To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 505.3.6
- compare with another revision
- download diff
- download tarball
- view history from revision 505.3.6
- Committer: teddy at bsnet
- Date: 2011-11-13 13:55:45 UTC
- mto: (505.2.5 mandos-client-network-hooks)
- mto: This revision was merged to the branch mainline in revision 525.
- Revision ID: teddy@fukt.bsnet.se-20111113135545-hyb59g1q2icwdcte
* plugins.d/mandos-client.c: Some white space fixes.
(runnable_hook): Simplify name rule. More debug messages.
(runnable_hook): Simplify name rule. More debug messages.
- files added:
- DBUS-API
- debian/source
- files removed:
- plugins.d/plymouth
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
# Contact the authors at <mandos@recompile.se>.
32
32
#
33
33
34
from __future__ import division, with_statement, absolute_import
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
35
36
36
37
import SocketServer as socketserver
37
38
import socket
38
import optparse
39
import argparse
39
40
import datetime
40
41
import errno
41
42
import gnutls.crypto
61
62
import functools
62
63
import cPickle as pickle
63
64
import multiprocessing
65
import types
64
66
65
67
import dbus
66
68
import dbus.service
81
83
SO_BINDTODEVICE = None
82
84
83
85
84
version = "1.0.14"
86
version = "1.4.1"
85
87
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
88
90
syslogger = (logging.handlers.SysLogHandler
89
91
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
90
address = "/dev/log"))
92
address = str("/dev/log")))
91
93
syslogger.setFormatter(logging.Formatter
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
94
96
logger.addHandler(syslogger)
95
97
96
98
console = logging.StreamHandler()
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
100
102
logger.addHandler(console)
101
103
102
104
class AvahiError(Exception):
119
121
Attributes:
120
122
interface: integer; avahi.IF_UNSPEC or an interface index.
121
123
Used to optionally bind to the specified interface.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
124
name: string; Example: 'Mandos'
125
type: string; Example: '_mandos._tcp'.
124
126
See <http://www.dns-sd.org/ServiceTypes.html>
125
127
port: integer; what port to announce
126
128
TXT: list of strings; TXT record for the service
135
137
"""
136
138
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
137
139
servicetype = None, port = None, TXT = None,
138
domain = u"", host = u"", max_renames = 32768,
140
domain = "", host = "", max_renames = 32768,
139
141
protocol = avahi.PROTO_UNSPEC, bus = None):
140
142
self.interface = interface
141
143
self.name = name
150
152
self.group = None # our entry group
151
153
self.server = None
152
154
self.bus = bus
155
self.entry_group_state_changed_match = None
153
156
def rename(self):
154
157
"""Derived from the Avahi example code"""
155
158
if self.rename_count >= self.max_renames:
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
159
logger.critical("No suitable Zeroconf service name found"
160
" after %i retries, exiting.",
158
161
self.rename_count)
159
raise AvahiServiceError(u"Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
161
logger.info(u"Changing Zeroconf service name to %r ...",
162
raise AvahiServiceError("Too many renames")
163
self.name = unicode(self.server
164
.GetAlternativeServiceName(self.name))
165
logger.info("Changing Zeroconf service name to %r ...",
162
166
self.name)
163
167
syslogger.setFormatter(logging.Formatter
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
168
('Mandos (%s) [%%(process)d]:'
169
' %%(levelname)s: %%(message)s'
166
170
% self.name))
167
171
self.remove()
168
self.add()
172
try:
173
self.add()
174
except dbus.exceptions.DBusException as error:
175
logger.critical("DBusException: %s", error)
176
self.cleanup()
177
os._exit(1)
169
178
self.rename_count += 1
170
179
def remove(self):
171
180
"""Derived from the Avahi example code"""
181
if self.entry_group_state_changed_match is not None:
182
self.entry_group_state_changed_match.remove()
183
self.entry_group_state_changed_match = None
172
184
if self.group is not None:
173
185
self.group.Reset()
174
186
def add(self):
175
187
"""Derived from the Avahi example code"""
188
self.remove()
176
189
if self.group is None:
177
190
self.group = dbus.Interface(
178
191
self.bus.get_object(avahi.DBUS_NAME,
179
192
self.server.EntryGroupNew()),
180
193
avahi.DBUS_INTERFACE_ENTRY_GROUP)
181
self.group.connect_to_signal('StateChanged',
182
self
183
.entry_group_state_changed)
184
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
194
self.entry_group_state_changed_match = (
195
self.group.connect_to_signal(
196
'StateChanged', self .entry_group_state_changed))
197
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
185
198
self.name, self.type)
186
199
self.group.AddService(
187
200
self.interface,
194
207
self.group.Commit()
195
208
def entry_group_state_changed(self, state, error):
196
209
"""Derived from the Avahi example code"""
197
logger.debug(u"Avahi state change: %i", state)
210
logger.debug("Avahi entry group state change: %i", state)
198
211
199
212
if state == avahi.ENTRY_GROUP_ESTABLISHED:
200
logger.debug(u"Zeroconf service established.")
213
logger.debug("Zeroconf service established.")
201
214
elif state == avahi.ENTRY_GROUP_COLLISION:
202
logger.warning(u"Zeroconf service name collision.")
215
logger.info("Zeroconf service name collision.")
203
216
self.rename()
204
217
elif state == avahi.ENTRY_GROUP_FAILURE:
205
logger.critical(u"Avahi: Error in group state changed %s",
218
logger.critical("Avahi: Error in group state changed %s",
206
219
unicode(error))
207
raise AvahiGroupError(u"State changed: %s"
220
raise AvahiGroupError("State changed: %s"
208
221
% unicode(error))
209
222
def cleanup(self):
210
223
"""Derived from the Avahi example code"""
211
224
if self.group is not None:
212
self.group.Free()
225
try:
226
self.group.Free()
227
except (dbus.exceptions.UnknownMethodException,
228
dbus.exceptions.DBusException) as e:
229
pass
213
230
self.group = None
214
def server_state_changed(self, state):
231
self.remove()
232
def server_state_changed(self, state, error=None):
215
233
"""Derived from the Avahi example code"""
216
if state == avahi.SERVER_COLLISION:
217
logger.error(u"Zeroconf server name collision")
218
self.remove()
234
logger.debug("Avahi server state change: %i", state)
235
bad_states = { avahi.SERVER_INVALID:
236
"Zeroconf server invalid",
237
avahi.SERVER_REGISTERING: None,
238
avahi.SERVER_COLLISION:
239
"Zeroconf server name collision",
240
avahi.SERVER_FAILURE:
241
"Zeroconf server failure" }
242
if state in bad_states:
243
if bad_states[state] is not None:
244
if error is None:
245
logger.error(bad_states[state])
246
else:
247
logger.error(bad_states[state] + ": %r", error)
248
self.cleanup()
219
249
elif state == avahi.SERVER_RUNNING:
220
250
self.add()
251
else:
252
if error is None:
253
logger.debug("Unknown state: %r", state)
254
else:
255
logger.debug("Unknown state: %r: %r", state, error)
221
256
def activate(self):
222
257
"""Derived from the Avahi example code"""
223
258
if self.server is None:
224
259
self.server = dbus.Interface(
225
260
self.bus.get_object(avahi.DBUS_NAME,
226
avahi.DBUS_PATH_SERVER),
261
avahi.DBUS_PATH_SERVER,
262
follow_name_owner_changes=True),
227
263
avahi.DBUS_INTERFACE_SERVER)
228
self.server.connect_to_signal(u"StateChanged",
264
self.server.connect_to_signal("StateChanged",
229
265
self.server_state_changed)
230
266
self.server_state_changed(self.server.GetState())
231
267
232
268
269
def _timedelta_to_milliseconds(td):
270
"Convert a datetime.timedelta() to milliseconds"
271
return ((td.days * 24 * 60 * 60 * 1000)
272
+ (td.seconds * 1000)
273
+ (td.microseconds // 1000))
274
233
275
class Client(object):
234
276
"""A representation of a client host served by this server.
235
277
236
278
Attributes:
237
name: string; from the config file, used in log messages and
238
D-Bus identifiers
279
_approved: bool(); 'None' if not yet approved/disapproved
280
approval_delay: datetime.timedelta(); Time to wait for approval
281
approval_duration: datetime.timedelta(); Duration of one approval
282
checker: subprocess.Popen(); a running checker process used
283
to see if the client lives.
284
'None' if no process is running.
285
checker_callback_tag: a gobject event source tag, or None
286
checker_command: string; External command which is run to check
287
if client lives. %() expansions are done at
288
runtime with vars(self) as dict, so that for
289
instance %(name)s can be used in the command.
290
checker_initiator_tag: a gobject event source tag, or None
291
created: datetime.datetime(); (UTC) object creation
292
current_checker_command: string; current running checker_command
293
disable_hook: If set, called by disable() as disable_hook(self)
294
disable_initiator_tag: a gobject event source tag, or None
295
enabled: bool()
239
296
fingerprint: string (40 or 32 hexadecimal digits); used to
240
297
uniquely identify the client
241
secret: bytestring; sent verbatim (over TLS) to client
242
298
host: string; available for use by the checker command
243
created: datetime.datetime(); (UTC) object creation
299
interval: datetime.timedelta(); How often to start a new checker
300
last_approval_request: datetime.datetime(); (UTC) or None
301
last_checked_ok: datetime.datetime(); (UTC) or None
244
302
last_enabled: datetime.datetime(); (UTC)
245
enabled: bool()
246
last_checked_ok: datetime.datetime(); (UTC) or None
303
name: string; from the config file, used in log messages and
304
D-Bus identifiers
305
secret: bytestring; sent verbatim (over TLS) to client
247
306
timeout: datetime.timedelta(); How long from last_checked_ok
248
307
until this client is disabled
249
interval: datetime.timedelta(); How often to start a new checker
250
disable_hook: If set, called by disable() as disable_hook(self)
251
checker: subprocess.Popen(); a running checker process used
252
to see if the client lives.
253
'None' if no process is running.
254
checker_initiator_tag: a gobject event source tag, or None
255
disable_initiator_tag: - '' -
256
checker_callback_tag: - '' -
257
checker_command: string; External command which is run to check if
258
client lives. %() expansions are done at
259
runtime with vars(self) as dict, so that for
260
instance %(name)s can be used in the command.
261
current_checker_command: string; current running checker_command
262
approved_delay: datetime.timedelta(); Time to wait for approval
263
_approved: bool(); 'None' if not yet approved/disapproved
264
approved_duration: datetime.timedelta(); Duration of one approval
308
extended_timeout: extra long timeout when password has been sent
309
runtime_expansions: Allowed attributes for runtime expansion.
