To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 441
- compare with another revision
- download diff
- download tarball
- view history from revision 441
- Committer: Teddy Hogeborn
- Date: 2010-09-25 23:52:17 UTC
- Revision ID: teddy@fukt.bsnet.se-20100925235217-4hhqfryz1ste6uw3
* mandos (ClientDBus.__init__): Bug fix: Translate "-" in client names
to "_" in D-Bus object paths.
(MandosServer.handle_ipc): Bug fix: Send only address string to
D-Bus signal, not whole tuple.
* mandos-ctl: New options "--approve-by-default", "--deny-by-default",
"--approval-delay", and "--approval-duration".
* mandos-ctl.xml (SYNOPSIS, OPTIONS): Document new options.
* mandos-monitor (MandosClientWidget.update): Fix spelling.
to "_" in D-Bus object paths.
(MandosServer.handle_ipc): Bug fix: Send only address string to
D-Bus signal, not whole tuple.
* mandos-ctl: New options "--approve-by-default", "--deny-by-default",
"--approval-delay", and "--approval-duration".
* mandos-ctl.xml (SYNOPSIS, OPTIONS): Document new options.
* mandos-monitor (MandosClientWidget.update): Fix spelling.
- files removed:
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
31
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
36
import SocketServer as socketserver
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
62
61
import functools
63
62
import cPickle as pickle
64
63
import multiprocessing
65
import types
66
64
67
65
import dbus
68
66
import dbus.service
83
81
SO_BINDTODEVICE = None
84
82
85
83
86
version = "1.3.1"
84
version = "1.0.14"
87
85
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
90
88
syslogger = (logging.handlers.SysLogHandler
91
89
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
address = str("/dev/log")))
90
address = "/dev/log"))
93
91
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
96
94
logger.addHandler(syslogger)
97
95
98
96
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
102
100
logger.addHandler(console)
103
101
104
102
class AvahiError(Exception):
121
119
Attributes:
122
120
interface: integer; avahi.IF_UNSPEC or an interface index.
123
121
Used to optionally bind to the specified interface.
124
name: string; Example: 'Mandos'
125
type: string; Example: '_mandos._tcp'.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
126
124
See <http://www.dns-sd.org/ServiceTypes.html>
127
125
port: integer; what port to announce
128
126
TXT: list of strings; TXT record for the service
137
135
"""
138
136
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
139
137
servicetype = None, port = None, TXT = None,
140
domain = "", host = "", max_renames = 32768,
138
domain = u"", host = u"", max_renames = 32768,
141
139
protocol = avahi.PROTO_UNSPEC, bus = None):
142
140
self.interface = interface
143
141
self.name = name
152
150
self.group = None # our entry group
153
151
self.server = None
154
152
self.bus = bus
155
self.entry_group_state_changed_match = None
156
153
def rename(self):
157
154
"""Derived from the Avahi example code"""
158
155
if self.rename_count >= self.max_renames:
159
logger.critical("No suitable Zeroconf service name found"
160
" after %i retries, exiting.",
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
161
158
self.rename_count)
162
raise AvahiServiceError("Too many renames")
159
raise AvahiServiceError(u"Too many renames")
163
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
164
logger.info("Changing Zeroconf service name to %r ...",
161
logger.info(u"Changing Zeroconf service name to %r ...",
165
162
self.name)
166
163
syslogger.setFormatter(logging.Formatter
167
('Mandos (%s) [%%(process)d]:'
168
' %%(levelname)s: %%(message)s'
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
169
166
% self.name))
170
167
self.remove()
171
168
try:
172
169
self.add()
173
except dbus.exceptions.DBusException as error:
174
logger.critical("DBusException: %s", error)
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
175
172
self.cleanup()
176
173
os._exit(1)
177
174
self.rename_count += 1
178
175
def remove(self):
179
176
"""Derived from the Avahi example code"""
180
if self.entry_group_state_changed_match is not None:
181
self.entry_group_state_changed_match.remove()
182
self.entry_group_state_changed_match = None
183
177
if self.group is not None:
184
178
self.group.Reset()
185
179
def add(self):
186
180
"""Derived from the Avahi example code"""
187
self.remove()
188
181
if self.group is None:
189
182
self.group = dbus.Interface(
190
183
self.bus.get_object(avahi.DBUS_NAME,
191
184
self.server.EntryGroupNew()),
192
185
avahi.DBUS_INTERFACE_ENTRY_GROUP)
193
self.entry_group_state_changed_match = (
194
self.group.connect_to_signal(
195
'StateChanged', self .entry_group_state_changed))
196
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
186
self.group.connect_to_signal('StateChanged',
187
self
188
.entry_group_state_changed)
189
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
197
190
self.name, self.type)
198
191
self.group.AddService(
199
192
self.interface,
206
199
self.group.Commit()
207
200
def entry_group_state_changed(self, state, error):
208
201
"""Derived from the Avahi example code"""
209
logger.debug("Avahi entry group state change: %i", state)
202
logger.debug(u"Avahi entry group state change: %i", state)
210
203
211
204
if state == avahi.ENTRY_GROUP_ESTABLISHED:
212
logger.debug("Zeroconf service established.")
205
logger.debug(u"Zeroconf service established.")
213
206
elif state == avahi.ENTRY_GROUP_COLLISION:
214
logger.info("Zeroconf service name collision.")
207
logger.warning(u"Zeroconf service name collision.")
215
208
self.rename()
216
209
elif state == avahi.ENTRY_GROUP_FAILURE:
217
logger.critical("Avahi: Error in group state changed %s",
210
logger.critical(u"Avahi: Error in group state changed %s",
218
211
unicode(error))
219
raise AvahiGroupError("State changed: %s"
212
raise AvahiGroupError(u"State changed: %s"
220
213
% unicode(error))
221
214
def cleanup(self):
222
215
"""Derived from the Avahi example code"""
223
216
if self.group is not None:
224
try:
225
self.group.Free()
226
except (dbus.exceptions.UnknownMethodException,
227
dbus.exceptions.DBusException) as e:
228
pass
217
self.group.Free()
229
218
self.group = None
230
self.remove()
231
def server_state_changed(self, state, error=None):
219
def server_state_changed(self, state):
232
220
"""Derived from the Avahi example code"""
233
logger.debug("Avahi server state change: %i", state)
234
bad_states = { avahi.SERVER_INVALID:
235
"Zeroconf server invalid",
236
avahi.SERVER_REGISTERING: None,
237
avahi.SERVER_COLLISION:
238
"Zeroconf server name collision",
239
avahi.SERVER_FAILURE:
240
"Zeroconf server failure" }
241
if state in bad_states:
242
if bad_states[state] is not None:
243
if error is None:
244
logger.error(bad_states[state])
245
else:
246
logger.error(bad_states[state] + ": %r", error)
247
self.cleanup()
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
224
self.remove()
248
225
elif state == avahi.SERVER_RUNNING:
249
226
self.add()
250
else:
251
if error is None:
252
logger.debug("Unknown state: %r", state)
253
else:
254
logger.debug("Unknown state: %r: %r", state, error)
255
227
def activate(self):
256
228
"""Derived from the Avahi example code"""
257
229
if self.server is None:
258
230
self.server = dbus.Interface(
259
231
self.bus.get_object(avahi.DBUS_NAME,
260
avahi.DBUS_PATH_SERVER,
261
follow_name_owner_changes=True),
232
avahi.DBUS_PATH_SERVER),
262
233
avahi.DBUS_INTERFACE_SERVER)
263
self.server.connect_to_signal("StateChanged",
234
self.server.connect_to_signal(u"StateChanged",
264
235
self.server_state_changed)
265
236
self.server_state_changed(self.server.GetState())
266
237
267
238
268
def _timedelta_to_milliseconds(td):
269
"Convert a datetime.timedelta() to milliseconds"
270
return ((td.days * 24 * 60 * 60 * 1000)
271
+ (td.seconds * 1000)
272
+ (td.microseconds // 1000))
273
274
239
class Client(object):
275
240
"""A representation of a client host served by this server.
276
241
281
246
checker: subprocess.Popen(); a running checker process used
282
247
to see if the client lives.
283
248
'None' if no process is running.
284
checker_callback_tag: a gobject event source tag, or None
249
checker_callback_tag: - '' -
285
250
checker_command: string; External command which is run to check
286
251
if client lives. %() expansions are done at
287
252
runtime with vars(self) as dict, so that for
290
255
created: datetime.datetime(); (UTC) object creation
291
256
current_checker_command: string; current running checker_command
292
257
disable_hook: If set, called by disable() as disable_hook(self)
293
disable_initiator_tag: a gobject event source tag, or None
258
disable_initiator_tag: - '' -
294
259
enabled: bool()
295
260
fingerprint: string (40 or 32 hexadecimal digits); used to
296
261
uniquely identify the client
297
262
host: string; available for use by the checker command
298
263
interval: datetime.timedelta(); How often to start a new checker
299
last_approval_request: datetime.datetime(); (UTC) or None
300
264
last_checked_ok: datetime.datetime(); (UTC) or None
301
265
last_enabled: datetime.datetime(); (UTC)
302
266
name: string; from the config file, used in log messages and
304
268
secret: bytestring; sent verbatim (over TLS) to client
305
269
timeout: datetime.timedelta(); How long from last_checked_ok
306
270
until this client is disabled
307
extended_timeout: extra long timeout when password has been sent
308
271
runtime_expansions: Allowed attributes for runtime expansion.
