To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 451
- compare with another revision
- download diff
- download tarball
- view history from revision 451
- Committer: Teddy Hogeborn
- Date: 2010-09-30 06:24:20 UTC
- Revision ID: teddy@fukt.bsnet.se-20100930062420-nm7nlb160myyzj82
* mandos-monitor.xml (KEYS): Bug fix: Changed "r" to "R".
* .bzrignore: Updated.
(debian/po/messages.mo, debian/po/templates.pot): Removed.
(plugins.d/plymouth): Added.
* .bzrignore: Updated.
(debian/po/messages.mo, debian/po/templates.pot): Removed.
(plugins.d/plymouth): Added.
- files removed:
- debian/source
- network-hooks.d
- files modified:
- DBUS-API
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
14
# Copyright © 2008-2010 Teddy Hogeborn
15
# Copyright © 2008-2010 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@recompile.se>.
31
# Contact the authors at <mandos@fukt.bsnet.se>.
32
32
#
33
33
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
34
from __future__ import division, with_statement, absolute_import
36
35
37
36
import SocketServer as socketserver
38
37
import socket
39
import argparse
38
import optparse
40
39
import datetime
41
40
import errno
42
41
import gnutls.crypto
62
61
import functools
63
62
import cPickle as pickle
64
63
import multiprocessing
65
import types
66
64
67
65
import dbus
68
66
import dbus.service
83
81
SO_BINDTODEVICE = None
84
82
85
83
86
version = "1.4.1"
84
version = "1.2"
87
85
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
90
88
syslogger = (logging.handlers.SysLogHandler
91
89
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
92
address = str("/dev/log")))
90
address = "/dev/log"))
93
91
syslogger.setFormatter(logging.Formatter
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
96
94
logger.addHandler(syslogger)
97
95
98
96
console = logging.StreamHandler()
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
102
100
logger.addHandler(console)
103
101
104
102
class AvahiError(Exception):
121
119
Attributes:
122
120
interface: integer; avahi.IF_UNSPEC or an interface index.
123
121
Used to optionally bind to the specified interface.
124
name: string; Example: 'Mandos'
125
type: string; Example: '_mandos._tcp'.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
126
124
See <http://www.dns-sd.org/ServiceTypes.html>
127
125
port: integer; what port to announce
128
126
TXT: list of strings; TXT record for the service
137
135
"""
138
136
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
139
137
servicetype = None, port = None, TXT = None,
140
domain = "", host = "", max_renames = 32768,
138
domain = u"", host = u"", max_renames = 32768,
141
139
protocol = avahi.PROTO_UNSPEC, bus = None):
142
140
self.interface = interface
143
141
self.name = name
152
150
self.group = None # our entry group
153
151
self.server = None
154
152
self.bus = bus
155
self.entry_group_state_changed_match = None
156
153
def rename(self):
157
154
"""Derived from the Avahi example code"""
158
155
if self.rename_count >= self.max_renames:
159
logger.critical("No suitable Zeroconf service name found"
160
" after %i retries, exiting.",
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
161
158
self.rename_count)
162
raise AvahiServiceError("Too many renames")
163
self.name = unicode(self.server
164
.GetAlternativeServiceName(self.name))
165
logger.info("Changing Zeroconf service name to %r ...",
159
raise AvahiServiceError(u"Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
161
logger.info(u"Changing Zeroconf service name to %r ...",
166
162
self.name)
167
163
syslogger.setFormatter(logging.Formatter
168
('Mandos (%s) [%%(process)d]:'
169
' %%(levelname)s: %%(message)s'
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
170
166
% self.name))
171
167
self.remove()
172
168
try:
173
169
self.add()
174
except dbus.exceptions.DBusException as error:
175
logger.critical("DBusException: %s", error)
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
176
172
self.cleanup()
177
173
os._exit(1)
178
174
self.rename_count += 1
179
175
def remove(self):
180
176
"""Derived from the Avahi example code"""
181
if self.entry_group_state_changed_match is not None:
182
self.entry_group_state_changed_match.remove()
183
self.entry_group_state_changed_match = None
184
177
if self.group is not None:
185
178
self.group.Reset()
186
179
def add(self):
187
180
"""Derived from the Avahi example code"""
188
self.remove()
189
181
if self.group is None:
190
182
self.group = dbus.Interface(
191
183
self.bus.get_object(avahi.DBUS_NAME,
192
184
self.server.EntryGroupNew()),
193
185
avahi.DBUS_INTERFACE_ENTRY_GROUP)
194
self.entry_group_state_changed_match = (
195
self.group.connect_to_signal(
196
'StateChanged', self .entry_group_state_changed))
197
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
186
self.group.connect_to_signal('StateChanged',
187
self
188
.entry_group_state_changed)
189
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
198
190
self.name, self.type)
199
191
self.group.AddService(
200
192
self.interface,
207
199
self.group.Commit()
208
200
def entry_group_state_changed(self, state, error):
209
201
"""Derived from the Avahi example code"""
210
logger.debug("Avahi entry group state change: %i", state)
202
logger.debug(u"Avahi entry group state change: %i", state)
211
203
212
204
if state == avahi.ENTRY_GROUP_ESTABLISHED:
213
logger.debug("Zeroconf service established.")
205
logger.debug(u"Zeroconf service established.")
214
206
elif state == avahi.ENTRY_GROUP_COLLISION:
215
logger.info("Zeroconf service name collision.")
207
logger.warning(u"Zeroconf service name collision.")
216
208
self.rename()
217
209
elif state == avahi.ENTRY_GROUP_FAILURE:
218
logger.critical("Avahi: Error in group state changed %s",
210
logger.critical(u"Avahi: Error in group state changed %s",
219
211
unicode(error))
220
raise AvahiGroupError("State changed: %s"
212
raise AvahiGroupError(u"State changed: %s"
221
213
% unicode(error))
222
214
def cleanup(self):
223
215
"""Derived from the Avahi example code"""
224
216
if self.group is not None:
225
try:
226
self.group.Free()
227
except (dbus.exceptions.UnknownMethodException,
228
dbus.exceptions.DBusException) as e:
229
pass
217
self.group.Free()
230
218
self.group = None
231
self.remove()
232
def server_state_changed(self, state, error=None):
219
def server_state_changed(self, state):
233
220
"""Derived from the Avahi example code"""
234
logger.debug("Avahi server state change: %i", state)
235
bad_states = { avahi.SERVER_INVALID:
236
"Zeroconf server invalid",
237
avahi.SERVER_REGISTERING: None,
238
avahi.SERVER_COLLISION:
239
"Zeroconf server name collision",
240
avahi.SERVER_FAILURE:
241
"Zeroconf server failure" }
242
if state in bad_states:
243
if bad_states[state] is not None:
244
if error is None:
245
logger.error(bad_states[state])
246
else:
247
logger.error(bad_states[state] + ": %r", error)
248
self.cleanup()
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
224
self.remove()
249
225
elif state == avahi.SERVER_RUNNING:
250
226
self.add()
251
else:
252
if error is None:
253
logger.debug("Unknown state: %r", state)
254
else:
255
logger.debug("Unknown state: %r: %r", state, error)
256
227
def activate(self):
257
228
"""Derived from the Avahi example code"""
258
229
if self.server is None:
259
230
self.server = dbus.Interface(
260
231
self.bus.get_object(avahi.DBUS_NAME,
261
avahi.DBUS_PATH_SERVER,
262
follow_name_owner_changes=True),
232
avahi.DBUS_PATH_SERVER),
263
233
avahi.DBUS_INTERFACE_SERVER)
264
self.server.connect_to_signal("StateChanged",
234
self.server.connect_to_signal(u"StateChanged",
265
235
self.server_state_changed)
266
236
self.server_state_changed(self.server.GetState())
267
237
268
238
269
def _timedelta_to_milliseconds(td):
270
"Convert a datetime.timedelta() to milliseconds"
271
return ((td.days * 24 * 60 * 60 * 1000)
272
+ (td.seconds * 1000)
273
+ (td.microseconds // 1000))
274
275
239
class Client(object):
276
240
"""A representation of a client host served by this server.
277
241
305
269
secret: bytestring; sent verbatim (over TLS) to client
306
270
timeout: datetime.timedelta(); How long from last_checked_ok
307
271
until this client is disabled
308
extended_timeout: extra long timeout when password has been sent
309
272
runtime_expansions: Allowed attributes for runtime expansion.
310
expires: datetime.datetime(); time (UTC) when a client will be
311
disabled, or None
312
273
"""
313
274
314
runtime_expansions = ("approval_delay", "approval_duration",
315
"created", "enabled", "fingerprint",
316
"host", "interval", "last_checked_ok",
317
"last_enabled", "name", "timeout")
275
runtime_expansions = (u"approval_delay", u"approval_duration",
276
u"created", u"enabled", u"fingerprint",
277
u"host", u"interval", u"last_checked_ok",
278
u"last_enabled", u"name", u"timeout")
279
280
@staticmethod
281
def _timedelta_to_milliseconds(td):
282
"Convert a datetime.timedelta() to milliseconds"
283
return ((td.days * 24 * 60 * 60 * 1000)
284
+ (td.seconds * 1000)
285
+ (td.microseconds // 1000))
318
286
319
287
def timeout_milliseconds(self):
320
288
"Return the 'timeout' attribute in milliseconds"
321
return _timedelta_to_milliseconds(self.timeout)
322
323
def extended_timeout_milliseconds(self):
324
"Return the 'extended_timeout' attribute in milliseconds"
325
return _timedelta_to_milliseconds(self.extended_timeout)
289
return self._timedelta_to_milliseconds(self.timeout)
326
290
327
291
def interval_milliseconds(self):
328
292
"Return the 'interval' attribute in milliseconds"
329
return _timedelta_to_milliseconds(self.interval)
330
293
return self._timedelta_to_milliseconds(self.interval)
294
331
295
def approval_delay_milliseconds(self):
332
return _timedelta_to_milliseconds(self.approval_delay)
296
return self._timedelta_to_milliseconds(self.approval_delay)
333
297
334
298
def __init__(self, name = None, disable_hook=None, config=None):
335
299
"""Note: the 'checker' key in 'config' sets the
338
302
self.name = name
339
303
if config is None:
340
304
config = {}
341
logger.debug("Creating client %r", self.name)
305
logger.debug(u"Creating client %r", self.name)
342
306
# Uppercase and remove spaces from fingerprint for later
343
307
# comparison purposes with return value from the fingerprint()
344
308
# function
345
self.fingerprint = (config["fingerprint"].upper()
346
.replace(" ", ""))
347
logger.debug(" Fingerprint: %s", self.fingerprint)
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
309
self.fingerprint = (config[u"fingerprint"].upper()
310
.replace(u" ", u""))
311
logger.debug(u" Fingerprint: %s", self.fingerprint)
312
if u"secret" in config:
313
self.secret = config[u"secret"].decode(u"base64")
314
elif u"secfile" in config:
351
315
with open(os.path.expanduser(os.path.expandvars
352
(config["secfile"])),
316
(config[u"secfile"])),
353
317
"rb") as secfile:
354
318
self.secret = secfile.read()
355
319
else:
356
raise TypeError("No secret or secfile for client %s"
320
raise TypeError(u"No secret or secfile for client %s"
357
321
% self.name)
358
self.host = config.get("host", "")
322
self.host = config.get(u"host", u"")
359
323
self.created = datetime.datetime.utcnow()
360
324
self.enabled = False
361
325
self.last_approval_request = None
362
326
self.last_enabled = None
363
327
self.last_checked_ok = None
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
328
self.timeout = string_to_delta(config[u"timeout"])
329
self.interval = string_to_delta(config[u"interval"])
368
330
self.disable_hook = disable_hook
369
331
self.checker = None
370
332
self.checker_initiator_tag = None
371
333
self.disable_initiator_tag = None
372
self.expires = None
373
334
self.checker_callback_tag = None
374
self.checker_command = config["checker"]
335
self.checker_command = config[u"checker"]
375
336
self.current_checker_command = None
376
337
self.last_connect = None
377
338
self._approved = None
378
self.approved_by_default = config.get("approved_by_default",
339
self.approved_by_default = config.get(u"approved_by_default",
379
340
True)
380
341
self.approvals_pending = 0
381
342
self.approval_delay = string_to_delta(
382
config["approval_delay"])
343
config[u"approval_delay"])
383
344
self.approval_duration = string_to_delta(
384
config["approval_duration"])
385
self.changedstate = (multiprocessing_manager
386
.Condition(multiprocessing_manager
387
.Lock()))
345
config[u"approval_duration"])
346
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
388
347
389
348
def send_changedstate(self):
390
349
self.changedstate.acquire()
391
350
self.changedstate.notify_all()
392
351
self.changedstate.release()
393
352
394
353
def enable(self):
395
354
"""Start this client's checker and timeout hooks"""
396
if getattr(self, "enabled", False):
355
if getattr(self, u"enabled", False):
397
356
# Already enabled
398
357
return
399
358
self.send_changedstate()
359
self.last_enabled = datetime.datetime.utcnow()