310
expires: datetime.datetime(); time (UTC) when a client will be
311
disabled, or None
265
312
"""
266
313
267
@staticmethod
268
def _timedelta_to_milliseconds(td):
269
"Convert a datetime.timedelta() to milliseconds"
270
return ((td.days * 24 * 60 * 60 * 1000)
271
+ (td.seconds * 1000)
272
+ (td.microseconds // 1000))
314
runtime_expansions = ("approval_delay", "approval_duration",
315
"created", "enabled", "fingerprint",
316
"host", "interval", "last_checked_ok",
317
"last_enabled", "name", "timeout")
273
318
274
319
def timeout_milliseconds(self):
275
320
"Return the 'timeout' attribute in milliseconds"
276
return self._timedelta_to_milliseconds(self.timeout)
321
return _timedelta_to_milliseconds(self.timeout)
322
323
def extended_timeout_milliseconds(self):
324
"Return the 'extended_timeout' attribute in milliseconds"
325
return _timedelta_to_milliseconds(self.extended_timeout)
277
326
278
327
def interval_milliseconds(self):
279
328
"Return the 'interval' attribute in milliseconds"
280
return self._timedelta_to_milliseconds(self.interval)
281
282
def approved_delay_milliseconds(self):
283
return self._timedelta_to_milliseconds(self.approved_delay)
329
return _timedelta_to_milliseconds(self.interval)
330
331
def approval_delay_milliseconds(self):
332
return _timedelta_to_milliseconds(self.approval_delay)
284
333
285
334
def __init__(self, name = None, disable_hook=None, config=None):
286
335
"""Note: the 'checker' key in 'config' sets the
289
338
self.name = name
290
339
if config is None:
291
340
config = {}
292
logger.debug(u"Creating client %r", self.name)
341
logger.debug("Creating client %r", self.name)
293
342
# Uppercase and remove spaces from fingerprint for later
294
343
# comparison purposes with return value from the fingerprint()
295
344
# function
296
self.fingerprint = (config[u"fingerprint"].upper()
297
.replace(u" ", u""))
298
logger.debug(u" Fingerprint: %s", self.fingerprint)
299
if u"secret" in config:
300
self.secret = config[u"secret"].decode(u"base64")
301
elif u"secfile" in config:
345
self.fingerprint = (config["fingerprint"].upper()
346
.replace(" ", ""))
347
logger.debug(" Fingerprint: %s", self.fingerprint)
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
302
351
with open(os.path.expanduser(os.path.expandvars
303
(config[u"secfile"])),
352
(config["secfile"])),
304
353
"rb") as secfile:
305
354
self.secret = secfile.read()
306
355
else:
307
raise TypeError(u"No secret or secfile for client %s"
356
raise TypeError("No secret or secfile for client %s"
308
357
% self.name)
309
self.host = config.get(u"host", u"")
358
self.host = config.get("host", "")
310
359
self.created = datetime.datetime.utcnow()
311
360
self.enabled = False
361
self.last_approval_request = None
312
362
self.last_enabled = None
313
363
self.last_checked_ok = None
314
self.timeout = string_to_delta(config[u"timeout"])
315
self.interval = string_to_delta(config[u"interval"])
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
316
368
self.disable_hook = disable_hook
317
369
self.checker = None
318
370
self.checker_initiator_tag = None
319
371
self.disable_initiator_tag = None
372
self.expires = None
320
373
self.checker_callback_tag = None
321
self.checker_command = config[u"checker"]
374
self.checker_command = config["checker"]
322
375
self.current_checker_command = None
323
376
self.last_connect = None
324
377
self._approved = None
325
self.approved_by_default = config.get(u"approved_by_default",
378
self.approved_by_default = config.get("approved_by_default",
326
379
True)
327
380
self.approvals_pending = 0
328
self.approved_delay = string_to_delta(
329
config[u"approved_delay"])
330
self.approved_duration = string_to_delta(
331
config[u"approved_duration"])
332
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
381
self.approval_delay = string_to_delta(
382
config["approval_delay"])
383
self.approval_duration = string_to_delta(
384
config["approval_duration"])
385
self.changedstate = (multiprocessing_manager
386
.Condition(multiprocessing_manager
387
.Lock()))
333
388
334
389
def send_changedstate(self):
335
390
self.changedstate.acquire()
336
391
self.changedstate.notify_all()
337
392
self.changedstate.release()
338
393
339
394
def enable(self):
340
395
"""Start this client's checker and timeout hooks"""
341
if getattr(self, u"enabled", False):
396
if getattr(self, "enabled", False):
342
397
# Already enabled
343
398
return
344
399
self.send_changedstate()
345
self.last_enabled = datetime.datetime.utcnow()
346
400
# Schedule a new checker to be started an 'interval' from now,
347
401
# and every interval from then on.
348
402
self.checker_initiator_tag = (gobject.timeout_add
349
403
(self.interval_milliseconds(),
350
404
self.start_checker))
351
405
# Schedule a disable() when 'timeout' has passed
406
self.expires = datetime.datetime.utcnow() + self.timeout
352
407
self.disable_initiator_tag = (gobject.timeout_add
353
408
(self.timeout_milliseconds(),
354
409
self.disable))
355
410
self.enabled = True
411
self.last_enabled = datetime.datetime.utcnow()
356
412
# Also start a new checker *right now*.
357
413
self.start_checker()
358
414
363
419
if not quiet:
364
420
self.send_changedstate()
365
421
if not quiet:
366
logger.info(u"Disabling client %s", self.name)
367
if getattr(self, u"disable_initiator_tag", False):
422
logger.info("Disabling client %s", self.name)
423
if getattr(self, "disable_initiator_tag", False):
368
424
gobject.source_remove(self.disable_initiator_tag)
369
425
self.disable_initiator_tag = None
370
if getattr(self, u"checker_initiator_tag", False):
426
self.expires = None
427
if getattr(self, "checker_initiator_tag", False):
371
428
gobject.source_remove(self.checker_initiator_tag)
372
429
self.checker_initiator_tag = None
373
430
self.stop_checker()
388
445
if os.WIFEXITED(condition):
389
446
exitstatus = os.WEXITSTATUS(condition)
390
447
if exitstatus == 0:
391
logger.info(u"Checker for %(name)s succeeded",
448
logger.info("Checker for %(name)s succeeded",
392
449
vars(self))
393
450
self.checked_ok()
394
451
else:
395
logger.info(u"Checker for %(name)s failed",
452
logger.info("Checker for %(name)s failed",
396
453
vars(self))
397
454
else:
398
logger.warning(u"Checker for %(name)s crashed?",
455
logger.warning("Checker for %(name)s crashed?",
399
456
vars(self))
400
457
401
def checked_ok(self):
458
def checked_ok(self, timeout=None):
402
459
"""Bump up the timeout for this client.
403
460
404
461
This should only be called when the client has been seen,
405
462
alive and well.
406
463
"""
464
if timeout is None:
465
timeout = self.timeout
407
466
self.last_checked_ok = datetime.datetime.utcnow()
408
gobject.source_remove(self.disable_initiator_tag)
409
self.disable_initiator_tag = (gobject.timeout_add
410
(self.timeout_milliseconds(),
411
self.disable))
467
if self.disable_initiator_tag is not None:
468
gobject.source_remove(self.disable_initiator_tag)
469
if getattr(self, "enabled", False):
470
self.disable_initiator_tag = (gobject.timeout_add
471
(_timedelta_to_milliseconds
472
(timeout), self.disable))
473
self.expires = datetime.datetime.utcnow() + timeout
474
475
def need_approval(self):
476
self.last_approval_request = datetime.datetime.utcnow()
412
477
413
478
def start_checker(self):
414
479
"""Start a new checker subprocess if one is not running.
427
492
# If a checker exists, make sure it is not a zombie
428
493
try:
429
494
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
430
except (AttributeError, OSError), error:
495
except (AttributeError, OSError) as error:
431
496
if (isinstance(error, OSError)
432
497
and error.errno != errno.ECHILD):
433
498
raise error
434
499
else:
435
500
if pid:
436
logger.warning(u"Checker was a zombie")
501
logger.warning("Checker was a zombie")
437
502
gobject.source_remove(self.checker_callback_tag)
438
503
self.checker_callback(pid, status,
439
504
self.current_checker_command)
444
509
command = self.checker_command % self.host
445
510
except TypeError:
446
511
# Escape attributes for the shell
447
escaped_attrs = dict((key,
448
re.escape(unicode(str(val),
449
errors=
450
u'replace')))
451
for key, val in
452
vars(self).iteritems())
512
escaped_attrs = dict(
513
(attr,
514
re.escape(unicode(str(getattr(self, attr, "")),
515
errors=
516
'replace')))
517
for attr in
518
self.runtime_expansions)
519
453
520
try:
454
521
command = self.checker_command % escaped_attrs
455
except TypeError, error:
456
logger.error(u'Could not format string "%s":'
457
u' %s', self.checker_command, error)
522
except TypeError as error:
523
logger.error('Could not format string "%s":'
524
' %s', self.checker_command, error)
458
525
return True # Try again later
459
526
self.current_checker_command = command
460
527
try:
461
logger.info(u"Starting checker %r for %s",
528
logger.info("Starting checker %r for %s",
462
529
command, self.name)
463
530
# We don't need to redirect stdout and stderr, since
464
531
# in normal mode, that is already done by daemon(),
466
533
# always replaced by /dev/null.)
467
534
self.checker = subprocess.Popen(command,
468
535
close_fds=True,
469
shell=True, cwd=u"/")
536
shell=True, cwd="/")
470
537
self.checker_callback_tag = (gobject.child_watch_add
471
538
(self.checker.pid,
472
539
self.checker_callback,
477
544
if pid:
478
545
gobject.source_remove(self.checker_callback_tag)
479
546
self.checker_callback(pid, status, command)
480
except OSError, error:
481
logger.error(u"Failed to start subprocess: %s",
547
except OSError as error:
548
logger.error("Failed to start subprocess: %s",
482
549
error)
483
550
# Re-run this periodically if run by gobject.timeout_add
484
551
return True
488
555
if self.checker_callback_tag:
489
556
gobject.source_remove(self.checker_callback_tag)
490
557
self.checker_callback_tag = None
491
if getattr(self, u"checker", None) is None:
558
if getattr(self, "checker", None) is None:
492
559
return
493
logger.debug(u"Stopping checker for %(name)s", vars(self))
560
logger.debug("Stopping checker for %(name)s", vars(self))
494
561
try:
495
562
os.kill(self.checker.pid, signal.SIGTERM)
496
563
#time.sleep(0.5)
497
564
#if self.checker.poll() is None:
498
565
# os.kill(self.checker.pid, signal.SIGKILL)
499
except OSError, error:
566
except OSError as error:
500
567
if error.errno != errno.ESRCH: # No such process
501
568
raise
502
569
self.checker = None
503
570
504
def dbus_service_property(dbus_interface, signature=u"v",
505
access=u"readwrite", byte_arrays=False):
571
572
def dbus_service_property(dbus_interface, signature="v",
573
access="readwrite", byte_arrays=False):
506
574
"""Decorators for marking methods of a DBusObjectWithProperties to
507
575
become properties on the D-Bus.
508
576
515
583
"""
516
584
# Encoding deeply encoded byte arrays is not supported yet by the
517
585
# "Set" method, so we fail early here:
518
if byte_arrays and signature != u"ay":
519
raise ValueError(u"Byte arrays not supported for non-'ay'"
520
u" signature %r" % signature)
586
if byte_arrays and signature != "ay":
587
raise ValueError("Byte arrays not supported for non-'ay'"
588
" signature %r" % signature)
521
589
def decorator(func):
522
590
func._dbus_is_property = True
523
591
func._dbus_interface = dbus_interface
524
592
func._dbus_signature = signature
525
593
func._dbus_access = access
526
594
func._dbus_name = func.__name__
527
if func._dbus_name.endswith(u"_dbus_property"):
595
if func._dbus_name.endswith("_dbus_property"):
528
596
func._dbus_name = func._dbus_name[:-14]
529
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
597
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
530
598
return func
531
599
return decorator
532
600
552
620
553
621
class DBusObjectWithProperties(dbus.service.Object):
554
622
"""A D-Bus object with properties.
555
623
556
624
Classes inheriting from this can use the dbus_service_property
557
625
decorator to expose methods as D-Bus properties. It exposes the
558
626
standard Get(), Set(), and GetAll() methods on the D-Bus.
560
628
561
629
@staticmethod
562
630
def _is_dbus_property(obj):
563
return getattr(obj, u"_dbus_is_property", False)
631
return getattr(obj, "_dbus_is_property", False)
564
632
565
633
def _get_all_dbus_properties(self):
566
634
"""Returns a generator of (name, attribute) pairs
567
635
"""
568
return ((prop._dbus_name, prop)
636
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
637
for cls in self.__class__.__mro__
569
638
for name, prop in
570
inspect.getmembers(self, self._is_dbus_property))
639
inspect.getmembers(cls, self._is_dbus_property))
571
640
572
641
def _get_dbus_property(self, interface_name, property_name):
573
642
"""Returns a bound method if one exists which is a D-Bus
574
643
property with the specified name and interface.