309
expires: datetime.datetime(); time (UTC) when a client will be
310
disabled, or None
311
272
"""
312
273
313
runtime_expansions = ("approval_delay", "approval_duration",
314
"created", "enabled", "fingerprint",
315
"host", "interval", "last_checked_ok",
316
"last_enabled", "name", "timeout")
274
runtime_expansions = (u"approval_delay", u"approval_duration",
275
u"created", u"enabled", u"fingerprint",
276
u"host", u"interval", u"last_checked_ok",
277
u"last_enabled", u"name", u"timeout")
278
279
@staticmethod
280
def _timedelta_to_milliseconds(td):
281
"Convert a datetime.timedelta() to milliseconds"
282
return ((td.days * 24 * 60 * 60 * 1000)
283
+ (td.seconds * 1000)
284
+ (td.microseconds // 1000))
317
285
318
286
def timeout_milliseconds(self):
319
287
"Return the 'timeout' attribute in milliseconds"
320
return _timedelta_to_milliseconds(self.timeout)
321
322
def extended_timeout_milliseconds(self):
323
"Return the 'extended_timeout' attribute in milliseconds"
324
return _timedelta_to_milliseconds(self.extended_timeout)
288
return self._timedelta_to_milliseconds(self.timeout)
325
289
326
290
def interval_milliseconds(self):
327
291
"Return the 'interval' attribute in milliseconds"
328
return _timedelta_to_milliseconds(self.interval)
329
292
return self._timedelta_to_milliseconds(self.interval)
293
330
294
def approval_delay_milliseconds(self):
331
return _timedelta_to_milliseconds(self.approval_delay)
295
return self._timedelta_to_milliseconds(self.approval_delay)
332
296
333
297
def __init__(self, name = None, disable_hook=None, config=None):
334
298
"""Note: the 'checker' key in 'config' sets the
337
301
self.name = name
338
302
if config is None:
339
303
config = {}
340
logger.debug("Creating client %r", self.name)
304
logger.debug(u"Creating client %r", self.name)
341
305
# Uppercase and remove spaces from fingerprint for later
342
306
# comparison purposes with return value from the fingerprint()
343
307
# function
344
self.fingerprint = (config["fingerprint"].upper()
345
.replace(" ", ""))
346
logger.debug(" Fingerprint: %s", self.fingerprint)
347
if "secret" in config:
348
self.secret = config["secret"].decode("base64")
349
elif "secfile" in config:
308
self.fingerprint = (config[u"fingerprint"].upper()
309
.replace(u" ", u""))
310
logger.debug(u" Fingerprint: %s", self.fingerprint)
311
if u"secret" in config:
312
self.secret = config[u"secret"].decode(u"base64")
313
elif u"secfile" in config:
350
314
with open(os.path.expanduser(os.path.expandvars
351
(config["secfile"])),
315
(config[u"secfile"])),
352
316
"rb") as secfile:
353
317
self.secret = secfile.read()
354
318
else:
355
raise TypeError("No secret or secfile for client %s"
319
raise TypeError(u"No secret or secfile for client %s"
356
320
% self.name)
357
self.host = config.get("host", "")
321
self.host = config.get(u"host", u"")
358
322
self.created = datetime.datetime.utcnow()
359
323
self.enabled = False
360
self.last_approval_request = None
361
324
self.last_enabled = None
362
325
self.last_checked_ok = None
363
self.timeout = string_to_delta(config["timeout"])
364
self.extended_timeout = string_to_delta(config["extended_timeout"])
365
self.interval = string_to_delta(config["interval"])
326
self.timeout = string_to_delta(config[u"timeout"])
327
self.interval = string_to_delta(config[u"interval"])
366
328
self.disable_hook = disable_hook
367
329
self.checker = None
368
330
self.checker_initiator_tag = None
369
331
self.disable_initiator_tag = None
370
self.expires = None
371
332
self.checker_callback_tag = None
372
self.checker_command = config["checker"]
333
self.checker_command = config[u"checker"]
373
334
self.current_checker_command = None
374
335
self.last_connect = None
375
336
self._approved = None
376
self.approved_by_default = config.get("approved_by_default",
337
self.approved_by_default = config.get(u"approved_by_default",
377
338
True)
378
339
self.approvals_pending = 0
379
340
self.approval_delay = string_to_delta(
380
config["approval_delay"])
341
config[u"approval_delay"])
381
342
self.approval_duration = string_to_delta(
382
config["approval_duration"])
343
config[u"approval_duration"])
383
344
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
384
345
385
346
def send_changedstate(self):
389
350
390
351
def enable(self):
391
352
"""Start this client's checker and timeout hooks"""
392
if getattr(self, "enabled", False):
353
if getattr(self, u"enabled", False):
393
354
# Already enabled
394
355
return
395
356
self.send_changedstate()
357
self.last_enabled = datetime.datetime.utcnow()
396
358
# Schedule a new checker to be started an 'interval' from now,
397
359
# and every interval from then on.
398
360
self.checker_initiator_tag = (gobject.timeout_add
399
361
(self.interval_milliseconds(),
400
362
self.start_checker))
401
363
# Schedule a disable() when 'timeout' has passed
402
self.expires = datetime.datetime.utcnow() + self.timeout
403
364
self.disable_initiator_tag = (gobject.timeout_add
404
365
(self.timeout_milliseconds(),
405
366
self.disable))
406
367
self.enabled = True
407
self.last_enabled = datetime.datetime.utcnow()
408
368
# Also start a new checker *right now*.
409
369
self.start_checker()
410
370
415
375
if not quiet:
416
376
self.send_changedstate()
417
377
if not quiet:
418
logger.info("Disabling client %s", self.name)
419
if getattr(self, "disable_initiator_tag", False):
378
logger.info(u"Disabling client %s", self.name)
379
if getattr(self, u"disable_initiator_tag", False):
420
380
gobject.source_remove(self.disable_initiator_tag)
421
381
self.disable_initiator_tag = None
422
self.expires = None
423
if getattr(self, "checker_initiator_tag", False):
382
if getattr(self, u"checker_initiator_tag", False):
424
383
gobject.source_remove(self.checker_initiator_tag)
425
384
self.checker_initiator_tag = None
426
385
self.stop_checker()
441
400
if os.WIFEXITED(condition):
442
401
exitstatus = os.WEXITSTATUS(condition)
443
402
if exitstatus == 0:
444
logger.info("Checker for %(name)s succeeded",
403
logger.info(u"Checker for %(name)s succeeded",
445
404
vars(self))
446
405
self.checked_ok()
447
406
else:
448
logger.info("Checker for %(name)s failed",
407
logger.info(u"Checker for %(name)s failed",
449
408
vars(self))
450
409
else:
451
logger.warning("Checker for %(name)s crashed?",
410
logger.warning(u"Checker for %(name)s crashed?",
452
411
vars(self))
453
412
454
def checked_ok(self, timeout=None):
413
def checked_ok(self):
455
414
"""Bump up the timeout for this client.
456
415
457
416
This should only be called when the client has been seen,
458
417
alive and well.
459
418
"""
460
if timeout is None:
461
timeout = self.timeout
462
419
self.last_checked_ok = datetime.datetime.utcnow()
463
420
gobject.source_remove(self.disable_initiator_tag)
464
self.expires = datetime.datetime.utcnow() + timeout
465
421
self.disable_initiator_tag = (gobject.timeout_add
466
(_timedelta_to_milliseconds(timeout),
422
(self.timeout_milliseconds(),
467
423
self.disable))
468
424
469
def need_approval(self):
470
self.last_approval_request = datetime.datetime.utcnow()
471
472
425
def start_checker(self):
473
426
"""Start a new checker subprocess if one is not running.
474
427
486
439
# If a checker exists, make sure it is not a zombie
487
440
try:
488
441
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
489
except (AttributeError, OSError) as error:
442
except (AttributeError, OSError), error:
490
443
if (isinstance(error, OSError)
491
444
and error.errno != errno.ECHILD):
492
445
raise error
493
446
else:
494
447
if pid:
495
logger.warning("Checker was a zombie")
448
logger.warning(u"Checker was a zombie")
496
449
gobject.source_remove(self.checker_callback_tag)
497
450
self.checker_callback(pid, status,
498
451
self.current_checker_command)
505
458
# Escape attributes for the shell
506
459
escaped_attrs = dict(
507
460
(attr,
508
re.escape(unicode(str(getattr(self, attr, "")),
461
re.escape(unicode(str(getattr(self, attr, u"")),
509
462
errors=
510
'replace')))
463
u'replace')))
511
464
for attr in
512
465
self.runtime_expansions)
513
466
514
467
try:
515
468
command = self.checker_command % escaped_attrs
516
except TypeError as error:
517
logger.error('Could not format string "%s":'
518
' %s', self.checker_command, error)
469
except TypeError, error:
470
logger.error(u'Could not format string "%s":'
471
u' %s', self.checker_command, error)
519
472
return True # Try again later
520
473
self.current_checker_command = command
521
474
try:
522
logger.info("Starting checker %r for %s",
475
logger.info(u"Starting checker %r for %s",
523
476
command, self.name)
524
477
# We don't need to redirect stdout and stderr, since
525
478
# in normal mode, that is already done by daemon(),
527
480
# always replaced by /dev/null.)
528
481
self.checker = subprocess.Popen(command,
529
482
close_fds=True,
530
shell=True, cwd="/")
483
shell=True, cwd=u"/")
531
484
self.checker_callback_tag = (gobject.child_watch_add
532
485
(self.checker.pid,
533
486
self.checker_callback,
538
491
if pid:
539
492
gobject.source_remove(self.checker_callback_tag)
540
493
self.checker_callback(pid, status, command)
541
except OSError as error:
542
logger.error("Failed to start subprocess: %s",
494
except OSError, error:
495
logger.error(u"Failed to start subprocess: %s",
543
496
error)
544
497
# Re-run this periodically if run by gobject.timeout_add
545
498
return True
549
502
if self.checker_callback_tag:
550
503
gobject.source_remove(self.checker_callback_tag)
551
504
self.checker_callback_tag = None
552
if getattr(self, "checker", None) is None:
505
if getattr(self, u"checker", None) is None:
553
506
return
554
logger.debug("Stopping checker for %(name)s", vars(self))
507
logger.debug(u"Stopping checker for %(name)s", vars(self))
555
508
try:
556
509
os.kill(self.checker.pid, signal.SIGTERM)
557
510
#time.sleep(0.5)
558
511
#if self.checker.poll() is None:
559
512
# os.kill(self.checker.pid, signal.SIGKILL)
560
except OSError as error:
513
except OSError, error:
561
514
if error.errno != errno.ESRCH: # No such process
562
515
raise
563
516
self.checker = None
564
517
565
566
def dbus_service_property(dbus_interface, signature="v",
567
access="readwrite", byte_arrays=False):
518
def dbus_service_property(dbus_interface, signature=u"v",
519
access=u"readwrite", byte_arrays=False):
568
520
"""Decorators for marking methods of a DBusObjectWithProperties to
569
521
become properties on the D-Bus.
570
522
577
529
"""
578
530
# Encoding deeply encoded byte arrays is not supported yet by the
579
531
# "Set" method, so we fail early here:
580
if byte_arrays and signature != "ay":
581
raise ValueError("Byte arrays not supported for non-'ay'"
582
" signature %r" % signature)
532
if byte_arrays and signature != u"ay":
533
raise ValueError(u"Byte arrays not supported for non-'ay'"
534
u" signature %r" % signature)
583
535
def decorator(func):
584
536
func._dbus_is_property = True
585
537
func._dbus_interface = dbus_interface
586
538
func._dbus_signature = signature
587
539
func._dbus_access = access
588
540
func._dbus_name = func.__name__
589
if func._dbus_name.endswith("_dbus_property"):
541
if func._dbus_name.endswith(u"_dbus_property"):
590
542
func._dbus_name = func._dbus_name[:-14]
591
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
543
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
592
544
return func
593
545
return decorator
594
546
614
566
615
567
class DBusObjectWithProperties(dbus.service.Object):
616
568
"""A D-Bus object with properties.
