To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 460
- compare with another revision
- download diff
- download tarball
- view history from revision 460
- Committer: Teddy Hogeborn
- Date: 2010-10-13 06:12:52 UTC
- Revision ID: teddy@fukt.bsnet.se-20101013061252-3a918xedja5caya8
* debian/mandos-client.lintian-overrides: Added plugins.d/plymouth.
- files added:
- DBUS-API
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008-2010 Teddy Hogeborn
15
# Copyright © 2008-2010 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
55
55
import logging
56
56
import logging.handlers
57
57
import pwd
58
from contextlib import closing
58
import contextlib
59
59
import struct
60
60
import fcntl
61
61
import functools
62
import cPickle as pickle
63
import multiprocessing
62
64
63
65
import dbus
64
66
import dbus.service
79
81
SO_BINDTODEVICE = None
80
82
81
83
82
version = "1.0.12"
84
version = "1.2.3"
83
85
86
#logger = logging.getLogger(u'mandos')
84
87
logger = logging.Logger(u'mandos')
85
88
syslogger = (logging.handlers.SysLogHandler
86
89
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
154
157
u" after %i retries, exiting.",
155
158
self.rename_count)
156
159
raise AvahiServiceError(u"Too many renames")
157
self.name = self.server.GetAlternativeServiceName(self.name)
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
158
161
logger.info(u"Changing Zeroconf service name to %r ...",
159
unicode(self.name))
162
self.name)
160
163
syslogger.setFormatter(logging.Formatter
161
164
(u'Mandos (%s) [%%(process)d]:'
162
165
u' %%(levelname)s: %%(message)s'
163
166
% self.name))
164
167
self.remove()
165
self.add()
168
try:
169
self.add()
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
172
self.cleanup()
173
os._exit(1)
166
174
self.rename_count += 1
167
175
def remove(self):
168
176
"""Derived from the Avahi example code"""
191
199
self.group.Commit()
192
200
def entry_group_state_changed(self, state, error):
193
201
"""Derived from the Avahi example code"""
194
logger.debug(u"Avahi state change: %i", state)
202
logger.debug(u"Avahi entry group state change: %i", state)
195
203
196
204
if state == avahi.ENTRY_GROUP_ESTABLISHED:
197
205
logger.debug(u"Zeroconf service established.")
210
218
self.group = None
211
219
def server_state_changed(self, state):
212
220
"""Derived from the Avahi example code"""
221
logger.debug(u"Avahi server state change: %i", state)
213
222
if state == avahi.SERVER_COLLISION:
214
223
logger.error(u"Zeroconf server name collision")
215
224
self.remove()
231
240
"""A representation of a client host served by this server.
232
241
233
242
Attributes:
234
name: string; from the config file, used in log messages and
235
D-Bus identifiers
236
fingerprint: string (40 or 32 hexadecimal digits); used to
237
uniquely identify the client
238
secret: bytestring; sent verbatim (over TLS) to client
239
host: string; available for use by the checker command
240
created: datetime.datetime(); (UTC) object creation
241
last_enabled: datetime.datetime(); (UTC)
242
enabled: bool()
243
last_checked_ok: datetime.datetime(); (UTC) or None
244
timeout: datetime.timedelta(); How long from last_checked_ok
245
until this client is invalid
246
interval: datetime.timedelta(); How often to start a new checker
247
disable_hook: If set, called by disable() as disable_hook(self)
243
_approved: bool(); 'None' if not yet approved/disapproved
244
approval_delay: datetime.timedelta(); Time to wait for approval
245
approval_duration: datetime.timedelta(); Duration of one approval
248
246
checker: subprocess.Popen(); a running checker process used
249
247
to see if the client lives.
250
248
'None' if no process is running.
251
checker_initiator_tag: a gobject event source tag, or None
252
disable_initiator_tag: - '' -
253
checker_callback_tag: - '' -
254
checker_command: string; External command which is run to check if
255
client lives. %() expansions are done at
249
checker_callback_tag: a gobject event source tag, or None
250
checker_command: string; External command which is run to check
251
if client lives. %() expansions are done at
256
252
runtime with vars(self) as dict, so that for
257
253
instance %(name)s can be used in the command.
254
checker_initiator_tag: a gobject event source tag, or None
255
created: datetime.datetime(); (UTC) object creation
258
256
current_checker_command: string; current running checker_command
257
disable_hook: If set, called by disable() as disable_hook(self)
258
disable_initiator_tag: a gobject event source tag, or None
259
enabled: bool()
260
fingerprint: string (40 or 32 hexadecimal digits); used to
261
uniquely identify the client
262
host: string; available for use by the checker command
263
interval: datetime.timedelta(); How often to start a new checker
264
last_approval_request: datetime.datetime(); (UTC) or None
265
last_checked_ok: datetime.datetime(); (UTC) or None
266
last_enabled: datetime.datetime(); (UTC)
267
name: string; from the config file, used in log messages and
268
D-Bus identifiers
269
secret: bytestring; sent verbatim (over TLS) to client
270
timeout: datetime.timedelta(); How long from last_checked_ok
271
until this client is disabled
272
runtime_expansions: Allowed attributes for runtime expansion.
259
273
"""
260
274
275
runtime_expansions = (u"approval_delay", u"approval_duration",
276
u"created", u"enabled", u"fingerprint",
277
u"host", u"interval", u"last_checked_ok",
278
u"last_enabled", u"name", u"timeout")
279
261
280
@staticmethod
262
281
def _timedelta_to_milliseconds(td):
263
282
"Convert a datetime.timedelta() to milliseconds"
272
291
def interval_milliseconds(self):
273
292
"Return the 'interval' attribute in milliseconds"
274
293
return self._timedelta_to_milliseconds(self.interval)
294
295
def approval_delay_milliseconds(self):
296
return self._timedelta_to_milliseconds(self.approval_delay)
275
297
276
298
def __init__(self, name = None, disable_hook=None, config=None):
277
299
"""Note: the 'checker' key in 'config' sets the
290
312
if u"secret" in config:
291
313
self.secret = config[u"secret"].decode(u"base64")
292
314
elif u"secfile" in config:
293
with closing(open(os.path.expanduser
294
(os.path.expandvars
295
(config[u"secfile"])))) as secfile:
315
with open(os.path.expanduser(os.path.expandvars
316
(config[u"secfile"])),
317
"rb") as secfile:
296
318
self.secret = secfile.read()
297
319
else:
298
320
raise TypeError(u"No secret or secfile for client %s"
300
322
self.host = config.get(u"host", u"")
301
323
self.created = datetime.datetime.utcnow()
302
324
self.enabled = False
325
self.last_approval_request = None
303
326
self.last_enabled = None
304
327
self.last_checked_ok = None
305
328
self.timeout = string_to_delta(config[u"timeout"])
312
335
self.checker_command = config[u"checker"]
313
336
self.current_checker_command = None
314
337
self.last_connect = None
338
self._approved = None
339
self.approved_by_default = config.get(u"approved_by_default",
340
True)
341
self.approvals_pending = 0
342
self.approval_delay = string_to_delta(
343
config[u"approval_delay"])
344
self.approval_duration = string_to_delta(
345
config[u"approval_duration"])
346
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
315
347
348
def send_changedstate(self):
349
self.changedstate.acquire()
350
self.changedstate.notify_all()
351
self.changedstate.release()
352
316
353
def enable(self):
317
354
"""Start this client's checker and timeout hooks"""
318
355
if getattr(self, u"enabled", False):
319
356
# Already enabled
320
357
return
358
self.send_changedstate()
321
359
self.last_enabled = datetime.datetime.utcnow()
