To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 460
- compare with another revision
- download diff
- download tarball
- view history from revision 460
- Committer: Teddy Hogeborn
- Date: 2010-10-13 06:12:52 UTC
- Revision ID: teddy@fukt.bsnet.se-20101013061252-3a918xedja5caya8
* debian/mandos-client.lintian-overrides: Added plugins.d/plymouth.
- files added:
- DBUS-API
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008-2010 Teddy Hogeborn
15
# Copyright © 2008-2010 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
55
55
import logging
56
56
import logging.handlers
57
57
import pwd
58
from contextlib import closing
58
import contextlib
59
59
import struct
60
60
import fcntl
61
61
import functools
62
import cPickle as pickle
63
import multiprocessing
62
64
63
65
import dbus
64
66
import dbus.service
79
81
SO_BINDTODEVICE = None
80
82
81
83
82
version = "1.0.12"
84
version = "1.2.3"
83
85
86
#logger = logging.getLogger(u'mandos')
84
87
logger = logging.Logger(u'mandos')
85
88
syslogger = (logging.handlers.SysLogHandler
86
89
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
154
157
u" after %i retries, exiting.",
155
158
self.rename_count)
156
159
raise AvahiServiceError(u"Too many renames")
157
self.name = self.server.GetAlternativeServiceName(self.name)
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
158
161
logger.info(u"Changing Zeroconf service name to %r ...",
159
unicode(self.name))
162
self.name)
160
163
syslogger.setFormatter(logging.Formatter
161
164
(u'Mandos (%s) [%%(process)d]:'
162
165
u' %%(levelname)s: %%(message)s'
163
166
% self.name))
164
167
self.remove()
165
self.add()
168
try:
169
self.add()
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
172
self.cleanup()
173
os._exit(1)
166
174
self.rename_count += 1
167
175
def remove(self):
168
176
"""Derived from the Avahi example code"""
191
199
self.group.Commit()
192
200
def entry_group_state_changed(self, state, error):
193
201
"""Derived from the Avahi example code"""
194
logger.debug(u"Avahi state change: %i", state)
202
logger.debug(u"Avahi entry group state change: %i", state)
195
203
196
204
if state == avahi.ENTRY_GROUP_ESTABLISHED:
197
205
logger.debug(u"Zeroconf service established.")
210
218
self.group = None
211
219
def server_state_changed(self, state):
212
220
"""Derived from the Avahi example code"""
221
logger.debug(u"Avahi server state change: %i", state)
213
222
if state == avahi.SERVER_COLLISION:
214
223
logger.error(u"Zeroconf server name collision")
215
224
self.remove()
231
240
"""A representation of a client host served by this server.
232
241
233
242
Attributes:
234
name: string; from the config file, used in log messages and
235
D-Bus identifiers
236
fingerprint: string (40 or 32 hexadecimal digits); used to
237
uniquely identify the client
238
secret: bytestring; sent verbatim (over TLS) to client
239
host: string; available for use by the checker command
240
created: datetime.datetime(); (UTC) object creation
241
last_enabled: datetime.datetime(); (UTC)
242
enabled: bool()
243
last_checked_ok: datetime.datetime(); (UTC) or None
244
timeout: datetime.timedelta(); How long from last_checked_ok
245
until this client is invalid
246
interval: datetime.timedelta(); How often to start a new checker
247
disable_hook: If set, called by disable() as disable_hook(self)
243
_approved: bool(); 'None' if not yet approved/disapproved
244
approval_delay: datetime.timedelta(); Time to wait for approval
245
approval_duration: datetime.timedelta(); Duration of one approval
248
246
checker: subprocess.Popen(); a running checker process used
249
247
to see if the client lives.
250
248
'None' if no process is running.
251
checker_initiator_tag: a gobject event source tag, or None
252
disable_initiator_tag: - '' -
253
checker_callback_tag: - '' -
254
checker_command: string; External command which is run to check if
255
client lives. %() expansions are done at
249
checker_callback_tag: a gobject event source tag, or None
250
checker_command: string; External command which is run to check
251
if client lives. %() expansions are done at
256
252
runtime with vars(self) as dict, so that for
257
253
instance %(name)s can be used in the command.
254
checker_initiator_tag: a gobject event source tag, or None
255
created: datetime.datetime(); (UTC) object creation
258
256
current_checker_command: string; current running checker_command
257
disable_hook: If set, called by disable() as disable_hook(self)
258
disable_initiator_tag: a gobject event source tag, or None
259
enabled: bool()
260
fingerprint: string (40 or 32 hexadecimal digits); used to
261
uniquely identify the client
262
host: string; available for use by the checker command
263
interval: datetime.timedelta(); How often to start a new checker
264
last_approval_request: datetime.datetime(); (UTC) or None
265
last_checked_ok: datetime.datetime(); (UTC) or None
266
last_enabled: datetime.datetime(); (UTC)
267
name: string; from the config file, used in log messages and
268
D-Bus identifiers
269
secret: bytestring; sent verbatim (over TLS) to client
270
timeout: datetime.timedelta(); How long from last_checked_ok
271
until this client is disabled
272
runtime_expansions: Allowed attributes for runtime expansion.
259
273
"""
260
274
275
runtime_expansions = (u"approval_delay", u"approval_duration",
276
u"created", u"enabled", u"fingerprint",
277
u"host", u"interval", u"last_checked_ok",
278
u"last_enabled", u"name", u"timeout")
279
261
280
@staticmethod
262
281
def _timedelta_to_milliseconds(td):
263
282
"Convert a datetime.timedelta() to milliseconds"
272
291
def interval_milliseconds(self):
273
292
"Return the 'interval' attribute in milliseconds"
274
293
return self._timedelta_to_milliseconds(self.interval)
294
295
def approval_delay_milliseconds(self):
296
return self._timedelta_to_milliseconds(self.approval_delay)
275
297
276
298
def __init__(self, name = None, disable_hook=None, config=None):
277
299
"""Note: the 'checker' key in 'config' sets the
290
312
if u"secret" in config:
291
313
self.secret = config[u"secret"].decode(u"base64")
292
314
elif u"secfile" in config:
293
with closing(open(os.path.expanduser
294
(os.path.expandvars
295
(config[u"secfile"])),
296
"rb")) as secfile:
315
with open(os.path.expanduser(os.path.expandvars
316
(config[u"secfile"])),
317
"rb") as secfile:
297
318
self.secret = secfile.read()
298
319
else:
299
320
raise TypeError(u"No secret or secfile for client %s"
301
322
self.host = config.get(u"host", u"")
302
323
self.created = datetime.datetime.utcnow()
303
324
self.enabled = False
325
self.last_approval_request = None
304
326
self.last_enabled = None
305
327
self.last_checked_ok = None
306
328
self.timeout = string_to_delta(config[u"timeout"])
313
335
self.checker_command = config[u"checker"]
314
336
self.current_checker_command = None
315
337
self.last_connect = None
338
self._approved = None
339
self.approved_by_default = config.get(u"approved_by_default",
340
True)
341
self.approvals_pending = 0
342
self.approval_delay = string_to_delta(
343
config[u"approval_delay"])
344
self.approval_duration = string_to_delta(
345
config[u"approval_duration"])
346
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
316
347
348
def send_changedstate(self):
349
self.changedstate.acquire()
350
self.changedstate.notify_all()
351
self.changedstate.release()
352
317
353
def enable(self):
318
354
"""Start this client's checker and timeout hooks"""
319
355
if getattr(self, u"enabled", False):
320
356
# Already enabled
321
357
return
358
self.send_changedstate()
322
359
self.last_enabled = datetime.datetime.utcnow()