617
569
618
570
Classes inheriting from this can use the dbus_service_property
619
571
decorator to expose methods as D-Bus properties. It exposes the
620
572
standard Get(), Set(), and GetAll() methods on the D-Bus.
622
574
623
575
@staticmethod
624
576
def _is_dbus_property(obj):
625
return getattr(obj, "_dbus_is_property", False)
577
return getattr(obj, u"_dbus_is_property", False)
626
578
627
579
def _get_all_dbus_properties(self):
628
580
"""Returns a generator of (name, attribute) pairs
629
581
"""
630
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
631
for cls in self.__class__.__mro__
632
for name, prop in inspect.getmembers(cls, self._is_dbus_property))
582
return ((prop._dbus_name, prop)
583
for name, prop in
584
inspect.getmembers(self, self._is_dbus_property))
633
585
634
586
def _get_dbus_property(self, interface_name, property_name):
635
587
"""Returns a bound method if one exists which is a D-Bus
636
588
property with the specified name and interface.
637
589
"""
638
for cls in self.__class__.__mro__:
639
for name, value in inspect.getmembers(cls, self._is_dbus_property):
640
if value._dbus_name == property_name and value._dbus_interface == interface_name:
641
return value.__get__(self)
642
590
for name in (property_name,
591
property_name + u"_dbus_property"):
592
prop = getattr(self, name, None)
593
if (prop is None
594
or not self._is_dbus_property(prop)
595
or prop._dbus_name != property_name
596
or (interface_name and prop._dbus_interface
597
and interface_name != prop._dbus_interface)):
598
continue
599
return prop
643
600
# No such property
644
raise DBusPropertyNotFound(self.dbus_object_path + ":"
645
+ interface_name + "."
601
raise DBusPropertyNotFound(self.dbus_object_path + u":"
602
+ interface_name + u"."
646
603
+ property_name)
647
648
604
649
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
650
out_signature="v")
605
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
606
out_signature=u"v")
651
607
def Get(self, interface_name, property_name):
652
608
"""Standard D-Bus property Get() method, see D-Bus standard.
653
609
"""
654
610
prop = self._get_dbus_property(interface_name, property_name)
655
if prop._dbus_access == "write":
611
if prop._dbus_access == u"write":
656
612
raise DBusPropertyAccessException(property_name)
657
613
value = prop()
658
if not hasattr(value, "variant_level"):
614
if not hasattr(value, u"variant_level"):
659
615
return value
660
616
return type(value)(value, variant_level=value.variant_level+1)
661
617
662
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
618
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
663
619
def Set(self, interface_name, property_name, value):
664
620
"""Standard D-Bus property Set() method, see D-Bus standard.
665
621
"""
666
622
prop = self._get_dbus_property(interface_name, property_name)
667
if prop._dbus_access == "read":
623
if prop._dbus_access == u"read":
668
624
raise DBusPropertyAccessException(property_name)
669
if prop._dbus_get_args_options["byte_arrays"]:
625
if prop._dbus_get_args_options[u"byte_arrays"]:
670
626
# The byte_arrays option is not supported yet on
671
627
# signatures other than "ay".
672
if prop._dbus_signature != "ay":
628
if prop._dbus_signature != u"ay":
673
629
raise ValueError
674
630
value = dbus.ByteArray(''.join(unichr(byte)
675
631
for byte in value))
676
632
prop(value)
677
633
678
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
679
out_signature="a{sv}")
634
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
635
out_signature=u"a{sv}")
680
636
def GetAll(self, interface_name):
681
637
"""Standard D-Bus property GetAll() method, see D-Bus
682
638
standard.
683
639
684
640
Note: Will not include properties with access="write".
685
641
"""
686
642
all = {}
690
646
# Interface non-empty but did not match
691
647
continue
692
648
# Ignore write-only properties
693
if prop._dbus_access == "write":
649
if prop._dbus_access == u"write":
694
650
continue
695
651
value = prop()
696
if not hasattr(value, "variant_level"):
652
if not hasattr(value, u"variant_level"):
697
653
all[name] = value
698
654
continue
699
655
all[name] = type(value)(value, variant_level=
700
656
value.variant_level+1)
701
return dbus.Dictionary(all, signature="sv")
657
return dbus.Dictionary(all, signature=u"sv")
702
658
703
659
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
704
out_signature="s",
660
out_signature=u"s",
705
661
path_keyword='object_path',
706
662
connection_keyword='connection')
707
663
def Introspect(self, object_path, connection):
712
668
try:
713
669
document = xml.dom.minidom.parseString(xmlstring)
714
670
def make_tag(document, name, prop):
715
e = document.createElement("property")
716
e.setAttribute("name", name)
717
e.setAttribute("type", prop._dbus_signature)
718
e.setAttribute("access", prop._dbus_access)
671
e = document.createElement(u"property")
672
e.setAttribute(u"name", name)
673
e.setAttribute(u"type", prop._dbus_signature)
674
e.setAttribute(u"access", prop._dbus_access)
719
675
return e
720
for if_tag in document.getElementsByTagName("interface"):
676
for if_tag in document.getElementsByTagName(u"interface"):
721
677
for tag in (make_tag(document, name, prop)
722
678
for name, prop
723
679
in self._get_all_dbus_properties()
724
680
if prop._dbus_interface
725
== if_tag.getAttribute("name")):
681
== if_tag.getAttribute(u"name")):
726
682
if_tag.appendChild(tag)
727
683
# Add the names to the return values for the
728
684
# "org.freedesktop.DBus.Properties" methods
729
if (if_tag.getAttribute("name")
730
== "org.freedesktop.DBus.Properties"):
731
for cn in if_tag.getElementsByTagName("method"):
732
if cn.getAttribute("name") == "Get":
733
for arg in cn.getElementsByTagName("arg"):
734
if (arg.getAttribute("direction")
735
== "out"):
736
arg.setAttribute("name", "value")
737
elif cn.getAttribute("name") == "GetAll":
738
for arg in cn.getElementsByTagName("arg"):
739
if (arg.getAttribute("direction")
740
== "out"):
741
arg.setAttribute("name", "props")
742
xmlstring = document.toxml("utf-8")
685
if (if_tag.getAttribute(u"name")
686
== u"org.freedesktop.DBus.Properties"):
687
for cn in if_tag.getElementsByTagName(u"method"):
688
if cn.getAttribute(u"name") == u"Get":
689
for arg in cn.getElementsByTagName(u"arg"):
690
if (arg.getAttribute(u"direction")
691
== u"out"):
692
arg.setAttribute(u"name", u"value")
693
elif cn.getAttribute(u"name") == u"GetAll":
694
for arg in cn.getElementsByTagName(u"arg"):
695
if (arg.getAttribute(u"direction")
696
== u"out"):
697
arg.setAttribute(u"name", u"props")
698
xmlstring = document.toxml(u"utf-8")
743
699
document.unlink()
744
700
except (AttributeError, xml.dom.DOMException,
745
xml.parsers.expat.ExpatError) as error:
746
logger.error("Failed to override Introspection method",
701
xml.parsers.expat.ExpatError), error:
702
logger.error(u"Failed to override Introspection method",
747
703
error)
748
704
return xmlstring
749
705
750
706
751
def datetime_to_dbus (dt, variant_level=0):
752
"""Convert a UTC datetime.datetime() to a D-Bus type."""
753
if dt is None:
754
return dbus.String("", variant_level = variant_level)
755
return dbus.String(dt.isoformat(),
756
variant_level=variant_level)
757
758
class transitional_dbus_metaclass(DBusObjectWithProperties.__metaclass__):
759
def __new__(mcs, name, bases, attr):
760
for attrname, old_dbusobj in inspect.getmembers(bases[0]):
761
new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")
762
if (getattr(old_dbusobj, "_dbus_is_signal", False)
763
and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):
764
unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,
765
old_dbusobj.__closure__))["func"].cell_contents
766
newfunc = types.FunctionType(unwrappedfunc.func_code,
767
unwrappedfunc.func_globals,
768
unwrappedfunc.func_name,
769
unwrappedfunc.func_defaults,
770
unwrappedfunc.func_closure)
771
new_dbusfunc = dbus.service.signal(
772
new_interface, old_dbusobj._dbus_signature)(newfunc)
773
attr["_transitional_" + attrname] = new_dbusfunc
774
775
def fixscope(func1, func2):
776
def newcall(*args, **kwargs):
777
func1(*args, **kwargs)
778
func2(*args, **kwargs)
779
return newcall
780
781
attr[attrname] = fixscope(old_dbusobj, new_dbusfunc)
782
783
elif (getattr(old_dbusobj, "_dbus_is_method", False)
784
and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):
785
new_dbusfunc = (dbus.service.method
786
(new_interface,
787
old_dbusobj._dbus_in_signature,
788
old_dbusobj._dbus_out_signature)
789
(types.FunctionType
790
(old_dbusobj.func_code,
791
old_dbusobj.func_globals,
792
old_dbusobj.func_name,
793
old_dbusobj.func_defaults,
794
old_dbusobj.func_closure)))
795
796
attr[attrname] = new_dbusfunc
797
elif (getattr(old_dbusobj, "_dbus_is_property", False)
798
and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):
799
new_dbusfunc = (dbus_service_property
800
(new_interface,
801
old_dbusobj._dbus_signature,
802
old_dbusobj._dbus_access,
803
old_dbusobj._dbus_get_args_options["byte_arrays"])
804
(types.FunctionType
805
(old_dbusobj.func_code,
806
old_dbusobj.func_globals,
807
old_dbusobj.func_name,
808
old_dbusobj.func_defaults,
809
old_dbusobj.func_closure)))
810
811
attr[attrname] = new_dbusfunc
812
return type.__new__(mcs, name, bases, attr)
813
814
707
class ClientDBus(Client, DBusObjectWithProperties):
815
708
"""A Client class using D-Bus
816
709
820
713
"""
821
714
822
715
runtime_expansions = (Client.runtime_expansions
823
+ ("dbus_object_path",))
716
+ (u"dbus_object_path",))
824
717
825
718
# dbus.service.Object doesn't use super(), so we can't either.
826
719
831
724
# Only now, when this client is initialized, can it show up on
832
725
# the D-Bus
833
726
client_object_name = unicode(self.name).translate(
834
{ord("."): ord("_"),
835
ord("-"): ord("_")})
727
{ord(u"."): ord(u"_"),
728
ord(u"-"): ord(u"_")})
836
729
self.dbus_object_path = (dbus.ObjectPath
837
("/clients/" + client_object_name))
730
(u"/clients/" + client_object_name))
838
731
DBusObjectWithProperties.__init__(self, self.bus,
839
732
self.dbus_object_path)
840
733
841
def notifychangeproperty(transform_func,
842
dbus_name, type_func=lambda x: x,
843
variant_level=1):
844
""" Modify a variable so that its a property that announce its
845
changes to DBus.
