To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 513
- compare with another revision
- download diff
- download tarball
- view history from revision 513
- Committer: Teddy Hogeborn
- Date: 2011-10-09 15:21:16 UTC
- mfrom: (505.1.11 teddy)
- Revision ID: teddy@recompile.se-20111009152116-obbil3b2sxu2sixl
Merge from Teddy
- files added:
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008,2009 Teddy Hogeborn
15
# Copyright © 2008,2009 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
# Contact the authors at <mandos@recompile.se>.
32
32
#
33
33
34
from __future__ import division, with_statement, absolute_import
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
35
36
36
37
import SocketServer as socketserver
37
38
import socket
38
import optparse
39
import argparse
39
40
import datetime
40
41
import errno
41
42
import gnutls.crypto
61
62
import functools
62
63
import cPickle as pickle
63
64
import multiprocessing
65
import types
64
66
65
67
import dbus
66
68
import dbus.service
81
83
SO_BINDTODEVICE = None
82
84
83
85
84
version = "1.0.14"
86
version = "1.3.1"
85
87
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
88
90
syslogger = (logging.handlers.SysLogHandler
89
91
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
90
address = "/dev/log"))
92
address = str("/dev/log")))
91
93
syslogger.setFormatter(logging.Formatter
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
94
96
logger.addHandler(syslogger)
95
97
96
98
console = logging.StreamHandler()
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
100
102
logger.addHandler(console)
101
103
102
104
class AvahiError(Exception):
119
121
Attributes:
120
122
interface: integer; avahi.IF_UNSPEC or an interface index.
121
123
Used to optionally bind to the specified interface.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
124
name: string; Example: 'Mandos'
125
type: string; Example: '_mandos._tcp'.
124
126
See <http://www.dns-sd.org/ServiceTypes.html>
125
127
port: integer; what port to announce
126
128
TXT: list of strings; TXT record for the service
135
137
"""
136
138
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
137
139
servicetype = None, port = None, TXT = None,
138
domain = u"", host = u"", max_renames = 32768,
140
domain = "", host = "", max_renames = 32768,
139
141
protocol = avahi.PROTO_UNSPEC, bus = None):
140
142
self.interface = interface
141
143
self.name = name
150
152
self.group = None # our entry group
151
153
self.server = None
152
154
self.bus = bus
155
self.entry_group_state_changed_match = None
153
156
def rename(self):
154
157
"""Derived from the Avahi example code"""
155
158
if self.rename_count >= self.max_renames:
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
159
logger.critical("No suitable Zeroconf service name found"
160
" after %i retries, exiting.",
158
161
self.rename_count)
159
raise AvahiServiceError(u"Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
161
logger.info(u"Changing Zeroconf service name to %r ...",
162
raise AvahiServiceError("Too many renames")
163
self.name = unicode(self.server
164
.GetAlternativeServiceName(self.name))
165
logger.info("Changing Zeroconf service name to %r ...",
162
166
self.name)
163
167
syslogger.setFormatter(logging.Formatter
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
168
('Mandos (%s) [%%(process)d]:'
169
' %%(levelname)s: %%(message)s'
166
170
% self.name))
167
171
self.remove()
168
172
try:
169
173
self.add()
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
174
except dbus.exceptions.DBusException as error:
175
logger.critical("DBusException: %s", error)
172
176
self.cleanup()
173
177
os._exit(1)
174
178
self.rename_count += 1
175
179
def remove(self):
176
180
"""Derived from the Avahi example code"""
181
if self.entry_group_state_changed_match is not None:
182
self.entry_group_state_changed_match.remove()
183
self.entry_group_state_changed_match = None
177
184
if self.group is not None:
178
185
self.group.Reset()
179
186
def add(self):
180
187
"""Derived from the Avahi example code"""
188
self.remove()
181
189
if self.group is None:
182
190
self.group = dbus.Interface(
183
191
self.bus.get_object(avahi.DBUS_NAME,
184
192
self.server.EntryGroupNew()),
185
193
avahi.DBUS_INTERFACE_ENTRY_GROUP)
186
self.group.connect_to_signal('StateChanged',
187
self
188
.entry_group_state_changed)
189
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
194
self.entry_group_state_changed_match = (
195
self.group.connect_to_signal(
196
'StateChanged', self .entry_group_state_changed))
197
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
190
198
self.name, self.type)
191
199
self.group.AddService(
192
200
self.interface,
199
207
self.group.Commit()
200
208
def entry_group_state_changed(self, state, error):
201
209
"""Derived from the Avahi example code"""
202
logger.debug(u"Avahi entry group state change: %i", state)
210
logger.debug("Avahi entry group state change: %i", state)
203
211
204
212
if state == avahi.ENTRY_GROUP_ESTABLISHED:
205
logger.debug(u"Zeroconf service established.")
213
logger.debug("Zeroconf service established.")
206
214
elif state == avahi.ENTRY_GROUP_COLLISION:
207
logger.warning(u"Zeroconf service name collision.")
215
logger.info("Zeroconf service name collision.")
208
216
self.rename()
209
217
elif state == avahi.ENTRY_GROUP_FAILURE:
210
logger.critical(u"Avahi: Error in group state changed %s",
218
logger.critical("Avahi: Error in group state changed %s",
211
219
unicode(error))
212
raise AvahiGroupError(u"State changed: %s"
220
raise AvahiGroupError("State changed: %s"
213
221
% unicode(error))
214
222
def cleanup(self):
215
223
"""Derived from the Avahi example code"""
216
224
if self.group is not None:
217
self.group.Free()
225
try:
226
self.group.Free()
227
except (dbus.exceptions.UnknownMethodException,
228
dbus.exceptions.DBusException) as e:
229
pass
218
230
self.group = None
219
def server_state_changed(self, state):
231
self.remove()
232
def server_state_changed(self, state, error=None):
220
233
"""Derived from the Avahi example code"""
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
224
self.remove()
234
logger.debug("Avahi server state change: %i", state)
235
bad_states = { avahi.SERVER_INVALID:
236
"Zeroconf server invalid",
237
avahi.SERVER_REGISTERING: None,
238
avahi.SERVER_COLLISION:
239
"Zeroconf server name collision",
240
avahi.SERVER_FAILURE:
241
"Zeroconf server failure" }
242
if state in bad_states:
243
if bad_states[state] is not None:
244
if error is None:
245
logger.error(bad_states[state])
246
else:
247
logger.error(bad_states[state] + ": %r", error)
248
self.cleanup()
225
249
elif state == avahi.SERVER_RUNNING:
226
250
self.add()
251
else:
252
if error is None:
253
logger.debug("Unknown state: %r", state)
254
else:
255
logger.debug("Unknown state: %r: %r", state, error)
227
256
def activate(self):
228
257
"""Derived from the Avahi example code"""
229
258
if self.server is None:
230
259
self.server = dbus.Interface(
231
260
self.bus.get_object(avahi.DBUS_NAME,
232
avahi.DBUS_PATH_SERVER),
261
avahi.DBUS_PATH_SERVER,
262
follow_name_owner_changes=True),
233
263
avahi.DBUS_INTERFACE_SERVER)
234
self.server.connect_to_signal(u"StateChanged",
264
self.server.connect_to_signal("StateChanged",
235
265
self.server_state_changed)
236
266
self.server_state_changed(self.server.GetState())
237
267
238
268
269
def _timedelta_to_milliseconds(td):
270
"Convert a datetime.timedelta() to milliseconds"
271
return ((td.days * 24 * 60 * 60 * 1000)
272
+ (td.seconds * 1000)
273
+ (td.microseconds // 1000))
274
239
275
class Client(object):
240
276
"""A representation of a client host served by this server.