322
360
# Schedule a new checker to be started an 'interval' from now,
323
361
# and every interval from then on.
324
362
self.checker_initiator_tag = (gobject.timeout_add
325
363
(self.interval_milliseconds(),
326
364
self.start_checker))
327
# Also start a new checker *right now*.
328
self.start_checker()
329
365
# Schedule a disable() when 'timeout' has passed
330
366
self.disable_initiator_tag = (gobject.timeout_add
331
367
(self.timeout_milliseconds(),
332
368
self.disable))
333
369
self.enabled = True
370
# Also start a new checker *right now*.
371
self.start_checker()
334
372
335
def disable(self):
373
def disable(self, quiet=True):
336
374
"""Disable this client."""
337
375
if not getattr(self, "enabled", False):
338
376
return False
339
logger.info(u"Disabling client %s", self.name)
377
if not quiet:
378
self.send_changedstate()
379
if not quiet:
380
logger.info(u"Disabling client %s", self.name)
340
381
if getattr(self, u"disable_initiator_tag", False):
341
382
gobject.source_remove(self.disable_initiator_tag)
342
383
self.disable_initiator_tag = None
383
424
(self.timeout_milliseconds(),
384
425
self.disable))
385
426
427
def need_approval(self):
428
self.last_approval_request = datetime.datetime.utcnow()
429
386
430
def start_checker(self):
387
431
"""Start a new checker subprocess if one is not running.
388
432
394
438
# client would inevitably timeout, since no checker would get
395
439
# a chance to run to completion. If we instead leave running
396
440
# checkers alone, the checker would have to take more time
397
# than 'timeout' for the client to be declared invalid, which
398
# is as it should be.
441
# than 'timeout' for the client to be disabled, which is as it
442
# should be.
399
443
400
444
# If a checker exists, make sure it is not a zombie
401
if self.checker is not None:
445
try:
402
446
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
447
except (AttributeError, OSError), error:
448
if (isinstance(error, OSError)
449
and error.errno != errno.ECHILD):
450
raise error
451
else:
403
452
if pid:
404
453
logger.warning(u"Checker was a zombie")
405
454
gobject.source_remove(self.checker_callback_tag)
412
461
command = self.checker_command % self.host
413
462
except TypeError:
414
463
# Escape attributes for the shell
415
escaped_attrs = dict((key,
416
re.escape(unicode(str(val),
417
errors=
418
u'replace')))
419
for key, val in
420
vars(self).iteritems())
464
escaped_attrs = dict(
465
(attr,
466
re.escape(unicode(str(getattr(self, attr, u"")),
467
errors=
468
u'replace')))
469
for attr in
470
self.runtime_expansions)
471
421
472
try:
422
473
command = self.checker_command % escaped_attrs
423
474
except TypeError, error:
461
512
logger.debug(u"Stopping checker for %(name)s", vars(self))
462
513
try:
463
514
os.kill(self.checker.pid, signal.SIGTERM)
464
#os.sleep(0.5)
515
#time.sleep(0.5)
465
516
#if self.checker.poll() is None:
466
517
# os.kill(self.checker.pid, signal.SIGKILL)
467
518
except OSError, error:
468
519
if error.errno != errno.ESRCH: # No such process
469
520
raise
470
521
self.checker = None
471
472
def still_valid(self):
473
"""Has the timeout not yet passed for this client?"""
474
if not getattr(self, u"enabled", False):
475
return False
476
now = datetime.datetime.utcnow()
477
if self.last_checked_ok is None:
478
return now < (self.created + self.timeout)
479
else:
480
return now < (self.last_checked_ok + self.timeout)
481
482
522
483
523
def dbus_service_property(dbus_interface, signature=u"v",
484
524
access=u"readwrite", byte_arrays=False):
492
532
dbus.service.method, except there is only "signature", since the
493
533
type from Get() and the type sent to Set() is the same.
494
534
"""
535
# Encoding deeply encoded byte arrays is not supported yet by the
536
# "Set" method, so we fail early here:
537
if byte_arrays and signature != u"ay":
538
raise ValueError(u"Byte arrays not supported for non-'ay'"
539
u" signature %r" % signature)
495
540
def decorator(func):
496
541
func._dbus_is_property = True
497
542
func._dbus_interface = dbus_interface
583
628
if prop._dbus_access == u"read":
584
629
raise DBusPropertyAccessException(property_name)
585
630
if prop._dbus_get_args_options[u"byte_arrays"]:
631
# The byte_arrays option is not supported yet on
632
# signatures other than "ay".
633
if prop._dbus_signature != u"ay":
634
raise ValueError
586
635
value = dbus.ByteArray(''.join(unichr(byte)
587
636
for byte in value))
588
637
prop(value)
620
669
"""Standard D-Bus method, overloaded to insert property tags.
621
670
"""
622
671
xmlstring = dbus.service.Object.Introspect(self, object_path,
623
connection)
624
document = xml.dom.minidom.parseString(xmlstring)
625
del xmlstring
626
def make_tag(document, name, prop):
627
e = document.createElement(u"property")
628
e.setAttribute(u"name", name)
629
e.setAttribute(u"type", prop._dbus_signature)
630
e.setAttribute(u"access", prop._dbus_access)
631
return e
632
for if_tag in document.getElementsByTagName(u"interface"):
633
for tag in (make_tag(document, name, prop)
634
for name, prop
635
in self._get_all_dbus_properties()
636
if prop._dbus_interface
637
== if_tag.getAttribute(u"name")):
638
if_tag.appendChild(tag)
639
xmlstring = document.toxml(u"utf-8")
640
document.unlink()
672
connection)
673
try:
674
document = xml.dom.minidom.parseString(xmlstring)
675
def make_tag(document, name, prop):
676
e = document.createElement(u"property")
677
e.setAttribute(u"name", name)
678
e.setAttribute(u"type", prop._dbus_signature)
679
e.setAttribute(u"access", prop._dbus_access)
680
return e
681
for if_tag in document.getElementsByTagName(u"interface"):
682
for tag in (make_tag(document, name, prop)
683
for name, prop
684
in self._get_all_dbus_properties()
685
if prop._dbus_interface
686
== if_tag.getAttribute(u"name")):
687
if_tag.appendChild(tag)
688
# Add the names to the return values for the
689
# "org.freedesktop.DBus.Properties" methods
690
if (if_tag.getAttribute(u"name")
691
== u"org.freedesktop.DBus.Properties"):
692
for cn in if_tag.getElementsByTagName(u"method"):
693
if cn.getAttribute(u"name") == u"Get":
694
for arg in cn.getElementsByTagName(u"arg"):
695
if (arg.getAttribute(u"direction")
696
== u"out"):
697
arg.setAttribute(u"name", u"value")
698
elif cn.getAttribute(u"name") == u"GetAll":
699
for arg in cn.getElementsByTagName(u"arg"):
700
if (arg.getAttribute(u"direction")
701
== u"out"):
702
arg.setAttribute(u"name", u"props")
703
xmlstring = document.toxml(u"utf-8")
704
document.unlink()
705
except (AttributeError, xml.dom.DOMException,
706
xml.parsers.expat.ExpatError), error:
707
logger.error(u"Failed to override Introspection method",
708
error)
641
709
return xmlstring
642
710
643
711
648
716
dbus_object_path: dbus.ObjectPath
649
717
bus: dbus.SystemBus()
650
718
"""
719
720
runtime_expansions = (Client.runtime_expansions
721
+ (u"dbus_object_path",))