846
transform_fun: Function that takes a value and transform it to
847
DBus type.
848
dbus_name: DBus name of the variable
849
type_func: Function that transform the value before sending it
850
to DBus
851
variant_level: DBus variant level. default: 1
852
"""
853
real_value = [None,]
854
def setter(self, value):
855
old_value = real_value[0]
856
real_value[0] = value
857
if hasattr(self, "dbus_object_path"):
858
if type_func(old_value) != type_func(real_value[0]):
859
dbus_value = transform_func(type_func(real_value[0]),
860
variant_level)
861
self.PropertyChanged(dbus.String(dbus_name),
862
dbus_value)
863
864
return property(lambda self: real_value[0], setter)
865
866
867
expires = notifychangeproperty(datetime_to_dbus, "Expires")
868
approvals_pending = notifychangeproperty(dbus.Boolean,
869
"ApprovalPending",
870
type_func = bool)
871
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
872
last_enabled = notifychangeproperty(datetime_to_dbus,
873
"LastEnabled")
874
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
875
type_func = lambda checker: checker is not None)
876
last_checked_ok = notifychangeproperty(datetime_to_dbus,
877
"LastCheckedOK")
878
last_approval_request = notifychangeproperty(datetime_to_dbus,
879
"LastApprovalRequest")
880
approved_by_default = notifychangeproperty(dbus.Boolean,
881
"ApprovedByDefault")
882
approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",
883
type_func = _timedelta_to_milliseconds)
884
approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",
885
type_func = _timedelta_to_milliseconds)
886
host = notifychangeproperty(dbus.String, "Host")
887
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
888
type_func = _timedelta_to_milliseconds)
889
extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",
890
type_func = _timedelta_to_milliseconds)
891
interval = notifychangeproperty(dbus.UInt16, "Interval",
892
type_func = _timedelta_to_milliseconds)
893
checker_command = notifychangeproperty(dbus.String, "Checker")
894
895
del notifychangeproperty
734
def _get_approvals_pending(self):
735
return self._approvals_pending
736
def _set_approvals_pending(self, value):
737
old_value = self._approvals_pending
738
self._approvals_pending = value
739
bval = bool(value)
740
if (hasattr(self, "dbus_object_path")
741
and bval is not bool(old_value)):
742
dbus_bool = dbus.Boolean(bval, variant_level=1)
743
self.PropertyChanged(dbus.String(u"ApprovalPending"),
744
dbus_bool)
745
746
approvals_pending = property(_get_approvals_pending,
747
_set_approvals_pending)
748
del _get_approvals_pending, _set_approvals_pending
749
750
@staticmethod
751
def _datetime_to_dbus(dt, variant_level=0):
752
"""Convert a UTC datetime.datetime() to a D-Bus type."""
753
return dbus.String(dt.isoformat(),
754
variant_level=variant_level)
755
756
def enable(self):
757
oldstate = getattr(self, u"enabled", False)
758
r = Client.enable(self)
759
if oldstate != self.enabled:
760
# Emit D-Bus signals
761
self.PropertyChanged(dbus.String(u"Enabled"),
762
dbus.Boolean(True, variant_level=1))
763
self.PropertyChanged(
764
dbus.String(u"LastEnabled"),
765
self._datetime_to_dbus(self.last_enabled,
766
variant_level=1))
767
return r
768
769
def disable(self, quiet = False):
770
oldstate = getattr(self, u"enabled", False)
771
r = Client.disable(self, quiet=quiet)
772
if not quiet and oldstate != self.enabled:
773
# Emit D-Bus signal
774
self.PropertyChanged(dbus.String(u"Enabled"),
775
dbus.Boolean(False, variant_level=1))
776
return r
896
777
897
778
def __del__(self, *args, **kwargs):
898
779
try:
899
780
self.remove_from_connection()
900
781
except LookupError:
901
782
pass
902
if hasattr(DBusObjectWithProperties, "__del__"):
783
if hasattr(DBusObjectWithProperties, u"__del__"):
903
784
DBusObjectWithProperties.__del__(self, *args, **kwargs)
904
785
Client.__del__(self, *args, **kwargs)
905
786
907
788
*args, **kwargs):
908
789
self.checker_callback_tag = None
909
790
self.checker = None
791
# Emit D-Bus signal
792
self.PropertyChanged(dbus.String(u"CheckerRunning"),
793
dbus.Boolean(False, variant_level=1))
910
794
if os.WIFEXITED(condition):
911
795
exitstatus = os.WEXITSTATUS(condition)
912
796
# Emit D-Bus signal
922
806
return Client.checker_callback(self, pid, condition, command,
923
807
*args, **kwargs)
924
808
809
def checked_ok(self, *args, **kwargs):
810
r = Client.checked_ok(self, *args, **kwargs)
811
# Emit D-Bus signal
812
self.PropertyChanged(
813
dbus.String(u"LastCheckedOK"),
814
(self._datetime_to_dbus(self.last_checked_ok,
815
variant_level=1)))
816
return r
817
925
818
def start_checker(self, *args, **kwargs):
926
819
old_checker = self.checker
927
820
if self.checker is not None:
934
827
and old_checker_pid != self.checker.pid):
935
828
# Emit D-Bus signal
936
829
self.CheckerStarted(self.current_checker_command)
830
self.PropertyChanged(
831
dbus.String(u"CheckerRunning"),
832
dbus.Boolean(True, variant_level=1))
937
833
return r
938
834
835
def stop_checker(self, *args, **kwargs):
836
old_checker = getattr(self, u"checker", None)
837
r = Client.stop_checker(self, *args, **kwargs)
838
if (old_checker is not None
839
and getattr(self, u"checker", None) is None):
840
self.PropertyChanged(dbus.String(u"CheckerRunning"),
841
dbus.Boolean(False, variant_level=1))
842
return r
843
939
844
def _reset_approved(self):
940
845
self._approved = None
941
846
return False
943
848
def approve(self, value=True):
944
849
self.send_changedstate()
945
850
self._approved = value
946
gobject.timeout_add(_timedelta_to_milliseconds
851
gobject.timeout_add(self._timedelta_to_milliseconds
947
852
(self.approval_duration),
948
853
self._reset_approved)
949
854
950
855
951
856
## D-Bus methods, signals & properties
952
_interface = "se.bsnet.fukt.Mandos.Client"
953
857
_interface = u"se.bsnet.fukt.Mandos.Client"
858
954
859
## Signals
955
860
956
861
# CheckerCompleted - signal
957
@dbus.service.signal(_interface, signature="nxs")
862
@dbus.service.signal(_interface, signature=u"nxs")
958
863
def CheckerCompleted(self, exitcode, waitstatus, command):
959
864
"D-Bus signal"
960
865
pass
961
866
962
867
# CheckerStarted - signal
963
@dbus.service.signal(_interface, signature="s")
868
@dbus.service.signal(_interface, signature=u"s")
964
869
def CheckerStarted(self, command):
965
870
"D-Bus signal"
966
871
pass
967
872
968
873
# PropertyChanged - signal
969
@dbus.service.signal(_interface, signature="sv")
874
@dbus.service.signal(_interface, signature=u"sv")
970
875
def PropertyChanged(self, property, value):
971
876
"D-Bus signal"
972
877
pass
981
886
pass
982
887
983
888
# Rejected - signal
984
@dbus.service.signal(_interface, signature="s")
889
@dbus.service.signal(_interface, signature=u"s")
985
890
def Rejected(self, reason):
986
891
"D-Bus signal"
987
892
pass
988
893
989
894
# NeedApproval - signal
990
@dbus.service.signal(_interface, signature="tb")
895
@dbus.service.signal(_interface, signature=u"tb")
991
896
def NeedApproval(self, timeout, default):
992
897
"D-Bus signal"
993
return self.need_approval()
898
pass
994
899
995
900
## Methods
996
901
997
902
# Approve - method
998
@dbus.service.method(_interface, in_signature="b")
903
@dbus.service.method(_interface, in_signature=u"b")
999
904
def Approve(self, value):
1000
905
self.approve(value)
1001
906
1002
907
# CheckedOK - method
1003
908
@dbus.service.method(_interface)
1004
909
def CheckedOK(self):
1005
self.checked_ok()
910
return self.checked_ok()
1006
911
1007
912
# Enable - method
1008
913
@dbus.service.method(_interface)
1030
935
## Properties
1031
936
1032
937
# ApprovalPending - property
1033
@dbus_service_property(_interface, signature="b", access="read")
938
@dbus_service_property(_interface, signature=u"b", access=u"read")
1034
939
def ApprovalPending_dbus_property(self):
1035
940
return dbus.Boolean(bool(self.approvals_pending))
1036
941
1037
942
# ApprovedByDefault - property
1038
@dbus_service_property(_interface, signature="b",
1039
access="readwrite")
943
@dbus_service_property(_interface, signature=u"b",
944
access=u"readwrite")
1040
945
def ApprovedByDefault_dbus_property(self, value=None):
1041
946
if value is None: # get
1042
947
return dbus.Boolean(self.approved_by_default)
1043
948
self.approved_by_default = bool(value)
949
# Emit D-Bus signal
950
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
951
dbus.Boolean(value, variant_level=1))
1044
952
1045
953
# ApprovalDelay - property
1046
@dbus_service_property(_interface, signature="t",
1047
access="readwrite")
954
@dbus_service_property(_interface, signature=u"t",
955
access=u"readwrite")
1048
956
def ApprovalDelay_dbus_property(self, value=None):
1049
957
if value is None: # get
1050
958