241
277
242
278
Attributes:
243
name: string; from the config file, used in log messages and
244
D-Bus identifiers
279
_approved: bool(); 'None' if not yet approved/disapproved
280
approval_delay: datetime.timedelta(); Time to wait for approval
281
approval_duration: datetime.timedelta(); Duration of one approval
282
checker: subprocess.Popen(); a running checker process used
283
to see if the client lives.
284
'None' if no process is running.
285
checker_callback_tag: a gobject event source tag, or None
286
checker_command: string; External command which is run to check
287
if client lives. %() expansions are done at
288
runtime with vars(self) as dict, so that for
289
instance %(name)s can be used in the command.
290
checker_initiator_tag: a gobject event source tag, or None
291
created: datetime.datetime(); (UTC) object creation
292
current_checker_command: string; current running checker_command
293
disable_hook: If set, called by disable() as disable_hook(self)
294
disable_initiator_tag: a gobject event source tag, or None
295
enabled: bool()
245
296
fingerprint: string (40 or 32 hexadecimal digits); used to
246
297
uniquely identify the client
247
secret: bytestring; sent verbatim (over TLS) to client
248
298
host: string; available for use by the checker command
249
created: datetime.datetime(); (UTC) object creation
299
interval: datetime.timedelta(); How often to start a new checker
300
last_approval_request: datetime.datetime(); (UTC) or None
301
last_checked_ok: datetime.datetime(); (UTC) or None
250
302
last_enabled: datetime.datetime(); (UTC)
251
enabled: bool()
252
last_checked_ok: datetime.datetime(); (UTC) or None
303
name: string; from the config file, used in log messages and
304
D-Bus identifiers
305
secret: bytestring; sent verbatim (over TLS) to client
253
306
timeout: datetime.timedelta(); How long from last_checked_ok
254
307
until this client is disabled
255
interval: datetime.timedelta(); How often to start a new checker
256
disable_hook: If set, called by disable() as disable_hook(self)
257
checker: subprocess.Popen(); a running checker process used
258
to see if the client lives.
259
'None' if no process is running.
260
checker_initiator_tag: a gobject event source tag, or None
261
disable_initiator_tag: - '' -
262
checker_callback_tag: - '' -
263
checker_command: string; External command which is run to check if
264
client lives. %() expansions are done at
265
runtime with vars(self) as dict, so that for
266
instance %(name)s can be used in the command.
267
current_checker_command: string; current running checker_command
268
approval_delay: datetime.timedelta(); Time to wait for approval
269
_approved: bool(); 'None' if not yet approved/disapproved
270
approval_duration: datetime.timedelta(); Duration of one approval
308
extended_timeout: extra long timeout when password has been sent
309
runtime_expansions: Allowed attributes for runtime expansion.
310
expires: datetime.datetime(); time (UTC) when a client will be
311
disabled, or None
271
312
"""
272
313
273
@staticmethod
274
def _timedelta_to_milliseconds(td):
275
"Convert a datetime.timedelta() to milliseconds"
276
return ((td.days * 24 * 60 * 60 * 1000)
277
+ (td.seconds * 1000)
278
+ (td.microseconds // 1000))
314
runtime_expansions = ("approval_delay", "approval_duration",
315
"created", "enabled", "fingerprint",
316
"host", "interval", "last_checked_ok",
317
"last_enabled", "name", "timeout")
279
318
280
319
def timeout_milliseconds(self):
281
320
"Return the 'timeout' attribute in milliseconds"
282
return self._timedelta_to_milliseconds(self.timeout)
321
return _timedelta_to_milliseconds(self.timeout)
322
323
def extended_timeout_milliseconds(self):
324
"Return the 'extended_timeout' attribute in milliseconds"
325
return _timedelta_to_milliseconds(self.extended_timeout)
283
326
284
327
def interval_milliseconds(self):
285
328
"Return the 'interval' attribute in milliseconds"
286
return self._timedelta_to_milliseconds(self.interval)
287
329
return _timedelta_to_milliseconds(self.interval)
330
288
331
def approval_delay_milliseconds(self):
289
return self._timedelta_to_milliseconds(self.approval_delay)
332
return _timedelta_to_milliseconds(self.approval_delay)
290
333
291
334
def __init__(self, name = None, disable_hook=None, config=None):
292
335
"""Note: the 'checker' key in 'config' sets the
295
338
self.name = name
296
339
if config is None:
297
340
config = {}
298
logger.debug(u"Creating client %r", self.name)
341
logger.debug("Creating client %r", self.name)
299
342
# Uppercase and remove spaces from fingerprint for later
300
343
# comparison purposes with return value from the fingerprint()
301
344
# function
302
self.fingerprint = (config[u"fingerprint"].upper()
303
.replace(u" ", u""))
304
logger.debug(u" Fingerprint: %s", self.fingerprint)
305
if u"secret" in config:
306
self.secret = config[u"secret"].decode(u"base64")
307
elif u"secfile" in config:
345
self.fingerprint = (config["fingerprint"].upper()
346
.replace(" ", ""))
347
logger.debug(" Fingerprint: %s", self.fingerprint)
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
308
351
with open(os.path.expanduser(os.path.expandvars
309
(config[u"secfile"])),
352
(config["secfile"])),
310
353
"rb") as secfile:
311
354
self.secret = secfile.read()
312
355
else:
313
raise TypeError(u"No secret or secfile for client %s"
356
raise TypeError("No secret or secfile for client %s"
314
357
% self.name)
315
self.host = config.get(u"host", u"")
358
self.host = config.get("host", "")
316
359
self.created = datetime.datetime.utcnow()
317
360
self.enabled = False
361
self.last_approval_request = None
318
362
self.last_enabled = None
319
363
self.last_checked_ok = None
320
self.timeout = string_to_delta(config[u"timeout"])
321
self.interval = string_to_delta(config[u"interval"])
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
322
368
self.disable_hook = disable_hook
323
369
self.checker = None
324
370
self.checker_initiator_tag = None
325
371
self.disable_initiator_tag = None
372
self.expires = None
326
373
self.checker_callback_tag = None
327
self.checker_command = config[u"checker"]
374
self.checker_command = config["checker"]
328
375
self.current_checker_command = None
329
376
self.last_connect = None
330
377
self._approved = None
331
self.approved_by_default = config.get(u"approved_by_default",
378
self.approved_by_default = config.get("approved_by_default",
332
379
True)
333
380
self.approvals_pending = 0
334
381
self.approval_delay = string_to_delta(
335
config[u"approval_delay"])
382
config["approval_delay"])
336
383
self.approval_duration = string_to_delta(
337
config[u"approval_duration"])
338
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
384
config["approval_duration"])
385
self.changedstate = (multiprocessing_manager
386
.Condition(multiprocessing_manager
387
.Lock()))
339
388
340
389
def send_changedstate(self):
341
390
self.changedstate.acquire()
342
391
self.changedstate.notify_all()
343
392
self.changedstate.release()
344
393
345
394
def enable(self):
346
395
"""Start this client's checker and timeout hooks"""
347
if getattr(self, u"enabled", False):
396
if getattr(self, "enabled", False):
348
397
# Already enabled
349
398
return
350
399
self.send_changedstate()
351
self.last_enabled = datetime.datetime.utcnow()
