To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 441
- compare with another revision
- download diff
- download tarball
- view history from revision 441
- Committer: Teddy Hogeborn
- Date: 2010-09-25 23:52:17 UTC
- Revision ID: teddy@fukt.bsnet.se-20100925235217-4hhqfryz1ste6uw3
* mandos (ClientDBus.__init__): Bug fix: Translate "-" in client names
to "_" in D-Bus object paths.
(MandosServer.handle_ipc): Bug fix: Send only address string to
D-Bus signal, not whole tuple.
* mandos-ctl: New options "--approve-by-default", "--deny-by-default",
"--approval-delay", and "--approval-duration".
* mandos-ctl.xml (SYNOPSIS, OPTIONS): Document new options.
* mandos-monitor (MandosClientWidget.update): Fix spelling.
to "_" in D-Bus object paths.
(MandosServer.handle_ipc): Bug fix: Send only address string to
D-Bus signal, not whole tuple.
* mandos-ctl: New options "--approve-by-default", "--deny-by-default",
"--approval-delay", and "--approval-duration".
* mandos-ctl.xml (SYNOPSIS, OPTIONS): Document new options.
* mandos-monitor (MandosClientWidget.update): Fix spelling.
- files removed:
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@recompile.se>.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
36
import SocketServer as socketserver
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
62
61
import functools
63
62
import cPickle as pickle
64
63
import multiprocessing
65
import types
66
import hashlib
67
64
68
65
import dbus
69
66
import dbus.service
74
71
import ctypes.util
75
72
import xml.dom.minidom
76
73
import inspect
77
import Crypto.Cipher.AES
78
74
79
75
try:
80
76
SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
81
SO_BINDTODEVICE = None
86
82
87
83
88
version = "1.4.1"
89
90
logger = logging.getLogger()
91
stored_state_path = "/var/lib/mandos/clients.pickle"
92
84
version = "1.0.14"
85
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
93
88
syslogger = (logging.handlers.SysLogHandler
94
89
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
95
address = str("/dev/log")))
90
address = "/dev/log"))
96
91
syslogger.setFormatter(logging.Formatter
97
('Mandos [%(process)d]: %(levelname)s:'
98
' %(message)s'))
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
99
94
logger.addHandler(syslogger)
100
95
101
96
console = logging.StreamHandler()
102
console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
103
' [%(process)d]:'
104
' %(levelname)s:'
105
' %(message)s'))
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
106
100
logger.addHandler(console)
107
101
108
109
102
class AvahiError(Exception):
110
103
def __init__(self, value, *args, **kwargs):
111
104
self.value = value
126
119
Attributes:
127
120
interface: integer; avahi.IF_UNSPEC or an interface index.
128
121
Used to optionally bind to the specified interface.
129
name: string; Example: 'Mandos'
130
type: string; Example: '_mandos._tcp'.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
131
124
See <http://www.dns-sd.org/ServiceTypes.html>
132
125
port: integer; what port to announce
133
126
TXT: list of strings; TXT record for the service
142
135
"""
143
136
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
144
137
servicetype = None, port = None, TXT = None,
145
domain = "", host = "", max_renames = 32768,
138
domain = u"", host = u"", max_renames = 32768,
146
139
protocol = avahi.PROTO_UNSPEC, bus = None):
147
140
self.interface = interface
148
141
self.name = name
157
150
self.group = None # our entry group
158
151
self.server = None
159
152
self.bus = bus
160
self.entry_group_state_changed_match = None
161
153
def rename(self):
162
154
"""Derived from the Avahi example code"""
163
155
if self.rename_count >= self.max_renames:
164
logger.critical("No suitable Zeroconf service name found"
165
" after %i retries, exiting.",
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
166
158
self.rename_count)
167
raise AvahiServiceError("Too many renames")
168
self.name = unicode(self.server
169
.GetAlternativeServiceName(self.name))
170
logger.info("Changing Zeroconf service name to %r ...",
159
raise AvahiServiceError(u"Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
161
logger.info(u"Changing Zeroconf service name to %r ...",
171
162
self.name)
163
syslogger.setFormatter(logging.Formatter
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
166
% self.name))
172
167
self.remove()
173
168
try:
174
169
self.add()
175
except dbus.exceptions.DBusException as error:
176
logger.critical("DBusException: %s", error)
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
177
172
self.cleanup()
178
173
os._exit(1)
179
174
self.rename_count += 1
180
175
def remove(self):
181
176
"""Derived from the Avahi example code"""
182
if self.entry_group_state_changed_match is not None:
183
self.entry_group_state_changed_match.remove()
184
self.entry_group_state_changed_match = None
185
177
if self.group is not None:
186
178
self.group.Reset()
187
179
def add(self):
188
180
"""Derived from the Avahi example code"""
189
self.remove()
190
181
if self.group is None:
191
182
self.group = dbus.Interface(
192
183
self.bus.get_object(avahi.DBUS_NAME,
193
184
self.server.EntryGroupNew()),
194
185
avahi.DBUS_INTERFACE_ENTRY_GROUP)
195
self.entry_group_state_changed_match = (
196
self.group.connect_to_signal(
197
'StateChanged', self.entry_group_state_changed))
198
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
186
self.group.connect_to_signal('StateChanged',
187
self
188
.entry_group_state_changed)
189
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
199
190
self.name, self.type)
200
191
self.group.AddService(
201
192
self.interface,
208
199
self.group.Commit()
209
200
def entry_group_state_changed(self, state, error):
210
201
"""Derived from the Avahi example code"""
211
logger.debug("Avahi entry group state change: %i", state)
202
logger.debug(u"Avahi entry group state change: %i", state)
212
203
213
204
if state == avahi.ENTRY_GROUP_ESTABLISHED:
214
logger.debug("Zeroconf service established.")
205
logger.debug(u"Zeroconf service established.")
215
206
elif state == avahi.ENTRY_GROUP_COLLISION:
216
logger.info("Zeroconf service name collision.")
207
logger.warning(u"Zeroconf service name collision.")
217
208
self.rename()
218
209
elif state == avahi.ENTRY_GROUP_FAILURE:
219
logger.critical("Avahi: Error in group state changed %s",
210
logger.critical(u"Avahi: Error in group state changed %s",
220
211
unicode(error))
221
raise AvahiGroupError("State changed: %s"
212
raise AvahiGroupError(u"State changed: %s"
222
213
% unicode(error))
223
214
def cleanup(self):
224
215
"""Derived from the Avahi example code"""
225
216
if self.group is not None:
226
try:
227
self.group.Free()
228
except (dbus.exceptions.UnknownMethodException,
229
dbus.exceptions.DBusException) as e:
230
pass
217
self.group.Free()
231
218
self.group = None
232
self.remove()
233
def server_state_changed(self, state, error=None):
219
def server_state_changed(self, state):
234
220
"""Derived from the Avahi example code"""
235
logger.debug("Avahi server state change: %i", state)
236
bad_states = { avahi.SERVER_INVALID:
237
"Zeroconf server invalid",
238
avahi.SERVER_REGISTERING: None,
239
avahi.SERVER_COLLISION:
240
"Zeroconf server name collision",
241
avahi.SERVER_FAILURE:
242
"Zeroconf server failure" }
243
if state in bad_states:
244
if bad_states[state] is not None:
245
if error is None:
246
logger.error(bad_states[state])
247
else:
248
logger.error(bad_states[state] + ": %r", error)
249
self.cleanup()
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
224
self.remove()
250
225
elif state == avahi.SERVER_RUNNING:
251
226
self.add()
252
else:
253
if error is None:
254
logger.debug("Unknown state: %r", state)
255
else:
256
logger.debug("Unknown state: %r: %r", state, error)
257
227
def activate(self):
258
228
"""Derived from the Avahi example code"""
259
229
if self.server is None:
260
230
self.server = dbus.Interface(
261
231
self.bus.get_object(avahi.DBUS_NAME,
262
avahi.DBUS_PATH_SERVER,
263
follow_name_owner_changes=True),
232
avahi.DBUS_PATH_SERVER),
264
233
avahi.DBUS_INTERFACE_SERVER)
265
self.server.connect_to_signal("StateChanged",
234
self.server.connect_to_signal(u"StateChanged",
266
235
self.server_state_changed)
267
236
self.server_state_changed(self.server.GetState())
268
237
269
class AvahiServiceToSyslog(AvahiService):
270
def rename(self):
271
"""Add the new name to the syslog messages"""
272
ret = AvahiService.rename(self)
273
syslogger.setFormatter(logging.Formatter
274
('Mandos (%s) [%%(process)d]:'
275
' %%(levelname)s: %%(message)s'
276
% self.name))
277
return ret
278
238
279
def _timedelta_to_milliseconds(td):
280
"Convert a datetime.timedelta() to milliseconds"
281
return ((td.days * 24 * 60 * 60 * 1000)
282
+ (td.seconds * 1000)
283
+ (td.microseconds // 1000))
284
285
239
class Client(object):
286
240
"""A representation of a client host served by this server.
287
241
292
246
checker: subprocess.Popen(); a running checker process used
293
247
to see if the client lives.
294
248
'None' if no process is running.
295
checker_callback_tag: a gobject event source tag, or None
249
checker_callback_tag: - '' -
296
250
checker_command: string; External command which is run to check
297
251
if client lives. %() expansions are done at
298
252
runtime with vars(self) as dict, so that for
299
253
instance %(name)s can be used in the command.
300
254
checker_initiator_tag: a gobject event source tag, or None
301
255
created: datetime.datetime(); (UTC) object creation
302
client_structure: Object describing what attributes a client has
303
and is used for storing the client at exit
304
256
current_checker_command: string; current running checker_command
305
disable_initiator_tag: a gobject event source tag, or None
257
disable_hook: If set, called by disable() as disable_hook(self)
258
disable_initiator_tag: - '' -
306
259
enabled: bool()
307
260
fingerprint: string (40 or 32 hexadecimal digits); used to
308
261
uniquely identify the client
309
262
host: string; available for use by the checker command
310
263
interval: datetime.timedelta(); How often to start a new checker
311
last_approval_request: datetime.datetime(); (UTC) or None
312
264
last_checked_ok: datetime.datetime(); (UTC) or None
313
last_checker_status: integer between 0 and 255 reflecting exit
314
status of last checker. -1 reflect crashed
315
checker, or None.
316
265
last_enabled: datetime.datetime(); (UTC)
317
266
name: string; from the config file, used in log messages and
318
267
D-Bus identifiers
319
268
secret: bytestring; sent verbatim (over TLS) to client
320
269
timeout: datetime.timedelta(); How long from last_checked_ok
321
270
until this client is disabled
322
extended_timeout: extra long timeout when password has been sent
323
271
runtime_expansions: Allowed attributes for runtime expansion.
324
expires: datetime.datetime(); time (UTC) when a client will be
325
disabled, or None
326
272
"""
327
273
328
runtime_expansions = ("approval_delay", "approval_duration",
329
"created", "enabled", "fingerprint",
330
"host", "interval", "last_checked_ok",
331
"last_enabled", "name", "timeout")
274
runtime_expansions = (u"approval_delay", u"approval_duration",
275
u"created", u"enabled", u"fingerprint",
276
u"host", u"interval", u"last_checked_ok",
277
u"last_enabled", u"name", u"timeout")
278
279
@staticmethod
280
def _timedelta_to_milliseconds(td):
281
"Convert a datetime.timedelta() to milliseconds"
282
return ((td.days * 24 * 60 * 60 * 1000)
283
+ (td.seconds * 1000)
284
+ (td.microseconds // 1000))
332
285
333
286
def timeout_milliseconds(self):
334
287
"Return the 'timeout' attribute in milliseconds"
335
return _timedelta_to_milliseconds(self.timeout)
336
337
def extended_timeout_milliseconds(self):
338
"Return the 'extended_timeout' attribute in milliseconds"
339
return _timedelta_to_milliseconds(self.extended_timeout)
288
return self._timedelta_to_milliseconds(self.timeout)
340
289
341
290
def interval_milliseconds(self):
342
291
"Return the 'interval' attribute in milliseconds"
343
return _timedelta_to_milliseconds(self.interval)
344
292
return self._timedelta_to_milliseconds(self.interval)
293
345
294
def approval_delay_milliseconds(self):
346
return _timedelta_to_milliseconds(self.approval_delay)
295
return self._timedelta_to_milliseconds(self.approval_delay)
347
296
348
def __init__(self, name = None, config=None):
297
def __init__(self, name = None, disable_hook=None, config=None):
349
298
"""Note: the 'checker' key in 'config' sets the
350
299
'checker_command' attribute and *not* the 'checker'
351
300
attribute."""