return dbus.UInt64(self.approval_delay_milliseconds())
1051
959
self.approval_delay = datetime.timedelta(0, 0, 0, value)
960
# Emit D-Bus signal
961
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
962
dbus.UInt64(value, variant_level=1))
1052
963
1053
964
# ApprovalDuration - property
1054
@dbus_service_property(_interface, signature="t",
1055
access="readwrite")
965
@dbus_service_property(_interface, signature=u"t",
966
access=u"readwrite")
1056
967
def ApprovalDuration_dbus_property(self, value=None):
1057
968
if value is None: # get
1058
return dbus.UInt64(_timedelta_to_milliseconds(
969
return dbus.UInt64(self._timedelta_to_milliseconds(
1059
970
self.approval_duration))
1060
971
self.approval_duration = datetime.timedelta(0, 0, 0, value)
972
# Emit D-Bus signal
973
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
974
dbus.UInt64(value, variant_level=1))
1061
975
1062
976
# Name - property
1063
@dbus_service_property(_interface, signature="s", access="read")
977
@dbus_service_property(_interface, signature=u"s", access=u"read")
1064
978
def Name_dbus_property(self):
1065
979
return dbus.String(self.name)
1066
980
1067
981
# Fingerprint - property
1068
@dbus_service_property(_interface, signature="s", access="read")
982
@dbus_service_property(_interface, signature=u"s", access=u"read")
1069
983
def Fingerprint_dbus_property(self):
1070
984
return dbus.String(self.fingerprint)
1071
985
1072
986
# Host - property
1073
@dbus_service_property(_interface, signature="s",
1074
access="readwrite")
987
@dbus_service_property(_interface, signature=u"s",
988
access=u"readwrite")
1075
989
def Host_dbus_property(self, value=None):
1076
990
if value is None: # get
1077
991
return dbus.String(self.host)
1078
992
self.host = value
993
# Emit D-Bus signal
994
self.PropertyChanged(dbus.String(u"Host"),
995
dbus.String(value, variant_level=1))
1079
996
1080
997
# Created - property
1081
@dbus_service_property(_interface, signature="s", access="read")
998
@dbus_service_property(_interface, signature=u"s", access=u"read")
1082
999
def Created_dbus_property(self):
1083
return dbus.String(datetime_to_dbus(self.created))
1000
return dbus.String(self._datetime_to_dbus(self.created))
1084
1001
1085
1002
# LastEnabled - property
1086
@dbus_service_property(_interface, signature="s", access="read")
1003
@dbus_service_property(_interface, signature=u"s", access=u"read")
1087
1004
def LastEnabled_dbus_property(self):
1088
return datetime_to_dbus(self.last_enabled)
1005
if self.last_enabled is None:
1006
return dbus.String(u"")
1007
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1089
1008
1090
1009
# Enabled - property
1091
@dbus_service_property(_interface, signature="b",
1092
access="readwrite")
1010
@dbus_service_property(_interface, signature=u"b",
1011
access=u"readwrite")
1093
1012
def Enabled_dbus_property(self, value=None):
1094
1013
if value is None: # get
1095
1014
return dbus.Boolean(self.enabled)
1099
1018
self.disable()
1100
1019
1101
1020
# LastCheckedOK - property
1102
@dbus_service_property(_interface, signature="s",
1103
access="readwrite")
1021
@dbus_service_property(_interface, signature=u"s",
1022
access=u"readwrite")
1104
1023
def LastCheckedOK_dbus_property(self, value=None):
1105
1024
if value is not None:
1106
1025
self.checked_ok()
1107
1026
return
1108
return datetime_to_dbus(self.last_checked_ok)
1109
1110
# Expires - property
1111
@dbus_service_property(_interface, signature="s", access="read")
1112
def Expires_dbus_property(self):
1113
return datetime_to_dbus(self.expires)
1114
1115
# LastApprovalRequest - property
1116
@dbus_service_property(_interface, signature="s", access="read")
1117
def LastApprovalRequest_dbus_property(self):
1118
return datetime_to_dbus(self.last_approval_request)
1027
if self.last_checked_ok is None:
1028
return dbus.String(u"")
1029
return dbus.String(self._datetime_to_dbus(self
1030
.last_checked_ok))
1119
1031
1120
1032
# Timeout - property
1121
@dbus_service_property(_interface, signature="t",
1122
access="readwrite")
1033
@dbus_service_property(_interface, signature=u"t",
1034
access=u"readwrite")
1123
1035
def Timeout_dbus_property(self, value=None):
1124
1036
if value is None: # get
1125
1037
return dbus.UInt64(self.timeout_milliseconds())
1126
1038
self.timeout = datetime.timedelta(0, 0, 0, value)
1127
if getattr(self, "disable_initiator_tag", None) is None:
1039
# Emit D-Bus signal
1040
self.PropertyChanged(dbus.String(u"Timeout"),
1041
dbus.UInt64(value, variant_level=1))
1042
if getattr(self, u"disable_initiator_tag", None) is None:
1128
1043
return
1129
1044
# Reschedule timeout
1130
1045
gobject.source_remove(self.disable_initiator_tag)
1131
1046
self.disable_initiator_tag = None
1132
self.expires = None
1133
1047
time_to_die = (self.
1134
1048
_timedelta_to_milliseconds((self
1135
1049
.last_checked_ok
1140
1054
# The timeout has passed
1141
1055
self.disable()
1142
1056
else:
1143
self.expires = (datetime.datetime.utcnow()
1144
+ datetime.timedelta(milliseconds = time_to_die))
1145
1057
self.disable_initiator_tag = (gobject.timeout_add
1146
1058
(time_to_die, self.disable))
1147
1059
1148
# ExtendedTimeout - property
1149
@dbus_service_property(_interface, signature="t",
1150
access="readwrite")
1151
def ExtendedTimeout_dbus_property(self, value=None):
1152
if value is None: # get
1153
return dbus.UInt64(self.extended_timeout_milliseconds())
1154
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1155
1156
1060
# Interval - property
1157
@dbus_service_property(_interface, signature="t",
1158
access="readwrite")
1061
@dbus_service_property(_interface, signature=u"t",
1062
access=u"readwrite")
1159
1063
def Interval_dbus_property(self, value=None):
1160
1064
if value is None: # get
1161
1065
return dbus.UInt64(self.interval_milliseconds())
1162
1066
self.interval = datetime.timedelta(0, 0, 0, value)
1163
if getattr(self, "checker_initiator_tag", None) is None:
1067
# Emit D-Bus signal
1068
self.PropertyChanged(dbus.String(u"Interval"),
1069
dbus.UInt64(value, variant_level=1))
1070
if getattr(self, u"checker_initiator_tag", None) is None:
1164
1071
return
1165
1072
# Reschedule checker run
1166
1073
gobject.source_remove(self.checker_initiator_tag)
1167
1074
self.checker_initiator_tag = (gobject.timeout_add
1168
1075
(value, self.start_checker))
1169
1076
self.start_checker() # Start one now, too
1170
1077
1171
1078
# Checker - property
1172
@dbus_service_property(_interface, signature="s",
1173
access="readwrite")
1079
@dbus_service_property(_interface, signature=u"s",
1080
access=u"readwrite")
1174
1081
def Checker_dbus_property(self, value=None):
1175
1082
if value is None: # get
1176
1083
return dbus.String(self.checker_command)
1177
1084
self.checker_command = value
1085
# Emit D-Bus signal
1086
self.PropertyChanged(dbus.String(u"Checker"),
1087
dbus.String(self.checker_command,
1088
variant_level=1))
1178
1089
1179
1090
# CheckerRunning - property
1180
@dbus_service_property(_interface, signature="b",
1181
access="readwrite")
1091
@dbus_service_property(_interface, signature=u"b",
1092
access=u"readwrite")
1182
1093
def CheckerRunning_dbus_property(self, value=None):
1183
1094
if value is None: # get
1184
1095
return dbus.Boolean(self.checker is not None)
1188
1099
self.stop_checker()
1189
1100
1190
1101
# ObjectPath - property
1191
@dbus_service_property(_interface, signature="o", access="read")
1102
@dbus_service_property(_interface, signature=u"o", access=u"read")
1192
1103
def ObjectPath_dbus_property(self):
1193
1104
return self.dbus_object_path # is already a dbus.ObjectPath
1194
1105
1195
1106
# Secret = property
1196
@dbus_service_property(_interface, signature="ay",
1197
access="write", byte_arrays=True)
1107
@dbus_service_property(_interface, signature=u"ay",
1108
access=u"write", byte_arrays=True)
1198
1109
def Secret_dbus_property(self, value):
1199
1110
self.secret = str(value)
1200
1111
1207
1118
self._pipe.send(('init', fpr, address))
1208
1119
if not self._pipe.recv():
1209
1120
raise KeyError()
1210
1121
1211
1122
def __getattribute__(self, name):
1212
1123
if(name == '_pipe'):
1213
1124
return super(ProxyClient, self).__getattribute__(name)
1220
1131
self._pipe.send(('funcall', name, args, kwargs))
1221
1132
return self._pipe.recv()[1]
1222
1133
return func
1223
1134
1224
1135
def __setattr__(self, name, value):
1225
1136
if(name == '_pipe'):
1226
1137
return super(ProxyClient, self).__setattr__(name, value)
1227
1138
self._pipe.send(('setattr', name, value))
1228
1139
1229
class ClientDBusTransitional(ClientDBus):
1230
__metaclass__ = transitional_dbus_metaclass
1231
1140
1232
1141
class ClientHandler(socketserver.BaseRequestHandler, object):
1233
1142
"""A class to handle client connections.