352
400
# Schedule a new checker to be started an 'interval' from now,
353
401
# and every interval from then on.
354
402
self.checker_initiator_tag = (gobject.timeout_add
355
403
(self.interval_milliseconds(),
356
404
self.start_checker))
357
405
# Schedule a disable() when 'timeout' has passed
406
self.expires = datetime.datetime.utcnow() + self.timeout
358
407
self.disable_initiator_tag = (gobject.timeout_add
359
408
(self.timeout_milliseconds(),
360
409
self.disable))
361
410
self.enabled = True
411
self.last_enabled = datetime.datetime.utcnow()
362
412
# Also start a new checker *right now*.
363
413
self.start_checker()
364
414
369
419
if not quiet:
370
420
self.send_changedstate()
371
421
if not quiet:
372
logger.info(u"Disabling client %s", self.name)
373
if getattr(self, u"disable_initiator_tag", False):
422
logger.info("Disabling client %s", self.name)
423
if getattr(self, "disable_initiator_tag", False):
374
424
gobject.source_remove(self.disable_initiator_tag)
375
425
self.disable_initiator_tag = None
376
if getattr(self, u"checker_initiator_tag", False):
426
self.expires = None
427
if getattr(self, "checker_initiator_tag", False):
377
428
gobject.source_remove(self.checker_initiator_tag)
378
429
self.checker_initiator_tag = None
379
430
self.stop_checker()
394
445
if os.WIFEXITED(condition):
395
446
exitstatus = os.WEXITSTATUS(condition)
396
447
if exitstatus == 0:
397
logger.info(u"Checker for %(name)s succeeded",
448
logger.info("Checker for %(name)s succeeded",
398
449
vars(self))
399
450
self.checked_ok()
400
451
else:
401
logger.info(u"Checker for %(name)s failed",
452
logger.info("Checker for %(name)s failed",
402
453
vars(self))
403
454
else:
404
logger.warning(u"Checker for %(name)s crashed?",
455
logger.warning("Checker for %(name)s crashed?",
405
456
vars(self))
406
457
407
def checked_ok(self):
458
def checked_ok(self, timeout=None):
408
459
"""Bump up the timeout for this client.
409
460
410
461
This should only be called when the client has been seen,
411
462
alive and well.
412
463
"""
464
if timeout is None:
465
timeout = self.timeout
413
466
self.last_checked_ok = datetime.datetime.utcnow()
414
467
gobject.source_remove(self.disable_initiator_tag)
415
468
self.disable_initiator_tag = (gobject.timeout_add
416
(self.timeout_milliseconds(),
417
self.disable))
469
(_timedelta_to_milliseconds
470
(timeout), self.disable))
471
self.expires = datetime.datetime.utcnow() + timeout
472
473
def need_approval(self):
474
self.last_approval_request = datetime.datetime.utcnow()
418
475
419
476
def start_checker(self):
420
477
"""Start a new checker subprocess if one is not running.
433
490
# If a checker exists, make sure it is not a zombie
434
491
try:
435
492
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
436
except (AttributeError, OSError), error:
493
except (AttributeError, OSError) as error:
437
494
if (isinstance(error, OSError)
438
495
and error.errno != errno.ECHILD):
439
496
raise error
440
497
else:
441
498
if pid:
442
logger.warning(u"Checker was a zombie")
499
logger.warning("Checker was a zombie")
443
500
gobject.source_remove(self.checker_callback_tag)
444
501
self.checker_callback(pid, status,
445
502
self.current_checker_command)
450
507
command = self.checker_command % self.host
451
508
except TypeError:
452
509
# Escape attributes for the shell
453
escaped_attrs = dict((key,
454
re.escape(unicode(str(val),
455
errors=
456
u'replace')))
457
for key, val in
458
vars(self).iteritems())
510
escaped_attrs = dict(
511
(attr,
512
re.escape(unicode(str(getattr(self, attr, "")),
513
errors=
514
'replace')))
515
for attr in
516
self.runtime_expansions)
517
459
518
try:
460
519
command = self.checker_command % escaped_attrs
461
except TypeError, error:
462
logger.error(u'Could not format string "%s":'
463
u' %s', self.checker_command, error)
520
except TypeError as error:
521
logger.error('Could not format string "%s":'
522
' %s', self.checker_command, error)
464
523
return True # Try again later
465
524
self.current_checker_command = command
466
525
try:
467
logger.info(u"Starting checker %r for %s",
526
logger.info("Starting checker %r for %s",
468
527
command, self.name)
469
528
# We don't need to redirect stdout and stderr, since
470
529
# in normal mode, that is already done by daemon(),
472
531
# always replaced by /dev/null.)
473
532
self.checker = subprocess.Popen(command,
474
533
close_fds=True,
475
shell=True, cwd=u"/")
534
shell=True, cwd="/")
476
535
self.checker_callback_tag = (gobject.child_watch_add
477
536
(self.checker.pid,
478
537
self.checker_callback,
483
542
if pid:
484
543
gobject.source_remove(self.checker_callback_tag)
485
544
self.checker_callback(pid, status, command)
486
except OSError, error:
487
logger.error(u"Failed to start subprocess: %s",
545
except OSError as error:
546
logger.error("Failed to start subprocess: %s",
488
547
error)
489
548
# Re-run this periodically if run by gobject.timeout_add
490
549
return True
494
553
if self.checker_callback_tag:
495
554
gobject.source_remove(self.checker_callback_tag)
496
555
self.checker_callback_tag = None
497
if getattr(self, u"checker", None) is None:
556
if getattr(self, "checker", None) is None:
498
557
return
499
logger.debug(u"Stopping checker for %(name)s", vars(self))
558
logger.debug("Stopping checker for %(name)s", vars(self))
500
559
try:
501
560
os.kill(self.checker.pid, signal.SIGTERM)
502
561
#time.sleep(0.5)
503
562
#if self.checker.poll() is None:
504
563
# os.kill(self.checker.pid, signal.SIGKILL)
505
except OSError, error:
564
except OSError as error:
506
565
if error.errno != errno.ESRCH: # No such process
507
566
raise
508
567
self.checker = None
509
568
510
def dbus_service_property(dbus_interface, signature=u"v",
511
access=u"readwrite", byte_arrays=False):
569
570
def dbus_service_property(dbus_interface, signature="v",
571
access="readwrite", byte_arrays=False):
512
572
"""Decorators for marking methods of a DBusObjectWithProperties to
513
573
become properties on the D-Bus.