400
360
# Schedule a new checker to be started an 'interval' from now,
401
361
# and every interval from then on.
402
362
self.checker_initiator_tag = (gobject.timeout_add
403
363
(self.interval_milliseconds(),
404
364
self.start_checker))
405
365
# Schedule a disable() when 'timeout' has passed
406
self.expires = datetime.datetime.utcnow() + self.timeout
407
366
self.disable_initiator_tag = (gobject.timeout_add
408
367
(self.timeout_milliseconds(),
409
368
self.disable))
410
369
self.enabled = True
411
self.last_enabled = datetime.datetime.utcnow()
412
370
# Also start a new checker *right now*.
413
371
self.start_checker()
414
372
419
377
if not quiet:
420
378
self.send_changedstate()
421
379
if not quiet:
422
logger.info("Disabling client %s", self.name)
423
if getattr(self, "disable_initiator_tag", False):
380
logger.info(u"Disabling client %s", self.name)
381
if getattr(self, u"disable_initiator_tag", False):
424
382
gobject.source_remove(self.disable_initiator_tag)
425
383
self.disable_initiator_tag = None
426
self.expires = None
427
if getattr(self, "checker_initiator_tag", False):
384
if getattr(self, u"checker_initiator_tag", False):
428
385
gobject.source_remove(self.checker_initiator_tag)
429
386
self.checker_initiator_tag = None
430
387
self.stop_checker()
445
402
if os.WIFEXITED(condition):
446
403
exitstatus = os.WEXITSTATUS(condition)
447
404
if exitstatus == 0:
448
logger.info("Checker for %(name)s succeeded",
405
logger.info(u"Checker for %(name)s succeeded",
449
406
vars(self))
450
407
self.checked_ok()
451
408
else:
452
logger.info("Checker for %(name)s failed",
409
logger.info(u"Checker for %(name)s failed",
453
410
vars(self))
454
411
else:
455
logger.warning("Checker for %(name)s crashed?",
412
logger.warning(u"Checker for %(name)s crashed?",
456
413
vars(self))
457
414
458
def checked_ok(self, timeout=None):
415
def checked_ok(self):
459
416
"""Bump up the timeout for this client.
460
417
461
418
This should only be called when the client has been seen,
462
419
alive and well.
463
420
"""
464
if timeout is None:
465
timeout = self.timeout
466
421
self.last_checked_ok = datetime.datetime.utcnow()
467
if self.disable_initiator_tag is not None:
468
gobject.source_remove(self.disable_initiator_tag)
469
if getattr(self, "enabled", False):
470
self.disable_initiator_tag = (gobject.timeout_add
471
(_timedelta_to_milliseconds
472
(timeout), self.disable))
473
self.expires = datetime.datetime.utcnow() + timeout
422
gobject.source_remove(self.disable_initiator_tag)
423
self.disable_initiator_tag = (gobject.timeout_add
424
(self.timeout_milliseconds(),
425
self.disable))
474
426
475
427
def need_approval(self):
476
428
self.last_approval_request = datetime.datetime.utcnow()
492
444
# If a checker exists, make sure it is not a zombie
493
445
try:
494
446
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
495
except (AttributeError, OSError) as error:
447
except (AttributeError, OSError), error:
496
448
if (isinstance(error, OSError)
497
449
and error.errno != errno.ECHILD):
498
450
raise error
499
451
else:
500
452
if pid:
501
logger.warning("Checker was a zombie")
453
logger.warning(u"Checker was a zombie")
502
454
gobject.source_remove(self.checker_callback_tag)
503
455
self.checker_callback(pid, status,
504
456
self.current_checker_command)
511
463
# Escape attributes for the shell
512
464
escaped_attrs = dict(
513
465
(attr,
514
re.escape(unicode(str(getattr(self, attr, "")),
466
re.escape(unicode(str(getattr(self, attr, u"")),
515
467
errors=
516
'replace')))
468
u'replace')))
517
469
for attr in
518
470
self.runtime_expansions)
519
471
520
472
try:
521
473
command = self.checker_command % escaped_attrs
522
except TypeError as error:
523
logger.error('Could not format string "%s":'
524
' %s', self.checker_command, error)
474
except TypeError, error:
475
logger.error(u'Could not format string "%s":'
476
u' %s', self.checker_command, error)
525
477
return True # Try again later
526
478
self.current_checker_command = command
527
479
try:
528
logger.info("Starting checker %r for %s",
480
logger.info(u"Starting checker %r for %s",
529
481
command, self.name)
530
482
# We don't need to redirect stdout and stderr, since
531
483
# in normal mode, that is already done by daemon(),
533
485
# always replaced by /dev/null.)
534
486
self.checker = subprocess.Popen(command,
535
487
close_fds=True,
536
shell=True, cwd="/")
488
shell=True, cwd=u"/")
537
489
self.checker_callback_tag = (gobject.child_watch_add
538
490
(self.checker.pid,
539
491
self.checker_callback,
544
496
if pid:
545
497
gobject.source_remove(self.checker_callback_tag)
546
498
self.checker_callback(pid, status, command)
547
except OSError as error:
548
logger.error("Failed to start subprocess: %s",
499
except OSError, error:
500
logger.error(u"Failed to start subprocess: %s",
549
501
error)
550
502
# Re-run this periodically if run by gobject.timeout_add
551
503
return True
555
507
if self.checker_callback_tag:
556
508
gobject.source_remove(self.checker_callback_tag)
557
509
self.checker_callback_tag = None
558
if getattr(self, "checker", None) is None:
510
if getattr(self, u"checker", None) is None:
559
511
return
560
logger.debug("Stopping checker for %(name)s", vars(self))
512
logger.debug(u"Stopping checker for %(name)s", vars(self))
561
513
try:
562
514
os.kill(self.checker.pid, signal.SIGTERM)
563
515
#time.sleep(0.5)
564
516
#if self.checker.poll() is None:
565
517
# os.kill(self.checker.pid, signal.SIGKILL)
566
except OSError as error:
518
except OSError, error:
567
519
if error.errno != errno.ESRCH: # No such process
568
520
raise
569
521
self.checker = None
570
522
571
572
def dbus_service_property(dbus_interface, signature="v",
573
access="readwrite", byte_arrays=False):
523
def dbus_service_property(dbus_interface, signature=u"v",
524
access=u"readwrite", byte_arrays=False):
574
525
"""Decorators for marking methods of a DBusObjectWithProperties to
575
526
become properties on the D-Bus.
576
527
583
534
"""
584
535
# Encoding deeply encoded byte arrays is not supported yet by the
585
536
# "Set" method, so we fail early here:
586
if byte_arrays and signature != "ay":
587
raise ValueError("Byte arrays not supported for non-'ay'"
588
" signature %r" % signature)
537
if byte_arrays and signature != u"ay":
538
raise ValueError(u"Byte arrays not supported for non-'ay'"
539
u" signature %r" % signature)
589
540
def decorator(func):
590
541
func._dbus_is_property = True
591
542
func._dbus_interface = dbus_interface
592
543
func._dbus_signature = signature
593
544
func._dbus_access = access
594
545
func._dbus_name = func.__name__
595
if func._dbus_name.endswith("_dbus_property"):
546
if func._dbus_name.endswith(u"_dbus_property"):
596
547
func._dbus_name = func._dbus_name[:-14]
597
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
548
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
598
549
return func
599
550
return decorator
600
551
620
571
621
572
class DBusObjectWithProperties(dbus.service.Object):
622
573
"""A D-Bus object with properties.
623
574
624
575
Classes inheriting from this can use the dbus_service_property
625
576
decorator to expose methods as D-Bus properties. It exposes the
626
577
standard Get(), Set(), and GetAll() methods on the D-Bus.
628
579
629
580
@staticmethod
630
581
def _is_dbus_property(obj):
631
return getattr(obj, "_dbus_is_property", False)
582
return getattr(obj, u"_dbus_is_property", False)
632
583
633
584
def _get_all_dbus_properties(self):
634
585
"""Returns a generator of (name, attribute) pairs
635
586
"""
636
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
637
for cls in self.__class__.__mro__
587
return ((prop._dbus_name, prop)
638
588
for name, prop in
639
inspect.getmembers(cls, self._is_dbus_property))
589
inspect.getmembers(self, self._is_dbus_property))
640
590
641
591
def _get_dbus_property(self, interface_name, property_name):
642
592
"""Returns a bound method if one exists which is a D-Bus
643
593
property with the specified name and interface.
644
594
"""
645
for cls in self.__class__.__mro__:
646
for name, value in (inspect.getmembers
647
(cls, self._is_dbus_property)):
648
if (value._dbus_name == property_name
649
and value._dbus_interface == interface_name):
650
return value.__get__(self)
651
595
for name in (property_name,
596
property_name + u"_dbus_property"):
597
prop = getattr(self, name, None)
598
if (prop is None
599
or not self._is_dbus_property(prop)
600
or prop._dbus_name != property_name
601
or (interface_name and prop._dbus_interface
602
and interface_name != prop._dbus_interface)):
603
continue
604
return prop
652
605
# No such property
653
raise DBusPropertyNotFound(self.dbus_object_path + ":"
654
+ interface_name + "."
606
raise DBusPropertyNotFound(self.dbus_object_path + u":"
607
+ interface_name + u"."
655
608
+ property_name)
656
609
657
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
658
out_signature="v")
610
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
611
out_signature=u"v")
659
612
def Get(self, interface_name, property_name):
660
613
"""Standard D-Bus property Get() method, see D-Bus standard.