1237
1146
1238
1147
def handle(self):
1239
1148
with contextlib.closing(self.server.child_pipe) as child_pipe:
1240
logger.info("TCP connection from: %s",
1149
logger.info(u"TCP connection from: %s",
1241
1150
unicode(self.client_address))
1242
logger.debug("Pipe FD: %d",
1151
logger.debug(u"Pipe FD: %d",
1243
1152
self.server.child_pipe.fileno())
1244
1153
1245
1154
session = (gnutls.connection
1246
1155
.ClientSession(self.request,
1247
1156
gnutls.connection
1248
1157
.X509Credentials()))
1249
1158
1250
1159
# Note: gnutls.connection.X509Credentials is really a
1251
1160
# generic GnuTLS certificate credentials object so long as
1252
1161
# no X.509 keys are added to it. Therefore, we can use it
1253
1162
# here despite using OpenPGP certificates.
1254
1255
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1256
# "+AES-256-CBC", "+SHA1",
1257
# "+COMP-NULL", "+CTYPE-OPENPGP",
1258
# "+DHE-DSS"))
1163
1164
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1165
# u"+AES-256-CBC", u"+SHA1",
1166
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1167
# u"+DHE-DSS"))
1259
1168
# Use a fallback default, since this MUST be set.
1260
1169
priority = self.server.gnutls_priority
1261
1170
if priority is None:
1262
priority = "NORMAL"
1171
priority = u"NORMAL"
1263
1172
(gnutls.library.functions
1264
1173
.gnutls_priority_set_direct(session._c_object,
1265
1174
priority, None))
1266
1175
1267
1176
# Start communication using the Mandos protocol
1268
1177
# Get protocol number
1269
1178
line = self.request.makefile().readline()
1270
logger.debug("Protocol version: %r", line)
1179
logger.debug(u"Protocol version: %r", line)
1271
1180
try:
1272
1181
if int(line.strip().split()[0]) > 1:
1273
1182
raise RuntimeError
1274
except (ValueError, IndexError, RuntimeError) as error:
1275
logger.error("Unknown protocol version: %s", error)
1183
except (ValueError, IndexError, RuntimeError), error:
1184
logger.error(u"Unknown protocol version: %s", error)
1276
1185
return
1277
1186
1278
1187
# Start GnuTLS connection
1279
1188
try:
1280
1189
session.handshake()
1281
except gnutls.errors.GNUTLSError as error:
1282
logger.warning("Handshake failed: %s", error)
1190
except gnutls.errors.GNUTLSError, error:
1191
logger.warning(u"Handshake failed: %s", error)
1283
1192
# Do not run session.bye() here: the session is not
1284
1193
# established. Just abandon the request.
1285
1194
return
1286
logger.debug("Handshake succeeded")
1287
1195
logger.debug(u"Handshake succeeded")
1196
1288
1197
approval_required = False
1289
1198
try:
1290
1199
try:
1291
1200
fpr = self.fingerprint(self.peer_certificate
1292
1201
(session))
1293
except (TypeError,
1294
gnutls.errors.GNUTLSError) as error:
1295
logger.warning("Bad certificate: %s", error)
1202
except (TypeError, gnutls.errors.GNUTLSError), error:
1203
logger.warning(u"Bad certificate: %s", error)
1296
1204
return
1297
logger.debug("Fingerprint: %s", fpr)
1298
1205
logger.debug(u"Fingerprint: %s", fpr)
1206
1299
1207
try:
1300
1208
client = ProxyClient(child_pipe, fpr,
1301
1209
self.client_address)
1309
1217
1310
1218
while True:
1311
1219
if not client.enabled:
1312
logger.info("Client %s is disabled",
1220
logger.warning(u"Client %s is disabled",
1313
1221
client.name)
1314
1222
if self.server.use_dbus:
1315
1223
# Emit D-Bus signal
1320
1228
#We are approved or approval is disabled
1321
1229
break
1322
1230
elif client._approved is None:
1323
logger.info("Client %s needs approval",
1231
logger.info(u"Client %s needs approval",
1324
1232
client.name)
1325
1233
if self.server.use_dbus:
1326
1234
# Emit D-Bus signal
1328
1236
client.approval_delay_milliseconds(),
1329
1237
client.approved_by_default)
1330
1238
else:
1331
logger.warning("Client %s was not approved",
1239
logger.warning(u"Client %s was not approved",
1332
1240
client.name)
1333
1241
if self.server.use_dbus:
1334
1242
# Emit D-Bus signal
1360
1268
while sent_size < len(client.secret):
1361
1269
try:
1362
1270
sent = session.send(client.secret[sent_size:])
1363
except gnutls.errors.GNUTLSError as error:
1271
except (gnutls.errors.GNUTLSError), error:
1364
1272
logger.warning("gnutls send failed")
1365
1273
return
1366
logger.debug("Sent: %d, remaining: %d",
1274
logger.debug(u"Sent: %d, remaining: %d",
1367
1275
sent, len(client.secret)
1368
1276
- (sent_size + sent))
1369
1277
sent_size += sent
1370
1371
logger.info("Sending secret to %s", client.name)
1278
1279
logger.info(u"Sending secret to %s", client.name)
1372
1280
# bump the timeout as if seen
1373
client.checked_ok(client.extended_timeout)
1281
client.checked_ok()
1374
1282
if self.server.use_dbus:
1375
1283
# Emit D-Bus signal
1376
1284
client.GotSecret()
1380
1288
client.approvals_pending -= 1
1381
1289
try:
1382
1290
session.bye()
1383
except gnutls.errors.GNUTLSError as error:
1291
except (gnutls.errors.GNUTLSError), error:
1384
1292
logger.warning("GnuTLS bye failed")
1385
1293
1386
1294
@staticmethod
1397
1305
.gnutls_certificate_get_peers
1398
1306
(session._c_object, ctypes.byref(list_size)))
1399
1307
if not bool(cert_list) and list_size.value != 0:
1400
raise gnutls.errors.GNUTLSError("error getting peer"
1401
" certificate")
1308
raise gnutls.errors.GNUTLSError(u"error getting peer"
1309
u" certificate")
1402
1310
if list_size.value == 0:
1403
1311
return None
1404
1312
cert = cert_list[0]
1430
1338
if crtverify.value != 0:
1431
1339
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1432
1340
raise (gnutls.errors.CertificateSecurityError
1433
("Verify failed"))
1341
(u"Verify failed"))
1434
1342
# New buffer for the fingerprint
1435
1343
buf = ctypes.create_string_buffer(20)
1436
1344
buf_len = ctypes.c_size_t()
1443
1351
# Convert the buffer to a Python bytestring
1444
1352
fpr = ctypes.string_at(buf, buf_len.value)
1445
1353
# Convert the bytestring to hexadecimal notation
1446
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1354
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1447
1355
return hex_fpr
1448
1356
1449
1357
1461
1369
multiprocessing.Process(target = self.sub_process_main,
1462
1370
args = (request, address)).start()
1463
1371
1464
1465
1372
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1466
1373
""" adds a pipe to the MixIn """
1467
1374
def process_request(self, request, client_address):
1470
1377
This function creates a new pipe in self.pipe
1471
1378
"""
1472
1379
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1473
1380
1474
1381
super(MultiprocessingMixInWithPipe,
1475
1382
self).process_request(request, client_address)
1476
1383
self.child_pipe.close()
1477
1384
self.add_pipe(parent_pipe)
1478
1385
1479
1386
def add_pipe(self, parent_pipe):
1480
1387
"""Dummy function; override as necessary"""
1481
raise NotImplementedError
1482
1388
pass
1483
1389
1484
1390
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1485
1391
socketserver.TCPServer, object):
1503
1409
bind to an address or port if they were not specified."""
1504
1410
if self.interface is not None:
1505
1411
if SO_BINDTODEVICE is None:
1506
logger.error("SO_BINDTODEVICE does not exist;"
1507
" cannot bind to interface %s",
1412
logger.error(u"SO_BINDTODEVICE does not exist;"
1413
u" cannot bind to interface %s",
1508
1414
self.interface)
1509
1415
else:
1510
1416
try:
1511
1417
self.socket.setsockopt(socket.SOL_SOCKET,
1512
1418
SO_BINDTODEVICE,
1513
1419
str(self.interface
1514
+ '\0'))
1515
except socket.error as error:
1420
+ u'\0'))
1421
except socket.error, error:
1516
1422
if error[0] == errno.EPERM:
1517
logger.error("No permission to"
1518
" bind to interface %s",
1423
logger.error(u"No permission to"
1424
u" bind to interface %s",
1519
1425
self.interface)
1520
1426
elif error[0] == errno.ENOPROTOOPT:
1521
logger.error("SO_BINDTODEVICE not available;"
1522
" cannot bind to interface %s",
1427
logger.error(u"SO_BINDTODEVICE not available;"
1428
u" cannot bind to interface %s",
1523
1429
self.interface)
1524
1430
else:
1525
1431
raise
1527
1433
if self.server_address[0] or self.server_address[1]:
1528
1434
if not self.server_address[0]:
1529
1435
if self.address_family == socket.AF_INET6:
1530
any_address = "::" # in6addr_any
1436
any_address = u"::" # in6addr_any
1531
1437
else:
1532
1438
any_address = socket.INADDR_ANY
1533
1439
self.server_address = (any_address,
1582
1488
def handle_ipc(self, source, condition, parent_pipe=None,
1583
1489
client_object=None):
1584
1490
condition_names = {
1585
gobject.IO_IN: "IN", # There is data to read.
1586
gobject.IO_OUT: "OUT", # Data can be written (without
1491
gobject.IO_IN: u"IN", # There is data to read.
1492
gobject.IO_OUT: u"OUT", # Data can be written (without
1587
1493
# blocking).
1588
gobject.IO_PRI: "PRI", # There is urgent data to read.
1589
gobject.IO_ERR: "ERR", # Error condition.
1590
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1494
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1495
gobject.IO_ERR: u"ERR", # Error condition.