514
574
521
581
"""
522
582
# Encoding deeply encoded byte arrays is not supported yet by the
523
583
# "Set" method, so we fail early here:
524
if byte_arrays and signature != u"ay":
525
raise ValueError(u"Byte arrays not supported for non-'ay'"
526
u" signature %r" % signature)
584
if byte_arrays and signature != "ay":
585
raise ValueError("Byte arrays not supported for non-'ay'"
586
" signature %r" % signature)
527
587
def decorator(func):
528
588
func._dbus_is_property = True
529
589
func._dbus_interface = dbus_interface
530
590
func._dbus_signature = signature
531
591
func._dbus_access = access
532
592
func._dbus_name = func.__name__
533
if func._dbus_name.endswith(u"_dbus_property"):
593
if func._dbus_name.endswith("_dbus_property"):
534
594
func._dbus_name = func._dbus_name[:-14]
535
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
595
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
536
596
return func
537
597
return decorator
538
598
558
618
559
619
class DBusObjectWithProperties(dbus.service.Object):
560
620
"""A D-Bus object with properties.
561
621
562
622
Classes inheriting from this can use the dbus_service_property
563
623
decorator to expose methods as D-Bus properties. It exposes the
564
624
standard Get(), Set(), and GetAll() methods on the D-Bus.
566
626
567
627
@staticmethod
568
628
def _is_dbus_property(obj):
569
return getattr(obj, u"_dbus_is_property", False)
629
return getattr(obj, "_dbus_is_property", False)
570
630
571
631
def _get_all_dbus_properties(self):
572
632
"""Returns a generator of (name, attribute) pairs
573
633
"""
574
return ((prop._dbus_name, prop)
634
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
635
for cls in self.__class__.__mro__
575
636
for name, prop in
576
inspect.getmembers(self, self._is_dbus_property))
637
inspect.getmembers(cls, self._is_dbus_property))
577
638
578
639
def _get_dbus_property(self, interface_name, property_name):
579
640
"""Returns a bound method if one exists which is a D-Bus
580
641
property with the specified name and interface.
581
642
"""
582
for name in (property_name,
583
property_name + u"_dbus_property"):
584
prop = getattr(self, name, None)
585
if (prop is None
586
or not self._is_dbus_property(prop)
587
or prop._dbus_name != property_name
588
or (interface_name and prop._dbus_interface
589
and interface_name != prop._dbus_interface)):
590
continue
591
return prop
643
for cls in self.__class__.__mro__:
644
for name, value in (inspect.getmembers
645
(cls, self._is_dbus_property)):
646
if (value._dbus_name == property_name
647
and value._dbus_interface == interface_name):
648
return value.__get__(self)
649
592
650
# No such property
593
raise DBusPropertyNotFound(self.dbus_object_path + u":"
594
+ interface_name + u"."
651
raise DBusPropertyNotFound(self.dbus_object_path + ":"
652
+ interface_name + "."
595
653
+ property_name)
596
654
597
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
598
out_signature=u"v")
655
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
656
out_signature="v")
599
657
def Get(self, interface_name, property_name):
600
658
"""Standard D-Bus property Get() method, see D-Bus standard.
601
659
"""
602
660
prop = self._get_dbus_property(interface_name, property_name)
603
if prop._dbus_access == u"write":
661
if prop._dbus_access == "write":
604
662
raise DBusPropertyAccessException(property_name)
605
663
value = prop()
606
if not hasattr(value, u"variant_level"):
664
if not hasattr(value, "variant_level"):
607
665
return value
608
666
return type(value)(value, variant_level=value.variant_level+1)
609
667
610
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
668
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
611
669
def Set(self, interface_name, property_name, value):
612
670
"""Standard D-Bus property Set() method, see D-Bus standard.
613
671
"""
614
672
prop = self._get_dbus_property(interface_name, property_name)
615
if prop._dbus_access == u"read":
673
if prop._dbus_access == "read":
616
674
raise DBusPropertyAccessException(property_name)
617
if prop._dbus_get_args_options[u"byte_arrays"]:
675
if prop._dbus_get_args_options["byte_arrays"]:
618
676
# The byte_arrays option is not supported yet on
619
677
# signatures other than "ay".
620
if prop._dbus_signature != u"ay":
678
if prop._dbus_signature != "ay":
621
679
raise ValueError
622
680
value = dbus.ByteArray(''.join(unichr(byte)
623
681
for byte in value))
624
682
prop(value)
625
683
626
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
627
out_signature=u"a{sv}")
684
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
685
out_signature="a{sv}")
628
686
def GetAll(self, interface_name):
629
687
"""Standard D-Bus property GetAll() method, see D-Bus
630
688
standard.
631
689
632
690
Note: Will not include properties with access="write".
633
691
"""
634
692
all = {}
638
696
# Interface non-empty but did not match
639
697
continue
640
698
# Ignore write-only properties
641
if prop._dbus_access == u"write":
699
if prop._dbus_access == "write":
642
700
continue
643
701
value = prop()
644
if not hasattr(value, u"variant_level"):
702
if not hasattr(value, "variant_level"):
645
703
all[name] = value
646
704
continue
647
705
all[name] = type(value)(value, variant_level=
648
706
value.variant_level+1)
649
return dbus.Dictionary(all, signature=u"sv")
707
return dbus.Dictionary(all, signature="sv")
650
708
651
709
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
652
out_signature=u"s",
710
out_signature="s",
653
711
path_keyword='object_path',
654
712
connection_keyword='connection')
655
713
def Introspect(self, object_path, connection):
660
718
try:
661
719
document = xml.dom.minidom.parseString(xmlstring)
662
720
def make_tag(document, name, prop):
663
e = document.createElement(u"property")
664
e.setAttribute(u"name", name)
665
e.setAttribute(u"type", prop._dbus_signature)
666
e.setAttribute(u"access", prop._dbus_access)
721
e = document.createElement("property")
722
e.setAttribute("name", name)
723
e.setAttribute("type", prop._dbus_signature)
724
e.setAttribute("access", prop._dbus_access)
667
725
return e
668
for if_tag in document.getElementsByTagName(u"interface"):
726
for if_tag in document.getElementsByTagName("interface"):
669
727
for tag in (make_tag(document, name, prop)
670
728
for name, prop
671
729
in self._get_all_dbus_properties()
672
730
if prop._dbus_interface
673
== if_tag.getAttribute(u"name")):
731
== if_tag.getAttribute("name")):
674
732
if_tag.appendChild(tag)
675
733
# Add the names to the return values for the
676
734
# "org.freedesktop.DBus.Properties" methods
677
if (if_tag.getAttribute(u"name")
678
== u"org.freedesktop.DBus.Properties"):
679
for cn in if_tag.getElementsByTagName(u"method"):
680
if cn.getAttribute(u"name") == u"Get":
681
for arg in cn.getElementsByTagName(u"arg"):
682
if (arg.getAttribute(u"direction")
683
== u"out"):
684
arg.setAttribute(u"name", u"value")
685
elif cn.getAttribute(u"name") == u"GetAll":
686
for arg in cn.getElementsByTagName(u"arg"):
687
if (arg.getAttribute(u"direction")
688
== u"out"):
689
arg.setAttribute(u"name", u"props")
690
xmlstring = document.toxml(u"utf-8")
735
if (if_tag.getAttribute("name")
736
== "org.freedesktop.DBus.Properties"):
737
for cn in if_tag.getElementsByTagName("method"):
738
if cn.getAttribute("name") == "Get":
739
for arg in cn.getElementsByTagName("arg"):
740
if (arg.getAttribute("direction")
741
== "out"):
742
arg.setAttribute("name", "value")
743
elif cn.getAttribute("name") == "GetAll":
744
for arg in cn.getElementsByTagName("arg"):
745
if (arg.getAttribute("direction")
746
== "out"):
747
arg.setAttribute("name", "props")
748
xmlstring = document.toxml("utf-8")
691
749
document.unlink()
692
750
except (AttributeError, xml.dom.DOMException,
693
xml.parsers.expat.ExpatError), error:
694
logger.error(u"Failed to override Introspection method",
751
xml.parsers.expat.ExpatError) as error:
752
logger.error("Failed to override Introspection method",
695
753
error)
696
754
return xmlstring
697
755
698
756
757
def datetime_to_dbus (dt, variant_level=0):
758
"""Convert a UTC datetime.datetime() to a D-Bus type."""