661
614
"""
662
615
prop = self._get_dbus_property(interface_name, property_name)
663
if prop._dbus_access == "write":
616
if prop._dbus_access == u"write":
664
617
raise DBusPropertyAccessException(property_name)
665
618
value = prop()
666
if not hasattr(value, "variant_level"):
619
if not hasattr(value, u"variant_level"):
667
620
return value
668
621
return type(value)(value, variant_level=value.variant_level+1)
669
622
670
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
623
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
671
624
def Set(self, interface_name, property_name, value):
672
625
"""Standard D-Bus property Set() method, see D-Bus standard.
673
626
"""
674
627
prop = self._get_dbus_property(interface_name, property_name)
675
if prop._dbus_access == "read":
628
if prop._dbus_access == u"read":
676
629
raise DBusPropertyAccessException(property_name)
677
if prop._dbus_get_args_options["byte_arrays"]:
630
if prop._dbus_get_args_options[u"byte_arrays"]:
678
631
# The byte_arrays option is not supported yet on
679
632
# signatures other than "ay".
680
if prop._dbus_signature != "ay":
633
if prop._dbus_signature != u"ay":
681
634
raise ValueError
682
635
value = dbus.ByteArray(''.join(unichr(byte)
683
636
for byte in value))
684
637
prop(value)
685
638
686
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
687
out_signature="a{sv}")
639
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
640
out_signature=u"a{sv}")
688
641
def GetAll(self, interface_name):
689
642
"""Standard D-Bus property GetAll() method, see D-Bus
690
643
standard.
691
644
692
645
Note: Will not include properties with access="write".
693
646
"""
694
647
all = {}
698
651
# Interface non-empty but did not match
699
652
continue
700
653
# Ignore write-only properties
701
if prop._dbus_access == "write":
654
if prop._dbus_access == u"write":
702
655
continue
703
656
value = prop()
704
if not hasattr(value, "variant_level"):
657
if not hasattr(value, u"variant_level"):
705
658
all[name] = value
706
659
continue
707
660
all[name] = type(value)(value, variant_level=
708
661
value.variant_level+1)
709
return dbus.Dictionary(all, signature="sv")
662
return dbus.Dictionary(all, signature=u"sv")
710
663
711
664
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
712
out_signature="s",
665
out_signature=u"s",
713
666
path_keyword='object_path',
714
667
connection_keyword='connection')
715
668
def Introspect(self, object_path, connection):
720
673
try:
721
674
document = xml.dom.minidom.parseString(xmlstring)
722
675
def make_tag(document, name, prop):
723
e = document.createElement("property")
724
e.setAttribute("name", name)
725
e.setAttribute("type", prop._dbus_signature)
726
e.setAttribute("access", prop._dbus_access)
676
e = document.createElement(u"property")
677
e.setAttribute(u"name", name)
678
e.setAttribute(u"type", prop._dbus_signature)
679
e.setAttribute(u"access", prop._dbus_access)
727
680
return e
728
for if_tag in document.getElementsByTagName("interface"):
681
for if_tag in document.getElementsByTagName(u"interface"):
729
682
for tag in (make_tag(document, name, prop)
730
683
for name, prop
731
684
in self._get_all_dbus_properties()
732
685
if prop._dbus_interface
733
== if_tag.getAttribute("name")):
686
== if_tag.getAttribute(u"name")):
734
687
if_tag.appendChild(tag)
735
688
# Add the names to the return values for the
736
689
# "org.freedesktop.DBus.Properties" methods
737
if (if_tag.getAttribute("name")
738
== "org.freedesktop.DBus.Properties"):
739
for cn in if_tag.getElementsByTagName("method"):
740
if cn.getAttribute("name") == "Get":
741
for arg in cn.getElementsByTagName("arg"):
742
if (arg.getAttribute("direction")
743
== "out"):
744
arg.setAttribute("name", "value")
745
elif cn.getAttribute("name") == "GetAll":
746
for arg in cn.getElementsByTagName("arg"):
747
if (arg.getAttribute("direction")
748
== "out"):
749
arg.setAttribute("name", "props")
750
xmlstring = document.toxml("utf-8")
690
if (if_tag.getAttribute(u"name")
691
== u"org.freedesktop.DBus.Properties"):
692
for cn in if_tag.getElementsByTagName(u"method"):
693
if cn.getAttribute(u"name") == u"Get":
694
for arg in cn.getElementsByTagName(u"arg"):
695
if (arg.getAttribute(u"direction")
696
== u"out"):
697
arg.setAttribute(u"name", u"value")
698
elif cn.getAttribute(u"name") == u"GetAll":
699
for arg in cn.getElementsByTagName(u"arg"):
700
if (arg.getAttribute(u"direction")
701
== u"out"):
702
arg.setAttribute(u"name", u"props")
703
xmlstring = document.toxml(u"utf-8")
751
704
document.unlink()
752
705
except (AttributeError, xml.dom.DOMException,
753
xml.parsers.expat.ExpatError) as error:
754
logger.error("Failed to override Introspection method",
706
xml.parsers.expat.ExpatError), error:
707
logger.error(u"Failed to override Introspection method",
755
708
error)
756
709
return xmlstring
757
710
758
711
759
def datetime_to_dbus (dt, variant_level=0):
760
"""Convert a UTC datetime.datetime() to a D-Bus type."""
761
if dt is None:
762
return dbus.String("", variant_level = variant_level)
763
return dbus.String(dt.isoformat(),
764
variant_level=variant_level)
765
766
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
767
.__metaclass__):
768
"""Applied to an empty subclass of a D-Bus object, this metaclass
769
will add additional D-Bus attributes matching a certain pattern.
770
"""
771
def __new__(mcs, name, bases, attr):
772
# Go through all the base classes which could have D-Bus
773
# methods, signals, or properties in them
774
for base in (b for b in bases
775
if issubclass(b, dbus.service.Object)):
776
# Go though all attributes of the base class
777
for attrname, attribute in inspect.getmembers(base):
778
# Ignore non-D-Bus attributes, and D-Bus attributes
779
# with the wrong interface name
780
if (not hasattr(attribute, "_dbus_interface")
781
or not attribute._dbus_interface
782
.startswith("se.recompile.Mandos")):
783
continue
784
# Create an alternate D-Bus interface name based on
785
# the current name
786
alt_interface = (attribute._dbus_interface
787
.replace("se.recompile.Mandos",
788
"se.bsnet.fukt.Mandos"))
789
# Is this a D-Bus signal?
790
if getattr(attribute, "_dbus_is_signal", False):
791
# Extract the original non-method function by
792
# black magic
793
nonmethod_func = (dict(
794
zip(attribute.func_code.co_freevars,
795
attribute.__closure__))["func"]
796
.cell_contents)
797
# Create a new, but exactly alike, function
798
# object, and decorate it to be a new D-Bus signal
799
# with the alternate D-Bus interface name
800
new_function = (dbus.service.signal
801
(alt_interface,
802
attribute._dbus_signature)
803
(types.FunctionType(
804
nonmethod_func.func_code,
805
nonmethod_func.func_globals,
806
nonmethod_func.func_name,
807
nonmethod_func.func_defaults,
808
nonmethod_func.func_closure)))
809
# Define a creator of a function to call both the
810
# old and new functions, so both the old and new
811
# signals gets sent when the function is called
812
def fixscope(func1, func2):
813
"""This function is a scope container to pass
814
func1 and func2 to the "call_both" function
815
outside of its arguments"""
816
def call_both(*args, **kwargs):
817
"""This function will emit two D-Bus
818
signals by calling func1 and func2"""
819
func1(*args, **kwargs)
820
func2(*args, **kwargs)
821
return call_both
822
# Create the "call_both" function and add it to
823
# the class
824
attr[attrname] = fixscope(attribute,
825
new_function)
826
# Is this a D-Bus method?
827
elif getattr(attribute, "_dbus_is_method", False):
828
# Create a new, but exactly alike, function
829
# object. Decorate it to be a new D-Bus method
830
# with the alternate D-Bus interface name. Add it
831
# to the class.
832
attr[attrname] = (dbus.service.method
833
(alt_interface,
834
attribute._dbus_in_signature,
835
attribute._dbus_out_signature)
836
(types.FunctionType
837
(attribute.func_code,
838
attribute.func_globals,
839
attribute.func_name,
840
attribute.func_defaults,
841
attribute.func_closure)))
842
# Is this a D-Bus property?
843
elif getattr(attribute, "_dbus_is_property", False):
844
# Create a new, but exactly alike, function
845
# object, and decorate it to be a new D-Bus
846
# property with the alternate D-Bus interface
847
# name. Add it to the class.
848
attr[attrname] = (dbus_service_property
849
(alt_interface,
850
attribute._dbus_signature,
851
attribute._dbus_access,
852
attribute
853
._dbus_get_args_options
854
["byte_arrays"])
855
(types.FunctionType
856
(attribute.func_code,
857
attribute.func_globals,
858
attribute.func_name,
859
attribute.func_defaults,
860
attribute.func_closure)))
861
return type.__new__(mcs, name, bases, attr)
862
863
712
class ClientDBus(Client, DBusObjectWithProperties):
864
713
"""A Client class using D-Bus
865
714
869
718
"""
870
719
871
720
runtime_expansions = (Client.runtime_expansions
872
+ ("dbus_object_path",))
721
+ (u"dbus_object_path",))
873
722
874
723
# dbus.service.Object doesn't use super(), so we can't either.
875
724
880
729
# Only now, when this client is initialized, can it show up on
881
730
# the D-Bus
882
731
client_object_name = unicode(self.name).translate(
883
{ord("."): ord("_"),
884
ord("-"): ord("_")})
732
{ord(u"."): ord(u"_"),
733
ord(u"-"): ord(u"_")})
885
734
self.dbus_object_path = (dbus.ObjectPath
886
("/clients/" + client_object_name))
735
(u"/clients/" + client_object_name))
887
736
DBusObjectWithProperties.__init__(self, self.bus,
888
737
self.dbus_object_path)
889
738
890
def notifychangeproperty(transform_func,
891
dbus_name, type_func=lambda x: x,
892
variant_level=1):
893
""" Modify a variable so that it's a property which announces
894
its changes to DBus.
739
def _get_approvals_pending(self):
740
return self._approvals_pending
741
def _set_approvals_pending(self, value):
742
old_value = self._approvals_pending
743
self._approvals_pending = value
744
bval = bool(value)
745
if (hasattr(self, "dbus_object_path")
746
and bval is not bool(old_value)):
747
dbus_bool = dbus.Boolean(bval, variant_level=1)
748
self.PropertyChanged(dbus.String(u"ApprovalPending"),
749
dbus_bool)
895
750
896
transform_fun: Function that takes a value and a variant_level
897
and transforms it to a D-Bus type.