323
360
# Schedule a new checker to be started an 'interval' from now,
324
361
# and every interval from then on.
325
362
self.checker_initiator_tag = (gobject.timeout_add
326
363
(self.interval_milliseconds(),
327
364
self.start_checker))
328
# Also start a new checker *right now*.
329
self.start_checker()
330
365
# Schedule a disable() when 'timeout' has passed
331
366
self.disable_initiator_tag = (gobject.timeout_add
332
367
(self.timeout_milliseconds(),
333
368
self.disable))
334
369
self.enabled = True
370
# Also start a new checker *right now*.
371
self.start_checker()
335
372
336
def disable(self):
373
def disable(self, quiet=True):
337
374
"""Disable this client."""
338
375
if not getattr(self, "enabled", False):
339
376
return False
340
logger.info(u"Disabling client %s", self.name)
377
if not quiet:
378
self.send_changedstate()
379
if not quiet:
380
logger.info(u"Disabling client %s", self.name)
341
381
if getattr(self, u"disable_initiator_tag", False):
342
382
gobject.source_remove(self.disable_initiator_tag)
343
383
self.disable_initiator_tag = None
384
424
(self.timeout_milliseconds(),
385
425
self.disable))
386
426
427
def need_approval(self):
428
self.last_approval_request = datetime.datetime.utcnow()
429
387
430
def start_checker(self):
388
431
"""Start a new checker subprocess if one is not running.
389
432
395
438
# client would inevitably timeout, since no checker would get
396
439
# a chance to run to completion. If we instead leave running
397
440
# checkers alone, the checker would have to take more time
398
# than 'timeout' for the client to be declared invalid, which
399
# is as it should be.
441
# than 'timeout' for the client to be disabled, which is as it
442
# should be.
400
443
401
444
# If a checker exists, make sure it is not a zombie
402
445
try:
418
461
command = self.checker_command % self.host
419
462
except TypeError:
420
463
# Escape attributes for the shell
421
escaped_attrs = dict((key,
422
re.escape(unicode(str(val),
423
errors=
424
u'replace')))
425
for key, val in
426
vars(self).iteritems())
464
escaped_attrs = dict(
465
(attr,
466
re.escape(unicode(str(getattr(self, attr, u"")),
467
errors=
468
u'replace')))
469
for attr in
470
self.runtime_expansions)
471
427
472
try:
428
473
command = self.checker_command % escaped_attrs
429
474
except TypeError, error:
467
512
logger.debug(u"Stopping checker for %(name)s", vars(self))
468
513
try:
469
514
os.kill(self.checker.pid, signal.SIGTERM)
470
#os.sleep(0.5)
515
#time.sleep(0.5)
471
516
#if self.checker.poll() is None:
472
517
# os.kill(self.checker.pid, signal.SIGKILL)
473
518
except OSError, error:
474
519
if error.errno != errno.ESRCH: # No such process
475
520
raise
476
521
self.checker = None
477
478
def still_valid(self):
479
"""Has the timeout not yet passed for this client?"""
480
if not getattr(self, u"enabled", False):
481
return False
482
now = datetime.datetime.utcnow()
483
if self.last_checked_ok is None:
484
return now < (self.created + self.timeout)
485
else:
486
return now < (self.last_checked_ok + self.timeout)
487
488
522
489
523
def dbus_service_property(dbus_interface, signature=u"v",
490
524
access=u"readwrite", byte_arrays=False):
498
532
dbus.service.method, except there is only "signature", since the
499
533
type from Get() and the type sent to Set() is the same.
500
534
"""
535
# Encoding deeply encoded byte arrays is not supported yet by the
536
# "Set" method, so we fail early here:
537
if byte_arrays and signature != u"ay":
538
raise ValueError(u"Byte arrays not supported for non-'ay'"
539
u" signature %r" % signature)
501
540
def decorator(func):
502
541
func._dbus_is_property = True
503
542
func._dbus_interface = dbus_interface
589
628
if prop._dbus_access == u"read":
590
629
raise DBusPropertyAccessException(property_name)
591
630
if prop._dbus_get_args_options[u"byte_arrays"]:
631
# The byte_arrays option is not supported yet on
632
# signatures other than "ay".
633
if prop._dbus_signature != u"ay":
634
raise ValueError
592
635
value = dbus.ByteArray(''.join(unichr(byte)
593
636
for byte in value))
594
637
prop(value)
627
670
"""
628
671
xmlstring = dbus.service.Object.Introspect(self, object_path,
629
672
connection)
630
document = xml.dom.minidom.parseString(xmlstring)
631
del xmlstring
632
def make_tag(document, name, prop):
633
e = document.createElement(u"property")
634
e.setAttribute(u"name", name)
635
e.setAttribute(u"type", prop._dbus_signature)
636
e.setAttribute(u"access", prop._dbus_access)
637
return e
638
for if_tag in document.getElementsByTagName(u"interface"):
639
for tag in (make_tag(document, name, prop)
640
for name, prop
641
in self._get_all_dbus_properties()
642
if prop._dbus_interface
643
== if_tag.getAttribute(u"name")):
644
if_tag.appendChild(tag)
645
# Add the names to the return values for the
646
# "org.freedesktop.DBus.Properties" methods
647
if (if_tag.getAttribute(u"name")
648
== u"org.freedesktop.DBus.Properties"):
649
for cn in if_tag.getElementsByTagName(u"method"):
650
if cn.getAttribute(u"name") == u"Get":
651
for arg in cn.getElementsByTagName(u"arg"):
652
if (arg.getAttribute(u"direction")
653
== u"out"):
654
arg.setAttribute(u"name", u"value")
655
elif cn.getAttribute(u"name") == u"GetAll":
656
for arg in cn.getElementsByTagName(u"arg"):
657
if (arg.getAttribute(u"direction")
658
== u"out"):
659
arg.setAttribute(u"name", u"props")
660
xmlstring = document.toxml(u"utf-8")
661
document.unlink()
673
try:
674
document = xml.dom.minidom.parseString(xmlstring)
675
def make_tag(document, name, prop):
676
e = document.createElement(u"property")
677
e.setAttribute(u"name", name)
678
e.setAttribute(u"type", prop._dbus_signature)
679
e.setAttribute(u"access", prop._dbus_access)
680
return e
681
for if_tag in document.getElementsByTagName(u"interface"):
682
for tag in (make_tag(document, name, prop)
683
for name, prop
684
in self._get_all_dbus_properties()
685
if prop._dbus_interface
686
== if_tag.getAttribute(u"name")):
687
if_tag.appendChild(tag)
688
# Add the names to the return values for the
689
# "org.freedesktop.DBus.Properties" methods
690
if (if_tag.getAttribute(u"name")
691
== u"org.freedesktop.DBus.Properties"):
692
for cn in if_tag.getElementsByTagName(u"method"):
693
if cn.getAttribute(u"name") == u"Get":
694
for arg in cn.getElementsByTagName(u"arg"):
695
if (arg.getAttribute(u"direction")
696
== u"out"):
697
arg.setAttribute(u"name", u"value")
698
elif cn.getAttribute(u"name") == u"GetAll":
699
for arg in cn.getElementsByTagName(u"arg"):
700
if (arg.getAttribute(u"direction")
701
== u"out"):
702
arg.setAttribute(u"name", u"props")
703
xmlstring = document.toxml(u"utf-8")
704
document.unlink()
705
except (AttributeError, xml.dom.DOMException,
706
xml.parsers.expat.ExpatError), error:
707
logger.error(u"Failed to override Introspection method",
708
error)
662
709
return xmlstring
663
710
664
711
669
716
dbus_object_path: dbus.ObjectPath
670
717
bus: dbus.SystemBus()
671
718
"""
719
720
runtime_expansions = (Client.runtime_expansions
721
+ (u"dbus_object_path",))
