To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 505.3.10
- compare with another revision
- download diff
- download tarball
- view history from revision 505.3.10
- Committer: Teddy Hogeborn
- Date: 2011-11-24 20:15:24 UTC
- mto: (505.2.8 mandos-client-network-hooks)
- mto: This revision was merged to the branch mainline in revision 525.
- Revision ID: teddy@recompile.se-20111124201524-5w9ovzpuw3drdlgf
* network-hooks.d: New directory.
* network-hooks.d/bridge: New example hook.
* network-hooks.d/bridge.conf: Config file for bridge example hook.
* network-hooks.d/bridge: New example hook.
* network-hooks.d/bridge.conf: Config file for bridge example hook.
- files added:
- debian/source
- network-hooks.d
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
# Contact the authors at <mandos@recompile.se>.
32
32
#
33
33
34
from __future__ import division, with_statement, absolute_import
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
35
36
36
37
import SocketServer as socketserver
37
38
import socket
38
import optparse
39
import argparse
39
40
import datetime
40
41
import errno
41
42
import gnutls.crypto
61
62
import functools
62
63
import cPickle as pickle
63
64
import multiprocessing
65
import types
64
66
65
67
import dbus
66
68
import dbus.service
81
83
SO_BINDTODEVICE = None
82
84
83
85
84
version = "1.0.14"
86
version = "1.4.1"
85
87
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
88
90
syslogger = (logging.handlers.SysLogHandler
89
91
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
90
address = "/dev/log"))
92
address = str("/dev/log")))
91
93
syslogger.setFormatter(logging.Formatter
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
94
96
logger.addHandler(syslogger)
95
97
96
98
console = logging.StreamHandler()
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
100
102
logger.addHandler(console)
101
103
102
104
class AvahiError(Exception):
119
121
Attributes:
120
122
interface: integer; avahi.IF_UNSPEC or an interface index.
121
123
Used to optionally bind to the specified interface.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
124
name: string; Example: 'Mandos'
125
type: string; Example: '_mandos._tcp'.
124
126
See <http://www.dns-sd.org/ServiceTypes.html>
125
127
port: integer; what port to announce
126
128
TXT: list of strings; TXT record for the service
135
137
"""
136
138
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
137
139
servicetype = None, port = None, TXT = None,
138
domain = u"", host = u"", max_renames = 32768,
140
domain = "", host = "", max_renames = 32768,
139
141
protocol = avahi.PROTO_UNSPEC, bus = None):
140
142
self.interface = interface
141
143
self.name = name
150
152
self.group = None # our entry group
151
153
self.server = None
152
154
self.bus = bus
155
self.entry_group_state_changed_match = None
153
156
def rename(self):
154
157
"""Derived from the Avahi example code"""
155
158
if self.rename_count >= self.max_renames:
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
159
logger.critical("No suitable Zeroconf service name found"
160
" after %i retries, exiting.",
158
161
self.rename_count)
159
raise AvahiServiceError(u"Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
161
logger.info(u"Changing Zeroconf service name to %r ...",
162
raise AvahiServiceError("Too many renames")
163
self.name = unicode(self.server
164
.GetAlternativeServiceName(self.name))
165
logger.info("Changing Zeroconf service name to %r ...",
162
166
self.name)
163
167
syslogger.setFormatter(logging.Formatter
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
168
('Mandos (%s) [%%(process)d]:'
169
' %%(levelname)s: %%(message)s'
166
170
% self.name))
167
171
self.remove()
168
172
try:
169
173
self.add()
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
174
except dbus.exceptions.DBusException as error:
175
logger.critical("DBusException: %s", error)
172
176
self.cleanup()
173
177
os._exit(1)
174
178
self.rename_count += 1
175
179
def remove(self):
176
180
"""Derived from the Avahi example code"""
181
if self.entry_group_state_changed_match is not None:
182
self.entry_group_state_changed_match.remove()
183
self.entry_group_state_changed_match = None
177
184
if self.group is not None:
178
185
self.group.Reset()
179
186
def add(self):
180
187
"""Derived from the Avahi example code"""
188
self.remove()
181
189
if self.group is None:
182
190
self.group = dbus.Interface(
183
191
self.bus.get_object(avahi.DBUS_NAME,
184
192
self.server.EntryGroupNew()),
185
193
avahi.DBUS_INTERFACE_ENTRY_GROUP)
186
self.group.connect_to_signal('StateChanged',
187
self
188
.entry_group_state_changed)
189
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
194
self.entry_group_state_changed_match = (
195
self.group.connect_to_signal(
196
'StateChanged', self .entry_group_state_changed))
197
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
190
198
self.name, self.type)
191
199
self.group.AddService(
192
200
self.interface,
199
207
self.group.Commit()
200
208
def entry_group_state_changed(self, state, error):
201
209
"""Derived from the Avahi example code"""
202
logger.debug(u"Avahi entry group state change: %i", state)
210
logger.debug("Avahi entry group state change: %i", state)
203
211
204
212
if state == avahi.ENTRY_GROUP_ESTABLISHED:
205
logger.debug(u"Zeroconf service established.")
213
logger.debug("Zeroconf service established.")
206
214
elif state == avahi.ENTRY_GROUP_COLLISION:
207
logger.warning(u"Zeroconf service name collision.")
215
logger.info("Zeroconf service name collision.")
208
216
self.rename()
209
217
elif state == avahi.ENTRY_GROUP_FAILURE:
210
logger.critical(u"Avahi: Error in group state changed %s",
218
logger.critical("Avahi: Error in group state changed %s",
211
219
unicode(error))
212
raise AvahiGroupError(u"State changed: %s"
220
raise AvahiGroupError("State changed: %s"
213
221
% unicode(error))
214
222
def cleanup(self):
215
223
"""Derived from the Avahi example code"""
216
224
if self.group is not None:
217
self.group.Free()
225
try:
226
self.group.Free()
227
except (dbus.exceptions.UnknownMethodException,
228
dbus.exceptions.DBusException) as e:
229
pass
218
230
self.group = None
219
def server_state_changed(self, state):
231
self.remove()
232
def server_state_changed(self, state, error=None):
220
233
"""Derived from the Avahi example code"""
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
224
self.remove()
234
logger.debug("Avahi server state change: %i", state)
235
bad_states = { avahi.SERVER_INVALID:
236
"Zeroconf server invalid",
237
avahi.SERVER_REGISTERING: None,
238
avahi.SERVER_COLLISION:
239
"Zeroconf server name collision",
240
avahi.SERVER_FAILURE:
241
"Zeroconf server failure" }
242
if state in bad_states:
243
if bad_states[state] is not None:
244
if error is None:
245
logger.error(bad_states[state])
246
else:
247
logger.error(bad_states[state] + ": %r", error)
248
self.cleanup()
225
249
elif state == avahi.SERVER_RUNNING:
226
250
self.add()
251
else:
252
if error is None:
253
logger.debug("Unknown state: %r", state)
254
else:
255
logger.debug("Unknown state: %r: %r", state, error)
227
256
def activate(self):
228
257
"""Derived from the Avahi example code"""
229
258
if self.server is None:
230
259
self.server = dbus.Interface(
231
260
self.bus.get_object(avahi.DBUS_NAME,
232
avahi.DBUS_PATH_SERVER),
261
avahi.DBUS_PATH_SERVER,
262
follow_name_owner_changes=True),
233
263
avahi.DBUS_INTERFACE_SERVER)
234
self.server.connect_to_signal(u"StateChanged",
264
self.server.connect_to_signal("StateChanged",
235
265
self.server_state_changed)
236
266
self.server_state_changed(self.server.GetState())
237
267
238
268
269
def _timedelta_to_milliseconds(td):
270
"Convert a datetime.timedelta() to milliseconds"
271
return ((td.days * 24 * 60 * 60 * 1000)
272
+ (td.seconds * 1000)
273
+ (td.microseconds // 1000))
274
239
275
class Client(object):
240
276
"""A representation of a client host served by this server.
241
277
242
278
Attributes:
243
name: string; from the config file, used in log messages and
244
D-Bus identifiers
279
_approved: bool(); 'None' if not yet approved/disapproved
280
approval_delay: datetime.timedelta(); Time to wait for approval
281
approval_duration: datetime.timedelta(); Duration of one approval
282
checker: subprocess.Popen(); a running checker process used
283
to see if the client lives.
284
'None' if no process is running.
285
checker_callback_tag: a gobject event source tag, or None
286
checker_command: string; External command which is run to check
287
if client lives. %() expansions are done at
288
runtime with vars(self) as dict, so that for
289
instance %(name)s can be used in the command.
290
checker_initiator_tag: a gobject event source tag, or None
291
created: datetime.datetime(); (UTC) object creation
292
current_checker_command: string; current running checker_command
293
disable_hook: If set, called by disable() as disable_hook(self)
294
disable_initiator_tag: a gobject event source tag, or None
295
enabled: bool()
245
296
fingerprint: string (40 or 32 hexadecimal digits); used to
246
297
uniquely identify the client
247
secret: bytestring; sent verbatim (over TLS) to client
248
298
host: string; available for use by the checker command
249
created: datetime.datetime(); (UTC) object creation
299
interval: datetime.timedelta(); How often to start a new checker
300
last_approval_request: datetime.datetime(); (UTC) or None
301
last_checked_ok: datetime.datetime(); (UTC) or None
250
302
last_enabled: datetime.datetime(); (UTC)
251
enabled: bool()
252
last_checked_ok: datetime.datetime(); (UTC) or None
303
name: string; from the config file, used in log messages and
304
D-Bus identifiers
305
secret: bytestring; sent verbatim (over TLS) to client
253
306
timeout: datetime.timedelta(); How long from last_checked_ok
254
307
until this client is disabled
255
interval: datetime.timedelta(); How often to start a new checker
256
disable_hook: If set, called by disable() as disable_hook(self)
257
checker: subprocess.Popen(); a running checker process used
258
to see if the client lives.
259
'None' if no process is running.
260
checker_initiator_tag: a gobject event source tag, or None
261
disable_initiator_tag: - '' -
262
checker_callback_tag: - '' -
263
checker_command: string; External command which is run to check if
264
client lives. %() expansions are done at
265
runtime with vars(self) as dict, so that for
266
instance %(name)s can be used in the command.
267
current_checker_command: string; current running checker_command
268
approval_delay: datetime.timedelta(); Time to wait for approval
269
_approved: bool(); 'None' if not yet approved/disapproved
270
approval_duration: datetime.timedelta(); Duration of one approval
308
extended_timeout: extra long timeout when password has been sent
309
runtime_expansions: Allowed attributes for runtime expansion.