575
644
"""
576
for name in (property_name,
577
property_name + u"_dbus_property"):
578
prop = getattr(self, name, None)
579
if (prop is None
580
or not self._is_dbus_property(prop)
581
or prop._dbus_name != property_name
582
or (interface_name and prop._dbus_interface
583
and interface_name != prop._dbus_interface)):
584
continue
585
return prop
645
for cls in self.__class__.__mro__:
646
for name, value in (inspect.getmembers
647
(cls, self._is_dbus_property)):
648
if (value._dbus_name == property_name
649
and value._dbus_interface == interface_name):
650
return value.__get__(self)
651
586
652
# No such property
587
raise DBusPropertyNotFound(self.dbus_object_path + u":"
588
+ interface_name + u"."
653
raise DBusPropertyNotFound(self.dbus_object_path + ":"
654
+ interface_name + "."
589
655
+ property_name)
590
656
591
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
592
out_signature=u"v")
657
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
658
out_signature="v")
593
659
def Get(self, interface_name, property_name):
594
660
"""Standard D-Bus property Get() method, see D-Bus standard.
595
661
"""
596
662
prop = self._get_dbus_property(interface_name, property_name)
597
if prop._dbus_access == u"write":
663
if prop._dbus_access == "write":
598
664
raise DBusPropertyAccessException(property_name)
599
665
value = prop()
600
if not hasattr(value, u"variant_level"):
666
if not hasattr(value, "variant_level"):
601
667
return value
602
668
return type(value)(value, variant_level=value.variant_level+1)
603
669
604
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
670
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
605
671
def Set(self, interface_name, property_name, value):
606
672
"""Standard D-Bus property Set() method, see D-Bus standard.
607
673
"""
608
674
prop = self._get_dbus_property(interface_name, property_name)
609
if prop._dbus_access == u"read":
675
if prop._dbus_access == "read":
610
676
raise DBusPropertyAccessException(property_name)
611
if prop._dbus_get_args_options[u"byte_arrays"]:
677
if prop._dbus_get_args_options["byte_arrays"]:
612
678
# The byte_arrays option is not supported yet on
613
679
# signatures other than "ay".
614
if prop._dbus_signature != u"ay":
680
if prop._dbus_signature != "ay":
615
681
raise ValueError
616
682
value = dbus.ByteArray(''.join(unichr(byte)
617
683
for byte in value))
618
684
prop(value)
619
685
620
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
621
out_signature=u"a{sv}")
686
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
687
out_signature="a{sv}")
622
688
def GetAll(self, interface_name):
623
689
"""Standard D-Bus property GetAll() method, see D-Bus
624
690
standard.
625
691
626
692
Note: Will not include properties with access="write".
627
693
"""
628
694
all = {}
632
698
# Interface non-empty but did not match
633
699
continue
634
700
# Ignore write-only properties
635
if prop._dbus_access == u"write":
701
if prop._dbus_access == "write":
636
702
continue
637
703
value = prop()
638
if not hasattr(value, u"variant_level"):
704
if not hasattr(value, "variant_level"):
639
705
all[name] = value
640
706
continue
641
707
all[name] = type(value)(value, variant_level=
642
708
value.variant_level+1)
643
return dbus.Dictionary(all, signature=u"sv")
709
return dbus.Dictionary(all, signature="sv")
644
710
645
711
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
646
out_signature=u"s",
712
out_signature="s",
647
713
path_keyword='object_path',
648
714
connection_keyword='connection')
649
715
def Introspect(self, object_path, connection):
654
720
try:
655
721
document = xml.dom.minidom.parseString(xmlstring)
656
722
def make_tag(document, name, prop):
657
e = document.createElement(u"property")
658
e.setAttribute(u"name", name)
659
e.setAttribute(u"type", prop._dbus_signature)
660
e.setAttribute(u"access", prop._dbus_access)
723
e = document.createElement("property")
724
e.setAttribute("name", name)
725
e.setAttribute("type", prop._dbus_signature)
726
e.setAttribute("access", prop._dbus_access)
661
727
return e
662
for if_tag in document.getElementsByTagName(u"interface"):
728
for if_tag in document.getElementsByTagName("interface"):
663
729
for tag in (make_tag(document, name, prop)
664
730
for name, prop
665
731
in self._get_all_dbus_properties()
666
732
if prop._dbus_interface
667
== if_tag.getAttribute(u"name")):
733
== if_tag.getAttribute("name")):
668
734
if_tag.appendChild(tag)
669
735
# Add the names to the return values for the
670
736
# "org.freedesktop.DBus.Properties" methods
671
if (if_tag.getAttribute(u"name")
672
== u"org.freedesktop.DBus.Properties"):
673
for cn in if_tag.getElementsByTagName(u"method"):
674
if cn.getAttribute(u"name") == u"Get":
675
for arg in cn.getElementsByTagName(u"arg"):
676
if (arg.getAttribute(u"direction")
677
== u"out"):
678
arg.setAttribute(u"name", u"value")
679
elif cn.getAttribute(u"name") == u"GetAll":
680
for arg in cn.getElementsByTagName(u"arg"):
681
if (arg.getAttribute(u"direction")
682
== u"out"):
683
arg.setAttribute(u"name", u"props")
684
xmlstring = document.toxml(u"utf-8")
737
if (if_tag.getAttribute("name")
738
== "org.freedesktop.DBus.Properties"):
739
for cn in if_tag.getElementsByTagName("method"):
740
if cn.getAttribute("name") == "Get":
741
for arg in cn.getElementsByTagName("arg"):
742
if (arg.getAttribute("direction")
743
== "out"):
744
arg.setAttribute("name", "value")
745
elif cn.getAttribute("name") == "GetAll":
746
for arg in cn.getElementsByTagName("arg"):
747
if (arg.getAttribute("direction")
748
== "out"):
749
arg.setAttribute("name", "props")
750
xmlstring = document.toxml("utf-8")
685
751
document.unlink()
686
752
except (AttributeError, xml.dom.DOMException,
687
xml.parsers.expat.ExpatError), error:
688
logger.error(u"Failed to override Introspection method",
753
xml.parsers.expat.ExpatError) as error:
754
logger.error("Failed to override Introspection method",
689
755
error)
690
756
return xmlstring
691
757
692
758
759
def datetime_to_dbus (dt, variant_level=0):
760
"""Convert a UTC datetime.datetime() to a D-Bus type."""
761
if dt is None:
762
return dbus.String("", variant_level = variant_level)
763
return dbus.String(dt.isoformat(),
764
variant_level=variant_level)
765
766
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
767
.__metaclass__):
768
"""Applied to an empty subclass of a D-Bus object, this metaclass
769
will add additional D-Bus attributes matching a certain pattern.
770
"""
771
def __new__(mcs, name, bases, attr):
772
# Go through all the base classes which could have D-Bus
773
# methods, signals, or properties in them
774
for base in (b for b in bases
775
if issubclass(b, dbus.service.Object)):
776
# Go though all attributes of the base class
777
for attrname, attribute in inspect.getmembers(base):
778
# Ignore non-D-Bus attributes, and D-Bus attributes
779
# with the wrong interface name
780
if (not hasattr(attribute, "_dbus_interface")
781
or not attribute._dbus_interface
782
.startswith("se.recompile.Mandos")):
783
continue
784
# Create an alternate D-Bus interface name based on
785
# the current name
786
alt_interface = (attribute._dbus_interface
787
.replace("se.recompile.Mandos",
788
"se.bsnet.fukt.Mandos"))
789
# Is this a D-Bus signal?
790
if getattr(attribute, "_dbus_is_signal", False):
791
# Extract the original non-method function by
792
# black magic
793
nonmethod_func = (dict(
794
zip(attribute.func_code.co_freevars,
795
attribute.__closure__))["func"]
796
.cell_contents)
797
# Create a new, but exactly alike, function
798
# object, and decorate it to be a new D-Bus signal
799
# with the alternate D-Bus interface name
800
new_function = (dbus.service.signal
801
(alt_interface,
802
attribute._dbus_signature)
803
(types.FunctionType(
804
nonmethod_func.func_code,
805
nonmethod_func.func_globals,
806
nonmethod_func.func_name,
807
nonmethod_func.func_defaults,
808
nonmethod_func.func_closure)))
809
# Define a creator of a function to call both the
810
# old and new functions, so both the old and new
811
# signals gets sent when the function is called
812
def fixscope(func1, func2):
813
"""This function is a scope container to pass
814
func1 and func2 to the "call_both" function
815
outside of its arguments"""
816
def call_both(*args, **kwargs):
817
"""This function will emit two D-Bus
818
signals by calling func1 and func2"""
819
func1(*args, **kwargs)
820
func2(*args, **kwargs)
821
return call_both
822
# Create the "call_both" function and add it to
823
# the class
824
attr[attrname] = fixscope(attribute,
825
new_function)
826
# Is this a D-Bus method?
827
elif getattr(attribute, "_dbus_is_method", False):
828
# Create a new, but exactly alike, function
829
# object. Decorate it to be a new D-Bus method
830
# with the alternate D-Bus interface name. Add it
831
# to the class.
832
attr[attrname] = (dbus.service.method
833
(alt_interface,
834
attribute._dbus_in_signature,
835
attribute._dbus_out_signature)
836
(types.FunctionType
837
(attribute.func_code,
838
attribute.func_globals,
839
attribute.func_name,
840
attribute.func_defaults,
841
attribute.func_closure)))
842
# Is this a D-Bus property?
843
elif getattr(attribute, "_dbus_is_property", False):
844
# Create a new, but exactly alike, function
845
# object, and decorate it to be a new D-Bus
846
# property with the alternate D-Bus interface
847
# name. Add it to the class.
848
attr[attrname] = (dbus_service_property
849
(alt_interface,
850
attribute._dbus_signature,
851
attribute._dbus_access,
852
attribute
853
._dbus_get_args_options
854
["byte_arrays"])
855
(types.FunctionType
856
(attribute.func_code,
857
attribute.func_globals,
858
attribute.func_name,
859
attribute.func_defaults,
860
attribute.func_closure)))
861
return type.__new__(mcs, name, bases, attr)
862
693
863
class ClientDBus(Client, DBusObjectWithProperties):
694
864
"""A Client class using D-Bus
695
865
697
867
dbus_object_path: dbus.ObjectPath
698
868
bus: dbus.SystemBus()
699
869
"""
870
871
runtime_expansions = (Client.runtime_expansions
872
+ ("dbus_object_path",))
873
700
874
# dbus.service.Object doesn't use super(), so we can't either.
701
875
702
876
def __init__(self, bus = None, *args, **kwargs):
705
879
Client.__init__(self, *args, **kwargs)
706
880
# Only now, when this client is initialized, can it show up on
707
881
# the D-Bus
882
client_object_name = unicode(self.name).translate(
883
{ord("."): ord("_"),
884
ord("-"): ord("_")})
708
885
self.dbus_object_path = (dbus.ObjectPath
709
(u"/clients/"
710
+ self.name.replace(u".", u"_")))
886
("/clients/" + client_object_name))
711
887
DBusObjectWithProperties.__init__(self, self.bus,
712
888
self.dbus_object_path)
713
714
def _get_approvals_pending(self):
715
return self._approvals_pending
716
def _set_approvals_pending(self, value):
717
old_value = self._approvals_pending
718
self._approvals_pending = value
719
bval = bool(value)
720
if (hasattr(self, "dbus_object_path")
721
and bval is not bool(old_value)):
722
dbus_bool = dbus.Boolean(bval, variant_level=1)
723
self.PropertyChanged(dbus.String(u"approved_pending"),
724
dbus_bool)
725
726
approvals_pending = property(_get_approvals_pending,
727
_set_approvals_pending)
728
del _get_approvals_pending, _set_approvals_pending
729
730
@staticmethod
731
def _datetime_to_dbus(dt, variant_level=0):
732
"""Convert a UTC datetime.datetime() to a D-Bus type."""
