To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 446
- compare with another revision
- download diff
- download tarball
- view history from revision 446
- Committer: teddy at bsnet
- Date: 2010-09-27 16:27:13 UTC
- Revision ID: teddy@fukt.bsnet.se-20100927162713-jucnyd63612ximvw
* mandos-monitor: Change key for removing a client from "r" to "R".
- files removed:
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008-2010 Teddy Hogeborn
15
# Copyright © 2008-2010 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
31
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
36
import SocketServer as socketserver
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
82
81
SO_BINDTODEVICE = None
83
82
84
83
85
version = "1.3.0"
84
version = "1.0.14"
86
85
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
89
88
syslogger = (logging.handlers.SysLogHandler
90
89
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
address = str("/dev/log")))
90
address = "/dev/log"))
92
91
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
95
94
logger.addHandler(syslogger)
96
95
97
96
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
100
' %(message)s'))
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
101
100
logger.addHandler(console)
102
101
103
102
class AvahiError(Exception):
120
119
Attributes:
121
120
interface: integer; avahi.IF_UNSPEC or an interface index.
122
121
Used to optionally bind to the specified interface.
123
name: string; Example: 'Mandos'
124
type: string; Example: '_mandos._tcp'.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
125
124
See <http://www.dns-sd.org/ServiceTypes.html>
126
125
port: integer; what port to announce
127
126
TXT: list of strings; TXT record for the service
136
135
"""
137
136
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
137
servicetype = None, port = None, TXT = None,
139
domain = "", host = "", max_renames = 32768,
138
domain = u"", host = u"", max_renames = 32768,
140
139
protocol = avahi.PROTO_UNSPEC, bus = None):
141
140
self.interface = interface
142
141
self.name = name
151
150
self.group = None # our entry group
152
151
self.server = None
153
152
self.bus = bus
154
self.entry_group_state_changed_match = None
155
153
def rename(self):
156
154
"""Derived from the Avahi example code"""
157
155
if self.rename_count >= self.max_renames:
158
logger.critical("No suitable Zeroconf service name found"
159
" after %i retries, exiting.",
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
160
158
self.rename_count)
161
raise AvahiServiceError("Too many renames")
159
raise AvahiServiceError(u"Too many renames")
162
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
163
logger.info("Changing Zeroconf service name to %r ...",
161
logger.info(u"Changing Zeroconf service name to %r ...",
164
162
self.name)
165
163
syslogger.setFormatter(logging.Formatter
166
('Mandos (%s) [%%(process)d]:'
167
' %%(levelname)s: %%(message)s'
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
168
166
% self.name))
169
167
self.remove()
170
168
try:
171
169
self.add()
172
except dbus.exceptions.DBusException as error:
173
logger.critical("DBusException: %s", error)
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
174
172
self.cleanup()
175
173
os._exit(1)
176
174
self.rename_count += 1
177
175
def remove(self):
178
176
"""Derived from the Avahi example code"""
179
177
if self.group is not None:
180
try:
181
self.group.Free()
182
except (dbus.exceptions.UnknownMethodException,
183
dbus.exceptions.DBusException) as e:
184
pass
185
self.group = None
186
if self.entry_group_state_changed_match is not None:
187
self.entry_group_state_changed_match.remove()
188
self.entry_group_state_changed_match = None
178
self.group.Reset()
189
179
def add(self):
190
180
"""Derived from the Avahi example code"""
191
self.remove()
192
self.group = dbus.Interface(
193
self.bus.get_object(avahi.DBUS_NAME,
194
self.server.EntryGroupNew(),
195
follow_name_owner_changes=True),
196
avahi.DBUS_INTERFACE_ENTRY_GROUP)
197
self.entry_group_state_changed_match = (
198
self.group.connect_to_signal(
199
'StateChanged', self .entry_group_state_changed))
200
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
181
if self.group is None:
182
self.group = dbus.Interface(
183
self.bus.get_object(avahi.DBUS_NAME,
184
self.server.EntryGroupNew()),
185
avahi.DBUS_INTERFACE_ENTRY_GROUP)
186
self.group.connect_to_signal('StateChanged',
187
self
188
.entry_group_state_changed)
189
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
201
190
self.name, self.type)
202
191
self.group.AddService(
203
192
self.interface,
210
199
self.group.Commit()
211
200
def entry_group_state_changed(self, state, error):
212
201
"""Derived from the Avahi example code"""
213
logger.debug("Avahi entry group state change: %i", state)
202
logger.debug(u"Avahi entry group state change: %i", state)
214
203
215
204
if state == avahi.ENTRY_GROUP_ESTABLISHED:
216
logger.debug("Zeroconf service established.")
205
logger.debug(u"Zeroconf service established.")
217
206
elif state == avahi.ENTRY_GROUP_COLLISION:
218
logger.info("Zeroconf service name collision.")
207
logger.warning(u"Zeroconf service name collision.")
219
208
self.rename()
220
209
elif state == avahi.ENTRY_GROUP_FAILURE:
221
logger.critical("Avahi: Error in group state changed %s",
210
logger.critical(u"Avahi: Error in group state changed %s",
222
211
unicode(error))
223
raise AvahiGroupError("State changed: %s"
212
raise AvahiGroupError(u"State changed: %s"
224
213
% unicode(error))
225
214
def cleanup(self):
226
215
"""Derived from the Avahi example code"""
227
self.remove()
228
def server_state_changed(self, state, error=None):
216
if self.group is not None:
217
self.group.Free()
218
self.group = None
219
def server_state_changed(self, state):
229
220
"""Derived from the Avahi example code"""
230
logger.debug("Avahi server state change: %i", state)
231
bad_states = { avahi.SERVER_INVALID:
232
"Zeroconf server invalid",
233
avahi.SERVER_REGISTERING: None,
234
avahi.SERVER_COLLISION:
235
"Zeroconf server name collision",
236
avahi.SERVER_FAILURE:
237
"Zeroconf server failure" }
238
if state in bad_states:
239
if bad_states[state]:
240
logger.error(bad_states[state])
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
241
224
self.remove()
242
225
elif state == avahi.SERVER_RUNNING:
243
226
self.add()
244
else:
245
logger.debug("Unknown state: %r", state)
246
227
def activate(self):
247
228
"""Derived from the Avahi example code"""
248
229
if self.server is None:
249
230
self.server = dbus.Interface(
250
231
self.bus.get_object(avahi.DBUS_NAME,
251
avahi.DBUS_PATH_SERVER,
252
follow_name_owner_changes=True),
232
avahi.DBUS_PATH_SERVER),
253
233
avahi.DBUS_INTERFACE_SERVER)
254
self.server.connect_to_signal("StateChanged",
234
self.server.connect_to_signal(u"StateChanged",
255
235
self.server_state_changed)
256
236
self.server_state_changed(self.server.GetState())
257
237
292
272
runtime_expansions: Allowed attributes for runtime expansion.