352
301
self.name = name
353
302
if config is None:
354
303
config = {}
355
logger.debug("Creating client %r", self.name)
304
logger.debug(u"Creating client %r", self.name)
356
305
# Uppercase and remove spaces from fingerprint for later
357
306
# comparison purposes with return value from the fingerprint()
358
307
# function
359
self.fingerprint = (config["fingerprint"].upper()
360
.replace(" ", ""))
361
logger.debug(" Fingerprint: %s", self.fingerprint)
362
if "secret" in config:
363
self.secret = config["secret"].decode("base64")
364
elif "secfile" in config:
308
self.fingerprint = (config[u"fingerprint"].upper()
309
.replace(u" ", u""))
310
logger.debug(u" Fingerprint: %s", self.fingerprint)
311
if u"secret" in config:
312
self.secret = config[u"secret"].decode(u"base64")
313
elif u"secfile" in config:
365
314
with open(os.path.expanduser(os.path.expandvars
366
(config["secfile"])),
315
(config[u"secfile"])),
367
316
"rb") as secfile:
368
317
self.secret = secfile.read()
369
318
else:
370
raise TypeError("No secret or secfile for client %s"
319
raise TypeError(u"No secret or secfile for client %s"
371
320
% self.name)
372
self.host = config.get("host", "")
321
self.host = config.get(u"host", u"")
373
322
self.created = datetime.datetime.utcnow()
374
self.enabled = True
375
self.last_approval_request = None
376
self.last_enabled = datetime.datetime.utcnow()
323
self.enabled = False
324
self.last_enabled = None
377
325
self.last_checked_ok = None
378
self.last_checker_status = None
379
self.timeout = string_to_delta(config["timeout"])
380
self.extended_timeout = string_to_delta(config
381
["extended_timeout"])
382
self.interval = string_to_delta(config["interval"])
326
self.timeout = string_to_delta(config[u"timeout"])
327
self.interval = string_to_delta(config[u"interval"])
328
self.disable_hook = disable_hook
383
329
self.checker = None
384
330
self.checker_initiator_tag = None
385
331
self.disable_initiator_tag = None
386
self.expires = datetime.datetime.utcnow() + self.timeout
387
332
self.checker_callback_tag = None
388
self.checker_command = config["checker"]
333
self.checker_command = config[u"checker"]
389
334
self.current_checker_command = None
335
self.last_connect = None
390
336
self._approved = None
391
self.approved_by_default = config.get("approved_by_default",
337
self.approved_by_default = config.get(u"approved_by_default",
392
338
True)
393
339
self.approvals_pending = 0
394
340
self.approval_delay = string_to_delta(
395
config["approval_delay"])
341
config[u"approval_delay"])
396
342
self.approval_duration = string_to_delta(
397
config["approval_duration"])
398
self.changedstate = (multiprocessing_manager
399
.Condition(multiprocessing_manager
400
.Lock()))
401
self.client_structure = [attr for attr
402
in self.__dict__.iterkeys()
403
if not attr.startswith("_")]
404
self.client_structure.append("client_structure")
405
406
407
for name, t in inspect.getmembers(type(self),
408
lambda obj:
409
isinstance(obj,
410
property)):
411
if not name.startswith("_"):
412
self.client_structure.append(name)
343
config[u"approval_duration"])
344
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
413
345
414
# Send notice to process children that client state has changed
415
346
def send_changedstate(self):
416
with self.changedstate:
417
self.changedstate.notify_all()
418
347
self.changedstate.acquire()
348
self.changedstate.notify_all()
349
self.changedstate.release()
350
419
351
def enable(self):
420
352
"""Start this client's checker and timeout hooks"""
421
if getattr(self, "enabled", False):
353
if getattr(self, u"enabled", False):
422
354
# Already enabled
423
355
return
424
356
self.send_changedstate()
425
self.expires = datetime.datetime.utcnow() + self.timeout
357
self.last_enabled = datetime.datetime.utcnow()
358
# Schedule a new checker to be started an 'interval' from now,
359
# and every interval from then on.
360
self.checker_initiator_tag = (gobject.timeout_add
361
(self.interval_milliseconds(),
362
self.start_checker))
363
# Schedule a disable() when 'timeout' has passed
364
self.disable_initiator_tag = (gobject.timeout_add
365
(self.timeout_milliseconds(),
366
self.disable))
426
367
self.enabled = True
427
self.last_enabled = datetime.datetime.utcnow()
428
self.init_checker()
368
# Also start a new checker *right now*.
369
self.start_checker()
429
370
430
371
def disable(self, quiet=True):
431
372
"""Disable this client."""
434
375
if not quiet:
435
376
self.send_changedstate()
436
377
if not quiet:
437
logger.info("Disabling client %s", self.name)
438
if getattr(self, "disable_initiator_tag", False):
378
logger.info(u"Disabling client %s", self.name)
379
if getattr(self, u"disable_initiator_tag", False):
439
380
gobject.source_remove(self.disable_initiator_tag)
440
381
self.disable_initiator_tag = None
441
self.expires = None
442
if getattr(self, "checker_initiator_tag", False):
382
if getattr(self, u"checker_initiator_tag", False):
443
383
gobject.source_remove(self.checker_initiator_tag)
444
384
self.checker_initiator_tag = None
445
385
self.stop_checker()
386
if self.disable_hook:
387
self.disable_hook(self)
446
388
self.enabled = False
447
389
# Do not run this again if called by a gobject.timeout_add
448
390
return False
449
391
450
392
def __del__(self):
393
self.disable_hook = None
451
394
self.disable()
452
453
def init_checker(self):
454
# Schedule a new checker to be started an 'interval' from now,
455
# and every interval from then on.
456
self.checker_initiator_tag = (gobject.timeout_add
457
(self.interval_milliseconds(),
458
self.start_checker))
459
# Schedule a disable() when 'timeout' has passed
460
self.disable_initiator_tag = (gobject.timeout_add
461
(self.timeout_milliseconds(),
462
self.disable))
463
# Also start a new checker *right now*.
464
self.start_checker()
465
466
395
467
396
def checker_callback(self, pid, condition, command):
468
397
"""The checker has completed, so take appropriate actions."""
469
398
self.checker_callback_tag = None
470
399
self.checker = None
471
400
if os.WIFEXITED(condition):
472
self.last_checker_status = os.WEXITSTATUS(condition)
473
if self.last_checker_status == 0:
474
logger.info("Checker for %(name)s succeeded",
401
exitstatus = os.WEXITSTATUS(condition)
402
if exitstatus == 0:
403
logger.info(u"Checker for %(name)s succeeded",
475
404
vars(self))
476
405
self.checked_ok()
477
406
else:
478
logger.info("Checker for %(name)s failed",
407
logger.info(u"Checker for %(name)s failed",
479
408
vars(self))
480
409
else:
481
self.last_checker_status = -1
482
logger.warning("Checker for %(name)s crashed?",
410
logger.warning(u"Checker for %(name)s crashed?",
483
411
vars(self))
484
412
485
def checked_ok(self, timeout=None):
413
def checked_ok(self):
486
414
"""Bump up the timeout for this client.
487
415
488
416
This should only be called when the client has been seen,
489
417
alive and well.
490
418
"""
491
if timeout is None:
492
timeout = self.timeout
493
419
self.last_checked_ok = datetime.datetime.utcnow()
494
if self.disable_initiator_tag is not None:
495
gobject.source_remove(self.disable_initiator_tag)
496
if getattr(self, "enabled", False):
497
self.disable_initiator_tag = (gobject.timeout_add
498
(_timedelta_to_milliseconds
499
(timeout), self.disable))
500
self.expires = datetime.datetime.utcnow() + timeout
501
502
def need_approval(self):
503
self.last_approval_request = datetime.datetime.utcnow()
420
gobject.source_remove(self.disable_initiator_tag)
421
self.disable_initiator_tag = (gobject.timeout_add
422
(self.timeout_milliseconds(),
423
self.disable))
504
424
505
425
def start_checker(self):
506
426
"""Start a new checker subprocess if one is not running.
519
439
# If a checker exists, make sure it is not a zombie
520
440
try:
521
441
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
522
except (AttributeError, OSError) as error:
442
except (AttributeError, OSError), error:
523
443
if (isinstance(error, OSError)
524
444
and error.errno != errno.ECHILD):
525
445
raise error
526
446
else:
527
447
if pid:
528
logger.warning("Checker was a zombie")
448
logger.warning(u"Checker was a zombie")
529
449
gobject.source_remove(self.checker_callback_tag)
530
450
self.checker_callback(pid, status,
531
451
self.current_checker_command)
538
458
# Escape attributes for the shell
539
459
escaped_attrs = dict(
540
460
(attr,
541
re.escape(unicode(str(getattr(self, attr, "")),
461
re.escape(unicode(str(getattr(self, attr, u"")),
542
462
errors=
543
'replace')))
463
u'replace')))
544
464
for attr in
545
465
self.runtime_expansions)
546
466
547
467
try:
548
468
command = self.checker_command % escaped_attrs
549
except TypeError as error:
550
logger.error('Could not format string "%s":'
551
' %s', self.checker_command, error)
469
except TypeError, error:
470
logger.error(u'Could not format string "%s":'
471
u' %s', self.checker_command, error)
552
472
return True # Try again later
553
473
self.current_checker_command = command
554
474
try:
555
logger.info("Starting checker %r for %s",
475
logger.info(u"Starting checker %r for %s",
556
476
command, self.name)
557
477
# We don't need to redirect stdout and stderr, since
558
478
# in normal mode, that is already done by daemon(),
560
480
# always replaced by /dev/null.)
561
481
self.checker = subprocess.Popen(command,
562
482
close_fds=True,
563
shell=True, cwd="/")
483
shell=True, cwd=u"/")
564
484
self.checker_callback_tag = (gobject.child_watch_add
565
485
(self.checker.pid,
566
486
self.checker_callback,
571
491
if pid:
572
492
gobject.source_remove(self.checker_callback_tag)
573
493
self.checker_callback(pid, status, command)
574
except OSError as error:
575
logger.error("Failed to start subprocess: %s",
494
except OSError, error:
495
logger.error(u"Failed to start subprocess: %s",
576
496
error)
577
497
# Re-run this periodically if run by gobject.timeout_add
578
498
return True
582
502
if self.checker_callback_tag:
583
503
gobject.source_remove(self.checker_callback_tag)
584
504
self.checker_callback_tag = None
585
if getattr(self, "checker", None) is None:
505
if getattr(self, u"checker", None) is None:
586
506
return
587
logger.debug("Stopping checker for %(name)s", vars(self))
507
logger.debug(u"Stopping checker for %(name)s", vars(self))
588
508
try:
589
509
os.kill(self.checker.pid, signal.SIGTERM)
590
510
#time.sleep(0.5)
591
511
#if self.checker.poll() is None:
592
512
# os.kill(self.checker.pid, signal.SIGKILL)
593
except OSError as error:
513
except OSError, error:
594
514
if error.errno != errno.ESRCH: # No such process
595
515
raise
596
516
self.checker = None
597
517
598
# Encrypts a client secret and stores it in a varible
599
# encrypted_secret
600
def encrypt_secret(self, key):
601
# Encryption-key need to be of a specific size, so we hash
602
# supplied key
603
hasheng = hashlib.sha256()
604
hasheng.update(key)
605
encryptionkey = hasheng.digest()
606
607
# Create validation hash so we know at decryption if it was
608
# sucessful
609
hasheng = hashlib.sha256()
610
hasheng.update(self.secret)
611
validationhash = hasheng.digest()
612
613
# Encrypt secret
614
iv = os.urandom(Crypto.Cipher.AES.block_size)
615
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
616
Crypto.Cipher.AES.MODE_CFB, iv)
617
ciphertext = ciphereng.encrypt(validationhash+self.secret)
618
self.encrypted_secret = (ciphertext, iv)
619
620
# Decrypt a encrypted client secret
621
def decrypt_secret(self, key):
622
# Decryption-key need to be of a specific size, so we hash
623
# supplied key
624
hasheng = hashlib.sha256()
625
hasheng.update(key)
626
encryptionkey = hasheng.digest()
627
628
# Decrypt encrypted secret
629
ciphertext, iv = self.encrypted_secret
630
ciphereng = Crypto.Cipher.AES.new(encryptionkey,
631
Crypto.Cipher.AES.MODE_CFB, iv)
632
plain = ciphereng.decrypt(ciphertext)
633
634
# Validate decrypted secret to know if it was succesful
635
hasheng = hashlib.sha256()
636
validationhash = plain[:hasheng.digest_size]
637
secret = plain[hasheng.digest_size:]
638
hasheng.update(secret)
639
640
# If validation fails, we use key as new secret. Otherwise, we
641
# use the decrypted secret
642
if hasheng.digest() == validationhash:
643
self.secret = secret
644
else:
645
self.secret = key
646
del self.encrypted_secret
647
648
649
def dbus_service_property(dbus_interface, signature="v",
650
access="readwrite", byte_arrays=False):
518
def dbus_service_property(dbus_interface, signature=u"v",
519
access=u"readwrite", byte_arrays=False):
651
520
"""Decorators for marking methods of a DBusObjectWithProperties to
652
521
become properties on the D-Bus.