759
if dt is None:
760
return dbus.String("", variant_level = variant_level)
761
return dbus.String(dt.isoformat(),
762
variant_level=variant_level)
763
764
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
765
.__metaclass__):
766
"""Applied to an empty subclass of a D-Bus object, this metaclass
767
will add additional D-Bus attributes matching a certain pattern.
768
"""
769
def __new__(mcs, name, bases, attr):
770
# Go through all the base classes which could have D-Bus
771
# methods, signals, or properties in them
772
for base in (b for b in bases
773
if issubclass(b, dbus.service.Object)):
774
# Go though all attributes of the base class
775
for attrname, attribute in inspect.getmembers(base):
776
# Ignore non-D-Bus attributes, and D-Bus attributes
777
# with the wrong interface name
778
if (not hasattr(attribute, "_dbus_interface")
779
or not attribute._dbus_interface
780
.startswith("se.recompile.Mandos")):
781
continue
782
# Create an alternate D-Bus interface name based on
783
# the current name
784
alt_interface = (attribute._dbus_interface
785
.replace("se.recompile.Mandos",
786
"se.bsnet.fukt.Mandos"))
787
# Is this a D-Bus signal?
788
if getattr(attribute, "_dbus_is_signal", False):
789
# Extract the original non-method function by
790
# black magic
791
nonmethod_func = (dict(
792
zip(attribute.func_code.co_freevars,
793
attribute.__closure__))["func"]
794
.cell_contents)
795
# Create a new, but exactly alike, function
796
# object, and decorate it to be a new D-Bus signal
797
# with the alternate D-Bus interface name
798
new_function = (dbus.service.signal
799
(alt_interface,
800
attribute._dbus_signature)
801
(types.FunctionType(
802
nonmethod_func.func_code,
803
nonmethod_func.func_globals,
804
nonmethod_func.func_name,
805
nonmethod_func.func_defaults,
806
nonmethod_func.func_closure)))
807
# Define a creator of a function to call both the
808
# old and new functions, so both the old and new
809
# signals gets sent when the function is called
810
def fixscope(func1, func2):
811
"""This function is a scope container to pass
812
func1 and func2 to the "call_both" function
813
outside of its arguments"""
814
def call_both(*args, **kwargs):
815
"""This function will emit two D-Bus
816
signals by calling func1 and func2"""
817
func1(*args, **kwargs)
818
func2(*args, **kwargs)
819
return call_both
820
# Create the "call_both" function and add it to
821
# the class
822
attr[attrname] = fixscope(attribute,
823
new_function)
824
# Is this a D-Bus method?
825
elif getattr(attribute, "_dbus_is_method", False):
826
# Create a new, but exactly alike, function
827
# object. Decorate it to be a new D-Bus method
828
# with the alternate D-Bus interface name. Add it
829
# to the class.
830
attr[attrname] = (dbus.service.method
831
(alt_interface,
832
attribute._dbus_in_signature,
833
attribute._dbus_out_signature)
834
(types.FunctionType
835
(attribute.func_code,
836
attribute.func_globals,
837
attribute.func_name,
838
attribute.func_defaults,
839
attribute.func_closure)))
840
# Is this a D-Bus property?
841
elif getattr(attribute, "_dbus_is_property", False):
842
# Create a new, but exactly alike, function
843
# object, and decorate it to be a new D-Bus
844
# property with the alternate D-Bus interface
845
# name. Add it to the class.
846
attr[attrname] = (dbus_service_property
847
(alt_interface,
848
attribute._dbus_signature,
849
attribute._dbus_access,
850
attribute
851
._dbus_get_args_options
852
["byte_arrays"])
853
(types.FunctionType
854
(attribute.func_code,
855
attribute.func_globals,
856
attribute.func_name,
857
attribute.func_defaults,
858
attribute.func_closure)))
859
return type.__new__(mcs, name, bases, attr)
860
699
861
class ClientDBus(Client, DBusObjectWithProperties):
700
862
"""A Client class using D-Bus
701
863
703
865
dbus_object_path: dbus.ObjectPath
704
866
bus: dbus.SystemBus()
705
867
"""
868
869
runtime_expansions = (Client.runtime_expansions
870
+ ("dbus_object_path",))
871
706
872
# dbus.service.Object doesn't use super(), so we can't either.
707
873
708
874
def __init__(self, bus = None, *args, **kwargs):
711
877
Client.__init__(self, *args, **kwargs)
712
878
# Only now, when this client is initialized, can it show up on
713
879
# the D-Bus
880
client_object_name = unicode(self.name).translate(
881
{ord("."): ord("_"),
882
ord("-"): ord("_")})
714
883
self.dbus_object_path = (dbus.ObjectPath
715
(u"/clients/"
716
+ self.name.replace(u".", u"_")))
884
("/clients/" + client_object_name))
717
885
DBusObjectWithProperties.__init__(self, self.bus,
718
886
self.dbus_object_path)
719
887
720
def _get_approvals_pending(self):
721
return self._approvals_pending
722
def _set_approvals_pending(self, value):
723
old_value = self._approvals_pending
724
self._approvals_pending = value
725
bval = bool(value)
726
if (hasattr(self, "dbus_object_path")
727
and bval is not bool(old_value)):
728
dbus_bool = dbus.Boolean(bval, variant_level=1)
729
self.PropertyChanged(dbus.String(u"ApprovalPending"),
730
dbus_bool)
888
def notifychangeproperty(transform_func,
889
dbus_name, type_func=lambda x: x,
890
variant_level=1):
891
""" Modify a variable so that it's a property which announces
892
its changes to DBus.
