
1915
gid = pwd.getpwnam("_mandos").pw_gid
1761
uid = pwd.getpwnam(u"_mandos").pw_uid
1762
gid = pwd.getpwnam(u"_mandos").pw_gid
1916
1763
except KeyError:
1917
1764
try:
1918
uid = pwd.getpwnam("mandos").pw_uid
1919
gid = pwd.getpwnam("mandos").pw_gid
1765
uid = pwd.getpwnam(u"mandos").pw_uid
1766
gid = pwd.getpwnam(u"mandos").pw_gid
1920
1767
except KeyError:
1921
1768
try:
1922
uid = pwd.getpwnam("nobody").pw_uid
1923
gid = pwd.getpwnam("nobody").pw_gid
1769
uid = pwd.getpwnam(u"nobody").pw_uid
1770
gid = pwd.getpwnam(u"nobody").pw_gid
1924
1771
except KeyError:
1925
1772
uid = 65534
1926
1773
gid = 65534
1927
1774
try:
1928
1775
os.setgid(gid)
1929
1776
os.setuid(uid)
1930
except OSError as error:
1777
except OSError, error:
1931
1778
if error[0] != errno.EPERM:
1932
1779
raise error
1933
1780
1938
1785
level = getattr(logging, debuglevel.upper())
1939
1786
syslogger.setLevel(level)
1940
1787
console.setLevel(level)
1941
1788
1942
1789
if debug:
1943
1790
# Enable all possible GnuTLS debugging
1944
1791
1948
1795
1949
1796
@gnutls.library.types.gnutls_log_func
1950
1797
def debug_gnutls(level, string):
1951
logger.debug("GnuTLS: %s", string[:-1])
1798
logger.debug(u"GnuTLS: %s", string[:-1])
1952
1799
1953
1800
(gnutls.library.functions
1954
1801
.gnutls_global_set_log_function(debug_gnutls))
1962
1809
# No console logging
1963
1810
logger.removeHandler(console)
1964
1811
1965
# Need to fork before connecting to D-Bus
1966
if not debug:
1967
# Close all input and output, do double fork, etc.
1968
daemon()
1969
1812
1970
1813
global main_loop
1971
1814
# From the Avahi example code
1975
1818
# End of Avahi example code
1976
1819
if use_dbus:
1977
1820
try:
1978
bus_name = dbus.service.BusName("se.recompile.Mandos",
1821
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1979
1822
bus, do_not_queue=True)
1980
old_bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1981
bus, do_not_queue=True)
1982
except dbus.exceptions.NameExistsException as e:
1983
logger.error(unicode(e) + ", disabling D-Bus")
1823
except dbus.exceptions.NameExistsException, e:
1824
logger.error(unicode(e) + u", disabling D-Bus")
1984
1825
use_dbus = False
1985
server_settings["use_dbus"] = False
1826
server_settings[u"use_dbus"] = False
1986
1827
tcp_server.use_dbus = False
1987
1828
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1988
service = AvahiService(name = server_settings["servicename"],
1989
servicetype = "_mandos._tcp",
1829
service = AvahiService(name = server_settings[u"servicename"],
1830
servicetype = u"_mandos._tcp",
1990
1831
protocol = protocol, bus = bus)
1991
1832
if server_settings["interface"]:
1992
1833
service.interface = (if_nametoindex
1993
(str(server_settings["interface"])))
1994
1834
(str(server_settings[u"interface"])))
1835
1836
if not debug:
1837
# Close all input and output, do double fork, etc.
1838
daemon()
1839
1995
1840
global multiprocessing_manager
1996
1841
multiprocessing_manager = multiprocessing.Manager()
1997
1842
1998
1843
client_class = Client
1999
1844
if use_dbus:
2000
client_class = functools.partial(ClientDBusTransitional, bus = bus)
1845
client_class = functools.partial(ClientDBus, bus = bus)
2001
1846
def client_config_items(config, section):
2002
1847
special_settings = {
2003
1848
"approved_by_default":
2016
1861
client_config, section)))
2017
1862
for section in client_config.sections()))
2018
1863
if not tcp_server.clients:
2019
logger.warning("No clients defined")
1864
logger.warning(u"No clients defined")
2020
1865
1866
try:
1867
with pidfile:
1868
pid = os.getpid()
1869
pidfile.write(str(pid) + "\n")
1870
del pidfile
1871
except IOError:
1872
logger.error(u"Could not write to file %r with PID %d",
1873
pidfilename, pid)
1874
except NameError:
1875
# "pidfile" was never created
1876
pass
1877
del pidfilename
1878
2021
1879
if not debug:
2022
try:
2023
with pidfile:
2024
pid = os.getpid()
2025
pidfile.write(str(pid) + "\n".encode("utf-8"))
2026
del pidfile
2027
except IOError:
2028
logger.error("Could not write to file %r with PID %d",
2029
pidfilename, pid)
2030
except NameError:
2031
# "pidfile" was never created
2032
pass
2033
del pidfilename
2034
2035
1880