310
expires: datetime.datetime(); time (UTC) when a client will be
311
disabled, or None
271
312
"""
272
313
273
@staticmethod
274
def _timedelta_to_milliseconds(td):
275
"Convert a datetime.timedelta() to milliseconds"
276
return ((td.days * 24 * 60 * 60 * 1000)
277
+ (td.seconds * 1000)
278
+ (td.microseconds // 1000))
314
runtime_expansions = ("approval_delay", "approval_duration",
315
"created", "enabled", "fingerprint",
316
"host", "interval", "last_checked_ok",
317
"last_enabled", "name", "timeout")
279
318
280
319
def timeout_milliseconds(self):
281
320
"Return the 'timeout' attribute in milliseconds"
282
return self._timedelta_to_milliseconds(self.timeout)
321
return _timedelta_to_milliseconds(self.timeout)
322
323
def extended_timeout_milliseconds(self):
324
"Return the 'extended_timeout' attribute in milliseconds"
325
return _timedelta_to_milliseconds(self.extended_timeout)
283
326
284
327
def interval_milliseconds(self):
285
328
"Return the 'interval' attribute in milliseconds"
286
return self._timedelta_to_milliseconds(self.interval)
287
329
return _timedelta_to_milliseconds(self.interval)
330
288
331
def approval_delay_milliseconds(self):
289
return self._timedelta_to_milliseconds(self.approval_delay)
332
return _timedelta_to_milliseconds(self.approval_delay)
290
333
291
334
def __init__(self, name = None, disable_hook=None, config=None):
292
335
"""Note: the 'checker' key in 'config' sets the
295
338
self.name = name
296
339
if config is None:
297
340
config = {}
298
logger.debug(u"Creating client %r", self.name)
341
logger.debug("Creating client %r", self.name)
299
342
# Uppercase and remove spaces from fingerprint for later
300
343
# comparison purposes with return value from the fingerprint()
301
344
# function
302
self.fingerprint = (config[u"fingerprint"].upper()
303
.replace(u" ", u""))
304
logger.debug(u" Fingerprint: %s", self.fingerprint)
305
if u"secret" in config:
306
self.secret = config[u"secret"].decode(u"base64")
307
elif u"secfile" in config:
345
self.fingerprint = (config["fingerprint"].upper()
346
.replace(" ", ""))
347
logger.debug(" Fingerprint: %s", self.fingerprint)
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
308
351
with open(os.path.expanduser(os.path.expandvars
309
(config[u"secfile"])),
352
(config["secfile"])),
310
353
"rb") as secfile:
311
354
self.secret = secfile.read()
312
355
else:
313
raise TypeError(u"No secret or secfile for client %s"
356
raise TypeError("No secret or secfile for client %s"
314
357
% self.name)
315
self.host = config.get(u"host", u"")
358
self.host = config.get("host", "")
316
359
self.created = datetime.datetime.utcnow()
317
360
self.enabled = False
361
self.last_approval_request = None
318
362
self.last_enabled = None
319
363
self.last_checked_ok = None
320
self.timeout = string_to_delta(config[u"timeout"])
321
self.interval = string_to_delta(config[u"interval"])
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
322
368
self.disable_hook = disable_hook
323
369
self.checker = None
324
370
self.checker_initiator_tag = None
325
371
self.disable_initiator_tag = None
372
self.expires = None
326
373
self.checker_callback_tag = None
327
self.checker_command = config[u"checker"]
374
self.checker_command = config["checker"]
328
375
self.current_checker_command = None
329
376
self.last_connect = None
330
377
self._approved = None
331
self.approved_by_default = config.get(u"approved_by_default",
378
self.approved_by_default = config.get("approved_by_default",
332
379
True)
333
380
self.approvals_pending = 0
334
381
self.approval_delay = string_to_delta(
335
config[u"approval_delay"])
382
config["approval_delay"])
336
383
self.approval_duration = string_to_delta(
337
config[u"approval_duration"])
338
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
384
config["approval_duration"])
385
self.changedstate = (multiprocessing_manager
386
.Condition(multiprocessing_manager
387
.Lock()))
339
388
340
389
def send_changedstate(self):
341
390
self.changedstate.acquire()
342
391
self.changedstate.notify_all()
343
392
self.changedstate.release()
344
393
345
394
def enable(self):
346
395
"""Start this client's checker and timeout hooks"""
347
if getattr(self, u"enabled", False):
396
if getattr(self, "enabled", False):
348
397
# Already enabled
349
398
return
350
399
self.send_changedstate()
351
self.last_enabled = datetime.datetime.utcnow()
352
400
# Schedule a new checker to be started an 'interval' from now,
353
401
# and every interval from then on.
354
402
self.checker_initiator_tag = (gobject.timeout_add
355
403
(self.interval_milliseconds(),
356
404
self.start_checker))
357
405
# Schedule a disable() when 'timeout' has passed
406
self.expires = datetime.datetime.utcnow() + self.timeout
358
407
self.disable_initiator_tag = (gobject.timeout_add
359
408
(self.timeout_milliseconds(),
360
409
self.disable))
361
410
self.enabled = True
411
self.last_enabled = datetime.datetime.utcnow()
362
412
# Also start a new checker *right now*.
363
413
self.start_checker()
364
414
369
419
if not quiet:
370
420
self.send_changedstate()
371
421
if not quiet:
372
logger.info(u"Disabling client %s", self.name)
373
if getattr(self, u"disable_initiator_tag", False):
422
logger.info("Disabling client %s", self.name)
423
if getattr(self, "disable_initiator_tag", False):
374
424
gobject.source_remove(self.disable_initiator_tag)
375
425
self.disable_initiator_tag = None
376
if getattr(self, u"checker_initiator_tag", False):
426
self.expires = None
427
if getattr(self, "checker_initiator_tag", False):
377
428
gobject.source_remove(self.checker_initiator_tag)
378
429
self.checker_initiator_tag = None
379
430
self.stop_checker()
394
445
if os.WIFEXITED(condition):
395
446
exitstatus = os.WEXITSTATUS(condition)
396
447
if exitstatus == 0:
397
logger.info(u"Checker for %(name)s succeeded",
448
logger.info("Checker for %(name)s succeeded",
398
449
vars(self))
399
450
self.checked_ok()
400
451
else:
401
logger.info(u"Checker for %(name)s failed",
452
logger.info("Checker for %(name)s failed",
402
453
vars(self))
403
454
else:
404
logger.warning(u"Checker for %(name)s crashed?",
455
logger.warning("Checker for %(name)s crashed?",
405
456
vars(self))
406
457
407
def checked_ok(self):
458
def checked_ok(self, timeout=None):
408
459
"""Bump up the timeout for this client.
409
460
410
461
This should only be called when the client has been seen,
411
462
alive and well.
412
463
"""
464
if timeout is None:
465
timeout = self.timeout
413
466
self.last_checked_ok = datetime.datetime.utcnow()
414
gobject.source_remove(self.disable_initiator_tag)
415
self.disable_initiator_tag = (gobject.timeout_add
416
(self.timeout_milliseconds(),
417
self.disable))
467
if self.disable_initiator_tag is not None:
468
gobject.source_remove(self.disable_initiator_tag)
469
if getattr(self, "enabled", False):
470
self.disable_initiator_tag = (gobject.timeout_add
471
(_timedelta_to_milliseconds
472
(timeout), self.disable))
473
self.expires = datetime.datetime.utcnow() + timeout
474
475
def need_approval(self):
476
self.last_approval_request = datetime.datetime.utcnow()
418
477
419
478
def start_checker(self):
420
479
"""Start a new checker subprocess if one is not running.
433
492
# If a checker exists, make sure it is not a zombie
434
493
try:
435
494
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
436
except (AttributeError, OSError), error:
495
except (AttributeError, OSError) as error:
437
496
if (isinstance(error, OSError)
438
497
and error.errno != errno.ECHILD):
439
498
raise error
440
499
else:
441
500
if pid:
442
logger.warning(u"Checker was a zombie")
501
logger.warning("Checker was a zombie")
443
502
gobject.source_remove(self.checker_callback_tag)
444
503
self.checker_callback(pid, status,
445
504
self.current_checker_command)
450
509
command = self.checker_command % self.host
451
510
except TypeError:
452
511
# Escape attributes for the shell
453
escaped_attrs = dict((key,
454
re.escape(unicode(str(val),
455
errors=
456
u'replace')))
457
for key, val in
458
vars(self).iteritems())
512
escaped_attrs = dict(
513
(attr,
514
re.escape(unicode(str(getattr(self, attr, "")),
515
errors=
516
'replace')))
517
for attr in
518
self.runtime_expansions)
519
459
520
try:
460
521
command = self.checker_command % escaped_attrs
461
except TypeError, error:
462
logger.error(u'Could not format string "%s":'
463
u' %s', self.checker_command, error)
522
except TypeError as error:
523
logger.error('Could not format string "%s":'
524
' %s', self.checker_command, error)
464
525
return True # Try again later
465
526
self.current_checker_command = command
466
527
try:
467
logger.info(u"Starting checker %r for %s",
528
logger.info("Starting checker %r for %s",
468
529
command, self.name)
469
530
# We don't need to redirect stdout and stderr, since
470
531
# in normal mode, that is already done by daemon(),
472
533
# always replaced by /dev/null.)
473
534
self.checker = subprocess.Popen(command,
474
535
close_fds=True,
475
shell=True, cwd=u"/")
536
shell=True, cwd="/")
476
537
self.checker_callback_tag = (gobject.child_watch_add
477
538
(self.checker.pid,
478
539
self.checker_callback,
483
544
if pid:
484
545
gobject.source_remove(self.checker_callback_tag)
485
546
self.checker_callback(pid, status, command)
486
except OSError, error:
487
logger.error(u"Failed to start subprocess: %s",
547
except OSError as error:
548
logger.error("Failed to start subprocess: %s",
488
549
error)
489
550
# Re-run this periodically if run by gobject.timeout_add
490
551
return True
494
555
if self.checker_callback_tag:
495
556
gobject.source_remove(self.checker_callback_tag)
496
557
self.checker_callback_tag = None
497
if getattr(self, u"checker", None) is None:
558
if getattr(self, "checker", None) is None:
498
559
return
499
logger.debug(u"Stopping checker for %(name)s", vars(self))
560
logger.debug("Stopping checker for %(name)s", vars(self))
500
561
try:
501
562
os.kill(self.checker.pid, signal.SIGTERM)
502
563
#time.sleep(0.5)
503
564
#if self.checker.poll() is None:
504
565
# os.kill(self.checker.pid, signal.SIGKILL)
505
except OSError, error:
566
except OSError as error:
506
567
if error.errno != errno.ESRCH: # No such process
507
568
raise
508
569
self.checker = None
509
570
510
def dbus_service_property(dbus_interface, signature=u"v",
511
access=u"readwrite", byte_arrays=False):
571
572
def dbus_service_property(dbus_interface, signature="v",
573
access="readwrite", byte_arrays=False):
512
574
"""Decorators for marking methods of a DBusObjectWithProperties to
513
575
become properties on the D-Bus.
514
576
521
583
"""
522
584
# Encoding deeply encoded byte arrays is not supported yet by the
523
585
# "Set" method, so we fail early here:
524
if byte_arrays and signature != u"ay":
525
raise ValueError(u"Byte arrays not supported for non-'ay'"
526
u" signature %r" % signature)
586
if byte_arrays and signature != "ay":
587
raise ValueError("Byte arrays not supported for non-'ay'"
588
" signature %r" % signature)
527
589
def decorator(func):
528
590
func._dbus_is_property = True
529
591
func._dbus_interface = dbus_interface
530
592
func._dbus_signature = signature
531
593
func._dbus_access = access
532
594
func._dbus_name = func.__name__
533
if func._dbus_name.endswith(u"_dbus_property"):
595
if func._dbus_name.endswith("_dbus_property"):
534
596
func._dbus_name = func._dbus_name[:-14]
535
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
597
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
536
598
return func
537
599
return decorator
538
600
558
620
559
621
class DBusObjectWithProperties(dbus.service.Object):
560
622
"""A D-Bus object with properties.
561
623
562
624
Classes inheriting from this can use the dbus_service_property
563
625
decorator to expose methods as D-Bus properties. It exposes the
564
626
standard Get(), Set(), and GetAll() methods on the D-Bus.
