To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 446
- compare with another revision
- download diff
- download tarball
- view history from revision 446
- Committer: teddy at bsnet
- Date: 2010-09-27 16:27:13 UTC
- Revision ID: teddy@fukt.bsnet.se-20100927162713-jucnyd63612ximvw
* mandos-monitor: Change key for removing a client from "r" to "R".
- files removed:
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008-2010 Teddy Hogeborn
15
# Copyright © 2008-2010 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
31
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
36
import SocketServer as socketserver
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
82
81
SO_BINDTODEVICE = None
83
82
84
83
85
version = "1.3.1"
84
version = "1.0.14"
86
85
87
#logger = logging.getLogger('mandos')
88
logger = logging.Logger('mandos')
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
89
88
syslogger = (logging.handlers.SysLogHandler
90
89
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
91
address = str("/dev/log")))
90
address = "/dev/log"))
92
91
syslogger.setFormatter(logging.Formatter
93
('Mandos [%(process)d]: %(levelname)s:'
94
' %(message)s'))
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
95
94
logger.addHandler(syslogger)
96
95
97
96
console = logging.StreamHandler()
98
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
99
' %(levelname)s:'
100
' %(message)s'))
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
101
100
logger.addHandler(console)
102
101
103
102
class AvahiError(Exception):
120
119
Attributes:
121
120
interface: integer; avahi.IF_UNSPEC or an interface index.
122
121
Used to optionally bind to the specified interface.
123
name: string; Example: 'Mandos'
124
type: string; Example: '_mandos._tcp'.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
125
124
See <http://www.dns-sd.org/ServiceTypes.html>
126
125
port: integer; what port to announce
127
126
TXT: list of strings; TXT record for the service
136
135
"""
137
136
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
138
137
servicetype = None, port = None, TXT = None,
139
domain = "", host = "", max_renames = 32768,
138
domain = u"", host = u"", max_renames = 32768,
140
139
protocol = avahi.PROTO_UNSPEC, bus = None):
141
140
self.interface = interface
142
141
self.name = name
151
150
self.group = None # our entry group
152
151
self.server = None
153
152
self.bus = bus
154
self.entry_group_state_changed_match = None
155
153
def rename(self):
156
154
"""Derived from the Avahi example code"""
157
155
if self.rename_count >= self.max_renames:
158
logger.critical("No suitable Zeroconf service name found"
159
" after %i retries, exiting.",
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
160
158
self.rename_count)
161
raise AvahiServiceError("Too many renames")
159
raise AvahiServiceError(u"Too many renames")
162
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
163
logger.info("Changing Zeroconf service name to %r ...",
161
logger.info(u"Changing Zeroconf service name to %r ...",
164
162
self.name)
165
163
syslogger.setFormatter(logging.Formatter
166
('Mandos (%s) [%%(process)d]:'
167
' %%(levelname)s: %%(message)s'
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
168
166
% self.name))
169
167
self.remove()
170
168
try:
171
169
self.add()
172
except dbus.exceptions.DBusException as error:
173
logger.critical("DBusException: %s", error)
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
174
172
self.cleanup()
175
173
os._exit(1)
176
174
self.rename_count += 1
177
175
def remove(self):
178
176
"""Derived from the Avahi example code"""
179
if self.entry_group_state_changed_match is not None:
180
self.entry_group_state_changed_match.remove()
181
self.entry_group_state_changed_match = None
182
177
if self.group is not None:
183
178
self.group.Reset()
184
179
def add(self):
185
180
"""Derived from the Avahi example code"""
186
self.remove()
187
181
if self.group is None:
188
182
self.group = dbus.Interface(
189
183
self.bus.get_object(avahi.DBUS_NAME,
190
184
self.server.EntryGroupNew()),
191
185
avahi.DBUS_INTERFACE_ENTRY_GROUP)
192
self.entry_group_state_changed_match = (
193
self.group.connect_to_signal(
194
'StateChanged', self .entry_group_state_changed))
195
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
186
self.group.connect_to_signal('StateChanged',
187
self
188
.entry_group_state_changed)
189
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
196
190
self.name, self.type)
197
191
self.group.AddService(
198
192
self.interface,
205
199
self.group.Commit()
206
200
def entry_group_state_changed(self, state, error):
207
201
"""Derived from the Avahi example code"""
208
logger.debug("Avahi entry group state change: %i", state)
202
logger.debug(u"Avahi entry group state change: %i", state)
209
203
210
204
if state == avahi.ENTRY_GROUP_ESTABLISHED:
211
logger.debug("Zeroconf service established.")
205
logger.debug(u"Zeroconf service established.")
212
206
elif state == avahi.ENTRY_GROUP_COLLISION:
213
logger.info("Zeroconf service name collision.")
207
logger.warning(u"Zeroconf service name collision.")
214
208
self.rename()
215
209
elif state == avahi.ENTRY_GROUP_FAILURE:
216
logger.critical("Avahi: Error in group state changed %s",
210
logger.critical(u"Avahi: Error in group state changed %s",
217
211
unicode(error))
218
raise AvahiGroupError("State changed: %s"
212
raise AvahiGroupError(u"State changed: %s"
219
213
% unicode(error))
220
214
def cleanup(self):
221
215
"""Derived from the Avahi example code"""
222
216
if self.group is not None:
223
try:
224
self.group.Free()
225
except (dbus.exceptions.UnknownMethodException,
226
dbus.exceptions.DBusException) as e:
227
pass
217
self.group.Free()
228
218
self.group = None
229
self.remove()
230
def server_state_changed(self, state, error=None):
219
def server_state_changed(self, state):
231
220
"""Derived from the Avahi example code"""
232
logger.debug("Avahi server state change: %i", state)
233
bad_states = { avahi.SERVER_INVALID:
234
"Zeroconf server invalid",
235
avahi.SERVER_REGISTERING: None,
236
avahi.SERVER_COLLISION:
237
"Zeroconf server name collision",
238
avahi.SERVER_FAILURE:
239
"Zeroconf server failure" }
240
if state in bad_states:
241
if bad_states[state] is not None:
242
if error is None:
243
logger.error(bad_states[state])
244
else:
245
logger.error(bad_states[state] + ": %r", error)
246
self.cleanup()
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
224
self.remove()
247
225
elif state == avahi.SERVER_RUNNING:
248
226
self.add()
249
else:
250
if error is None:
251
logger.debug("Unknown state: %r", state)
252
else:
253
logger.debug("Unknown state: %r: %r", state, error)
254
227
def activate(self):
255
228
"""Derived from the Avahi example code"""
256
229
if self.server is None:
257
230
self.server = dbus.Interface(
258
231
self.bus.get_object(avahi.DBUS_NAME,
259
avahi.DBUS_PATH_SERVER,
260
follow_name_owner_changes=True),
232
avahi.DBUS_PATH_SERVER),
261
233
avahi.DBUS_INTERFACE_SERVER)
262
self.server.connect_to_signal("StateChanged",
234
self.server.connect_to_signal(u"StateChanged",
263
235
self.server_state_changed)
264
236
self.server_state_changed(self.server.GetState())
265
237
300
272
runtime_expansions: Allowed attributes for runtime expansion.