293
273
"""
294
274
295
runtime_expansions = ("approval_delay", "approval_duration",
296
"created", "enabled", "fingerprint",
297
"host", "interval", "last_checked_ok",
298
"last_enabled", "name", "timeout")
275
runtime_expansions = (u"approval_delay", u"approval_duration",
276
u"created", u"enabled", u"fingerprint",
277
u"host", u"interval", u"last_checked_ok",
278
u"last_enabled", u"name", u"timeout")
299
279
300
280
@staticmethod
301
281
def _timedelta_to_milliseconds(td):
322
302
self.name = name
323
303
if config is None:
324
304
config = {}
325
logger.debug("Creating client %r", self.name)
305
logger.debug(u"Creating client %r", self.name)
326
306
# Uppercase and remove spaces from fingerprint for later
327
307
# comparison purposes with return value from the fingerprint()
328
308
# function
329
self.fingerprint = (config["fingerprint"].upper()
330
.replace(" ", ""))
331
logger.debug(" Fingerprint: %s", self.fingerprint)
332
if "secret" in config:
333
self.secret = config["secret"].decode("base64")
334
elif "secfile" in config:
309
self.fingerprint = (config[u"fingerprint"].upper()
310
.replace(u" ", u""))
311
logger.debug(u" Fingerprint: %s", self.fingerprint)
312
if u"secret" in config:
313
self.secret = config[u"secret"].decode(u"base64")
314
elif u"secfile" in config:
335
315
with open(os.path.expanduser(os.path.expandvars
336
(config["secfile"])),
316
(config[u"secfile"])),
337
317
"rb") as secfile:
338
318
self.secret = secfile.read()
339
319
else:
340
raise TypeError("No secret or secfile for client %s"
320
raise TypeError(u"No secret or secfile for client %s"
341
321
% self.name)
342
self.host = config.get("host", "")
322
self.host = config.get(u"host", u"")
343
323
self.created = datetime.datetime.utcnow()
344
324
self.enabled = False
345
325
self.last_approval_request = None
346
326
self.last_enabled = None
347
327
self.last_checked_ok = None
348
self.timeout = string_to_delta(config["timeout"])
349
self.interval = string_to_delta(config["interval"])
328
self.timeout = string_to_delta(config[u"timeout"])
329
self.interval = string_to_delta(config[u"interval"])
350
330
self.disable_hook = disable_hook
351
331
self.checker = None
352
332
self.checker_initiator_tag = None
353
333
self.disable_initiator_tag = None
354
334
self.checker_callback_tag = None
355
self.checker_command = config["checker"]
335
self.checker_command = config[u"checker"]
356
336
self.current_checker_command = None
357
337
self.last_connect = None
358
338
self._approved = None
359
self.approved_by_default = config.get("approved_by_default",
339
self.approved_by_default = config.get(u"approved_by_default",
360
340
True)
361
341
self.approvals_pending = 0
362
342
self.approval_delay = string_to_delta(
363
config["approval_delay"])
343
config[u"approval_delay"])
364
344
self.approval_duration = string_to_delta(
365
config["approval_duration"])
345
config[u"approval_duration"])
366
346
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
367
347
368
348
def send_changedstate(self):
372
352
373
353
def enable(self):
374
354
"""Start this client's checker and timeout hooks"""
375
if getattr(self, "enabled", False):
355
if getattr(self, u"enabled", False):
376
356
# Already enabled
377
357
return
378
358
self.send_changedstate()
397
377
if not quiet:
398
378
self.send_changedstate()
399
379
if not quiet:
400
logger.info("Disabling client %s", self.name)
401
if getattr(self, "disable_initiator_tag", False):
380
logger.info(u"Disabling client %s", self.name)
381
if getattr(self, u"disable_initiator_tag", False):
402
382
gobject.source_remove(self.disable_initiator_tag)
403
383
self.disable_initiator_tag = None
404
if getattr(self, "checker_initiator_tag", False):
384
if getattr(self, u"checker_initiator_tag", False):
405
385
gobject.source_remove(self.checker_initiator_tag)
406
386
self.checker_initiator_tag = None
407
387
self.stop_checker()
422
402
if os.WIFEXITED(condition):
423
403
exitstatus = os.WEXITSTATUS(condition)
424
404
if exitstatus == 0:
425
logger.info("Checker for %(name)s succeeded",
405
logger.info(u"Checker for %(name)s succeeded",
426
406
vars(self))
427
407
self.checked_ok()
428
408
else:
429
logger.info("Checker for %(name)s failed",
409
logger.info(u"Checker for %(name)s failed",
430
410
vars(self))
431
411
else:
432
logger.warning("Checker for %(name)s crashed?",
412
logger.warning(u"Checker for %(name)s crashed?",
433
413
vars(self))
434
414
435
415
def checked_ok(self):
464
444
# If a checker exists, make sure it is not a zombie
465
445
try:
466
446
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
467
except (AttributeError, OSError) as error:
447
except (AttributeError, OSError), error:
468
448
if (isinstance(error, OSError)
469
449
and error.errno != errno.ECHILD):
470
450
raise error
471
451
else:
472
452
if pid:
473
logger.warning("Checker was a zombie")
453
logger.warning(u"Checker was a zombie")
474
454
gobject.source_remove(self.checker_callback_tag)
475
455
self.checker_callback(pid, status,
476
456
self.current_checker_command)
483
463
# Escape attributes for the shell
484
464
escaped_attrs = dict(
485
465
(attr,
486
re.escape(unicode(str(getattr(self, attr, "")),
466
re.escape(unicode(str(getattr(self, attr, u"")),
487
467
errors=
488
'replace')))
468
u'replace')))
489
469
for attr in
490
470
self.runtime_expansions)
491
471
492
472
try:
493
473
command = self.checker_command % escaped_attrs
494
except TypeError as error:
495
logger.error('Could not format string "%s":'
496
' %s', self.checker_command, error)
474
except TypeError, error:
475
logger.error(u'Could not format string "%s":'
476
u' %s', self.checker_command, error)
497
477
return True # Try again later
498
478
self.current_checker_command = command
499
479
try:
500
logger.info("Starting checker %r for %s",
480
logger.info(u"Starting checker %r for %s",
501
481
command, self.name)
502
482
# We don't need to redirect stdout and stderr, since
503
483
# in normal mode, that is already done by daemon(),
505
485
# always replaced by /dev/null.)
506
486
self.checker = subprocess.Popen(command,
507
487
close_fds=True,
508
shell=True, cwd="/")
488
shell=True, cwd=u"/")
509
489
self.checker_callback_tag = (gobject.child_watch_add
510
490
(self.checker.pid,
511
491
self.checker_callback,
516
496
if pid:
517
497
gobject.source_remove(self.checker_callback_tag)
518
498
self.checker_callback(pid, status, command)
519
except OSError as error:
520
logger.error("Failed to start subprocess: %s",
499
except OSError, error:
500
logger.error(u"Failed to start subprocess: %s",
521
501
error)
522
502
# Re-run this periodically if run by gobject.timeout_add
523
503
return True
527
507
if self.checker_callback_tag:
528
508
gobject.source_remove(self.checker_callback_tag)
529
509
self.checker_callback_tag = None
530
if getattr(self, "checker", None) is None:
510
if getattr(self, u"checker", None) is None:
531
511
return
532
logger.debug("Stopping checker for %(name)s", vars(self))
512
logger.debug(u"Stopping checker for %(name)s", vars(self))
533
513
try:
534
514
os.kill(self.checker.pid, signal.SIGTERM)
535
515
#time.sleep(0.5)
536
516
#if self.checker.poll() is None:
537
517
# os.kill(self.checker.pid, signal.SIGKILL)
538
except OSError as error:
518
except OSError, error:
539
519
if error.errno != errno.ESRCH: # No such process
540
520
raise
541
521
self.checker = None
542
522
543
def dbus_service_property(dbus_interface, signature="v",
544
access="readwrite", byte_arrays=False):
523
def dbus_service_property(dbus_interface, signature=u"v",
524
access=u"readwrite", byte_arrays=False):
545
525
"""Decorators for marking methods of a DBusObjectWithProperties to
546
526
become properties on the D-Bus.
547
527
554
534
"""
555
535
# Encoding deeply encoded byte arrays is not supported yet by the
556
536
# "Set" method, so we fail early here:
557
if byte_arrays and signature != "ay":
558
raise ValueError("Byte arrays not supported for non-'ay'"
559
" signature %r" % signature)
537
if byte_arrays and signature != u"ay":
538
raise ValueError(u"Byte arrays not supported for non-'ay'"
539
u" signature %r" % signature)
560
540
def decorator(func):
561
541
func._dbus_is_property = True
562
542
func._dbus_interface = dbus_interface
563
543
func._dbus_signature = signature
564
544
func._dbus_access = access
565
545
func._dbus_name = func.__name__
566
if func._dbus_name.endswith("_dbus_property"):
546
if func._dbus_name.endswith(u"_dbus_property"):
567
547
func._dbus_name = func._dbus_name[:-14]
568
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
548
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
569
549
return func
570
550
return decorator
571
551
599
579
600
580
@staticmethod
601
581
def _is_dbus_property(obj):
602
return getattr(obj, "_dbus_is_property", False)
582
return getattr(obj, u"_dbus_is_property", False)
603
583
604
584
def _get_all_dbus_properties(self):
605
585
"""Returns a generator of (name, attribute) pairs
613
593
property with the specified name and interface.
614
594
"""
615
595
for name in (property_name,
616
property_name + "_dbus_property"):
596
property_name + u"_dbus_property"):
617
597
prop = getattr(self, name, None)
618
598
if (prop is None
619
599
or not self._is_dbus_property(prop)
623
603
continue
624
604
return prop
625
605
# No such property
626
raise DBusPropertyNotFound(self.dbus_object_path + ":"
627
+ interface_name + "."
606
raise DBusPropertyNotFound(self.dbus_object_path + u":"
607
+ interface_name + u"."
628
608
+ property_name)
629
609
630
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
631
out_signature="v")
610
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
611
out_signature=u"v")
632
612
def Get(self, interface_name, property_name):
633
613
"""Standard D-Bus property Get() method, see D-Bus standard.