1496
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1591
1497
# broken, usually for pipes and
1592
1498
# sockets).
1593
1499
}
1612
1518
client = c
1613
1519
break
1614
1520
else:
1615
logger.info("Client not found for fingerprint: %s, ad"
1616
"dress: %s", fpr, address)
1521
logger.warning(u"Client not found for fingerprint: %s, ad"
1522
u"dress: %s", fpr, address)
1617
1523
if self.use_dbus:
1618
1524
# Emit D-Bus signal
1619
1525
mandos_dbus_service.ClientNotFound(fpr, address[0])
1634
1540
kwargs = request[3]
1635
1541
1636
1542
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1637
1543
1638
1544
if command == 'getattr':
1639
1545
attrname = request[1]
1640
1546
if callable(client_object.__getattribute__(attrname)):
1646
1552
attrname = request[1]
1647
1553
value = request[2]
1648
1554
setattr(client_object, attrname, value)
1649
1555
1650
1556
return True
1651
1557
1652
1558
1653
1559
def string_to_delta(interval):
1654
1560
"""Parse a string and return a datetime.timedelta
1655
1561
1656
>>> string_to_delta('7d')
1562
>>> string_to_delta(u'7d')
1657
1563
datetime.timedelta(7)
1658
>>> string_to_delta('60s')
1564
>>> string_to_delta(u'60s')
1659
1565
datetime.timedelta(0, 60)
1660
>>> string_to_delta('60m')
1566
>>> string_to_delta(u'60m')
1661
1567
datetime.timedelta(0, 3600)
1662
>>> string_to_delta('24h')
1568
>>> string_to_delta(u'24h')
1663
1569
datetime.timedelta(1)
1664
>>> string_to_delta('1w')
1570
>>> string_to_delta(u'1w')
1665
1571
datetime.timedelta(7)
1666
>>> string_to_delta('5m 30s')
1572
>>> string_to_delta(u'5m 30s')
1667
1573
datetime.timedelta(0, 330)
1668
1574
"""
1669
1575
timevalue = datetime.timedelta(0)
1671
1577
try:
1672
1578
suffix = unicode(s[-1])
1673
1579
value = int(s[:-1])
1674
if suffix == "d":
1580
if suffix == u"d":
1675
1581
delta = datetime.timedelta(value)
1676
elif suffix == "s":
1582
elif suffix == u"s":
1677
1583
delta = datetime.timedelta(0, value)
1678
elif suffix == "m":
1584
elif suffix == u"m":
1679
1585
delta = datetime.timedelta(0, 0, 0, 0, value)
1680
elif suffix == "h":
1586
elif suffix == u"h":
1681
1587
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1682
elif suffix == "w":
1588
elif suffix == u"w":
1683
1589
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1684
1590
else:
1685
raise ValueError("Unknown suffix %r" % suffix)
1686
except (ValueError, IndexError) as e:
1687
raise ValueError(*(e.args))
1591
raise ValueError(u"Unknown suffix %r" % suffix)
1592
except (ValueError, IndexError), e:
1593
raise ValueError(e.message)
1688
1594
timevalue += delta
1689
1595
return timevalue
1690
1596
1696
1602
global if_nametoindex
1697
1603
try:
1698
1604
if_nametoindex = (ctypes.cdll.LoadLibrary
1699
(ctypes.util.find_library("c"))
1605
(ctypes.util.find_library(u"c"))
1700
1606
.if_nametoindex)
1701
1607
except (OSError, AttributeError):
1702
logger.warning("Doing if_nametoindex the hard way")
1608
logger.warning(u"Doing if_nametoindex the hard way")
1703
1609
def if_nametoindex(interface):
1704
1610
"Get an interface index the hard way, i.e. using fcntl()"
1705
1611
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1706
1612
with contextlib.closing(socket.socket()) as s:
1707
1613
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1708
struct.pack(str("16s16x"),
1614
struct.pack(str(u"16s16x"),
1709
1615
interface))
1710
interface_index = struct.unpack(str("I"),
1616
interface_index = struct.unpack(str(u"I"),
1711
1617
ifreq[16:20])[0]
1712
1618
return interface_index
1713
1619
return if_nametoindex(interface)
1721
1627
sys.exit()
1722
1628
os.setsid()
1723
1629
if not nochdir:
1724
os.chdir("/")
1630
os.chdir(u"/")
1725
1631
if os.fork():
1726
1632
sys.exit()
1727
1633
if not noclose:
1729
1635
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1730
1636
if not stat.S_ISCHR(os.fstat(null).st_mode):
1731
1637
raise OSError(errno.ENODEV,
1732
"%s not a character device"
1638
u"%s not a character device"
1733
1639
% os.path.devnull)
1734
1640
os.dup2(null, sys.stdin.fileno())
1735
1641
os.dup2(null, sys.stdout.fileno())
1743
1649
##################################################################
1744
1650
# Parsing of options, both command line and config file
1745
1651
1746
parser = argparse.ArgumentParser()
1747
parser.add_argument("-v", "--version", action="version",
1748
version = "%%(prog)s %s" % version,
1749
help="show version number and exit")
1750
parser.add_argument("-i", "--interface", metavar="IF",
1751
help="Bind to interface IF")
1752
parser.add_argument("-a", "--address",
1753
help="Address to listen for requests on")
1754
parser.add_argument("-p", "--port", type=int,
1755
help="Port number to receive requests on")
1756
parser.add_argument("--check", action="store_true",
1757
help="Run self-test")
1758
parser.add_argument("--debug", action="store_true",
1759
help="Debug mode; run in foreground and log"
1760
" to terminal")
1761
parser.add_argument("--debuglevel", metavar="LEVEL",
1762
help="Debug level for stdout output")
1763
parser.add_argument("--priority", help="GnuTLS"
1764
" priority string (see GnuTLS documentation)")
1765
parser.add_argument("--servicename",
1766
metavar="NAME", help="Zeroconf service name")
1767
parser.add_argument("--configdir",
1768
default="/etc/mandos", metavar="DIR",
1769
help="Directory to search for configuration"
1770
" files")
1771
parser.add_argument("--no-dbus", action="store_false",
1772
dest="use_dbus", help="Do not provide D-Bus"
1773
" system bus interface")
1774
parser.add_argument("--no-ipv6", action="store_false",
1775
dest="use_ipv6", help="Do not use IPv6")
1776
options = parser.parse_args()
1652
parser = optparse.OptionParser(version = "%%prog %s" % version)
1653
parser.add_option("-i", u"--interface", type=u"string",
1654
metavar="IF", help=u"Bind to interface IF")
1655
parser.add_option("-a", u"--address", type=u"string",
1656
help=u"Address to listen for requests on")
1657
parser.add_option("-p", u"--port", type=u"int",
1658
help=u"Port number to receive requests on")
1659
parser.add_option("--check", action=u"store_true",
1660
help=u"Run self-test")
1661
parser.add_option("--debug", action=u"store_true",
1662
help=u"Debug mode; run in foreground and log to"
1663
u" terminal")
1664
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1665
help=u"Debug level for stdout output")
1666
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1667
u" priority string (see GnuTLS documentation)")
1668
parser.add_option("--servicename", type=u"string",
1669
metavar=u"NAME", help=u"Zeroconf service name")
1670
parser.add_option("--configdir", type=u"string",
1671
default=u"/etc/mandos", metavar=u"DIR",
1672
help=u"Directory to search for configuration"
1673
u" files")
1674
parser.add_option("--no-dbus", action=u"store_false",
1675
dest=u"use_dbus", help=u"Do not provide D-Bus"
1676
u" system bus interface")
1677
parser.add_option("--no-ipv6", action=u"store_false",
1678
dest=u"use_ipv6", help=u"Do not use IPv6")
1679
options = parser.parse_args()[0]
1777
1680
1778
1681
if options.check:
1779
1682
import doctest
1781
1684
sys.exit()
1782
1685
1783
1686
# Default values for config file for server-global settings
1784
server_defaults = { "interface": "",
1785
"address": "",
1786
"port": "",
1787
"debug": "False",
1788
"priority":
1789
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1790
"servicename": "Mandos",
1791
"use_dbus": "True",
1792
"use_ipv6": "True",
1793
"debuglevel": "",
1687
server_defaults = { u"interface": u"",
1688
u"address": u"",
1689
u"port": u"",
1690
u"debug": u"False",
1691
u"priority":
1692
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1693
u"servicename": u"Mandos",
1694
u"use_dbus": u"True",
1695
u"use_ipv6": u"True",
1696
u"debuglevel": u"",
1794
1697
}
1795
1698
1796
1699
# Parse config file for server-global settings
1797
1700
server_config = configparser.SafeConfigParser(server_defaults)
1798
1701
del server_defaults
1799
1702
server_config.read(os.path.join(options.configdir,
1800
"mandos.conf"))
1703
u"mandos.conf"))
1801
1704
# Convert the SafeConfigParser object to a dict
1802
1705
server_settings = server_config.defaults()
1803
1706
# Use the appropriate methods on the non-string config options
1804
for option in ("debug", "use_dbus", "use_ipv6"):
1805
server_settings[option] = server_config.getboolean("DEFAULT",
1707
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1708
server_settings[option] = server_config.getboolean(u"DEFAULT",
1806
1709
option)
1807
1710
if server_settings["port"]:
1808
server_settings["port"] = server_config.getint("DEFAULT",
1809
"port")
1711
server_settings["port"] = server_config.getint(u"DEFAULT",
1712
u"port")