733
return dbus.String(dt.isoformat(),
734
variant_level=variant_level)
735
736
def enable(self):
737
oldstate = getattr(self, u"enabled", False)
738
r = Client.enable(self)
739
if oldstate != self.enabled:
740
# Emit D-Bus signals
741
self.PropertyChanged(dbus.String(u"enabled"),
742
dbus.Boolean(True, variant_level=1))
743
self.PropertyChanged(
744
dbus.String(u"last_enabled"),
745
self._datetime_to_dbus(self.last_enabled,
746
variant_level=1))
747
return r
748
749
def disable(self, quiet = False):
750
oldstate = getattr(self, u"enabled", False)
751
r = Client.disable(self, quiet=quiet)
752
if not quiet and oldstate != self.enabled:
753
# Emit D-Bus signal
754
self.PropertyChanged(dbus.String(u"enabled"),
755
dbus.Boolean(False, variant_level=1))
756
return r
889
890
def notifychangeproperty(transform_func,
891
dbus_name, type_func=lambda x: x,
892
variant_level=1):
893
""" Modify a variable so that it's a property which announces
894
its changes to DBus.
895
896
transform_fun: Function that takes a value and a variant_level
897
and transforms it to a D-Bus type.
898
dbus_name: D-Bus name of the variable
899
type_func: Function that transform the value before sending it
900
to the D-Bus. Default: no transform
901
variant_level: D-Bus variant level. Default: 1
902
"""
903
attrname = "_{0}".format(dbus_name)
904
def setter(self, value):
905
if hasattr(self, "dbus_object_path"):
906
if (not hasattr(self, attrname) or
907
type_func(getattr(self, attrname, None))
908
!= type_func(value)):
909
dbus_value = transform_func(type_func(value),
910
variant_level
911
=variant_level)
912
self.PropertyChanged(dbus.String(dbus_name),
913
dbus_value)
914
setattr(self, attrname, value)
915
916
return property(lambda self: getattr(self, attrname), setter)
917
918
919
expires = notifychangeproperty(datetime_to_dbus, "Expires")
920
approvals_pending = notifychangeproperty(dbus.Boolean,
921
"ApprovalPending",
922
type_func = bool)
923
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
924
last_enabled = notifychangeproperty(datetime_to_dbus,
925
"LastEnabled")
926
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
927
type_func = lambda checker:
928
checker is not None)
929
last_checked_ok = notifychangeproperty(datetime_to_dbus,
930
"LastCheckedOK")
931
last_approval_request = notifychangeproperty(
932
datetime_to_dbus, "LastApprovalRequest")
933
approved_by_default = notifychangeproperty(dbus.Boolean,
934
"ApprovedByDefault")
935
approval_delay = notifychangeproperty(dbus.UInt16,
936
"ApprovalDelay",
937
type_func =
938
_timedelta_to_milliseconds)
939
approval_duration = notifychangeproperty(
940
dbus.UInt16, "ApprovalDuration",
941
type_func = _timedelta_to_milliseconds)
942
host = notifychangeproperty(dbus.String, "Host")
943
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
944
type_func =
945
_timedelta_to_milliseconds)
946
extended_timeout = notifychangeproperty(
947
dbus.UInt16, "ExtendedTimeout",
948
type_func = _timedelta_to_milliseconds)
949
interval = notifychangeproperty(dbus.UInt16,
950
"Interval",
951
type_func =
952
_timedelta_to_milliseconds)
953
checker_command = notifychangeproperty(dbus.String, "Checker")
954
955
del notifychangeproperty
757
956
758
957
def __del__(self, *args, **kwargs):
759
958
try:
760
959
self.remove_from_connection()
761
960
except LookupError:
762
961
pass
763
if hasattr(DBusObjectWithProperties, u"__del__"):
962
if hasattr(DBusObjectWithProperties, "__del__"):
764
963
DBusObjectWithProperties.__del__(self, *args, **kwargs)
765
964
Client.__del__(self, *args, **kwargs)
766
965
768
967
*args, **kwargs):
769
968
self.checker_callback_tag = None
770
969
self.checker = None
771
# Emit D-Bus signal
772
self.PropertyChanged(dbus.String(u"checker_running"),
773
dbus.Boolean(False, variant_level=1))
774
970
if os.WIFEXITED(condition):
775
971
exitstatus = os.WEXITSTATUS(condition)
776
972
# Emit D-Bus signal
786
982
return Client.checker_callback(self, pid, condition, command,
787
983
*args, **kwargs)
788
984
789
def checked_ok(self, *args, **kwargs):
790
r = Client.checked_ok(self, *args, **kwargs)
791
# Emit D-Bus signal
792
self.PropertyChanged(
793
dbus.String(u"last_checked_ok"),
794
(self._datetime_to_dbus(self.last_checked_ok,
795
variant_level=1)))
796
return r
797
798
985
def start_checker(self, *args, **kwargs):
799
986
old_checker = self.checker
800
987
if self.checker is not None:
807
994
and old_checker_pid != self.checker.pid):
808
995
# Emit D-Bus signal
809
996
self.CheckerStarted(self.current_checker_command)
810
self.PropertyChanged(
811
dbus.String(u"checker_running"),
812
dbus.Boolean(True, variant_level=1))
813
997
return r
814
998
815
def stop_checker(self, *args, **kwargs):
816
old_checker = getattr(self, u"checker", None)
817
r = Client.stop_checker(self, *args, **kwargs)
818
if (old_checker is not None
819
and getattr(self, u"checker", None) is None):
820
self.PropertyChanged(dbus.String(u"checker_running"),
821
dbus.Boolean(False, variant_level=1))
822
return r
823
824
999
def _reset_approved(self):
825
1000
self._approved = None
826
1001
return False
828
1003
def approve(self, value=True):
829
1004
self.send_changedstate()
830
1005
self._approved = value
831
gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),
1006
gobject.timeout_add(_timedelta_to_milliseconds
1007
(self.approval_duration),
832
1008
self._reset_approved)
833
1009
834
1010
835
1011
## D-Bus methods, signals & properties
836
_interface = u"se.bsnet.fukt.Mandos.Client"
1012
_interface = "se.recompile.Mandos.Client"
837
1013
838
1014
## Signals
839
1015
840
1016
# CheckerCompleted - signal
841
@dbus.service.signal(_interface, signature=u"nxs")
1017
@dbus.service.signal(_interface, signature="nxs")
842
1018
def CheckerCompleted(self, exitcode, waitstatus, command):
843
1019
"D-Bus signal"
844
1020
pass
845
1021
846
1022
# CheckerStarted - signal
847
@dbus.service.signal(_interface, signature=u"s")
1023
@dbus.service.signal(_interface, signature="s")
848
1024
def CheckerStarted(self, command):
849
1025
"D-Bus signal"
850
1026
pass
851
1027
852
1028
# PropertyChanged - signal
853
@dbus.service.signal(_interface, signature=u"sv")
1029
@dbus.service.signal(_interface, signature="sv")
854
1030
def PropertyChanged(self, property, value):
855
1031
"D-Bus signal"
856
1032
pass
865
1041
pass
866
1042
867
1043
# Rejected - signal
868
@dbus.service.signal(_interface, signature=u"s")
1044
@dbus.service.signal(_interface, signature="s")
869
1045
def Rejected(self, reason):
870
1046
"D-Bus signal"
871
1047
pass
872
1048
873
1049
# NeedApproval - signal
874
@dbus.service.signal(_interface, signature=u"db")
1050
@dbus.service.signal(_interface, signature="tb")
875
1051
def NeedApproval(self, timeout, default):
876
1052
"D-Bus signal"
877
pass
1053
return self.need_approval()
878
1054
879
1055
## Methods
880
1056
881
1057
# Approve - method
882
@dbus.service.method(_interface, in_signature=u"b")
1058
@dbus.service.method(_interface, in_signature="b")
883
1059
def Approve(self, value):
884
1060
self.approve(value)
885
1061
886
1062
# CheckedOK - method
887
1063
@dbus.service.method(_interface)
888
1064
def CheckedOK(self):
889
return self.checked_ok()
1065
self.checked_ok()
890
1066
891
1067
# Enable - method
892
1068
@dbus.service.method(_interface)
913
1089
914
1090
## Properties
915
1091
916
# approved_pending - property
917
@dbus_service_property(_interface, signature=u"b", access=u"read")
918
def approved_pending_dbus_property(self):
1092
# ApprovalPending - property
1093
@dbus_service_property(_interface, signature="b", access="read")
1094
def ApprovalPending_dbus_property(self):
919
1095
return dbus.Boolean(bool(self.approvals_pending))
920
1096
921
# approved_by_default - property
922
@dbus_service_property(_interface, signature=u"b",
923
access=u"readwrite")
924
def approved_by_default_dbus_property(self):
925
return dbus.Boolean(self.approved_by_default)
926
927
# approved_delay - property
928
@dbus_service_property(_interface, signature=u"t",
929
access=u"readwrite")
930
def approved_delay_dbus_property(self):
931
return dbus.UInt64(self.approved_delay_milliseconds())
932
933
# approved_duration - property
934
@dbus_service_property(_interface, signature=u"t",
935
access=u"readwrite")
936
def approved_duration_dbus_property(self):
937
return dbus.UInt64(self._timedelta_to_milliseconds(
938
self.approved_duration))
939
940
# name - property
941
@dbus_service_property(_interface, signature=u"s", access=u"read")
942
def name_dbus_property(self):
1097
# ApprovedByDefault - property
1098
@dbus_service_property(_interface, signature="b",
1099
access="readwrite")
1100
def ApprovedByDefault_dbus_property(self, value=None):
1101
if value is None: # get
1102
return dbus.Boolean(self.approved_by_default)
1103
self.approved_by_default = bool(value)
1104
1105
# ApprovalDelay - property
1106
@dbus_service_property(_interface, signature="t",
1107
access="readwrite")
1108
def ApprovalDelay_dbus_property(self, value=None):
1109
if value is None: # get
1110
return dbus.UInt64(self.approval_delay_milliseconds())
1111
self.approval_delay = datetime.timedelta(0, 0, 0, value)
1112
1113
# ApprovalDuration - property
1114
@dbus_service_property(_interface, signature="t",
1115
access="readwrite")
1116
def ApprovalDuration_dbus_property(self, value=None):
1117
if value is None: # get
1118
return dbus.UInt64(_timedelta_to_milliseconds(
1119
self.approval_duration))
1120
self.approval_duration = datetime.timedelta(0, 0, 0, value)
1121
1122
# Name - property
1123
@dbus_service_property(_interface, signature="s", access="read")
1124
def Name_dbus_property(self):
943
1125
return dbus.String(self.name)
944
1126
945
# fingerprint - property
946
@dbus_service_property(_interface, signature=u"s", access=u"read")
947
def fingerprint_dbus_property(self):
1127
# Fingerprint - property
1128
@dbus_service_property(_interface, signature="s", access="read")
1129
def Fingerprint_dbus_property(self):
948
1130
return dbus.String(self.fingerprint)
949
1131
950
# host - property
951
@dbus_service_property(_interface, signature=u"s",
952
access=u"readwrite")
953
def host_dbus_property(self, value=None):
1132
# Host - property
1133
@dbus_service_property(_interface, signature="s",
1134
access="readwrite")
1135
def Host_dbus_property(self, value=None):
954
1136
if value is None: # get
955
1137
return dbus.String(self.host)
956
1138
self.host = value
957
# Emit D-Bus signal
958
self.PropertyChanged(dbus.String(u"host"),
959
dbus.String(value, variant_level=1))
960
961
# created - property
962
@dbus_service_property(_interface, signature=u"s", access=u"read")
963
def created_dbus_property(self):
964
return dbus.String(self._datetime_to_dbus(self.created))
965
966
# last_enabled - property
967
@dbus_service_property(_interface, signature=u"s", access=u"read")
968
def last_enabled_dbus_property(self):
969
if self.last_enabled is None:
970
return dbus.String(u"")
971
return dbus.String(self._datetime_to_dbus(self.last_enabled))
972
973
# enabled - property
974
@dbus_service_property(_interface, signature=u"b",
975
access=u"readwrite")
976
def enabled_dbus_property(self, value=None):
1139
1140
# Created - property
1141
@dbus_service_property(_interface, signature="s", access="read")
1142
def Created_dbus_property(self):
1143
return dbus.String(datetime_to_dbus(self.created))
1144
1145
# LastEnabled - property
1146
@dbus_service_property(_interface, signature="s", access="read")
1147
def LastEnabled_dbus_property(self):
1148
return datetime_to_dbus(self.last_enabled)
1149
1150
# Enabled - property
1151
@dbus_service_property(_interface, signature="b",
1152
access="readwrite")
1153
def Enabled_dbus_property(self, value=None):
977
1154
if value is None: # get
978
1155
return dbus.Boolean(self.enabled)
979
1156
if value:
981
1158
else:
982
1159
self.disable()
983
1160
984
# last_checked_ok - property
985
@dbus_service_property(_interface, signature=u"s",
986
access=u"readwrite")
987
def last_checked_ok_dbus_property(self, value=None):
1161
# LastCheckedOK - property
1162
@dbus_service_property(_interface, signature="s",
1163
access="readwrite")
1164
def LastCheckedOK_dbus_property(self, value=None):
988
1165
if value is not None:
989
1166
self.checked_ok()
990
1167
return
991
if self.last_checked_ok is None:
992
return dbus.String(u"")
993
return dbus.String(self._datetime_to_dbus(self
994
.last_checked_ok))
995
996
# timeout - property
997
@dbus_service_property(_interface, signature=u"t",
998
access=u"readwrite")
999
def timeout_dbus_property(self, value=None):
1168
return datetime_to_dbus(self.last_checked_ok)
1169
1170
# Expires - property
1171
@dbus_service_property(_interface, signature="s", access="read")
1172
def Expires_dbus_property(self):
1173
return datetime_to_dbus(self.expires)
1174
1175
# LastApprovalRequest - property
1176
@dbus_service_property(_interface, signature="s", access="read")
1177
def LastApprovalRequest_dbus_property(self):
1178
return datetime_to_dbus(self.last_approval_request)
1179
1180
# Timeout - property
1181
@dbus_service_property(_interface, signature="t",
1182
access="readwrite")
1183
def Timeout_dbus_property(self, value=None):
1000
1184
if value is None: # get
1001
1185
return dbus.UInt64(self.timeout_milliseconds())
1002
1186
self.timeout = datetime.timedelta(0, 0, 0, value)
1003
# Emit D-Bus signal
1004
self.PropertyChanged(dbus.String(u"timeout"),
1005
dbus.UInt64(value, variant_level=1))
1006
if getattr(self, u"disable_initiator_tag", None) is None:
1187
if getattr(self, "disable_initiator_tag", None) is None:
1007
1188
return
1008
1189
# Reschedule timeout
1009
1190
gobject.source_remove(self.disable_initiator_tag)
1010
1191
self.disable_initiator_tag = None
1011
time_to_die = (self.