566
628
567
629
@staticmethod
568
630
def _is_dbus_property(obj):
569
return getattr(obj, u"_dbus_is_property", False)
631
return getattr(obj, "_dbus_is_property", False)
570
632
571
633
def _get_all_dbus_properties(self):
572
634
"""Returns a generator of (name, attribute) pairs
573
635
"""
574
return ((prop._dbus_name, prop)
636
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
637
for cls in self.__class__.__mro__
575
638
for name, prop in
576
inspect.getmembers(self, self._is_dbus_property))
639
inspect.getmembers(cls, self._is_dbus_property))
577
640
578
641
def _get_dbus_property(self, interface_name, property_name):
579
642
"""Returns a bound method if one exists which is a D-Bus
580
643
property with the specified name and interface.
581
644
"""
582
for name in (property_name,
583
property_name + u"_dbus_property"):
584
prop = getattr(self, name, None)
585
if (prop is None
586
or not self._is_dbus_property(prop)
587
or prop._dbus_name != property_name
588
or (interface_name and prop._dbus_interface
589
and interface_name != prop._dbus_interface)):
590
continue
591
return prop
645
for cls in self.__class__.__mro__:
646
for name, value in (inspect.getmembers
647
(cls, self._is_dbus_property)):
648
if (value._dbus_name == property_name
649
and value._dbus_interface == interface_name):
650
return value.__get__(self)
651
592
652
# No such property
593
raise DBusPropertyNotFound(self.dbus_object_path + u":"
594
+ interface_name + u"."
653
raise DBusPropertyNotFound(self.dbus_object_path + ":"
654
+ interface_name + "."
595
655
+ property_name)
596
656
597
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
598
out_signature=u"v")
657
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
658
out_signature="v")
599
659
def Get(self, interface_name, property_name):
600
660
"""Standard D-Bus property Get() method, see D-Bus standard.
601
661
"""
602
662
prop = self._get_dbus_property(interface_name, property_name)
603
if prop._dbus_access == u"write":
663
if prop._dbus_access == "write":
604
664
raise DBusPropertyAccessException(property_name)
605
665
value = prop()
606
if not hasattr(value, u"variant_level"):
666
if not hasattr(value, "variant_level"):
607
667
return value
608
668
return type(value)(value, variant_level=value.variant_level+1)
609
669
610
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
670
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
611
671
def Set(self, interface_name, property_name, value):
612
672
"""Standard D-Bus property Set() method, see D-Bus standard.
613
673
"""
614
674
prop = self._get_dbus_property(interface_name, property_name)
615
if prop._dbus_access == u"read":
675
if prop._dbus_access == "read":
616
676
raise DBusPropertyAccessException(property_name)
617
if prop._dbus_get_args_options[u"byte_arrays"]:
677
if prop._dbus_get_args_options["byte_arrays"]:
618
678
# The byte_arrays option is not supported yet on
619
679
# signatures other than "ay".
620
if prop._dbus_signature != u"ay":
680
if prop._dbus_signature != "ay":
621
681
raise ValueError
622
682
value = dbus.ByteArray(''.join(unichr(byte)
623
683
for byte in value))
624
684
prop(value)
625
685
626
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
627
out_signature=u"a{sv}")
686
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
687
out_signature="a{sv}")
628
688
def GetAll(self, interface_name):
629
689
"""Standard D-Bus property GetAll() method, see D-Bus
630
690
standard.
631
691
632
692
Note: Will not include properties with access="write".
633
693
"""
634
694
all = {}
638
698
# Interface non-empty but did not match
639
699
continue
640
700
# Ignore write-only properties
641
if prop._dbus_access == u"write":
701
if prop._dbus_access == "write":
642
702
continue
643
703
value = prop()
644
if not hasattr(value, u"variant_level"):
704
if not hasattr(value, "variant_level"):
645
705
all[name] = value
646
706
continue
647
707
all[name] = type(value)(value, variant_level=
648
708
value.variant_level+1)
649
return dbus.Dictionary(all, signature=u"sv")
709
return dbus.Dictionary(all, signature="sv")
650
710
651
711
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
652
out_signature=u"s",
712
out_signature="s",
653
713
path_keyword='object_path',
654
714
connection_keyword='connection')
655
715
def Introspect(self, object_path, connection):
660
720
try:
661
721
document = xml.dom.minidom.parseString(xmlstring)
662
722
def make_tag(document, name, prop):
663
e = document.createElement(u"property")
664
e.setAttribute(u"name", name)
665
e.setAttribute(u"type", prop._dbus_signature)
666
e.setAttribute(u"access", prop._dbus_access)
723
e = document.createElement("property")
724
e.setAttribute("name", name)
725
e.setAttribute("type", prop._dbus_signature)
726
e.setAttribute("access", prop._dbus_access)
667
727
return e
668
for if_tag in document.getElementsByTagName(u"interface"):
728
for if_tag in document.getElementsByTagName("interface"):
669
729
for tag in (make_tag(document, name, prop)
670
730
for name, prop
671
731
in self._get_all_dbus_properties()
672
732
if prop._dbus_interface
673
== if_tag.getAttribute(u"name")):
733
== if_tag.getAttribute("name")):
674
734
if_tag.appendChild(tag)
675
735
# Add the names to the return values for the
676
736
# "org.freedesktop.DBus.Properties" methods
677
if (if_tag.getAttribute(u"name")
678
== u"org.freedesktop.DBus.Properties"):
679
for cn in if_tag.getElementsByTagName(u"method"):
680
if cn.getAttribute(u"name") == u"Get":
681
for arg in cn.getElementsByTagName(u"arg"):
682
if (arg.getAttribute(u"direction")
683
== u"out"):
684
arg.setAttribute(u"name", u"value")
685
elif cn.getAttribute(u"name") == u"GetAll":
686
for arg in cn.getElementsByTagName(u"arg"):
687
if (arg.getAttribute(u"direction")
688
== u"out"):
689
arg.setAttribute(u"name", u"props")
690
xmlstring = document.toxml(u"utf-8")
737
if (if_tag.getAttribute("name")
738
== "org.freedesktop.DBus.Properties"):
739
for cn in if_tag.getElementsByTagName("method"):
740
if cn.getAttribute("name") == "Get":
741
for arg in cn.getElementsByTagName("arg"):
742
if (arg.getAttribute("direction")
743
== "out"):
744
arg.setAttribute("name", "value")
745
elif cn.getAttribute("name") == "GetAll":
746
for arg in cn.getElementsByTagName("arg"):
747
if (arg.getAttribute("direction")
748
== "out"):
749
arg.setAttribute("name", "props")
750
xmlstring = document.toxml("utf-8")
691
751
document.unlink()
692
752
except (AttributeError, xml.dom.DOMException,
693
xml.parsers.expat.ExpatError), error:
694
logger.error(u"Failed to override Introspection method",
753
xml.parsers.expat.ExpatError) as error:
754
logger.error("Failed to override Introspection method",
695
755
error)
696
756
return xmlstring
697
757
698
758
759
def datetime_to_dbus (dt, variant_level=0):
760
"""Convert a UTC datetime.datetime() to a D-Bus type."""
761
if dt is None:
762
return dbus.String("", variant_level = variant_level)
763
return dbus.String(dt.isoformat(),
764
variant_level=variant_level)
765
766
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
767
.__metaclass__):
768
"""Applied to an empty subclass of a D-Bus object, this metaclass
769
will add additional D-Bus attributes matching a certain pattern.
770
"""
771
def __new__(mcs, name, bases, attr):
772
# Go through all the base classes which could have D-Bus
773
# methods, signals, or properties in them
774
for base in (b for b in bases
775
if issubclass(b, dbus.service.Object)):
776
# Go though all attributes of the base class
777
for attrname, attribute in inspect.getmembers(base):
778
# Ignore non-D-Bus attributes, and D-Bus attributes
779
# with the wrong interface name
780
if (not hasattr(attribute, "_dbus_interface")
781
or not attribute._dbus_interface
782
.startswith("se.recompile.Mandos")):
783
continue
784
# Create an alternate D-Bus interface name based on
785
# the current name
786
alt_interface = (attribute._dbus_interface
787
.replace("se.recompile.Mandos",
788
"se.bsnet.fukt.Mandos"))
789
# Is this a D-Bus signal?
790
if getattr(attribute, "_dbus_is_signal", False):
791
# Extract the original non-method function by
792
# black magic
793
nonmethod_func = (dict(
794
zip(attribute.func_code.co_freevars,
795
attribute.__closure__))["func"]
796
.cell_contents)
797
# Create a new, but exactly alike, function
798
# object, and decorate it to be a new D-Bus signal
799
# with the alternate D-Bus interface name
800
new_function = (dbus.service.signal
801
(alt_interface,
802
attribute._dbus_signature)
803
(types.FunctionType(
804
nonmethod_func.func_code,
805
nonmethod_func.func_globals,
806
nonmethod_func.func_name,
807
nonmethod_func.func_defaults,
808
nonmethod_func.func_closure)))
809
# Define a creator of a function to call both the
810
# old and new functions, so both the old and new
811
# signals gets sent when the function is called
812
def fixscope(func1, func2):
813
"""This function is a scope container to pass
814
func1 and func2 to the "call_both" function
815
outside of its arguments"""
816
def call_both(*args, **kwargs):
817
"""This function will emit two D-Bus
818
signals by calling func1 and func2"""
819
func1(*args, **kwargs)
820
func2(*args, **kwargs)
821
return call_both
822
# Create the "call_both" function and add it to
823
# the class
824
attr[attrname] = fixscope(attribute,
825
new_function)
826
# Is this a D-Bus method?
827
elif getattr(attribute, "_dbus_is_method", False):
828
# Create a new, but exactly alike, function
829
# object. Decorate it to be a new D-Bus method
830
# with the alternate D-Bus interface name. Add it
831
# to the class.
832
attr[attrname] = (dbus.service.method
833
(alt_interface,
834
attribute._dbus_in_signature,
835
attribute._dbus_out_signature)
836
(types.FunctionType
837
(attribute.func_code,
838
attribute.func_globals,
839
attribute.func_name,
840
attribute.func_defaults,
841
attribute.func_closure)))
842
# Is this a D-Bus property?
843
elif getattr(attribute, "_dbus_is_property", False):
844
# Create a new, but exactly alike, function
845
# object, and decorate it to be a new D-Bus
846
# property with the alternate D-Bus interface
847
# name. Add it to the class.
848
attr[attrname] = (dbus_service_property
849
(alt_interface,
850
attribute._dbus_signature,
851
attribute._dbus_access,
852
attribute
853
._dbus_get_args_options
854
["byte_arrays"])
855
(types.FunctionType
856
(attribute.func_code,
857
attribute.func_globals,
858
attribute.func_name,
859
attribute.func_defaults,
860
attribute.func_closure)))
861
return type.__new__(mcs, name, bases, attr)
862
699
863
class ClientDBus(Client, DBusObjectWithProperties):
700
864
"""A Client class using D-Bus
701
865
703
867
dbus_object_path: dbus.ObjectPath
704
868
bus: dbus.SystemBus()
705
869
"""
870
871
runtime_expansions = (Client.runtime_expansions
872
+ ("dbus_object_path",))
873
706
874
# dbus.service.Object doesn't use super(), so we can't either.
707
875
708
876
def __init__(self, bus = None, *args, **kwargs):
711
879
Client.__init__(self, *args, **kwargs)
712
880
# Only now, when this client is initialized, can it show up on
713
881
# the D-Bus
882
client_object_name = unicode(self.name).translate(
883
{ord("."): ord("_"),
884
ord("-"): ord("_")})
714
885
self.dbus_object_path = (dbus.ObjectPath
715
(u"/clients/"
716
+ self.name.replace(u".", u"_")))
886
("/clients/" + client_object_name))
717
887
DBusObjectWithProperties.__init__(self, self.bus,
718
888
self.dbus_object_path)
719
889
720
def _get_approvals_pending(self):
721
return self._approvals_pending
722
def _set_approvals_pending(self, value):
723
old_value = self._approvals_pending
724
self._approvals_pending = value
725
bval = bool(value)
726
if (hasattr(self, "dbus_object_path")
727
and bval is not bool(old_value)):
728
dbus_bool = dbus.Boolean(bval, variant_level=1)
729
self.PropertyChanged(dbus.String(u"ApprovalPending"),
730
dbus_bool)
890
def notifychangeproperty(transform_func,
891
dbus_name, type_func=lambda x: x,
892
variant_level=1):
893
""" Modify a variable so that it's a property which announces
894
its changes to DBus.