898
dbus_name: D-Bus name of the variable
899
type_func: Function that transform the value before sending it
900
to the D-Bus. Default: no transform
901
variant_level: D-Bus variant level. Default: 1
902
"""
903
attrname = "_{0}".format(dbus_name)
904
def setter(self, value):
905
if hasattr(self, "dbus_object_path"):
906
if (not hasattr(self, attrname) or
907
type_func(getattr(self, attrname, None))
908
!= type_func(value)):
909
dbus_value = transform_func(type_func(value),
910
variant_level
911
=variant_level)
912
self.PropertyChanged(dbus.String(dbus_name),
913
dbus_value)
914
setattr(self, attrname, value)
915
916
return property(lambda self: getattr(self, attrname), setter)
917
918
919
expires = notifychangeproperty(datetime_to_dbus, "Expires")
920
approvals_pending = notifychangeproperty(dbus.Boolean,
921
"ApprovalPending",
922
type_func = bool)
923
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
924
last_enabled = notifychangeproperty(datetime_to_dbus,
925
"LastEnabled")
926
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
927
type_func = lambda checker:
928
checker is not None)
929
last_checked_ok = notifychangeproperty(datetime_to_dbus,
930
"LastCheckedOK")
931
last_approval_request = notifychangeproperty(
932
datetime_to_dbus, "LastApprovalRequest")
933
approved_by_default = notifychangeproperty(dbus.Boolean,
934
"ApprovedByDefault")
935
approval_delay = notifychangeproperty(dbus.UInt16,
936
"ApprovalDelay",
937
type_func =
938
_timedelta_to_milliseconds)
939
approval_duration = notifychangeproperty(
940
dbus.UInt16, "ApprovalDuration",
941
type_func = _timedelta_to_milliseconds)
942
host = notifychangeproperty(dbus.String, "Host")
943
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
944
type_func =
945
_timedelta_to_milliseconds)
946
extended_timeout = notifychangeproperty(
947
dbus.UInt16, "ExtendedTimeout",
948
type_func = _timedelta_to_milliseconds)
949
interval = notifychangeproperty(dbus.UInt16,
950
"Interval",
951
type_func =
952
_timedelta_to_milliseconds)
953
checker_command = notifychangeproperty(dbus.String, "Checker")
954
955
del notifychangeproperty
751
approvals_pending = property(_get_approvals_pending,
752
_set_approvals_pending)
753
del _get_approvals_pending, _set_approvals_pending
754
755
@staticmethod
756
def _datetime_to_dbus(dt, variant_level=0):
757
"""Convert a UTC datetime.datetime() to a D-Bus type."""
758
return dbus.String(dt.isoformat(),
759
variant_level=variant_level)
760
761
def enable(self):
762
oldstate = getattr(self, u"enabled", False)
763
r = Client.enable(self)
764
if oldstate != self.enabled:
765
# Emit D-Bus signals
766
self.PropertyChanged(dbus.String(u"Enabled"),
767
dbus.Boolean(True, variant_level=1))
768
self.PropertyChanged(
769
dbus.String(u"LastEnabled"),
770
self._datetime_to_dbus(self.last_enabled,
771
variant_level=1))
772
return r
773
774
def disable(self, quiet = False):
775
oldstate = getattr(self, u"enabled", False)
776
r = Client.disable(self, quiet=quiet)
777
if not quiet and oldstate != self.enabled:
778
# Emit D-Bus signal
779
self.PropertyChanged(dbus.String(u"Enabled"),
780
dbus.Boolean(False, variant_level=1))
781
return r
956
782
957
783
def __del__(self, *args, **kwargs):
958
784
try:
959
785
self.remove_from_connection()
960
786
except LookupError:
961
787
pass
962
if hasattr(DBusObjectWithProperties, "__del__"):
788
if hasattr(DBusObjectWithProperties, u"__del__"):
963
789
DBusObjectWithProperties.__del__(self, *args, **kwargs)
964
790
Client.__del__(self, *args, **kwargs)
965
791
967
793
*args, **kwargs):
968
794
self.checker_callback_tag = None
969
795
self.checker = None
796
# Emit D-Bus signal
797
self.PropertyChanged(dbus.String(u"CheckerRunning"),
798
dbus.Boolean(False, variant_level=1))
970
799
if os.WIFEXITED(condition):
971
800
exitstatus = os.WEXITSTATUS(condition)
972
801
# Emit D-Bus signal
982
811
return Client.checker_callback(self, pid, condition, command,
983
812
*args, **kwargs)
984
813
814
def checked_ok(self, *args, **kwargs):
815
r = Client.checked_ok(self, *args, **kwargs)
816
# Emit D-Bus signal
817
self.PropertyChanged(
818
dbus.String(u"LastCheckedOK"),
819
(self._datetime_to_dbus(self.last_checked_ok,
820
variant_level=1)))
821
return r
822
823
def need_approval(self, *args, **kwargs):
824
r = Client.need_approval(self, *args, **kwargs)
825
# Emit D-Bus signal
826
self.PropertyChanged(
827
dbus.String(u"LastApprovalRequest"),
828
(self._datetime_to_dbus(self.last_approval_request,
829
variant_level=1)))
830
return r
831
985
832
def start_checker(self, *args, **kwargs):
986
833
old_checker = self.checker
987
834
if self.checker is not None:
994
841
and old_checker_pid != self.checker.pid):
995
842
# Emit D-Bus signal
996
843
self.CheckerStarted(self.current_checker_command)
844
self.PropertyChanged(
845
dbus.String(u"CheckerRunning"),
846
dbus.Boolean(True, variant_level=1))
997
847
return r
998
848
849
def stop_checker(self, *args, **kwargs):
850
old_checker = getattr(self, u"checker", None)
851
r = Client.stop_checker(self, *args, **kwargs)
852
if (old_checker is not None
853
and getattr(self, u"checker", None) is None):
854
self.PropertyChanged(dbus.String(u"CheckerRunning"),
855
dbus.Boolean(False, variant_level=1))
856
return r
857
999
858
def _reset_approved(self):
1000
859
self._approved = None
1001
860
return False
1003
862
def approve(self, value=True):
1004
863
self.send_changedstate()
1005
864
self._approved = value
1006
gobject.timeout_add(_timedelta_to_milliseconds
865
gobject.timeout_add(self._timedelta_to_milliseconds
1007
866
(self.approval_duration),
1008
867
self._reset_approved)
1009
868
1010
869
1011
870
## D-Bus methods, signals & properties
1012
_interface = "se.recompile.Mandos.Client"
871
_interface = u"se.bsnet.fukt.Mandos.Client"
1013
872
1014
873
## Signals
1015
874
1016
875
# CheckerCompleted - signal
1017
@dbus.service.signal(_interface, signature="nxs")
876
@dbus.service.signal(_interface, signature=u"nxs")
1018
877
def CheckerCompleted(self, exitcode, waitstatus, command):
1019
878
"D-Bus signal"
1020
879
pass
1021
880
1022
881
# CheckerStarted - signal
1023
@dbus.service.signal(_interface, signature="s")
882
@dbus.service.signal(_interface, signature=u"s")
1024
883
def CheckerStarted(self, command):
1025
884
"D-Bus signal"
1026
885
pass
1027
886
1028
887
# PropertyChanged - signal
1029
@dbus.service.signal(_interface, signature="sv")
888
@dbus.service.signal(_interface, signature=u"sv")
1030
889
def PropertyChanged(self, property, value):
1031
890
"D-Bus signal"
1032
891
pass
1041
900
pass
1042
901
1043
902
# Rejected - signal
1044
@dbus.service.signal(_interface, signature="s")
903
@dbus.service.signal(_interface, signature=u"s")
1045
904
def Rejected(self, reason):
1046
905
"D-Bus signal"
1047
906
pass
1048
907
1049
908
# NeedApproval - signal
1050
@dbus.service.signal(_interface, signature="tb")
909
@dbus.service.signal(_interface, signature=u"tb")
1051
910
def NeedApproval(self, timeout, default):
1052
911
"D-Bus signal"
1053
912
return self.need_approval()
1055
914
## Methods
1056
915
1057
916
# Approve - method
1058
@dbus.service.method(_interface, in_signature="b")
917
@dbus.service.method(_interface, in_signature=u"b")
1059
918
def Approve(self, value):
1060
919
self.approve(value)
1061
920
1062
921
# CheckedOK - method
1063
922
@dbus.service.method(_interface)
1064
923
def CheckedOK(self):
1065
self.checked_ok()
924
return self.checked_ok()
1066
925
1067
926
# Enable - method
1068
927
@dbus.service.method(_interface)
1090
949
## Properties
1091
950
1092
951
# ApprovalPending - property
1093
@dbus_service_property(_interface, signature="b", access="read")
952
@dbus_service_property(_interface, signature=u"b", access=u"read")
1094
953
def ApprovalPending_dbus_property(self):
1095
954
return dbus.Boolean(bool(self.approvals_pending))
1096
955
1097
956
# ApprovedByDefault - property
1098
@dbus_service_property(_interface, signature="b",
1099
access="readwrite")
957
@dbus_service_property(_interface, signature=u"b",
958
access=u"readwrite")
1100
959
def ApprovedByDefault_dbus_property(self, value=None):
1101
960
if value is None: # get
1102
961
return dbus.Boolean(self.approved_by_default)
1103
962
self.approved_by_default = bool(value)
963
# Emit D-Bus signal
964
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
965
dbus.Boolean(value, variant_level=1))
1104
966
1105
967
# ApprovalDelay - property
1106
@dbus_service_property(_interface, signature="t",
1107
access="readwrite")
968
@dbus_service_property(_interface, signature=u"t",
969
access=u"readwrite")
1108
970
def ApprovalDelay_dbus_property(self, value=None):
1109
971
if value is None: # get
1110
972
return dbus.UInt64(self.approval_delay_milliseconds())
1111
973
self.approval_delay = datetime.timedelta(0, 0, 0, value)
974
# Emit D-Bus signal
975
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
976
dbus.UInt64(value, variant_level=1))
1112
977
1113
978
# ApprovalDuration - property
1114
@dbus_service_property(_interface, signature="t",
1115
access="readwrite")
979
@dbus_service_property(_interface, signature=u"t",
980
access=u"readwrite")
1116
981
def ApprovalDuration_dbus_property(self, value=None):
1117
982
if value is None: # get
1118
return dbus.UInt64(_timedelta_to_milliseconds(
983
return dbus.UInt64(self._timedelta_to_milliseconds(
1119
984
self.approval_duration))
1120
985
self.approval_duration = datetime.timedelta(0, 0, 0, value)
986
# Emit D-Bus signal
987
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
988
dbus.UInt64(value, variant_level=1))
1121
989
1122
990
# Name - property
1123
@dbus_service_property(_interface, signature="s", access="read")
991
@dbus_service_property(_interface, signature=u"s", access=u"read")
1124
992
def Name_dbus_property(self):
1125
993
return dbus.String(self.name)
1126
994
1127
995
# Fingerprint - property
1128
@dbus_service_property(_interface, signature="s", access="read")
996
@dbus_service_property(_interface, signature=u"s", access=u"read")
1129
997
def Fingerprint_dbus_property(self):
1130
998
return dbus.String(self.fingerprint)
1131
999
1132
1000
# Host - property
1133
@dbus_service_property(_interface, signature="s",
1134
access="readwrite")
1001
@dbus_service_property(_interface, signature=u"s",
1002
access=u"readwrite")
1135
1003
def Host_dbus_property(self, value=None):
1136
1004
if value is None: # get
1137
1005
return dbus.String(self.host)
1138
1006
self.host = value
1007
# Emit D-Bus signal
1008
self.PropertyChanged(dbus.String(u"Host"),
1009
dbus.String(value, variant_level=1))
1139
1010
1140
1011
# Created - property
1141
@dbus_service_property(_interface, signature="s", access="read")
1012
@dbus_service_property(_interface, signature=u"s", access=u"read")
1142
1013
def Created_dbus_property(self):
1143
return dbus.String(datetime_to_dbus(self.created))
1014
return dbus.String(self._datetime_to_dbus(self.created))
1144
1015
1145
1016
# LastEnabled - property
1146
@dbus_service_property(_interface, signature="s", access="read")
1017
@dbus_service_property(_interface, signature=u"s", access=u"read")
1147
1018
def LastEnabled_dbus_property(self):
1148
return datetime_to_dbus(self.last_enabled)
1019
if self.last_enabled is None:
1020
return dbus.String(u"")
1021
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1149
1022
1150
1023
# Enabled - property
1151
@dbus_service_property(_interface, signature="b",
1152
access="readwrite")
1024
@dbus_service_property(_interface, signature=u"b",
1025
access=u"readwrite")
1153
1026
def Enabled_dbus_property(self, value=None):
1154
1027
if value is None: # get
1155
1028
return dbus.Boolean(self.enabled)
1159
1032
self.disable()
1160
1033
1161
1034
# LastCheckedOK - property
1162
@dbus_service_property(_interface, signature="s",
1163
access="readwrite")
1035
@dbus_service_property(_interface, signature=u"s",
1036
access=u"readwrite")
1164
1037
def LastCheckedOK_dbus_property(self, value=None):
1165
1038
if value is not None:
1166
1039
self.checked_ok()
1167
1040
return
1168
return datetime_to_dbus(self.last_checked_ok)
1169
1170
# Expires - property
1171
@dbus_service_property(_interface, signature="s", access="read")
1172
def Expires_dbus_property(self):
1173
return datetime_to_dbus(self.expires)
1041
if self.last_checked_ok is None:
1042
return dbus.String(u"")
1043
return dbus.String(self._datetime_to_dbus(self
1044
.last_checked_ok))
1174
1045
1175
1046
# LastApprovalRequest - property
1176
@dbus_service_property(_interface, signature="s", access="read")
1047
@dbus_service_property(_interface, signature=u"s", access=u"read")
1177
1048
def LastApprovalRequest_dbus_property(self):
1178
return datetime_to_dbus(self.last_approval_request)
1049
if self.last_approval_request is None:
1050
return dbus.String(u"")
1051
return dbus.String(self.