301
273
"""
302
274
303
runtime_expansions = ("approval_delay", "approval_duration",
304
"created", "enabled", "fingerprint",
305
"host", "interval", "last_checked_ok",
306
"last_enabled", "name", "timeout")
275
runtime_expansions = (u"approval_delay", u"approval_duration",
276
u"created", u"enabled", u"fingerprint",
277
u"host", u"interval", u"last_checked_ok",
278
u"last_enabled", u"name", u"timeout")
307
279
308
280
@staticmethod
309
281
def _timedelta_to_milliseconds(td):
330
302
self.name = name
331
303
if config is None:
332
304
config = {}
333
logger.debug("Creating client %r", self.name)
305
logger.debug(u"Creating client %r", self.name)
334
306
# Uppercase and remove spaces from fingerprint for later
335
307
# comparison purposes with return value from the fingerprint()
336
308
# function
337
self.fingerprint = (config["fingerprint"].upper()
338
.replace(" ", ""))
339
logger.debug(" Fingerprint: %s", self.fingerprint)
340
if "secret" in config:
341
self.secret = config["secret"].decode("base64")
342
elif "secfile" in config:
309
self.fingerprint = (config[u"fingerprint"].upper()
310
.replace(u" ", u""))
311
logger.debug(u" Fingerprint: %s", self.fingerprint)
312
if u"secret" in config:
313
self.secret = config[u"secret"].decode(u"base64")
314
elif u"secfile" in config:
343
315
with open(os.path.expanduser(os.path.expandvars
344
(config["secfile"])),
316
(config[u"secfile"])),
345
317
"rb") as secfile:
346
318
self.secret = secfile.read()
347
319
else:
348
raise TypeError("No secret or secfile for client %s"
320
raise TypeError(u"No secret or secfile for client %s"
349
321
% self.name)
350
self.host = config.get("host", "")
322
self.host = config.get(u"host", u"")
351
323
self.created = datetime.datetime.utcnow()
352
324
self.enabled = False
353
325
self.last_approval_request = None
354
326
self.last_enabled = None
355
327
self.last_checked_ok = None
356
self.timeout = string_to_delta(config["timeout"])
357
self.interval = string_to_delta(config["interval"])
328
self.timeout = string_to_delta(config[u"timeout"])
329
self.interval = string_to_delta(config[u"interval"])
358
330
self.disable_hook = disable_hook
359
331
self.checker = None
360
332
self.checker_initiator_tag = None
361
333
self.disable_initiator_tag = None
362
334
self.checker_callback_tag = None
363
self.checker_command = config["checker"]
335
self.checker_command = config[u"checker"]
364
336
self.current_checker_command = None
365
337
self.last_connect = None
366
338
self._approved = None
367
self.approved_by_default = config.get("approved_by_default",
339
self.approved_by_default = config.get(u"approved_by_default",
368
340
True)
369
341
self.approvals_pending = 0
370
342
self.approval_delay = string_to_delta(
371
config["approval_delay"])
343
config[u"approval_delay"])
372
344
self.approval_duration = string_to_delta(
373
config["approval_duration"])
345
config[u"approval_duration"])
374
346
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
375
347
376
348
def send_changedstate(self):
380
352
381
353
def enable(self):
382
354
"""Start this client's checker and timeout hooks"""
383
if getattr(self, "enabled", False):
355
if getattr(self, u"enabled", False):
384
356
# Already enabled
385
357
return
386
358
self.send_changedstate()
405
377
if not quiet:
406
378
self.send_changedstate()
407
379
if not quiet:
408
logger.info("Disabling client %s", self.name)
409
if getattr(self, "disable_initiator_tag", False):
380
logger.info(u"Disabling client %s", self.name)
381
if getattr(self, u"disable_initiator_tag", False):
410
382
gobject.source_remove(self.disable_initiator_tag)
411
383
self.disable_initiator_tag = None
412
if getattr(self, "checker_initiator_tag", False):
384
if getattr(self, u"checker_initiator_tag", False):
413
385
gobject.source_remove(self.checker_initiator_tag)
414
386
self.checker_initiator_tag = None
415
387
self.stop_checker()
430
402
if os.WIFEXITED(condition):
431
403
exitstatus = os.WEXITSTATUS(condition)
432
404
if exitstatus == 0:
433
logger.info("Checker for %(name)s succeeded",
405
logger.info(u"Checker for %(name)s succeeded",
434
406
vars(self))
435
407
self.checked_ok()
436
408
else:
437
logger.info("Checker for %(name)s failed",
409
logger.info(u"Checker for %(name)s failed",
438
410
vars(self))
439
411
else:
440
logger.warning("Checker for %(name)s crashed?",
412
logger.warning(u"Checker for %(name)s crashed?",
441
413
vars(self))
442
414
443
415
def checked_ok(self):
472
444
# If a checker exists, make sure it is not a zombie
473
445
try:
474
446
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
475
except (AttributeError, OSError) as error:
447
except (AttributeError, OSError), error:
476
448
if (isinstance(error, OSError)
477
449
and error.errno != errno.ECHILD):
478
450
raise error
479
451
else:
480
452
if pid:
481
logger.warning("Checker was a zombie")
453
logger.warning(u"Checker was a zombie")
482
454
gobject.source_remove(self.checker_callback_tag)
483
455
self.checker_callback(pid, status,
484
456
self.current_checker_command)
491
463
# Escape attributes for the shell
492
464
escaped_attrs = dict(
493
465
(attr,
494
re.escape(unicode(str(getattr(self, attr, "")),
466
re.escape(unicode(str(getattr(self, attr, u"")),
495
467
errors=
496
'replace')))
468
u'replace')))
497
469
for attr in
498
470
self.runtime_expansions)
499
471
500
472
try:
501
473
command = self.checker_command % escaped_attrs
502
except TypeError as error:
503
logger.error('Could not format string "%s":'
504
' %s', self.checker_command, error)
474
except TypeError, error:
475
logger.error(u'Could not format string "%s":'
476
u' %s', self.checker_command, error)
505
477
return True # Try again later
506
478
self.current_checker_command = command
507
479
try:
508
logger.info("Starting checker %r for %s",
480
logger.info(u"Starting checker %r for %s",
509
481
command, self.name)
510
482
# We don't need to redirect stdout and stderr, since
511
483
# in normal mode, that is already done by daemon(),
513
485
# always replaced by /dev/null.)
514
486
self.checker = subprocess.Popen(command,
515
487
close_fds=True,
516
shell=True, cwd="/")
488
shell=True, cwd=u"/")
517
489
self.checker_callback_tag = (gobject.child_watch_add
518
490
(self.checker.pid,
519
491
self.checker_callback,
524
496
if pid:
525
497
gobject.source_remove(self.checker_callback_tag)
526
498
self.checker_callback(pid, status, command)
527
except OSError as error:
528
logger.error("Failed to start subprocess: %s",
499
except OSError, error:
500
logger.error(u"Failed to start subprocess: %s",
529
501
error)
530
502
# Re-run this periodically if run by gobject.timeout_add
531
503
return True
535
507
if self.checker_callback_tag:
536
508
gobject.source_remove(self.checker_callback_tag)
537
509
self.checker_callback_tag = None
538
if getattr(self, "checker", None) is None:
510
if getattr(self, u"checker", None) is None:
539
511
return
540
logger.debug("Stopping checker for %(name)s", vars(self))
512
logger.debug(u"Stopping checker for %(name)s", vars(self))
541
513
try:
542
514
os.kill(self.checker.pid, signal.SIGTERM)
543
515
#time.sleep(0.5)
544
516
#if self.checker.poll() is None:
545
517
# os.kill(self.checker.pid, signal.SIGKILL)
546
except OSError as error:
518
except OSError, error:
547
519
if error.errno != errno.ESRCH: # No such process
548
520
raise
549
521
self.checker = None
550
522
551
def dbus_service_property(dbus_interface, signature="v",
552
access="readwrite", byte_arrays=False):
523
def dbus_service_property(dbus_interface, signature=u"v",
524
access=u"readwrite", byte_arrays=False):
553
525
"""Decorators for marking methods of a DBusObjectWithProperties to
554
526
become properties on the D-Bus.
555
527
562
534
"""
563
535
# Encoding deeply encoded byte arrays is not supported yet by the
564
536
# "Set" method, so we fail early here:
565
if byte_arrays and signature != "ay":
566
raise ValueError("Byte arrays not supported for non-'ay'"
567
" signature %r" % signature)
537
if byte_arrays and signature != u"ay":
538
raise ValueError(u"Byte arrays not supported for non-'ay'"
539
u" signature %r" % signature)
568
540
def decorator(func):
569
541
func._dbus_is_property = True
570
542
func._dbus_interface = dbus_interface
571
543
func._dbus_signature = signature
572
544
func._dbus_access = access
573
545
func._dbus_name = func.__name__
574
if func._dbus_name.endswith("_dbus_property"):
546
if func._dbus_name.endswith(u"_dbus_property"):
575
547
func._dbus_name = func._dbus_name[:-14]
576
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
548
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
577
549
return func
578
550
return decorator
579
551
607
579
608
580
@staticmethod
609
581
def _is_dbus_property(obj):
610
return getattr(obj, "_dbus_is_property", False)
582
return getattr(obj, u"_dbus_is_property", False)
611
583
612
584
def _get_all_dbus_properties(self):
613
585
"""Returns a generator of (name, attribute) pairs
621
593
property with the specified name and interface.
622
594
"""
623
595
for name in (property_name,
624
property_name + "_dbus_property"):
596
property_name + u"_dbus_property"):
625
597
prop = getattr(self, name, None)
626
598
if (prop is None
627
599
or not self._is_dbus_property(prop)
631
603
continue
632
604
return prop
633
605
# No such property
634
raise DBusPropertyNotFound(self.dbus_object_path + ":"
635
+ interface_name + "."
606
raise DBusPropertyNotFound(self.dbus_object_path + u":"
607
+ interface_name + u"."
636
608
+ property_name)
637
609
638
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
639
out_signature="v")
610
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
611
out_signature=u"v")
640
612
def Get(self, interface_name, property_name):
641
613
"""Standard D-Bus property Get() method, see D-Bus standard.