722
651
723
# dbus.service.Object doesn't use super(), so we can't either.
652
724
653
725
def __init__(self, bus = None, *args, **kwargs):
726
self._approvals_pending = 0
654
727
self.bus = bus
655
728
Client.__init__(self, *args, **kwargs)
656
729
# Only now, when this client is initialized, can it show up on
657
730
# the D-Bus
731
client_object_name = unicode(self.name).translate(
732
{ord(u"."): ord(u"_"),
733
ord(u"-"): ord(u"_")})
658
734
self.dbus_object_path = (dbus.ObjectPath
659
(u"/clients/"
660
+ self.name.replace(u".", u"_")))
735
(u"/clients/" + client_object_name))
661
736
DBusObjectWithProperties.__init__(self, self.bus,
662
737
self.dbus_object_path)
738
739
def _get_approvals_pending(self):
740
return self._approvals_pending
741
def _set_approvals_pending(self, value):
742
old_value = self._approvals_pending
743
self._approvals_pending = value
744
bval = bool(value)
745
if (hasattr(self, "dbus_object_path")
746
and bval is not bool(old_value)):
747
dbus_bool = dbus.Boolean(bval, variant_level=1)
748
self.PropertyChanged(dbus.String(u"ApprovalPending"),
749
dbus_bool)
750
751
approvals_pending = property(_get_approvals_pending,
752
_set_approvals_pending)
753
del _get_approvals_pending, _set_approvals_pending
663
754
664
755
@staticmethod
665
756
def _datetime_to_dbus(dt, variant_level=0):
672
763
r = Client.enable(self)
673
764
if oldstate != self.enabled:
674
765
# Emit D-Bus signals
675
self.PropertyChanged(dbus.String(u"enabled"),
766
self.PropertyChanged(dbus.String(u"Enabled"),
676
767
dbus.Boolean(True, variant_level=1))
677
768
self.PropertyChanged(
678
dbus.String(u"last_enabled"),
769
dbus.String(u"LastEnabled"),
679
770
self._datetime_to_dbus(self.last_enabled,
680
771
variant_level=1))
681
772
return r
682
773
683
def disable(self, signal = True):
774
def disable(self, quiet = False):
684
775
oldstate = getattr(self, u"enabled", False)
685
r = Client.disable(self)
686
if signal and oldstate != self.enabled:
776
r = Client.disable(self, quiet=quiet)
777
if not quiet and oldstate != self.enabled:
687
778
# Emit D-Bus signal
688
self.PropertyChanged(dbus.String(u"enabled"),
779
self.PropertyChanged(dbus.String(u"Enabled"),
689
780
dbus.Boolean(False, variant_level=1))
690
781
return r
691
782
703
794
self.checker_callback_tag = None
704
795
self.checker = None
705
796
# Emit D-Bus signal
706
self.PropertyChanged(dbus.String(u"checker_running"),
797
self.PropertyChanged(dbus.String(u"CheckerRunning"),
707
798
dbus.Boolean(False, variant_level=1))
708
799
if os.WIFEXITED(condition):
709
800
exitstatus = os.WEXITSTATUS(condition)
724
815
r = Client.checked_ok(self, *args, **kwargs)
725
816
# Emit D-Bus signal
726
817
self.PropertyChanged(
727
dbus.String(u"last_checked_ok"),
818
dbus.String(u"LastCheckedOK"),
728
819
(self._datetime_to_dbus(self.last_checked_ok,
729
820
variant_level=1)))
730
821
return r
731
822
823
def need_approval(self, *args, **kwargs):
824
r = Client.need_approval(self, *args, **kwargs)
825
# Emit D-Bus signal
826
self.PropertyChanged(
827
dbus.String(u"LastApprovalRequest"),
828
(self._datetime_to_dbus(self.last_approval_request,
829
variant_level=1)))
830
return r
831
732
832
def start_checker(self, *args, **kwargs):
733
833
old_checker = self.checker
734
834
if self.checker is not None:
742
842
# Emit D-Bus signal
743
843
self.CheckerStarted(self.current_checker_command)
744
844
self.PropertyChanged(
745
dbus.String(u"checker_running"),
845
dbus.String(u"CheckerRunning"),
746
846
dbus.Boolean(True, variant_level=1))
747
847
return r
748
848
751
851
r = Client.stop_checker(self, *args, **kwargs)
752
852
if (old_checker is not None
753
853
and getattr(self, u"checker", None) is None):
754
self.PropertyChanged(dbus.String(u"checker_running"),
854
self.PropertyChanged(dbus.String(u"CheckerRunning"),
755
855
dbus.Boolean(False, variant_level=1))
756
856
return r
757
758
## D-Bus methods & signals
857
858
def _reset_approved(self):
859
self._approved = None
860
return False
861
862
def approve(self, value=True):
863
self.send_changedstate()
864
self._approved = value
865
gobject.timeout_add(self._timedelta_to_milliseconds
866
(self.approval_duration),
867
self._reset_approved)
868
869
870
## D-Bus methods, signals & properties
759
871
_interface = u"se.bsnet.fukt.Mandos.Client"
760
872
761
# CheckedOK - method
762
@dbus.service.method(_interface)
763
def CheckedOK(self):
764
return self.checked_ok()
873
## Signals
765
874
766
875
# CheckerCompleted - signal
767
876
@dbus.service.signal(_interface, signature=u"nxs")
781
890
"D-Bus signal"
782
891
pass
783
892
784
# ReceivedSecret - signal
893
# GotSecret - signal
785
894
@dbus.service.signal(_interface)
786
def ReceivedSecret(self):
787
"D-Bus signal"
895
def GotSecret(self):
896
"""D-Bus signal
897
Is sent after a successful transfer of secret from the Mandos
898
server to mandos-client
899
"""
788
900
pass
789
901
790
902
# Rejected - signal
791
@dbus.service.signal(_interface)
792
def Rejected(self):
903
@dbus.service.signal(_interface, signature=u"s")