653
522
660
529
"""
661
530
# Encoding deeply encoded byte arrays is not supported yet by the
662
531
# "Set" method, so we fail early here:
663
if byte_arrays and signature != "ay":
664
raise ValueError("Byte arrays not supported for non-'ay'"
665
" signature %r" % signature)
532
if byte_arrays and signature != u"ay":
533
raise ValueError(u"Byte arrays not supported for non-'ay'"
534
u" signature %r" % signature)
666
535
def decorator(func):
667
536
func._dbus_is_property = True
668
537
func._dbus_interface = dbus_interface
669
538
func._dbus_signature = signature
670
539
func._dbus_access = access
671
540
func._dbus_name = func.__name__
672
if func._dbus_name.endswith("_dbus_property"):
541
if func._dbus_name.endswith(u"_dbus_property"):
673
542
func._dbus_name = func._dbus_name[:-14]
674
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
543
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
675
544
return func
676
545
return decorator
677
546
697
566
698
567
class DBusObjectWithProperties(dbus.service.Object):
699
568
"""A D-Bus object with properties.
700
569
701
570
Classes inheriting from this can use the dbus_service_property
702
571
decorator to expose methods as D-Bus properties. It exposes the
703
572
standard Get(), Set(), and GetAll() methods on the D-Bus.
705
574
706
575
@staticmethod
707
576
def _is_dbus_property(obj):
708
return getattr(obj, "_dbus_is_property", False)
577
return getattr(obj, u"_dbus_is_property", False)
709
578
710
579
def _get_all_dbus_properties(self):
711
580
"""Returns a generator of (name, attribute) pairs
712
581
"""
713
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
714
for cls in self.__class__.__mro__
582
return ((prop._dbus_name, prop)
715
583
for name, prop in
716
inspect.getmembers(cls, self._is_dbus_property))
584
inspect.getmembers(self, self._is_dbus_property))
717
585
718
586
def _get_dbus_property(self, interface_name, property_name):
719
587
"""Returns a bound method if one exists which is a D-Bus
720
588
property with the specified name and interface.
721
589
"""
722
for cls in self.__class__.__mro__:
723
for name, value in (inspect.getmembers
724
(cls, self._is_dbus_property)):
725
if (value._dbus_name == property_name
726
and value._dbus_interface == interface_name):
727
return value.__get__(self)
728
590
for name in (property_name,
591
property_name + u"_dbus_property"):
592
prop = getattr(self, name, None)
593
if (prop is None
594
or not self._is_dbus_property(prop)
595
or prop._dbus_name != property_name
596
or (interface_name and prop._dbus_interface
597
and interface_name != prop._dbus_interface)):
598
continue
599
return prop
729
600
# No such property
730
raise DBusPropertyNotFound(self.dbus_object_path + ":"
731
+ interface_name + "."
601
raise DBusPropertyNotFound(self.dbus_object_path + u":"
602
+ interface_name + u"."
732
603
+ property_name)
733
604
734
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
735
out_signature="v")
605
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
606
out_signature=u"v")
736
607
def Get(self, interface_name, property_name):
737
608
"""Standard D-Bus property Get() method, see D-Bus standard.
738
609
"""
739
610
prop = self._get_dbus_property(interface_name, property_name)
740
if prop._dbus_access == "write":
611
if prop._dbus_access == u"write":
741
612
raise DBusPropertyAccessException(property_name)
742
613
value = prop()
743
if not hasattr(value, "variant_level"):
614
if not hasattr(value, u"variant_level"):
744
615
return value
745
616
return type(value)(value, variant_level=value.variant_level+1)
746
617
747
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
618
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
748
619
def Set(self, interface_name, property_name, value):
749
620
"""Standard D-Bus property Set() method, see D-Bus standard.
750
621
"""
751
622
prop = self._get_dbus_property(interface_name, property_name)
752
if prop._dbus_access == "read":
623
if prop._dbus_access == u"read":
753
624
raise DBusPropertyAccessException(property_name)
754
if prop._dbus_get_args_options["byte_arrays"]:
625
if prop._dbus_get_args_options[u"byte_arrays"]:
755
626
# The byte_arrays option is not supported yet on
756
627
# signatures other than "ay".
757
if prop._dbus_signature != "ay":
628
if prop._dbus_signature != u"ay":
758
629
raise ValueError
759
630
value = dbus.ByteArray(''.join(unichr(byte)
760
631
for byte in value))
761
632
prop(value)
762
633
763
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
764
out_signature="a{sv}")
634
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
635
out_signature=u"a{sv}")
765
636
def GetAll(self, interface_name):
766
637
"""Standard D-Bus property GetAll() method, see D-Bus
767
638
standard.
768
639
769
640
Note: Will not include properties with access="write".
770
641
"""
771
642
all = {}
775
646
# Interface non-empty but did not match
776
647
continue
777
648
# Ignore write-only properties
778
if prop._dbus_access == "write":
649
if prop._dbus_access == u"write":
779
650
continue
780
651
value = prop()
781
if not hasattr(value, "variant_level"):
652
if not hasattr(value, u"variant_level"):
782
653
all[name] = value
783
654
continue
784
655
all[name] = type(value)(value, variant_level=
785
656
value.variant_level+1)
786
return dbus.Dictionary(all, signature="sv")
657
return dbus.Dictionary(all, signature=u"sv")
787
658
788
659
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
789
out_signature="s",
660
out_signature=u"s",
790
661
path_keyword='object_path',
791
662
connection_keyword='connection')
792
663
def Introspect(self, object_path, connection):
797
668
try:
798
669
document = xml.dom.minidom.parseString(xmlstring)
799
670
def make_tag(document, name, prop):
800
e = document.createElement("property")
801
e.setAttribute("name", name)
802
e.setAttribute("type", prop._dbus_signature)
803
e.setAttribute("access", prop._dbus_access)
671
e = document.createElement(u"property")
672
e.setAttribute(u"name", name)
673
e.setAttribute(u"type", prop._dbus_signature)
674
e.setAttribute(u"access", prop._dbus_access)
804
675
return e
805
for if_tag in document.getElementsByTagName("interface"):
676
for if_tag in document.getElementsByTagName(u"interface"):
806
677
for tag in (make_tag(document, name, prop)
807
678
for name, prop
808
679
in self._get_all_dbus_properties()
809
680
if prop._dbus_interface
810
== if_tag.getAttribute("name")):
681
== if_tag.getAttribute(u"name")):
811
682
if_tag.appendChild(tag)
812
683
# Add the names to the return values for the
813
684
# "org.freedesktop.DBus.Properties" methods
814
if (if_tag.getAttribute("name")
815
== "org.freedesktop.DBus.Properties"):
816
for cn in if_tag.getElementsByTagName("method"):
817
if cn.getAttribute("name") == "Get":
818
for arg in cn.getElementsByTagName("arg"):
819
if (arg.getAttribute("direction")
820
== "out"):
821
arg.setAttribute("name", "value")
822
elif cn.getAttribute("name") == "GetAll":
823
for arg in cn.getElementsByTagName("arg"):
824
if (arg.getAttribute("direction")
825
== "out"):
826
arg.setAttribute("name", "props")
827
xmlstring = document.toxml("utf-8")
685
if (if_tag.getAttribute(u"name")
686
== u"org.freedesktop.DBus.Properties"):
687
for cn in if_tag.getElementsByTagName(u"method"):
688
if cn.getAttribute(u"name") == u"Get":
689
for arg in cn.getElementsByTagName(u"arg"):
690
if (arg.getAttribute(u"direction")
691
== u"out"):
692
arg.setAttribute(u"name", u"value")
693
elif cn.getAttribute(u"name") == u"GetAll":
694
for arg in cn.getElementsByTagName(u"arg"):
695
if (arg.getAttribute(u"direction")
696
== u"out"):
697
arg.setAttribute(u"name", u"props")
698
xmlstring = document.toxml(u"utf-8")
828
699
document.unlink()
829
700
except (AttributeError, xml.dom.DOMException,
830
xml.parsers.expat.ExpatError) as error:
831
logger.error("Failed to override Introspection method",
701
xml.parsers.expat.ExpatError), error:
702
logger.error(u"Failed to override Introspection method",
832
703
error)
833
704
return xmlstring
834
705
835
706
836
def datetime_to_dbus (dt, variant_level=0):
837
"""Convert a UTC datetime.datetime() to a D-Bus type."""
838
if dt is None:
839
return dbus.String("", variant_level = variant_level)
840
return dbus.String(dt.isoformat(),
841
variant_level=variant_level)
842
843
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
844
.__metaclass__):
845
"""Applied to an empty subclass of a D-Bus object, this metaclass
846
will add additional D-Bus attributes matching a certain pattern.
847
"""
848
def __new__(mcs, name, bases, attr):
849
# Go through all the base classes which could have D-Bus
850
# methods, signals, or properties in them
851
for base in (b for b in bases
852
if issubclass(b, dbus.service.Object)):
853
# Go though all attributes of the base class
854
for attrname, attribute in inspect.getmembers(base):
855
# Ignore non-D-Bus attributes, and D-Bus attributes
856
# with the wrong interface name
857
if (not hasattr(attribute, "_dbus_interface")
858
or not attribute._dbus_interface
859
.startswith("se.recompile.Mandos")):
860
continue
861
# Create an alternate D-Bus interface name based on
862
# the current name
863
alt_interface = (attribute._dbus_interface
864
.replace("se.recompile.Mandos",
865
"se.bsnet.fukt.Mandos"))
866
# Is this a D-Bus signal?
867
if getattr(attribute, "_dbus_is_signal", False):
868
# Extract the original non-method function by
869
# black magic
870
nonmethod_func = (dict(
871
zip(attribute.func_code.co_freevars,
872
attribute.__closure__))["func"]
873
.cell_contents)
874
# Create a new, but exactly alike, function
875
# object, and decorate it to be a new D-Bus signal
876
# with the alternate D-Bus interface name
877
new_function = (dbus.service.signal
878
(alt_interface,
879
attribute._dbus_signature)
880
(types.FunctionType(
881
nonmethod_func.func_code,
882
nonmethod_func.func_globals,
883
nonmethod_func.func_name,
884
nonmethod_func.func_defaults,
885
nonmethod_func.func_closure)))
886
# Define a creator of a function to call both the
887
# old and new functions, so both the old and new
888
# signals gets sent when the function is called
889
def fixscope(func1, func2):
890
"""This function is a scope container to pass
891
func1 and func2 to the "call_both" function
892
outside of its arguments"""
893
def call_both(*args, **kwargs):
894
"""This function will emit two D-Bus
895
signals by calling func1 and func2"""
896
func1(*args, **kwargs)
897
func2(*args, **kwargs)
898
return call_both
899
# Create the "call_both" function and add it to
900
# the class
901
attr[attrname] = fixscope(attribute,
902
new_function)
903
# Is this a D-Bus method?
904
elif getattr(attribute, "_dbus_is_method", False):
905
# Create a new, but exactly alike, function
906
# object. Decorate it to be a new D-Bus method
907
# with the alternate D-Bus interface name. Add it
908
# to the class.
909
attr[attrname] = (dbus.service.method
910
(alt_interface,
911
attribute._dbus_in_signature,
912
attribute._dbus_out_signature)
913
(types.FunctionType
914
(attribute.func_code,
915
attribute.func_globals,
916
attribute.func_name,
917
attribute.func_defaults,
918
attribute.func_closure)))
919
# Is this a D-Bus property?
920
elif getattr(attribute, "_dbus_is_property", False):
921
# Create a new, but exactly alike, function
922
# object, and decorate it to be a new D-Bus
923
# property with the alternate D-Bus interface
924
# name. Add it to the class.
925
attr[attrname] = (dbus_service_property
926
(alt_interface,
927
attribute._dbus_signature,
928
attribute._dbus_access,
929
attribute
930
._dbus_get_args_options
931
["byte_arrays"])
932
(types.FunctionType
933
(attribute.func_code,
934
attribute.func_globals,
935
attribute.func_name,
936
attribute.func_defaults,
937
attribute.func_closure)))
938
return type.__new__(mcs, name, bases, attr)
939
940
707
class ClientDBus(Client, DBusObjectWithProperties):
941
708
"""A Client class using D-Bus
942
709
946
713
"""
947
714
948
715
runtime_expansions = (Client.runtime_expansions
949
+ ("dbus_object_path",))
716
+ (u"dbus_object_path",))
950
717
951
718
# dbus.service.Object doesn't use super(), so we can't either.
952
719
953
720
def __init__(self, bus = None, *args, **kwargs):
954
self.bus = bus
955
721
self._approvals_pending = 0
722
self.bus = bus
956
723
Client.__init__(self, *args, **kwargs)
957
self.add_to_dbus()
958
959
def add_to_dbus(self):
960
724
# Only now, when this client is initialized, can it show up on
961
725
# the D-Bus
962
726
client_object_name = unicode(self.name).translate(
963
{ord("."): ord("_"),
964
ord("-"): ord("_")})
727
{ord(u"."): ord(u"_"),
728
ord(u"-"): ord(u"_")})
965
729
self.dbus_object_path = (dbus.ObjectPath
966
("/clients/" + client_object_name))
730
(u"/clients/" + client_object_name))
967
731
DBusObjectWithProperties.__init__(self, self.bus,
968
732
self.dbus_object_path)
969
733
970
def notifychangeproperty(transform_func,
971
dbus_name, type_func=lambda x: x,
972
variant_level=1):
973
""" Modify a variable so that it's a property which announces
974
its changes to DBus.