signal.signal(signal.SIGINT, signal.SIG_IGN)
2036
2037
1881
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2038
1882
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2039
1883
2041
1885
class MandosDBusService(dbus.service.Object):
2042
1886
"""A D-Bus proxy object"""
2043
1887
def __init__(self):
2044
dbus.service.Object.__init__(self, bus, "/")
2045
_interface = "se.recompile.Mandos"
1888
dbus.service.Object.__init__(self, bus, u"/")
1889
_interface = u"se.bsnet.fukt.Mandos"
2046
1890
2047
@dbus.service.signal(_interface, signature="o")
1891
@dbus.service.signal(_interface, signature=u"o")
2048
1892
def ClientAdded(self, objpath):
2049
1893
"D-Bus signal"
2050
1894
pass
2051
1895
2052
@dbus.service.signal(_interface, signature="ss")
1896
@dbus.service.signal(_interface, signature=u"ss")
2053
1897
def ClientNotFound(self, fingerprint, address):
2054
1898
"D-Bus signal"
2055
1899
pass
2056
1900
2057
@dbus.service.signal(_interface, signature="os")
1901
@dbus.service.signal(_interface, signature=u"os")
2058
1902
def ClientRemoved(self, objpath, name):
2059
1903
"D-Bus signal"
2060
1904
pass
2061
1905
2062
@dbus.service.method(_interface, out_signature="ao")
1906
@dbus.service.method(_interface, out_signature=u"ao")
2063
1907
def GetAllClients(self):
2064
1908
"D-Bus method"
2065
1909
return dbus.Array(c.dbus_object_path
2066
1910
for c in tcp_server.clients)
2067
1911
2068
1912
@dbus.service.method(_interface,
2069
out_signature="a{oa{sv}}")
1913
out_signature=u"a{oa{sv}}")
2070
1914
def GetAllClientsWithProperties(self):
2071
1915
"D-Bus method"
2072
1916
return dbus.Dictionary(
2073
((c.dbus_object_path, c.GetAll(""))
1917
((c.dbus_object_path, c.GetAll(u""))
2074
1918
for c in tcp_server.clients),
2075
signature="oa{sv}")
1919
signature=u"oa{sv}")
2076
1920
2077
@dbus.service.method(_interface, in_signature="o")
1921
@dbus.service.method(_interface, in_signature=u"o")
2078
1922
def RemoveClient(self, object_path):
2079
1923
"D-Bus method"
2080
1924
for c in tcp_server.clients:
2090
1934
2091
1935
del _interface
2092
1936
2093
class MandosDBusServiceTransitional(MandosDBusService):
2094
__metaclass__ = AlternateDBusNamesMetaclass
2095
mandos_dbus_service = MandosDBusServiceTransitional()
1937
mandos_dbus_service = MandosDBusService()
2096
1938
2097
1939
def cleanup():
2098
1940
"Cleanup function; run on exit"
2124
1966
# Find out what port we got
2125
1967
service.port = tcp_server.socket.getsockname()[1]
2126
1968
if use_ipv6:
2127
logger.info("Now listening on address %r, port %d,"
1969
logger.info(u"Now listening on address %r, port %d,"
2128
1970
" flowinfo %d, scope_id %d"
2129
1971
% tcp_server.socket.getsockname())
2130
1972
else: # IPv4
2131
logger.info("Now listening on address %r, port %d"
1973
logger.info(u"Now listening on address %r, port %d"
2132
1974
% tcp_server.socket.getsockname())
2133
1975
2134
1976
#service.interface = tcp_server.socket.getsockname()[3]
2137
1979
# From the Avahi example code
2138
1980
try:
2139
1981
service.activate()
2140
except dbus.exceptions.DBusException as error:
2141
logger.critical("DBusException: %s", error)
1982
except dbus.exceptions.DBusException, error:
1983
logger.critical(u"DBusException: %s", error)
2142
1984
cleanup()
2143
1985
sys.exit(1)
2144
1986
# End of Avahi example code
2148
1990
(tcp_server.handle_request
2149
1991
(*args[2:], **kwargs) or True))
2150
1992
2151
logger.debug("Starting main loop")
1993
logger.debug(u"Starting main loop")
2152
1994
main_loop.run()
2153
except AvahiError as error:
2154
logger.critical("AvahiError: %s", error)
1995
except AvahiError, error:
1996
logger.critical(u"AvahiError: %s", error)
2155
1997
cleanup()
2156
1998
sys.exit(1)
2157
1999
except KeyboardInterrupt:
2158
2000
if debug:
2159
print("", file=sys.stderr)
2160
logger.debug("Server received KeyboardInterrupt")
2161
logger.debug("Server exiting")
2001
print >> sys.stderr
2002
logger.debug(u"Server received KeyboardInterrupt")
2003
logger.debug(u"Server exiting")
2162
2004
# Must run before the D-Bus bus name gets deregistered
2163
2005
cleanup()
2164
2006
2165
2166
2007
if __name__ == '__main__':
2167
2008
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0