1052
_datetime_to_dbus(self
1053
.last_approval_request))
1179
1054
1180
1055
# Timeout - property
1181
@dbus_service_property(_interface, signature="t",
1182
access="readwrite")
1056
@dbus_service_property(_interface, signature=u"t",
1057
access=u"readwrite")
1183
1058
def Timeout_dbus_property(self, value=None):
1184
1059
if value is None: # get
1185
1060
return dbus.UInt64(self.timeout_milliseconds())
1186
1061
self.timeout = datetime.timedelta(0, 0, 0, value)
1187
if getattr(self, "disable_initiator_tag", None) is None:
1062
# Emit D-Bus signal
1063
self.PropertyChanged(dbus.String(u"Timeout"),
1064
dbus.UInt64(value, variant_level=1))
1065
if getattr(self, u"disable_initiator_tag", None) is None:
1188
1066
return
1189
1067
# Reschedule timeout
1190
1068
gobject.source_remove(self.disable_initiator_tag)
1191
1069
self.disable_initiator_tag = None
1192
self.expires = None
1193
time_to_die = _timedelta_to_milliseconds((self
1194
.last_checked_ok
1195
+ self.timeout)
1196
- datetime.datetime
1197
.utcnow())
1070
time_to_die = (self.
1071
_timedelta_to_milliseconds((self
1072
.last_checked_ok
1073
+ self.timeout)
1074
- datetime.datetime
1075
.utcnow()))
1198
1076
if time_to_die <= 0:
1199
1077
# The timeout has passed
1200
1078
self.disable()
1201
1079
else:
1202
self.expires = (datetime.datetime.utcnow()
1203
+ datetime.timedelta(milliseconds =
1204
time_to_die))
1205
1080
self.disable_initiator_tag = (gobject.timeout_add
1206
1081
(time_to_die, self.disable))
1207
1082
1208
# ExtendedTimeout - property
1209
@dbus_service_property(_interface, signature="t",
1210
access="readwrite")
1211
def ExtendedTimeout_dbus_property(self, value=None):
1212
if value is None: # get
1213
return dbus.UInt64(self.extended_timeout_milliseconds())
1214
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1215
1216
1083
# Interval - property
1217
@dbus_service_property(_interface, signature="t",
1218
access="readwrite")
1084
@dbus_service_property(_interface, signature=u"t",
1085
access=u"readwrite")
1219
1086
def Interval_dbus_property(self, value=None):
1220
1087
if value is None: # get
1221
1088
return dbus.UInt64(self.interval_milliseconds())
1222
1089
self.interval = datetime.timedelta(0, 0, 0, value)
1223
if getattr(self, "checker_initiator_tag", None) is None:
1090
# Emit D-Bus signal
1091
self.PropertyChanged(dbus.String(u"Interval"),
1092
dbus.UInt64(value, variant_level=1))
1093
if getattr(self, u"checker_initiator_tag", None) is None:
1224
1094
return
1225
1095
# Reschedule checker run
1226
1096
gobject.source_remove(self.checker_initiator_tag)
1227
1097
self.checker_initiator_tag = (gobject.timeout_add
1228
1098
(value, self.start_checker))
1229
1099
self.start_checker() # Start one now, too
1230
1100
1231
1101
# Checker - property
1232
@dbus_service_property(_interface, signature="s",
1233
access="readwrite")
1102
@dbus_service_property(_interface, signature=u"s",
1103
access=u"readwrite")
1234
1104
def Checker_dbus_property(self, value=None):
1235
1105
if value is None: # get
1236
1106
return dbus.String(self.checker_command)
1237
1107
self.checker_command = value
1108
# Emit D-Bus signal
1109
self.PropertyChanged(dbus.String(u"Checker"),
1110
dbus.String(self.checker_command,
1111
variant_level=1))
1238
1112
1239
1113
# CheckerRunning - property
1240
@dbus_service_property(_interface, signature="b",
1241
access="readwrite")
1114
@dbus_service_property(_interface, signature=u"b",
1115
access=u"readwrite")
1242
1116
def CheckerRunning_dbus_property(self, value=None):
1243
1117
if value is None: # get
1244
1118
return dbus.Boolean(self.checker is not None)
1248
1122
self.stop_checker()
1249
1123
1250
1124
# ObjectPath - property
1251
@dbus_service_property(_interface, signature="o", access="read")
1125
@dbus_service_property(_interface, signature=u"o", access=u"read")
1252
1126
def ObjectPath_dbus_property(self):
1253
1127
return self.dbus_object_path # is already a dbus.ObjectPath
1254
1128
1255
1129
# Secret = property
1256
@dbus_service_property(_interface, signature="ay",
1257
access="write", byte_arrays=True)
1130
@dbus_service_property(_interface, signature=u"ay",
1131
access=u"write", byte_arrays=True)
1258
1132
def Secret_dbus_property(self, value):
1259
1133
self.secret = str(value)
1260
1134
1267
1141
self._pipe.send(('init', fpr, address))
1268
1142
if not self._pipe.recv():
1269
1143
raise KeyError()
1270
1144
1271
1145
def __getattribute__(self, name):
1272
1146
if(name == '_pipe'):
1273
1147
return super(ProxyClient, self).__getattribute__(name)
1280
1154
self._pipe.send(('funcall', name, args, kwargs))
1281
1155
return self._pipe.recv()[1]
1282
1156
return func
1283
1157
1284
1158
def __setattr__(self, name, value):
1285
1159
if(name == '_pipe'):
1286
1160
return super(ProxyClient, self).__setattr__(name, value)
1287
1161
self._pipe.send(('setattr', name, value))
1288
1162
1289
class ClientDBusTransitional(ClientDBus):
1290
__metaclass__ = AlternateDBusNamesMetaclass
1291
1163
1292
1164
class ClientHandler(socketserver.BaseRequestHandler, object):
1293
1165
"""A class to handle client connections.
1297
1169
1298
1170
def handle(self):
1299
1171
with contextlib.closing(self.server.child_pipe) as child_pipe:
1300
logger.info("TCP connection from: %s",
1172
logger.info(u"TCP connection from: %s",
1301
1173
unicode(self.client_address))
1302
logger.debug("Pipe FD: %d",
1174
logger.debug(u"Pipe FD: %d",
1303
1175
self.server.child_pipe.fileno())
1304
1176
1305
1177
session = (gnutls.connection
1306
1178
.ClientSession(self.request,
1307
1179
gnutls.connection
1308
1180
.X509Credentials()))
1309
1181
1310
1182
# Note: gnutls.connection.X509Credentials is really a
1311
1183
# generic GnuTLS certificate credentials object so long as
1312
1184
# no X.509 keys are added to it. Therefore, we can use it
1313
1185
# here despite using OpenPGP certificates.
1314
1315
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1316
# "+AES-256-CBC", "+SHA1",
1317
# "+COMP-NULL", "+CTYPE-OPENPGP",
1318
# "+DHE-DSS"))
1186
1187
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1188
# u"+AES-256-CBC", u"+SHA1",
1189
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1190
# u"+DHE-DSS"))
1319
1191
# Use a fallback default, since this MUST be set.
1320
1192
priority = self.server.gnutls_priority
1321
1193
if priority is None:
1322
priority = "NORMAL"
1194
priority = u"NORMAL"
1323
1195
(gnutls.library.functions
1324
1196
.gnutls_priority_set_direct(session._c_object,
1325
1197
priority, None))
1326
1198
1327
1199
# Start communication using the Mandos protocol
1328
1200
# Get protocol number
1329
1201
line = self.request.makefile().readline()
1330
logger.debug("Protocol version: %r", line)
1202
logger.debug(u"Protocol version: %r", line)
1331
1203
try:
1332
1204
if int(line.strip().split()[0]) > 1:
1333
1205
raise RuntimeError
1334
except (ValueError, IndexError, RuntimeError) as error:
1335
logger.error("Unknown protocol version: %s", error)
1206
except (ValueError, IndexError, RuntimeError), error:
1207
logger.error(u"Unknown protocol version: %s", error)
1336
1208
return
1337
1209
1338
1210
# Start GnuTLS connection
1339
1211
try:
1340
1212
session.handshake()
1341
except gnutls.errors.GNUTLSError as error:
1342
logger.warning("Handshake failed: %s", error)
1213
except gnutls.errors.GNUTLSError, error:
1214
logger.warning(u"Handshake failed: %s", error)