734
def _get_approvals_pending(self):
735
return self._approvals_pending
736
def _set_approvals_pending(self, value):
737
old_value = self._approvals_pending
738
self._approvals_pending = value
739
bval = bool(value)
740
if (hasattr(self, "dbus_object_path")
741
and bval is not bool(old_value)):
742
dbus_bool = dbus.Boolean(bval, variant_level=1)
743
self.PropertyChanged(dbus.String(u"ApprovalPending"),
744
dbus_bool)
975
745
976
transform_fun: Function that takes a value and a variant_level
977
and transforms it to a D-Bus type.
978
dbus_name: D-Bus name of the variable
979
type_func: Function that transform the value before sending it
980
to the D-Bus. Default: no transform
981
variant_level: D-Bus variant level. Default: 1
982
"""
983
attrname = "_{0}".format(dbus_name)
984
def setter(self, value):
985
if hasattr(self, "dbus_object_path"):
986
if (not hasattr(self, attrname) or
987
type_func(getattr(self, attrname, None))
988
!= type_func(value)):
989
dbus_value = transform_func(type_func(value),
990
variant_level
991
=variant_level)
992
self.PropertyChanged(dbus.String(dbus_name),
993
dbus_value)
994
setattr(self, attrname, value)
995
996
return property(lambda self: getattr(self, attrname), setter)
997
998
999
expires = notifychangeproperty(datetime_to_dbus, "Expires")
1000
approvals_pending = notifychangeproperty(dbus.Boolean,
1001
"ApprovalPending",
1002
type_func = bool)
1003
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1004
last_enabled = notifychangeproperty(datetime_to_dbus,
1005
"LastEnabled")
1006
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
1007
type_func = lambda checker:
1008
checker is not None)
1009
last_checked_ok = notifychangeproperty(datetime_to_dbus,
1010
"LastCheckedOK")
1011
last_approval_request = notifychangeproperty(
1012
datetime_to_dbus, "LastApprovalRequest")
1013
approved_by_default = notifychangeproperty(dbus.Boolean,
1014
"ApprovedByDefault")
1015
approval_delay = notifychangeproperty(dbus.UInt16,
1016
"ApprovalDelay",
1017
type_func =
1018
_timedelta_to_milliseconds)
1019
approval_duration = notifychangeproperty(
1020
dbus.UInt16, "ApprovalDuration",
1021
type_func = _timedelta_to_milliseconds)
1022
host = notifychangeproperty(dbus.String, "Host")
1023
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
1024
type_func =
1025
_timedelta_to_milliseconds)
1026
extended_timeout = notifychangeproperty(
1027
dbus.UInt16, "ExtendedTimeout",
1028
type_func = _timedelta_to_milliseconds)
1029
interval = notifychangeproperty(dbus.UInt16,
1030
"Interval",
1031
type_func =
1032
_timedelta_to_milliseconds)
1033
checker_command = notifychangeproperty(dbus.String, "Checker")
1034
1035
del notifychangeproperty
746
approvals_pending = property(_get_approvals_pending,
747
_set_approvals_pending)
748
del _get_approvals_pending, _set_approvals_pending
749
750
@staticmethod
751
def _datetime_to_dbus(dt, variant_level=0):
752
"""Convert a UTC datetime.datetime() to a D-Bus type."""
753
return dbus.String(dt.isoformat(),
754
variant_level=variant_level)
755
756
def enable(self):
757
oldstate = getattr(self, u"enabled", False)
758
r = Client.enable(self)
759
if oldstate != self.enabled:
760
# Emit D-Bus signals
761
self.PropertyChanged(dbus.String(u"Enabled"),
762
dbus.Boolean(True, variant_level=1))
763
self.PropertyChanged(
764
dbus.String(u"LastEnabled"),
765
self._datetime_to_dbus(self.last_enabled,
766
variant_level=1))
767
return r
768
769
def disable(self, quiet = False):
770
oldstate = getattr(self, u"enabled", False)
771
r = Client.disable(self, quiet=quiet)
772
if not quiet and oldstate != self.enabled:
773
# Emit D-Bus signal
774
self.PropertyChanged(dbus.String(u"Enabled"),
775
dbus.Boolean(False, variant_level=1))
776
return r
1036
777
1037
778
def __del__(self, *args, **kwargs):
1038
779
try:
1039
780
self.remove_from_connection()
1040
781
except LookupError:
1041
782
pass
1042
if hasattr(DBusObjectWithProperties, "__del__"):
783
if hasattr(DBusObjectWithProperties, u"__del__"):
1043
784
DBusObjectWithProperties.__del__(self, *args, **kwargs)
1044
785
Client.__del__(self, *args, **kwargs)
1045
786
1047
788
*args, **kwargs):
1048
789
self.checker_callback_tag = None
1049
790
self.checker = None
791
# Emit D-Bus signal
792
self.PropertyChanged(dbus.String(u"CheckerRunning"),
793
dbus.Boolean(False, variant_level=1))
1050
794
if os.WIFEXITED(condition):
1051
795
exitstatus = os.WEXITSTATUS(condition)
1052
796
# Emit D-Bus signal
1062
806
return Client.checker_callback(self, pid, condition, command,
1063
807
*args, **kwargs)
1064
808
809
def checked_ok(self, *args, **kwargs):
810
r = Client.checked_ok(self, *args, **kwargs)
811
# Emit D-Bus signal
812
self.PropertyChanged(
813
dbus.String(u"LastCheckedOK"),
814
(self._datetime_to_dbus(self.last_checked_ok,
815
variant_level=1)))
816
return r
817
1065
818
def start_checker(self, *args, **kwargs):
1066
819
old_checker = self.checker
1067
820
if self.checker is not None:
1074
827
and old_checker_pid != self.checker.pid):
1075
828
# Emit D-Bus signal
1076
829
self.CheckerStarted(self.current_checker_command)
830
self.PropertyChanged(
831
dbus.String(u"CheckerRunning"),
832
dbus.Boolean(True, variant_level=1))
1077
833
return r
1078
834
835
def stop_checker(self, *args, **kwargs):
836
old_checker = getattr(self, u"checker", None)
837
r = Client.stop_checker(self, *args, **kwargs)
838
if (old_checker is not None
839
and getattr(self, u"checker", None) is None):
840
self.PropertyChanged(dbus.String(u"CheckerRunning"),
841
dbus.Boolean(False, variant_level=1))
842
return r
843
1079
844
def _reset_approved(self):
1080
845
self._approved = None
1081
846
return False
1083
848
def approve(self, value=True):
1084
849
self.send_changedstate()
1085
850
self._approved = value
1086
gobject.timeout_add(_timedelta_to_milliseconds
851
gobject.timeout_add(self._timedelta_to_milliseconds
1087
852
(self.approval_duration),
1088
853
self._reset_approved)
1089
854
1090
855
1091
856
## D-Bus methods, signals & properties
1092
_interface = "se.recompile.Mandos.Client"
857
_interface = u"se.bsnet.fukt.Mandos.Client"
1093
858
1094
859
## Signals
1095
860
1096
861
# CheckerCompleted - signal
1097
@dbus.service.signal(_interface, signature="nxs")
862
@dbus.service.signal(_interface, signature=u"nxs")
1098
863
def CheckerCompleted(self, exitcode, waitstatus, command):
1099
864
"D-Bus signal"
1100
865
pass
1101
866
1102
867
# CheckerStarted - signal
1103
@dbus.service.signal(_interface, signature="s")
868
@dbus.service.signal(_interface, signature=u"s")
1104
869
def CheckerStarted(self, command):
1105
870
"D-Bus signal"
1106
871
pass
1107
872
1108
873
# PropertyChanged - signal
1109
@dbus.service.signal(_interface, signature="sv")
874
@dbus.service.signal(_interface, signature=u"sv")
1110
875
def PropertyChanged(self, property, value):
1111
876
"D-Bus signal"
1112
877
pass
1121
886
pass
1122
887
1123
888
# Rejected - signal
1124
@dbus.service.signal(_interface, signature="s")
889
@dbus.service.signal(_interface, signature=u"s")
1125
890
def Rejected(self, reason):
1126
891
"D-Bus signal"
1127
892
pass
1128
893
1129
894
# NeedApproval - signal
1130
@dbus.service.signal(_interface, signature="tb")
895
@dbus.service.signal(_interface, signature=u"tb")
1131
896
def NeedApproval(self, timeout, default):
1132
897
"D-Bus signal"
1133
return self.need_approval()
898
pass
1134
899
1135
900
## Methods
1136
901
1137
902
# Approve - method
1138
@dbus.service.method(_interface, in_signature="b")
903
@dbus.service.method(_interface, in_signature=u"b")
1139
904
def Approve(self, value):
1140
905
self.approve(value)
1141
906
1142
907
# CheckedOK - method
1143
908
@dbus.service.method(_interface)
1144
909
def CheckedOK(self):
1145
self.checked_ok()
910
return self.checked_ok()
1146
911
1147
912
# Enable - method
1148
913
@dbus.service.method(_interface)
1170
935
## Properties
1171
936
1172
937
# ApprovalPending - property
1173
@dbus_service_property(_interface, signature="b", access="read")
938
@dbus_service_property(_interface, signature=u"b", access=u"read")
1174
939
def ApprovalPending_dbus_property(self):
1175
940
return dbus.Boolean(bool(self.approvals_pending))
1176
941
1177
942
# ApprovedByDefault - property
1178
@dbus_service_property(_interface, signature="b",
1179
access="readwrite")
943
@dbus_service_property(_interface, signature=u"b",
944
access=u"readwrite")
1180
945
def ApprovedByDefault_dbus_property(self, value=None):
1181
946
if value is None: # get
1182
947
return dbus.Boolean(self.approved_by_default)
1183
948
self.approved_by_default = bool(value)
949
# Emit D-Bus signal
950
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
951
dbus.Boolean(value, variant_level=1))
1184
952
1185
953
# ApprovalDelay - property
1186
@dbus_service_property(_interface, signature="t",
1187
access="readwrite")
954
@dbus_service_property(_interface, signature=u"t",
955
access=u"readwrite")
1188
956
def ApprovalDelay_dbus_property(self, value=None):
1189
957
if value is None: # get
1190
958
return dbus.UInt64(self.approval_delay_milliseconds())
1191
959
self.approval_delay = datetime.timedelta(0, 0, 0, value)
960
# Emit D-Bus signal
961
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
962
dbus.UInt64(value, variant_level=1))
1192
963
1193
964
# ApprovalDuration - property
1194
@dbus_service_property(_interface, signature="t",
1195
access="readwrite")
965
@dbus_service_property(_interface, signature=u"t",
966
access=u"readwrite")
1196
967
def ApprovalDuration_dbus_property(self, value=None):
1197
968
if value is None: # get
1198
return dbus.UInt64(_timedelta_to_milliseconds(
969
return dbus.UInt64(self._timedelta_to_milliseconds(
1199
970
self.approval_duration))
1200
971
self.approval_duration = datetime.timedelta(0, 0, 0, value)
972
# Emit D-Bus signal
973
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
974
dbus.UInt64(value, variant_level=1))
1201
975
1202
976
# Name - property
1203
@dbus_service_property(_interface, signature="s", access="read")
977
@dbus_service_property(_interface, signature=u"s", access=u"read")
1204
978
def Name_dbus_property(self):
1205
979
return dbus.String(self.name)
1206
980
1207
981
# Fingerprint - property
1208
@dbus_service_property(_interface, signature="s", access="read")
982
@dbus_service_property(_interface, signature=u"s", access=u"read")
1209
983
def Fingerprint_dbus_property(self):
1210
984
return dbus.String(self.fingerprint)
1211
985
1212
986
# Host - property
1213
@dbus_service_property(_interface, signature="s",
1214
access="readwrite")
987
@dbus_service_property(_interface, signature=u"s",
988
access=u"readwrite")
1215
989
def Host_dbus_property(self, value=None):
1216
990
if value is None: # get
1217
991
return dbus.String(self.host)
1218
992
self.host = value
993
# Emit D-Bus signal
994
self.PropertyChanged(dbus.String(u"Host"),
995
dbus.String(value, variant_level=1))
1219
996
1220
997
# Created - property
1221
@dbus_service_property(_interface, signature="s", access="read")
998
@dbus_service_property(_interface, signature=u"s", access=u"read")
1222
999
def Created_dbus_property(self):
1223
return dbus.String(datetime_to_dbus(self.created))
1000
return dbus.String(self._datetime_to_dbus(self.created))
1224
1001
1225
1002
# LastEnabled - property
1226
@dbus_service_property(_interface, signature="s", access="read")
1003
@dbus_service_property(_interface, signature=u"s", access=u"read")
1227
1004
def LastEnabled_dbus_property(self):
1228
return datetime_to_dbus(self.last_enabled)
1005
if self.last_enabled is None:
1006
return dbus.String(u"")
1007
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1229
1008
1230
1009
# Enabled - property
1231
@dbus_service_property(_interface, signature="b",
1232
access="readwrite")
1010
@dbus_service_property(_interface, signature=u"b",
1011
access=u"readwrite")
1233
1012
def Enabled_dbus_property(self, value=None):
1234
1013
if value is None: # get
1235
1014
return dbus.Boolean(self.enabled)
1239
1018
self.disable()
1240
1019
1241
1020
# LastCheckedOK - property
1242
@dbus_service_property(_interface, signature="s",
1243
access="readwrite")
1021
@dbus_service_property(_interface, signature=u"s",
1022
access=u"readwrite")
1244
1023
def LastCheckedOK_dbus_property(self, value=None):
1245
1024
if value is not None:
1246
1025
self.checked_ok()
1247
1026
return
1248
return datetime_to_dbus(self.last_checked_ok)
1249
1250
# Expires - property
1251
@dbus_service_property(_interface, signature="s", access="read")
1252
def Expires_dbus_property(self):
1253
return datetime_to_dbus(self.expires)
1254
1255
# LastApprovalRequest - property
1256
@dbus_service_property(_interface, signature="s", access="read")
1257
def LastApprovalRequest_dbus_property(self):
1258
return datetime_to_dbus(self.last_approval_request)
1027
if self.last_checked_ok is None:
1028
return dbus.String(u"")
1029
return dbus.String(self._datetime_to_dbus(self
1030
.last_checked_ok))
1259
1031
1260
1032
# Timeout - property
1261
@dbus_service_property(_interface, signature="t",
1262
access="readwrite")
1033
@dbus_service_property(_interface, signature=u"t",
1034
access=u"readwrite")
1263
1035
def Timeout_dbus_property(self, value=None):
1264
1036
if value is None: # get
1265
1037
return dbus.UInt64(self.timeout_milliseconds())
1266
1038
self.timeout = datetime.timedelta(0, 0, 0, value)
1267
if getattr(self, "disable_initiator_tag", None) is None:
1039
# Emit D-Bus signal
1040
self.PropertyChanged(dbus.String(u"Timeout"),
1041
dbus.UInt64(value, variant_level=1))
1042
if getattr(self, u"disable_initiator_tag", None) is None:
1268
1043
return
1269
1044
# Reschedule timeout
1270
1045
gobject.source_remove(self.disable_initiator_tag)
1271
1046
self.disable_initiator_tag = None
1272
self.expires = None
1273
time_to_die = _timedelta_to_milliseconds((self
1274
.last_checked_ok
1275
+ self.timeout)
1276
- datetime.datetime
1277
.utcnow())
1047
time_to_die = (self.