1810
1713
del server_config
1811
1714
1812
1715
# Override the settings from the config file with command line
1813
1716
# options, if set.
1814
for option in ("interface", "address", "port", "debug",
1815
"priority", "servicename", "configdir",
1816
"use_dbus", "use_ipv6", "debuglevel"):
1717
for option in (u"interface", u"address", u"port", u"debug",
1718
u"priority", u"servicename", u"configdir",
1719
u"use_dbus", u"use_ipv6", u"debuglevel"):
1817
1720
value = getattr(options, option)
1818
1721
if value is not None:
1819
1722
server_settings[option] = value
1827
1730
##################################################################
1828
1731
1829
1732
# For convenience
1830
debug = server_settings["debug"]
1831
debuglevel = server_settings["debuglevel"]
1832
use_dbus = server_settings["use_dbus"]
1833
use_ipv6 = server_settings["use_ipv6"]
1834
1835
if server_settings["servicename"] != "Mandos":
1733
debug = server_settings[u"debug"]
1734
debuglevel = server_settings[u"debuglevel"]
1735
use_dbus = server_settings[u"use_dbus"]
1736
use_ipv6 = server_settings[u"use_ipv6"]
1737
1738
if server_settings[u"servicename"] != u"Mandos":
1836
1739
syslogger.setFormatter(logging.Formatter
1837
('Mandos (%s) [%%(process)d]:'
1838
' %%(levelname)s: %%(message)s'
1839
% server_settings["servicename"]))
1740
(u'Mandos (%s) [%%(process)d]:'
1741
u' %%(levelname)s: %%(message)s'
1742
% server_settings[u"servicename"]))
1840
1743
1841
1744
# Parse config file with clients
1842
client_defaults = { "timeout": "5m",
1843
"extended_timeout": "15m",
1844
"interval": "2m",
1845
"checker": "fping -q -- %%(host)s",
1846
"host": "",
1847
"approval_delay": "0s",
1848
"approval_duration": "1s",
1745
client_defaults = { u"timeout": u"1h",
1746
u"interval": u"5m",
1747
u"checker": u"fping -q -- %%(host)s",
1748
u"host": u"",
1749
u"approval_delay": u"0s",
1750
u"approval_duration": u"1s",
1849
1751
}
1850
1752
client_config = configparser.SafeConfigParser(client_defaults)
1851
client_config.read(os.path.join(server_settings["configdir"],
1852
"clients.conf"))
1753
client_config.read(os.path.join(server_settings[u"configdir"],
1754
u"clients.conf"))
1853
1755
1854
1756
global mandos_dbus_service
1855
1757
mandos_dbus_service = None
1856
1758
1857
tcp_server = MandosServer((server_settings["address"],
1858
server_settings["port"]),
1759
tcp_server = MandosServer((server_settings[u"address"],
1760
server_settings[u"port"]),
1859
1761
ClientHandler,
1860
interface=(server_settings["interface"]
1762
interface=(server_settings[u"interface"]
1861
1763
or None),
1862
1764
use_ipv6=use_ipv6,
1863
1765
gnutls_priority=
1864
server_settings["priority"],
1766
server_settings[u"priority"],
1865
1767
use_dbus=use_dbus)
1866
1768
if not debug:
1867
pidfilename = "/var/run/mandos.pid"
1769
pidfilename = u"/var/run/mandos.pid"
1868
1770
try:
1869
pidfile = open(pidfilename, "w")
1771
pidfile = open(pidfilename, u"w")
1870
1772
except IOError:
1871
logger.error("Could not open file %r", pidfilename)
1773
logger.error(u"Could not open file %r", pidfilename)
1872
1774
1873
1775
try:
1874
uid = pwd.getpwnam("_mandos").pw_uid
1875
gid = pwd.getpwnam("_mandos").pw_gid
1776
uid = pwd.getpwnam(u"_mandos").pw_uid
1777
gid = pwd.getpwnam(u"_mandos").pw_gid
1876
1778
except KeyError:
1877
1779
try:
1878
uid = pwd.getpwnam("mandos").pw_uid
1879
gid = pwd.getpwnam("mandos").pw_gid
1780
uid = pwd.getpwnam(u"mandos").pw_uid
1781
gid = pwd.getpwnam(u"mandos").pw_gid
1880
1782
except KeyError:
1881
1783
try:
1882
uid = pwd.getpwnam("nobody").pw_uid
1883
gid = pwd.getpwnam("nobody").pw_gid
1784
uid = pwd.getpwnam(u"nobody").pw_uid
1785
gid = pwd.getpwnam(u"nobody").pw_gid
1884
1786
except KeyError:
1885
1787
uid = 65534
1886
1788
gid = 65534
1887
1789
try:
1888
1790
os.setgid(gid)
1889
1791
os.setuid(uid)
1890
except OSError as error:
1792
except OSError, error:
1891
1793
if error[0] != errno.EPERM:
1892
1794
raise error
1893
1795
1898
1800
level = getattr(logging, debuglevel.upper())
1899
1801
syslogger.setLevel(level)
1900
1802
console.setLevel(level)
1901
1803
1902
1804
if debug:
1903
1805
# Enable all possible GnuTLS debugging
1904
1806
1908
1810
1909
1811
@gnutls.library.types.gnutls_log_func
1910
1812
def debug_gnutls(level, string):
1911
logger.debug("GnuTLS: %s", string[:-1])
1813
logger.debug(u"GnuTLS: %s", string[:-1])
1912
1814
1913
1815
(gnutls.library.functions
1914
1816
.gnutls_global_set_log_function(debug_gnutls))
1922
1824
# No console logging
1923
1825
logger.removeHandler(console)
1924
1826
1925
# Need to fork before connecting to D-Bus
1926
if not debug:
1927
# Close all input and output, do double fork, etc.
1928
daemon()
1929
1827
1930
1828
global main_loop
1931
1829
# From the Avahi example code
1935
1833
# End of Avahi example code
1936
1834
if use_dbus:
1937
1835
try:
1938
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1939
bus, do_not_queue=True)
1940
bus_name2 = dbus.service.BusName("se.recompile.Mandos",
1941
bus, do_not_queue=True)
1942
except dbus.exceptions.NameExistsException as e:
1943
logger.error(unicode(e) + ", disabling D-Bus")
1836
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1837
bus, do_not_queue=True)
1838
except dbus.exceptions.NameExistsException, e:
1839
logger.error(unicode(e) + u", disabling D-Bus")
1944
1840
use_dbus = False
1945
server_settings["use_dbus"] = False
1841
server_settings[u"use_dbus"] = False
1946
1842
tcp_server.use_dbus = False
1947
1843
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1948
service = AvahiService(name = server_settings["servicename"],
1949
servicetype = "_mandos._tcp",
1844
service = AvahiService(name = server_settings[u"servicename"],
1845
servicetype = u"_mandos._tcp",
1950
1846
protocol = protocol, bus = bus)
1951
1847
if server_settings["interface"]:
1952
1848
service.interface = (if_nametoindex
1953
(str(server_settings["interface"])))
1954
1849
(str(server_settings[u"interface"])))
1850
1851
if not debug:
1852
# Close all input and output, do double fork, etc.
1853
daemon()
1854
1955
1855
global multiprocessing_manager
1956
1856
multiprocessing_manager = multiprocessing.Manager()
1957
1857
1958
1858
client_class = Client
1959
1859
if use_dbus:
1960
client_class = functools.partial(ClientDBusTransitional, bus = bus)
1860
client_class = functools.partial(ClientDBus, bus = bus)
1961
1861
def client_config_items(config, section):
1962
1862
special_settings = {
1963
1863
"approved_by_default":
1976
1876
client_config, section)))
1977
1877
for section in client_config.sections()))
1978
1878
if not tcp_server.clients:
1979
logger.warning("No clients defined")
1879
logger.warning(u"No clients defined")
1980
1880
1981
1881
if not debug:
1982
1882
try:
1983
1883
with pidfile:
1984
1884
pid = os.getpid()
1985
pidfile.write(str(pid) + "\n".encode("utf-8"))
1885
pidfile.write(str(pid) + "\n")
1986
1886
del pidfile
1987
1887
except IOError:
1988
logger.error("Could not write to file %r with PID %d",
1888
logger.error(u"Could not write to file %r with PID %d",
1989
1889
pidfilename, pid)
1990
1890
except NameError:
1991
1891
# "pidfile" was never created
1993
1893
del pidfilename
1994
1894
1995
1895
signal.signal(signal.SIGINT, signal.SIG_IGN)
1996
1896
1997
1897
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1998
1898
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1999
1899
2001
1901
class MandosDBusService(dbus.service.Object):
2002
1902
"""A D-Bus proxy object"""
2003
1903
def __init__(self):
2004
dbus.service.Object.__init__(self, bus, "/")
2005
_interface = "se.bsnet.fukt.Mandos"
1904
dbus.service.Object.__init__(self, bus, u"/")
1905
_interface = u"se.bsnet.fukt.Mandos"
2006
1906
2007
@dbus.service.signal(_interface, signature="o")
1907
@dbus.service.signal(_interface, signature=u"o")
2008
1908
def ClientAdded(self, objpath):
2009
1909
"D-Bus signal"
2010
1910
pass
2011
1911
2012
@dbus.service.signal(_interface, signature="ss")
1912
@dbus.service.signal(_interface, signature=u"ss")
2013
1913
def ClientNotFound(self, fingerprint, address):
2014
1914
"D-Bus signal"
2015
1915
pass
2016
1916
2017
@dbus.service.signal(_interface, signature="os")
1917
@dbus.service.signal(_interface, signature=u"os")
2018
1918
def ClientRemoved(self, objpath, name):
2019
1919
"D-Bus signal"
2020
1920
pass
2021
1921
2022
@dbus.service.method(_interface, out_signature="ao")
1922
@dbus.service.method(_interface, out_signature=u"ao")
2023
1923
def GetAllClients(self):
2024
1924
"D-Bus method"
2025
1925
return dbus.Array(c.dbus_object_path
2026
1926
for c in tcp_server.clients)
2027
1927
2028
1928
@dbus.service.method(_interface,
2029
out_signature="a{oa{sv}}")
1929
out_signature=u"a{oa{sv}}")
2030
1930
def GetAllClientsWithProperties(self):
2031
1931
"D-Bus method"
2032
1932
return dbus.Dictionary(
2033
((c.dbus_object_path, c.GetAll(""))
1933
((c.dbus_object_path, c.GetAll(u""))
2034
1934
for c in tcp_server.clients),
2035
signature="oa{sv}")
1935
signature=u"oa{sv}")
2036
1936
2037
@dbus.service.method(_interface, in_signature="o")
1937
@dbus.service.method(_interface, in_signature=u"o")
2038
1938
def RemoveClient(self, object_path):
2039
1939
"D-Bus method"
2040
1940
for c in tcp_server.clients:
2050
1950
2051
1951
del _interface
2052
1952
2053
class MandosDBusServiceTransitional(MandosDBusService):
2054
__metaclass__ = transitional_dbus_metaclass
2055
mandos_dbus_service = MandosDBusServiceTransitional()
1953
mandos_dbus_service = MandosDBusService()
2056
1954
2057
1955
def cleanup():
2058
1956
"Cleanup function; run on exit"
2084
1982
# Find out what port we got
2085
1983
service.port = tcp_server.socket.getsockname()[1]
2086
1984
if use_ipv6:
2087
logger.info("Now listening on address %r, port %d,"
1985
logger.info(u"Now listening on address %r, port %d,"
2088
1986
" flowinfo %d, scope_id %d"
2089
1987
% tcp_server.socket.getsockname())
2090
1988
else: # IPv4
2091
logger.info("Now listening on address %r, port %d"
1989
logger.info(u"Now listening on address %r, port %d"
2092
1990
% tcp_server.socket.getsockname())
2093
1991
2094
1992
#service.interface = tcp_server.socket.getsockname()[3]
2097
1995
# From the Avahi example code
2098
1996
try:
2099
1997
service.activate()
2100
except dbus.exceptions.DBusException as error:
2101
logger.critical("DBusException: %s", error)
1998
except dbus.exceptions.DBusException, error:
1999
logger.critical(u"DBusException: %s", error)
2102
2000
cleanup()
2103
2001
sys.exit(1)
2104
2002
# End of Avahi example code
2108
2006
(tcp_server.handle_request
2109
2007
(*args[2:], **kwargs) or True))
2110
2008
2111
logger.debug("Starting main loop")
2009
logger.debug(u"Starting main loop")
2112
2010
main_loop.run()
2113
except AvahiError as error:
2114
logger.critical("AvahiError: %s", error)
2011
except AvahiError, error:
2012
logger.critical(u"AvahiError: %s", error)
2115
2013
cleanup()
2116
2014
sys.exit(1)
2117
2015
except KeyboardInterrupt:
2118
2016
if debug:
2119
print("", file=sys.stderr)
2120
logger.debug("Server received KeyboardInterrupt")
2121
logger.debug("Server exiting")
2017
print >> sys.stderr
2018
logger.debug(u"Server received KeyboardInterrupt")
2019
logger.debug(u"Server exiting")
2122
2020
# Must run before the D-Bus bus name gets deregistered
2123
2021
cleanup()
2124
2022
2125
2126
2023
if __name__ == '__main__':
2127
2024
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0