731
895
732
approvals_pending = property(_get_approvals_pending,
733
_set_approvals_pending)
734
del _get_approvals_pending, _set_approvals_pending
735
736
@staticmethod
737
def _datetime_to_dbus(dt, variant_level=0):
738
"""Convert a UTC datetime.datetime() to a D-Bus type."""
739
return dbus.String(dt.isoformat(),
740
variant_level=variant_level)
741
742
def enable(self):
743
oldstate = getattr(self, u"enabled", False)
744
r = Client.enable(self)
745
if oldstate != self.enabled:
746
# Emit D-Bus signals
747
self.PropertyChanged(dbus.String(u"Enabled"),
748
dbus.Boolean(True, variant_level=1))
749
self.PropertyChanged(
750
dbus.String(u"LastEnabled"),
751
self._datetime_to_dbus(self.last_enabled,
752
variant_level=1))
753
return r
754
755
def disable(self, quiet = False):
756
oldstate = getattr(self, u"enabled", False)
757
r = Client.disable(self, quiet=quiet)
758
if not quiet and oldstate != self.enabled:
759
# Emit D-Bus signal
760
self.PropertyChanged(dbus.String(u"Enabled"),
761
dbus.Boolean(False, variant_level=1))
762
return r
896
transform_fun: Function that takes a value and a variant_level
897
and transforms it to a D-Bus type.
898
dbus_name: D-Bus name of the variable
899
type_func: Function that transform the value before sending it
900
to the D-Bus. Default: no transform
901
variant_level: D-Bus variant level. Default: 1
902
"""
903
attrname = "_{0}".format(dbus_name)
904
def setter(self, value):
905
if hasattr(self, "dbus_object_path"):
906
if (not hasattr(self, attrname) or
907
type_func(getattr(self, attrname, None))
908
!= type_func(value)):
909
dbus_value = transform_func(type_func(value),
910
variant_level
911
=variant_level)
912
self.PropertyChanged(dbus.String(dbus_name),
913
dbus_value)
914
setattr(self, attrname, value)
915
916
return property(lambda self: getattr(self, attrname), setter)
917
918
919
expires = notifychangeproperty(datetime_to_dbus, "Expires")
920
approvals_pending = notifychangeproperty(dbus.Boolean,
921
"ApprovalPending",
922
type_func = bool)
923
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
924
last_enabled = notifychangeproperty(datetime_to_dbus,
925
"LastEnabled")
926
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
927
type_func = lambda checker:
928
checker is not None)
929
last_checked_ok = notifychangeproperty(datetime_to_dbus,
930
"LastCheckedOK")
931
last_approval_request = notifychangeproperty(
932
datetime_to_dbus, "LastApprovalRequest")
933
approved_by_default = notifychangeproperty(dbus.Boolean,
934
"ApprovedByDefault")
935
approval_delay = notifychangeproperty(dbus.UInt16,
936
"ApprovalDelay",
937
type_func =
938
_timedelta_to_milliseconds)
939
approval_duration = notifychangeproperty(
940
dbus.UInt16, "ApprovalDuration",
941
type_func = _timedelta_to_milliseconds)
942
host = notifychangeproperty(dbus.String, "Host")
943
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
944
type_func =
945
_timedelta_to_milliseconds)
946
extended_timeout = notifychangeproperty(
947
dbus.UInt16, "ExtendedTimeout",
948
type_func = _timedelta_to_milliseconds)
949
interval = notifychangeproperty(dbus.UInt16,
950
"Interval",
951
type_func =
952
_timedelta_to_milliseconds)
953
checker_command = notifychangeproperty(dbus.String, "Checker")
954
955
del notifychangeproperty
763
956
764
957
def __del__(self, *args, **kwargs):
765
958
try:
766
959
self.remove_from_connection()
767
960
except LookupError:
768
961
pass
769
if hasattr(DBusObjectWithProperties, u"__del__"):
962
if hasattr(DBusObjectWithProperties, "__del__"):
770
963
DBusObjectWithProperties.__del__(self, *args, **kwargs)
771
964
Client.__del__(self, *args, **kwargs)
772
965
774
967
*args, **kwargs):
775
968
self.checker_callback_tag = None
776
969
self.checker = None
777
# Emit D-Bus signal
778
self.PropertyChanged(dbus.String(u"CheckerRunning"),
779
dbus.Boolean(False, variant_level=1))
780
970
if os.WIFEXITED(condition):
781
971
exitstatus = os.WEXITSTATUS(condition)
782
972
# Emit D-Bus signal
792
982
return Client.checker_callback(self, pid, condition, command,
793
983
*args, **kwargs)
794
984
795
def checked_ok(self, *args, **kwargs):
796
r = Client.checked_ok(self, *args, **kwargs)
797
# Emit D-Bus signal
798
self.PropertyChanged(
799
dbus.String(u"LastCheckedOK"),
800
(self._datetime_to_dbus(self.last_checked_ok,
801
variant_level=1)))
802
return r
803
804
985
def start_checker(self, *args, **kwargs):
805
986
old_checker = self.checker
806
987
if self.checker is not None:
813
994
and old_checker_pid != self.checker.pid):
814
995
# Emit D-Bus signal
815
996
self.CheckerStarted(self.current_checker_command)
816
self.PropertyChanged(
817
dbus.String(u"CheckerRunning"),
818
dbus.Boolean(True, variant_level=1))
819
997
return r
820
998
821
def stop_checker(self, *args, **kwargs):
822
old_checker = getattr(self, u"checker", None)
823
r = Client.stop_checker(self, *args, **kwargs)
824
if (old_checker is not None
825
and getattr(self, u"checker", None) is None):
826
self.PropertyChanged(dbus.String(u"CheckerRunning"),
827
dbus.Boolean(False, variant_level=1))
828
return r
829
830
999
def _reset_approved(self):
831
1000
self._approved = None
832
1001
return False
834
1003
def approve(self, value=True):
835
1004
self.send_changedstate()
836
1005
self._approved = value
837
gobject.timeout_add(self._timedelta_to_milliseconds
1006
gobject.timeout_add(_timedelta_to_milliseconds
838
1007
(self.approval_duration),
839
1008
self._reset_approved)
840
1009
841
1010
842
1011
## D-Bus methods, signals & properties
843
_interface = u"se.bsnet.fukt.Mandos.Client"
1012
_interface = "se.recompile.Mandos.Client"
844
1013
845
1014
## Signals
846
1015
847
1016
# CheckerCompleted - signal
848
@dbus.service.signal(_interface, signature=u"nxs")
1017
@dbus.service.signal(_interface, signature="nxs")
849
1018
def CheckerCompleted(self, exitcode, waitstatus, command):
850
1019
"D-Bus signal"
851
1020
pass
852
1021
853
1022
# CheckerStarted - signal
854
@dbus.service.signal(_interface, signature=u"s")
1023
@dbus.service.signal(_interface, signature="s")
855
1024
def CheckerStarted(self, command):
856
1025
"D-Bus signal"
857
1026
pass
858
1027
859
1028
# PropertyChanged - signal
860
@dbus.service.signal(_interface, signature=u"sv")
1029
@dbus.service.signal(_interface, signature="sv")
861
1030
def PropertyChanged(self, property, value):
862
1031
"D-Bus signal"
863
1032
pass
872
1041
pass
873
1042
874
1043
# Rejected - signal
875
@dbus.service.signal(_interface, signature=u"s")
1044
@dbus.service.signal(_interface, signature="s")
876
1045
def Rejected(self, reason):
877
1046
"D-Bus signal"
878
1047
pass
879
1048
880
1049
# NeedApproval - signal
881
@dbus.service.signal(_interface, signature=u"tb")
1050
@dbus.service.signal(_interface, signature="tb")
882
1051
def NeedApproval(self, timeout, default):
883
1052
"D-Bus signal"
884
pass
1053
return self.need_approval()
885
1054
886
1055
## Methods
887
1056
888
1057
# Approve - method
889
@dbus.service.method(_interface, in_signature=u"b")
1058
@dbus.service.method(_interface, in_signature="b")
890
1059
def Approve(self, value):
891
1060
self.approve(value)
892
1061
893
1062
# CheckedOK - method
894
1063
@dbus.service.method(_interface)
895
1064
def CheckedOK(self):
896
return self.checked_ok()
1065
self.checked_ok()
897
1066
898
1067
# Enable - method
899
1068
@dbus.service.method(_interface)
921
1090
## Properties
922
1091
923
1092
# ApprovalPending - property
924
@dbus_service_property(_interface, signature=u"b", access=u"read")
1093
@dbus_service_property(_interface, signature="b", access="read")
925
1094
def ApprovalPending_dbus_property(self):
926
1095
return dbus.Boolean(bool(self.approvals_pending))
927
1096
928
1097
# ApprovedByDefault - property
929
@dbus_service_property(_interface, signature=u"b",
930
access=u"readwrite")
1098
@dbus_service_property(_interface, signature="b",
1099
access="readwrite")
931
1100
def ApprovedByDefault_dbus_property(self, value=None):
932
1101
if value is None: # get
933
1102
return dbus.Boolean(self.approved_by_default)
934
1103
self.approved_by_default = bool(value)
935
# Emit D-Bus signal
936
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
937
dbus.Boolean(value, variant_level=1))
938
1104
939
1105
# ApprovalDelay - property
940
@dbus_service_property(_interface, signature=u"t",
941
access=u"readwrite")
1106
@dbus_service_property(_interface, signature="t",
1107
access="readwrite")
942
1108
def ApprovalDelay_dbus_property(self, value=None):
943
1109
if value is None: # get
944
1110
return dbus.UInt64(self.approval_delay_milliseconds())
945
1111
self.approval_delay = datetime.timedelta(0, 0, 0, value)
946
# Emit D-Bus signal
947
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
948
dbus.UInt64(value, variant_level=1))
949
1112
950
1113
# ApprovalDuration - property
951
@dbus_service_property(_interface, signature=u"t",
952
access=u"readwrite")
1114
@dbus_service_property(_interface, signature="t",
1115
access="readwrite")
953
1116
def ApprovalDuration_dbus_property(self, value=None):
954
1117
if value is None: # get
955
return dbus.UInt64(self._timedelta_to_milliseconds(
1118
return dbus.UInt64(_timedelta_to_milliseconds(
956
1119
self.approval_duration))
957
1120
self.approval_duration = datetime.timedelta(0, 0, 0, value)
958
# Emit D-Bus signal
959
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
960
dbus.UInt64(value, variant_level=1))
961
1121
962
1122
# Name - property
963
@dbus_service_property(_interface, signature=u"s", access=u"read")
1123
@dbus_service_property(_interface, signature="s", access="read")
964
1124
def Name_dbus_property(self):
965
1125
return dbus.String(self.name)
966
1126
967
1127
# Fingerprint - property
968
@dbus_service_property(_interface, signature=u"s", access=u"read")
1128
@dbus_service_property(_interface, signature="s", access="read")
969
1129
def Fingerprint_dbus_property(self):