1048
_timedelta_to_milliseconds((self
1049
.last_checked_ok
1050
+ self.timeout)
1051
- datetime.datetime
1052
.utcnow()))
1278
1053
if time_to_die <= 0:
1279
1054
# The timeout has passed
1280
1055
self.disable()
1281
1056
else:
1282
self.expires = (datetime.datetime.utcnow()
1283
+ datetime.timedelta(milliseconds =
1284
time_to_die))
1285
1057
self.disable_initiator_tag = (gobject.timeout_add
1286
1058
(time_to_die, self.disable))
1287
1059
1288
# ExtendedTimeout - property
1289
@dbus_service_property(_interface, signature="t",
1290
access="readwrite")
1291
def ExtendedTimeout_dbus_property(self, value=None):
1292
if value is None: # get
1293
return dbus.UInt64(self.extended_timeout_milliseconds())
1294
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1295
1296
1060
# Interval - property
1297
@dbus_service_property(_interface, signature="t",
1298
access="readwrite")
1061
@dbus_service_property(_interface, signature=u"t",
1062
access=u"readwrite")
1299
1063
def Interval_dbus_property(self, value=None):
1300
1064
if value is None: # get
1301
1065
return dbus.UInt64(self.interval_milliseconds())
1302
1066
self.interval = datetime.timedelta(0, 0, 0, value)
1303
if getattr(self, "checker_initiator_tag", None) is None:
1067
# Emit D-Bus signal
1068
self.PropertyChanged(dbus.String(u"Interval"),
1069
dbus.UInt64(value, variant_level=1))
1070
if getattr(self, u"checker_initiator_tag", None) is None:
1304
1071
return
1305
1072
# Reschedule checker run
1306
1073
gobject.source_remove(self.checker_initiator_tag)
1307
1074
self.checker_initiator_tag = (gobject.timeout_add
1308
1075
(value, self.start_checker))
1309
1076
self.start_checker() # Start one now, too
1310
1077
1311
1078
# Checker - property
1312
@dbus_service_property(_interface, signature="s",
1313
access="readwrite")
1079
@dbus_service_property(_interface, signature=u"s",
1080
access=u"readwrite")
1314
1081
def Checker_dbus_property(self, value=None):
1315
1082
if value is None: # get
1316
1083
return dbus.String(self.checker_command)
1317
1084
self.checker_command = value
1085
# Emit D-Bus signal
1086
self.PropertyChanged(dbus.String(u"Checker"),
1087
dbus.String(self.checker_command,
1088
variant_level=1))
1318
1089
1319
1090
# CheckerRunning - property
1320
@dbus_service_property(_interface, signature="b",
1321
access="readwrite")
1091
@dbus_service_property(_interface, signature=u"b",
1092
access=u"readwrite")
1322
1093
def CheckerRunning_dbus_property(self, value=None):
1323
1094
if value is None: # get
1324
1095
return dbus.Boolean(self.checker is not None)
1328
1099
self.stop_checker()
1329
1100
1330
1101
# ObjectPath - property
1331
@dbus_service_property(_interface, signature="o", access="read")
1102
@dbus_service_property(_interface, signature=u"o", access=u"read")
1332
1103
def ObjectPath_dbus_property(self):
1333
1104
return self.dbus_object_path # is already a dbus.ObjectPath
1334
1105
1335
1106
# Secret = property
1336
@dbus_service_property(_interface, signature="ay",
1337
access="write", byte_arrays=True)
1107
@dbus_service_property(_interface, signature=u"ay",
1108
access=u"write", byte_arrays=True)
1338
1109
def Secret_dbus_property(self, value):
1339
1110
self.secret = str(value)
1340
1111
1347
1118
self._pipe.send(('init', fpr, address))
1348
1119
if not self._pipe.recv():
1349
1120
raise KeyError()
1350
1121
1351
1122
def __getattribute__(self, name):
1352
1123
if(name == '_pipe'):
1353
1124
return super(ProxyClient, self).__getattribute__(name)
1360
1131
self._pipe.send(('funcall', name, args, kwargs))
1361
1132
return self._pipe.recv()[1]
1362
1133
return func
1363
1134
1364
1135
def __setattr__(self, name, value):
1365
1136
if(name == '_pipe'):
1366
1137
return super(ProxyClient, self).__setattr__(name, value)
1367
1138
self._pipe.send(('setattr', name, value))
1368
1139
1369
class ClientDBusTransitional(ClientDBus):
1370
__metaclass__ = AlternateDBusNamesMetaclass
1371
1140
1372
1141
class ClientHandler(socketserver.BaseRequestHandler, object):
1373
1142
"""A class to handle client connections.
1377
1146
1378
1147
def handle(self):
1379
1148
with contextlib.closing(self.server.child_pipe) as child_pipe:
1380
logger.info("TCP connection from: %s",
1149
logger.info(u"TCP connection from: %s",
1381
1150
unicode(self.client_address))
1382
logger.debug("Pipe FD: %d",
1151
logger.debug(u"Pipe FD: %d",
1383
1152
self.server.child_pipe.fileno())
1384
1153
1385
1154
session = (gnutls.connection
1386
1155
.ClientSession(self.request,
1387
1156
gnutls.connection
1388
1157
.X509Credentials()))
1389
1158
1390
1159
# Note: gnutls.connection.X509Credentials is really a
1391
1160
# generic GnuTLS certificate credentials object so long as
1392
1161
# no X.509 keys are added to it. Therefore, we can use it
1393
1162
# here despite using OpenPGP certificates.
1394
1395
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1396
# "+AES-256-CBC", "+SHA1",
1397
# "+COMP-NULL", "+CTYPE-OPENPGP",
1398
# "+DHE-DSS"))
1163
1164
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1165
# u"+AES-256-CBC", u"+SHA1",
1166
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1167
# u"+DHE-DSS"))
1399
1168
# Use a fallback default, since this MUST be set.
1400
1169
priority = self.server.gnutls_priority
1401
1170
if priority is None:
1402
priority = "NORMAL"
1171
priority = u"NORMAL"
1403
1172
(gnutls.library.functions
1404
1173
.gnutls_priority_set_direct(session._c_object,
1405
1174
priority, None))
1406
1175
1407
1176
# Start communication using the Mandos protocol
1408
1177
# Get protocol number
1409
1178
line = self.request.makefile().readline()
1410
logger.debug("Protocol version: %r", line)
1179
logger.debug(u"Protocol version: %r", line)
1411
1180
try:
1412
1181
if int(line.strip().split()[0]) > 1:
1413
1182
raise RuntimeError
1414
except (ValueError, IndexError, RuntimeError) as error:
1415
logger.error("Unknown protocol version: %s", error)
1183
except (ValueError, IndexError, RuntimeError), error:
1184
logger.error(u"Unknown protocol version: %s", error)
1416
1185
return
1417
1186
1418
1187
# Start GnuTLS connection
1419
1188
try:
1420
1189
session.handshake()
1421
except gnutls.errors.GNUTLSError as error:
1422
logger.warning("Handshake failed: %s", error)
1190
except gnutls.errors.GNUTLSError, error:
1191
logger.warning(u"Handshake failed: %s", error)
1423
1192
# Do not run session.bye() here: the session is not
1424
1193
# established. Just abandon the request.
1425
1194
return
1426
logger.debug("Handshake succeeded")
1427
1195
logger.debug(u"Handshake succeeded")
1196
1428
1197
approval_required = False
1429
1198
try:
1430
1199
try:
1431
1200
fpr = self.fingerprint(self.peer_certificate
1432
1201
(session))
1433
except (TypeError,
1434
gnutls.errors.GNUTLSError) as error:
1435
logger.warning("Bad certificate: %s", error)
1202
except (TypeError, gnutls.errors.GNUTLSError), error:
1203
logger.warning(u"Bad certificate: %s", error)
1436
1204
return
1437
logger.debug("Fingerprint: %s", fpr)
1438
1205
logger.debug(u"Fingerprint: %s", fpr)
1206
1439
1207
try:
1440
1208
client = ProxyClient(child_pipe, fpr,
1441
1209
self.client_address)
1449
1217
1450
1218
while True:
1451
1219
if not client.enabled:
1452
logger.info("Client %s is disabled",
1220
logger.warning(u"Client %s is disabled",
1453
1221
client.name)
1454
1222
if self.server.use_dbus:
1455
1223
# Emit D-Bus signal
1456
client.Rejected("Disabled")
1224
client.Rejected("Disabled")
1457
1225
return
1458
1226
1459
1227
if client._approved or not client.approval_delay:
1460
1228
#We are approved or approval is disabled
1461
1229
break
1462
1230
elif client._approved is None:
1463
logger.info("Client %s needs approval",
1231
logger.info(u"Client %s needs approval",
1464
1232
client.name)
1465
1233
if self.server.use_dbus:
1466
1234
# Emit D-Bus signal
1468
1236
client.approval_delay_milliseconds(),
1469
1237
client.approved_by_default)
1470
1238
else:
1471
logger.warning("Client %s was not approved",
1239
logger.warning(u"Client %s was not approved",
1472
1240
client.name)
1473
1241
if self.server.use_dbus:
1474
1242
# Emit D-Bus signal
1476
1244
return
1477
1245
1478
1246
#wait until timeout or approved
1247
#x = float(client._timedelta_to_milliseconds(delay))
1479
1248
time = datetime.datetime.now()
1480
1249
client.changedstate.acquire()
1481
(client.changedstate.wait
1482
(float(client._timedelta_to_milliseconds(delay)
1483
/ 1000)))
1250
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1484
1251
client.changedstate.release()
1485
1252
time2 = datetime.datetime.now()
1486
1253
if (time2 - time) >= delay:
1501
1268
while sent_size < len(client.secret):
1502
1269
try:
1503
1270
sent = session.send(client.secret[sent_size:])
1504
except gnutls.errors.GNUTLSError as error:
1271
except (gnutls.errors.GNUTLSError), error:
1505
1272
logger.warning("gnutls send failed")
1506
1273
return
1507
logger.debug("Sent: %d, remaining: %d",
1274
logger.debug(u"Sent: %d, remaining: %d",
1508
1275
sent, len(client.secret)
1509
1276
- (sent_size + sent))
1510
1277
sent_size += sent
1511
1512
logger.info("Sending secret to %s", client.name)
1513
# bump the timeout using extended_timeout
1514
client.checked_ok(client.extended_timeout)
1278
1279
logger.info(u"Sending secret to %s", client.name)
1280
# bump the timeout as if seen
1281
client.checked_ok()
1515
1282
if self.server.use_dbus:
1516
1283
# Emit D-Bus signal
1517
1284
client.GotSecret()
1521
1288
client.approvals_pending -= 1
1522
1289
try:
1523
1290
session.bye()
1524
except gnutls.errors.GNUTLSError as error:
1291
except (gnutls.errors.GNUTLSError), error:
1525
1292
logger.warning("GnuTLS bye failed")
1526
1293
1527
1294
@staticmethod
1538
1305
.gnutls_certificate_get_peers
1539
1306
(session._c_object, ctypes.byref(list_size)))
1540
1307
if not bool(cert_list) and list_size.value != 0:
1541
raise gnutls.errors.GNUTLSError("error getting peer"
1542
" certificate")
1308
raise gnutls.errors.GNUTLSError(u"error getting peer"
1309
u" certificate")
1543
1310
if list_size.value == 0:
1544
1311
return None
1545
1312
cert = cert_list[0]
1571
1338
if crtverify.value != 0:
1572
1339
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1573
1340
raise (gnutls.errors.CertificateSecurityError
1574
("Verify failed"))
1341
(u"Verify failed"))
1575
1342
# New buffer for the fingerprint
1576
1343
buf = ctypes.create_string_buffer(20)
1577
1344
buf_len = ctypes.c_size_t()
1584
1351
# Convert the buffer to a Python bytestring
1585
1352
fpr = ctypes.string_at(buf, buf_len.value)
1586
1353
# Convert the bytestring to hexadecimal notation
1587
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1354
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1588
1355
return hex_fpr
1589
1356
1590
1357
1596
1363
except:
1597
1364
self.handle_error(request, address)
1598
1365
self.close_request(request)
1599
1366
1600
1367
def process_request(self, request, address):
1601
1368
"""Start a new process to process the request."""