1012
_timedelta_to_milliseconds((self
1013
.last_checked_ok
1014
+ self.timeout)
1015
- datetime.datetime
1016
.utcnow()))
1192
self.expires = None
1193
time_to_die = _timedelta_to_milliseconds((self
1194
.last_checked_ok
1195
+ self.timeout)
1196
- datetime.datetime
1197
.utcnow())
1017
1198
if time_to_die <= 0:
1018
1199
# The timeout has passed
1019
1200
self.disable()
1020
1201
else:
1202
self.expires = (datetime.datetime.utcnow()
1203
+ datetime.timedelta(milliseconds =
1204
time_to_die))
1021
1205
self.disable_initiator_tag = (gobject.timeout_add
1022
1206
(time_to_die, self.disable))
1023
1207
1024
# interval - property
1025
@dbus_service_property(_interface, signature=u"t",
1026
access=u"readwrite")
1027
def interval_dbus_property(self, value=None):
1208
# ExtendedTimeout - property
1209
@dbus_service_property(_interface, signature="t",
1210
access="readwrite")
1211
def ExtendedTimeout_dbus_property(self, value=None):
1212
if value is None: # get
1213
return dbus.UInt64(self.extended_timeout_milliseconds())
1214
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1215
1216
# Interval - property
1217
@dbus_service_property(_interface, signature="t",
1218
access="readwrite")
1219
def Interval_dbus_property(self, value=None):
1028
1220
if value is None: # get
1029
1221
return dbus.UInt64(self.interval_milliseconds())
1030
1222
self.interval = datetime.timedelta(0, 0, 0, value)
1031
# Emit D-Bus signal
1032
self.PropertyChanged(dbus.String(u"interval"),
1033
dbus.UInt64(value, variant_level=1))
1034
if getattr(self, u"checker_initiator_tag", None) is None:
1223
if getattr(self, "checker_initiator_tag", None) is None:
1035
1224
return
1036
1225
# Reschedule checker run
1037
1226
gobject.source_remove(self.checker_initiator_tag)
1038
1227
self.checker_initiator_tag = (gobject.timeout_add
1039
1228
(value, self.start_checker))
1040
1229
self.start_checker() # Start one now, too
1041
1042
# checker - property
1043
@dbus_service_property(_interface, signature=u"s",
1044
access=u"readwrite")
1045
def checker_dbus_property(self, value=None):
1230
1231
# Checker - property
1232
@dbus_service_property(_interface, signature="s",
1233
access="readwrite")
1234
def Checker_dbus_property(self, value=None):
1046
1235
if value is None: # get
1047
1236
return dbus.String(self.checker_command)
1048
1237
self.checker_command = value
1049
# Emit D-Bus signal
1050
self.PropertyChanged(dbus.String(u"checker"),
1051
dbus.String(self.checker_command,
1052
variant_level=1))
1053
1238
1054
# checker_running - property
1055
@dbus_service_property(_interface, signature=u"b",
1056
access=u"readwrite")
1057
def checker_running_dbus_property(self, value=None):
1239
# CheckerRunning - property
1240
@dbus_service_property(_interface, signature="b",
1241
access="readwrite")
1242
def CheckerRunning_dbus_property(self, value=None):
1058
1243
if value is None: # get
1059
1244
return dbus.Boolean(self.checker is not None)
1060
1245
if value:
1062
1247
else:
1063
1248
self.stop_checker()
1064
1249
1065
# object_path - property
1066
@dbus_service_property(_interface, signature=u"o", access=u"read")
1067
def object_path_dbus_property(self):
1250
# ObjectPath - property
1251
@dbus_service_property(_interface, signature="o", access="read")
1252
def ObjectPath_dbus_property(self):
1068
1253
return self.dbus_object_path # is already a dbus.ObjectPath
1069
1254
1070
# secret = property
1071
@dbus_service_property(_interface, signature=u"ay",
1072
access=u"write", byte_arrays=True)
1073
def secret_dbus_property(self, value):
1255
# Secret = property
1256
@dbus_service_property(_interface, signature="ay",
1257
access="write", byte_arrays=True)
1258
def Secret_dbus_property(self, value):
1074
1259
self.secret = str(value)
1075
1260
1076
1261
del _interface
1082
1267
self._pipe.send(('init', fpr, address))
1083
1268
if not self._pipe.recv():
1084
1269
raise KeyError()
1085
1270
1086
1271
def __getattribute__(self, name):
1087
1272
if(name == '_pipe'):
1088
1273
return super(ProxyClient, self).__getattribute__(name)
1095
1280
self._pipe.send(('funcall', name, args, kwargs))
1096
1281
return self._pipe.recv()[1]
1097
1282
return func
1098
1283
1099
1284
def __setattr__(self, name, value):
1100
1285
if(name == '_pipe'):
1101
1286
return super(ProxyClient, self).__setattr__(name, value)
1102
1287
self._pipe.send(('setattr', name, value))
1103
1288
1289
class ClientDBusTransitional(ClientDBus):
1290
__metaclass__ = AlternateDBusNamesMetaclass
1104
1291
1105
1292
class ClientHandler(socketserver.BaseRequestHandler, object):
1106
1293
"""A class to handle client connections.
1110
1297
1111
1298
def handle(self):
1112
1299
with contextlib.closing(self.server.child_pipe) as child_pipe:
1113
logger.info(u"TCP connection from: %s",
1300
logger.info("TCP connection from: %s",
1114
1301
unicode(self.client_address))
1115
logger.debug(u"Pipe FD: %d",
1302
logger.debug("Pipe FD: %d",
1116
1303
self.server.child_pipe.fileno())
1117
1304
1118
1305
session = (gnutls.connection
1119
1306
.ClientSession(self.request,
1120
1307
gnutls.connection
1121
1308
.X509Credentials()))
1122
1309
1123
1310
# Note: gnutls.connection.X509Credentials is really a
1124
1311
# generic GnuTLS certificate credentials object so long as
1125
1312
# no X.509 keys are added to it. Therefore, we can use it
1126
1313
# here despite using OpenPGP certificates.
1127
1128
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1129
# u"+AES-256-CBC", u"+SHA1",
1130
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1131
# u"+DHE-DSS"))
1314
1315
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1316
# "+AES-256-CBC", "+SHA1",
1317
# "+COMP-NULL", "+CTYPE-OPENPGP",
1318
# "+DHE-DSS"))
1132
1319
# Use a fallback default, since this MUST be set.
1133
1320
priority = self.server.gnutls_priority
1134
1321
if priority is None:
1135
priority = u"NORMAL"
1322
priority = "NORMAL"
1136
1323
(gnutls.library.functions
1137
1324
.gnutls_priority_set_direct(session._c_object,
1138
1325
priority, None))
1139
1326
1140
1327
# Start communication using the Mandos protocol
1141
1328
# Get protocol number
1142
1329
line = self.request.makefile().readline()
1143
logger.debug(u"Protocol version: %r", line)
1330
logger.debug("Protocol version: %r", line)
1144
1331
try:
1145
1332
if int(line.strip().split()[0]) > 1:
1146
1333
raise RuntimeError
1147
except (ValueError, IndexError, RuntimeError), error:
1148
logger.error(u"Unknown protocol version: %s", error)
1334
except (ValueError, IndexError, RuntimeError) as error:
1335
logger.error("Unknown protocol version: %s", error)
1149
1336
return
1150
1337
1151
1338
# Start GnuTLS connection
1152
1339
try:
1153
1340
session.handshake()
1154
except gnutls.errors.GNUTLSError, error:
1155
logger.warning(u"Handshake failed: %s", error)
1341
except gnutls.errors.GNUTLSError as error:
1342
logger.warning("Handshake failed: %s", error)