731
893
732
approvals_pending = property(_get_approvals_pending,
733
_set_approvals_pending)
734
del _get_approvals_pending, _set_approvals_pending
735
736
@staticmethod
737
def _datetime_to_dbus(dt, variant_level=0):
738
"""Convert a UTC datetime.datetime() to a D-Bus type."""
739
return dbus.String(dt.isoformat(),
740
variant_level=variant_level)
741
742
def enable(self):
743
oldstate = getattr(self, u"enabled", False)
744
r = Client.enable(self)
745
if oldstate != self.enabled:
746
# Emit D-Bus signals
747
self.PropertyChanged(dbus.String(u"Enabled"),
748
dbus.Boolean(True, variant_level=1))
749
self.PropertyChanged(
750
dbus.String(u"LastEnabled"),
751
self._datetime_to_dbus(self.last_enabled,
752
variant_level=1))
753
return r
754
755
def disable(self, quiet = False):
756
oldstate = getattr(self, u"enabled", False)
757
r = Client.disable(self, quiet=quiet)
758
if not quiet and oldstate != self.enabled:
759
# Emit D-Bus signal
760
self.PropertyChanged(dbus.String(u"Enabled"),
761
dbus.Boolean(False, variant_level=1))
762
return r
894
transform_fun: Function that takes a value and transforms it
895
to a D-Bus type.
896
dbus_name: D-Bus name of the variable
897
type_func: Function that transform the value before sending it
898
to the D-Bus. Default: no transform
899
variant_level: D-Bus variant level. Default: 1
900
"""
901
attrname = "_{0}".format(dbus_name)
902
def setter(self, value):
903
if hasattr(self, "dbus_object_path"):
904
if (not hasattr(self, attrname) or
905
type_func(getattr(self, attrname, None))
906
!= type_func(value)):
907
dbus_value = transform_func(type_func(value),
908
variant_level)
909
self.PropertyChanged(dbus.String(dbus_name),
910
dbus_value)
911
setattr(self, attrname, value)
912
913
return property(lambda self: getattr(self, attrname), setter)
914
915
916
expires = notifychangeproperty(datetime_to_dbus, "Expires")
917
approvals_pending = notifychangeproperty(dbus.Boolean,
918
"ApprovalPending",
919
type_func = bool)
920
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
921
last_enabled = notifychangeproperty(datetime_to_dbus,
922
"LastEnabled")
923
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
924
type_func = lambda checker:
925
checker is not None)
926
last_checked_ok = notifychangeproperty(datetime_to_dbus,
927
"LastCheckedOK")
928
last_approval_request = notifychangeproperty(
929
datetime_to_dbus, "LastApprovalRequest")
930
approved_by_default = notifychangeproperty(dbus.Boolean,
931
"ApprovedByDefault")
932
approval_delay = notifychangeproperty(dbus.UInt16,
933
"ApprovalDelay",
934
type_func =
935
_timedelta_to_milliseconds)
936
approval_duration = notifychangeproperty(
937
dbus.UInt16, "ApprovalDuration",
938
type_func = _timedelta_to_milliseconds)
939
host = notifychangeproperty(dbus.String, "Host")
940
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
941
type_func =
942
_timedelta_to_milliseconds)
943
extended_timeout = notifychangeproperty(
944
dbus.UInt16, "ExtendedTimeout",
945
type_func = _timedelta_to_milliseconds)
946
interval = notifychangeproperty(dbus.UInt16,
947
"Interval",
948
type_func =
949
_timedelta_to_milliseconds)
950
checker_command = notifychangeproperty(dbus.String, "Checker")
951
952
del notifychangeproperty
763
953
764
954
def __del__(self, *args, **kwargs):
765
955
try:
766
956
self.remove_from_connection()
767
957
except LookupError:
768
958
pass
769
if hasattr(DBusObjectWithProperties, u"__del__"):
959
if hasattr(DBusObjectWithProperties, "__del__"):
770
960
DBusObjectWithProperties.__del__(self, *args, **kwargs)
771
961
Client.__del__(self, *args, **kwargs)
772
962
774
964
*args, **kwargs):
775
965
self.checker_callback_tag = None
776
966
self.checker = None
777
# Emit D-Bus signal
778
self.PropertyChanged(dbus.String(u"CheckerRunning"),
779
dbus.Boolean(False, variant_level=1))
780
967
if os.WIFEXITED(condition):
781
968
exitstatus = os.WEXITSTATUS(condition)
782
969
# Emit D-Bus signal
792
979
return Client.checker_callback(self, pid, condition, command,
793
980
*args, **kwargs)
794
981
795
def checked_ok(self, *args, **kwargs):
796
r = Client.checked_ok(self, *args, **kwargs)
797
# Emit D-Bus signal
798
self.PropertyChanged(
799
dbus.String(u"LastCheckedOK"),
800
(self._datetime_to_dbus(self.last_checked_ok,
801
variant_level=1)))
802
return r
803
804
982
def start_checker(self, *args, **kwargs):
805
983
old_checker = self.checker
806
984
if self.checker is not None:
813
991
and old_checker_pid != self.checker.pid):
814
992
# Emit D-Bus signal
815
993
self.CheckerStarted(self.current_checker_command)
816
self.PropertyChanged(
817
dbus.String(u"CheckerRunning"),
818
dbus.Boolean(True, variant_level=1))
819
994
return r
820
995
821
def stop_checker(self, *args, **kwargs):
822
old_checker = getattr(self, u"checker", None)
823
r = Client.stop_checker(self, *args, **kwargs)
824
if (old_checker is not None
825
and getattr(self, u"checker", None) is None):
826
self.PropertyChanged(dbus.String(u"CheckerRunning"),
827
dbus.Boolean(False, variant_level=1))
828
return r
829
830
996
def _reset_approved(self):
831
997
self._approved = None
832
998
return False
834
1000
def approve(self, value=True):
835
1001
self.send_changedstate()
836
1002
self._approved = value
837
gobject.timeout_add(self._timedelta_to_milliseconds
1003
gobject.timeout_add(_timedelta_to_milliseconds
838
1004
(self.approval_duration),
839
1005
self._reset_approved)
840
1006
841
1007
842
1008
## D-Bus methods, signals & properties
843
_interface = u"se.bsnet.fukt.Mandos.Client"
1009
_interface = "se.recompile.Mandos.Client"
844
1010
845
1011
## Signals
846
1012
847
1013
# CheckerCompleted - signal
848
@dbus.service.signal(_interface, signature=u"nxs")
1014
@dbus.service.signal(_interface, signature="nxs")
849
1015
def CheckerCompleted(self, exitcode, waitstatus, command):
850
1016
"D-Bus signal"
851
1017
pass
852
1018
853
1019
# CheckerStarted - signal
854
@dbus.service.signal(_interface, signature=u"s")
1020
@dbus.service.signal(_interface, signature="s")
855
1021
def CheckerStarted(self, command):
856
1022
"D-Bus signal"
857
1023
pass
858
1024
859
1025
# PropertyChanged - signal
860
@dbus.service.signal(_interface, signature=u"sv")
1026
@dbus.service.signal(_interface, signature="sv")
861
1027
def PropertyChanged(self, property, value):
862
1028
"D-Bus signal"
863
1029
pass
872
1038
pass
873
1039
874
1040
# Rejected - signal
875
@dbus.service.signal(_interface, signature=u"s")
1041
@dbus.service.signal(_interface, signature="s")
876
1042
def Rejected(self, reason):
877
1043
"D-Bus signal"
878
1044
pass
879
1045
880
1046
# NeedApproval - signal
881