1602
proc = multiprocessing.Process(target = self.sub_process_main,
1603
args = (request,
1604
address))
1605
proc.start()
1606
return proc
1607
1369
multiprocessing.Process(target = self.sub_process_main,
1370
args = (request, address)).start()
1608
1371
1609
1372
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1610
1373
""" adds a pipe to the MixIn """
1614
1377
This function creates a new pipe in self.pipe
1615
1378
"""
1616
1379
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1617
1618
proc = MultiprocessingMixIn.process_request(self, request,
1619
client_address)
1380
1381
super(MultiprocessingMixInWithPipe,
1382
self).process_request(request, client_address)
1620
1383
self.child_pipe.close()
1621
self.add_pipe(parent_pipe, proc)
1622
1623
def add_pipe(self, parent_pipe, proc):
1384
self.add_pipe(parent_pipe)
1385
1386
def add_pipe(self, parent_pipe):
1624
1387
"""Dummy function; override as necessary"""
1625
raise NotImplementedError
1626
1388
pass
1627
1389
1628
1390
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1629
1391
socketserver.TCPServer, object):
1647
1409
bind to an address or port if they were not specified."""
1648
1410
if self.interface is not None:
1649
1411
if SO_BINDTODEVICE is None:
1650
logger.error("SO_BINDTODEVICE does not exist;"
1651
" cannot bind to interface %s",
1412
logger.error(u"SO_BINDTODEVICE does not exist;"
1413
u" cannot bind to interface %s",
1652
1414
self.interface)
1653
1415
else:
1654
1416
try:
1655
1417
self.socket.setsockopt(socket.SOL_SOCKET,
1656
1418
SO_BINDTODEVICE,
1657
1419
str(self.interface
1658
+ '\0'))
1659
except socket.error as error:
1420
+ u'\0'))
1421
except socket.error, error:
1660
1422
if error[0] == errno.EPERM:
1661
logger.error("No permission to"
1662
" bind to interface %s",
1423
logger.error(u"No permission to"
1424
u" bind to interface %s",
1663
1425
self.interface)
1664
1426
elif error[0] == errno.ENOPROTOOPT:
1665
logger.error("SO_BINDTODEVICE not available;"
1666
" cannot bind to interface %s",
1427
logger.error(u"SO_BINDTODEVICE not available;"
1428
u" cannot bind to interface %s",
1667
1429
self.interface)
1668
1430
else:
1669
1431
raise
1671
1433
if self.server_address[0] or self.server_address[1]:
1672
1434
if not self.server_address[0]:
1673
1435
if self.address_family == socket.AF_INET6:
1674
any_address = "::" # in6addr_any
1436
any_address = u"::" # in6addr_any
1675
1437
else:
1676
1438
any_address = socket.INADDR_ANY
1677
1439
self.server_address = (any_address,
1704
1466
self.enabled = False
1705
1467
self.clients = clients
1706
1468
if self.clients is None:
1707
self.clients = {}
1469
self.clients = set()
1708
1470
self.use_dbus = use_dbus
1709
1471
self.gnutls_priority = gnutls_priority
1710
1472
IPv6_TCPServer.__init__(self, server_address,
1714
1476
def server_activate(self):
1715
1477
if self.enabled:
1716
1478
return socketserver.TCPServer.server_activate(self)
1717
1718
1479
def enable(self):
1719
1480
self.enabled = True
1720
1721
def add_pipe(self, parent_pipe, proc):
1481
def add_pipe(self, parent_pipe):
1722
1482
# Call "handle_ipc" for both data and EOF events
1723
1483
gobject.io_add_watch(parent_pipe.fileno(),
1724
1484
gobject.IO_IN | gobject.IO_HUP,
1725
1485
functools.partial(self.handle_ipc,
1726
parent_pipe =
1727
parent_pipe,
1728
proc = proc))
1729
1486
parent_pipe = parent_pipe))
1487
1730
1488
def handle_ipc(self, source, condition, parent_pipe=None,
1731
proc = None, client_object=None):
1489
client_object=None):
1732
1490
condition_names = {
1733
gobject.IO_IN: "IN", # There is data to read.
1734
gobject.IO_OUT: "OUT", # Data can be written (without
1491
gobject.IO_IN: u"IN", # There is data to read.
1492
gobject.IO_OUT: u"OUT", # Data can be written (without
1735
1493
# blocking).
1736
gobject.IO_PRI: "PRI", # There is urgent data to read.
1737
gobject.IO_ERR: "ERR", # Error condition.
1738
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1494
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1495
gobject.IO_ERR: u"ERR", # Error condition.
1496
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1739
1497
# broken, usually for pipes and
1740
1498
# sockets).
1741
1499
}
1743
1501
for cond, name in
1744
1502
condition_names.iteritems()
1745
1503
if cond & condition)
1746
# error, or the other end of multiprocessing.Pipe has closed
1504
# error or the other end of multiprocessing.Pipe has closed
1747
1505
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1748
# Wait for other process to exit
1749
proc.join()
1750
1506
return False
1751
1507
1752
1508
# Read a request from the child
1757
1513
fpr = request[1]
1758
1514
address = request[2]
1759
1515
1760
for c in self.clients.itervalues():
1516
for c in self.clients:
1761
1517
if c.fingerprint == fpr:
1762
1518
client = c
1763
1519
break
1764
1520
else:
1765
logger.info("Client not found for fingerprint: %s, ad"
1766
"dress: %s", fpr, address)
1521
logger.warning(u"Client not found for fingerprint: %s, ad"
1522
u"dress: %s", fpr, address)
1767
1523
if self.use_dbus:
1768
1524
# Emit D-Bus signal
1769
mandos_dbus_service.ClientNotFound(fpr,
1770
address[0])
1525
mandos_dbus_service.ClientNotFound(fpr, address[0])
1771
1526
parent_pipe.send(False)
1772
1527
return False
1773
1528
1774
1529
gobject.io_add_watch(parent_pipe.fileno(),
1775
1530
gobject.IO_IN | gobject.IO_HUP,
1776
1531
functools.partial(self.handle_ipc,
1777
parent_pipe =
1778
parent_pipe,
1779
proc = proc,
1780
client_object =
1781
client))
1532
parent_pipe = parent_pipe,
1533
client_object = client))
1782
1534
parent_pipe.send(True)
1783
# remove the old hook in favor of the new above hook on
1784
# same fileno
1535
# remove the old hook in favor of the new above hook on same fileno
1785
1536
return False
1786
1537
if command == 'funcall':
1787
1538
funcname = request[1]
1788
1539
args = request[2]
1789
1540
kwargs = request[3]
1790
1541
1791
parent_pipe.send(('data', getattr(client_object,
1792
funcname)(*args,
1793
**kwargs)))
1794
1542
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1543
1795
1544
if command == 'getattr':
1796
1545
attrname = request[1]
1797
1546
if callable(client_object.__getattribute__(attrname)):
1798
1547
parent_pipe.send(('function',))
1799
1548
else:
1800
parent_pipe.send(('data', client_object
1801
.__getattribute__(attrname)))
1549
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1802
1550
1803
1551
if command == 'setattr':
1804
1552
attrname = request[1]
1805
1553
value = request[2]
1806
1554
setattr(client_object, attrname, value)
1807
1555
1808
1556
return True
1809
1557
1810
1558
1811
1559
def string_to_delta(interval):
1812
1560
"""Parse a string and return a datetime.timedelta
1813
1561
1814
>>> string_to_delta('7d')
1562
>>> string_to_delta(u'7d')
1815
1563
datetime.timedelta(7)
1816
>>> string_to_delta('60s')
1564
>>> string_to_delta(u'60s')
1817
1565
datetime.timedelta(0, 60)
1818
>>> string_to_delta('60m')
1566
>>> string_to_delta(u'60m')
1819
1567
datetime.timedelta(0, 3600)
1820
>>> string_to_delta('24h')
1568
>>> string_to_delta(u'24h')
1821
1569
datetime.timedelta(1)
1822
>>> string_to_delta('1w')
1570
>>> string_to_delta(u'1w')
1823
1571
datetime.timedelta(7)
1824
>>> string_to_delta('5m 30s')
1572
>>> string_to_delta(u'5m 30s')
1825
1573
datetime.timedelta(0, 330)
1826
1574
"""
1827
1575
timevalue = datetime.timedelta(0)
1829
1577
try:
1830
1578
suffix = unicode(s[-1])
1831
1579
value = int(s[:-1])
1832
if suffix == "d":
1580
if suffix == u"d":
1833
1581
delta = datetime.timedelta(value)
1834
elif suffix == "s":
1582
elif suffix == u"s":
1835
1583
delta = datetime.timedelta(0, value)
1836
elif suffix == "m":
1584
elif suffix == u"m":
1837
1585
delta = datetime.timedelta(0, 0, 0, 0, value)
1838
elif suffix == "h":
1586
elif suffix == u"h":
1839
1587
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1840
elif suffix == "w":
1588
elif suffix == u"w":
1841
1589
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1842
1590
else:
1843
raise ValueError("Unknown suffix %r" % suffix)
1844
except (ValueError, IndexError) as e:
1845
raise ValueError(*(e.args))
1591
raise ValueError(u"Unknown suffix %r" % suffix)
1592
except (ValueError, IndexError), e:
1593
raise ValueError(e.message)
1846
1594
timevalue += delta
1847
1595
return timevalue
1848
1596
1854
1602
global if_nametoindex
1855
1603
try:
1856
1604
if_nametoindex = (ctypes.cdll.LoadLibrary
1857
(ctypes.util.find_library("c"))
1605
(ctypes.util.find_library(u"c"))
1858
1606
.if_nametoindex)
1859
1607
except (OSError, AttributeError):
1860
logger.warning("Doing if_nametoindex the hard way")
1608
logger.warning(u"Doing if_nametoindex the hard way")
1861
1609
def if_nametoindex(interface):
1862
1610
"Get an interface index the hard way, i.e. using fcntl()"
1863
1611
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1864
1612
with contextlib.closing(socket.socket()) as s:
1865
1613
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1866
struct.pack(str("16s16x"),
1614
struct.pack(str(u"16s16x"),
1867
1615
interface))
1868
interface_index = struct.unpack(str("I"),
1616
interface_index = struct.unpack(str(u"I"),
1869
1617
ifreq[16:20])[0]
1870
1618
return interface_index
1871
1619
return if_nametoindex(interface)
1879
1627
sys.exit()
1880
1628
os.setsid()
1881
1629
if not nochdir:
1882
os.chdir("/")
1630
os.chdir(u"/")
1883
1631
if os.fork():
1884
1632
sys.exit()
1885
1633
if not noclose:
1887
1635
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1888
1636
if not stat.S_ISCHR(os.fstat(null).st_mode):
1889
1637
raise OSError(errno.ENODEV,
1890
"%s not a character device"
1638
u"%s not a character device"
1891
1639
% os.path.devnull)
1892
1640
os.dup2(null, sys.stdin.fileno())
1893
1641
os.dup2(null, sys.stdout.fileno())
1901
1649
##################################################################
1902
1650
# Parsing of options, both command line and config file
1903
1651
1904
parser = argparse.ArgumentParser()
1905
parser.add_argument("-v", "--version", action="version",
1906
version = "%%(prog)s %s" % version,
1907
help="show version number and exit")
1908
parser.add_argument("-i", "--interface", metavar="IF",
1909
help="Bind to interface IF")
1910
parser.add_argument("-a", "--address",
1911
help="Address to listen for requests on")
1912
parser.add_argument("-p", "--port", type=int,
1913
help="Port number to receive requests on")
1914
parser.add_argument("--check", action="store_true",