1343
1215
# Do not run session.bye() here: the session is not
1344
1216
# established. Just abandon the request.
1345
1217
return
1346
logger.debug("Handshake succeeded")
1347
1218
logger.debug(u"Handshake succeeded")
1219
1348
1220
approval_required = False
1349
1221
try:
1350
1222
try:
1351
1223
fpr = self.fingerprint(self.peer_certificate
1352
1224
(session))
1353
except (TypeError,
1354
gnutls.errors.GNUTLSError) as error:
1355
logger.warning("Bad certificate: %s", error)
1225
except (TypeError, gnutls.errors.GNUTLSError), error:
1226
logger.warning(u"Bad certificate: %s", error)
1356
1227
return
1357
logger.debug("Fingerprint: %s", fpr)
1358
1228
logger.debug(u"Fingerprint: %s", fpr)
1229
1359
1230
try:
1360
1231
client = ProxyClient(child_pipe, fpr,
1361
1232
self.client_address)
1369
1240
1370
1241
while True:
1371
1242
if not client.enabled:
1372
logger.info("Client %s is disabled",
1243
logger.warning(u"Client %s is disabled",
1373
1244
client.name)
1374
1245
if self.server.use_dbus:
1375
1246
# Emit D-Bus signal
1376
client.Rejected("Disabled")
1247
client.Rejected("Disabled")
1377
1248
return
1378
1249
1379
1250
if client._approved or not client.approval_delay:
1380
1251
#We are approved or approval is disabled
1381
1252
break
1382
1253
elif client._approved is None:
1383
logger.info("Client %s needs approval",
1254
logger.info(u"Client %s needs approval",
1384
1255
client.name)
1385
1256
if self.server.use_dbus:
1386
1257
# Emit D-Bus signal
1388
1259
client.approval_delay_milliseconds(),
1389
1260
client.approved_by_default)
1390
1261
else:
1391
logger.warning("Client %s was not approved",
1262
logger.warning(u"Client %s was not approved",
1392
1263
client.name)
1393
1264
if self.server.use_dbus:
1394
1265
# Emit D-Bus signal
1396
1267
return
1397
1268
1398
1269
#wait until timeout or approved
1270
#x = float(client._timedelta_to_milliseconds(delay))
1399
1271
time = datetime.datetime.now()
1400
1272
client.changedstate.acquire()
1401
(client.changedstate.wait
1402
(float(client._timedelta_to_milliseconds(delay)
1403
/ 1000)))
1273
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1404
1274
client.changedstate.release()
1405
1275
time2 = datetime.datetime.now()
1406
1276
if (time2 - time) >= delay:
1421
1291
while sent_size < len(client.secret):
1422
1292
try:
1423
1293
sent = session.send(client.secret[sent_size:])
1424
except gnutls.errors.GNUTLSError as error:
1294
except (gnutls.errors.GNUTLSError), error:
1425
1295
logger.warning("gnutls send failed")
1426
1296
return
1427
logger.debug("Sent: %d, remaining: %d",
1297
logger.debug(u"Sent: %d, remaining: %d",
1428
1298
sent, len(client.secret)
1429
1299
- (sent_size + sent))
1430
1300
sent_size += sent
1431
1432
logger.info("Sending secret to %s", client.name)
1433
# bump the timeout using extended_timeout
1434
client.checked_ok(client.extended_timeout)
1301
1302
logger.info(u"Sending secret to %s", client.name)
1303
# bump the timeout as if seen
1304
client.checked_ok()
1435
1305
if self.server.use_dbus:
1436
1306
# Emit D-Bus signal
1437
1307
client.GotSecret()
1441
1311
client.approvals_pending -= 1
1442
1312
try:
1443
1313
session.bye()
1444
except gnutls.errors.GNUTLSError as error:
1314
except (gnutls.errors.GNUTLSError), error:
1445
1315
logger.warning("GnuTLS bye failed")
1446
1316
1447
1317
@staticmethod
1458
1328
.gnutls_certificate_get_peers
1459
1329
(session._c_object, ctypes.byref(list_size)))
1460
1330
if not bool(cert_list) and list_size.value != 0:
1461
raise gnutls.errors.GNUTLSError("error getting peer"
1462
" certificate")
1331
raise gnutls.errors.GNUTLSError(u"error getting peer"
1332
u" certificate")
1463
1333
if list_size.value == 0:
1464
1334
return None
1465
1335
cert = cert_list[0]
1491
1361
if crtverify.value != 0:
1492
1362
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1493
1363
raise (gnutls.errors.CertificateSecurityError
1494
("Verify failed"))
1364
(u"Verify failed"))
1495
1365
# New buffer for the fingerprint
1496
1366
buf = ctypes.create_string_buffer(20)
1497
1367
buf_len = ctypes.c_size_t()
1504
1374
# Convert the buffer to a Python bytestring
1505
1375
fpr = ctypes.string_at(buf, buf_len.value)
1506
1376
# Convert the bytestring to hexadecimal notation
1507
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1377
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1508
1378
return hex_fpr
1509
1379
1510
1380
1516
1386
except:
1517
1387
self.handle_error(request, address)
1518
1388
self.close_request(request)
1519
1389
1520
1390
def process_request(self, request, address):
1521
1391
"""Start a new process to process the request."""
1522
proc = multiprocessing.Process(target = self.sub_process_main,
1523
args = (request,
1524
address))
1525
proc.start()
1526
return proc
1527
1392
multiprocessing.Process(target = self.sub_process_main,
1393
args = (request, address)).start()
1528
1394
1529
1395
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1530
1396
""" adds a pipe to the MixIn """
1534
1400
This function creates a new pipe in self.pipe
1535
1401
"""
1536
1402
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1537
1538
proc = MultiprocessingMixIn.process_request(self, request,
1539
client_address)
1403
1404
super(MultiprocessingMixInWithPipe,
1405
self).process_request(request, client_address)
1540
1406
self.child_pipe.close()
1541
self.add_pipe(parent_pipe, proc)
1542
1543
def add_pipe(self, parent_pipe, proc):
1407
self.add_pipe(parent_pipe)
1408
1409
def add_pipe(self, parent_pipe):
1544
1410
"""Dummy function; override as necessary"""
1545
raise NotImplementedError
1546
1411
pass
1547
1412
1548
1413
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1549
1414
socketserver.TCPServer, object):
1567
1432
bind to an address or port if they were not specified."""
1568
1433
if self.interface is not None:
1569
1434
if SO_BINDTODEVICE is None:
1570
logger.error("SO_BINDTODEVICE does not exist;"
1571
" cannot bind to interface %s",
1435
logger.error(u"SO_BINDTODEVICE does not exist;"
1436
u" cannot bind to interface %s",
1572
1437
self.interface)
1573
1438
else:
1574
1439
try:
1575
1440
self.socket.setsockopt(socket.SOL_SOCKET,
1576
1441
SO_BINDTODEVICE,
1577
1442
str(self.interface
1578
+ '\0'))
1579
except socket.error as error:
1443
+ u'\0'))
1444
except socket.error, error:
1580
1445
if error[0] == errno.EPERM:
1581
logger.error("No permission to"
1582
" bind to interface %s",
1446
logger.error(u"No permission to"
1447
u" bind to interface %s",
1583
1448
self.interface)
1584
1449
elif error[0] == errno.ENOPROTOOPT:
1585
logger.error("SO_BINDTODEVICE not available;"
1586
" cannot bind to interface %s",
1450
logger.error(u"SO_BINDTODEVICE not available;"
1451
u" cannot bind to interface %s",
1587
1452
self.interface)
1588
1453
else:
1589
1454
raise
1591
1456
if self.server_address[0] or self.server_address[1]:
1592
1457
if not self.server_address[0]:
1593
1458
if self.address_family == socket.AF_INET6:
1594
any_address = "::" # in6addr_any
1459
any_address = u"::" # in6addr_any
1595
1460
else:
1596
1461
any_address = socket.INADDR_ANY
1597
1462
self.server_address = (any_address,
1634
1499
def server_activate(self):
1635
1500
if self.enabled:
1636
1501
return socketserver.TCPServer.server_activate(self)
1637
1638
1502
def enable(self):
1639
1503
self.enabled = True
1640
1641
def add_pipe(self, parent_pipe, proc):
1504
def add_pipe(self, parent_pipe):
1642
1505
# Call "handle_ipc" for both data and EOF events
1643
1506
gobject.io_add_watch(parent_pipe.fileno(),
1644
1507
gobject.IO_IN | gobject.IO_HUP,
1645
1508
functools.partial(self.handle_ipc,
1646
parent_pipe =
1647
parent_pipe,
1648
proc = proc))
1649
1509
parent_pipe = parent_pipe))
1510
1650
1511
def handle_ipc(self, source, condition, parent_pipe=None,
1651
proc = None, client_object=None):
1512
client_object=None):
1652
1513
condition_names = {
1653
gobject.IO_IN: "IN", # There is data to read.
1654
gobject.IO_OUT: "OUT", # Data can be written (without
1514
gobject.IO_IN: u"IN", # There is data to read.
1515
gobject.IO_OUT: u"OUT", # Data can be written (without
1655
1516
# blocking).
1656
gobject.IO_PRI: "PRI", # There is urgent data to read.
1657
gobject.IO_ERR: "ERR", # Error condition.
1658
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1517
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1518
gobject.IO_ERR: u"ERR", # Error condition.