970
1130
return dbus.String(self.fingerprint)
971
1131
972
1132
# Host - property
973
@dbus_service_property(_interface, signature=u"s",
974
access=u"readwrite")
1133
@dbus_service_property(_interface, signature="s",
1134
access="readwrite")
975
1135
def Host_dbus_property(self, value=None):
976
1136
if value is None: # get
977
1137
return dbus.String(self.host)
978
1138
self.host = value
979
# Emit D-Bus signal
980
self.PropertyChanged(dbus.String(u"Host"),
981
dbus.String(value, variant_level=1))
982
1139
983
1140
# Created - property
984
@dbus_service_property(_interface, signature=u"s", access=u"read")
1141
@dbus_service_property(_interface, signature="s", access="read")
985
1142
def Created_dbus_property(self):
986
return dbus.String(self._datetime_to_dbus(self.created))
1143
return dbus.String(datetime_to_dbus(self.created))
987
1144
988
1145
# LastEnabled - property
989
@dbus_service_property(_interface, signature=u"s", access=u"read")
1146
@dbus_service_property(_interface, signature="s", access="read")
990
1147
def LastEnabled_dbus_property(self):
991
if self.last_enabled is None:
992
return dbus.String(u"")
993
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1148
return datetime_to_dbus(self.last_enabled)
994
1149
995
1150
# Enabled - property
996
@dbus_service_property(_interface, signature=u"b",
997
access=u"readwrite")
1151
@dbus_service_property(_interface, signature="b",
1152
access="readwrite")
998
1153
def Enabled_dbus_property(self, value=None):
999
1154
if value is None: # get
1000
1155
return dbus.Boolean(self.enabled)
1004
1159
self.disable()
1005
1160
1006
1161
# LastCheckedOK - property
1007
@dbus_service_property(_interface, signature=u"s",
1008
access=u"readwrite")
1162
@dbus_service_property(_interface, signature="s",
1163
access="readwrite")
1009
1164
def LastCheckedOK_dbus_property(self, value=None):
1010
1165
if value is not None:
1011
1166
self.checked_ok()
1012
1167
return
1013
if self.last_checked_ok is None:
1014
return dbus.String(u"")
1015
return dbus.String(self._datetime_to_dbus(self
1016
.last_checked_ok))
1168
return datetime_to_dbus(self.last_checked_ok)
1169
1170
# Expires - property
1171
@dbus_service_property(_interface, signature="s", access="read")
1172
def Expires_dbus_property(self):
1173
return datetime_to_dbus(self.expires)
1174
1175
# LastApprovalRequest - property
1176
@dbus_service_property(_interface, signature="s", access="read")
1177
def LastApprovalRequest_dbus_property(self):
1178
return datetime_to_dbus(self.last_approval_request)
1017
1179
1018
1180
# Timeout - property
1019
@dbus_service_property(_interface, signature=u"t",
1020
access=u"readwrite")
1181
@dbus_service_property(_interface, signature="t",
1182
access="readwrite")
1021
1183
def Timeout_dbus_property(self, value=None):
1022
1184
if value is None: # get
1023
1185
return dbus.UInt64(self.timeout_milliseconds())
1024
1186
self.timeout = datetime.timedelta(0, 0, 0, value)
1025
# Emit D-Bus signal
1026
self.PropertyChanged(dbus.String(u"Timeout"),
1027
dbus.UInt64(value, variant_level=1))
1028
if getattr(self, u"disable_initiator_tag", None) is None:
1187
if getattr(self, "disable_initiator_tag", None) is None:
1029
1188
return
1030
1189
# Reschedule timeout
1031
1190
gobject.source_remove(self.disable_initiator_tag)
1032
1191
self.disable_initiator_tag = None
1033
time_to_die = (self.
1034
_timedelta_to_milliseconds((self
1035
.last_checked_ok
1036
+ self.timeout)
1037
- datetime.datetime
1038
.utcnow()))
1192
self.expires = None
1193
time_to_die = _timedelta_to_milliseconds((self
1194
.last_checked_ok
1195
+ self.timeout)
1196
- datetime.datetime
1197
.utcnow())
1039
1198
if time_to_die <= 0:
1040
1199
# The timeout has passed
1041
1200
self.disable()
1042
1201
else:
1202
self.expires = (datetime.datetime.utcnow()
1203
+ datetime.timedelta(milliseconds =
1204
time_to_die))
1043
1205
self.disable_initiator_tag = (gobject.timeout_add
1044
1206
(time_to_die, self.disable))
1045
1207
1208
# ExtendedTimeout - property
1209
@dbus_service_property(_interface, signature="t",
1210
access="readwrite")
1211
def ExtendedTimeout_dbus_property(self, value=None):
1212
if value is None: # get
1213
return dbus.UInt64(self.extended_timeout_milliseconds())
1214
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1215
1046
1216
# Interval - property
1047
@dbus_service_property(_interface, signature=u"t",
1048
access=u"readwrite")
1217
@dbus_service_property(_interface, signature="t",
1218
access="readwrite")
1049
1219
def Interval_dbus_property(self, value=None):
1050
1220
if value is None: # get
1051
1221
return dbus.UInt64(self.interval_milliseconds())
1052
1222
self.interval = datetime.timedelta(0, 0, 0, value)
1053
# Emit D-Bus signal
1054
self.PropertyChanged(dbus.String(u"Interval"),
1055
dbus.UInt64(value, variant_level=1))
1056
if getattr(self, u"checker_initiator_tag", None) is None:
1223
if getattr(self, "checker_initiator_tag", None) is None:
1057
1224
return
1058
1225
# Reschedule checker run
1059
1226
gobject.source_remove(self.checker_initiator_tag)
1060
1227
self.checker_initiator_tag = (gobject.timeout_add
1061
1228
(value, self.start_checker))
1062
1229
self.start_checker() # Start one now, too
1063
1230
1064
1231
# Checker - property
1065
@dbus_service_property(_interface, signature=u"s",
1066
access=u"readwrite")
1232
@dbus_service_property(_interface, signature="s",
1233
access="readwrite")
1067
1234
def Checker_dbus_property(self, value=None):
1068
1235
if value is None: # get
1069
1236
return dbus.String(self.checker_command)
1070
1237
self.checker_command = value
1071
# Emit D-Bus signal
1072
self.PropertyChanged(dbus.String(u"Checker"),
1073
dbus.String(self.checker_command,
1074
variant_level=1))
1075
1238
1076
1239
# CheckerRunning - property
1077
@dbus_service_property(_interface, signature=u"b",
1078
access=u"readwrite")
1240
@dbus_service_property(_interface, signature="b",
1241
access="readwrite")
1079
1242
def CheckerRunning_dbus_property(self, value=None):
1080
1243
if value is None: # get
1081
1244
return dbus.Boolean(self.checker is not None)
1085
1248
self.stop_checker()
1086
1249
1087
1250
# ObjectPath - property
1088
@dbus_service_property(_interface, signature=u"o", access=u"read")
1251
@dbus_service_property(_interface, signature="o", access="read")
1089
1252
def ObjectPath_dbus_property(self):
1090
1253
return self.dbus_object_path # is already a dbus.ObjectPath
1091
1254
1092
1255
# Secret = property
1093
@dbus_service_property(_interface, signature=u"ay",
1094
access=u"write", byte_arrays=True)
1256
@dbus_service_property(_interface, signature="ay",
1257
access="write", byte_arrays=True)
1095
1258
def Secret_dbus_property(self, value):
1096
1259
self.secret = str(value)
1097
1260
1104
1267
self._pipe.send(('init', fpr, address))
1105
1268
if not self._pipe.recv():
1106
1269
raise KeyError()
1107
1270
1108
1271
def __getattribute__(self, name):
1109
1272
if(name == '_pipe'):
1110
1273
return super(ProxyClient, self).__getattribute__(name)
1117
1280
self._pipe.send(('funcall', name, args, kwargs))
1118
1281
return self._pipe.recv()[1]
1119
1282
return func
1120
1283
1121
1284
def __setattr__(self, name, value):
1122
1285
if(name == '_pipe'):
1123
1286
return super(ProxyClient, self).__setattr__(name, value)
1124
1287
self._pipe.send(('setattr', name, value))
1125
1288
1289
class ClientDBusTransitional(ClientDBus):
1290
__metaclass__ = AlternateDBusNamesMetaclass
1126
1291
1127
1292
class ClientHandler(socketserver.BaseRequestHandler, object):
1128
1293
"""A class to handle client connections.
1132
1297
1133
1298
def handle(self):
1134
1299
with contextlib.closing(self.server.child_pipe) as child_pipe:
1135
logger.info(u"TCP connection from: %s",
1300
logger.info("TCP connection from: %s",
1136
1301
unicode(self.client_address))
1137
logger.debug(u"Pipe FD: %d",
1302
logger.debug("Pipe FD: %d",
1138
1303
self.server.child_pipe.fileno())
1139
1304
1140
1305
session = (gnutls.connection
1141
1306
.ClientSession(self.request,
1142
1307
gnutls.connection
1143
1308
.X509Credentials()))
1144
1309
1145
1310
# Note: gnutls.connection.X509Credentials is really a
1146
1311
# generic GnuTLS certificate credentials object so long as
1147
1312
# no X.509 keys are added to it. Therefore, we can use it
1148
1313
# here despite using OpenPGP certificates.
1149
1150
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1151
# u"+AES-256-CBC", u"+SHA1",
1152
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1153
# u"+DHE-DSS"))
1314
1315
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1316
# "+AES-256-CBC", "+SHA1",
1317
# "+COMP-NULL", "+CTYPE-OPENPGP",
1318
# "+DHE-DSS"))
1154
1319
# Use a fallback default, since this MUST be set.
1155
1320
priority = self.server.gnutls_priority
1156
1321
if priority is None:
1157
priority = u"NORMAL"
1322
priority = "NORMAL"
1158
1323
(gnutls.library.functions
1159
1324
.gnutls_priority_set_direct(session._c_object,
1160
1325
priority, None))
1161
1326
1162
1327
# Start communication using the Mandos protocol
1163
1328
# Get protocol number
1164
1329
line = self.request.makefile().readline()
1165
logger.debug(u"Protocol version: %r", line)
1330
logger.debug("Protocol version: %r", line)
1166
1331
try:
1167
1332
if int(line.strip().split()[0]) > 1:
1168
1333
raise RuntimeError
1169
except (ValueError, IndexError, RuntimeError), error:
1170
logger.error(u"Unknown protocol version: %s", error)
1334
except (ValueError, IndexError, RuntimeError) as error:
1335
logger.error("Unknown protocol version: %s", error)
1171
1336
return
1172
1337
1173
1338
# Start GnuTLS connection
1174
1339
try:
1175
1340
session.handshake()
1176
except gnutls.errors.GNUTLSError, error:
1177
logger.warning(u"Handshake failed: %s", error)
1341
except gnutls.errors.GNUTLSError as error:
1342
logger.warning("Handshake failed: %s", error)