904
def Rejected(self, reason):
793
905
"D-Bus signal"
794
906
pass
795
907
908
# NeedApproval - signal
909
@dbus.service.signal(_interface, signature=u"tb")
910
def NeedApproval(self, timeout, default):
911
"D-Bus signal"
912
return self.need_approval()
913
914
## Methods
915
916
# Approve - method
917
@dbus.service.method(_interface, in_signature=u"b")
918
def Approve(self, value):
919
self.approve(value)
920
921
# CheckedOK - method
922
@dbus.service.method(_interface)
923
def CheckedOK(self):
924
return self.checked_ok()
925
796
926
# Enable - method
797
927
@dbus.service.method(_interface)
798
928
def Enable(self):
816
946
def StopChecker(self):
817
947
self.stop_checker()
818
948
819
# name - property
949
## Properties
950
951
# ApprovalPending - property
952
@dbus_service_property(_interface, signature=u"b", access=u"read")
953
def ApprovalPending_dbus_property(self):
954
return dbus.Boolean(bool(self.approvals_pending))
955
956
# ApprovedByDefault - property
957
@dbus_service_property(_interface, signature=u"b",
958
access=u"readwrite")
959
def ApprovedByDefault_dbus_property(self, value=None):
960
if value is None: # get
961
return dbus.Boolean(self.approved_by_default)
962
self.approved_by_default = bool(value)
963
# Emit D-Bus signal
964
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
965
dbus.Boolean(value, variant_level=1))
966
967
# ApprovalDelay - property
968
@dbus_service_property(_interface, signature=u"t",
969
access=u"readwrite")
970
def ApprovalDelay_dbus_property(self, value=None):
971
if value is None: # get
972
return dbus.UInt64(self.approval_delay_milliseconds())
973
self.approval_delay = datetime.timedelta(0, 0, 0, value)
974
# Emit D-Bus signal
975
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
976
dbus.UInt64(value, variant_level=1))
977
978
# ApprovalDuration - property
979
@dbus_service_property(_interface, signature=u"t",
980
access=u"readwrite")
981
def ApprovalDuration_dbus_property(self, value=None):
982
if value is None: # get
983
return dbus.UInt64(self._timedelta_to_milliseconds(
984
self.approval_duration))
985
self.approval_duration = datetime.timedelta(0, 0, 0, value)
986
# Emit D-Bus signal
987
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
988
dbus.UInt64(value, variant_level=1))
989
990
# Name - property
820
991
@dbus_service_property(_interface, signature=u"s", access=u"read")
821
def name_dbus_property(self):
992
def Name_dbus_property(self):
822
993
return dbus.String(self.name)
823
994
824
# fingerprint - property
995
# Fingerprint - property
825
996
@dbus_service_property(_interface, signature=u"s", access=u"read")
826
def fingerprint_dbus_property(self):
997
def Fingerprint_dbus_property(self):
827
998
return dbus.String(self.fingerprint)
828
999
829
# host - property
1000
# Host - property
830
1001
@dbus_service_property(_interface, signature=u"s",
831
1002
access=u"readwrite")
832
def host_dbus_property(self, value=None):
1003
def Host_dbus_property(self, value=None):
833
1004
if value is None: # get
834
1005
return dbus.String(self.host)
835
1006
self.host = value
836
1007
# Emit D-Bus signal
837
self.PropertyChanged(dbus.String(u"host"),
1008
self.PropertyChanged(dbus.String(u"Host"),
838
1009
dbus.String(value, variant_level=1))
839
1010
840
# created - property
1011
# Created - property
841
1012
@dbus_service_property(_interface, signature=u"s", access=u"read")
842
def created_dbus_property(self):
1013
def Created_dbus_property(self):
843
1014
return dbus.String(self._datetime_to_dbus(self.created))
844
1015
845
# last_enabled - property
1016
# LastEnabled - property
846
1017
@dbus_service_property(_interface, signature=u"s", access=u"read")
847
def last_enabled_dbus_property(self):
1018
def LastEnabled_dbus_property(self):
848
1019
if self.last_enabled is None:
849
1020
return dbus.String(u"")
850
1021
return dbus.String(self._datetime_to_dbus(self.last_enabled))
851
1022
852
# enabled - property
1023
# Enabled - property
853
1024
@dbus_service_property(_interface, signature=u"b",
854
1025
access=u"readwrite")
855
def enabled_dbus_property(self, value=None):
1026
def Enabled_dbus_property(self, value=None):
856
1027
if value is None: # get
857
1028
return dbus.Boolean(self.enabled)
858
1029
if value:
860
1031
else:
861
1032
self.disable()
862
1033
863
# last_checked_ok - property
1034
# LastCheckedOK - property
864
1035
@dbus_service_property(_interface, signature=u"s",
865
1036
access=u"readwrite")
866
def last_checked_ok_dbus_property(self, value=None):
1037
def LastCheckedOK_dbus_property(self, value=None):
867
1038
if value is not None:
868
1039
self.checked_ok()
869
1040
return
872
1043
return dbus.String(self._datetime_to_dbus(self
873
1044
.last_checked_ok))
874
1045
875
# timeout - property
1046
# LastApprovalRequest - property
1047
@dbus_service_property(_interface, signature=u"s", access=u"read")
1048
def LastApprovalRequest_dbus_property(self):
1049
if self.last_approval_request is None:
1050
return dbus.String(u"")
1051
return dbus.String(self.