1156
1343
# Do not run session.bye() here: the session is not
1157
1344
# established. Just abandon the request.
1158
1345
return
1159
logger.debug(u"Handshake succeeded")
1160
1346
logger.debug("Handshake succeeded")
1347
1161
1348
approval_required = False
1162
1349
try:
1163
1350
try:
1164
1351
fpr = self.fingerprint(self.peer_certificate
1165
1352
(session))
1166
except (TypeError, gnutls.errors.GNUTLSError), error:
1167
logger.warning(u"Bad certificate: %s", error)
1353
except (TypeError,
1354
gnutls.errors.GNUTLSError) as error:
1355
logger.warning("Bad certificate: %s", error)
1168
1356
return
1169
logger.debug(u"Fingerprint: %s", fpr)
1170
1357
logger.debug("Fingerprint: %s", fpr)
1358
1171
1359
try:
1172
1360
client = ProxyClient(child_pipe, fpr,
1173
1361
self.client_address)
1174
1362
except KeyError:
1175
1363
return
1176
1364
1177
if client.approved_delay:
1178
delay = client.approved_delay
1365
if client.approval_delay:
1366
delay = client.approval_delay
1179
1367
client.approvals_pending += 1
1180
1368
approval_required = True
1181
1369
1182
1370
while True:
1183
1371
if not client.enabled:
1184
logger.warning(u"Client %s is disabled",
1372
logger.info("Client %s is disabled",
1185
1373
client.name)
1186
1374
if self.server.use_dbus:
1187
1375
# Emit D-Bus signal
1188
client.Rejected("Disabled")
1376
client.Rejected("Disabled")
1189
1377
return
1190
1378
1191
if client._approved or not client.approved_delay:
1379
if client._approved or not client.approval_delay:
1192
1380
#We are approved or approval is disabled
1193
1381
break
1194
1382
elif client._approved is None:
1195
logger.info(u"Client %s need approval",
1383
logger.info("Client %s needs approval",
1196
1384
client.name)
1197
1385
if self.server.use_dbus:
1198
1386
# Emit D-Bus signal
1199
1387
client.NeedApproval(
1200
client.approved_delay_milliseconds(),
1388
client.approval_delay_milliseconds(),
1201
1389
client.approved_by_default)
1202
1390
else:
1203
logger.warning(u"Client %s was not approved",
1391
logger.warning("Client %s was not approved",
1204
1392
client.name)
1205
1393
if self.server.use_dbus:
1206
1394
# Emit D-Bus signal
1207
client.Rejected("Disapproved")
1395
client.Rejected("Denied")
1208
1396
return
1209
1397
1210
1398
#wait until timeout or approved
1211
#x = float(client._timedelta_to_milliseconds(delay))
1212
1399
time = datetime.datetime.now()
1213
1400
client.changedstate.acquire()
1214
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1401
(client.changedstate.wait
1402
(float(client._timedelta_to_milliseconds(delay)
1403
/ 1000)))
1215
1404
client.changedstate.release()
1216
1405
time2 = datetime.datetime.now()
1217
1406
if (time2 - time) >= delay:
1221
1410
client.name)
1222
1411
if self.server.use_dbus:
1223
1412
# Emit D-Bus signal
1224
client.Rejected("Time out")
1413
client.Rejected("Approval timed out")
1225
1414
return
1226
1415
else:
1227
1416
break
1232
1421
while sent_size < len(client.secret):
1233
1422
try:
1234
1423
sent = session.send(client.secret[sent_size:])
1235
except (gnutls.errors.GNUTLSError), error:
1424
except gnutls.errors.GNUTLSError as error:
1236
1425
logger.warning("gnutls send failed")
1237
1426
return
1238
logger.debug(u"Sent: %d, remaining: %d",
1427
logger.debug("Sent: %d, remaining: %d",
1239
1428
sent, len(client.secret)
1240
1429
- (sent_size + sent))
1241
1430
sent_size += sent
1242
1243
logger.info(u"Sending secret to %s", client.name)
1244
# bump the timeout as if seen
1245
client.checked_ok()
1431
1432
logger.info("Sending secret to %s", client.name)
1433
# bump the timeout using extended_timeout
1434
client.checked_ok(client.extended_timeout)
1246
1435
if self.server.use_dbus:
1247
1436
# Emit D-Bus signal
1248
1437
client.GotSecret()
1252
1441
client.approvals_pending -= 1
1253
1442
try:
1254
1443
session.bye()
1255
except (gnutls.errors.GNUTLSError), error:
1256
logger.warning("gnutls bye failed")
1444
except gnutls.errors.GNUTLSError as error:
1445
logger.warning("GnuTLS bye failed")
1257
1446
1258
1447
@staticmethod
1259
1448
def peer_certificate(session):
1269
1458
.gnutls_certificate_get_peers
1270
1459
(session._c_object, ctypes.byref(list_size)))
1271
1460
if not bool(cert_list) and list_size.value != 0:
1272
raise gnutls.errors.GNUTLSError(u"error getting peer"
1273
u" certificate")
1461
raise gnutls.errors.GNUTLSError("error getting peer"
1462
" certificate")
1274
1463
if list_size.value == 0:
1275
1464
return None
1276
1465
cert = cert_list[0]
1302
1491
if crtverify.value != 0:
1303
1492
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1304
1493
raise (gnutls.errors.CertificateSecurityError
1305
(u"Verify failed"))
1494
("Verify failed"))
1306
1495
# New buffer for the fingerprint
1307
1496
buf = ctypes.create_string_buffer(20)
1308
1497
buf_len = ctypes.c_size_t()
1315
1504
# Convert the buffer to a Python bytestring
1316
1505
fpr = ctypes.string_at(buf, buf_len.value)
1317
1506
# Convert the bytestring to hexadecimal notation
1318
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1507
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1319
1508
return hex_fpr
1320
1509
1321
1510
1327
1516
except:
1328
1517
self.handle_error(request, address)
1329
1518
self.close_request(request)
1330
1519
1331
1520
def process_request(self, request, address):
1332
1521
"""Start a new process to process the request."""
1333
multiprocessing.Process(target = self.sub_process_main,
1334
args = (request, address)).start()
1522
proc = multiprocessing.Process(target = self.sub_process_main,
1523
args = (request,
1524
address))
1525
proc.start()
1526
return proc
1527
1335
1528
1336
1529
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1337
1530
""" adds a pipe to the MixIn """
1341
1534
This function creates a new pipe in self.pipe
1342
1535
"""
1343
1536
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1344
1345
super(MultiprocessingMixInWithPipe,
1346
self).process_request(request, client_address)
1537
1538
proc = MultiprocessingMixIn.process_request(self, request,
1539
client_address)
1347
1540
self.child_pipe.close()
1348
self.add_pipe(parent_pipe)
1349
1350
def add_pipe(self, parent_pipe):
1541
self.add_pipe(parent_pipe, proc)
1542
1543
def add_pipe(self, parent_pipe, proc):
1351
1544
"""Dummy function; override as necessary"""
1352
pass
1545
raise NotImplementedError
1546
1353
1547
1354
1548
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1355
1549
socketserver.TCPServer, object):
1373
1567
bind to an address or port if they were not specified."""
1374
1568
if self.interface is not None:
1375
1569
if SO_BINDTODEVICE is None:
1376
logger.error(u"SO_BINDTODEVICE does not exist;"
1377
u" cannot bind to interface %s",
1570
logger.error("SO_BINDTODEVICE does not exist;"
1571
" cannot bind to interface %s",
1378
1572
self.interface)
1379
1573
else:
1380
1574
try:
1381
1575
self.socket.setsockopt(socket.SOL_SOCKET,
1382
1576
SO_BINDTODEVICE,
1383
1577
str(self.interface
1384
+ u'\0'))
1385
except socket.error, error:
1578
+ '\0'))
1579
except socket.error as error:
1386
1580
if error[0] == errno.EPERM:
1387
logger.error(u"No permission to"
1388
u" bind to interface %s",
1581
logger.error("No permission to"
1582
" bind to interface %s",
1389
1583
self.interface)
1390
1584
elif error[0] == errno.ENOPROTOOPT:
1391
logger.error(u"SO_BINDTODEVICE not available;"
1392
u" cannot bind to interface %s",
1585
logger.error("SO_BINDTODEVICE not available;"
1586
" cannot bind to interface %s",
1393
1587
self.interface)
1394
1588
else:
1395
1589
raise
1397
1591
if self.server_address[0] or self.server_address[1]:
1398
1592
if not self.server_address[0]:
1399
1593
if self.address_family == socket.AF_INET6:
1400
any_address = u"::" # in6addr_any
1594
any_address = "::" # in6addr_any
1401
1595
else:
1402
1596
any_address = socket.INADDR_ANY
1403
1597
self.server_address = (any_address,
1440
1634
def server_activate(self):
1441
1635
if self.enabled:
1442
1636
return socketserver.TCPServer.server_activate(self)
1637
1443
1638
def enable(self):
1444
1639
self.enabled = True
1445
def add_pipe(self, parent_pipe):
1640
1641
def add_pipe(self, parent_pipe, proc):
1446
1642
# Call "handle_ipc" for both data and EOF events
1447
1643
gobject.io_add_watch(parent_pipe.fileno(),
1448
1644
gobject.IO_IN | gobject.IO_HUP,
1449
1645
functools.partial(self.handle_ipc,
1450
parent_pipe = parent_pipe))
1451
1646
parent_pipe =
1647
parent_pipe,
1648
proc = proc))
1649
1452
1650
def handle_ipc(self, source, condition, parent_pipe=None,
1453
client_object=None):
1651
proc = None, client_object=None):
1454
1652
condition_names = {
1455
gobject.IO_IN: u"IN", # There is data to read.
1456
gobject.IO_OUT: u"OUT", # Data can be written (without
1653
gobject.IO_IN: "IN", # There is data to read.
1654
gobject.IO_OUT: "OUT", # Data can be written (without
1457
1655
# blocking).
1458
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1459
gobject.IO_ERR: u"ERR", # Error condition.
1460
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1656
gobject.IO_PRI: "PRI", # There is urgent data to read.
1657
gobject.IO_ERR: "ERR", # Error condition.