1178
1343
# Do not run session.bye() here: the session is not
1179
1344
# established. Just abandon the request.
1180
1345
return
1181
logger.debug(u"Handshake succeeded")
1182
1346
logger.debug("Handshake succeeded")
1347
1183
1348
approval_required = False
1184
1349
try:
1185
1350
try:
1186
1351
fpr = self.fingerprint(self.peer_certificate
1187
1352
(session))
1188
except (TypeError, gnutls.errors.GNUTLSError), error:
1189
logger.warning(u"Bad certificate: %s", error)
1353
except (TypeError,
1354
gnutls.errors.GNUTLSError) as error:
1355
logger.warning("Bad certificate: %s", error)
1190
1356
return
1191
logger.debug(u"Fingerprint: %s", fpr)
1192
1357
logger.debug("Fingerprint: %s", fpr)
1358
1193
1359
try:
1194
1360
client = ProxyClient(child_pipe, fpr,
1195
1361
self.client_address)
1203
1369
1204
1370
while True:
1205
1371
if not client.enabled:
1206
logger.warning(u"Client %s is disabled",
1372
logger.info("Client %s is disabled",
1207
1373
client.name)
1208
1374
if self.server.use_dbus:
1209
1375
# Emit D-Bus signal
1210
client.Rejected("Disabled")
1376
client.Rejected("Disabled")
1211
1377
return
1212
1378
1213
1379
if client._approved or not client.approval_delay:
1214
1380
#We are approved or approval is disabled
1215
1381
break
1216
1382
elif client._approved is None:
1217
logger.info(u"Client %s needs approval",
1383
logger.info("Client %s needs approval",
1218
1384
client.name)
1219
1385
if self.server.use_dbus:
1220
1386
# Emit D-Bus signal
1222
1388
client.approval_delay_milliseconds(),
1223
1389
client.approved_by_default)
1224
1390
else:
1225
logger.warning(u"Client %s was not approved",
1391
logger.warning("Client %s was not approved",
1226
1392
client.name)
1227
1393
if self.server.use_dbus:
1228
1394
# Emit D-Bus signal
1230
1396
return
1231
1397
1232
1398
#wait until timeout or approved
1233
#x = float(client._timedelta_to_milliseconds(delay))
1234
1399
time = datetime.datetime.now()
1235
1400
client.changedstate.acquire()
1236
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1401
(client.changedstate.wait
1402
(float(client._timedelta_to_milliseconds(delay)
1403
/ 1000)))
1237
1404
client.changedstate.release()
1238
1405
time2 = datetime.datetime.now()
1239
1406
if (time2 - time) >= delay:
1254
1421
while sent_size < len(client.secret):
1255
1422
try:
1256
1423
sent = session.send(client.secret[sent_size:])
1257
except (gnutls.errors.GNUTLSError), error:
1424
except gnutls.errors.GNUTLSError as error:
1258
1425
logger.warning("gnutls send failed")
1259
1426
return
1260
logger.debug(u"Sent: %d, remaining: %d",
1427
logger.debug("Sent: %d, remaining: %d",
1261
1428
sent, len(client.secret)
1262
1429
- (sent_size + sent))
1263
1430
sent_size += sent
1264
1265
logger.info(u"Sending secret to %s", client.name)
1266
# bump the timeout as if seen
1267
client.checked_ok()
1431
1432
logger.info("Sending secret to %s", client.name)
1433
# bump the timeout using extended_timeout
1434
client.checked_ok(client.extended_timeout)
1268
1435
if self.server.use_dbus:
1269
1436
# Emit D-Bus signal
1270
1437
client.GotSecret()
1274
1441
client.approvals_pending -= 1
1275
1442
try:
1276
1443
session.bye()
1277
except (gnutls.errors.GNUTLSError), error:
1444
except gnutls.errors.GNUTLSError as error:
1278
1445
logger.warning("GnuTLS bye failed")
1279
1446
1280
1447
@staticmethod
1291
1458
.gnutls_certificate_get_peers
1292
1459
(session._c_object, ctypes.byref(list_size)))
1293
1460
if not bool(cert_list) and list_size.value != 0:
1294
raise gnutls.errors.GNUTLSError(u"error getting peer"
1295
u" certificate")
1461
raise gnutls.errors.GNUTLSError("error getting peer"
1462
" certificate")
1296
1463
if list_size.value == 0:
1297
1464
return None
1298
1465
cert = cert_list[0]
1324
1491
if crtverify.value != 0:
1325
1492
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1326
1493
raise (gnutls.errors.CertificateSecurityError
1327
(u"Verify failed"))
1494
("Verify failed"))
1328
1495
# New buffer for the fingerprint
1329
1496
buf = ctypes.create_string_buffer(20)
1330
1497
buf_len = ctypes.c_size_t()
1337
1504
# Convert the buffer to a Python bytestring
1338
1505
fpr = ctypes.string_at(buf, buf_len.value)
1339
1506
# Convert the bytestring to hexadecimal notation
1340
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1507
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1341
1508
return hex_fpr
1342
1509
1343
1510
1349
1516
except:
1350
1517
self.handle_error(request, address)
1351
1518
self.close_request(request)
1352
1519
1353
1520
def process_request(self, request, address):
1354
1521
"""Start a new process to process the request."""
1355
multiprocessing.Process(target = self.sub_process_main,
1356
args = (request, address)).start()
1522
proc = multiprocessing.Process(target = self.sub_process_main,
1523
args = (request,
1524
address))
1525
proc.start()
1526
return proc
1527
1357
1528
1358
1529
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1359
1530
""" adds a pipe to the MixIn """
1363
1534
This function creates a new pipe in self.pipe
1364
1535
"""
1365
1536
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1366
1367
super(MultiprocessingMixInWithPipe,
1368
self).process_request(request, client_address)
1537
1538
proc = MultiprocessingMixIn.process_request(self, request,
1539
client_address)
1369
1540
self.child_pipe.close()
1370
self.add_pipe(parent_pipe)
1371
1372
def add_pipe(self, parent_pipe):
1541
self.add_pipe(parent_pipe, proc)
1542
1543
def add_pipe(self, parent_pipe, proc):
1373
1544
"""Dummy function; override as necessary"""
1374
pass
1545
raise NotImplementedError
1546
1375
1547
1376
1548
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1377
1549
socketserver.TCPServer, object):
1395
1567
bind to an address or port if they were not specified."""
1396
1568
if self.interface is not None:
1397
1569
if SO_BINDTODEVICE is None:
1398
logger.error(u"SO_BINDTODEVICE does not exist;"
1399
u" cannot bind to interface %s",
1570
logger.error("SO_BINDTODEVICE does not exist;"
1571
" cannot bind to interface %s",
1400
1572
self.interface)
1401
1573
else:
1402
1574
try:
1403
1575
self.socket.setsockopt(socket.SOL_SOCKET,
1404
1576
SO_BINDTODEVICE,
1405
1577
str(self.interface
1406
+ u'\0'))
1407
except socket.error, error:
1578
+ '\0'))
1579
except socket.error as error:
1408
1580
if error[0] == errno.EPERM:
1409
logger.error(u"No permission to"
1410
u" bind to interface %s",
1581
logger.error("No permission to"
1582
" bind to interface %s",
1411
1583
self.interface)
1412
1584
elif error[0] == errno.ENOPROTOOPT:
1413
logger.error(u"SO_BINDTODEVICE not available;"
1414
u" cannot bind to interface %s",
1585
logger.error("SO_BINDTODEVICE not available;"
1586
" cannot bind to interface %s",
1415
1587
self.interface)
1416
1588
else:
1417
1589
raise
1419
1591
if self.server_address[0] or self.server_address[1]:
1420
1592
if not self.server_address[0]:
1421
1593
if self.address_family == socket.AF_INET6:
1422
any_address = u"::" # in6addr_any
1594
any_address = "::" # in6addr_any
1423
1595
else:
1424
1596
any_address = socket.INADDR_ANY
1425
1597
self.server_address = (any_address,
1462
1634
def server_activate(self):
1463
1635
if self.enabled:
1464
1636
return socketserver.TCPServer.server_activate(self)
1637
1465
1638
def enable(self):
1466
1639
self.enabled = True
1467
def add_pipe(self, parent_pipe):
1640
1641
def add_pipe(self, parent_pipe, proc):
1468
1642
# Call "handle_ipc" for both data and EOF events
1469
1643
gobject.io_add_watch(parent_pipe.fileno(),
1470
1644
gobject.IO_IN | gobject.IO_HUP,
1471
1645
functools.partial(self.handle_ipc,
1472
parent_pipe = parent_pipe))
1473
1646
parent_pipe =
1647
parent_pipe,
1648
proc = proc))
1649
1474
1650
def handle_ipc(self, source, condition, parent_pipe=None,
1475
client_object=None):
1651
proc = None, client_object=None):
1476
1652
condition_names = {
1477
gobject.IO_IN: u"IN", # There is data to read.
1478
gobject.IO_OUT: u"OUT", # Data can be written (without
1653
gobject.IO_IN: "IN", # There is data to read.
1654
gobject.IO_OUT: "OUT", # Data can be written (without
1479
1655
# blocking).
1480
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1481
gobject.IO_ERR: u"ERR", # Error condition.
1482
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1656
gobject.IO_PRI: "PRI", # There is urgent data to read.
1657
gobject.IO_ERR: "ERR", # Error condition.