1052
_datetime_to_dbus(self
1053
.last_approval_request))
1054
1055
# Timeout - property
876
1056
@dbus_service_property(_interface, signature=u"t",
877
1057
access=u"readwrite")
878
def timeout_dbus_property(self, value=None):
1058
def Timeout_dbus_property(self, value=None):
879
1059
if value is None: # get
880
1060
return dbus.UInt64(self.timeout_milliseconds())
881
1061
self.timeout = datetime.timedelta(0, 0, 0, value)
882
1062
# Emit D-Bus signal
883
self.PropertyChanged(dbus.String(u"timeout"),
1063
self.PropertyChanged(dbus.String(u"Timeout"),
884
1064
dbus.UInt64(value, variant_level=1))
885
1065
if getattr(self, u"disable_initiator_tag", None) is None:
886
1066
return
900
1080
self.disable_initiator_tag = (gobject.timeout_add
901
1081
(time_to_die, self.disable))
902
1082
903
# interval - property
1083
# Interval - property
904
1084
@dbus_service_property(_interface, signature=u"t",
905
1085
access=u"readwrite")
906
def interval_dbus_property(self, value=None):
1086
def Interval_dbus_property(self, value=None):
907
1087
if value is None: # get
908
1088
return dbus.UInt64(self.interval_milliseconds())
909
1089
self.interval = datetime.timedelta(0, 0, 0, value)
910
1090
# Emit D-Bus signal
911
self.PropertyChanged(dbus.String(u"interval"),
1091
self.PropertyChanged(dbus.String(u"Interval"),
912
1092
dbus.UInt64(value, variant_level=1))
913
1093
if getattr(self, u"checker_initiator_tag", None) is None:
914
1094
return
918
1098
(value, self.start_checker))
919
1099
self.start_checker() # Start one now, too
920
1100
921
# checker - property
1101
# Checker - property
922
1102
@dbus_service_property(_interface, signature=u"s",
923
1103
access=u"readwrite")
924
def checker_dbus_property(self, value=None):
1104
def Checker_dbus_property(self, value=None):
925
1105
if value is None: # get
926
1106
return dbus.String(self.checker_command)
927
1107
self.checker_command = value
928
1108
# Emit D-Bus signal
929
self.PropertyChanged(dbus.String(u"checker"),
1109
self.PropertyChanged(dbus.String(u"Checker"),
930
1110
dbus.String(self.checker_command,
931
1111
variant_level=1))
932
1112
933
# checker_running - property
1113
# CheckerRunning - property
934
1114
@dbus_service_property(_interface, signature=u"b",
935
1115
access=u"readwrite")
936
def checker_running_dbus_property(self, value=None):
1116
def CheckerRunning_dbus_property(self, value=None):
937
1117
if value is None: # get
938
1118
return dbus.Boolean(self.checker is not None)
939
1119
if value:
941
1121
else:
942
1122
self.stop_checker()
943
1123
944
# object_path - property
1124
# ObjectPath - property
945
1125
@dbus_service_property(_interface, signature=u"o", access=u"read")
946
def object_path_dbus_property(self):
1126
def ObjectPath_dbus_property(self):
947
1127
return self.dbus_object_path # is already a dbus.ObjectPath
948
1128
949
# secret = property
1129
# Secret = property
950
1130
@dbus_service_property(_interface, signature=u"ay",
951
1131
access=u"write", byte_arrays=True)
952
def secret_dbus_property(self, value):
1132
def Secret_dbus_property(self, value):
953
1133
self.secret = str(value)
954
1134
955
1135
del _interface
956
1136
957
1137
1138
class ProxyClient(object):
1139
def __init__(self, child_pipe, fpr, address):
1140
self._pipe = child_pipe
1141
self._pipe.send(('init', fpr, address))
1142
if not self._pipe.recv():
1143
raise KeyError()
1144
1145
def __getattribute__(self, name):
1146
if(name == '_pipe'):
1147
return super(ProxyClient, self).__getattribute__(name)
1148
self._pipe.send(('getattr', name))
1149
data = self._pipe.recv()
1150
if data[0] == 'data':
1151
return data[1]
1152
if data[0] == 'function':
1153
def func(*args, **kwargs):
1154
self._pipe.send(('funcall', name, args, kwargs))
1155
return self._pipe.recv()[1]
1156
return func
1157
1158
def __setattr__(self, name, value):
1159
if(name == '_pipe'):
1160
return super(ProxyClient, self).__setattr__(name, value)
1161
self._pipe.send(('setattr', name, value))
1162
1163
958
1164
class ClientHandler(socketserver.BaseRequestHandler, object):
959
1165
"""A class to handle client connections.
960
1166
962
1168
Note: This will run in its own forked process."""
963
1169
964
1170
def handle(self):
965
logger.info(u"TCP connection from: %s",
966
unicode(self.client_address))
967
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
968
# Open IPC pipe to parent process
969
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
1171
with contextlib.closing(self.server.child_pipe) as child_pipe:
1172
logger.info(u"TCP connection from: %s",
1173
unicode(self.client_address))
1174
logger.debug(u"Pipe FD: %d",
1175
self.server.child_pipe.fileno())
1176
970
1177
session = (gnutls.connection
971
1178
.ClientSession(self.request,
972
1179
gnutls.connection
973
1180
.X509Credentials()))
974
975
line = self.request.makefile().readline()
976
logger.debug(u"Protocol version: %r", line)
977
try:
978
if int(line.strip().split()[0]) > 1:
979
raise RuntimeError
980
except (ValueError, IndexError, RuntimeError), error:
981
logger.error(u"Unknown protocol version: %s", error)
982
return
983
1181
984
1182
# Note: gnutls.connection.X509Credentials is really a
985
1183
# generic GnuTLS certificate credentials object so long as
986
1184
# no X.509 keys are added to it. Therefore, we can use it
987
1185
# here despite using OpenPGP certificates.
988
1186
989
1187
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
990
1188
# u"+AES-256-CBC", u"+SHA1",
991
1189
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
997
1195
(gnutls.library.functions
998
1196
.gnutls_priority_set_direct(session._c_object,
999
1197
priority, None))
1000
1198
1199
# Start communication using the Mandos protocol
1200
# Get protocol number
1201
line = self.request.makefile().readline()
1202
logger.debug(u"Protocol version: %r", line)
1203
try:
1204
if int(line.strip().split()[0]) > 1:
1205
raise RuntimeError
1206
except (ValueError, IndexError, RuntimeError), error:
1207
logger.error(u"Unknown protocol version: %s", error)
1208
return
1209
1210
# Start GnuTLS connection
1001
1211
try:
1002
1212
session.handshake()
1003
1213
except gnutls.errors.GNUTLSError, error:
1006
1216
# established. Just abandon the request.
1007
1217
return
1008
1218
logger.debug(u"Handshake succeeded")
1219
1220
approval_required = False
1009
1221
try:
1010
fpr = self.fingerprint(self.peer_certificate(session))
1011
except (TypeError, gnutls.errors.GNUTLSError), error:
1012
logger.warning(u"Bad certificate: %s", error)
1013
session.bye()
1014
return
1015
logger.debug(u"Fingerprint: %s", fpr)
1222
try:
1223
fpr = self.fingerprint(self.peer_certificate
1224
(session))
1225
except (TypeError, gnutls.errors.GNUTLSError), error:
1226
logger.warning(u"Bad certificate: %s", error)
1227
return
1228
logger.debug(u"Fingerprint: %s", fpr)
1229
1230
try:
1231
client = ProxyClient(child_pipe, fpr,
1232
self.client_address)
1233
except KeyError:
1234
return
1235
1236
if client.approval_delay:
1237
delay = client.approval_delay
1238
client.approvals_pending += 1
1239
approval_required = True
1240
1241
while True:
1242
if not client.enabled:
1243
logger.warning(u"Client %s is disabled",
1244
client.name)
1245
if self.server.use_dbus:
1246
# Emit D-Bus signal
1247
client.Rejected("Disabled")
1248
return
1249
1250
if client._approved or not client.approval_delay:
1251
#We are approved or approval is disabled
1252
break
1253
elif client._approved is None:
1254
logger.info(u"Client %s needs approval",
1255
client.name)
1256
if self.server.use_dbus:
1257
# Emit D-Bus signal
1258
client.NeedApproval(
1259
client.approval_delay_milliseconds(),
1260
client.approved_by_default)
1261
else:
1262
logger.warning(u"Client %s was not approved",
1263
client.name)
1264
if self.server.use_dbus:
1265
# Emit D-Bus signal
1266
client.Rejected("Denied")
1267
return
1268
1269
#wait until timeout or approved
1270
#x = float(client._timedelta_to_milliseconds(delay))
1271
time = datetime.datetime.now()
1272
client.changedstate.acquire()
1273
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1274
client.changedstate.release()
1275
time2 = datetime.datetime.now()
1276
if (time2 - time) >= delay:
1277
if not client.approved_by_default:
1278
logger.warning("Client %s timed out while"
1279
" waiting for approval",
1280
client.name)
1281
if self.server.use_dbus:
1282
# Emit D-Bus signal
1283
client.Rejected("Approval timed out")
1284
return
1285
else:
1286
break
1287
else:
1288
delay -= time2 - time
1289
1290
sent_size = 0
1291
while sent_size < len(client.secret):
1292
try:
1293
sent = session.send(client.secret[sent_size:])
1294
except (gnutls.errors.GNUTLSError), error:
1295
logger.warning("gnutls send failed")
1296
return
1297
logger.debug(u"Sent: %d, remaining: %d",
1298
sent, len(client.secret)
1299
- (sent_size + sent))
1300
sent_size += sent
1301
1302
logger.info(u"Sending secret to %s", client.name)
1303
# bump the timeout as if seen
1304
client.checked_ok()
1305
if self.server.use_dbus:
1306
# Emit D-Bus signal
1307
client.GotSecret()
1016
1308
1017
for c in self.server.clients:
1018
if c.fingerprint == fpr:
1019
client = c
1020
break
1021
else:
1022
ipc.write(u"NOTFOUND %s %s\n"
1023
% (fpr, unicode(self.client_address)))
1024
session.bye()
1025
return
1026
# Have to check if client.still_valid(), since it is
1027
# possible that the client timed out while establishing
1028
# the GnuTLS session.
1029
if not client.still_valid():
1030
ipc.write(u"INVALID %s\n" % client.name)
1031
session.bye()
1032
return
1033
ipc.write(u"SENDING %s\n" % client.name)
1034
sent_size = 0
1035
while sent_size < len(client.secret):
1036
sent = session.send(client.secret[sent_size:])
1037
logger.debug(u"Sent: %d, remaining: %d",
1038
sent, len(client.secret)
1039
- (sent_size + sent))
1040
sent_size += sent
1041
session.bye()
1309
finally:
1310
if approval_required:
1311
client.approvals_pending -= 1
1312
try:
1313
session.bye()
1314
except (gnutls.errors.GNUTLSError), error:
1315
logger.warning("GnuTLS bye failed")
1042
1316
1043
1317
@staticmethod
1044
1318
def peer_certificate(session):
1104
1378
return hex_fpr
1105
1379
1106
1380
1107
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
1108
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
1381
class MultiprocessingMixIn(object):
1382
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1383
def sub_process_main(self, request, address):
1384
try:
1385
self.finish_request(request, address)
1386
except:
1387
self.handle_error(request, address)
1388
self.close_request(request)
1389
1390
def process_request(self, request, address):
1391
"""Start a new process to process the request."""
1392
multiprocessing.Process(target = self.sub_process_main,
1393
args = (request, address)).start()
1394
1395
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1396
""" adds a pipe to the MixIn """
1109
1397
def process_request(self, request, client_address):
1110
1398
"""Overrides and wraps the original process_request().
1111
1399
1112
1400
This function creates a new pipe in self.pipe
1113
1401
"""
1114
self.pipe = os.pipe()
1115
super(ForkingMixInWithPipe,
1402
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1403
1404
super(MultiprocessingMixInWithPipe,
1116
1405
self).process_request(request, client_address)
1117
os.close(self.pipe[1]) # close write end
1118
self.add_pipe(self.pipe[0])
1119
def add_pipe(self, pipe):
1406
self.child_pipe.close()
1407
self.add_pipe(parent_pipe)
1408
1409
def add_pipe(self, parent_pipe):
1120
1410
"""Dummy function; override as necessary"""
1121
os.close(pipe)
1122
1123
1124
class IPv6_TCPServer(ForkingMixInWithPipe,
1411
pass
1412
1413
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1125
1414
socketserver.TCPServer, object):
1126
1415
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1127
1416
1212
1501
return socketserver.TCPServer.server_activate(self)
1213
1502
def enable(self):
1214
1503
self.enabled = True
1215
def add_pipe(self, pipe):
1504
def add_pipe(self, parent_pipe):
1216
1505
# Call "handle_ipc" for both data and EOF events
1217
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1218
self.handle_ipc)
1219
def handle_ipc(self, source, condition, file_objects={}):
1506
gobject.io_add_watch(parent_pipe.fileno(),
1507
gobject.IO_IN | gobject.IO_HUP,
1508
functools.partial(self.handle_ipc,
1509
parent_pipe = parent_pipe))
1510
1511
def handle_ipc(self, source, condition, parent_pipe=None,
1512
client_object=None):
1220
1513
condition_names = {
1221
1514
gobject.IO_IN: u"IN", # There is data to read.