1658
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1461
1659
# broken, usually for pipes and
1462
1660
# sockets).
1463
1661
}
1465
1663
for cond, name in
1466
1664
condition_names.iteritems()
1467
1665
if cond & condition)
1468
logger.debug(u"Handling IPC: FD = %d, condition = %s", source,
1469
conditions_string)
1470
1471
# error or the other end of multiprocessing.Pipe has closed
1666
# error, or the other end of multiprocessing.Pipe has closed
1472
1667
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1668
# Wait for other process to exit
1669
proc.join()
1473
1670
return False
1474
1671
1475
1672
# Read a request from the child
1476
1673
request = parent_pipe.recv()
1477
logger.debug(u"IPC request: %s", repr(request))
1478
1674
command = request[0]
1479
1675
1480
1676
if command == 'init':
1486
1682
client = c
1487
1683
break
1488
1684
else:
1489
logger.warning(u"Client not found for fingerprint: %s, ad"
1490
u"dress: %s", fpr, address)
1685
logger.info("Client not found for fingerprint: %s, ad"
1686
"dress: %s", fpr, address)
1491
1687
if self.use_dbus:
1492
1688
# Emit D-Bus signal
1493
mandos_dbus_service.ClientNotFound(fpr, address)
1689
mandos_dbus_service.ClientNotFound(fpr,
1690
address[0])
1494
1691
parent_pipe.send(False)
1495
1692
return False
1496
1693
1497
1694
gobject.io_add_watch(parent_pipe.fileno(),
1498
1695
gobject.IO_IN | gobject.IO_HUP,
1499
1696
functools.partial(self.handle_ipc,
1500
parent_pipe = parent_pipe,
1501
client_object = client))
1697
parent_pipe =
1698
parent_pipe,
1699
proc = proc,
1700
client_object =
1701
client))
1502
1702
parent_pipe.send(True)
1503
# remove the old hook in favor of the new above hook on same fileno
1703
# remove the old hook in favor of the new above hook on
1704
# same fileno
1504
1705
return False
1505
1706
if command == 'funcall':
1506
1707
funcname = request[1]
1507
1708
args = request[2]
1508
1709
kwargs = request[3]
1509
1710
1510
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1511
1711
parent_pipe.send(('data', getattr(client_object,
1712
funcname)(*args,
1713
**kwargs)))
1714
1512
1715
if command == 'getattr':
1513
1716
attrname = request[1]
1514
1717
if callable(client_object.__getattribute__(attrname)):
1515
1718
parent_pipe.send(('function',))
1516
1719
else:
1517
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1720
parent_pipe.send(('data', client_object
1721
.__getattribute__(attrname)))
1518
1722
1519
1723
if command == 'setattr':
1520
1724
attrname = request[1]
1521
1725
value = request[2]
1522
1726
setattr(client_object, attrname, value)
1523
1727
1524
1728
return True
1525
1729
1526
1730
1527
1731
def string_to_delta(interval):
1528
1732
"""Parse a string and return a datetime.timedelta
1529
1733
1530
>>> string_to_delta(u'7d')
1734
>>> string_to_delta('7d')
1531
1735
datetime.timedelta(7)
1532
>>> string_to_delta(u'60s')
1736
>>> string_to_delta('60s')
1533
1737
datetime.timedelta(0, 60)
1534
>>> string_to_delta(u'60m')
1738
>>> string_to_delta('60m')
1535
1739
datetime.timedelta(0, 3600)
1536
>>> string_to_delta(u'24h')
1740
>>> string_to_delta('24h')
1537
1741
datetime.timedelta(1)
1538
>>> string_to_delta(u'1w')
1742
>>> string_to_delta('1w')
1539
1743
datetime.timedelta(7)
1540
>>> string_to_delta(u'5m 30s')
1744
>>> string_to_delta('5m 30s')
1541
1745
datetime.timedelta(0, 330)
1542
1746
"""
1543
1747
timevalue = datetime.timedelta(0)
1545
1749
try:
1546
1750
suffix = unicode(s[-1])
1547
1751
value = int(s[:-1])
1548
if suffix == u"d":
1752
if suffix == "d":
1549
1753
delta = datetime.timedelta(value)
1550
elif suffix == u"s":
1754
elif suffix == "s":
1551
1755
delta = datetime.timedelta(0, value)
1552
elif suffix == u"m":
1756
elif suffix == "m":
1553
1757
delta = datetime.timedelta(0, 0, 0, 0, value)
1554
elif suffix == u"h":
1758
elif suffix == "h":
1555
1759
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1556
elif suffix == u"w":
1760
elif suffix == "w":
1557
1761
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1558
1762
else:
1559
raise ValueError(u"Unknown suffix %r" % suffix)
1560
except (ValueError, IndexError), e:
1561
raise ValueError(e.message)
1763
raise ValueError("Unknown suffix %r" % suffix)
1764
except (ValueError, IndexError) as e:
1765
raise ValueError(*(e.args))
1562
1766
timevalue += delta
1563
1767
return timevalue
1564
1768
1570
1774
global if_nametoindex
1571
1775
try:
1572
1776
if_nametoindex = (ctypes.cdll.LoadLibrary
1573
(ctypes.util.find_library(u"c"))
1777
(ctypes.util.find_library("c"))
1574
1778
.if_nametoindex)
1575
1779
except (OSError, AttributeError):
1576
logger.warning(u"Doing if_nametoindex the hard way")
1780
logger.warning("Doing if_nametoindex the hard way")
1577
1781
def if_nametoindex(interface):
1578
1782
"Get an interface index the hard way, i.e. using fcntl()"
1579
1783
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1580
1784
with contextlib.closing(socket.socket()) as s:
1581
1785
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1582
struct.pack(str(u"16s16x"),
1786
struct.pack(str("16s16x"),
1583
1787
interface))
1584
interface_index = struct.unpack(str(u"I"),
1788
interface_index = struct.unpack(str("I"),
1585
1789
ifreq[16:20])[0]
1586
1790
return interface_index
1587
1791
return if_nametoindex(interface)
1595
1799
sys.exit()
1596
1800
os.setsid()
1597
1801
if not nochdir:
1598
os.chdir(u"/")
1802
os.chdir("/")
1599
1803
if os.fork():
1600
1804
sys.exit()
1601
1805
if not noclose:
1603
1807
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1604
1808
if not stat.S_ISCHR(os.fstat(null).st_mode):
1605
1809
raise OSError(errno.ENODEV,
1606
u"%s not a character device"
1810
"%s not a character device"
1607
1811
% os.path.devnull)
1608
1812
os.dup2(null, sys.stdin.fileno())
1609
1813
os.dup2(null, sys.stdout.fileno())
1617
1821
##################################################################
1618
1822
# Parsing of options, both command line and config file
1619
1823
1620
parser = optparse.OptionParser(version = "%%prog %s" % version)
1621
parser.add_option("-i", u"--interface", type=u"string",
1622
metavar="IF", help=u"Bind to interface IF")
1623
parser.add_option("-a", u"--address", type=u"string",
1624
help=u"Address to listen for requests on")
1625
parser.add_option("-p", u"--port", type=u"int",
1626
help=u"Port number to receive requests on")
1627
parser.add_option("--check", action=u"store_true",
1628
help=u"Run self-test")
1629
parser.add_option("--debug", action=u"store_true",
1630
help=u"Debug mode; run in foreground and log to"
1631
u" terminal")
1632
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1633
help=u"Debug level for stdout output")
1634
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1635
u" priority string (see GnuTLS documentation)")
1636
parser.add_option("--servicename", type=u"string",
1637
metavar=u"NAME", help=u"Zeroconf service name")
1638
parser.add_option("--configdir", type=u"string",
1639
default=u"/etc/mandos", metavar=u"DIR",
1640
help=u"Directory to search for configuration"
1641
u" files")
1642
parser.add_option("--no-dbus", action=u"store_false",
1643
dest=u"use_dbus", help=u"Do not provide D-Bus"
1644
u" system bus interface")
1645
parser.add_option("--no-ipv6", action=u"store_false",
1646
dest=u"use_ipv6", help=u"Do not use IPv6")
1647
options = parser.parse_args()[0]
1824
parser = argparse.ArgumentParser()
1825
parser.add_argument("-v", "--version", action="version",
1826
version = "%%(prog)s %s" % version,
1827
help="show version number and exit")
1828
parser.add_argument("-i", "--interface", metavar="IF",
1829
help="Bind to interface IF")
1830
parser.add_argument("-a", "--address",
1831
help="Address to listen for requests on")
1832
parser.add_argument("-p", "--port", type=int,
1833
help="Port number to receive requests on")
1834
parser.add_argument("--check", action="store_true",
1835
help="Run self-test")
1836
parser.add_argument("--debug", action="store_true",
1837
help="Debug mode; run in foreground and log"
1838
" to terminal")
1839
parser.add_argument("--debuglevel", metavar="LEVEL",
1840
help="Debug level for stdout output")
1841
parser.add_argument("--priority", help="GnuTLS"
1842
" priority string (see GnuTLS documentation)")
1843
parser.add_argument("--servicename",
1844
metavar="NAME", help="Zeroconf service name")
1845
parser.add_argument("--configdir",
1846
default="/etc/mandos", metavar="DIR",
1847
help="Directory to search for configuration"
1848
" files")
1849
parser.add_argument("--no-dbus", action="store_false",
1850
dest="use_dbus", help="Do not provide D-Bus"
1851
" system bus interface")
1852
parser.add_argument("--no-ipv6", action="store_false",
1853
dest="use_ipv6", help="Do not use IPv6")
1854
options = parser.parse_args()
1648
1855
1649
1856
if options.check:
1650
1857
import doctest
1652
1859
sys.exit()
1653
1860
1654
1861
# Default values for config file for server-global settings
1655
server_defaults = { u"interface": u"",
1656
u"address": u"",
1657
u"port": u"",
1658
u"debug": u"False",
1659
u"priority":
1660
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1661
u"servicename": u"Mandos",
1662
u"use_dbus": u"True",
1663
u"use_ipv6": u"True",
1664
u"debuglevel": u"",
1862
server_defaults = { "interface": "",
1863
"address": "",
1864
"port": "",
1865
"debug": "False",
1866
"priority":
1867
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1868
"servicename": "Mandos",
1869
"use_dbus": "True",
1870
"use_ipv6": "True",
1871
"debuglevel": "",
1665
1872
}
1666
1873
1667
1874
# Parse config file for server-global settings
1668
1875
server_config = configparser.SafeConfigParser(server_defaults)
1669
1876
del server_defaults
1670
1877
server_config.read(os.path.join(options.configdir,
1671
u"mandos.conf"))
1878
"mandos.conf"))
1672
1879
# Convert the SafeConfigParser object to a dict
1673
1880
server_settings = server_config.defaults()
1674
1881
# Use the appropriate methods on the non-string config options
1675
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1676
server_settings[option] = server_config.getboolean(u"DEFAULT",
1882
for option in ("debug", "use_dbus", "use_ipv6"):
1883
server_settings[option] = server_config.getboolean("DEFAULT",
1677
1884
option)
1678
1885
if server_settings["port"]:
1679
server_settings["port"] = server_config.getint(u"DEFAULT",
1680
u"port")
1886
server_settings["port"] = server_config.getint("DEFAULT",
1887
"port")
1681
1888
del server_config
1682
1889
1683
1890
# Override the settings from the config file with command line
1684
1891
# options, if set.
1685
for option in (u"interface", u"address", u"port", u"debug",
1686
u"priority", u"servicename", u"configdir",
1687
u"use_dbus", u"use_ipv6", u"debuglevel"):
1892
for option in ("interface", "address", "port", "debug",
1893
"priority", "servicename", "configdir",
1894
"use_dbus", "use_ipv6", "debuglevel"):
1688
1895
value = getattr(options, option)
1689
1896
if value is not None:
1690
1897
server_settings[option] = value
1698
1905
##################################################################
1699
1906
1700
1907
# For convenience
1701
debug = server_settings[u"debug"]
1702
debuglevel = server_settings[u"debuglevel"]
1703
use_dbus = server_settings[u"use_dbus"]
1704
use_ipv6 = server_settings[u"use_ipv6"]
1705
1706
if server_settings[u"servicename"] != u"Mandos":
1908
debug = server_settings["debug"]
1909
debuglevel = server_settings["debuglevel"]
1910
use_dbus = server_settings["use_dbus"]
1911
use_ipv6 = server_settings["use_ipv6"]
1912
1913
if server_settings["servicename"] != "Mandos":
1707
1914
syslogger.setFormatter(logging.Formatter
1708
(u'Mandos (%s) [%%(process)d]:'
1709
u' %%(levelname)s: %%(message)s'
1710
% server_settings[u"servicename"]))
1915
('Mandos (%s) [%%(process)d]:'
1916
' %%(levelname)s: %%(message)s'
1917
% server_settings["servicename"]))
1711
1918
1712
1919
# Parse config file with clients
1713
client_defaults = { u"timeout": u"1h",
1714
u"interval": u"5m",
1715
u"checker": u"fping -q -- %%(host)s",
1716
u"host": u"",
1717
u"approved_delay": u"0s",
1718
u"approved_duration": u"1s",
1920
client_defaults = { "timeout": "5m",
1921
"extended_timeout": "15m",
1922
"interval": "2m",
1923
"checker": "fping -q -- %%(host)s",
1924
"host": "",
1925
"approval_delay": "0s",
1926
"approval_duration": "1s",
1719
1927
}
1720
1928
client_config = configparser.SafeConfigParser(client_defaults)
1721
client_config.read(os.path.join(server_settings[u"configdir"],
1722
u"clients.conf"))
1929
client_config.read(os.path.join(server_settings["configdir"],
1930
"clients.conf"))
1723
1931
1724
1932
global mandos_dbus_service
1725
1933
mandos_dbus_service = None
1726
1934
1727
tcp_server = MandosServer((server_settings[u"address"],
1728
server_settings[u"port"]),
1935
tcp_server = MandosServer((server_settings["address"],
1936
server_settings["port"]),
1729
1937
ClientHandler,
1730
interface=server_settings[u"interface"],
1938
interface=(server_settings["interface"]
1939
or None),
1731
1940
use_ipv6=use_ipv6,
1732
1941
gnutls_priority=
1733
server_settings[u"priority"],
1942
server_settings["priority"],
1734
1943
use_dbus=use_dbus)
1735
pidfilename = u"/var/run/mandos.pid"
1736
try:
1737
pidfile = open(pidfilename, u"w")
1738
except IOError:
1739
logger.error(u"Could not open file %r", pidfilename)
1944
if not debug:
1945
pidfilename = "/var/run/mandos.pid"
1946
try:
1947
pidfile = open(pidfilename, "w")
1948
except IOError:
1949
logger.error("Could not open file %r", pidfilename)
1740
1950
1741
1951
try:
1742
uid = pwd.getpwnam(u"_mandos").pw_uid
1743
gid = pwd.getpwnam(u"_mandos").pw_gid
1952
uid = pwd.getpwnam("_mandos").pw_uid
1953
gid = pwd.getpwnam("_mandos").pw_gid
1744
1954
except KeyError:
1745
1955
try:
1746
uid = pwd.getpwnam(u"mandos").pw_uid
1747
gid = pwd.getpwnam(u"mandos").pw_gid
1956
uid = pwd.getpwnam("mandos").pw_uid
1957
gid = pwd.getpwnam("mandos").pw_gid
1748
1958
except KeyError:
1749
1959
try:
1750
uid = pwd.getpwnam(u"nobody").pw_uid
1751
gid = pwd.getpwnam(u"nobody").pw_gid
1960
uid = pwd.getpwnam("nobody").pw_uid
1961
gid = pwd.getpwnam("nobody").pw_gid
1752
1962
except KeyError:
1753
1963
uid = 65534
1754
1964
gid = 65534
1755
1965
try:
1756
1966
os.setgid(gid)
1757
1967
os.setuid(uid)
1758
except OSError, error:
1968
except OSError as error:
1759
1969
if error[0] != errno.EPERM:
1760
1970
raise error
1761
1971
1762
# Enable all possible GnuTLS debugging
1763
1764
1765
1972
if not debug and not debuglevel:
1766
1973
syslogger.setLevel(logging.WARNING)
1767
1974
console.setLevel(logging.WARNING)
1769
1976
level = getattr(logging, debuglevel.upper())
1770
1977
syslogger.setLevel(level)
1771
1978
console.setLevel(level)
1772
1979
1773
1980
if debug:
1981
# Enable all possible GnuTLS debugging
1982
1774
1983
# "Use a log level over 10 to enable all debugging options."
1775
1984
# - GnuTLS manual
1776
1985
gnutls.library.functions.gnutls_global_set_log_level(11)
1777
1986
1778
1987
@gnutls.library.types.gnutls_log_func
1779
1988
def debug_gnutls(level, string):
1780
logger.debug(u"GnuTLS: %s", string[:-1])
1989
logger.debug("GnuTLS: %s", string[:-1])
1781
1990
1782
1991
(gnutls.library.functions
1783
1992
.gnutls_global_set_log_function(debug_gnutls))
1784
1993
1785
1994
# Redirect stdin so all checkers get /dev/null
1786
1995
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1787
1996
os.dup2(null, sys.stdin.fileno())
1790
1999
else:
1791
2000
# No console logging
1792
2001
logger.removeHandler(console)
1793
2002
2003
# Need to fork before connecting to D-Bus
2004
if not debug:
2005
# Close all input and output, do double fork, etc.
2006
daemon()
1794
2007
1795
2008
global main_loop
1796
2009
# From the Avahi example code
1800
2013
# End of Avahi example code
1801
2014
if use_dbus:
1802
2015
try:
1803
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
2016
bus_name = dbus.service.BusName("se.recompile.Mandos",
1804
2017
bus, do_not_queue=True)
1805
except dbus.exceptions.NameExistsException, e:
1806
logger.error(unicode(e) + u", disabling D-Bus")
2018
old_bus_name = (dbus.service.BusName
2019
("se.bsnet.fukt.Mandos", bus,
2020
do_not_queue=True))
2021
except dbus.exceptions.NameExistsException as e:
2022
logger.error(unicode(e) + ", disabling D-Bus")
1807
2023
use_dbus = False
1808
server_settings[u"use_dbus"] = False
2024
server_settings["use_dbus"] = False
1809
2025
tcp_server.use_dbus = False
1810
2026
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1811
service = AvahiService(name = server_settings[u"servicename"],
1812
servicetype = u"_mandos._tcp",
2027
service = AvahiService(name = server_settings["servicename"],
2028
servicetype = "_mandos._tcp",
1813
2029
protocol = protocol, bus = bus)
1814
2030
if server_settings["interface"]:
1815
2031
service.interface = (if_nametoindex
1816
(str(server_settings[u"interface"])))
1817
1818
if not debug:
1819
# Close all input and output, do double fork, etc.
1820
daemon()
1821
2032
(str(server_settings["interface"])))
2033
1822
2034
global multiprocessing_manager
1823
2035
multiprocessing_manager = multiprocessing.Manager()
1824
2036
1825
2037
client_class = Client
1826
2038
if use_dbus:
1827
client_class = functools.partial(ClientDBus, bus = bus)
2039
client_class = functools.partial(ClientDBusTransitional,
2040
bus = bus)
1828
2041
def client_config_items(config, section):
1829
2042
special_settings = {
1830
2043
"approved_by_default":
1843
2056
client_config, section)))
1844
2057
for section in client_config.sections()))
1845
2058
if not tcp_server.clients:
1846
logger.warning(u"No clients defined")
2059
logger.warning("No clients defined")
1847
2060
1848
try:
1849
with pidfile:
1850
pid = os.getpid()
1851
pidfile.write(str(pid) + "\n")
1852
del pidfile
1853
except IOError:
1854
logger.error(u"Could not write to file %r with PID %d",
1855
pidfilename, pid)
1856
except NameError:
1857
# "pidfile" was never created
1858
pass
1859
del pidfilename
1860
1861
2061
if not debug:
2062
try:
2063
with pidfile:
2064
pid = os.getpid()
2065
pidfile.write(str(pid) + "\n".encode("utf-8"))
2066
del pidfile
2067
except IOError:
2068
logger.error("Could not write to file %r with PID %d",
2069
pidfilename, pid)
2070
except NameError:
2071
# "pidfile" was never created
2072
pass
2073
del pidfilename
2074
1862
2075
signal.signal(signal.SIGINT, signal.SIG_IGN)
2076
1863
2077
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1864
2078
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1865
2079
1867
2081
class MandosDBusService(dbus.service.Object):
1868
2082
"""A D-Bus proxy object"""
1869
2083
def __init__(self):
1870
dbus.service.Object.__init__(self, bus, u"/")
1871
_interface = u"se.bsnet.fukt.Mandos"
2084
dbus.service.Object.__init__(self, bus, "/")
2085
_interface = "se.recompile.Mandos"
1872
2086
1873
@dbus.service.signal(_interface, signature=u"o")
2087
@dbus.service.signal(_interface, signature="o")
1874
2088
def ClientAdded(self, objpath):
1875
2089
"D-Bus signal"
1876
2090
pass
1877
2091
1878
@dbus.service.signal(_interface, signature=u"ss")
2092
@dbus.service.signal(_interface, signature="ss")
1879
2093
def ClientNotFound(self, fingerprint, address):
1880
2094
"D-Bus signal"
1881
2095
pass
1882
2096
1883
@dbus.service.signal(_interface, signature=u"os")
2097
@dbus.service.signal(_interface, signature="os")
1884
2098
def ClientRemoved(self, objpath, name):
1885
2099
"D-Bus signal"
1886
2100
pass
1887
2101
1888
@dbus.service.method(_interface, out_signature=u"ao")
2102
@dbus.service.method(_interface, out_signature="ao")
1889
2103
def GetAllClients(self):
1890
2104
"D-Bus method"
1891
2105
return dbus.Array(c.dbus_object_path
1892
2106
for c in tcp_server.clients)
1893
2107
1894
2108
@dbus.service.method(_interface,
1895
out_signature=u"a{oa{sv}}")
2109
out_signature="a{oa{sv}}")
1896
2110
def GetAllClientsWithProperties(self):
1897
2111
"D-Bus method"
1898
2112
return dbus.Dictionary(
1899
((c.dbus_object_path, c.GetAll(u""))
2113
((c.dbus_object_path, c.GetAll(""))
1900
2114
for c in tcp_server.clients),
1901
signature=u"oa{sv}")
2115
signature="oa{sv}")
1902
2116
1903
@dbus.service.method(_interface, in_signature=u"o")
2117
@dbus.service.method(_interface, in_signature="o")
1904
2118
def RemoveClient(self, object_path):
1905
2119
"D-Bus method"
1906
2120
for c in tcp_server.clients:
1916
2130
1917
2131
del _interface
1918
2132
1919
mandos_dbus_service = MandosDBusService()
2133
class MandosDBusServiceTransitional(MandosDBusService):
2134
__metaclass__ = AlternateDBusNamesMetaclass
2135
mandos_dbus_service = MandosDBusServiceTransitional()
1920
2136
1921
2137
def cleanup():
1922
2138
"Cleanup function; run on exit"
1923
2139
service.cleanup()
1924
2140
2141
multiprocessing.active_children()
1925
2142
while tcp_server.clients:
1926
2143
client = tcp_server.clients.pop()
1927
2144
if use_dbus:
1931
2148
client.disable(quiet=True)
1932
2149
if use_dbus:
1933
2150
# Emit D-Bus signal
1934
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2151
mandos_dbus_service.ClientRemoved(client
2152
.dbus_object_path,
1935
2153
client.name)
1936
2154
1937
2155
atexit.register(cleanup)
1948
2166
# Find out what port we got
1949
2167
service.port = tcp_server.socket.getsockname()[1]
1950
2168
if use_ipv6:
1951
logger.info(u"Now listening on address %r, port %d,"
2169
logger.info("Now listening on address %r, port %d,"
1952
2170
" flowinfo %d, scope_id %d"
1953
2171
% tcp_server.socket.getsockname())
1954
2172
else: # IPv4
1955
logger.info(u"Now listening on address %r, port %d"
2173
logger.info("Now listening on address %r, port %d"
1956
2174
% tcp_server.socket.getsockname())
1957
2175
1958
2176
#service.interface = tcp_server.socket.getsockname()[3]
1961
2179
# From the Avahi example code
1962
2180
try:
1963
2181
service.activate()
1964
except dbus.exceptions.DBusException, error:
1965
logger.critical(u"DBusException: %s", error)
2182
except dbus.exceptions.DBusException as error:
2183
logger.critical("DBusException: %s", error)
1966
2184
cleanup()
1967
2185
sys.exit(1)
1968
2186
# End of Avahi example code
1972
2190
(tcp_server.handle_request
1973
2191
(*args[2:], **kwargs) or True))
1974
2192
1975
logger.debug(u"Starting main loop")
2193
logger.debug("Starting main loop")
1976
2194
main_loop.run()
1977
except AvahiError, error:
1978
logger.critical(u"AvahiError: %s", error)
2195
except AvahiError as error:
2196
logger.critical("AvahiError: %s", error)
1979
2197
cleanup()
1980
2198
sys.exit(1)
1981
2199
except KeyboardInterrupt:
1982
2200
if debug:
1983
print >> sys.stderr
1984
logger.debug(u"Server received KeyboardInterrupt")
1985
logger.debug(u"Server exiting")
2201
print("", file=sys.stderr)
2202
logger.debug("Server received KeyboardInterrupt")
2203
logger.debug("Server exiting")
1986
2204
# Must run before the D-Bus bus name gets deregistered
1987
2205
cleanup()
1988
2206
2207
1989
2208
if __name__ == '__main__':
1990
2209
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0