1519
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1659
1520
# broken, usually for pipes and
1660
1521
# sockets).
1661
1522
}
1663
1524
for cond, name in
1664
1525
condition_names.iteritems()
1665
1526
if cond & condition)
1666
# error, or the other end of multiprocessing.Pipe has closed
1527
# error or the other end of multiprocessing.Pipe has closed
1667
1528
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1668
# Wait for other process to exit
1669
proc.join()
1670
1529
return False
1671
1530
1672
1531
# Read a request from the child
1682
1541
client = c
1683
1542
break
1684
1543
else:
1685
logger.info("Client not found for fingerprint: %s, ad"
1686
"dress: %s", fpr, address)
1544
logger.warning(u"Client not found for fingerprint: %s, ad"
1545
u"dress: %s", fpr, address)
1687
1546
if self.use_dbus:
1688
1547
# Emit D-Bus signal
1689
mandos_dbus_service.ClientNotFound(fpr,
1690
address[0])
1548
mandos_dbus_service.ClientNotFound(fpr, address[0])
1691
1549
parent_pipe.send(False)
1692
1550
return False
1693
1551
1694
1552
gobject.io_add_watch(parent_pipe.fileno(),
1695
1553
gobject.IO_IN | gobject.IO_HUP,
1696
1554
functools.partial(self.handle_ipc,
1697
parent_pipe =
1698
parent_pipe,
1699
proc = proc,
1700
client_object =
1701
client))
1555
parent_pipe = parent_pipe,
1556
client_object = client))
1702
1557
parent_pipe.send(True)
1703
# remove the old hook in favor of the new above hook on
1704
# same fileno
1558
# remove the old hook in favor of the new above hook on same fileno
1705
1559
return False
1706
1560
if command == 'funcall':
1707
1561
funcname = request[1]
1708
1562
args = request[2]
1709
1563
kwargs = request[3]
1710
1564
1711
parent_pipe.send(('data', getattr(client_object,
1712
funcname)(*args,
1713
**kwargs)))
1714
1565
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1566
1715
1567
if command == 'getattr':
1716
1568
attrname = request[1]
1717
1569
if callable(client_object.__getattribute__(attrname)):
1718
1570
parent_pipe.send(('function',))
1719
1571
else:
1720
parent_pipe.send(('data', client_object
1721
.__getattribute__(attrname)))
1572
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1722
1573
1723
1574
if command == 'setattr':
1724
1575
attrname = request[1]
1725
1576
value = request[2]
1726
1577
setattr(client_object, attrname, value)
1727
1578
1728
1579
return True
1729
1580
1730
1581
1731
1582
def string_to_delta(interval):
1732
1583
"""Parse a string and return a datetime.timedelta
1733
1584
1734
>>> string_to_delta('7d')
1585
>>> string_to_delta(u'7d')
1735
1586
datetime.timedelta(7)
1736
>>> string_to_delta('60s')
1587
>>> string_to_delta(u'60s')
1737
1588
datetime.timedelta(0, 60)
1738
>>> string_to_delta('60m')
1589
>>> string_to_delta(u'60m')
1739
1590
datetime.timedelta(0, 3600)
1740
>>> string_to_delta('24h')
1591
>>> string_to_delta(u'24h')
1741
1592
datetime.timedelta(1)
1742
>>> string_to_delta('1w')
1593
>>> string_to_delta(u'1w')
1743
1594
datetime.timedelta(7)
1744
>>> string_to_delta('5m 30s')
1595
>>> string_to_delta(u'5m 30s')
1745
1596
datetime.timedelta(0, 330)
1746
1597
"""
1747
1598
timevalue = datetime.timedelta(0)
1749
1600
try:
1750
1601
suffix = unicode(s[-1])
1751
1602
value = int(s[:-1])
1752
if suffix == "d":
1603
if suffix == u"d":
1753
1604
delta = datetime.timedelta(value)
1754
elif suffix == "s":
1605
elif suffix == u"s":
1755
1606
delta = datetime.timedelta(0, value)
1756
elif suffix == "m":
1607
elif suffix == u"m":
1757
1608
delta = datetime.timedelta(0, 0, 0, 0, value)
1758
elif suffix == "h":
1609
elif suffix == u"h":
1759
1610
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1760
elif suffix == "w":
1611
elif suffix == u"w":
1761
1612
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1762
1613
else:
1763
raise ValueError("Unknown suffix %r" % suffix)
1764
except (ValueError, IndexError) as e:
1765
raise ValueError(*(e.args))
1614
raise ValueError(u"Unknown suffix %r" % suffix)
1615
except (ValueError, IndexError), e:
1616
raise ValueError(e.message)
1766
1617
timevalue += delta
1767
1618
return timevalue
1768
1619
1774
1625
global if_nametoindex
1775
1626
try:
1776
1627
if_nametoindex = (ctypes.cdll.LoadLibrary
1777
(ctypes.util.find_library("c"))
1628
(ctypes.util.find_library(u"c"))
1778
1629
.if_nametoindex)
1779
1630
except (OSError, AttributeError):
1780
logger.warning("Doing if_nametoindex the hard way")
1631
logger.warning(u"Doing if_nametoindex the hard way")
1781
1632
def if_nametoindex(interface):
1782
1633
"Get an interface index the hard way, i.e. using fcntl()"
1783
1634
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1784
1635
with contextlib.closing(socket.socket()) as s:
1785
1636
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1786
struct.pack(str("16s16x"),
1637
struct.pack(str(u"16s16x"),
1787
1638
interface))
1788
interface_index = struct.unpack(str("I"),
1639
interface_index = struct.unpack(str(u"I"),
1789
1640
ifreq[16:20])[0]
1790
1641
return interface_index
1791
1642
return if_nametoindex(interface)
1799
1650
sys.exit()
1800
1651
os.setsid()
1801
1652
if not nochdir:
1802
os.chdir("/")
1653
os.chdir(u"/")
1803
1654
if os.fork():
1804
1655
sys.exit()
1805
1656
if not noclose:
1807
1658
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1808
1659
if not stat.S_ISCHR(os.fstat(null).st_mode):
1809
1660
raise OSError(errno.ENODEV,
1810
"%s not a character device"
1661
u"%s not a character device"
1811
1662
% os.path.devnull)
1812
1663
os.dup2(null, sys.stdin.fileno())
1813
1664
os.dup2(null, sys.stdout.fileno())
1821
1672
##################################################################
1822
1673
# Parsing of options, both command line and config file
1823
1674
1824
parser = argparse.ArgumentParser()
1825
parser.add_argument("-v", "--version", action="version",
1826
version = "%%(prog)s %s" % version,
1827
help="show version number and exit")
1828
parser.add_argument("-i", "--interface", metavar="IF",
1829
help="Bind to interface IF")
1830
parser.add_argument("-a", "--address",
1831
help="Address to listen for requests on")
1832
parser.add_argument("-p", "--port", type=int,
1833
help="Port number to receive requests on")
1834
parser.add_argument("--check", action="store_true",
1835
help="Run self-test")
1836
parser.add_argument("--debug", action="store_true",
1837
help="Debug mode; run in foreground and log"
1838
" to terminal")
1839
parser.add_argument("--debuglevel", metavar="LEVEL",
1840
help="Debug level for stdout output")
1841
parser.add_argument("--priority", help="GnuTLS"
1842
" priority string (see GnuTLS documentation)")
1843
parser.add_argument("--servicename",
1844
metavar="NAME", help="Zeroconf service name")
1845
parser.add_argument("--configdir",
1846
default="/etc/mandos", metavar="DIR",
1847
help="Directory to search for configuration"
1848
" files")
1849
parser.add_argument("--no-dbus", action="store_false",
1850
dest="use_dbus", help="Do not provide D-Bus"
1851
" system bus interface")
1852
parser.add_argument("--no-ipv6", action="store_false",
1853
dest="use_ipv6", help="Do not use IPv6")
1854
options = parser.parse_args()
1675
parser = optparse.OptionParser(version = "%%prog %s" % version)
1676
parser.add_option("-i", u"--interface", type=u"string",
1677
metavar="IF", help=u"Bind to interface IF")
1678
parser.add_option("-a", u"--address", type=u"string",
1679
help=u"Address to listen for requests on")
1680
parser.add_option("-p", u"--port", type=u"int",
1681
help=u"Port number to receive requests on")
1682
parser.add_option("--check", action=u"store_true",
1683
help=u"Run self-test")
1684
parser.add_option("--debug", action=u"store_true",
1685
help=u"Debug mode; run in foreground and log to"
1686
u" terminal")
1687
parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",
1688
help=u"Debug level for stdout output")
1689
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1690
u" priority string (see GnuTLS documentation)")
1691
parser.add_option("--servicename", type=u"string",
1692
metavar=u"NAME", help=u"Zeroconf service name")
1693
parser.add_option("--configdir", type=u"string",
1694
default=u"/etc/mandos", metavar=u"DIR",
1695
help=u"Directory to search for configuration"
1696
u" files")
1697
parser.add_option("--no-dbus", action=u"store_false",
1698
dest=u"use_dbus", help=u"Do not provide D-Bus"
1699
u" system bus interface")
1700
parser.add_option("--no-ipv6", action=u"store_false",
1701
dest=u"use_ipv6", help=u"Do not use IPv6")
1702
options = parser.parse_args()[0]
1855
1703
1856
1704
if options.check:
1857
1705
import doctest
1859
1707
sys.exit()
1860
1708
1861
1709
# Default values for config file for server-global settings
1862
server_defaults = { "interface": "",
1863
"address": "",
1864
"port": "",
1865
"debug": "False",
1866
"priority":
1867
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1868
"servicename": "Mandos",
1869
"use_dbus": "True",
1870
"use_ipv6": "True",
1871
"debuglevel": "",
1710
server_defaults = { u"interface": u"",
1711
u"address": u"",
1712
u"port": u"",
1713
u"debug": u"False",
1714
u"priority":
1715
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1716
u"servicename": u"Mandos",
1717
u"use_dbus": u"True",
1718
u"use_ipv6": u"True",
1719
u"debuglevel": u"",
1872
1720
}
1873
1721
1874
1722
# Parse config file for server-global settings
1875
1723
server_config = configparser.SafeConfigParser(server_defaults)
1876
1724
del server_defaults
1877
1725
server_config.read(os.path.join(options.configdir,
1878
"mandos.conf"))
1726
u"mandos.conf"))
1879
1727
# Convert the SafeConfigParser object to a dict
1880
1728
server_settings = server_config.defaults()
1881
1729
# Use the appropriate methods on the non-string config options
1882
for option in ("debug", "use_dbus", "use_ipv6"):
1883
server_settings[option] = server_config.getboolean("DEFAULT",
1730
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1731
server_settings[option] = server_config.getboolean(u"DEFAULT",
1884
1732
option)
1885
1733
if server_settings["port"]:
1886
server_settings["port"] = server_config.getint("DEFAULT",
1887
"port")
1734
server_settings["port"] = server_config.getint(u"DEFAULT",
1735
u"port")