642
614
"""
643
615
prop = self._get_dbus_property(interface_name, property_name)
644
if prop._dbus_access == "write":
616
if prop._dbus_access == u"write":
645
617
raise DBusPropertyAccessException(property_name)
646
618
value = prop()
647
if not hasattr(value, "variant_level"):
619
if not hasattr(value, u"variant_level"):
648
620
return value
649
621
return type(value)(value, variant_level=value.variant_level+1)
650
622
651
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
623
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
652
624
def Set(self, interface_name, property_name, value):
653
625
"""Standard D-Bus property Set() method, see D-Bus standard.
654
626
"""
655
627
prop = self._get_dbus_property(interface_name, property_name)
656
if prop._dbus_access == "read":
628
if prop._dbus_access == u"read":
657
629
raise DBusPropertyAccessException(property_name)
658
if prop._dbus_get_args_options["byte_arrays"]:
630
if prop._dbus_get_args_options[u"byte_arrays"]:
659
631
# The byte_arrays option is not supported yet on
660
632
# signatures other than "ay".
661
if prop._dbus_signature != "ay":
633
if prop._dbus_signature != u"ay":
662
634
raise ValueError
663
635
value = dbus.ByteArray(''.join(unichr(byte)
664
636
for byte in value))
665
637
prop(value)
666
638
667
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
668
out_signature="a{sv}")
639
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
640
out_signature=u"a{sv}")
669
641
def GetAll(self, interface_name):
670
642
"""Standard D-Bus property GetAll() method, see D-Bus
671
643
standard.
679
651
# Interface non-empty but did not match
680
652
continue
681
653
# Ignore write-only properties
682
if prop._dbus_access == "write":
654
if prop._dbus_access == u"write":
683
655
continue
684
656
value = prop()
685
if not hasattr(value, "variant_level"):
657
if not hasattr(value, u"variant_level"):
686
658
all[name] = value
687
659
continue
688
660
all[name] = type(value)(value, variant_level=
689
661
value.variant_level+1)
690
return dbus.Dictionary(all, signature="sv")
662
return dbus.Dictionary(all, signature=u"sv")
691
663
692
664
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
693
out_signature="s",
665
out_signature=u"s",
694
666
path_keyword='object_path',
695
667
connection_keyword='connection')
696
668
def Introspect(self, object_path, connection):
701
673
try:
702
674
document = xml.dom.minidom.parseString(xmlstring)
703
675
def make_tag(document, name, prop):
704
e = document.createElement("property")
705
e.setAttribute("name", name)
706
e.setAttribute("type", prop._dbus_signature)
707
e.setAttribute("access", prop._dbus_access)
676
e = document.createElement(u"property")
677
e.setAttribute(u"name", name)
678
e.setAttribute(u"type", prop._dbus_signature)
679
e.setAttribute(u"access", prop._dbus_access)
708
680
return e
709
for if_tag in document.getElementsByTagName("interface"):
681
for if_tag in document.getElementsByTagName(u"interface"):
710
682
for tag in (make_tag(document, name, prop)
711
683
for name, prop
712
684
in self._get_all_dbus_properties()
713
685
if prop._dbus_interface
714
== if_tag.getAttribute("name")):
686
== if_tag.getAttribute(u"name")):
715
687
if_tag.appendChild(tag)
716
688
# Add the names to the return values for the
717
689
# "org.freedesktop.DBus.Properties" methods
718
if (if_tag.getAttribute("name")
719
== "org.freedesktop.DBus.Properties"):
720
for cn in if_tag.getElementsByTagName("method"):
721
if cn.getAttribute("name") == "Get":
722
for arg in cn.getElementsByTagName("arg"):
723
if (arg.getAttribute("direction")
724
== "out"):
725
arg.setAttribute("name", "value")
726
elif cn.getAttribute("name") == "GetAll":
727
for arg in cn.getElementsByTagName("arg"):
728
if (arg.getAttribute("direction")
729
== "out"):
730
arg.setAttribute("name", "props")
731
xmlstring = document.toxml("utf-8")
690
if (if_tag.getAttribute(u"name")
691
== u"org.freedesktop.DBus.Properties"):
692
for cn in if_tag.getElementsByTagName(u"method"):
693
if cn.getAttribute(u"name") == u"Get":
694
for arg in cn.getElementsByTagName(u"arg"):
695
if (arg.getAttribute(u"direction")
696
== u"out"):
697
arg.setAttribute(u"name", u"value")
698
elif cn.getAttribute(u"name") == u"GetAll":
699
for arg in cn.getElementsByTagName(u"arg"):
700
if (arg.getAttribute(u"direction")
701
== u"out"):
702
arg.setAttribute(u"name", u"props")
703
xmlstring = document.toxml(u"utf-8")
732
704
document.unlink()
733
705
except (AttributeError, xml.dom.DOMException,
734
xml.parsers.expat.ExpatError) as error:
735
logger.error("Failed to override Introspection method",
706
xml.parsers.expat.ExpatError), error:
707
logger.error(u"Failed to override Introspection method",
736
708
error)
737
709
return xmlstring
738
710
746
718
"""
747
719
748
720
runtime_expansions = (Client.runtime_expansions
749
+ ("dbus_object_path",))
721
+ (u"dbus_object_path",))
750
722
751
723
# dbus.service.Object doesn't use super(), so we can't either.
752
724
757
729
# Only now, when this client is initialized, can it show up on
758
730
# the D-Bus
759
731
client_object_name = unicode(self.name).translate(
760
{ord("."): ord("_"),
761
ord("-"): ord("_")})
732
{ord(u"."): ord(u"_"),
733
ord(u"-"): ord(u"_")})
762
734
self.dbus_object_path = (dbus.ObjectPath
763
("/clients/" + client_object_name))
735
(u"/clients/" + client_object_name))
764
736
DBusObjectWithProperties.__init__(self, self.bus,
765
737
self.dbus_object_path)
766
738
773
745
if (hasattr(self, "dbus_object_path")
774
746
and bval is not bool(old_value)):
775
747
dbus_bool = dbus.Boolean(bval, variant_level=1)
776
self.PropertyChanged(dbus.String("ApprovalPending"),
748
self.PropertyChanged(dbus.String(u"ApprovalPending"),
777
749
dbus_bool)
778
750
779
751
approvals_pending = property(_get_approvals_pending,
787
759
variant_level=variant_level)
788
760
789
761
def enable(self):
790
oldstate = getattr(self, "enabled", False)
762
oldstate = getattr(self, u"enabled", False)
791
763
r = Client.enable(self)
792
764
if oldstate != self.enabled:
793
765
# Emit D-Bus signals
794
self.PropertyChanged(dbus.String("Enabled"),
766
self.PropertyChanged(dbus.String(u"Enabled"),
795
767
dbus.Boolean(True, variant_level=1))
796
768
self.PropertyChanged(
797
dbus.String("LastEnabled"),
769
dbus.String(u"LastEnabled"),
798
770
self._datetime_to_dbus(self.last_enabled,
799
771
variant_level=1))
800
772
return r
801
773
802
774
def disable(self, quiet = False):
803
oldstate = getattr(self, "enabled", False)
775
oldstate = getattr(self, u"enabled", False)
804
776
r = Client.disable(self, quiet=quiet)
805
777
if not quiet and oldstate != self.enabled:
806
778
# Emit D-Bus signal
807
self.PropertyChanged(dbus.String("Enabled"),
779
self.PropertyChanged(dbus.String(u"Enabled"),
808
780
dbus.Boolean(False, variant_level=1))
809
781
return r
810
782
813
785
self.remove_from_connection()
814
786
except LookupError:
815
787
pass
816
if hasattr(DBusObjectWithProperties, "__del__"):
788
if hasattr(DBusObjectWithProperties, u"__del__"):
817
789
DBusObjectWithProperties.__del__(self, *args, **kwargs)
818
790
Client.__del__(self, *args, **kwargs)
819
791
822
794
self.checker_callback_tag = None
823
795
self.checker = None
824
796
# Emit D-Bus signal
825
self.PropertyChanged(dbus.String("CheckerRunning"),
797
self.PropertyChanged(dbus.String(u"CheckerRunning"),
826
798
dbus.Boolean(False, variant_level=1))
827
799
if os.WIFEXITED(condition):
828
800
exitstatus = os.WEXITSTATUS(condition)
840
812
*args, **kwargs)
841
813
842
814
def checked_ok(self, *args, **kwargs):
843
Client.checked_ok(self, *args, **kwargs)
815
r = Client.checked_ok(self, *args, **kwargs)
844
816
# Emit D-Bus signal
845
817
self.PropertyChanged(
846
dbus.String("LastCheckedOK"),
818
dbus.String(u"LastCheckedOK"),
847
819
(self._datetime_to_dbus(self.last_checked_ok,
848
820
variant_level=1)))
821
return r
849
822
850
823
def need_approval(self, *args, **kwargs):
851
824
r = Client.need_approval(self, *args, **kwargs)
852
825
# Emit D-Bus signal
853