722
672
723
# dbus.service.Object doesn't use super(), so we can't either.
673
724
674
725
def __init__(self, bus = None, *args, **kwargs):
726
self._approvals_pending = 0
675
727
self.bus = bus
676
728
Client.__init__(self, *args, **kwargs)
677
729
# Only now, when this client is initialized, can it show up on
678
730
# the D-Bus
731
client_object_name = unicode(self.name).translate(
732
{ord(u"."): ord(u"_"),
733
ord(u"-"): ord(u"_")})
679
734
self.dbus_object_path = (dbus.ObjectPath
680
(u"/clients/"
681
+ self.name.replace(u".", u"_")))
735
(u"/clients/" + client_object_name))
682
736
DBusObjectWithProperties.__init__(self, self.bus,
683
737
self.dbus_object_path)
738
739
def _get_approvals_pending(self):
740
return self._approvals_pending
741
def _set_approvals_pending(self, value):
742
old_value = self._approvals_pending
743
self._approvals_pending = value
744
bval = bool(value)
745
if (hasattr(self, "dbus_object_path")
746
and bval is not bool(old_value)):
747
dbus_bool = dbus.Boolean(bval, variant_level=1)
748
self.PropertyChanged(dbus.String(u"ApprovalPending"),
749
dbus_bool)
750
751
approvals_pending = property(_get_approvals_pending,
752
_set_approvals_pending)
753
del _get_approvals_pending, _set_approvals_pending
684
754
685
755
@staticmethod
686
756
def _datetime_to_dbus(dt, variant_level=0):
693
763
r = Client.enable(self)
694
764
if oldstate != self.enabled:
695
765
# Emit D-Bus signals
696
self.PropertyChanged(dbus.String(u"enabled"),
766
self.PropertyChanged(dbus.String(u"Enabled"),
697
767
dbus.Boolean(True, variant_level=1))
698
768
self.PropertyChanged(
699
dbus.String(u"last_enabled"),
769
dbus.String(u"LastEnabled"),
700
770
self._datetime_to_dbus(self.last_enabled,
701
771
variant_level=1))
702
772
return r
703
773
704
def disable(self, signal = True):
774
def disable(self, quiet = False):
705
775
oldstate = getattr(self, u"enabled", False)
706
r = Client.disable(self)
707
if signal and oldstate != self.enabled:
776
r = Client.disable(self, quiet=quiet)
777
if not quiet and oldstate != self.enabled:
708
778
# Emit D-Bus signal
709
self.PropertyChanged(dbus.String(u"enabled"),
779
self.PropertyChanged(dbus.String(u"Enabled"),
710
780
dbus.Boolean(False, variant_level=1))
711
781
return r
712
782
724
794
self.checker_callback_tag = None
725
795
self.checker = None
726
796
# Emit D-Bus signal
727
self.PropertyChanged(dbus.String(u"checker_running"),
797
self.PropertyChanged(dbus.String(u"CheckerRunning"),
728
798
dbus.Boolean(False, variant_level=1))
729
799
if os.WIFEXITED(condition):
730
800
exitstatus = os.WEXITSTATUS(condition)
745
815
r = Client.checked_ok(self, *args, **kwargs)
746
816
# Emit D-Bus signal
747
817
self.PropertyChanged(
748
dbus.String(u"last_checked_ok"),
818
dbus.String(u"LastCheckedOK"),
749
819
(self._datetime_to_dbus(self.last_checked_ok,
750
820
variant_level=1)))
751
821
return r
752
822
823
def need_approval(self, *args, **kwargs):
824
r = Client.need_approval(self, *args, **kwargs)
825
# Emit D-Bus signal
826
self.PropertyChanged(
827
dbus.String(u"LastApprovalRequest"),
828
(self._datetime_to_dbus(self.last_approval_request,
829
variant_level=1)))
830
return r
831
753
832
def start_checker(self, *args, **kwargs):
754
833
old_checker = self.checker
755
834
if self.checker is not None:
763
842
# Emit D-Bus signal
764
843
self.CheckerStarted(self.current_checker_command)
765
844
self.PropertyChanged(
766
dbus.String(u"checker_running"),
845
dbus.String(u"CheckerRunning"),
767
846
dbus.Boolean(True, variant_level=1))
768
847
return r
769
848
772
851
r = Client.stop_checker(self, *args, **kwargs)
773
852
if (old_checker is not None
774
853
and getattr(self, u"checker", None) is None):
775
self.PropertyChanged(dbus.String(u"checker_running"),
854
self.PropertyChanged(dbus.String(u"CheckerRunning"),
776
855
dbus.Boolean(False, variant_level=1))
777
856
return r
778
779
## D-Bus methods & signals
857
858
def _reset_approved(self):
859
self._approved = None
860
return False
861
862
def approve(self, value=True):
863
self.send_changedstate()
864
self._approved = value
865
gobject.timeout_add(self._timedelta_to_milliseconds
866
(self.approval_duration),
867
self._reset_approved)
868
869
870
## D-Bus methods, signals & properties
780
871
_interface = u"se.bsnet.fukt.Mandos.Client"
781
872
782
# CheckedOK - method
783
@dbus.service.method(_interface)
784
def CheckedOK(self):
785
return self.checked_ok()
873
## Signals
786
874
787
875
# CheckerCompleted - signal
788
876
@dbus.service.signal(_interface, signature=u"nxs")
802
890
"D-Bus signal"
803
891
pass
804
892
805
# ReceivedSecret - signal
893
# GotSecret - signal
806
894
@dbus.service.signal(_interface)
807
def ReceivedSecret(self):
808
"D-Bus signal"
895
def GotSecret(self):
896
"""D-Bus signal
897
Is sent after a successful transfer of secret from the Mandos
898
server to mandos-client
899
"""
809
900
pass
810
901
811
902
# Rejected - signal
812
@dbus.service.signal(_interface)
813
def Rejected(self):
903
@dbus.service.signal(_interface, signature=u"s")