1915
help="Run self-test")
1916
parser.add_argument("--debug", action="store_true",
1917
help="Debug mode; run in foreground and log"
1918
" to terminal")
1919
parser.add_argument("--debuglevel", metavar="LEVEL",
1920
help="Debug level for stdout output")
1921
parser.add_argument("--priority", help="GnuTLS"
1922
" priority string (see GnuTLS documentation)")
1923
parser.add_argument("--servicename",
1924
metavar="NAME", help="Zeroconf service name")
1925
parser.add_argument("--configdir",
1926
default="/etc/mandos", metavar="DIR",
1927
help="Directory to search for configuration"
1928
" files")
1929
parser.add_argument("--no-dbus", action="store_false",
1930
dest="use_dbus", help="Do not provide D-Bus"
1931
" system bus interface")
1932
parser.add_argument("--no-ipv6", action="store_false",
1933
dest="use_ipv6", help="Do not use IPv6")
1934
parser.add_argument("--no-restore", action="store_false",
1935
dest="restore",
1936
help="Do not restore stored state",
1937
default=True)
1938
1939
options = parser.parse_args()
1652
parser = optparse.OptionParser(version = "%%prog %s" % version)
1653
parser.add_option("-i", u"--interface", type=u"string",
1654
metavar="IF", help=u"Bind to interface IF")
1655
parser.add_option("-a", u"--address", type=u"string",
1656
help=u"Address to listen for requests on")
1657
parser.add_option("-p", u"--port", type=u"int",
1658
help=u"Port number to receive requests on")
1659
parser.add_option("--check", action=u"store_true",
1660
help=u"Run self-test")
1661
parser.add_option("--debug", action=u"store_true",
1662
help=u"Debug mode; run in foreground and log to"
1663
u" terminal")
1664
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1665
help=u"Debug level for stdout output")
1666
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1667
u" priority string (see GnuTLS documentation)")
1668
parser.add_option("--servicename", type=u"string",
1669
metavar=u"NAME", help=u"Zeroconf service name")
1670
parser.add_option("--configdir", type=u"string",
1671
default=u"/etc/mandos", metavar=u"DIR",
1672
help=u"Directory to search for configuration"
1673
u" files")
1674
parser.add_option("--no-dbus", action=u"store_false",
1675
dest=u"use_dbus", help=u"Do not provide D-Bus"
1676
u" system bus interface")
1677
parser.add_option("--no-ipv6", action=u"store_false",
1678
dest=u"use_ipv6", help=u"Do not use IPv6")
1679
options = parser.parse_args()[0]
1940
1680
1941
1681
if options.check:
1942
1682
import doctest
1944
1684
sys.exit()
1945
1685
1946
1686
# Default values for config file for server-global settings
1947
server_defaults = { "interface": "",
1948
"address": "",
1949
"port": "",
1950
"debug": "False",
1951
"priority":
1952
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1953
"servicename": "Mandos",
1954
"use_dbus": "True",
1955
"use_ipv6": "True",
1956
"debuglevel": "",
1687
server_defaults = { u"interface": u"",
1688
u"address": u"",
1689
u"port": u"",
1690
u"debug": u"False",
1691
u"priority":
1692
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1693
u"servicename": u"Mandos",
1694
u"use_dbus": u"True",
1695
u"use_ipv6": u"True",
1696
u"debuglevel": u"",
1957
1697
}
1958
1698
1959
1699
# Parse config file for server-global settings
1960
1700
server_config = configparser.SafeConfigParser(server_defaults)
1961
1701
del server_defaults
1962
1702
server_config.read(os.path.join(options.configdir,
1963
"mandos.conf"))
1703
u"mandos.conf"))
1964
1704
# Convert the SafeConfigParser object to a dict
1965
1705
server_settings = server_config.defaults()
1966
1706
# Use the appropriate methods on the non-string config options
1967
for option in ("debug", "use_dbus", "use_ipv6"):
1968
server_settings[option] = server_config.getboolean("DEFAULT",
1707
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1708
server_settings[option] = server_config.getboolean(u"DEFAULT",
1969
1709
option)
1970
1710
if server_settings["port"]:
1971
server_settings["port"] = server_config.getint("DEFAULT",
1972
"port")
1711
server_settings["port"] = server_config.getint(u"DEFAULT",
1712
u"port")
1973
1713
del server_config
1974
1714
1975
1715
# Override the settings from the config file with command line
1976
1716
# options, if set.
1977
for option in ("interface", "address", "port", "debug",
1978
"priority", "servicename", "configdir",
1979
"use_dbus", "use_ipv6", "debuglevel", "restore"):
1717
for option in (u"interface", u"address", u"port", u"debug",
1718
u"priority", u"servicename", u"configdir",
1719
u"use_dbus", u"use_ipv6", u"debuglevel"):
1980
1720
value = getattr(options, option)
1981
1721
if value is not None:
1982
1722
server_settings[option] = value
1990
1730
##################################################################
1991
1731
1992
1732
# For convenience
1993
debug = server_settings["debug"]
1994
debuglevel = server_settings["debuglevel"]
1995
use_dbus = server_settings["use_dbus"]
1996
use_ipv6 = server_settings["use_ipv6"]
1997
1998
if server_settings["servicename"] != "Mandos":
1733
debug = server_settings[u"debug"]
1734
debuglevel = server_settings[u"debuglevel"]
1735
use_dbus = server_settings[u"use_dbus"]
1736
use_ipv6 = server_settings[u"use_ipv6"]
1737
1738
if server_settings[u"servicename"] != u"Mandos":
1999
1739
syslogger.setFormatter(logging.Formatter
2000
('Mandos (%s) [%%(process)d]:'
2001
' %%(levelname)s: %%(message)s'
2002
% server_settings["servicename"]))
1740
(u'Mandos (%s) [%%(process)d]:'
1741
u' %%(levelname)s: %%(message)s'
1742
% server_settings[u"servicename"]))
2003
1743
2004
1744
# Parse config file with clients
2005
client_defaults = { "timeout": "5m",
2006
"extended_timeout": "15m",
2007
"interval": "2m",
2008
"checker": "fping -q -- %%(host)s",
2009
"host": "",
2010
"approval_delay": "0s",
2011
"approval_duration": "1s",
1745
client_defaults = { u"timeout": u"1h",
1746
u"interval": u"5m",
1747
u"checker": u"fping -q -- %%(host)s",
1748
u"host": u"",
1749
u"approval_delay": u"0s",
1750
u"approval_duration": u"1s",
2012
1751
}
2013
1752
client_config = configparser.SafeConfigParser(client_defaults)
2014
client_config.read(os.path.join(server_settings["configdir"],
2015
"clients.conf"))
1753
client_config.read(os.path.join(server_settings[u"configdir"],
1754
u"clients.conf"))
2016
1755
2017
1756
global mandos_dbus_service
2018
1757
mandos_dbus_service = None
2019
1758
2020
tcp_server = MandosServer((server_settings["address"],
2021
server_settings["port"]),
1759
tcp_server = MandosServer((server_settings[u"address"],
1760
server_settings[u"port"]),
2022
1761
ClientHandler,
2023
interface=(server_settings["interface"]
1762
interface=(server_settings[u"interface"]
2024
1763
or None),
2025
1764
use_ipv6=use_ipv6,
2026
1765
gnutls_priority=
2027
server_settings["priority"],
1766
server_settings[u"priority"],
2028
1767
use_dbus=use_dbus)
2029
1768
if not debug:
2030
pidfilename = "/var/run/mandos.pid"
1769
pidfilename = u"/var/run/mandos.pid"
2031
1770
try:
2032
pidfile = open(pidfilename, "w")
1771
pidfile = open(pidfilename, u"w")
2033
1772
except IOError:
2034
logger.error("Could not open file %r", pidfilename)
1773
logger.error(u"Could not open file %r", pidfilename)
2035
1774
2036
1775
try:
2037
uid = pwd.getpwnam("_mandos").pw_uid
2038
gid = pwd.getpwnam("_mandos").pw_gid
1776
uid = pwd.getpwnam(u"_mandos").pw_uid
1777
gid = pwd.getpwnam(u"_mandos").pw_gid
2039
1778
except KeyError:
2040
1779
try:
2041
uid = pwd.getpwnam("mandos").pw_uid
2042
gid = pwd.getpwnam("mandos").pw_gid
1780
uid = pwd.getpwnam(u"mandos").pw_uid
1781
gid = pwd.getpwnam(u"mandos").pw_gid
2043
1782
except KeyError:
2044
1783
try:
2045
uid = pwd.getpwnam("nobody").pw_uid
2046
gid = pwd.getpwnam("nobody").pw_gid
1784
uid = pwd.getpwnam(u"nobody").pw_uid
1785
gid = pwd.getpwnam(u"nobody").pw_gid
2047
1786
except KeyError:
2048
1787
uid = 65534
2049
1788
gid = 65534
2050
1789
try:
2051
1790
os.setgid(gid)
2052
1791
os.setuid(uid)
2053
except OSError as error:
1792
except OSError, error:
2054
1793
if error[0] != errno.EPERM:
2055
1794
raise error
2056
1795
2057
1796
if not debug and not debuglevel:
2058
logger.setLevel(logging.WARNING)
1797
syslogger.setLevel(logging.WARNING)
1798
console.setLevel(logging.WARNING)
2059
1799
if debuglevel:
2060
1800
level = getattr(logging, debuglevel.upper())
2061
logger.setLevel(level)
2062
1801
syslogger.setLevel(level)
1802
console.setLevel(level)
1803
2063
1804
if debug:
2064
logger.setLevel(logging.DEBUG)
2065
1805
# Enable all possible GnuTLS debugging
2066
1806
2067
1807
# "Use a log level over 10 to enable all debugging options."
2070
1810
2071
1811
@gnutls.library.types.gnutls_log_func
2072
1812
def debug_gnutls(level, string):
2073
logger.debug("GnuTLS: %s", string[:-1])
1813
logger.debug(u"GnuTLS: %s", string[:-1])
2074
1814
2075
1815
(gnutls.library.functions
2076
1816
.gnutls_global_set_log_function(debug_gnutls))
2084
1824
# No console logging
2085
1825
logger.removeHandler(console)
2086
1826
2087
# Need to fork before connecting to D-Bus
2088
if not debug:
2089
# Close all input and output, do double fork, etc.
2090
daemon()
2091
1827
2092
1828
global main_loop
2093
1829
# From the Avahi example code
2097
1833
# End of Avahi example code
2098
1834
if use_dbus:
2099
1835
try:
2100
bus_name = dbus.service.BusName("se.recompile.Mandos",
1836
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
2101
1837
bus, do_not_queue=True)
2102
old_bus_name = (dbus.service.BusName
2103
("se.bsnet.fukt.Mandos", bus,
2104
do_not_queue=True))
2105
except dbus.exceptions.NameExistsException as e:
2106
logger.error(unicode(e) + ", disabling D-Bus")
1838
except dbus.exceptions.NameExistsException, e:
1839
logger.error(unicode(e) + u", disabling D-Bus")
2107
1840
use_dbus = False
2108
server_settings["use_dbus"] = False
1841
server_settings[u"use_dbus"] = False
2109
1842
tcp_server.use_dbus = False
2110
1843
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2111
service = AvahiServiceToSyslog(name =
2112
server_settings["servicename"],
2113
servicetype = "_mandos._tcp",
2114
protocol = protocol, bus = bus)
1844
service = AvahiService(name = server_settings[u"servicename"],
1845
servicetype = u"_mandos._tcp",
1846
protocol = protocol, bus = bus)
2115
1847
if server_settings["interface"]:
2116
1848
service.interface = (if_nametoindex
2117
(str(server_settings["interface"])))
2118
1849
(str(server_settings[u"interface"])))
1850
1851
if not debug:
1852
# Close all input and output, do double fork, etc.
1853
daemon()
1854
2119
1855
global multiprocessing_manager
2120
1856
multiprocessing_manager = multiprocessing.Manager()
2121
1857
2122
1858
client_class = Client
2123
1859
if use_dbus:
2124
client_class = functools.partial(ClientDBusTransitional,
2125
bus = bus)
2126
2127
special_settings = {
2128
# Some settings need to be accessd by special methods;
2129
# booleans need .getboolean(), etc. Here is a list of them:
2130
"approved_by_default":
2131
lambda section:
2132
client_config.getboolean(section, "approved_by_default"),
2133
}
2134
# Construct a new dict of client settings of this form:
2135
# { client_name: {setting_name: value, ...}, ...}
2136
# with exceptions for any special settings as defined above
2137
client_settings = dict((clientname,
2138
dict((setting,
2139
(value if
2140
setting not in special_settings
2141
else special_settings[setting]
2142
(clientname)))
2143
for setting, value
2144
in client_config.items(clientname)))
2145
for clientname in client_config.sections())
2146
2147
old_client_settings = {}
2148
clients_data = []
2149
2150
# Get client data and settings from last running state.
2151
if server_settings["restore"]:
2152
try:
2153
with open(stored_state_path, "rb") as stored_state:
2154
clients_data, old_client_settings = (
2155
pickle.load(stored_state))
2156
os.remove(stored_state_path)
2157
except IOError as e:
2158
logger.warning("Could not load persistant state: {0}"
2159
.format(e))
2160
if e.errno != errno.ENOENT:
2161
raise
2162
2163
for client in clients_data:
2164
client_name = client["name"]
2165
2166
# Decide which value to use after restoring saved state.
2167
# We have three different values: Old config file,
2168
# new config file, and saved state.
2169
# New config value takes precedence if it differs from old
2170
# config value, otherwise use saved state.
2171
for name, value in client_settings[client_name].items():
1860
client_class = functools.partial(ClientDBus, bus = bus)
1861
def client_config_items(config, section):
1862
special_settings = {
1863
"approved_by_default":
1864
lambda: config.getboolean(section,
1865
"approved_by_default"),
1866
}
1867
for name, value in config.items(section):
2172
1868
try:
2173
# For each value in new config, check if it differs
2174
# from the old config value (Except for the "secret"
2175
# attribute)
2176
if (name != "secret" and
2177
value != old_client_settings[client_name][name]):
2178
setattr(client, name, value)
1869
yield (name, special_settings[name]())
2179
1870
except KeyError:
2180
pass
2181
2182
# Clients who has passed its expire date, can still be enabled
2183
# if its last checker was sucessful. Clients who checkers
2184
# failed before we stored it state is asumed to had failed
2185
# checker during downtime.
2186
if client["enabled"] and client["last_checked_ok"]:
2187
if ((datetime.datetime.utcnow()
2188
- client["last_checked_ok"]) > client["interval"]):
2189
if client["last_checker_status"] != 0:
2190
client["enabled"] = False
2191
else:
2192
client["expires"] = (datetime.datetime.utcnow()
2193
+ client["timeout"])
2194
2195
client["changedstate"] = (multiprocessing_manager
2196
.Condition(multiprocessing_manager
2197
.Lock()))
2198
if use_dbus:
2199
new_client = ClientDBusTransitional.__new__(
2200
ClientDBusTransitional)
2201
tcp_server.clients[client_name] = new_client
2202
new_client.bus = bus
2203
for name, value in client.iteritems():
2204
setattr(new_client, name, value)
2205
new_client._approvals_pending = 0
2206
new_client.add_to_dbus()
2207
else:
2208
tcp_server.clients[client_name] = Client.__new__(Client)
2209
for name, value in client.iteritems():
2210
setattr(tcp_server.clients[client_name], name, value)
2211
2212
tcp_server.clients[client_name].decrypt_secret(
2213
client_settings[client_name]["secret"])
2214
2215
# Create/remove clients based on new changes made to config
2216
for clientname in set(old_client_settings) - set(client_settings):
2217
del tcp_server.clients[clientname]
2218
for clientname in set(client_settings) - set(old_client_settings):
2219
tcp_server.clients[clientname] = client_class(name
2220
= clientname,
2221
config =
2222
client_settings
2223
[clientname])
1871
yield (name, value)
2224
1872
1873
tcp_server.clients.update(set(
1874
client_class(name = section,
1875
config= dict(client_config_items(
1876
client_config, section)))
1877
for section in client_config.sections()))
2225
1878
if not tcp_server.clients:
2226
logger.warning("No clients defined")
1879
logger.warning(u"No clients defined")
2227
1880
2228
1881
if not debug:
2229
1882
try:
2230
1883
with pidfile:
2231
1884
pid = os.getpid()
2232
pidfile.write(str(pid) + "\n".encode("utf-8"))
1885
pidfile.write(str(pid) + "\n")
2233
1886
del pidfile
2234
1887
except IOError:
2235
logger.error("Could not write to file %r with PID %d",
1888
logger.error(u"Could not write to file %r with PID %d",
2236
1889
pidfilename, pid)
2237
1890
except NameError:
2238
1891
# "pidfile" was never created
2240
1893
del pidfilename
2241
1894
2242
1895
signal.signal(signal.SIGINT, signal.SIG_IGN)
2243
1896
2244
1897
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2245
1898
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2246
1899
2248
1901
class MandosDBusService(dbus.service.Object):
2249
1902
"""A D-Bus proxy object"""
2250
1903
def __init__(self):
2251
dbus.service.Object.__init__(self, bus, "/")
2252
_interface = "se.recompile.Mandos"
1904
dbus.service.Object.__init__(self, bus, u"/")
1905
_interface = u"se.bsnet.fukt.Mandos"
2253
1906
2254
@dbus.service.signal(_interface, signature="o")
1907
@dbus.service.signal(_interface, signature=u"o")
2255
1908
def ClientAdded(self, objpath):
2256
1909
"D-Bus signal"
2257
1910
pass
2258
1911
2259
@dbus.service.signal(_interface, signature="ss")
1912
@dbus.service.signal(_interface, signature=u"ss")
2260
1913
def ClientNotFound(self, fingerprint, address):
2261
1914
"D-Bus signal"
2262
1915
pass
2263
1916
2264
@dbus.service.signal(_interface, signature="os")
1917
@dbus.service.signal(_interface, signature=u"os")
2265
1918
def ClientRemoved(self, objpath, name):
2266
1919
"D-Bus signal"
2267
1920
pass
2268
1921
2269
@dbus.service.method(_interface, out_signature="ao")
1922
@dbus.service.method(_interface, out_signature=u"ao")
2270
1923
def GetAllClients(self):
2271
1924
"D-Bus method"
2272
1925
return dbus.Array(c.dbus_object_path
2273
for c in
2274
tcp_server.clients.itervalues())
1926
for c in tcp_server.clients)
2275
1927
2276
1928
@dbus.service.method(_interface,
2277
out_signature="a{oa{sv}}")
1929
out_signature=u"a{oa{sv}}")
2278
1930
def GetAllClientsWithProperties(self):
2279
1931
"D-Bus method"
2280
1932
return dbus.Dictionary(
2281
((c.dbus_object_path, c.GetAll(""))
2282
for c in tcp_server.clients.itervalues()),
2283
signature="oa{sv}")
1933
((c.dbus_object_path, c.GetAll(u""))
1934
for c in tcp_server.clients),
1935
signature=u"oa{sv}")
2284
1936
2285
@dbus.service.method(_interface, in_signature="o")
1937
@dbus.service.method(_interface, in_signature=u"o")
2286
1938
def RemoveClient(self, object_path):
2287
1939
"D-Bus method"
2288
for c in tcp_server.clients.itervalues():
1940
for c in tcp_server.clients:
2289
1941
if c.dbus_object_path == object_path:
2290
del tcp_server.clients[c.name]
1942
tcp_server.clients.remove(c)
2291
1943
c.remove_from_connection()
2292
1944
# Don't signal anything except ClientRemoved
2293
1945
c.disable(quiet=True)
2298
1950
2299
1951
del _interface
2300
1952
2301
class MandosDBusServiceTransitional(MandosDBusService):
2302
__metaclass__ = AlternateDBusNamesMetaclass
2303
mandos_dbus_service = MandosDBusServiceTransitional()
1953
mandos_dbus_service = MandosDBusService()
2304
1954
2305
1955
def cleanup():
2306
1956
"Cleanup function; run on exit"
2307
1957
service.cleanup()
2308
1958
2309
multiprocessing.active_children()
2310
if not (tcp_server.clients or client_settings):
2311
return
2312
2313
# Store client before exiting. Secrets are encrypted with key
2314
# based on what config file has. If config file is
2315
# removed/edited, old secret will thus be unrecovable.
2316
clients = []
2317
for client in tcp_server.clients.itervalues():
2318
client.encrypt_secret(
2319
client_settings[client.name]["secret"])
2320
2321
client_dict = {}
2322
2323
# A list of attributes that will not be stored when
2324
# shutting down.
2325
exclude = set(("bus", "changedstate", "secret"))
2326
for name, typ in inspect.getmembers(dbus.service.Object):
2327
exclude.add(name)
2328
2329
client_dict["encrypted_secret"] = client.encrypted_secret
2330
for attr in client.client_structure:
2331
if attr not in exclude:
2332
client_dict[attr] = getattr(client, attr)
2333
2334
clients.append(client_dict)
2335
del client_settings[client.name]["secret"]
2336
2337
try:
2338
with os.fdopen(os.open(stored_state_path,
2339
os.O_CREAT|os.O_WRONLY|os.O_TRUNC,
2340
stat.S_IRUSR | stat.S_IWUSR),
2341
"wb") as stored_state:
2342
pickle.dump((clients, client_settings), stored_state)
2343
except IOError as e:
2344
logger.warning("Could not save persistant state: {0}"
2345
.format(e))
2346
if e.errno != errno.ENOENT:
2347
raise
2348
2349
# Delete all clients, and settings from config
2350
1959
while tcp_server.clients:
2351
name, client = tcp_server.clients.popitem()
1960
client = tcp_server.clients.pop()
2352
1961
if use_dbus:
2353
1962
client.remove_from_connection()
1963
client.disable_hook = None
2354
1964
# Don't signal anything except ClientRemoved
2355
1965
client.disable(quiet=True)
2356
1966
if use_dbus:
2357
1967
# Emit D-Bus signal
2358
mandos_dbus_service.ClientRemoved(client
2359
.dbus_object_path,
1968
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2360
1969
client.name)
2361
client_settings.clear()
2362
1970
2363
1971
atexit.register(cleanup)
2364
1972
2365
for client in tcp_server.clients.itervalues():
1973
for client in tcp_server.clients:
2366
1974
if use_dbus:
2367
1975
# Emit D-Bus signal
2368
1976
mandos_dbus_service.ClientAdded(client.dbus_object_path)
2369
# Need to initiate checking of clients
2370
if client.enabled:
2371
client.init_checker()
2372
1977
client.enable()
2373
1978
2374
1979
tcp_server.enable()
2375
1980
tcp_server.server_activate()
2377
1982
# Find out what port we got
2378
1983
service.port = tcp_server.socket.getsockname()[1]
2379
1984
if use_ipv6:
2380
logger.info("Now listening on address %r, port %d,"
1985
logger.info(u"Now listening on address %r, port %d,"
2381
1986
" flowinfo %d, scope_id %d"
2382
1987
% tcp_server.socket.getsockname())
2383
1988
else: # IPv4
2384
logger.info("Now listening on address %r, port %d"
1989
logger.info(u"Now listening on address %r, port %d"
2385
1990
% tcp_server.socket.getsockname())
2386
1991
2387
1992
#service.interface = tcp_server.socket.getsockname()[3]
2390
1995
# From the Avahi example code
2391
1996
try:
2392
1997
service.activate()
2393
except dbus.exceptions.DBusException as error:
2394
logger.critical("DBusException: %s", error)
1998
except dbus.exceptions.DBusException, error:
1999
logger.critical(u"DBusException: %s", error)
2395
2000
cleanup()
2396
2001
sys.exit(1)
2397
2002
# End of Avahi example code
2401
2006
(tcp_server.handle_request
2402
2007
(*args[2:], **kwargs) or True))
2403
2008
2404
logger.debug("Starting main loop")
2009
logger.debug(u"Starting main loop")
2405
2010
main_loop.run()
2406
except AvahiError as error:
2407
logger.critical("AvahiError: %s", error)
2011
except AvahiError, error:
2012
logger.critical(u"AvahiError: %s", error)
2408
2013
cleanup()
2409
2014
sys.exit(1)
2410
2015
except KeyboardInterrupt:
2411
2016
if debug:
2412
print("", file=sys.stderr)
2413
logger.debug("Server received KeyboardInterrupt")
2414
logger.debug("Server exiting")
2017
print >> sys.stderr
2018
logger.debug(u"Server received KeyboardInterrupt")
2019
logger.debug(u"Server exiting")
2415
2020
# Must run before the D-Bus bus name gets deregistered
2416
2021
cleanup()
2417
2022
2418
2419
2023
if __name__ == '__main__':
2420
2024
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0