1888
1736
del server_config
1889
1737
1890
1738
# Override the settings from the config file with command line
1891
1739
# options, if set.
1892
for option in ("interface", "address", "port", "debug",
1893
"priority", "servicename", "configdir",
1894
"use_dbus", "use_ipv6", "debuglevel"):
1740
for option in (u"interface", u"address", u"port", u"debug",
1741
u"priority", u"servicename", u"configdir",
1742
u"use_dbus", u"use_ipv6", u"debuglevel"):
1895
1743
value = getattr(options, option)
1896
1744
if value is not None:
1897
1745
server_settings[option] = value
1905
1753
##################################################################
1906
1754
1907
1755
# For convenience
1908
debug = server_settings["debug"]
1909
debuglevel = server_settings["debuglevel"]
1910
use_dbus = server_settings["use_dbus"]
1911
use_ipv6 = server_settings["use_ipv6"]
1912
1913
if server_settings["servicename"] != "Mandos":
1756
debug = server_settings[u"debug"]
1757
debuglevel = server_settings[u"debuglevel"]
1758
use_dbus = server_settings[u"use_dbus"]
1759
use_ipv6 = server_settings[u"use_ipv6"]
1760
1761
if server_settings[u"servicename"] != u"Mandos":
1914
1762
syslogger.setFormatter(logging.Formatter
1915
('Mandos (%s) [%%(process)d]:'
1916
' %%(levelname)s: %%(message)s'
1917
% server_settings["servicename"]))
1763
(u'Mandos (%s) [%%(process)d]:'
1764
u' %%(levelname)s: %%(message)s'
1765
% server_settings[u"servicename"]))
1918
1766
1919
1767
# Parse config file with clients
1920
client_defaults = { "timeout": "5m",
1921
"extended_timeout": "15m",
1922
"interval": "2m",
1923
"checker": "fping -q -- %%(host)s",
1924
"host": "",
1925
"approval_delay": "0s",
1926
"approval_duration": "1s",
1768
client_defaults = { u"timeout": u"1h",
1769
u"interval": u"5m",
1770
u"checker": u"fping -q -- %%(host)s",
1771
u"host": u"",
1772
u"approval_delay": u"0s",
1773
u"approval_duration": u"1s",
1927
1774
}
1928
1775
client_config = configparser.SafeConfigParser(client_defaults)
1929
client_config.read(os.path.join(server_settings["configdir"],
1930
"clients.conf"))
1776
client_config.read(os.path.join(server_settings[u"configdir"],
1777
u"clients.conf"))
1931
1778
1932
1779
global mandos_dbus_service
1933
1780
mandos_dbus_service = None
1934
1781
1935
tcp_server = MandosServer((server_settings["address"],
1936
server_settings["port"]),
1782
tcp_server = MandosServer((server_settings[u"address"],
1783
server_settings[u"port"]),
1937
1784
ClientHandler,
1938
interface=(server_settings["interface"]
1785
interface=(server_settings[u"interface"]
1939
1786
or None),
1940
1787
use_ipv6=use_ipv6,
1941
1788
gnutls_priority=
1942
server_settings["priority"],
1789
server_settings[u"priority"],
1943
1790
use_dbus=use_dbus)
1944
1791
if not debug:
1945
pidfilename = "/var/run/mandos.pid"
1792
pidfilename = u"/var/run/mandos.pid"
1946
1793
try:
1947
pidfile = open(pidfilename, "w")
1794
pidfile = open(pidfilename, u"w")
1948
1795
except IOError:
1949
logger.error("Could not open file %r", pidfilename)
1796
logger.error(u"Could not open file %r", pidfilename)
1950
1797
1951
1798
try:
1952
uid = pwd.getpwnam("_mandos").pw_uid
1953
gid = pwd.getpwnam("_mandos").pw_gid
1799
uid = pwd.getpwnam(u"_mandos").pw_uid
1800
gid = pwd.getpwnam(u"_mandos").pw_gid
1954
1801
except KeyError:
1955
1802
try:
1956
uid = pwd.getpwnam("mandos").pw_uid
1957
gid = pwd.getpwnam("mandos").pw_gid
1803
uid = pwd.getpwnam(u"mandos").pw_uid
1804
gid = pwd.getpwnam(u"mandos").pw_gid
1958
1805
except KeyError:
1959
1806
try:
1960
uid = pwd.getpwnam("nobody").pw_uid
1961
gid = pwd.getpwnam("nobody").pw_gid
1807
uid = pwd.getpwnam(u"nobody").pw_uid
1808
gid = pwd.getpwnam(u"nobody").pw_gid
1962
1809
except KeyError:
1963
1810
uid = 65534
1964
1811
gid = 65534
1965
1812
try:
1966
1813
os.setgid(gid)
1967
1814
os.setuid(uid)
1968
except OSError as error:
1815
except OSError, error:
1969
1816
if error[0] != errno.EPERM:
1970
1817
raise error
1971
1818
1976
1823
level = getattr(logging, debuglevel.upper())
1977
1824
syslogger.setLevel(level)
1978
1825
console.setLevel(level)
1979
1826
1980
1827
if debug:
1981
1828
# Enable all possible GnuTLS debugging
1982
1829
1986
1833
1987
1834
@gnutls.library.types.gnutls_log_func
1988
1835
def debug_gnutls(level, string):
1989
logger.debug("GnuTLS: %s", string[:-1])
1836
logger.debug(u"GnuTLS: %s", string[:-1])
1990
1837
1991
1838
(gnutls.library.functions
1992
1839
.gnutls_global_set_log_function(debug_gnutls))
2000
1847
# No console logging
2001
1848
logger.removeHandler(console)
2002
1849
2003
# Need to fork before connecting to D-Bus
2004
if not debug:
2005
# Close all input and output, do double fork, etc.
2006
daemon()
2007
1850
2008
1851
global main_loop
2009
1852
# From the Avahi example code
2013
1856
# End of Avahi example code
2014
1857
if use_dbus:
2015
1858
try:
2016
bus_name = dbus.service.BusName("se.recompile.Mandos",
1859
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
2017
1860
bus, do_not_queue=True)
2018
old_bus_name = (dbus.service.BusName
2019
("se.bsnet.fukt.Mandos", bus,
2020
do_not_queue=True))
2021
except dbus.exceptions.NameExistsException as e:
2022
logger.error(unicode(e) + ", disabling D-Bus")
1861
except dbus.exceptions.NameExistsException, e:
1862
logger.error(unicode(e) + u", disabling D-Bus")
2023
1863
use_dbus = False
2024
server_settings["use_dbus"] = False
1864
server_settings[u"use_dbus"] = False
2025
1865
tcp_server.use_dbus = False
2026
1866
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
2027
service = AvahiService(name = server_settings["servicename"],
2028
servicetype = "_mandos._tcp",
1867
service = AvahiService(name = server_settings[u"servicename"],
1868
servicetype = u"_mandos._tcp",
2029
1869
protocol = protocol, bus = bus)
2030
1870
if server_settings["interface"]:
2031
1871
service.interface = (if_nametoindex
2032
(str(server_settings["interface"])))
2033
1872
(str(server_settings[u"interface"])))
1873
1874
if not debug:
1875
# Close all input and output, do double fork, etc.
1876
daemon()
1877
2034
1878
global multiprocessing_manager
2035
1879
multiprocessing_manager = multiprocessing.Manager()
2036
1880
2037
1881
client_class = Client
2038
1882
if use_dbus:
2039
client_class = functools.partial(ClientDBusTransitional,
2040
bus = bus)
1883
client_class = functools.partial(ClientDBus, bus = bus)
2041
1884
def client_config_items(config, section):
2042
1885
special_settings = {
2043
1886
"approved_by_default":
2056
1899
client_config, section)))
2057
1900
for section in client_config.sections()))
2058
1901
if not tcp_server.clients:
2059
logger.warning("No clients defined")
1902
logger.warning(u"No clients defined")
2060
1903
2061
1904
if not debug:
2062
1905
try:
2063
1906
with pidfile:
2064
1907
pid = os.getpid()
2065
pidfile.write(str(pid) + "\n".encode("utf-8"))
1908
pidfile.write(str(pid) + "\n")
2066
1909
del pidfile
2067
1910
except IOError:
2068
logger.error("Could not write to file %r with PID %d",
1911
logger.error(u"Could not write to file %r with PID %d",
2069
1912
pidfilename, pid)
2070
1913
except NameError:
2071
1914
# "pidfile" was never created
2073
1916
del pidfilename
2074
1917
2075
1918
signal.signal(signal.SIGINT, signal.SIG_IGN)
2076
1919
2077
1920
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2078
1921
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
2079
1922
2081
1924
class MandosDBusService(dbus.service.Object):
2082
1925
"""A D-Bus proxy object"""
2083
1926
def __init__(self):
2084
dbus.service.Object.__init__(self, bus, "/")
2085
_interface = "se.recompile.Mandos"
1927
dbus.service.Object.__init__(self, bus, u"/")
1928
_interface = u"se.bsnet.fukt.Mandos"
2086
1929
2087
@dbus.service.signal(_interface, signature="o")
1930
@dbus.service.signal(_interface, signature=u"o")
2088
1931
def ClientAdded(self, objpath):
2089
1932
"D-Bus signal"
2090
1933
pass
2091
1934
2092
@dbus.service.signal(_interface, signature="ss")
1935
@dbus.service.signal(_interface, signature=u"ss")
2093
1936
def ClientNotFound(self, fingerprint, address):
2094
1937
"D-Bus signal"
2095
1938
pass
2096
1939
2097
@dbus.service.signal(_interface, signature="os")
1940
@dbus.service.signal(_interface, signature=u"os")
2098
1941
def ClientRemoved(self, objpath, name):
2099
1942
"D-Bus signal"
2100
1943
pass
2101
1944
2102
@dbus.service.method(_interface, out_signature="ao")
1945
@dbus.service.method(_interface, out_signature=u"ao")
2103
1946
def GetAllClients(self):
2104
1947
"D-Bus method"
2105
1948
return dbus.Array(c.dbus_object_path
2106
1949
for c in tcp_server.clients)
2107
1950
2108
1951
@dbus.service.method(_interface,
2109
out_signature="a{oa{sv}}")
1952
out_signature=u"a{oa{sv}}")
2110
1953
def GetAllClientsWithProperties(self):
2111
1954
"D-Bus method"
2112
1955
return dbus.Dictionary(
2113
((c.dbus_object_path, c.GetAll(""))
1956
((c.dbus_object_path, c.GetAll(u""))
2114
1957
for c in tcp_server.clients),
2115
signature="oa{sv}")
1958
signature=u"oa{sv}")
2116
1959
2117
@dbus.service.method(_interface, in_signature="o")
1960
@dbus.service.method(_interface, in_signature=u"o")
2118
1961
def RemoveClient(self, object_path):
2119
1962
"D-Bus method"
2120
1963
for c in tcp_server.clients:
2130
1973
2131
1974
del _interface
2132
1975
2133
class MandosDBusServiceTransitional(MandosDBusService):
2134
__metaclass__ = AlternateDBusNamesMetaclass
2135
mandos_dbus_service = MandosDBusServiceTransitional()
1976
mandos_dbus_service = MandosDBusService()
2136
1977
2137
1978
def cleanup():
2138
1979
"Cleanup function; run on exit"
2139
1980
service.cleanup()
2140
1981
2141
multiprocessing.active_children()
2142
1982
while tcp_server.clients:
2143
1983
client = tcp_server.clients.pop()
2144
1984
if use_dbus:
2148
1988
client.disable(quiet=True)
2149
1989
if use_dbus:
2150
1990
# Emit D-Bus signal
2151
mandos_dbus_service.ClientRemoved(client
2152
.dbus_object_path,
1991
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2153
1992
client.name)
2154
1993
2155
1994
atexit.register(cleanup)
2166
2005
# Find out what port we got
2167
2006
service.port = tcp_server.socket.getsockname()[1]
2168
2007
if use_ipv6:
2169
logger.info("Now listening on address %r, port %d,"
2008
logger.info(u"Now listening on address %r, port %d,"
2170
2009
" flowinfo %d, scope_id %d"
2171
2010
% tcp_server.socket.getsockname())
2172
2011
else: # IPv4
2173
logger.info("Now listening on address %r, port %d"
2012
logger.info(u"Now listening on address %r, port %d"
2174
2013
% tcp_server.socket.getsockname())
2175
2014
2176
2015
#service.interface = tcp_server.socket.getsockname()[3]
2179
2018
# From the Avahi example code
2180
2019
try:
2181
2020
service.activate()
2182
except dbus.exceptions.DBusException as error:
2183
logger.critical("DBusException: %s", error)
2021
except dbus.exceptions.DBusException, error:
2022
logger.critical(u"DBusException: %s", error)
2184
2023
cleanup()
2185
2024
sys.exit(1)
2186
2025
# End of Avahi example code
2190
2029
(tcp_server.handle_request
2191
2030
(*args[2:], **kwargs) or True))
2192
2031
2193
logger.debug("Starting main loop")
2032
logger.debug(u"Starting main loop")
2194
2033
main_loop.run()
2195
except AvahiError as error:
2196
logger.critical("AvahiError: %s", error)
2034
except AvahiError, error:
2035
logger.critical(u"AvahiError: %s", error)
2197
2036
cleanup()
2198
2037
sys.exit(1)
2199
2038
except KeyboardInterrupt:
2200
2039
if debug:
2201
print("", file=sys.stderr)
2202
logger.debug("Server received KeyboardInterrupt")
2203
logger.debug("Server exiting")
2040
print >> sys.stderr
2041
logger.debug(u"Server received KeyboardInterrupt")
2042
logger.debug(u"Server exiting")
2204
2043
# Must run before the D-Bus bus name gets deregistered
2205
2044
cleanup()
2206
2045
2207
2208
2046
if __name__ == '__main__':
2209
2047
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0