634
614
"""
635
615
prop = self._get_dbus_property(interface_name, property_name)
636
if prop._dbus_access == "write":
616
if prop._dbus_access == u"write":
637
617
raise DBusPropertyAccessException(property_name)
638
618
value = prop()
639
if not hasattr(value, "variant_level"):
619
if not hasattr(value, u"variant_level"):
640
620
return value
641
621
return type(value)(value, variant_level=value.variant_level+1)
642
622
643
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
623
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
644
624
def Set(self, interface_name, property_name, value):
645
625
"""Standard D-Bus property Set() method, see D-Bus standard.
646
626
"""
647
627
prop = self._get_dbus_property(interface_name, property_name)
648
if prop._dbus_access == "read":
628
if prop._dbus_access == u"read":
649
629
raise DBusPropertyAccessException(property_name)
650
if prop._dbus_get_args_options["byte_arrays"]:
630
if prop._dbus_get_args_options[u"byte_arrays"]:
651
631
# The byte_arrays option is not supported yet on
652
632
# signatures other than "ay".
653
if prop._dbus_signature != "ay":
633
if prop._dbus_signature != u"ay":
654
634
raise ValueError
655
635
value = dbus.ByteArray(''.join(unichr(byte)
656
636
for byte in value))
657
637
prop(value)
658
638
659
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
660
out_signature="a{sv}")
639
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
640
out_signature=u"a{sv}")
661
641
def GetAll(self, interface_name):
662
642
"""Standard D-Bus property GetAll() method, see D-Bus
663
643
standard.
671
651
# Interface non-empty but did not match
672
652
continue
673
653
# Ignore write-only properties
674
if prop._dbus_access == "write":
654
if prop._dbus_access == u"write":
675
655
continue
676
656
value = prop()
677
if not hasattr(value, "variant_level"):
657
if not hasattr(value, u"variant_level"):
678
658
all[name] = value
679
659
continue
680
660
all[name] = type(value)(value, variant_level=
681
661
value.variant_level+1)
682
return dbus.Dictionary(all, signature="sv")
662
return dbus.Dictionary(all, signature=u"sv")
683
663
684
664
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
685
out_signature="s",
665
out_signature=u"s",
686
666
path_keyword='object_path',
687
667
connection_keyword='connection')
688
668
def Introspect(self, object_path, connection):
693
673
try:
694
674
document = xml.dom.minidom.parseString(xmlstring)
695
675
def make_tag(document, name, prop):
696
e = document.createElement("property")
697
e.setAttribute("name", name)
698
e.setAttribute("type", prop._dbus_signature)
699
e.setAttribute("access", prop._dbus_access)
676
e = document.createElement(u"property")
677
e.setAttribute(u"name", name)
678
e.setAttribute(u"type", prop._dbus_signature)
679
e.setAttribute(u"access", prop._dbus_access)
700
680
return e
701
for if_tag in document.getElementsByTagName("interface"):
681
for if_tag in document.getElementsByTagName(u"interface"):
702
682
for tag in (make_tag(document, name, prop)
703
683
for name, prop
704
684
in self._get_all_dbus_properties()
705
685
if prop._dbus_interface
706
== if_tag.getAttribute("name")):
686
== if_tag.getAttribute(u"name")):
707
687
if_tag.appendChild(tag)
708
688
# Add the names to the return values for the
709
689
# "org.freedesktop.DBus.Properties" methods
710
if (if_tag.getAttribute("name")
711
== "org.freedesktop.DBus.Properties"):
712
for cn in if_tag.getElementsByTagName("method"):
713
if cn.getAttribute("name") == "Get":
714
for arg in cn.getElementsByTagName("arg"):
715
if (arg.getAttribute("direction")
716
== "out"):
717
arg.setAttribute("name", "value")
718
elif cn.getAttribute("name") == "GetAll":
719
for arg in cn.getElementsByTagName("arg"):
720
if (arg.getAttribute("direction")
721
== "out"):
722
arg.setAttribute("name", "props")
723
xmlstring = document.toxml("utf-8")
690
if (if_tag.getAttribute(u"name")
691
== u"org.freedesktop.DBus.Properties"):
692
for cn in if_tag.getElementsByTagName(u"method"):
693
if cn.getAttribute(u"name") == u"Get":
694
for arg in cn.getElementsByTagName(u"arg"):
695
if (arg.getAttribute(u"direction")
696
== u"out"):
697
arg.setAttribute(u"name", u"value")
698
elif cn.getAttribute(u"name") == u"GetAll":
699
for arg in cn.getElementsByTagName(u"arg"):
700
if (arg.getAttribute(u"direction")
701
== u"out"):
702
arg.setAttribute(u"name", u"props")
703
xmlstring = document.toxml(u"utf-8")
724
704
document.unlink()
725
705
except (AttributeError, xml.dom.DOMException,
726
xml.parsers.expat.ExpatError) as error:
727
logger.error("Failed to override Introspection method",
706
xml.parsers.expat.ExpatError), error:
707
logger.error(u"Failed to override Introspection method",
728
708
error)
729
709
return xmlstring
730
710
738
718
"""
739
719
740
720
runtime_expansions = (Client.runtime_expansions
741
+ ("dbus_object_path",))
721
+ (u"dbus_object_path",))
742
722
743
723
# dbus.service.Object doesn't use super(), so we can't either.
744
724
749
729
# Only now, when this client is initialized, can it show up on
750
730
# the D-Bus
751
731
client_object_name = unicode(self.name).translate(
752
{ord("."): ord("_"),
753
ord("-"): ord("_")})
732
{ord(u"."): ord(u"_"),
733
ord(u"-"): ord(u"_")})
754
734
self.dbus_object_path = (dbus.ObjectPath
755
("/clients/" + client_object_name))
735
(u"/clients/" + client_object_name))
756
736
DBusObjectWithProperties.__init__(self, self.bus,
757
737
self.dbus_object_path)
758
738
765
745
if (hasattr(self, "dbus_object_path")
766
746
and bval is not bool(old_value)):
767
747
dbus_bool = dbus.Boolean(bval, variant_level=1)
768
self.PropertyChanged(dbus.String("ApprovalPending"),
748
self.PropertyChanged(dbus.String(u"ApprovalPending"),
769
749
dbus_bool)
770
750
771
751
approvals_pending = property(_get_approvals_pending,
779
759
variant_level=variant_level)
780
760
781
761
def enable(self):
782
oldstate = getattr(self, "enabled", False)
762
oldstate = getattr(self, u"enabled", False)
783
763
r = Client.enable(self)
784
764
if oldstate != self.enabled:
785
765
# Emit D-Bus signals
786
self.PropertyChanged(dbus.String("Enabled"),
766
self.PropertyChanged(dbus.String(u"Enabled"),
787
767
dbus.Boolean(True, variant_level=1))
788
768
self.PropertyChanged(
789
dbus.String("LastEnabled"),
769
dbus.String(u"LastEnabled"),
790
770
self._datetime_to_dbus(self.last_enabled,
791
771
variant_level=1))
792
772
return r
793
773
794
774
def disable(self, quiet = False):
795
oldstate = getattr(self, "enabled", False)
775
oldstate = getattr(self, u"enabled", False)
796
776
r = Client.disable(self, quiet=quiet)
797
777
if not quiet and oldstate != self.enabled:
798
778
# Emit D-Bus signal
799
self.PropertyChanged(dbus.String("Enabled"),
779
self.PropertyChanged(dbus.String(u"Enabled"),
800
780
dbus.Boolean(False, variant_level=1))
801
781
return r
802
782
805
785
self.remove_from_connection()
806
786
except LookupError:
807
787
pass
808
if hasattr(DBusObjectWithProperties, "__del__"):
788
if hasattr(DBusObjectWithProperties, u"__del__"):
809
789
DBusObjectWithProperties.__del__(self, *args, **kwargs)
810
790
Client.__del__(self, *args, **kwargs)
811
791
814
794
self.checker_callback_tag = None
815
795
self.checker = None
816
796
# Emit D-Bus signal
817
self.PropertyChanged(dbus.String("CheckerRunning"),
797
self.PropertyChanged(dbus.String(u"CheckerRunning"),
818
798
dbus.Boolean(False, variant_level=1))
819
799
if os.WIFEXITED(condition):
820
800
exitstatus = os.WEXITSTATUS(condition)
832
812
*args, **kwargs)
833
813
834
814
def checked_ok(self, *args, **kwargs):
835
Client.checked_ok(self, *args, **kwargs)
815
r = Client.checked_ok(self, *args, **kwargs)
836
816
# Emit D-Bus signal
837
817
self.PropertyChanged(
838
dbus.String("LastCheckedOK"),
818
dbus.String(u"LastCheckedOK"),
839
819
(self._datetime_to_dbus(self.last_checked_ok,
840
820
variant_level=1)))
821
return r
841
822
842
823
def need_approval(self, *args, **kwargs):
843
824
r = Client.need_approval(self, *args, **kwargs)
844
825
# Emit D-Bus signal
845