1658
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1483
1659
# broken, usually for pipes and
1484
1660
# sockets).
1485
1661
}
1487
1663
for cond, name in
1488
1664
condition_names.iteritems()
1489
1665
if cond & condition)
1490
# error or the other end of multiprocessing.Pipe has closed
1666
# error, or the other end of multiprocessing.Pipe has closed
1491
1667
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1668
# Wait for other process to exit
1669
proc.join()
1492
1670
return False
1493
1671
1494
1672
# Read a request from the child
1504
1682
client = c
1505
1683
break
1506
1684
else:
1507
logger.warning(u"Client not found for fingerprint: %s, ad"
1508
u"dress: %s", fpr, address)
1685
logger.info("Client not found for fingerprint: %s, ad"
1686
"dress: %s", fpr, address)
1509
1687
if self.use_dbus:
1510
1688
# Emit D-Bus signal
1511
mandos_dbus_service.ClientNotFound(fpr, address)
1689
mandos_dbus_service.ClientNotFound(fpr,
1690
address[0])
1512
1691
parent_pipe.send(False)
1513
1692
return False
1514
1693
1515
1694
gobject.io_add_watch(parent_pipe.fileno(),
1516
1695
gobject.IO_IN | gobject.IO_HUP,
1517
1696
functools.partial(self.handle_ipc,
1518
parent_pipe = parent_pipe,
1519
client_object = client))
1697
parent_pipe =
1698
parent_pipe,
1699
proc = proc,
1700
client_object =
1701
client))
1520
1702
parent_pipe.send(True)
1521
# remove the old hook in favor of the new above hook on same fileno
1703
# remove the old hook in favor of the new above hook on
1704
# same fileno
1522
1705
return False
1523
1706
if command == 'funcall':
1524
1707
funcname = request[1]
1525
1708
args = request[2]
1526
1709
kwargs = request[3]
1527
1710
1528
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1529
1711
parent_pipe.send(('data', getattr(client_object,
1712
funcname)(*args,
1713
**kwargs)))
1714
1530
1715
if command == 'getattr':
1531
1716
attrname = request[1]
1532
1717
if callable(client_object.__getattribute__(attrname)):
1533
1718
parent_pipe.send(('function',))
1534
1719
else:
1535
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1720
parent_pipe.send(('data', client_object
1721
.__getattribute__(attrname)))
1536
1722
1537
1723
if command == 'setattr':
1538
1724
attrname = request[1]
1539
1725
value = request[2]
1540
1726
setattr(client_object, attrname, value)
1541
1727
1542
1728
return True
1543
1729
1544
1730
1545
1731
def string_to_delta(interval):
1546
1732
"""Parse a string and return a datetime.timedelta
1547
1733
1548
>>> string_to_delta(u'7d')
1734
>>> string_to_delta('7d')
1549
1735
datetime.timedelta(7)
1550
>>> string_to_delta(u'60s')
1736
>>> string_to_delta('60s')
1551
1737
datetime.timedelta(0, 60)
1552
>>> string_to_delta(u'60m')
1738
>>> string_to_delta('60m')
1553
1739
datetime.timedelta(0, 3600)
1554
>>> string_to_delta(u'24h')
1740
>>> string_to_delta('24h')
1555
1741
datetime.timedelta(1)
1556
>>> string_to_delta(u'1w')
1742
>>> string_to_delta('1w')
1557
1743
datetime.timedelta(7)
1558
>>> string_to_delta(u'5m 30s')
1744
>>> string_to_delta('5m 30s')
1559
1745
datetime.timedelta(0, 330)
1560
1746
"""
1561
1747
timevalue = datetime.timedelta(0)
1563
1749
try:
1564
1750
suffix = unicode(s[-1])
1565
1751
value = int(s[:-1])
1566
if suffix == u"d":
1752
if suffix == "d":
1567
1753
delta = datetime.timedelta(value)
1568
elif suffix == u"s":
1754
elif suffix == "s":
1569
1755
delta = datetime.timedelta(0, value)
1570
elif suffix == u"m":
1756
elif suffix == "m":
1571
1757
delta = datetime.timedelta(0, 0, 0, 0, value)
1572
elif suffix == u"h":
1758
elif suffix == "h":
1573
1759
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1574
elif suffix == u"w":
1760
elif suffix == "w":
1575
1761
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1576
1762
else:
1577
raise ValueError(u"Unknown suffix %r" % suffix)
1578
except (ValueError, IndexError), e:
1579
raise ValueError(e.message)
1763
raise ValueError("Unknown suffix %r" % suffix)
1764
except (ValueError, IndexError) as e:
1765
raise ValueError(*(e.args))
1580
1766
timevalue += delta
1581
1767
return timevalue
1582
1768
1588
1774
global if_nametoindex
1589
1775
try:
1590
1776
if_nametoindex = (ctypes.cdll.LoadLibrary
1591
(ctypes.util.find_library(u"c"))
1777
(ctypes.util.find_library("c"))
1592
1778
.if_nametoindex)
1593
1779
except (OSError, AttributeError):
1594
logger.warning(u"Doing if_nametoindex the hard way")
1780
logger.warning("Doing if_nametoindex the hard way")
1595
1781
def if_nametoindex(interface):
1596
1782
"Get an interface index the hard way, i.e. using fcntl()"
1597
1783
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1598
1784
with contextlib.closing(socket.socket()) as s:
1599
1785
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1600
struct.pack(str(u"16s16x"),
1786
struct.pack(str("16s16x"),
1601
1787
interface))
1602
interface_index = struct.unpack(str(u"I"),
1788
interface_index = struct.unpack(str("I"),
1603
1789
ifreq[16:20])[0]
1604
1790
return interface_index
1605
1791
return if_nametoindex(interface)
1613
1799
sys.exit()
1614
1800
os.setsid()
1615
1801
if not nochdir:
1616
os.chdir(u"/")
1802
os.chdir("/")
1617
1803
if os.fork():
1618
1804
sys.exit()
1619
1805
if not noclose:
1621
1807
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1622
1808
if not stat.S_ISCHR(os.fstat(null).st_mode):
1623
1809
raise OSError(errno.ENODEV,
1624
u"%s not a character device"
1810
"%s not a character device"
1625
1811
% os.path.devnull)
1626
1812
os.dup2(null, sys.stdin.fileno())
1627
1813
os.dup2(null, sys.stdout.fileno())
1635
1821
##################################################################
1636
1822
# Parsing of options, both command line and config file
1637
1823
1638
parser = optparse.OptionParser(version = "%%prog %s" % version)
1639
parser.add_option("-i", u"--interface", type=u"string",
1640
metavar="IF", help=u"Bind to interface IF")
1641
parser.add_option("-a", u"--address", type=u"string",
1642
help=u"Address to listen for requests on")
1643
parser.add_option("-p", u"--port", type=u"int",
1644
help=u"Port number to receive requests on")
1645
parser.add_option("--check", action=u"store_true",
1646
help=u"Run self-test")
1647
parser.add_option("--debug", action=u"store_true",
1648
help=u"Debug mode; run in foreground and log to"
1649
u" terminal")
1650
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1651
help=u"Debug level for stdout output")
1652
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1653
u" priority string (see GnuTLS documentation)")
1654
parser.add_option("--servicename", type=u"string",
1655
metavar=u"NAME", help=u"Zeroconf service name")
1656
parser.add_option("--configdir", type=u"string",
1657
default=u"/etc/mandos", metavar=u"DIR",
1658
help=u"Directory to search for configuration"
1659
u" files")
1660
parser.add_option("--no-dbus", action=u"store_false",
1661
dest=u"use_dbus", help=u"Do not provide D-Bus"
1662
u" system bus interface")
1663
parser.add_option("--no-ipv6", action=u"store_false",
1664
dest=u"use_ipv6", help=u"Do not use IPv6")
1665
options = parser.parse_args()[0]
1824
parser = argparse.ArgumentParser()
1825
parser.add_argument("-v", "--version", action="version",
1826
version = "%%(prog)s %s" % version,
1827
help="show version number and exit")
1828
parser.add_argument("-i", "--interface", metavar="IF",
1829
help="Bind to interface IF")
1830
parser.add_argument("-a", "--address",
1831
help="Address to listen for requests on")
1832
parser.add_argument("-p", "--port", type=int,
1833
help="Port number to receive requests on")
1834
parser.add_argument("--check", action="store_true",
1835
help="Run self-test")
1836
parser.add_argument("--debug", action="store_true",
1837
help="Debug mode; run in foreground and log"
1838
" to terminal")
1839
parser.add_argument("--debuglevel", metavar="LEVEL",
1840
help="Debug level for stdout output")
1841
parser.add_argument("--priority", help="GnuTLS"
1842
" priority string (see GnuTLS documentation)")
1843
parser.add_argument("--servicename",
1844
metavar="NAME", help="Zeroconf service name")
1845
parser.add_argument("--configdir",
1846
default="/etc/mandos", metavar="DIR",
1847
help="Directory to search for configuration"
1848
" files")
1849
parser.add_argument("--no-dbus", action="store_false",
1850
dest="use_dbus", help="Do not provide D-Bus"
1851
" system bus interface")
1852
parser.add_argument("--no-ipv6", action="store_false",
1853
dest="use_ipv6", help="Do not use IPv6")
1854
options = parser.parse_args()
1666
1855
1667
1856
if options.check:
1668
1857
import doctest
1670
1859
sys.exit()
1671
1860
1672
1861
# Default values for config file for server-global settings
1673
server_defaults = { u"interface": u"",
1674
u"address": u"",
1675
u"port": u"",
1676
u"debug": u"False",
1677
u"priority":
1678
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1679
u"servicename": u"Mandos",
1680
u"use_dbus": u"True",
1681
u"use_ipv6": u"True",
1682
u"debuglevel": u"",
1862
server_defaults = { "interface": "",
1863
"address": "",
1864
"port": "",
1865
"debug": "False",
1866
"priority":
1867
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1868
"servicename": "Mandos",
1869
"use_dbus": "True",
1870
"use_ipv6": "True",
1871
"debuglevel": "",
1683
1872
}
1684
1873
1685
1874
# Parse config file for server-global settings
1686
1875
server_config = configparser.SafeConfigParser(server_defaults)
1687
1876
del server_defaults
1688
1877
server_config.read(os.path.join(options.configdir,
1689
u"mandos.conf"))
1878
"mandos.conf"))
1690
1879
# Convert the SafeConfigParser object to a dict
1691
1880
server_settings = server_config.defaults()
1692
1881
# Use the appropriate methods on the non-string config options
1693
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1694
server_settings[option] = server_config.getboolean(u"DEFAULT",
1882
for option in ("debug", "use_dbus", "use_ipv6"):
1883
server_settings[option] = server_config.getboolean("DEFAULT",
1695
1884
option)
1696
1885
if server_settings["port"]:
1697
server_settings["port"] = server_config.getint(u"DEFAULT",
1698
u"port")
1886
server_settings["port"] = server_config.getint("DEFAULT",
1887
"port")