@dbus.service.signal(_interface, signature=u"tb")
1047
@dbus.service.signal(_interface, signature="tb")
882
1048
def NeedApproval(self, timeout, default):
883
1049
"D-Bus signal"
884
pass
1050
return self.need_approval()
885
1051
886
1052
## Methods
887
1053
888
1054
# Approve - method
889
@dbus.service.method(_interface, in_signature=u"b")
1055
@dbus.service.method(_interface, in_signature="b")
890
1056
def Approve(self, value):
891
1057
self.approve(value)
892
1058
893
1059
# CheckedOK - method
894
1060
@dbus.service.method(_interface)
895
1061
def CheckedOK(self):
896
return self.checked_ok()
1062
self.checked_ok()
897
1063
898
1064
# Enable - method
899
1065
@dbus.service.method(_interface)
921
1087
## Properties
922
1088
923
1089
# ApprovalPending - property
924
@dbus_service_property(_interface, signature=u"b", access=u"read")
1090
@dbus_service_property(_interface, signature="b", access="read")
925
1091
def ApprovalPending_dbus_property(self):
926
1092
return dbus.Boolean(bool(self.approvals_pending))
927
1093
928
1094
# ApprovedByDefault - property
929
@dbus_service_property(_interface, signature=u"b",
930
access=u"readwrite")
1095
@dbus_service_property(_interface, signature="b",
1096
access="readwrite")
931
1097
def ApprovedByDefault_dbus_property(self, value=None):
932
1098
if value is None: # get
933
1099
return dbus.Boolean(self.approved_by_default)
934
1100
self.approved_by_default = bool(value)
935
# Emit D-Bus signal
936
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
937
dbus.Boolean(value, variant_level=1))
938
1101
939
1102
# ApprovalDelay - property
940
@dbus_service_property(_interface, signature=u"t",
941
access=u"readwrite")
1103
@dbus_service_property(_interface, signature="t",
1104
access="readwrite")
942
1105
def ApprovalDelay_dbus_property(self, value=None):
943
1106
if value is None: # get
944
1107
return dbus.UInt64(self.approval_delay_milliseconds())
945
1108
self.approval_delay = datetime.timedelta(0, 0, 0, value)
946
# Emit D-Bus signal
947
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
948
dbus.UInt64(value, variant_level=1))
949
1109
950
1110
# ApprovalDuration - property
951
@dbus_service_property(_interface, signature=u"t",
952
access=u"readwrite")
1111
@dbus_service_property(_interface, signature="t",
1112
access="readwrite")
953
1113
def ApprovalDuration_dbus_property(self, value=None):
954
1114
if value is None: # get
955
return dbus.UInt64(self._timedelta_to_milliseconds(
1115
return dbus.UInt64(_timedelta_to_milliseconds(
956
1116
self.approval_duration))
957
1117
self.approval_duration = datetime.timedelta(0, 0, 0, value)
958
# Emit D-Bus signal
959
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
960
dbus.UInt64(value, variant_level=1))
961
1118
962
1119
# Name - property
963
@dbus_service_property(_interface, signature=u"s", access=u"read")
1120
@dbus_service_property(_interface, signature="s", access="read")
964
1121
def Name_dbus_property(self):
965
1122
return dbus.String(self.name)
966
1123
967
1124
# Fingerprint - property
968
@dbus_service_property(_interface, signature=u"s", access=u"read")
1125
@dbus_service_property(_interface, signature="s", access="read")
969
1126
def Fingerprint_dbus_property(self):
970
1127
return dbus.String(self.fingerprint)
971
1128
972
1129
# Host - property
973
@dbus_service_property(_interface, signature=u"s",
974
access=u"readwrite")
1130
@dbus_service_property(_interface, signature="s",
1131
access="readwrite")
975
1132
def Host_dbus_property(self, value=None):
976
1133
if value is None: # get
977
1134
return dbus.String(self.host)
978
1135
self.host = value
979
# Emit D-Bus signal
980
self.PropertyChanged(dbus.String(u"Host"),
981
dbus.String(value, variant_level=1))
982
1136
983
1137
# Created - property
984
@dbus_service_property(_interface, signature=u"s", access=u"read")
1138
@dbus_service_property(_interface, signature="s", access="read")
985
1139
def Created_dbus_property(self):
986
return dbus.String(self._datetime_to_dbus(self.created))
1140
return dbus.String(datetime_to_dbus(self.created))
987
1141
988
1142
# LastEnabled - property
989
@dbus_service_property(_interface, signature=u"s", access=u"read")
1143
@dbus_service_property(_interface, signature="s", access="read")
990
1144
def LastEnabled_dbus_property(self):
991
if self.last_enabled is None:
992
return dbus.String(u"")
993
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1145
return datetime_to_dbus(self.last_enabled)
994
1146
995
1147
# Enabled - property
996
@dbus_service_property(_interface, signature=u"b",
997
access=u"readwrite")
1148
@dbus_service_property(_interface, signature="b",
1149
access="readwrite")
998
1150
def Enabled_dbus_property(self, value=None):
999
1151
if value is None: # get
1000
1152
return dbus.Boolean(self.enabled)
1004
1156
self.disable()
1005
1157
1006
1158
# LastCheckedOK - property
1007
@dbus_service_property(_interface, signature=u"s",
1008
access=u"readwrite")
1159
@dbus_service_property(_interface, signature="s",
1160
access="readwrite")
1009
1161
def LastCheckedOK_dbus_property(self, value=None):
1010
1162
if value is not None:
1011
1163
self.checked_ok()
1012
1164
return
1013
if self.last_checked_ok is None:
1014
return dbus.String(u"")
1015
return dbus.String(self._datetime_to_dbus(self
1016
.last_checked_ok))
1165
return datetime_to_dbus(self.last_checked_ok)
1166
1167
# Expires - property
1168
@dbus_service_property(_interface, signature="s", access="read")
1169
def Expires_dbus_property(self):
1170
return datetime_to_dbus(self.expires)
1171
1172
# LastApprovalRequest - property
1173
@dbus_service_property(_interface, signature="s", access="read")
1174
def LastApprovalRequest_dbus_property(self):
1175
return datetime_to_dbus(self.last_approval_request)
1017
1176
1018
1177
# Timeout - property
1019
@dbus_service_property(_interface, signature=u"t",
1020
access=u"readwrite")
1178
@dbus_service_property(_interface, signature="t",
1179
access="readwrite")
1021
1180
def Timeout_dbus_property(self, value=None):
1022
1181
if value is None: # get
1023
1182
return dbus.UInt64(self.timeout_milliseconds())
1024
1183
self.timeout = datetime.timedelta(0, 0, 0, value)
1025
# Emit D-Bus signal
1026
self.PropertyChanged(dbus.String(u"Timeout"),
1027
dbus.UInt64(value, variant_level=1))
1028
if getattr(self, u"disable_initiator_tag", None) is None:
1184
if getattr(self, "disable_initiator_tag", None) is None:
1029
1185
return
1030
1186
# Reschedule timeout
1031
1187
gobject.source_remove(self.disable_initiator_tag)
1032
1188
self.disable_initiator_tag = None
1189
self.expires = None
1033
1190
time_to_die = (self.