826
self.PropertyChanged(
854
dbus.String("LastApprovalRequest"),
827
dbus.String(u"LastApprovalRequest"),
855
828
(self._datetime_to_dbus(self.last_approval_request,
856
829
variant_level=1)))
857
830
return r
869
842
# Emit D-Bus signal
870
843
self.CheckerStarted(self.current_checker_command)
871
844
self.PropertyChanged(
872
dbus.String("CheckerRunning"),
845
dbus.String(u"CheckerRunning"),
873
846
dbus.Boolean(True, variant_level=1))
874
847
return r
875
848
876
849
def stop_checker(self, *args, **kwargs):
877
old_checker = getattr(self, "checker", None)
850
old_checker = getattr(self, u"checker", None)
878
851
r = Client.stop_checker(self, *args, **kwargs)
879
852
if (old_checker is not None
880
and getattr(self, "checker", None) is None):
881
self.PropertyChanged(dbus.String("CheckerRunning"),
853
and getattr(self, u"checker", None) is None):
854
self.PropertyChanged(dbus.String(u"CheckerRunning"),
882
855
dbus.Boolean(False, variant_level=1))
883
856
return r
884
857
895
868
896
869
897
870
## D-Bus methods, signals & properties
898
_interface = "se.bsnet.fukt.Mandos.Client"
871
_interface = u"se.bsnet.fukt.Mandos.Client"
899
872
900
873
## Signals
901
874
902
875
# CheckerCompleted - signal
903
@dbus.service.signal(_interface, signature="nxs")
876
@dbus.service.signal(_interface, signature=u"nxs")
904
877
def CheckerCompleted(self, exitcode, waitstatus, command):
905
878
"D-Bus signal"
906
879
pass
907
880
908
881
# CheckerStarted - signal
909
@dbus.service.signal(_interface, signature="s")
882
@dbus.service.signal(_interface, signature=u"s")
910
883
def CheckerStarted(self, command):
911
884
"D-Bus signal"
912
885
pass
913
886
914
887
# PropertyChanged - signal
915
@dbus.service.signal(_interface, signature="sv")
888
@dbus.service.signal(_interface, signature=u"sv")
916
889
def PropertyChanged(self, property, value):
917
890
"D-Bus signal"
918
891
pass
927
900
pass
928
901
929
902
# Rejected - signal
930
@dbus.service.signal(_interface, signature="s")
903
@dbus.service.signal(_interface, signature=u"s")
931
904
def Rejected(self, reason):
932
905
"D-Bus signal"
933
906
pass
934
907
935
908
# NeedApproval - signal
936
@dbus.service.signal(_interface, signature="tb")
909
@dbus.service.signal(_interface, signature=u"tb")
937
910
def NeedApproval(self, timeout, default):
938
911
"D-Bus signal"
939
912
return self.need_approval()
941
914
## Methods
942
915
943
916
# Approve - method
944
@dbus.service.method(_interface, in_signature="b")
917
@dbus.service.method(_interface, in_signature=u"b")
945
918
def Approve(self, value):
946
919
self.approve(value)
947
920
948
921
# CheckedOK - method
949
922
@dbus.service.method(_interface)
950
923
def CheckedOK(self):
951
self.checked_ok()
924
return self.checked_ok()
952
925
953
926
# Enable - method
954
927
@dbus.service.method(_interface)
976
949
## Properties
977
950
978
951
# ApprovalPending - property
979
@dbus_service_property(_interface, signature="b", access="read")
952
@dbus_service_property(_interface, signature=u"b", access=u"read")
980
953
def ApprovalPending_dbus_property(self):
981
954
return dbus.Boolean(bool(self.approvals_pending))
982
955
983
956
# ApprovedByDefault - property
984
@dbus_service_property(_interface, signature="b",
985
access="readwrite")
957
@dbus_service_property(_interface, signature=u"b",
958
access=u"readwrite")
986
959
def ApprovedByDefault_dbus_property(self, value=None):
987
960
if value is None: # get
988
961
return dbus.Boolean(self.approved_by_default)
989
962
self.approved_by_default = bool(value)
990
963
# Emit D-Bus signal
991
self.PropertyChanged(dbus.String("ApprovedByDefault"),
964
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
992
965
dbus.Boolean(value, variant_level=1))
993
966
994
967
# ApprovalDelay - property
995
@dbus_service_property(_interface, signature="t",
996
access="readwrite")
968
@dbus_service_property(_interface, signature=u"t",
969
access=u"readwrite")
997
970
def ApprovalDelay_dbus_property(self, value=None):
998
971
if value is None: # get
999
972
return dbus.UInt64(self.approval_delay_milliseconds())
1000
973
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1001
974
# Emit D-Bus signal
1002
self.PropertyChanged(dbus.String("ApprovalDelay"),
975
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
1003
976
dbus.UInt64(value, variant_level=1))
1004
977
1005
978
# ApprovalDuration - property
1006
@dbus_service_property(_interface, signature="t",
1007
access="readwrite")
979
@dbus_service_property(_interface, signature=u"t",
980
access=u"readwrite")
1008
981
def ApprovalDuration_dbus_property(self, value=None):
1009
982
if value is None: # get
1010
983
return dbus.UInt64(self._timedelta_to_milliseconds(
1011
984
self.approval_duration))
1012
985
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1013
986
# Emit D-Bus signal
1014
self.PropertyChanged(dbus.String("ApprovalDuration"),
987
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
1015
988
dbus.UInt64(value, variant_level=1))
1016
989
1017
990
# Name - property
1018
@dbus_service_property(_interface, signature="s", access="read")
991
@dbus_service_property(_interface, signature=u"s", access=u"read")
1019
992
def Name_dbus_property(self):
1020
993
return dbus.String(self.name)
1021
994
1022
995
# Fingerprint - property
1023
@dbus_service_property(_interface, signature="s", access="read")
996
@dbus_service_property(_interface, signature=u"s", access=u"read")
1024
997
def Fingerprint_dbus_property(self):
1025
998
return dbus.String(self.fingerprint)
1026
999
1027
1000
# Host - property
1028
@dbus_service_property(_interface, signature="s",
1029
access="readwrite")
1001
@dbus_service_property(_interface, signature=u"s",
1002
access=u"readwrite")
1030
1003
def Host_dbus_property(self, value=None):
1031
1004
if value is None: # get
1032
1005
return dbus.String(self.host)
1033
1006
self.host = value
1034
1007
# Emit D-Bus signal
1035
self.PropertyChanged(dbus.String("Host"),
1008
self.PropertyChanged(dbus.String(u"Host"),
1036
1009
dbus.String(value, variant_level=1))
1037
1010
1038
1011
# Created - property
1039
@dbus_service_property(_interface, signature="s", access="read")
1012
@dbus_service_property(_interface, signature=u"s", access=u"read")
1040
1013
def Created_dbus_property(self):
1041
1014
return dbus.String(self._datetime_to_dbus(self.created))
1042
1015
1043
1016
# LastEnabled - property
1044
@dbus_service_property(_interface, signature="s", access="read")
1017
@dbus_service_property(_interface, signature=u"s", access=u"read")
1045
1018
def LastEnabled_dbus_property(self):
1046
1019
if self.last_enabled is None:
1047
return dbus.String("")
1020
return dbus.String(u"")
1048
1021
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1049
1022
1050
1023
# Enabled - property
1051
@dbus_service_property(_interface, signature="b",
1052
access="readwrite")
1024
@dbus_service_property(_interface, signature=u"b",
1025
access=u"readwrite")
1053
1026
def Enabled_dbus_property(self, value=None):
1054
1027
if value is None: # get
1055
1028
return dbus.Boolean(self.enabled)
1059
1032
self.disable()
1060
1033
1061
1034
# LastCheckedOK - property
1062
@dbus_service_property(_interface, signature="s",
1063
access="readwrite")
1035
@dbus_service_property(_interface, signature=u"s",
1036
access=u"readwrite")
1064
1037
def LastCheckedOK_dbus_property(self, value=None):
1065
1038
if value is not None:
1066
1039
self.checked_ok()
1067
1040
return
1068
1041
if self.last_checked_ok is None:
1069
return dbus.String("")
1042
return dbus.String(u"")
1070
1043
return dbus.String(self._datetime_to_dbus(self
1071
1044
.last_checked_ok))
1072
1045
1073
1046
# LastApprovalRequest - property
1074
@dbus_service_property(_interface, signature="s", access="read")
1047
@dbus_service_property(_interface, signature=u"s", access=u"read")
1075
1048
def LastApprovalRequest_dbus_property(self):
1076
1049
if self.last_approval_request is None:
1077
return dbus.String("")
1050
return dbus.String(u"")
1078
1051
return dbus.String(self.