826
self.PropertyChanged(
846
dbus.String("LastApprovalRequest"),
827
dbus.String(u"LastApprovalRequest"),
847
828
(self._datetime_to_dbus(self.last_approval_request,
848
829
variant_level=1)))
849
830
return r
861
842
# Emit D-Bus signal
862
843
self.CheckerStarted(self.current_checker_command)
863
844
self.PropertyChanged(
864
dbus.String("CheckerRunning"),
845
dbus.String(u"CheckerRunning"),
865
846
dbus.Boolean(True, variant_level=1))
866
847
return r
867
848
868
849
def stop_checker(self, *args, **kwargs):
869
old_checker = getattr(self, "checker", None)
850
old_checker = getattr(self, u"checker", None)
870
851
r = Client.stop_checker(self, *args, **kwargs)
871
852
if (old_checker is not None
872
and getattr(self, "checker", None) is None):
873
self.PropertyChanged(dbus.String("CheckerRunning"),
853
and getattr(self, u"checker", None) is None):
854
self.PropertyChanged(dbus.String(u"CheckerRunning"),
874
855
dbus.Boolean(False, variant_level=1))
875
856
return r
876
857
887
868
888
869
889
870
## D-Bus methods, signals & properties
890
_interface = "se.bsnet.fukt.Mandos.Client"
871
_interface = u"se.bsnet.fukt.Mandos.Client"
891
872
892
873
## Signals
893
874
894
875
# CheckerCompleted - signal
895
@dbus.service.signal(_interface, signature="nxs")
876
@dbus.service.signal(_interface, signature=u"nxs")
896
877
def CheckerCompleted(self, exitcode, waitstatus, command):
897
878
"D-Bus signal"
898
879
pass
899
880
900
881
# CheckerStarted - signal
901
@dbus.service.signal(_interface, signature="s")
882
@dbus.service.signal(_interface, signature=u"s")
902
883
def CheckerStarted(self, command):
903
884
"D-Bus signal"
904
885
pass
905
886
906
887
# PropertyChanged - signal
907
@dbus.service.signal(_interface, signature="sv")
888
@dbus.service.signal(_interface, signature=u"sv")
908
889
def PropertyChanged(self, property, value):
909
890
"D-Bus signal"
910
891
pass
919
900
pass
920
901
921
902
# Rejected - signal
922
@dbus.service.signal(_interface, signature="s")
903
@dbus.service.signal(_interface, signature=u"s")
923
904
def Rejected(self, reason):
924
905
"D-Bus signal"
925
906
pass
926
907
927
908
# NeedApproval - signal
928
@dbus.service.signal(_interface, signature="tb")
909
@dbus.service.signal(_interface, signature=u"tb")
929
910
def NeedApproval(self, timeout, default):
930
911
"D-Bus signal"
931
912
return self.need_approval()
933
914
## Methods
934
915
935
916
# Approve - method
936
@dbus.service.method(_interface, in_signature="b")
917
@dbus.service.method(_interface, in_signature=u"b")
937
918
def Approve(self, value):
938
919
self.approve(value)
939
920
940
921
# CheckedOK - method
941
922
@dbus.service.method(_interface)
942
923
def CheckedOK(self):
943
self.checked_ok()
924
return self.checked_ok()
944
925
945
926
# Enable - method
946
927
@dbus.service.method(_interface)
968
949
## Properties
969
950
970
951
# ApprovalPending - property
971
@dbus_service_property(_interface, signature="b", access="read")
952
@dbus_service_property(_interface, signature=u"b", access=u"read")
972
953
def ApprovalPending_dbus_property(self):
973
954
return dbus.Boolean(bool(self.approvals_pending))
974
955
975
956
# ApprovedByDefault - property
976
@dbus_service_property(_interface, signature="b",
977
access="readwrite")
957
@dbus_service_property(_interface, signature=u"b",
958
access=u"readwrite")
978
959
def ApprovedByDefault_dbus_property(self, value=None):
979
960
if value is None: # get
980
961
return dbus.Boolean(self.approved_by_default)
981
962
self.approved_by_default = bool(value)
982
963
# Emit D-Bus signal
983
self.PropertyChanged(dbus.String("ApprovedByDefault"),
964
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
984
965
dbus.Boolean(value, variant_level=1))
985
966
986
967
# ApprovalDelay - property
987
@dbus_service_property(_interface, signature="t",
988
access="readwrite")
968
@dbus_service_property(_interface, signature=u"t",
969
access=u"readwrite")
989
970
def ApprovalDelay_dbus_property(self, value=None):
990
971
if value is None: # get
991
972
return dbus.UInt64(self.approval_delay_milliseconds())
992
973
self.approval_delay = datetime.timedelta(0, 0, 0, value)
993
974
# Emit D-Bus signal
994
self.PropertyChanged(dbus.String("ApprovalDelay"),
975
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
995
976
dbus.UInt64(value, variant_level=1))
996
977
997
978
# ApprovalDuration - property
998
@dbus_service_property(_interface, signature="t",
999
access="readwrite")
979
@dbus_service_property(_interface, signature=u"t",
980
access=u"readwrite")
1000
981
def ApprovalDuration_dbus_property(self, value=None):
1001
982
if value is None: # get
1002
983
return dbus.UInt64(self._timedelta_to_milliseconds(
1003
984
self.approval_duration))
1004
985
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1005
986
# Emit D-Bus signal
1006
self.PropertyChanged(dbus.String("ApprovalDuration"),
987
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
1007
988
dbus.UInt64(value, variant_level=1))
1008
989
1009
990
# Name - property
1010
@dbus_service_property(_interface, signature="s", access="read")
991
@dbus_service_property(_interface, signature=u"s", access=u"read")
1011
992
def Name_dbus_property(self):
1012
993
return dbus.String(self.name)
1013
994
1014
995
# Fingerprint - property
1015
@dbus_service_property(_interface, signature="s", access="read")
996
@dbus_service_property(_interface, signature=u"s", access=u"read")
1016
997
def Fingerprint_dbus_property(self):
1017
998
return dbus.String(self.fingerprint)
1018
999
1019
1000
# Host - property
1020
@dbus_service_property(_interface, signature="s",
1021
access="readwrite")
1001
@dbus_service_property(_interface, signature=u"s",
1002
access=u"readwrite")
1022
1003
def Host_dbus_property(self, value=None):
1023
1004
if value is None: # get
1024
1005
return dbus.String(self.host)
1025
1006
self.host = value
1026
1007
# Emit D-Bus signal
1027
self.PropertyChanged(dbus.String("Host"),
1008
self.PropertyChanged(dbus.String(u"Host"),
1028
1009
dbus.String(value, variant_level=1))
1029
1010
1030
1011
# Created - property
1031
@dbus_service_property(_interface, signature="s", access="read")
1012
@dbus_service_property(_interface, signature=u"s", access=u"read")
1032
1013
def Created_dbus_property(self):
1033
1014
return dbus.String(self._datetime_to_dbus(self.created))
1034
1015
1035
1016
# LastEnabled - property
1036
@dbus_service_property(_interface, signature="s", access="read")
1017
@dbus_service_property(_interface, signature=u"s", access=u"read")
1037
1018
def LastEnabled_dbus_property(self):
1038
1019
if self.last_enabled is None:
1039
return dbus.String("")
1020
return dbus.String(u"")
1040
1021
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1041
1022
1042
1023
# Enabled - property
1043
@dbus_service_property(_interface, signature="b",
1044
access="readwrite")
1024
@dbus_service_property(_interface, signature=u"b",
1025
access=u"readwrite")
1045
1026
def Enabled_dbus_property(self, value=None):
1046
1027
if value is None: # get
1047
1028
return dbus.Boolean(self.enabled)
1051
1032
self.disable()
1052
1033
1053
1034
# LastCheckedOK - property
1054
@dbus_service_property(_interface, signature="s",
1055
access="readwrite")
1035
@dbus_service_property(_interface, signature=u"s",
1036
access=u"readwrite")
1056
1037
def LastCheckedOK_dbus_property(self, value=None):
1057
1038
if value is not None:
1058
1039
self.checked_ok()
1059
1040
return
1060
1041
if self.last_checked_ok is None:
1061
return dbus.String("")
1042
return dbus.String(u"")
1062
1043
return dbus.String(self._datetime_to_dbus(self
1063
1044
.last_checked_ok))
1064
1045
1065
1046
# LastApprovalRequest - property
1066
@dbus_service_property(_interface, signature="s", access="read")
1047
@dbus_service_property(_interface, signature=u"s", access=u"read")
1067
1048
def LastApprovalRequest_dbus_property(self):
1068
1049
if self.last_approval_request is None:
1069
return dbus.String("")
1050
return dbus.String(u"")
1070
1051
return dbus.String(self.