1699
1888
del server_config
1700
1889
1701
1890
# Override the settings from the config file with command line
1702
1891
# options, if set.
1703
for option in (u"interface", u"address", u"port", u"debug",
1704
u"priority", u"servicename", u"configdir",
1705
u"use_dbus", u"use_ipv6", u"debuglevel"):
1892
for option in ("interface", "address", "port", "debug",
1893
"priority", "servicename", "configdir",
1894
"use_dbus", "use_ipv6", "debuglevel"):
1706
1895
value = getattr(options, option)
1707
1896
if value is not None:
1708
1897
server_settings[option] = value
1716
1905
##################################################################
1717
1906
1718
1907
# For convenience
1719
debug = server_settings[u"debug"]
1720
debuglevel = server_settings[u"debuglevel"]
1721
use_dbus = server_settings[u"use_dbus"]
1722
use_ipv6 = server_settings[u"use_ipv6"]
1723
1724
if server_settings[u"servicename"] != u"Mandos":
1908
debug = server_settings["debug"]
1909
debuglevel = server_settings["debuglevel"]
1910
use_dbus = server_settings["use_dbus"]
1911
use_ipv6 = server_settings["use_ipv6"]
1912
1913
if server_settings["servicename"] != "Mandos":
1725
1914
syslogger.setFormatter(logging.Formatter
1726
(u'Mandos (%s) [%%(process)d]:'
1727
u' %%(levelname)s: %%(message)s'
1728
% server_settings[u"servicename"]))
1915
('Mandos (%s) [%%(process)d]:'
1916
' %%(levelname)s: %%(message)s'
1917
% server_settings["servicename"]))
1729
1918
1730
1919
# Parse config file with clients
1731
client_defaults = { u"timeout": u"1h",
1732
u"interval": u"5m",
1733
u"checker": u"fping -q -- %%(host)s",
1734
u"host": u"",
1735
u"approval_delay": u"0s",
1736
u"approval_duration": u"1s",
1920
client_defaults = { "timeout": "5m",
1921
"extended_timeout": "15m",
1922
"interval": "2m",
1923
"checker": "fping -q -- %%(host)s",
1924
"host": "",
1925
"approval_delay": "0s",
1926
"approval_duration": "1s",
1737
1927
}
1738
1928
client_config = configparser.SafeConfigParser(client_defaults)
1739
client_config.read(os.path.join(server_settings[u"configdir"],
1740
u"clients.conf"))
1929
client_config.read(os.path.join(server_settings["configdir"],
1930
"clients.conf"))
1741
1931
1742
1932
global mandos_dbus_service
1743
1933
mandos_dbus_service = None
1744
1934
1745
tcp_server = MandosServer((server_settings[u"address"],
1746
server_settings[u"port"]),
1935
tcp_server = MandosServer((server_settings["address"],
1936
server_settings["port"]),
1747
1937
ClientHandler,
1748
interface=(server_settings[u"interface"]
1938
interface=(server_settings["interface"]
1749
1939
or None),
1750
1940
use_ipv6=use_ipv6,
1751
1941
gnutls_priority=
1752
server_settings[u"priority"],
1942
server_settings["priority"],
1753
1943
use_dbus=use_dbus)
1754
pidfilename = u"/var/run/mandos.pid"
1755
try:
1756
pidfile = open(pidfilename, u"w")
1757
except IOError:
1758
logger.error(u"Could not open file %r", pidfilename)
1944
if not debug:
1945
pidfilename = "/var/run/mandos.pid"
1946
try:
1947
pidfile = open(pidfilename, "w")
1948
except IOError:
1949
logger.error("Could not open file %r", pidfilename)
1759
1950
1760
1951
try:
1761
uid = pwd.getpwnam(u"_mandos").pw_uid
1762
gid = pwd.getpwnam(u"_mandos").pw_gid
1952
uid = pwd.getpwnam("_mandos").pw_uid
1953
gid = pwd.getpwnam("_mandos").pw_gid
1763
1954
except KeyError:
1764
1955
try:
1765
uid = pwd.getpwnam(u"mandos").pw_uid
1766
gid = pwd.getpwnam(u"mandos").pw_gid
1956
uid = pwd.getpwnam("mandos").pw_uid
1957
gid = pwd.getpwnam("mandos").pw_gid
1767
1958
except KeyError:
1768
1959
try:
1769
uid = pwd.getpwnam(u"nobody").pw_uid
1770
gid = pwd.getpwnam(u"nobody").pw_gid
1960
uid = pwd.getpwnam("nobody").pw_uid
1961
gid = pwd.getpwnam("nobody").pw_gid
1771
1962
except KeyError:
1772
1963
uid = 65534
1773
1964
gid = 65534
1774
1965
try:
1775
1966
os.setgid(gid)
1776
1967
os.setuid(uid)
1777
except OSError, error:
1968
except OSError as error:
1778
1969
if error[0] != errno.EPERM:
1779
1970
raise error
1780
1971
1785
1976
level = getattr(logging, debuglevel.upper())
1786
1977
syslogger.setLevel(level)
1787
1978
console.setLevel(level)
1788
1979
1789
1980
if debug:
1790
1981
# Enable all possible GnuTLS debugging
1791
1982
1795
1986
1796
1987
@gnutls.library.types.gnutls_log_func
1797
1988
def debug_gnutls(level, string):
1798
logger.debug(u"GnuTLS: %s", string[:-1])
1989
logger.debug("GnuTLS: %s", string[:-1])
1799
1990
1800
1991
(gnutls.library.functions
1801
1992
.gnutls_global_set_log_function(debug_gnutls))
1809
2000
# No console logging
1810
2001
logger.removeHandler(console)
1811
2002
2003
# Need to fork before connecting to D-Bus
2004
if not debug:
2005
# Close all input and output, do double fork, etc.
2006
daemon()
1812
2007
1813
2008
global main_loop
1814
2009
# From the Avahi example code
1818
2013
# End of Avahi example code
1819
2014
if use_dbus:
1820
2015
try:
1821
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
2016
bus_name = dbus.service.BusName("se.recompile.Mandos",
1822
2017
bus, do_not_queue=True)
1823
except dbus.exceptions.NameExistsException, e:
1824
logger.error(unicode(e) + u", disabling D-Bus")
2018
old_bus_name = (dbus.service.BusName
2019
("se.bsnet.fukt.Mandos", bus,
2020
do_not_queue=True))
2021
except dbus.exceptions.NameExistsException as e:
2022
logger.error(unicode(e) + ", disabling D-Bus")
1825
2023
use_dbus = False
1826
server_settings[u"use_dbus"] = False
2024
server_settings["use_dbus"] = False
1827
2025
tcp_server.use_dbus = False
1828
2026
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1829
service = AvahiService(name = server_settings[u"servicename"],
1830
servicetype = u"_mandos._tcp",
2027
service = AvahiService(name = server_settings["servicename"],
2028
servicetype = "_mandos._tcp",
1831
2029
protocol = protocol, bus = bus)
1832
2030
if server_settings["interface"]:
1833
2031
service.interface = (if_nametoindex
1834
(str(server_settings[u"interface"])))
1835
1836
if not debug:
1837
# Close all input and output, do double fork, etc.
1838
daemon()
1839
2032
(str(server_settings["interface"])))
2033
1840
2034
global multiprocessing_manager
1841
2035
multiprocessing_manager = multiprocessing.Manager()
1842
2036
1843
2037
client_class = Client
1844
2038
if use_dbus:
1845
client_class = functools.partial(ClientDBus, bus = bus)
2039
client_class = functools.partial(ClientDBusTransitional,
2040
bus = bus)
1846
2041
def client_config_items(config, section):
1847
2042
special_settings = {
1848
2043
"approved_by_default":
1861
2056
client_config, section)))
1862
2057
for section in client_config.sections()))
1863
2058
if not tcp_server.clients:
1864
logger.warning(u"No clients defined")
2059
logger.warning("No clients defined")
1865
2060
1866
try:
1867
with pidfile:
1868
pid = os.getpid()
1869
pidfile.write(str(pid) + "\n")
1870
del pidfile
1871
except IOError:
1872
logger.error(u"Could not write to file %r with PID %d",
1873
pidfilename, pid)
1874
except NameError:
1875
# "pidfile" was never created
1876
pass
1877
del pidfilename
1878
1879
2061
if not debug:
2062
try:
2063
with pidfile:
2064
pid = os.getpid()
2065
pidfile.write(str(pid) + "\n".encode("utf-8"))
2066
del pidfile
2067
except IOError:
2068
logger.error("Could not write to file %r with PID %d",
2069
pidfilename, pid)
2070
except NameError:
2071
# "pidfile" was never created
2072
pass
2073
del pidfilename
2074
1880
2075
signal.signal(signal.SIGINT, signal.SIG_IGN)
2076
1881
2077
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1882
2078
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1883
2079
1885
2081
class MandosDBusService(dbus.service.Object):
1886
2082
"""A D-Bus proxy object"""
1887
2083
def __init__(self):
1888
dbus.service.Object.__init__(self, bus, u"/")
1889
_interface = u"se.bsnet.fukt.Mandos"
2084
dbus.service.Object.__init__(self, bus, "/")
2085
_interface = "se.recompile.Mandos"
1890
2086
1891
@dbus.service.signal(_interface, signature=u"o")
2087
@dbus.service.signal(_interface, signature="o")
1892
2088
def ClientAdded(self, objpath):
1893
2089
"D-Bus signal"
1894
2090
pass
1895
2091
1896
@dbus.service.signal(_interface, signature=u"ss")
2092
@dbus.service.signal(_interface, signature="ss")
1897
2093
def ClientNotFound(self, fingerprint, address):
1898
2094
"D-Bus signal"
1899
2095
pass
1900
2096
1901
@dbus.service.signal(_interface, signature=u"os")
2097
@dbus.service.signal(_interface, signature="os")
1902
2098
def ClientRemoved(self, objpath, name):
1903
2099
"D-Bus signal"
1904
2100
pass
1905
2101
1906
@dbus.service.method(_interface, out_signature=u"ao")
2102
@dbus.service.method(_interface, out_signature="ao")
1907
2103
def GetAllClients(self):
1908
2104
"D-Bus method"
1909
2105
return dbus.Array(c.dbus_object_path
1910
2106
for c in tcp_server.clients)
1911
2107
1912
2108
@dbus.service.method(_interface,
1913
out_signature=u"a{oa{sv}}")
2109
out_signature="a{oa{sv}}")
1914
2110
def GetAllClientsWithProperties(self):
1915
2111
"D-Bus method"
1916
2112
return dbus.Dictionary(
1917
((c.dbus_object_path, c.GetAll(u""))
2113
((c.dbus_object_path, c.GetAll(""))
1918
2114
for c in tcp_server.clients),
1919
signature=u"oa{sv}")
2115
signature="oa{sv}")
1920
2116
1921
@dbus.service.method(_interface, in_signature=u"o")
2117
@dbus.service.method(_interface, in_signature="o")
1922
2118
def RemoveClient(self, object_path):
1923
2119
"D-Bus method"
1924
2120
for c in tcp_server.clients:
1934
2130
1935
2131
del _interface
1936
2132
1937
mandos_dbus_service = MandosDBusService()
2133
class MandosDBusServiceTransitional(MandosDBusService):
2134
__metaclass__ = AlternateDBusNamesMetaclass
2135
mandos_dbus_service = MandosDBusServiceTransitional()
1938
2136
1939
2137
def cleanup():
1940
2138
"Cleanup function; run on exit"
1941
2139
service.cleanup()
1942
2140
2141
multiprocessing.active_children()
1943
2142
while tcp_server.clients:
1944
2143
client = tcp_server.clients.pop()
1945
2144
if use_dbus:
1949
2148
client.disable(quiet=True)
1950
2149
if use_dbus:
1951
2150
# Emit D-Bus signal
1952
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2151
mandos_dbus_service.ClientRemoved(client
2152
.dbus_object_path,
1953
2153
client.name)
1954
2154
1955
2155
atexit.register(cleanup)
1966
2166
# Find out what port we got
1967
2167
service.port = tcp_server.socket.getsockname()[1]
1968
2168
if use_ipv6:
1969
logger.info(u"Now listening on address %r, port %d,"
2169
logger.info("Now listening on address %r, port %d,"
1970
2170
" flowinfo %d, scope_id %d"
1971
2171
% tcp_server.socket.getsockname())
1972
2172
else: # IPv4
1973
logger.info(u"Now listening on address %r, port %d"
2173
logger.info("Now listening on address %r, port %d"
1974
2174
% tcp_server.socket.getsockname())
1975
2175
1976
2176
#service.interface = tcp_server.socket.getsockname()[3]
1979
2179
# From the Avahi example code
1980
2180
try:
1981
2181
service.activate()
1982
except dbus.exceptions.DBusException, error:
1983
logger.critical(u"DBusException: %s", error)
2182
except dbus.exceptions.DBusException as error:
2183
logger.critical("DBusException: %s", error)
1984
2184
cleanup()
1985
2185
sys.exit(1)
1986
2186
# End of Avahi example code
1990
2190
(tcp_server.handle_request
1991
2191
(*args[2:], **kwargs) or True))
1992
2192
1993
logger.debug(u"Starting main loop")
2193
logger.debug("Starting main loop")
1994
2194
main_loop.run()
1995
except AvahiError, error:
1996
logger.critical(u"AvahiError: %s", error)
2195
except AvahiError as error:
2196
logger.critical("AvahiError: %s", error)
1997
2197
cleanup()
1998
2198
sys.exit(1)
1999
2199
except KeyboardInterrupt:
2000
2200
if debug:
2001
print >> sys.stderr
2002
logger.debug(u"Server received KeyboardInterrupt")
2003
logger.debug(u"Server exiting")
2201
print("", file=sys.stderr)
2202
logger.debug("Server received KeyboardInterrupt")
2203
logger.debug("Server exiting")
2004
2204
# Must run before the D-Bus bus name gets deregistered
2005
2205
cleanup()
2006
2206
2207
2007
2208
if __name__ == '__main__':
2008
2209
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0