904
def Rejected(self, reason):
814
905
"D-Bus signal"
815
906
pass
816
907
908
# NeedApproval - signal
909
@dbus.service.signal(_interface, signature=u"tb")
910
def NeedApproval(self, timeout, default):
911
"D-Bus signal"
912
return self.need_approval()
913
914
## Methods
915
916
# Approve - method
917
@dbus.service.method(_interface, in_signature=u"b")
918
def Approve(self, value):
919
self.approve(value)
920
921
# CheckedOK - method
922
@dbus.service.method(_interface)
923
def CheckedOK(self):
924
return self.checked_ok()
925
817
926
# Enable - method
818
927
@dbus.service.method(_interface)
819
928
def Enable(self):
837
946
def StopChecker(self):
838
947
self.stop_checker()
839
948
840
# name - property
949
## Properties
950
951
# ApprovalPending - property
952
@dbus_service_property(_interface, signature=u"b", access=u"read")
953
def ApprovalPending_dbus_property(self):
954
return dbus.Boolean(bool(self.approvals_pending))
955
956
# ApprovedByDefault - property
957
@dbus_service_property(_interface, signature=u"b",
958
access=u"readwrite")
959
def ApprovedByDefault_dbus_property(self, value=None):
960
if value is None: # get
961
return dbus.Boolean(self.approved_by_default)
962
self.approved_by_default = bool(value)
963
# Emit D-Bus signal
964
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
965
dbus.Boolean(value, variant_level=1))
966
967
# ApprovalDelay - property
968
@dbus_service_property(_interface, signature=u"t",
969
access=u"readwrite")
970
def ApprovalDelay_dbus_property(self, value=None):
971
if value is None: # get
972
return dbus.UInt64(self.approval_delay_milliseconds())
973
self.approval_delay = datetime.timedelta(0, 0, 0, value)
974
# Emit D-Bus signal
975
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
976
dbus.UInt64(value, variant_level=1))
977
978
# ApprovalDuration - property
979
@dbus_service_property(_interface, signature=u"t",
980
access=u"readwrite")
981
def ApprovalDuration_dbus_property(self, value=None):
982
if value is None: # get
983
return dbus.UInt64(self._timedelta_to_milliseconds(
984
self.approval_duration))
985
self.approval_duration = datetime.timedelta(0, 0, 0, value)
986
# Emit D-Bus signal
987
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
988
dbus.UInt64(value, variant_level=1))
989
990
# Name - property
841
991
@dbus_service_property(_interface, signature=u"s", access=u"read")
842
def name_dbus_property(self):
992
def Name_dbus_property(self):
843
993
return dbus.String(self.name)
844
994
845
# fingerprint - property
995
# Fingerprint - property
846
996
@dbus_service_property(_interface, signature=u"s", access=u"read")
847
def fingerprint_dbus_property(self):
997
def Fingerprint_dbus_property(self):
848
998
return dbus.String(self.fingerprint)
849
999
850
# host - property
1000
# Host - property
851
1001
@dbus_service_property(_interface, signature=u"s",
852
1002
access=u"readwrite")
853
def host_dbus_property(self, value=None):
1003
def Host_dbus_property(self, value=None):
854
1004
if value is None: # get
855
1005
return dbus.String(self.host)
856
1006
self.host = value
857
1007
# Emit D-Bus signal
858
self.PropertyChanged(dbus.String(u"host"),
1008
self.PropertyChanged(dbus.String(u"Host"),
859
1009
dbus.String(value, variant_level=1))
860
1010
861
# created - property
1011
# Created - property
862
1012
@dbus_service_property(_interface, signature=u"s", access=u"read")
863
def created_dbus_property(self):
1013
def Created_dbus_property(self):
864
1014
return dbus.String(self._datetime_to_dbus(self.created))
865
1015
866
# last_enabled - property
1016
# LastEnabled - property
867
1017
@dbus_service_property(_interface, signature=u"s", access=u"read")
868
def last_enabled_dbus_property(self):
1018
def LastEnabled_dbus_property(self):
869
1019
if self.last_enabled is None:
870
1020
return dbus.String(u"")
871
1021
return dbus.String(self._datetime_to_dbus(self.last_enabled))
872
1022
873
# enabled - property
1023
# Enabled - property
874
1024
@dbus_service_property(_interface, signature=u"b",
875
1025
access=u"readwrite")
876
def enabled_dbus_property(self, value=None):
1026
def Enabled_dbus_property(self, value=None):
877
1027
if value is None: # get
878
1028
return dbus.Boolean(self.enabled)
879
1029
if value:
881
1031
else:
882
1032
self.disable()
883
1033
884
# last_checked_ok - property
1034
# LastCheckedOK - property
885
1035
@dbus_service_property(_interface, signature=u"s",
886
1036
access=u"readwrite")
887
def last_checked_ok_dbus_property(self, value=None):
1037
def LastCheckedOK_dbus_property(self, value=None):
888
1038
if value is not None:
889
1039
self.checked_ok()
890
1040
return
893
1043
return dbus.String(self._datetime_to_dbus(self
894
1044
.last_checked_ok))
895
1045
896
# timeout - property
1046
# LastApprovalRequest - property
1047
@dbus_service_property(_interface, signature=u"s", access=u"read")
1048
def LastApprovalRequest_dbus_property(self):
1049
if self.last_approval_request is None:
1050
return dbus.String(u"")
1051
return dbus.String(self.