1079
1052
_datetime_to_dbus(self
1080
1053
.last_approval_request))
1081
1054
1082
1055
# Timeout - property
1083
@dbus_service_property(_interface, signature="t",
1084
access="readwrite")
1056
@dbus_service_property(_interface, signature=u"t",
1057
access=u"readwrite")
1085
1058
def Timeout_dbus_property(self, value=None):
1086
1059
if value is None: # get
1087
1060
return dbus.UInt64(self.timeout_milliseconds())
1088
1061
self.timeout = datetime.timedelta(0, 0, 0, value)
1089
1062
# Emit D-Bus signal
1090
self.PropertyChanged(dbus.String("Timeout"),
1063
self.PropertyChanged(dbus.String(u"Timeout"),
1091
1064
dbus.UInt64(value, variant_level=1))
1092
if getattr(self, "disable_initiator_tag", None) is None:
1065
if getattr(self, u"disable_initiator_tag", None) is None:
1093
1066
return
1094
1067
# Reschedule timeout
1095
1068
gobject.source_remove(self.disable_initiator_tag)
1108
1081
(time_to_die, self.disable))
1109
1082
1110
1083
# Interval - property
1111
@dbus_service_property(_interface, signature="t",
1112
access="readwrite")
1084
@dbus_service_property(_interface, signature=u"t",
1085
access=u"readwrite")
1113
1086
def Interval_dbus_property(self, value=None):
1114
1087
if value is None: # get
1115
1088
return dbus.UInt64(self.interval_milliseconds())
1116
1089
self.interval = datetime.timedelta(0, 0, 0, value)
1117
1090
# Emit D-Bus signal
1118
self.PropertyChanged(dbus.String("Interval"),
1091
self.PropertyChanged(dbus.String(u"Interval"),
1119
1092
dbus.UInt64(value, variant_level=1))
1120
if getattr(self, "checker_initiator_tag", None) is None:
1093
if getattr(self, u"checker_initiator_tag", None) is None:
1121
1094
return
1122
1095
# Reschedule checker run
1123
1096
gobject.source_remove(self.checker_initiator_tag)
1126
1099
self.start_checker() # Start one now, too
1127
1100
1128
1101
# Checker - property
1129
@dbus_service_property(_interface, signature="s",
1130
access="readwrite")
1102
@dbus_service_property(_interface, signature=u"s",
1103
access=u"readwrite")
1131
1104
def Checker_dbus_property(self, value=None):
1132
1105
if value is None: # get
1133
1106
return dbus.String(self.checker_command)
1134
1107
self.checker_command = value
1135
1108
# Emit D-Bus signal
1136
self.PropertyChanged(dbus.String("Checker"),
1109
self.PropertyChanged(dbus.String(u"Checker"),
1137
1110
dbus.String(self.checker_command,
1138
1111
variant_level=1))
1139
1112
1140
1113
# CheckerRunning - property
1141
@dbus_service_property(_interface, signature="b",
1142
access="readwrite")
1114
@dbus_service_property(_interface, signature=u"b",
1115
access=u"readwrite")
1143
1116
def CheckerRunning_dbus_property(self, value=None):
1144
1117
if value is None: # get
1145
1118
return dbus.Boolean(self.checker is not None)
1149
1122
self.stop_checker()
1150
1123
1151
1124
# ObjectPath - property
1152
@dbus_service_property(_interface, signature="o", access="read")
1125
@dbus_service_property(_interface, signature=u"o", access=u"read")
1153
1126
def ObjectPath_dbus_property(self):
1154
1127
return self.dbus_object_path # is already a dbus.ObjectPath
1155
1128
1156
1129
# Secret = property
1157
@dbus_service_property(_interface, signature="ay",
1158
access="write", byte_arrays=True)
1130
@dbus_service_property(_interface, signature=u"ay",
1131
access=u"write", byte_arrays=True)
1159
1132
def Secret_dbus_property(self, value):
1160
1133
self.secret = str(value)
1161
1134
1196
1169
1197
1170
def handle(self):
1198
1171
with contextlib.closing(self.server.child_pipe) as child_pipe:
1199
logger.info("TCP connection from: %s",
1172
logger.info(u"TCP connection from: %s",
1200
1173
unicode(self.client_address))
1201
logger.debug("Pipe FD: %d",
1174
logger.debug(u"Pipe FD: %d",
1202
1175
self.server.child_pipe.fileno())
1203
1176
1204
1177
session = (gnutls.connection
1211
1184
# no X.509 keys are added to it. Therefore, we can use it
1212
1185
# here despite using OpenPGP certificates.
1213
1186
1214
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1215
# "+AES-256-CBC", "+SHA1",
1216
# "+COMP-NULL", "+CTYPE-OPENPGP",
1217
# "+DHE-DSS"))
1187
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1188
# u"+AES-256-CBC", u"+SHA1",
1189
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1190
# u"+DHE-DSS"))
1218
1191
# Use a fallback default, since this MUST be set.
1219
1192
priority = self.server.gnutls_priority
1220
1193
if priority is None:
1221
priority = "NORMAL"
1194
priority = u"NORMAL"
1222
1195
(gnutls.library.functions
1223
1196
.gnutls_priority_set_direct(session._c_object,
1224
1197
priority, None))
1226
1199
# Start communication using the Mandos protocol
1227
1200
# Get protocol number
1228
1201
line = self.request.makefile().readline()
1229
logger.debug("Protocol version: %r", line)
1202
logger.debug(u"Protocol version: %r", line)
1230
1203
try:
1231
1204
if int(line.strip().split()[0]) > 1:
1232
1205
raise RuntimeError
1233
except (ValueError, IndexError, RuntimeError) as error:
1234
logger.error("Unknown protocol version: %s", error)
1206
except (ValueError, IndexError, RuntimeError), error:
1207
logger.error(u"Unknown protocol version: %s", error)
1235
1208
return
1236
1209
1237
1210
# Start GnuTLS connection
1238
1211
try:
1239
1212
session.handshake()
1240
except gnutls.errors.GNUTLSError as error:
1241
logger.warning("Handshake failed: %s", error)
1213
except gnutls.errors.GNUTLSError, error:
1214
logger.warning(u"Handshake failed: %s", error)