1222
1515
gobject.IO_OUT: u"OUT", # Data can be written (without
1231
1524
for cond, name in
1232
1525
condition_names.iteritems()
1233
1526
if cond & condition)
1234
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1235
conditions_string)
1236
1237
# Turn the pipe file descriptor into a Python file object
1238
if source not in file_objects:
1239
file_objects[source] = os.fdopen(source, u"r", 1)
1240
1241
# Read a line from the file object
1242
cmdline = file_objects[source].readline()
1243
if not cmdline: # Empty line means end of file
1244
# close the IPC pipe
1245
file_objects[source].close()
1246
del file_objects[source]
1247
1248
# Stop calling this function
1249
return False
1250
1251
logger.debug(u"IPC command: %r", cmdline)
1252
1253
# Parse and act on command
1254
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1255
1256
if cmd == u"NOTFOUND":
1257
logger.warning(u"Client not found for fingerprint: %s",
1258
args)
1259
if self.use_dbus:
1260
# Emit D-Bus signal
1261
mandos_dbus_service.ClientNotFound(args)
1262
elif cmd == u"INVALID":
1263
for client in self.clients:
1264
if client.name == args:
1265
logger.warning(u"Client %s is invalid", args)
1266
if self.use_dbus:
1267
# Emit D-Bus signal
1268
client.Rejected()
1269
break
1270
else:
1271
logger.error(u"Unknown client %s is invalid", args)
1272
elif cmd == u"SENDING":
1273
for client in self.clients:
1274
if client.name == args:
1275
logger.info(u"Sending secret to %s", client.name)
1276
client.checked_ok()
1277
if self.use_dbus:
1278
# Emit D-Bus signal
1279
client.ReceivedSecret()
1280
break
1281
else:
1282
logger.error(u"Sending secret to unknown client %s",
1283
args)
1284
else:
1285
logger.error(u"Unknown IPC command: %r", cmdline)
1286
1287
# Keep calling this function
1527
# error or the other end of multiprocessing.Pipe has closed
1528
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1529
return False
1530
1531
# Read a request from the child
1532
request = parent_pipe.recv()
1533
command = request[0]
1534
1535
if command == 'init':
1536
fpr = request[1]
1537
address = request[2]
1538
1539
for c in self.clients:
1540
if c.fingerprint == fpr:
1541
client = c
1542
break
1543
else:
1544
logger.warning(u"Client not found for fingerprint: %s, ad"
1545
u"dress: %s", fpr, address)
1546
if self.use_dbus:
1547
# Emit D-Bus signal
1548
mandos_dbus_service.ClientNotFound(fpr, address[0])
1549
parent_pipe.send(False)
1550
return False
1551
1552
gobject.io_add_watch(parent_pipe.fileno(),
1553
gobject.IO_IN | gobject.IO_HUP,
1554
functools.partial(self.handle_ipc,
1555
parent_pipe = parent_pipe,
1556
client_object = client))
1557
parent_pipe.send(True)
1558
# remove the old hook in favor of the new above hook on same fileno
1559
return False
1560
if command == 'funcall':
1561
funcname = request[1]
1562
args = request[2]
1563
kwargs = request[3]
1564
1565
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1566
1567
if command == 'getattr':
1568
attrname = request[1]
1569
if callable(client_object.__getattribute__(attrname)):
1570
parent_pipe.send(('function',))
1571
else:
1572
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1573
1574
if command == 'setattr':
1575
attrname = request[1]
1576
value = request[2]
1577
setattr(client_object, attrname, value)
1578
1288
1579
return True
1289
1580
1290
1581
1320
1611
elif suffix == u"w":
1321
1612
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1322
1613
else:
1323
raise ValueError
1324
except (ValueError, IndexError):
1325
raise ValueError
1614
raise ValueError(u"Unknown suffix %r" % suffix)
1615
except (ValueError, IndexError), e:
1616
raise ValueError(e.message)
1326
1617
timevalue += delta
1327
1618
return timevalue
1328
1619
1341
1632
def if_nametoindex(interface):
1342
1633
"Get an interface index the hard way, i.e. using fcntl()"
1343
1634
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1344
with closing(socket.socket()) as s:
1635
with contextlib.closing(socket.socket()) as s:
1345
1636
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1346
1637
struct.pack(str(u"16s16x"),
1347
1638
interface))
1367
1658
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1368
1659
if not stat.S_ISCHR(os.fstat(null).st_mode):
1369
1660
raise OSError(errno.ENODEV,
1370
u"/dev/null not a character device")
1661
u"%s not a character device"
1662
% os.path.devnull)
1371
1663
os.dup2(null, sys.stdin.fileno())
1372
1664
os.dup2(null, sys.stdout.fileno())
1373
1665
os.dup2(null, sys.stderr.fileno())
1392
1684
parser.add_option("--debug", action=u"store_true",
1393
1685
help=u"Debug mode; run in foreground and log to"
1394
1686
u" terminal")
1687
parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",
1688
help=u"Debug level for stdout output")
1395
1689
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1396
1690
u" priority string (see GnuTLS documentation)")
1397
1691
parser.add_option("--servicename", type=u"string",
1422
1716
u"servicename": u"Mandos",
1423
1717
u"use_dbus": u"True",
1424
1718
u"use_ipv6": u"True",
1719
u"debuglevel": u"",
1425
1720
}
1426
1721
1427
1722
# Parse config file for server-global settings
1444
1739
# options, if set.
1445
1740
for option in (u"interface", u"address", u"port", u"debug",
1446
1741
u"priority", u"servicename", u"configdir",
1447
u"use_dbus", u"use_ipv6"):
1742
u"use_dbus", u"use_ipv6", u"debuglevel"):
1448
1743
value = getattr(options, option)
1449
1744
if value is not None:
1450
1745
server_settings[option] = value
1459
1754
1460
1755
# For convenience
1461
1756
debug = server_settings[u"debug"]
1757
debuglevel = server_settings[u"debuglevel"]
1462
1758
use_dbus = server_settings[u"use_dbus"]
1463
1759
use_ipv6 = server_settings[u"use_ipv6"]
1464
1465
if not debug:
1466
syslogger.setLevel(logging.WARNING)
1467
console.setLevel(logging.WARNING)
1468
1760
1469
1761
if server_settings[u"servicename"] != u"Mandos":
1470
1762
syslogger.setFormatter(logging.Formatter
1471
1763
(u'Mandos (%s) [%%(process)d]:'
1477
1769
u"interval": u"5m",
1478
1770
u"checker": u"fping -q -- %%(host)s",
1479
1771
u"host": u"",
1772
u"approval_delay": u"0s",
1773
u"approval_duration": u"1s",
1480
1774
}
1481
1775
client_config = configparser.SafeConfigParser(client_defaults)
1482
1776
client_config.read(os.path.join(server_settings[u"configdir"],
1488
1782
tcp_server = MandosServer((server_settings[u"address"],
1489
1783
server_settings[u"port"]),
1490
1784
ClientHandler,
1491
interface=server_settings[u"interface"],
1785
interface=(server_settings[u"interface"]
1786
or None),
1492
1787
use_ipv6=use_ipv6,
1493
1788
gnutls_priority=
1494
1789
server_settings[u"priority"],
1495
1790
use_dbus=use_dbus)
1496
pidfilename = u"/var/run/mandos.pid"
1497
try:
1498
pidfile = open(pidfilename, u"w")
1499
except IOError:
1500
logger.error(u"Could not open file %r", pidfilename)
1791
if not debug:
1792
pidfilename = u"/var/run/mandos.pid"
1793
try:
1794
pidfile = open(pidfilename, u"w")
1795
except IOError:
1796
logger.error(u"Could not open file %r", pidfilename)
1501
1797
1502
1798
try:
1503
1799
uid = pwd.getpwnam(u"_mandos").pw_uid
1520
1816
if error[0] != errno.EPERM:
1521
1817
raise error
1522
1818
1523
# Enable all possible GnuTLS debugging
1819
if not debug and not debuglevel:
1820
syslogger.setLevel(logging.WARNING)
1821
console.setLevel(logging.WARNING)
1822
if debuglevel:
1823
level = getattr(logging, debuglevel.upper())
1824
syslogger.setLevel(level)
1825
console.setLevel(level)
1826
1524
1827
if debug:
1828
# Enable all possible GnuTLS debugging
1829
1525
1830
# "Use a log level over 10 to enable all debugging options."
1526
1831
# - GnuTLS manual
1527
1832
gnutls.library.functions.gnutls_global_set_log_level(11)
1532
1837
1533
1838
(gnutls.library.functions
1534
1839
.gnutls_global_set_log_function(debug_gnutls))
1840
1841
# Redirect stdin so all checkers get /dev/null
1842
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1843
os.dup2(null, sys.stdin.fileno())
1844
if null > 2:
1845
os.close(null)
1846
else:
1847
# No console logging
1848
logger.removeHandler(console)
1849
1850
# Need to fork before connecting to D-Bus
1851
if not debug:
1852
# Close all input and output, do double fork, etc.
1853
daemon()
1535
1854
1536
1855
global main_loop
1537
1856
# From the Avahi example code
1540
1859
bus = dbus.SystemBus()
1541
1860
# End of Avahi example code
1542
1861
if use_dbus:
1543
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1862
try:
1863
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1864
bus, do_not_queue=True)
1865
except dbus.exceptions.NameExistsException, e:
1866
logger.error(unicode(e) + u", disabling D-Bus")
1867
use_dbus = False
1868
server_settings[u"use_dbus"] = False
1869
tcp_server.use_dbus = False
1544
1870
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1545
1871
service = AvahiService(name = server_settings[u"servicename"],
1546
1872
servicetype = u"_mandos._tcp",
1549
1875
service.interface = (if_nametoindex
1550
1876
(str(server_settings[u"interface"])))
1551
1877
1878
global multiprocessing_manager
1879
multiprocessing_manager = multiprocessing.Manager()
1880
1552
1881
client_class = Client
1553
1882
if use_dbus:
1554
1883
client_class = functools.partial(ClientDBus, bus = bus)
1884
def client_config_items(config, section):
1885
special_settings = {
1886
"approved_by_default":
1887
lambda: config.getboolean(section,
1888
"approved_by_default"),
1889
}
1890
for name, value in config.items(section):
1891
try:
1892
yield (name, special_settings[name]())
1893
except KeyError:
1894
yield (name, value)
1895
1555
1896
tcp_server.clients.update(set(
1556
1897
client_class(name = section,
1557
config= dict(client_config.items(section)))
1898
config= dict(client_config_items(
1899
client_config, section)))
1558
1900
for section in client_config.sections()))
1559
1901
if not tcp_server.clients:
1560
1902
logger.warning(u"No clients defined")
1561
1562
if debug:
1563
# Redirect stdin so all checkers get /dev/null
1564
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1565
os.dup2(null, sys.stdin.fileno())
1566
if null > 2:
1567
os.close(null)
1568
else:
1569
# No console logging
1570
logger.removeHandler(console)
1571
# Close all input and output, do double fork, etc.
1572
daemon()
1573
1574
try:
1575
with closing(pidfile):
1576
pid = os.getpid()
1577
pidfile.write(str(pid) + "\n")
1578
del pidfile
1579
except IOError:
1580
logger.error(u"Could not write to file %r with PID %d",
1581
pidfilename, pid)
1582
except NameError:
1583
# "pidfile" was never created
1584
pass
1585
del pidfilename
1586
1587
def cleanup():
1588
"Cleanup function; run on exit"
1589
service.cleanup()
1590
1903
1591
while tcp_server.clients:
1592
client = tcp_server.clients.pop()
1593
client.disable_hook = None
1594
client.disable()
1595
1596
atexit.register(cleanup)
1597
1598
1904
if not debug:
1905
try:
1906
with pidfile:
1907
pid = os.getpid()
1908
pidfile.write(str(pid) + "\n")
1909
del pidfile
1910
except IOError:
1911
logger.error(u"Could not write to file %r with PID %d",
1912
pidfilename, pid)
1913
except NameError:
1914
# "pidfile" was never created
1915
pass
1916
del pidfilename
1917
1599
1918
signal.signal(signal.SIGINT, signal.SIG_IGN)
1919
1600
1920
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1601
1921
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1602
1922
1607
1927
dbus.service.Object.__init__(self, bus, u"/")
1608
1928
_interface = u"se.bsnet.fukt.Mandos"
1609
1929
1610
@dbus.service.signal(_interface, signature=u"oa{sv}")
1611
def ClientAdded(self, objpath, properties):
1930
@dbus.service.signal(_interface, signature=u"o")
1931
def ClientAdded(self, objpath):
1612
1932
"D-Bus signal"
1613
1933
pass
1614
1934
1615
@dbus.service.signal(_interface, signature=u"s")
1616
def ClientNotFound(self, fingerprint):
1935
@dbus.service.signal(_interface, signature=u"ss")
1936
def ClientNotFound(self, fingerprint, address):
1617
1937
"D-Bus signal"
1618
1938
pass
1619
1939
1645
1965
tcp_server.clients.remove(c)
1646
1966
c.remove_from_connection()
1647
1967
# Don't signal anything except ClientRemoved
1648
c.disable(signal=False)
1968
c.disable(quiet=True)
1649
1969
# Emit D-Bus signal
1650
1970
self.ClientRemoved(object_path, c.name)
1651
1971
return
1652
raise KeyError
1972
raise KeyError(object_path)
1653
1973
1654
1974
del _interface
1655
1975
1656
1976
mandos_dbus_service = MandosDBusService()
1657
1977
1978
def cleanup():
1979
"Cleanup function; run on exit"
1980
service.cleanup()
1981
1982
while tcp_server.clients:
1983
client = tcp_server.clients.pop()
1984
if use_dbus:
1985
client.remove_from_connection()
1986
client.disable_hook = None
1987
# Don't signal anything except ClientRemoved
1988
client.disable(quiet=True)
1989
if use_dbus:
1990
# Emit D-Bus signal
1991
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
1992
client.name)
1993
1994
atexit.register(cleanup)
1995
1658
1996
for client in tcp_server.clients:
1659
1997
if use_dbus:
1660
1998
# Emit D-Bus signal
1661
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1662
client.GetAll(u""))
1999
mandos_dbus_service.ClientAdded(client.dbus_object_path)
1663
2000
client.enable()
1664
2001
1665
2002
tcp_server.enable()
1683
2020
service.activate()
1684
2021
except dbus.exceptions.DBusException, error:
1685
2022
logger.critical(u"DBusException: %s", error)
2023
cleanup()
1686
2024
sys.exit(1)
1687
2025
# End of Avahi example code
1688
2026
1695
2033
main_loop.run()
1696
2034
except AvahiError, error:
1697
2035
logger.critical(u"AvahiError: %s", error)
2036
cleanup()
1698
2037
sys.exit(1)
1699
2038
except KeyboardInterrupt:
1700
2039
if debug:
1701
2040
print >> sys.stderr
1702
2041
logger.debug(u"Server received KeyboardInterrupt")
1703
2042
logger.debug(u"Server exiting")
2043
# Must run before the D-Bus bus name gets deregistered
2044
cleanup()
1704
2045
1705
2046
if __name__ == '__main__':
1706
2047
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0