1052
_datetime_to_dbus(self
1053
.last_approval_request))
1054
1055
# Timeout - property
897
1056
@dbus_service_property(_interface, signature=u"t",
898
1057
access=u"readwrite")
899
def timeout_dbus_property(self, value=None):
1058
def Timeout_dbus_property(self, value=None):
900
1059
if value is None: # get
901
1060
return dbus.UInt64(self.timeout_milliseconds())
902
1061
self.timeout = datetime.timedelta(0, 0, 0, value)
903
1062
# Emit D-Bus signal
904
self.PropertyChanged(dbus.String(u"timeout"),
1063
self.PropertyChanged(dbus.String(u"Timeout"),
905
1064
dbus.UInt64(value, variant_level=1))
906
1065
if getattr(self, u"disable_initiator_tag", None) is None:
907
1066
return
921
1080
self.disable_initiator_tag = (gobject.timeout_add
922
1081
(time_to_die, self.disable))
923
1082
924
# interval - property
1083
# Interval - property
925
1084
@dbus_service_property(_interface, signature=u"t",
926
1085
access=u"readwrite")
927
def interval_dbus_property(self, value=None):
1086
def Interval_dbus_property(self, value=None):
928
1087
if value is None: # get
929
1088
return dbus.UInt64(self.interval_milliseconds())
930
1089
self.interval = datetime.timedelta(0, 0, 0, value)
931
1090
# Emit D-Bus signal
932
self.PropertyChanged(dbus.String(u"interval"),
1091
self.PropertyChanged(dbus.String(u"Interval"),
933
1092
dbus.UInt64(value, variant_level=1))
934
1093
if getattr(self, u"checker_initiator_tag", None) is None:
935
1094
return
939
1098
(value, self.start_checker))
940
1099
self.start_checker() # Start one now, too
941
1100
942
# checker - property
1101
# Checker - property
943
1102
@dbus_service_property(_interface, signature=u"s",
944
1103
access=u"readwrite")
945
def checker_dbus_property(self, value=None):
1104
def Checker_dbus_property(self, value=None):
946
1105
if value is None: # get
947
1106
return dbus.String(self.checker_command)
948
1107
self.checker_command = value
949
1108
# Emit D-Bus signal
950
self.PropertyChanged(dbus.String(u"checker"),
1109
self.PropertyChanged(dbus.String(u"Checker"),
951
1110
dbus.String(self.checker_command,
952
1111
variant_level=1))
953
1112
954
# checker_running - property
1113
# CheckerRunning - property
955
1114
@dbus_service_property(_interface, signature=u"b",
956
1115
access=u"readwrite")
957
def checker_running_dbus_property(self, value=None):
1116
def CheckerRunning_dbus_property(self, value=None):
958
1117
if value is None: # get
959
1118
return dbus.Boolean(self.checker is not None)
960
1119
if value:
962
1121
else:
963
1122
self.stop_checker()
964
1123
965
# object_path - property
1124
# ObjectPath - property
966
1125
@dbus_service_property(_interface, signature=u"o", access=u"read")
967
def object_path_dbus_property(self):
1126
def ObjectPath_dbus_property(self):
968
1127
return self.dbus_object_path # is already a dbus.ObjectPath
969
1128
970
# secret = property
1129
# Secret = property
971
1130
@dbus_service_property(_interface, signature=u"ay",
972
1131
access=u"write", byte_arrays=True)
973
def secret_dbus_property(self, value):
1132
def Secret_dbus_property(self, value):
974
1133
self.secret = str(value)
975
1134
976
1135
del _interface
977
1136
978
1137
1138
class ProxyClient(object):
1139
def __init__(self, child_pipe, fpr, address):
1140
self._pipe = child_pipe
1141
self._pipe.send(('init', fpr, address))
1142
if not self._pipe.recv():
1143
raise KeyError()
1144
1145
def __getattribute__(self, name):
1146
if(name == '_pipe'):
1147
return super(ProxyClient, self).__getattribute__(name)
1148
self._pipe.send(('getattr', name))
1149
data = self._pipe.recv()
1150
if data[0] == 'data':
1151
return data[1]
1152
if data[0] == 'function':
1153
def func(*args, **kwargs):
1154
self._pipe.send(('funcall', name, args, kwargs))
1155
return self._pipe.recv()[1]
1156
return func
1157
1158
def __setattr__(self, name, value):
1159
if(name == '_pipe'):
1160
return super(ProxyClient, self).__setattr__(name, value)
1161
self._pipe.send(('setattr', name, value))
1162
1163
979
1164
class ClientHandler(socketserver.BaseRequestHandler, object):
980
1165
"""A class to handle client connections.
981
1166
983
1168
Note: This will run in its own forked process."""
984
1169
985
1170
def handle(self):
986
logger.info(u"TCP connection from: %s",
987
unicode(self.client_address))
988
logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])
989
# Open IPC pipe to parent process
990
with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:
1171
with contextlib.closing(self.server.child_pipe) as child_pipe:
1172
logger.info(u"TCP connection from: %s",
1173
unicode(self.client_address))
1174
logger.debug(u"Pipe FD: %d",
1175
self.server.child_pipe.fileno())
1176
991
1177
session = (gnutls.connection
992
1178
.ClientSession(self.request,
993
1179
gnutls.connection
994
1180
.X509Credentials()))
995
996
line = self.request.makefile().readline()
997
logger.debug(u"Protocol version: %r", line)
998
try:
999
if int(line.strip().split()[0]) > 1:
1000
raise RuntimeError
1001
except (ValueError, IndexError, RuntimeError), error:
1002
logger.error(u"Unknown protocol version: %s", error)
1003
return
1004
1181
1005
1182
# Note: gnutls.connection.X509Credentials is really a
1006
1183
# generic GnuTLS certificate credentials object so long as
1007
1184
# no X.509 keys are added to it. Therefore, we can use it
1008
1185
# here despite using OpenPGP certificates.
1009
1186
1010
1187
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1011
1188
# u"+AES-256-CBC", u"+SHA1",
1012
1189
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1018
1195
(gnutls.library.functions
1019
1196
.gnutls_priority_set_direct(session._c_object,
1020
1197
priority, None))
1021
1198
1199
# Start communication using the Mandos protocol
1200
# Get protocol number
1201
line = self.request.makefile().readline()
1202
logger.debug(u"Protocol version: %r", line)
1203
try:
1204
if int(line.strip().split()[0]) > 1:
1205
raise RuntimeError
1206
except (ValueError, IndexError, RuntimeError), error:
1207
logger.error(u"Unknown protocol version: %s", error)
1208
return
1209
1210
# Start GnuTLS connection
1022
1211
try:
1023
1212
session.handshake()
1024
1213
except gnutls.errors.GNUTLSError, error:
1027
1216
# established. Just abandon the request.
1028
1217
return
1029
1218
logger.debug(u"Handshake succeeded")
1219
1220
approval_required = False
1030
1221
try:
1031
fpr = self.fingerprint(self.peer_certificate(session))
1032
except (TypeError, gnutls.errors.GNUTLSError), error:
1033
logger.warning(u"Bad certificate: %s", error)
1034
session.bye()
1035
return
1036
logger.debug(u"Fingerprint: %s", fpr)
1222
try:
1223
fpr = self.fingerprint(self.peer_certificate
1224
(session))
1225
except (TypeError, gnutls.errors.GNUTLSError), error:
1226
logger.warning(u"Bad certificate: %s", error)
1227
return
1228
logger.debug(u"Fingerprint: %s", fpr)
1229
1230
try:
1231
client = ProxyClient(child_pipe, fpr,
1232
self.client_address)
1233
except KeyError:
1234
return
1235
1236
if client.approval_delay:
1237
delay = client.approval_delay
1238
client.approvals_pending += 1
1239
approval_required = True
1240
1241
while True:
1242
if not client.enabled:
1243
logger.warning(u"Client %s is disabled",
1244
client.name)
1245
if self.server.use_dbus:
1246
# Emit D-Bus signal
1247
client.Rejected("Disabled")
1248
return
1249
1250
if client._approved or not client.approval_delay:
1251
#We are approved or approval is disabled
1252
break
1253
elif client._approved is None:
1254
logger.info(u"Client %s needs approval",
1255
client.name)
1256
if self.server.use_dbus:
1257
# Emit D-Bus signal
1258
client.NeedApproval(
1259
client.approval_delay_milliseconds(),
1260
client.approved_by_default)
1261
else:
1262
logger.warning(u"Client %s was not approved",
1263
client.name)
1264
if self.server.use_dbus:
1265
# Emit D-Bus signal
1266
client.Rejected("Denied")
1267
return
1268
1269
#wait until timeout or approved
1270
#x = float(client._timedelta_to_milliseconds(delay))
1271
time = datetime.datetime.now()
1272
client.changedstate.acquire()
1273
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1274
client.changedstate.release()
1275
time2 = datetime.datetime.now()
1276
if (time2 - time) >= delay:
1277
if not client.approved_by_default:
1278
logger.warning("Client %s timed out while"
1279
" waiting for approval",
1280
client.name)
1281
if self.server.use_dbus:
1282
# Emit D-Bus signal
1283
client.Rejected("Approval timed out")
1284
return
1285
else:
1286
break
1287
else:
1288
delay -= time2 - time
1289
1290
sent_size = 0
1291
while sent_size < len(client.secret):
1292
try:
1293
sent = session.send(client.secret[sent_size:])
1294
except (gnutls.errors.GNUTLSError), error:
1295
logger.warning("gnutls send failed")
1296
return
1297
logger.debug(u"Sent: %d, remaining: %d",
1298
sent, len(client.secret)
1299
- (sent_size + sent))
1300
sent_size += sent
1301
1302
logger.info(u"Sending secret to %s", client.name)
1303
# bump the timeout as if seen
1304
client.checked_ok()
1305
if self.server.use_dbus:
1306
# Emit D-Bus signal
1307
client.GotSecret()
1037
1308
1038
for c in self.server.clients:
1039
if c.fingerprint == fpr:
1040
client = c
1041
break
1042
else:
1043
ipc.write(u"NOTFOUND %s %s\n"
1044
% (fpr, unicode(self.client_address)))
1045
session.bye()
1046
return
1047
# Have to check if client.still_valid(), since it is
1048
# possible that the client timed out while establishing
1049
# the GnuTLS session.
1050
if not client.still_valid():
1051
ipc.write(u"INVALID %s\n" % client.name)
1052
session.bye()
1053
return
1054
ipc.write(u"SENDING %s\n" % client.name)
1055
sent_size = 0
1056
while sent_size < len(client.secret):
1057
sent = session.send(client.secret[sent_size:])
1058
logger.debug(u"Sent: %d, remaining: %d",
1059
sent, len(client.secret)
1060
- (sent_size + sent))
1061
sent_size += sent
1062
session.bye()
1309
finally:
1310
if approval_required:
1311
client.approvals_pending -= 1
1312
try:
1313
session.bye()
1314
except (gnutls.errors.GNUTLSError), error:
1315
logger.warning("GnuTLS bye failed")
1063
1316
1064
1317
@staticmethod
1065
1318
def peer_certificate(session):
1125
1378
return hex_fpr
1126
1379
1127
1380
1128
class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):
1129
"""Like socketserver.ForkingMixIn, but also pass a pipe."""
1381
class MultiprocessingMixIn(object):
1382
"""Like socketserver.ThreadingMixIn, but with multiprocessing"""
1383
def sub_process_main(self, request, address):
1384
try:
1385
self.finish_request(request, address)
1386
except:
1387
self.handle_error(request, address)
1388
self.close_request(request)
1389
1390
def process_request(self, request, address):
1391
"""Start a new process to process the request."""
1392
multiprocessing.Process(target = self.sub_process_main,
1393
args = (request, address)).start()
1394
1395
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1396
""" adds a pipe to the MixIn """
1130
1397
def process_request(self, request, client_address):
1131
1398
"""Overrides and wraps the original process_request().
1132
1399
1133
1400
This function creates a new pipe in self.pipe
1134
1401
"""
1135
self.pipe = os.pipe()
1136
super(ForkingMixInWithPipe,
1402
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1403
1404
super(MultiprocessingMixInWithPipe,
1137
1405
self).process_request(request, client_address)
1138
os.close(self.pipe[1]) # close write end
1139
self.add_pipe(self.pipe[0])
1140
def add_pipe(self, pipe):
1406
self.child_pipe.close()
1407
self.add_pipe(parent_pipe)
1408
1409
def add_pipe(self, parent_pipe):
1141
1410
"""Dummy function; override as necessary"""
1142
os.close(pipe)
1143
1144
1145
class IPv6_TCPServer(ForkingMixInWithPipe,
1411
pass
1412
1413
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1146
1414
socketserver.TCPServer, object):
1147
1415
"""IPv6-capable TCP server. Accepts 'None' as address and/or port
1148
1416
1233
1501
return socketserver.TCPServer.server_activate(self)
1234
1502
def enable(self):
1235
1503
self.enabled = True
1236
def add_pipe(self, pipe):
1504
def add_pipe(self, parent_pipe):
1237
1505
# Call "handle_ipc" for both data and EOF events
1238
gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,
1239
self.handle_ipc)
1240
def handle_ipc(self, source, condition, file_objects={}):
1506
gobject.io_add_watch(parent_pipe.fileno(),
1507
gobject.IO_IN | gobject.IO_HUP,
1508
functools.partial(self.handle_ipc,
1509
parent_pipe = parent_pipe))
1510
1511
def handle_ipc(self, source, condition, parent_pipe=None,
1512
client_object=None):
1241
1513
condition_names = {
1242
1514
gobject.IO_IN: u"IN", # There is data to read.