1242
1215
# Do not run session.bye() here: the session is not
1243
1216
# established. Just abandon the request.
1244
1217
return
1245
logger.debug("Handshake succeeded")
1218
logger.debug(u"Handshake succeeded")
1246
1219
1247
1220
approval_required = False
1248
1221
try:
1249
1222
try:
1250
1223
fpr = self.fingerprint(self.peer_certificate
1251
1224
(session))
1252
except (TypeError,
1253
gnutls.errors.GNUTLSError) as error:
1254
logger.warning("Bad certificate: %s", error)
1225
except (TypeError, gnutls.errors.GNUTLSError), error:
1226
logger.warning(u"Bad certificate: %s", error)
1255
1227
return
1256
logger.debug("Fingerprint: %s", fpr)
1228
logger.debug(u"Fingerprint: %s", fpr)
1257
1229
1258
1230
try:
1259
1231
client = ProxyClient(child_pipe, fpr,
1268
1240
1269
1241
while True:
1270
1242
if not client.enabled:
1271
logger.info("Client %s is disabled",
1243
logger.warning(u"Client %s is disabled",
1272
1244
client.name)
1273
1245
if self.server.use_dbus:
1274
1246
# Emit D-Bus signal
1279
1251
#We are approved or approval is disabled
1280
1252
break
1281
1253
elif client._approved is None:
1282
logger.info("Client %s needs approval",
1254
logger.info(u"Client %s needs approval",
1283
1255
client.name)
1284
1256
if self.server.use_dbus:
1285
1257
# Emit D-Bus signal
1287
1259
client.approval_delay_milliseconds(),
1288
1260
client.approved_by_default)
1289
1261
else:
1290
logger.warning("Client %s was not approved",
1262
logger.warning(u"Client %s was not approved",
1291
1263
client.name)
1292
1264
if self.server.use_dbus:
1293
1265
# Emit D-Bus signal
1319
1291
while sent_size < len(client.secret):
1320
1292
try:
1321
1293
sent = session.send(client.secret[sent_size:])
1322
except gnutls.errors.GNUTLSError as error:
1294
except (gnutls.errors.GNUTLSError), error:
1323
1295
logger.warning("gnutls send failed")
1324
1296
return
1325
logger.debug("Sent: %d, remaining: %d",
1297
logger.debug(u"Sent: %d, remaining: %d",
1326
1298
sent, len(client.secret)
1327
1299
- (sent_size + sent))
1328
1300
sent_size += sent
1329
1301
1330
logger.info("Sending secret to %s", client.name)
1302
logger.info(u"Sending secret to %s", client.name)
1331
1303
# bump the timeout as if seen
1332
1304
client.checked_ok()
1333
1305
if self.server.use_dbus:
1339
1311
client.approvals_pending -= 1
1340
1312
try:
1341
1313
session.bye()
1342
except gnutls.errors.GNUTLSError as error:
1314
except (gnutls.errors.GNUTLSError), error:
1343
1315
logger.warning("GnuTLS bye failed")
1344
1316
1345
1317
@staticmethod
1356
1328
.gnutls_certificate_get_peers
1357
1329
(session._c_object, ctypes.byref(list_size)))
1358
1330
if not bool(cert_list) and list_size.value != 0:
1359
raise gnutls.errors.GNUTLSError("error getting peer"
1360
" certificate")
1331
raise gnutls.errors.GNUTLSError(u"error getting peer"
1332
u" certificate")
1361
1333
if list_size.value == 0:
1362
1334
return None
1363
1335
cert = cert_list[0]
1389
1361
if crtverify.value != 0:
1390
1362
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1391
1363
raise (gnutls.errors.CertificateSecurityError
1392
("Verify failed"))
1364
(u"Verify failed"))
1393
1365
# New buffer for the fingerprint
1394
1366
buf = ctypes.create_string_buffer(20)
1395
1367
buf_len = ctypes.c_size_t()
1402
1374
# Convert the buffer to a Python bytestring
1403
1375
fpr = ctypes.string_at(buf, buf_len.value)
1404
1376
# Convert the bytestring to hexadecimal notation
1405
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1377
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1406
1378
return hex_fpr
1407
1379
1408
1380
1436
1408
1437
1409
def add_pipe(self, parent_pipe):
1438
1410
"""Dummy function; override as necessary"""
1439
raise NotImplementedError
1411
pass
1440
1412
1441
1413
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1442
1414
socketserver.TCPServer, object):
1460
1432
bind to an address or port if they were not specified."""
1461
1433
if self.interface is not None:
1462
1434
if SO_BINDTODEVICE is None:
1463
logger.error("SO_BINDTODEVICE does not exist;"
1464
" cannot bind to interface %s",
1435
logger.error(u"SO_BINDTODEVICE does not exist;"
1436
u" cannot bind to interface %s",
1465
1437
self.interface)
1466
1438
else:
1467
1439
try:
1468
1440
self.socket.setsockopt(socket.SOL_SOCKET,
1469
1441
SO_BINDTODEVICE,
1470
1442
str(self.interface
1471
+ '\0'))
1472
except socket.error as error:
1443
+ u'\0'))
1444
except socket.error, error:
1473
1445
if error[0] == errno.EPERM:
1474
logger.error("No permission to"
1475
" bind to interface %s",
1446
logger.error(u"No permission to"
1447
u" bind to interface %s",
1476
1448
self.interface)
1477
1449
elif error[0] == errno.ENOPROTOOPT:
1478
logger.error("SO_BINDTODEVICE not available;"
1479
" cannot bind to interface %s",
1450
logger.error(u"SO_BINDTODEVICE not available;"
1451
u" cannot bind to interface %s",
1480
1452
self.interface)
1481
1453
else:
1482
1454
raise
1484
1456
if self.server_address[0] or self.server_address[1]:
1485
1457
if not self.server_address[0]:
1486
1458
if self.address_family == socket.AF_INET6:
1487
any_address = "::" # in6addr_any
1459
any_address = u"::" # in6addr_any
1488
1460
else:
1489
1461
any_address = socket.INADDR_ANY
1490
1462
self.server_address = (any_address,
1539
1511
def handle_ipc(self, source, condition, parent_pipe=None,
1540
1512
client_object=None):
1541
1513
condition_names = {
1542
gobject.IO_IN: "IN", # There is data to read.
1543
gobject.IO_OUT: "OUT", # Data can be written (without
1514
gobject.IO_IN: u"IN", # There is data to read.
1515
gobject.IO_OUT: u"OUT", # Data can be written (without
1544
1516
# blocking).
1545
gobject.IO_PRI: "PRI", # There is urgent data to read.
1546
gobject.IO_ERR: "ERR", # Error condition.
1547
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1517
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1518
gobject.IO_ERR: u"ERR", # Error condition.
1519
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1548
1520
# broken, usually for pipes and
1549
1521
# sockets).
1550
1522
}
1569
1541
client = c
1570
1542
break
1571
1543
else:
1572
logger.info("Client not found for fingerprint: %s, ad"
1573
"dress: %s", fpr, address)
1544
logger.warning(u"Client not found for fingerprint: %s, ad"
1545
u"dress: %s", fpr, address)
1574
1546
if self.use_dbus:
1575
1547
# Emit D-Bus signal
1576
1548
mandos_dbus_service.ClientNotFound(fpr, address[0])
1610
1582
def string_to_delta(interval):
1611
1583
"""Parse a string and return a datetime.timedelta
1612
1584
1613
>>> string_to_delta('7d')
1585
>>> string_to_delta(u'7d')
1614
1586
datetime.timedelta(7)
1615
>>> string_to_delta('60s')
1587
>>> string_to_delta(u'60s')
1616
1588
datetime.timedelta(0, 60)
1617
>>> string_to_delta('60m')
1589
>>> string_to_delta(u'60m')
1618
1590
datetime.timedelta(0, 3600)
1619
>>> string_to_delta('24h')
1591
>>> string_to_delta(u'24h')
1620
1592
datetime.timedelta(1)
1621
>>> string_to_delta('1w')
1593
>>> string_to_delta(u'1w')
1622
1594
datetime.timedelta(7)
1623
>>> string_to_delta('5m 30s')
1595
>>> string_to_delta(u'5m 30s')
1624
1596
datetime.timedelta(0, 330)
1625
1597
"""
1626
1598
timevalue = datetime.timedelta(0)
1628
1600
try:
1629
1601
suffix = unicode(s[-1])
1630
1602
value = int(s[:-1])
1631
if suffix == "d":
1603
if suffix == u"d":
1632
1604
delta = datetime.timedelta(value)
1633
elif suffix == "s":
1605
elif suffix == u"s":
1634
1606
delta = datetime.timedelta(0, value)
1635
elif suffix == "m":
1607
elif suffix == u"m":
1636
1608
delta = datetime.timedelta(0, 0, 0, 0, value)
1637
elif suffix == "h":
1609
elif suffix == u"h":
1638
1610
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1639
elif suffix == "w":
1611
elif suffix == u"w":
1640
1612
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1641
1613
else:
1642
raise ValueError("Unknown suffix %r" % suffix)
1643
except (ValueError, IndexError) as e:
1644
raise ValueError(*(e.args))
1614
raise ValueError(u"Unknown suffix %r" % suffix)
1615
except (ValueError, IndexError), e:
1616
raise ValueError(e.message)
1645
1617
timevalue += delta
1646
1618
return timevalue
1647
1619
1653
1625
global if_nametoindex
1654
1626
try:
1655
1627
if_nametoindex = (ctypes.cdll.LoadLibrary
1656
(ctypes.util.find_library("c"))
1628
(ctypes.util.find_library(u"c"))
1657
1629
.if_nametoindex)
1658
1630
except (OSError, AttributeError):
1659
logger.warning("Doing if_nametoindex the hard way")
1631
logger.warning(u"Doing if_nametoindex the hard way")
1660
1632
def if_nametoindex(interface):
1661
1633
"Get an interface index the hard way, i.e. using fcntl()"
1662
1634
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1663
1635
with contextlib.closing(socket.socket()) as s:
1664
1636
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1665
struct.pack(str("16s16x"),
1637
struct.pack(str(u"16s16x"),
1666
1638
interface))
1667
interface_index = struct.unpack(str("I"),
1639
interface_index = struct.unpack(str(u"I"),
1668
1640
ifreq[16:20])[0]
1669
1641
return interface_index
1670
1642
return if_nametoindex(interface)
1678
1650
sys.exit()
1679
1651
os.setsid()
1680
1652
if not nochdir:
1681
os.chdir("/")
1653
os.chdir(u"/")
1682
1654
if os.fork():
1683
1655
sys.exit()
1684
1656
if not noclose:
1686
1658