1071
1052
_datetime_to_dbus(self
1072
1053
.last_approval_request))
1073
1054
1074
1055
# Timeout - property
1075
@dbus_service_property(_interface, signature="t",
1076
access="readwrite")
1056
@dbus_service_property(_interface, signature=u"t",
1057
access=u"readwrite")
1077
1058
def Timeout_dbus_property(self, value=None):
1078
1059
if value is None: # get
1079
1060
return dbus.UInt64(self.timeout_milliseconds())
1080
1061
self.timeout = datetime.timedelta(0, 0, 0, value)
1081
1062
# Emit D-Bus signal
1082
self.PropertyChanged(dbus.String("Timeout"),
1063
self.PropertyChanged(dbus.String(u"Timeout"),
1083
1064
dbus.UInt64(value, variant_level=1))
1084
if getattr(self, "disable_initiator_tag", None) is None:
1065
if getattr(self, u"disable_initiator_tag", None) is None:
1085
1066
return
1086
1067
# Reschedule timeout
1087
1068
gobject.source_remove(self.disable_initiator_tag)
1100
1081
(time_to_die, self.disable))
1101
1082
1102
1083
# Interval - property
1103
@dbus_service_property(_interface, signature="t",
1104
access="readwrite")
1084
@dbus_service_property(_interface, signature=u"t",
1085
access=u"readwrite")
1105
1086
def Interval_dbus_property(self, value=None):
1106
1087
if value is None: # get
1107
1088
return dbus.UInt64(self.interval_milliseconds())
1108
1089
self.interval = datetime.timedelta(0, 0, 0, value)
1109
1090
# Emit D-Bus signal
1110
self.PropertyChanged(dbus.String("Interval"),
1091
self.PropertyChanged(dbus.String(u"Interval"),
1111
1092
dbus.UInt64(value, variant_level=1))
1112
if getattr(self, "checker_initiator_tag", None) is None:
1093
if getattr(self, u"checker_initiator_tag", None) is None:
1113
1094
return
1114
1095
# Reschedule checker run
1115
1096
gobject.source_remove(self.checker_initiator_tag)
1118
1099
self.start_checker() # Start one now, too
1119
1100
1120
1101
# Checker - property
1121
@dbus_service_property(_interface, signature="s",
1122
access="readwrite")
1102
@dbus_service_property(_interface, signature=u"s",
1103
access=u"readwrite")
1123
1104
def Checker_dbus_property(self, value=None):
1124
1105
if value is None: # get
1125
1106
return dbus.String(self.checker_command)
1126
1107
self.checker_command = value
1127
1108
# Emit D-Bus signal
1128
self.PropertyChanged(dbus.String("Checker"),
1109
self.PropertyChanged(dbus.String(u"Checker"),
1129
1110
dbus.String(self.checker_command,
1130
1111
variant_level=1))
1131
1112
1132
1113
# CheckerRunning - property
1133
@dbus_service_property(_interface, signature="b",
1134
access="readwrite")
1114
@dbus_service_property(_interface, signature=u"b",
1115
access=u"readwrite")
1135
1116
def CheckerRunning_dbus_property(self, value=None):
1136
1117
if value is None: # get
1137
1118
return dbus.Boolean(self.checker is not None)
1141
1122
self.stop_checker()
1142
1123
1143
1124
# ObjectPath - property
1144
@dbus_service_property(_interface, signature="o", access="read")
1125
@dbus_service_property(_interface, signature=u"o", access=u"read")
1145
1126
def ObjectPath_dbus_property(self):
1146
1127
return self.dbus_object_path # is already a dbus.ObjectPath
1147
1128
1148
1129
# Secret = property
1149
@dbus_service_property(_interface, signature="ay",
1150
access="write", byte_arrays=True)
1130
@dbus_service_property(_interface, signature=u"ay",
1131
access=u"write", byte_arrays=True)
1151
1132
def Secret_dbus_property(self, value):
1152
1133
self.secret = str(value)
1153
1134
1188
1169
1189
1170
def handle(self):
1190
1171
with contextlib.closing(self.server.child_pipe) as child_pipe:
1191
logger.info("TCP connection from: %s",
1172
logger.info(u"TCP connection from: %s",
1192
1173
unicode(self.client_address))
1193
logger.debug("Pipe FD: %d",
1174
logger.debug(u"Pipe FD: %d",
1194
1175
self.server.child_pipe.fileno())
1195
1176
1196
1177
session = (gnutls.connection
1203
1184
# no X.509 keys are added to it. Therefore, we can use it
1204
1185
# here despite using OpenPGP certificates.
1205
1186
1206
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1207
# "+AES-256-CBC", "+SHA1",
1208
# "+COMP-NULL", "+CTYPE-OPENPGP",
1209
# "+DHE-DSS"))
1187
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1188
# u"+AES-256-CBC", u"+SHA1",
1189
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1190
# u"+DHE-DSS"))
1210
1191
# Use a fallback default, since this MUST be set.
1211
1192
priority = self.server.gnutls_priority
1212
1193
if priority is None:
1213
priority = "NORMAL"
1194
priority = u"NORMAL"
1214
1195
(gnutls.library.functions
1215
1196
.gnutls_priority_set_direct(session._c_object,
1216
1197
priority, None))
1218
1199
# Start communication using the Mandos protocol
1219
1200
# Get protocol number
1220
1201
line = self.request.makefile().readline()
1221
logger.debug("Protocol version: %r", line)
1202
logger.debug(u"Protocol version: %r", line)
1222
1203
try:
1223
1204
if int(line.strip().split()[0]) > 1:
1224
1205
raise RuntimeError
1225
except (ValueError, IndexError, RuntimeError) as error:
1226
logger.error("Unknown protocol version: %s", error)
1206
except (ValueError, IndexError, RuntimeError), error:
1207
logger.error(u"Unknown protocol version: %s", error)
1227
1208
return
1228
1209
1229
1210
# Start GnuTLS connection
1230
1211
try:
1231
1212
session.handshake()
1232
except gnutls.errors.GNUTLSError as error:
1233
logger.warning("Handshake failed: %s", error)
1213
except gnutls.errors.GNUTLSError, error:
1214
logger.warning(u"Handshake failed: %s", error)