1243
1515
gobject.IO_OUT: u"OUT", # Data can be written (without
1252
1524
for cond, name in
1253
1525
condition_names.iteritems()
1254
1526
if cond & condition)
1255
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1256
conditions_string)
1257
1258
# Turn the pipe file descriptor into a Python file object
1259
if source not in file_objects:
1260
file_objects[source] = os.fdopen(source, u"r", 1)
1261
1262
# Read a line from the file object
1263
cmdline = file_objects[source].readline()
1264
if not cmdline: # Empty line means end of file
1265
# close the IPC pipe
1266
file_objects[source].close()
1267
del file_objects[source]
1268
1269
# Stop calling this function
1270
return False
1271
1272
logger.debug(u"IPC command: %r", cmdline)
1273
1274
# Parse and act on command
1275
cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)
1276
1277
if cmd == u"NOTFOUND":
1278
logger.warning(u"Client not found for fingerprint: %s",
1279
args)
1280
if self.use_dbus:
1281
# Emit D-Bus signal
1282
mandos_dbus_service.ClientNotFound(args)
1283
elif cmd == u"INVALID":
1284
for client in self.clients:
1285
if client.name == args:
1286
logger.warning(u"Client %s is invalid", args)
1287
if self.use_dbus:
1288
# Emit D-Bus signal
1289
client.Rejected()
1290
break
1291
else:
1292
logger.error(u"Unknown client %s is invalid", args)
1293
elif cmd == u"SENDING":
1294
for client in self.clients:
1295
if client.name == args:
1296
logger.info(u"Sending secret to %s", client.name)
1297
client.checked_ok()
1298
if self.use_dbus:
1299
# Emit D-Bus signal
1300
client.ReceivedSecret()
1301
break
1302
else:
1303
logger.error(u"Sending secret to unknown client %s",
1304
args)
1305
else:
1306
logger.error(u"Unknown IPC command: %r", cmdline)
1307
1308
# Keep calling this function
1527
# error or the other end of multiprocessing.Pipe has closed
1528
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1529
return False
1530
1531
# Read a request from the child
1532
request = parent_pipe.recv()
1533
command = request[0]
1534
1535
if command == 'init':
1536
fpr = request[1]
1537
address = request[2]
1538
1539
for c in self.clients:
1540
if c.fingerprint == fpr:
1541
client = c
1542
break
1543
else:
1544
logger.warning(u"Client not found for fingerprint: %s, ad"
1545
u"dress: %s", fpr, address)
1546
if self.use_dbus:
1547
# Emit D-Bus signal
1548
mandos_dbus_service.ClientNotFound(fpr, address[0])
1549
parent_pipe.send(False)
1550
return False
1551
1552
gobject.io_add_watch(parent_pipe.fileno(),
1553
gobject.IO_IN | gobject.IO_HUP,
1554
functools.partial(self.handle_ipc,
1555
parent_pipe = parent_pipe,
1556
client_object = client))
1557
parent_pipe.send(True)
1558
# remove the old hook in favor of the new above hook on same fileno
1559
return False
1560
if command == 'funcall':
1561
funcname = request[1]
1562
args = request[2]
1563
kwargs = request[3]
1564
1565
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1566
1567
if command == 'getattr':
1568
attrname = request[1]
1569
if callable(client_object.__getattribute__(attrname)):
1570
parent_pipe.send(('function',))
1571
else:
1572
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1573
1574
if command == 'setattr':
1575
attrname = request[1]
1576
value = request[2]
1577
setattr(client_object, attrname, value)
1578
1309
1579
return True
1310
1580
1311
1581
1341
1611
elif suffix == u"w":
1342
1612
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1343
1613
else:
1344
raise ValueError
1345
except (ValueError, IndexError):
1346
raise ValueError
1614
raise ValueError(u"Unknown suffix %r" % suffix)
1615
except (ValueError, IndexError), e:
1616
raise ValueError(e.message)
1347
1617
timevalue += delta
1348
1618
return timevalue
1349
1619
1362
1632
def if_nametoindex(interface):
1363
1633
"Get an interface index the hard way, i.e. using fcntl()"
1364
1634
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1365
with closing(socket.socket()) as s:
1635
with contextlib.closing(socket.socket()) as s:
1366
1636
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1367
1637
struct.pack(str(u"16s16x"),
1368
1638
interface))
1388
1658
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1389
1659
if not stat.S_ISCHR(os.fstat(null).st_mode):
1390
1660
raise OSError(errno.ENODEV,
1391
u"/dev/null not a character device")
1661
u"%s not a character device"
1662
% os.path.devnull)
1392
1663
os.dup2(null, sys.stdin.fileno())
1393
1664
os.dup2(null, sys.stdout.fileno())
1394
1665
os.dup2(null, sys.stderr.fileno())
1413
1684
parser.add_option("--debug", action=u"store_true",
1414
1685
help=u"Debug mode; run in foreground and log to"
1415
1686
u" terminal")
1687
parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",
1688
help=u"Debug level for stdout output")
1416
1689
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1417
1690
u" priority string (see GnuTLS documentation)")
1418
1691
parser.add_option("--servicename", type=u"string",
1443
1716
u"servicename": u"Mandos",
1444
1717
u"use_dbus": u"True",
1445
1718
u"use_ipv6": u"True",
1719
u"debuglevel": u"",
1446
1720
}
1447
1721
1448
1722
# Parse config file for server-global settings
1465
1739
# options, if set.
1466
1740
for option in (u"interface", u"address", u"port", u"debug",
1467
1741
u"priority", u"servicename", u"configdir",
1468
u"use_dbus", u"use_ipv6"):
1742
u"use_dbus", u"use_ipv6", u"debuglevel"):
1469
1743
value = getattr(options, option)
1470
1744
if value is not None:
1471
1745
server_settings[option] = value
1480
1754
1481
1755
# For convenience
1482
1756
debug = server_settings[u"debug"]
1757
debuglevel = server_settings[u"debuglevel"]
1483
1758
use_dbus = server_settings[u"use_dbus"]
1484
1759
use_ipv6 = server_settings[u"use_ipv6"]
1485
1486
if not debug:
1487
syslogger.setLevel(logging.WARNING)
1488
console.setLevel(logging.WARNING)
1489
1760
1490
1761
if server_settings[u"servicename"] != u"Mandos":
1491
1762
syslogger.setFormatter(logging.Formatter
1492
1763
(u'Mandos (%s) [%%(process)d]:'
1498
1769
u"interval": u"5m",
1499
1770
u"checker": u"fping -q -- %%(host)s",
1500
1771
u"host": u"",
1772
u"approval_delay": u"0s",
1773
u"approval_duration": u"1s",
1501
1774
}
1502
1775
client_config = configparser.SafeConfigParser(client_defaults)
1503
1776
client_config.read(os.path.join(server_settings[u"configdir"],
1509
1782
tcp_server = MandosServer((server_settings[u"address"],
1510
1783
server_settings[u"port"]),
1511
1784
ClientHandler,
1512
interface=server_settings[u"interface"],
1785
interface=(server_settings[u"interface"]
1786
or None),
1513
1787
use_ipv6=use_ipv6,
1514
1788
gnutls_priority=
1515
1789
server_settings[u"priority"],
1516
1790
use_dbus=use_dbus)
1517
pidfilename = u"/var/run/mandos.pid"
1518
try:
1519
pidfile = open(pidfilename, u"w")
1520
except IOError:
1521
logger.error(u"Could not open file %r", pidfilename)
1791
if not debug:
1792
pidfilename = u"/var/run/mandos.pid"
1793
try:
1794
pidfile = open(pidfilename, u"w")
1795
except IOError:
1796
logger.error(u"Could not open file %r", pidfilename)
1522
1797
1523
1798
try:
1524
1799
uid = pwd.getpwnam(u"_mandos").pw_uid
1541
1816
if error[0] != errno.EPERM:
1542
1817
raise error
1543
1818
1544
# Enable all possible GnuTLS debugging
1819
if not debug and not debuglevel:
1820
syslogger.setLevel(logging.WARNING)
1821
console.setLevel(logging.WARNING)
1822
if debuglevel:
1823
level = getattr(logging, debuglevel.upper())
1824
syslogger.setLevel(level)
1825
console.setLevel(level)
1826
1545
1827
if debug:
1828
# Enable all possible GnuTLS debugging
1829
1546
1830
# "Use a log level over 10 to enable all debugging options."
1547
1831
# - GnuTLS manual
1548
1832
gnutls.library.functions.gnutls_global_set_log_level(11)
1553
1837
1554
1838
(gnutls.library.functions
1555
1839
.gnutls_global_set_log_function(debug_gnutls))
1840
1841
# Redirect stdin so all checkers get /dev/null
1842
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1843
os.dup2(null, sys.stdin.fileno())
1844
if null > 2:
1845
os.close(null)
1846
else:
1847
# No console logging
1848
logger.removeHandler(console)
1849
1850
# Need to fork before connecting to D-Bus
1851
if not debug:
1852
# Close all input and output, do double fork, etc.
1853
daemon()
1556
1854
1557
1855
global main_loop
1558
1856
# From the Avahi example code
1561
1859
bus = dbus.SystemBus()
1562
1860
# End of Avahi example code
1563
1861
if use_dbus:
1564
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)
1862
try:
1863
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
1864
bus, do_not_queue=True)
1865
except dbus.exceptions.NameExistsException, e:
1866
logger.error(unicode(e) + u", disabling D-Bus")
1867
use_dbus = False
1868
server_settings[u"use_dbus"] = False
1869
tcp_server.use_dbus = False
1565
1870
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1566
1871
service = AvahiService(name = server_settings[u"servicename"],
1567
1872
servicetype = u"_mandos._tcp",
1570
1875
service.interface = (if_nametoindex
1571
1876
(str(server_settings[u"interface"])))
1572
1877
1878
global multiprocessing_manager
1879
multiprocessing_manager = multiprocessing.Manager()
1880
1573
1881
client_class = Client
1574
1882
if use_dbus:
1575
1883
client_class = functools.partial(ClientDBus, bus = bus)
1884
def client_config_items(config, section):
1885
special_settings = {
1886
"approved_by_default":
1887
lambda: config.getboolean(section,
1888
"approved_by_default"),
1889
}
1890
for name, value in config.items(section):
1891
try:
1892
yield (name, special_settings[name]())
1893
except KeyError:
1894
yield (name, value)
1895
1576
1896
tcp_server.clients.update(set(
1577
1897
client_class(name = section,
1578
config= dict(client_config.items(section)))
1898
config= dict(client_config_items(
1899
client_config, section)))
1579
1900
for section in client_config.sections()))
1580
1901
if not tcp_server.clients:
1581
1902
logger.warning(u"No clients defined")
1582
1583
if debug:
1584
# Redirect stdin so all checkers get /dev/null
1585
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1586
os.dup2(null, sys.stdin.fileno())
1587
if null > 2:
1588
os.close(null)
1589
else:
1590
# No console logging
1591
logger.removeHandler(console)
1592
# Close all input and output, do double fork, etc.
1593
daemon()
1594
1595
try:
1596
with closing(pidfile):
1597
pid = os.getpid()
1598
pidfile.write(str(pid) + "\n")
1599
del pidfile
1600
except IOError:
1601
logger.error(u"Could not write to file %r with PID %d",
1602
pidfilename, pid)
1603
except NameError:
1604
# "pidfile" was never created
1605
pass
1606
del pidfilename
1607
1608
def cleanup():
1609
"Cleanup function; run on exit"
1610
service.cleanup()
1611
1903
1612
while tcp_server.clients:
1613
client = tcp_server.clients.pop()
1614
client.disable_hook = None
1615
client.disable()
1616
1617
atexit.register(cleanup)
1618
1619
1904
if not debug:
1905
try:
1906
with pidfile:
1907
pid = os.getpid()
1908
pidfile.write(str(pid) + "\n")
1909
del pidfile
1910
except IOError:
1911
logger.error(u"Could not write to file %r with PID %d",
1912
pidfilename, pid)
1913
except NameError:
1914
# "pidfile" was never created
1915
pass
1916
del pidfilename
1917
1620
1918
signal.signal(signal.SIGINT, signal.SIG_IGN)
1919
1621
1920
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1622
1921
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1623
1922
1628
1927
dbus.service.Object.__init__(self, bus, u"/")
1629
1928
_interface = u"se.bsnet.fukt.Mandos"
1630
1929
1631
@dbus.service.signal(_interface, signature=u"oa{sv}")
1632
def ClientAdded(self, objpath, properties):
1930
@dbus.service.signal(_interface, signature=u"o")
1931
def ClientAdded(self, objpath):
1633
1932
"D-Bus signal"
1634
1933
pass
1635
1934
1636
@dbus.service.signal(_interface, signature=u"s")
1637
def ClientNotFound(self, fingerprint):
1935
@dbus.service.signal(_interface, signature=u"ss")
1936
def ClientNotFound(self, fingerprint, address):
1638
1937
"D-Bus signal"
1639
1938
pass
1640
1939
1666
1965
tcp_server.clients.remove(c)
1667
1966
c.remove_from_connection()
1668
1967
# Don't signal anything except ClientRemoved
1669
c.disable(signal=False)
1968
c.disable(quiet=True)
1670
1969
# Emit D-Bus signal
1671
1970
self.ClientRemoved(object_path, c.name)
1672
1971
return
1673
raise KeyError
1972
raise KeyError(object_path)
1674
1973
1675
1974
del _interface
1676
1975
1677
1976
mandos_dbus_service = MandosDBusService()
1678
1977
1978
def cleanup():
1979
"Cleanup function; run on exit"
1980
service.cleanup()
1981
1982
while tcp_server.clients:
1983
client = tcp_server.clients.pop()
1984
if use_dbus:
1985
client.remove_from_connection()
1986
client.disable_hook = None
1987
# Don't signal anything except ClientRemoved
1988
client.disable(quiet=True)
1989
if use_dbus:
1990
# Emit D-Bus signal
1991
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
1992
client.name)
1993
1994
atexit.register(cleanup)
1995
1679
1996
for client in tcp_server.clients:
1680
1997
if use_dbus:
1681
1998
# Emit D-Bus signal
1682
mandos_dbus_service.ClientAdded(client.dbus_object_path,
1683
client.GetAll(u""))
1999
mandos_dbus_service.ClientAdded(client.dbus_object_path)
1684
2000
client.enable()
1685
2001
1686
2002
tcp_server.enable()
1704
2020
service.activate()
1705
2021
except dbus.exceptions.DBusException, error:
1706
2022
logger.critical(u"DBusException: %s", error)
2023
cleanup()
1707
2024
sys.exit(1)
1708
2025
# End of Avahi example code
1709
2026
1716
2033
main_loop.run()
1717
2034
except AvahiError, error:
1718
2035
logger.critical(u"AvahiError: %s", error)
2036
cleanup()
1719
2037
sys.exit(1)
1720
2038
except KeyboardInterrupt:
1721
2039
if debug:
1722
2040
print >> sys.stderr
1723
2041
logger.debug(u"Server received KeyboardInterrupt")
1724
2042
logger.debug(u"Server exiting")
2043
# Must run before the D-Bus bus name gets deregistered
2044
cleanup()
1725
2045
1726
2046
if __name__ == '__main__':
1727
2047
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0