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1687
1659
if not stat.S_ISCHR(os.fstat(null).st_mode):
1688
1660
raise OSError(errno.ENODEV,
1689
"%s not a character device"
1661
u"%s not a character device"
1690
1662
% os.path.devnull)
1691
1663
os.dup2(null, sys.stdin.fileno())
1692
1664
os.dup2(null, sys.stdout.fileno())
1700
1672
##################################################################
1701
1673
# Parsing of options, both command line and config file
1702
1674
1703
parser = argparse.ArgumentParser()
1704
parser.add_argument("-v", "--version", action="version",
1705
version = "%%(prog)s %s" % version,
1706
help="show version number and exit")
1707
parser.add_argument("-i", "--interface", metavar="IF",
1708
help="Bind to interface IF")
1709
parser.add_argument("-a", "--address",
1710
help="Address to listen for requests on")
1711
parser.add_argument("-p", "--port", type=int,
1712
help="Port number to receive requests on")
1713
parser.add_argument("--check", action="store_true",
1714
help="Run self-test")
1715
parser.add_argument("--debug", action="store_true",
1716
help="Debug mode; run in foreground and log"
1717
" to terminal")
1718
parser.add_argument("--debuglevel", metavar="LEVEL",
1719
help="Debug level for stdout output")
1720
parser.add_argument("--priority", help="GnuTLS"
1721
" priority string (see GnuTLS documentation)")
1722
parser.add_argument("--servicename",
1723
metavar="NAME", help="Zeroconf service name")
1724
parser.add_argument("--configdir",
1725
default="/etc/mandos", metavar="DIR",
1726
help="Directory to search for configuration"
1727
" files")
1728
parser.add_argument("--no-dbus", action="store_false",
1729
dest="use_dbus", help="Do not provide D-Bus"
1730
" system bus interface")
1731
parser.add_argument("--no-ipv6", action="store_false",
1732
dest="use_ipv6", help="Do not use IPv6")
1733
options = parser.parse_args()
1675
parser = optparse.OptionParser(version = "%%prog %s" % version)
1676
parser.add_option("-i", u"--interface", type=u"string",
1677
metavar="IF", help=u"Bind to interface IF")
1678
parser.add_option("-a", u"--address", type=u"string",
1679
help=u"Address to listen for requests on")
1680
parser.add_option("-p", u"--port", type=u"int",
1681
help=u"Port number to receive requests on")
1682
parser.add_option("--check", action=u"store_true",
1683
help=u"Run self-test")
1684
parser.add_option("--debug", action=u"store_true",
1685
help=u"Debug mode; run in foreground and log to"
1686
u" terminal")
1687
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1688
help=u"Debug level for stdout output")
1689
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1690
u" priority string (see GnuTLS documentation)")
1691
parser.add_option("--servicename", type=u"string",
1692
metavar=u"NAME", help=u"Zeroconf service name")
1693
parser.add_option("--configdir", type=u"string",
1694
default=u"/etc/mandos", metavar=u"DIR",
1695
help=u"Directory to search for configuration"
1696
u" files")
1697
parser.add_option("--no-dbus", action=u"store_false",
1698
dest=u"use_dbus", help=u"Do not provide D-Bus"
1699
u" system bus interface")
1700
parser.add_option("--no-ipv6", action=u"store_false",
1701
dest=u"use_ipv6", help=u"Do not use IPv6")
1702
options = parser.parse_args()[0]
1734
1703
1735
1704
if options.check:
1736
1705
import doctest
1738
1707
sys.exit()
1739
1708
1740
1709
# Default values for config file for server-global settings
1741
server_defaults = { "interface": "",
1742
"address": "",
1743
"port": "",
1744
"debug": "False",
1745
"priority":
1746
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1747
"servicename": "Mandos",
1748
"use_dbus": "True",
1749
"use_ipv6": "True",
1750
"debuglevel": "",
1710
server_defaults = { u"interface": u"",
1711
u"address": u"",
1712
u"port": u"",
1713
u"debug": u"False",
1714
u"priority":
1715
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1716
u"servicename": u"Mandos",
1717
u"use_dbus": u"True",
1718
u"use_ipv6": u"True",
1719
u"debuglevel": u"",
1751
1720
}
1752
1721
1753
1722
# Parse config file for server-global settings
1754
1723
server_config = configparser.SafeConfigParser(server_defaults)
1755
1724
del server_defaults
1756
1725
server_config.read(os.path.join(options.configdir,
1757
"mandos.conf"))
1726
u"mandos.conf"))
1758
1727
# Convert the SafeConfigParser object to a dict
1759
1728
server_settings = server_config.defaults()
1760
1729
# Use the appropriate methods on the non-string config options
1761
for option in ("debug", "use_dbus", "use_ipv6"):
1762
server_settings[option] = server_config.getboolean("DEFAULT",
1730
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1731
server_settings[option] = server_config.getboolean(u"DEFAULT",
1763
1732
option)
1764
1733
if server_settings["port"]:
1765
server_settings["port"] = server_config.getint("DEFAULT",
1766
"port")
1734
server_settings["port"] = server_config.getint(u"DEFAULT",
1735
u"port")
1767
1736
del server_config
1768
1737
1769
1738
# Override the settings from the config file with command line
1770
1739
# options, if set.
1771
for option in ("interface", "address", "port", "debug",
1772
"priority", "servicename", "configdir",
1773
"use_dbus", "use_ipv6", "debuglevel"):
1740
for option in (u"interface", u"address", u"port", u"debug",
1741
u"priority", u"servicename", u"configdir",
1742
u"use_dbus", u"use_ipv6", u"debuglevel"):
1774
1743
value = getattr(options, option)
1775
1744
if value is not None:
1776
1745
server_settings[option] = value
1784
1753
##################################################################
1785
1754
1786
1755
# For convenience
1787
debug = server_settings["debug"]
1788
debuglevel = server_settings["debuglevel"]
1789
use_dbus = server_settings["use_dbus"]
1790
use_ipv6 = server_settings["use_ipv6"]
1756
debug = server_settings[u"debug"]
1757
debuglevel = server_settings[u"debuglevel"]
1758
use_dbus = server_settings[u"use_dbus"]
1759
use_ipv6 = server_settings[u"use_ipv6"]
1791
1760
1792
if server_settings["servicename"] != "Mandos":
1761
if server_settings[u"servicename"] != u"Mandos":
1793
1762
syslogger.setFormatter(logging.Formatter
1794
('Mandos (%s) [%%(process)d]:'
1795
' %%(levelname)s: %%(message)s'
1796
% server_settings["servicename"]))
1763
(u'Mandos (%s) [%%(process)d]:'
1764
u' %%(levelname)s: %%(message)s'
1765
% server_settings[u"servicename"]))
1797
1766
1798
1767
# Parse config file with clients
1799
client_defaults = { "timeout": "1h",
1800
"interval": "5m",
1801
"checker": "fping -q -- %%(host)s",
1802
"host": "",
1803
"approval_delay": "0s",
1804
"approval_duration": "1s",
1768
client_defaults = { u"timeout": u"1h",
1769
u"interval": u"5m",
1770
u"checker": u"fping -q -- %%(host)s",
1771
u"host": u"",
1772
u"approval_delay": u"0s",
1773
u"approval_duration": u"1s",
1805
1774
}
1806
1775
client_config = configparser.SafeConfigParser(client_defaults)
1807
client_config.read(os.path.join(server_settings["configdir"],
1808
"clients.conf"))
1776
client_config.read(os.path.join(server_settings[u"configdir"],
1777
u"clients.conf"))
1809
1778
1810
1779
global mandos_dbus_service
1811
1780
mandos_dbus_service = None
1812
1781
1813
tcp_server = MandosServer((server_settings["address"],
1814
server_settings["port"]),
1782
tcp_server = MandosServer((server_settings[u"address"],
1783
server_settings[u"port"]),
1815
1784
ClientHandler,
1816
interface=(server_settings["interface"]
1785
interface=(server_settings[u"interface"]
1817
1786
or None),
1818
1787
use_ipv6=use_ipv6,
1819
1788
gnutls_priority=
1820
server_settings["priority"],
1789
server_settings[u"priority"],
1821
1790
use_dbus=use_dbus)
1822
1791
if not debug:
1823
pidfilename = "/var/run/mandos.pid"
1792
pidfilename = u"/var/run/mandos.pid"
1824
1793
try:
1825
pidfile = open(pidfilename, "w")
1794
pidfile = open(pidfilename, u"w")
1826
1795
except IOError:
1827
logger.error("Could not open file %r", pidfilename)
1796
logger.error(u"Could not open file %r", pidfilename)
1828
1797
1829
1798
try:
1830
uid = pwd.getpwnam("_mandos").pw_uid
1831
gid = pwd.getpwnam("_mandos").pw_gid
1799
uid = pwd.getpwnam(u"_mandos").pw_uid
1800
gid = pwd.getpwnam(u"_mandos").pw_gid
1832
1801
except KeyError:
1833
1802
try:
1834
uid = pwd.getpwnam("mandos").pw_uid
1835
gid = pwd.getpwnam("mandos").pw_gid
1803
uid = pwd.getpwnam(u"mandos").pw_uid
1804
gid = pwd.getpwnam(u"mandos").pw_gid
1836
1805
except KeyError:
1837
1806
try:
1838
uid = pwd.getpwnam("nobody").pw_uid
1839
gid = pwd.getpwnam("nobody").pw_gid
1807
uid = pwd.getpwnam(u"nobody").pw_uid
1808
gid = pwd.getpwnam(u"nobody").pw_gid
1840
1809
except KeyError:
1841
1810
uid = 65534
1842
1811
gid = 65534
1843
1812
try:
1844
1813
os.setgid(gid)
1845
1814
os.setuid(uid)
1846
except OSError as error:
1815
except OSError, error:
1847
1816
if error[0] != errno.EPERM:
1848
1817
raise error
1849
1818
1864
1833
1865
1834
@gnutls.library.types.gnutls_log_func
1866
1835
def debug_gnutls(level, string):
1867
logger.debug("GnuTLS: %s", string[:-1])
1836
logger.debug(u"GnuTLS: %s", string[:-1])
1868
1837
1869
1838
(gnutls.library.functions
1870
1839
.gnutls_global_set_log_function(debug_gnutls))
1878
1847
# No console logging
1879
1848
logger.removeHandler(console)
1880
1849
1881
# Need to fork before connecting to D-Bus
1882
if not debug:
1883
# Close all input and output, do double fork, etc.
1884
daemon()
1885
1850
1886
1851
global main_loop
1887
1852
# From the Avahi example code
1891
1856
# End of Avahi example code
1892
1857
if use_dbus:
1893
1858
try:
1894
bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",
1859
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1895
1860
bus, do_not_queue=True)
1896
except dbus.exceptions.NameExistsException as e:
1897
logger.error(unicode(e) + ", disabling D-Bus")
1861
except dbus.exceptions.NameExistsException, e:
1862
logger.error(unicode(e) + u", disabling D-Bus")
1898
1863
use_dbus = False
1899
server_settings["use_dbus"] = False
1864
server_settings[u"use_dbus"] = False
1900
1865
tcp_server.use_dbus = False
1901
1866
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1902
service = AvahiService(name = server_settings["servicename"],
1903
servicetype = "_mandos._tcp",
1867
service = AvahiService(name = server_settings[u"servicename"],
1868
servicetype = u"_mandos._tcp",
1904
1869
protocol = protocol, bus = bus)
1905
1870
if server_settings["interface"]:
1906
1871
service.interface = (if_nametoindex
1907
(str(server_settings["interface"])))
1908
1872
(str(server_settings[u"interface"])))
1873
1874
if not debug:
1875
# Close all input and output, do double fork, etc.
1876
daemon()
1877
1909
1878
global multiprocessing_manager
1910
1879
multiprocessing_manager = multiprocessing.Manager()
1911
1880
1930
1899
client_config, section)))
1931
1900
for section in client_config.sections()))
1932
1901
if not tcp_server.clients:
1933
logger.warning("No clients defined")
1902
logger.warning(u"No clients defined")
1934
1903
1935
1904
if not debug:
1936
1905
try:
1937
1906
with pidfile:
1938
1907
pid = os.getpid()
1939
pidfile.write(str(pid) + "\n".encode("utf-8"))
1908
pidfile.write(str(pid) + "\n")
1940
1909
del pidfile
1941
1910
except IOError:
1942
logger.error("Could not write to file %r with PID %d",
1911
logger.error(u"Could not write to file %r with PID %d",
1943
1912
pidfilename, pid)
1944
1913
except NameError:
1945
1914
# "pidfile" was never created
1955
1924
class MandosDBusService(dbus.service.Object):
1956
1925
"""A D-Bus proxy object"""
1957
1926
def __init__(self):
1958
dbus.service.Object.__init__(self, bus, "/")
1959
_interface = "se.bsnet.fukt.Mandos"
1927
dbus.service.Object.__init__(self, bus, u"/")
1928
_interface = u"se.bsnet.fukt.Mandos"
1960
1929
1961
@dbus.service.signal(_interface, signature="o")
1930
@dbus.service.signal(_interface, signature=u"o")
1962
1931
def ClientAdded(self, objpath):
1963
1932
"D-Bus signal"
1964
1933
pass
1965
1934
1966
@dbus.service.signal(_interface, signature="ss")
1935
@dbus.service.signal(_interface, signature=u"ss")
1967
1936
def ClientNotFound(self, fingerprint, address):
1968
1937
"D-Bus signal"
1969
1938
pass
1970
1939
1971
@dbus.service.signal(_interface, signature="os")
1940
@dbus.service.signal(_interface, signature=u"os")
1972
1941
def ClientRemoved(self, objpath, name):
1973
1942
"D-Bus signal"
1974
1943
pass
1975
1944
1976
@dbus.service.method(_interface, out_signature="ao")
1945
@dbus.service.method(_interface, out_signature=u"ao")
1977
1946
def GetAllClients(self):
1978
1947
"D-Bus method"
1979
1948
return dbus.Array(c.dbus_object_path
1980
1949
for c in tcp_server.clients)
1981
1950
1982
1951
@dbus.service.method(_interface,
1983
out_signature="a{oa{sv}}")
1952
out_signature=u"a{oa{sv}}")
1984
1953
def GetAllClientsWithProperties(self):
1985
1954
"D-Bus method"
1986
1955
return dbus.Dictionary(
1987
((c.dbus_object_path, c.GetAll(""))
1956
((c.dbus_object_path, c.GetAll(u""))
1988
1957
for c in tcp_server.clients),
1989
signature="oa{sv}")
1958
signature=u"oa{sv}")
1990
1959
1991
@dbus.service.method(_interface, in_signature="o")
1960
@dbus.service.method(_interface, in_signature=u"o")
1992
1961
def RemoveClient(self, object_path):
1993
1962
"D-Bus method"
1994
1963
for c in tcp_server.clients:
2036
2005
# Find out what port we got
2037
2006
service.port = tcp_server.socket.getsockname()[1]
2038
2007
if use_ipv6:
2039
logger.info("Now listening on address %r, port %d,"
2008
logger.info(u"Now listening on address %r, port %d,"
2040
2009
" flowinfo %d, scope_id %d"
2041
2010
% tcp_server.socket.getsockname())
2042
2011
else: # IPv4
2043
logger.info("Now listening on address %r, port %d"
2012
logger.info(u"Now listening on address %r, port %d"
2044
2013
% tcp_server.socket.getsockname())
2045
2014
2046
2015
#service.interface = tcp_server.socket.getsockname()[3]
2049
2018
# From the Avahi example code
2050
2019
try:
2051
2020
service.activate()
2052
except dbus.exceptions.DBusException as error:
2053
logger.critical("DBusException: %s", error)
2021
except dbus.exceptions.DBusException, error:
2022
logger.critical(u"DBusException: %s", error)
2054
2023
cleanup()
2055
2024
sys.exit(1)
2056
2025
# End of Avahi example code
2060
2029
(tcp_server.handle_request
2061
2030
(*args[2:], **kwargs) or True))
2062
2031
2063
logger.debug("Starting main loop")
2032
logger.debug(u"Starting main loop")
2064
2033
main_loop.run()
2065
except AvahiError as error:
2066
logger.critical("AvahiError: %s", error)
2034
except AvahiError, error:
2035
logger.critical(u"AvahiError: %s", error)
2067
2036
cleanup()
2068
2037
sys.exit(1)
2069
2038
except KeyboardInterrupt:
2070
2039
if debug:
2071
print("", file=sys.stderr)
2072
logger.debug("Server received KeyboardInterrupt")
2073
logger.debug("Server exiting")
2040
print >> sys.stderr
2041
logger.debug(u"Server received KeyboardInterrupt")
2042
logger.debug(u"Server exiting")
2074
2043
# Must run before the D-Bus bus name gets deregistered
2075
2044
cleanup()
2076
2045
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0