1234
1215
# Do not run session.bye() here: the session is not
1235
1216
# established. Just abandon the request.
1236
1217
return
1237
logger.debug("Handshake succeeded")
1218
logger.debug(u"Handshake succeeded")
1238
1219
1239
1220
approval_required = False
1240
1221
try:
1241
1222
try:
1242
1223
fpr = self.fingerprint(self.peer_certificate
1243
1224
(session))
1244
except (TypeError,
1245
gnutls.errors.GNUTLSError) as error:
1246
logger.warning("Bad certificate: %s", error)
1225
except (TypeError, gnutls.errors.GNUTLSError), error:
1226
logger.warning(u"Bad certificate: %s", error)
1247
1227
return
1248
logger.debug("Fingerprint: %s", fpr)
1228
logger.debug(u"Fingerprint: %s", fpr)
1249
1229
1250
1230
try:
1251
1231
client = ProxyClient(child_pipe, fpr,
1260
1240
1261
1241
while True:
1262
1242
if not client.enabled:
1263
logger.warning("Client %s is disabled",
1243
logger.warning(u"Client %s is disabled",
1264
1244
client.name)
1265
1245
if self.server.use_dbus:
1266
1246
# Emit D-Bus signal
1271
1251
#We are approved or approval is disabled
1272
1252
break
1273
1253
elif client._approved is None:
1274
logger.info("Client %s needs approval",
1254
logger.info(u"Client %s needs approval",
1275
1255
client.name)
1276
1256
if self.server.use_dbus:
1277
1257
# Emit D-Bus signal
1279
1259
client.approval_delay_milliseconds(),
1280
1260
client.approved_by_default)
1281
1261
else:
1282
logger.warning("Client %s was not approved",
1262
logger.warning(u"Client %s was not approved",
1283
1263
client.name)
1284
1264
if self.server.use_dbus:
1285
1265
# Emit D-Bus signal
1311
1291
while sent_size < len(client.secret):
1312
1292
try:
1313
1293
sent = session.send(client.secret[sent_size:])
1314
except gnutls.errors.GNUTLSError as error:
1294
except (gnutls.errors.GNUTLSError), error:
1315
1295
logger.warning("gnutls send failed")
1316
1296
return
1317
logger.debug("Sent: %d, remaining: %d",
1297
logger.debug(u"Sent: %d, remaining: %d",
1318
1298
sent, len(client.secret)
1319
1299
- (sent_size + sent))
1320
1300
sent_size += sent
1321
1301
1322
logger.info("Sending secret to %s", client.name)
1302
logger.info(u"Sending secret to %s", client.name)
1323
1303
# bump the timeout as if seen
1324
1304
client.checked_ok()
1325
1305
if self.server.use_dbus:
1331
1311
client.approvals_pending -= 1
1332
1312
try:
1333
1313
session.bye()
1334
except gnutls.errors.GNUTLSError as error:
1314
except (gnutls.errors.GNUTLSError), error:
1335
1315
logger.warning("GnuTLS bye failed")
1336
1316
1337
1317
@staticmethod
1348
1328
.gnutls_certificate_get_peers
1349
1329
(session._c_object, ctypes.byref(list_size)))
1350
1330
if not bool(cert_list) and list_size.value != 0:
1351
raise gnutls.errors.GNUTLSError("error getting peer"
1352
" certificate")
1331
raise gnutls.errors.GNUTLSError(u"error getting peer"
1332
u" certificate")
1353
1333
if list_size.value == 0:
1354
1334
return None
1355
1335
cert = cert_list[0]
1381
1361
if crtverify.value != 0:
1382
1362
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1383
1363
raise (gnutls.errors.CertificateSecurityError
1384
("Verify failed"))
1364
(u"Verify failed"))
1385
1365
# New buffer for the fingerprint
1386
1366
buf = ctypes.create_string_buffer(20)
1387
1367
buf_len = ctypes.c_size_t()
1394
1374
# Convert the buffer to a Python bytestring
1395
1375
fpr = ctypes.string_at(buf, buf_len.value)
1396
1376
# Convert the bytestring to hexadecimal notation
1397
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1377
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1398
1378
return hex_fpr
1399
1379
1400
1380
1428
1408
1429
1409
def add_pipe(self, parent_pipe):
1430
1410
"""Dummy function; override as necessary"""
1431
raise NotImplementedError
1411
pass
1432
1412
1433
1413
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1434
1414
socketserver.TCPServer, object):
1452
1432
bind to an address or port if they were not specified."""
1453
1433
if self.interface is not None:
1454
1434
if SO_BINDTODEVICE is None:
1455
logger.error("SO_BINDTODEVICE does not exist;"
1456
" cannot bind to interface %s",
1435
logger.error(u"SO_BINDTODEVICE does not exist;"
1436
u" cannot bind to interface %s",
1457
1437
self.interface)
1458
1438
else:
1459
1439
try:
1460
1440
self.socket.setsockopt(socket.SOL_SOCKET,
1461
1441
SO_BINDTODEVICE,
1462
1442
str(self.interface
1463
+ '\0'))
1464
except socket.error as error:
1443
+ u'\0'))
1444
except socket.error, error:
1465
1445
if error[0] == errno.EPERM:
1466
logger.error("No permission to"
1467
" bind to interface %s",
1446
logger.error(u"No permission to"
1447
u" bind to interface %s",
1468
1448
self.interface)
1469
1449
elif error[0] == errno.ENOPROTOOPT:
1470
logger.error("SO_BINDTODEVICE not available;"
1471
" cannot bind to interface %s",
1450
logger.error(u"SO_BINDTODEVICE not available;"
1451
u" cannot bind to interface %s",
1472
1452
self.interface)
1473
1453
else:
1474
1454
raise
1476
1456
if self.server_address[0] or self.server_address[1]:
1477
1457
if not self.server_address[0]:
1478
1458
if self.address_family == socket.AF_INET6:
1479
any_address = "::" # in6addr_any
1459
any_address = u"::" # in6addr_any
1480
1460
else:
1481
1461
any_address = socket.INADDR_ANY
1482
1462
self.server_address = (any_address,
1531
1511
def handle_ipc(self, source, condition, parent_pipe=None,
1532
1512
client_object=None):
1533
1513
condition_names = {
1534
gobject.IO_IN: "IN", # There is data to read.
1535
gobject.IO_OUT: "OUT", # Data can be written (without
1514
gobject.IO_IN: u"IN", # There is data to read.
1515
gobject.IO_OUT: u"OUT", # Data can be written (without
1536
1516
# blocking).
1537
gobject.IO_PRI: "PRI", # There is urgent data to read.
1538
gobject.IO_ERR: "ERR", # Error condition.
1539
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1517
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1518
gobject.IO_ERR: u"ERR", # Error condition.
1519
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1540
1520
# broken, usually for pipes and
1541
1521
# sockets).
1542
1522
}
1561
1541
client = c
1562
1542
break
1563
1543
else:
1564
logger.warning("Client not found for fingerprint: %s, ad"
1565
"dress: %s", fpr, address)
1544
logger.warning(u"Client not found for fingerprint: %s, ad"
1545
u"dress: %s", fpr, address)
1566
1546
if self.use_dbus:
1567
1547
# Emit D-Bus signal
1568
1548
mandos_dbus_service.ClientNotFound(fpr, address[0])
1602
1582
def string_to_delta(interval):
1603
1583
"""Parse a string and return a datetime.timedelta
1604
1584
1605
>>> string_to_delta('7d')
1585
>>> string_to_delta(u'7d')
1606
1586
datetime.timedelta(7)
1607
>>> string_to_delta('60s')
1587
>>> string_to_delta(u'60s')
1608
1588
datetime.timedelta(0, 60)
1609
>>> string_to_delta('60m')
1589
>>> string_to_delta(u'60m')
1610
1590
datetime.timedelta(0, 3600)
1611
>>> string_to_delta('24h')
1591
>>> string_to_delta(u'24h')
1612
1592
datetime.timedelta(1)
1613
>>> string_to_delta('1w')
1593
>>> string_to_delta(u'1w')
1614
1594
datetime.timedelta(7)
1615
>>> string_to_delta('5m 30s')
1595
>>> string_to_delta(u'5m 30s')
1616
1596
datetime.timedelta(0, 330)
1617
1597
"""
1618
1598
timevalue = datetime.timedelta(0)
1620
1600
try:
1621
1601
suffix = unicode(s[-1])
1622
1602
value = int(s[:-1])
1623
if suffix == "d":
1603
if suffix == u"d":
1624
1604
delta = datetime.timedelta(value)
1625
elif suffix == "s":
1605
elif suffix == u"s":
1626
1606
delta = datetime.timedelta(0, value)
1627
elif suffix == "m":
1607
elif suffix == u"m":
1628
1608
delta = datetime.timedelta(0, 0, 0, 0, value)
1629
elif suffix == "h":
1609
elif suffix == u"h":
1630
1610
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1631
elif suffix == "w":
1611
elif suffix == u"w":
1632
1612
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1633
1613
else:
1634
raise ValueError("Unknown suffix %r" % suffix)
1635
except (ValueError, IndexError) as e:
1636
raise ValueError(*(e.args))
1614
raise ValueError(u"Unknown suffix %r" % suffix)
1615
except (ValueError, IndexError), e:
1616
raise ValueError(e.message)
1637
1617
timevalue += delta
1638
1618
return timevalue
1639
1619
1645
1625
global if_nametoindex
1646
1626
try:
1647
1627
if_nametoindex = (ctypes.cdll.LoadLibrary
1648
(ctypes.util.find_library("c"))
1628
(ctypes.util.find_library(u"c"))
1649
1629
.if_nametoindex)
1650
1630
except (OSError, AttributeError):
1651
logger.warning("Doing if_nametoindex the hard way")
1631
logger.warning(u"Doing if_nametoindex the hard way")
1652
1632
def if_nametoindex(interface):
1653
1633
"Get an interface index the hard way, i.e. using fcntl()"
1654
1634
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1655
1635
with contextlib.closing(socket.socket()) as s:
1656
1636
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1657
struct.pack(str("16s16x"),
1637
struct.pack(str(u"16s16x"),
1658
1638
interface))
1659
interface_index = struct.unpack(str("I"),
1639
interface_index = struct.unpack(str(u"I"),
1660
1640
ifreq[16:20])[0]
1661
1641
return interface_index
1662
1642
return if_nametoindex(interface)
1670
1650
sys.exit()
1671
1651
os.setsid()
1672
1652
if not nochdir:
1673
os.chdir("/")
1653
os.chdir(u"/")
1674
1654
if os.fork():
1675
1655
sys.exit()
1676
1656
if not noclose:
1678
1658
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1679
1659
if not stat.S_ISCHR(os.fstat(null).st_mode):
1680
1660
raise OSError(errno.ENODEV,
1681
"%s not a character device"
1661
u"%s not a character device"
1682
1662
% os.path.devnull)
1683
1663
os.dup2(null, sys.stdin.fileno())
1684
1664
os.dup2(null, sys.stdout.fileno())
1692
1672
##################################################################
1693
1673
# Parsing of options, both command line and config file
1694
1674
1695
parser = argparse.ArgumentParser()
1696
parser.add_argument("-v", "--version", action="version",
1697
version = "%%(prog)s %s" % version,
1698
help="show version number and exit")
1699
parser.add_argument("-i", "--interface", metavar="IF",
1700
help="Bind to interface IF")
1701
parser.add_argument("-a", "--address",
1702
help="Address to listen for requests on")
1703
parser.add_argument("-p", "--port", type=int,
1704
help="Port number to receive requests on")
1705
parser.add_argument("--check", action="store_true",
1706
help="Run self-test")
1707
parser.add_argument("--debug", action="store_true",
1708
help="Debug mode; run in foreground and log"
1709
" to terminal")
1710
parser.add_argument("--debuglevel", metavar="LEVEL",
1711
help="Debug level for stdout output")
1712
parser.add_argument("--priority", help="GnuTLS"
1713
" priority string (see GnuTLS documentation)")
1714
parser.add_argument("--servicename",
1715
metavar="NAME", help="Zeroconf service name")
1716
parser.add_argument("--configdir",
1717
default="/etc/mandos", metavar="DIR",
1718
help="Directory to search for configuration"
1719
" files")
1720
parser.add_argument("--no-dbus", action="store_false",
1721
dest="use_dbus", help="Do not provide D-Bus"
1722
" system bus interface")
1723
parser.add_argument("--no-ipv6", action="store_false",
1724
dest="use_ipv6", help="Do not use IPv6")
1725
options = parser.parse_args()
1675
parser = optparse.OptionParser(version = "%%prog %s" % version)
1676
parser.add_option("-i", u"--interface", type=u"string",
1677
metavar="IF", help=u"Bind to interface IF")
1678
parser.add_option("-a", u"--address", type=u"string",
1679
help=u"Address to listen for requests on")
1680
parser.add_option("-p", u"--port", type=u"int",
1681
help=u"Port number to receive requests on")
1682
parser.add_option("--check", action=u"store_true",
1683
help=u"Run self-test")
1684
parser.add_option("--debug", action=u"store_true",
1685
help=u"Debug mode; run in foreground and log to"
1686
u" terminal")
1687
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1688
help=u"Debug level for stdout output")
1689
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1690
u" priority string (see GnuTLS documentation)")
1691
parser.add_option("--servicename", type=u"string",
1692
metavar=u"NAME", help=u"Zeroconf service name")
1693
parser.add_option("--configdir", type=u"string",
1694
default=u"/etc/mandos", metavar=u"DIR",
1695
help=u"Directory to search for configuration"
1696
u" files")
1697
parser.add_option("--no-dbus", action=u"store_false",
1698
dest=u"use_dbus", help=u"Do not provide D-Bus"
1699
u" system bus interface")
1700
parser.add_option("--no-ipv6", action=u"store_false",
1701
dest=u"use_ipv6", help=u"Do not use IPv6")
1702
options = parser.parse_args()[0]
1726
1703
1727
1704
if options.check:
1728
1705
import doctest
1730
1707
sys.exit()
1731
1708
1732
1709
# Default values for config file for server-global settings
1733
server_defaults = { "interface": "",
1734
"address": "",
1735
"port": "",
1736
"debug": "False",
1737
"priority":
1738
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1739
"servicename": "Mandos",
1740
"use_dbus": "True",
1741
"use_ipv6": "True",
1742
"debuglevel": "",
1710
server_defaults = { u"interface": u"",
1711
u"address": u"",
1712
u"port": u"",
1713
u"debug": u"False",
1714
u"priority":
1715
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1716
u"servicename": u"Mandos",
1717
u"use_dbus": u"True",
1718
u"use_ipv6": u"True",
1719
u"debuglevel": u"",
1743
1720
}
1744
1721
1745
1722
# Parse config file for server-global settings
1746
1723
server_config = configparser.SafeConfigParser(server_defaults)
1747
1724
del server_defaults
1748
1725
server_config.read(os.path.join(options.configdir,
1749
"mandos.conf"))
1726
u"mandos.conf"))
1750
1727
# Convert the SafeConfigParser object to a dict
1751
1728
server_settings = server_config.defaults()
1752
1729
# Use the appropriate methods on the non-string config options
1753
for option in ("debug", "use_dbus", "use_ipv6"):
1754
server_settings[option] = server_config.getboolean("DEFAULT",
1730
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1731
server_settings[option] = server_config.getboolean(u"DEFAULT",
1755
1732
option)
1756
1733
if server_settings["port"]:
1757
server_settings["port"] = server_config.getint("DEFAULT",
1758
"port")
1734
server_settings["port"] = server_config.getint(u"DEFAULT",
1735
u"port")
1759
1736
del server_config
1760
1737
1761
1738
# Override the settings from the config file with command line
1762
1739
# options, if set.
1763
for option in ("interface", "address", "port", "debug",
1764
"priority", "servicename", "configdir",
1765
"use_dbus", "use_ipv6", "debuglevel"):
1740
for option in (u"interface", u"address", u"port", u"debug",
1741
u"priority", u"servicename", u"configdir",
1742
u"use_dbus", u"use_ipv6", u"debuglevel"):
1766
1743
value = getattr(options, option)
1767
1744
if value is not None:
1768
1745
server_settings[option] = value
1776
1753
##################################################################
1777
1754
1778
1755
# For convenience
1779
debug = server_settings["debug"]
1780
debuglevel = server_settings["debuglevel"]
1781
use_dbus = server_settings["use_dbus"]
1782
use_ipv6 = server_settings["use_ipv6"]
1756
debug = server_settings[u"debug"]
1757
debuglevel = server_settings[u"debuglevel"]
1758
use_dbus = server_settings[u"use_dbus"]
1759
use_ipv6 = server_settings[u"use_ipv6"]
1783
1760
1784
if server_settings["servicename"] != "Mandos":
1761
if server_settings[u"servicename"] != u"Mandos":
1785
1762
syslogger.setFormatter(logging.Formatter
1786
('Mandos (%s) [%%(process)d]:'
1787
' %%(levelname)s: %%(message)s'
1788
% server_settings["servicename"]))
1763
(u'Mandos (%s) [%%(process)d]:'
1764
u' %%(levelname)s: %%(message)s'
1765
% server_settings[u"servicename"]))
1789
1766
1790
1767
# Parse config file with clients
1791
client_defaults = { "timeout": "1h",
1792
"interval": "5m",
1793
"checker": "fping -q -- %%(host)s",
1794
"host": "",
1795
"approval_delay": "0s",
1796
"approval_duration": "1s",
1768
client_defaults = { u"timeout": u"1h",
1769
u"interval": u"5m",
1770
u"checker": u"fping -q -- %%(host)s",
1771
u"host": u"",
1772
u"approval_delay": u"0s",
1773
u"approval_duration": u"1s",
1797
1774
}
1798
1775
client_config = configparser.SafeConfigParser(client_defaults)
1799
client_config.read(os.path.join(server_settings["configdir"],
1800
"clients.conf"))
1776
client_config.read(os.path.join(server_settings[u"configdir"],
1777
u"clients.conf"))
1801
1778
1802
1779
global mandos_dbus_service
1803
1780
mandos_dbus_service = None
1804
1781
1805
tcp_server = MandosServer((server_settings["address"],
1806
server_settings["port"]),
1782
tcp_server = MandosServer((server_settings[u"address"],
1783
server_settings[u"port"]),
1807
1784
ClientHandler,
1808
interface=(server_settings["interface"]
1785
interface=(server_settings[u"interface"]
1809
1786
or None),
1810
1787
use_ipv6=use_ipv6,
1811
1788
gnutls_priority=
1812
server_settings["priority"],
1789
server_settings[u"priority"],
1813
1790
use_dbus=use_dbus)
1814
1791
if not debug:
1815
pidfilename = "/var/run/mandos.pid"
1792
pidfilename = u"/var/run/mandos.pid"
1816
1793
try:
1817
pidfile = open(pidfilename, "w")
1794
pidfile = open(pidfilename, u"w")
1818
1795
except IOError:
1819
logger.error("Could not open file %r", pidfilename)
1796
logger.error(u"Could not open file %r", pidfilename)
1820
1797
1821
1798
try:
1822
uid = pwd.getpwnam("_mandos").pw_uid
1823
gid = pwd.getpwnam("_mandos").pw_gid
1799
uid = pwd.getpwnam(u"_mandos").pw_uid
1800
gid = pwd.getpwnam(u"_mandos").pw_gid
1824
1801
except KeyError:
1825
1802
try:
1826
uid = pwd.getpwnam("mandos").pw_uid
1827
gid = pwd.getpwnam("mandos").pw_gid
1803
uid = pwd.getpwnam(u"mandos").pw_uid
1804
gid = pwd.getpwnam(u"mandos").pw_gid
1828
1805
except KeyError:
1829
1806
try:
1830
uid = pwd.getpwnam("nobody").pw_uid
1831
gid = pwd.getpwnam("nobody").pw_gid
1807
uid = pwd.getpwnam(u"nobody").pw_uid
1808
gid = pwd.getpwnam(u"nobody").pw_gid
1832
1809
except KeyError:
1833
1810
uid = 65534
1834
1811
gid = 65534
1835
1812
try:
1836
1813
os.setgid(gid)
1837
1814
os.setuid(uid)
1838
except OSError as error:
1815
except OSError, error:
1839
1816
if error[0] != errno.EPERM:
1840
1817
raise error
1841
1818
1856
1833
1857
1834
@gnutls.library.types.gnutls_log_func
1858
1835
def debug_gnutls(level, string):
1859
logger.debug("GnuTLS: %s", string[:-1])
1836
logger.debug(u"GnuTLS: %s", string[:-1])
1860
1837
1861
1838
(gnutls.library.functions
1862
1839
.gnutls_global_set_log_function(debug_gnutls))
1870
1847
# No console logging
1871
1848
logger.removeHandler(console)
1872
1849
1873
# Need to fork before connecting to D-Bus
1874
if not debug:
1875
# Close all input and output, do double fork, etc.
1876
daemon()
1877
1850
1878
1851
global main_loop
1879
1852
# From the Avahi example code
1883
1856
# End of Avahi example code
1884
1857
if use_dbus:
1885
1858
try:
1886
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1859
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1887
1860
bus, do_not_queue=True)
1888
except dbus.exceptions.NameExistsException as e:
1889
logger.error(unicode(e) + ", disabling D-Bus")
1861
except dbus.exceptions.NameExistsException, e:
1862
logger.error(unicode(e) + u", disabling D-Bus")
1890
1863
use_dbus = False
1891
server_settings["use_dbus"] = False
1864
server_settings[u"use_dbus"] = False
1892
1865
tcp_server.use_dbus = False
1893
1866
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1894
service = AvahiService(name = server_settings["servicename"],
1895
servicetype = "_mandos._tcp",
1867
service = AvahiService(name = server_settings[u"servicename"],
1868
servicetype = u"_mandos._tcp",
1896
1869
protocol = protocol, bus = bus)
1897
1870
if server_settings["interface"]:
1898
1871
service.interface = (if_nametoindex
1899
(str(server_settings["interface"])))
1900
1872
(str(server_settings[u"interface"])))
1873
1874
if not debug:
1875
# Close all input and output, do double fork, etc.
1876
daemon()
1877
1901
1878
global multiprocessing_manager
1902
1879
multiprocessing_manager = multiprocessing.Manager()
1903
1880
1922
1899
client_config, section)))
1923
1900
for section in client_config.sections()))
1924
1901
if not tcp_server.clients:
1925
logger.warning("No clients defined")
1902
logger.warning(u"No clients defined")
1926
1903
1927
1904
if not debug:
1928
1905
try:
1929
1906
with pidfile:
1930
1907
pid = os.getpid()
1931
pidfile.write(str(pid) + "\n".encode("utf-8"))
1908
pidfile.write(str(pid) + "\n")
1932
1909
del pidfile
1933
1910
except IOError:
1934
logger.error("Could not write to file %r with PID %d",
1911
logger.error(u"Could not write to file %r with PID %d",
1935
1912
pidfilename, pid)
1936
1913
except NameError:
1937
1914
# "pidfile" was never created
1947
1924
class MandosDBusService(dbus.service.Object):
1948
1925
"""A D-Bus proxy object"""
1949
1926
def __init__(self):
1950
dbus.service.Object.__init__(self, bus, "/")
1951
_interface = "se.bsnet.fukt.Mandos"
1927
dbus.service.Object.__init__(self, bus, u"/")
1928
_interface = u"se.bsnet.fukt.Mandos"
1952
1929
1953
@dbus.service.signal(_interface, signature="o")
1930
@dbus.service.signal(_interface, signature=u"o")
1954
1931
def ClientAdded(self, objpath):
1955
1932
"D-Bus signal"
1956
1933
pass
1957
1934
1958
@dbus.service.signal(_interface, signature="ss")
1935
@dbus.service.signal(_interface, signature=u"ss")
1959
1936
def ClientNotFound(self, fingerprint, address):
1960
1937
"D-Bus signal"
1961
1938
pass
1962
1939
1963
@dbus.service.signal(_interface, signature="os")
1940
@dbus.service.signal(_interface, signature=u"os")
1964
1941
def ClientRemoved(self, objpath, name):
1965
1942
"D-Bus signal"
1966
1943
pass
1967
1944
1968
@dbus.service.method(_interface, out_signature="ao")
1945
@dbus.service.method(_interface, out_signature=u"ao")
1969
1946
def GetAllClients(self):
1970
1947
"D-Bus method"
1971
1948
return dbus.Array(c.dbus_object_path
1972
1949
for c in tcp_server.clients)
1973
1950
1974
1951
@dbus.service.method(_interface,
1975
out_signature="a{oa{sv}}")
1952
out_signature=u"a{oa{sv}}")
1976
1953
def GetAllClientsWithProperties(self):
1977
1954
"D-Bus method"
1978
1955
return dbus.Dictionary(
1979
((c.dbus_object_path, c.GetAll(""))
1956
((c.dbus_object_path, c.GetAll(u""))
1980
1957
for c in tcp_server.clients),
1981
signature="oa{sv}")
1958
signature=u"oa{sv}")
1982
1959
1983
@dbus.service.method(_interface, in_signature="o")
1960
@dbus.service.method(_interface, in_signature=u"o")
1984
1961
def RemoveClient(self, object_path):
1985
1962
"D-Bus method"
1986
1963
for c in tcp_server.clients:
2028
2005
# Find out what port we got
2029
2006
service.port = tcp_server.socket.getsockname()[1]
2030
2007
if use_ipv6:
2031
logger.info("Now listening on address %r, port %d,"
2008
logger.info(u"Now listening on address %r, port %d,"
2032
2009
" flowinfo %d, scope_id %d"
2033
2010
% tcp_server.socket.getsockname())
2034
2011
else: # IPv4
2035
logger.info("Now listening on address %r, port %d"
2012
logger.info(u"Now listening on address %r, port %d"
2036
2013
% tcp_server.socket.getsockname())
2037
2014
2038
2015
#service.interface = tcp_server.socket.getsockname()[3]
2041
2018
# From the Avahi example code
2042
2019
try:
2043
2020
service.activate()
2044
except dbus.exceptions.DBusException as error:
2045
logger.critical("DBusException: %s", error)
2021
except dbus.exceptions.DBusException, error:
2022
logger.critical(u"DBusException: %s", error)
2046
2023
cleanup()
2047
2024
sys.exit(1)
2048
2025
# End of Avahi example code
2052
2029
(tcp_server.handle_request
2053
2030
(*args[2:], **kwargs) or True))
2054
2031
2055
logger.debug("Starting main loop")
2032
logger.debug(u"Starting main loop")
2056
2033
main_loop.run()
2057
except AvahiError as error:
2058
logger.critical("AvahiError: %s", error)
2034
except AvahiError, error:
2035
logger.critical(u"AvahiError: %s", error)
2059
2036
cleanup()
2060
2037
sys.exit(1)
2061
2038
except KeyboardInterrupt:
2062
2039
if debug:
2063
print("", file=sys.stderr)
2064
logger.debug("Server received KeyboardInterrupt")
2065
logger.debug("Server exiting")
2040
print >> sys.stderr
2041
logger.debug(u"Server received KeyboardInterrupt")
2042
logger.debug(u"Server exiting")
2066
2043
# Must run before the D-Bus bus name gets deregistered
2067
2044
cleanup()
2068
2045
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0