1034
1191
_timedelta_to_milliseconds((self
1035
1192
.last_checked_ok
1040
1197
# The timeout has passed
1041
1198
self.disable()
1042
1199
else:
1200
self.expires = (datetime.datetime.utcnow()
1201
+ datetime.timedelta(milliseconds =
1202
time_to_die))
1043
1203
self.disable_initiator_tag = (gobject.timeout_add
1044
1204
(time_to_die, self.disable))
1045
1205
1206
# ExtendedTimeout - property
1207
@dbus_service_property(_interface, signature="t",
1208
access="readwrite")
1209
def ExtendedTimeout_dbus_property(self, value=None):
1210
if value is None: # get
1211
return dbus.UInt64(self.extended_timeout_milliseconds())
1212
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1213
1046
1214
# Interval - property
1047
@dbus_service_property(_interface, signature=u"t",
1048
access=u"readwrite")
1215
@dbus_service_property(_interface, signature="t",
1216
access="readwrite")
1049
1217
def Interval_dbus_property(self, value=None):
1050
1218
if value is None: # get
1051
1219
return dbus.UInt64(self.interval_milliseconds())
1052
1220
self.interval = datetime.timedelta(0, 0, 0, value)
1053
# Emit D-Bus signal
1054
self.PropertyChanged(dbus.String(u"Interval"),
1055
dbus.UInt64(value, variant_level=1))
1056
if getattr(self, u"checker_initiator_tag", None) is None:
1221
if getattr(self, "checker_initiator_tag", None) is None:
1057
1222
return
1058
1223
# Reschedule checker run
1059
1224
gobject.source_remove(self.checker_initiator_tag)
1060
1225
self.checker_initiator_tag = (gobject.timeout_add
1061
1226
(value, self.start_checker))
1062
1227
self.start_checker() # Start one now, too
1063
1228
1064
1229
# Checker - property
1065
@dbus_service_property(_interface, signature=u"s",
1066
access=u"readwrite")
1230
@dbus_service_property(_interface, signature="s",
1231
access="readwrite")
1067
1232
def Checker_dbus_property(self, value=None):
1068
1233
if value is None: # get
1069
1234
return dbus.String(self.checker_command)
1070
1235
self.checker_command = value
1071
# Emit D-Bus signal
1072
self.PropertyChanged(dbus.String(u"Checker"),
1073
dbus.String(self.checker_command,
1074
variant_level=1))
1075
1236
1076
1237
# CheckerRunning - property
1077
@dbus_service_property(_interface, signature=u"b",
1078
access=u"readwrite")
1238
@dbus_service_property(_interface, signature="b",
1239
access="readwrite")
1079
1240
def CheckerRunning_dbus_property(self, value=None):
1080
1241
if value is None: # get
1081
1242
return dbus.Boolean(self.checker is not None)
1085
1246
self.stop_checker()
1086
1247
1087
1248
# ObjectPath - property
1088
@dbus_service_property(_interface, signature=u"o", access=u"read")
1249
@dbus_service_property(_interface, signature="o", access="read")
1089
1250
def ObjectPath_dbus_property(self):
1090
1251
return self.dbus_object_path # is already a dbus.ObjectPath
1091
1252
1092
1253
# Secret = property
1093
@dbus_service_property(_interface, signature=u"ay",
1094
access=u"write", byte_arrays=True)
1254
@dbus_service_property(_interface, signature="ay",
1255
access="write", byte_arrays=True)
1095
1256
def Secret_dbus_property(self, value):
1096
1257
self.secret = str(value)
1097
1258
1104
1265
self._pipe.send(('init', fpr, address))
1105
1266
if not self._pipe.recv():
1106
1267
raise KeyError()
1107
1268
1108
1269
def __getattribute__(self, name):
1109
1270
if(name == '_pipe'):
1110
1271
return super(ProxyClient, self).__getattribute__(name)
1117
1278
self._pipe.send(('funcall', name, args, kwargs))
1118
1279
return self._pipe.recv()[1]
1119
1280
return func
1120
1281
1121
1282
def __setattr__(self, name, value):
1122
1283
if(name == '_pipe'):
1123
1284
return super(ProxyClient, self).__setattr__(name, value)
1124
1285
self._pipe.send(('setattr', name, value))
1125
1286
1287
class ClientDBusTransitional(ClientDBus):
1288
__metaclass__ = AlternateDBusNamesMetaclass
1126
1289
1127
1290
class ClientHandler(socketserver.BaseRequestHandler, object):
1128
1291
"""A class to handle client connections.
1132
1295
1133
1296
def handle(self):
1134
1297
with contextlib.closing(self.server.child_pipe) as child_pipe:
1135
logger.info(u"TCP connection from: %s",
1298
logger.info("TCP connection from: %s",
1136
1299
unicode(self.client_address))
1137
logger.debug(u"Pipe FD: %d",
1300
logger.debug("Pipe FD: %d",
1138
1301
self.server.child_pipe.fileno())
1139
1302
1140
1303
session = (gnutls.connection
1141
1304
.ClientSession(self.request,
1142
1305
gnutls.connection
1143
1306
.X509Credentials()))
1144
1307
1145
1308
# Note: gnutls.connection.X509Credentials is really a
1146
1309
# generic GnuTLS certificate credentials object so long as
1147
1310
# no X.509 keys are added to it. Therefore, we can use it
1148
1311
# here despite using OpenPGP certificates.
1149
1150
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1151
# u"+AES-256-CBC", u"+SHA1",
1152
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1153
# u"+DHE-DSS"))
1312
1313
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1314
# "+AES-256-CBC", "+SHA1",
1315
# "+COMP-NULL", "+CTYPE-OPENPGP",
1316
# "+DHE-DSS"))
1154
1317
# Use a fallback default, since this MUST be set.
1155
1318
priority = self.server.gnutls_priority
1156
1319
if priority is None:
1157
priority = u"NORMAL"
1320
priority = "NORMAL"
1158
1321
(gnutls.library.functions
1159
1322
.gnutls_priority_set_direct(session._c_object,
1160
1323
priority, None))
1161
1324
1162
1325
# Start communication using the Mandos protocol
1163
1326
# Get protocol number
1164
1327
line = self.request.makefile().readline()
1165
logger.debug(u"Protocol version: %r", line)
1328
logger.debug("Protocol version: %r", line)
1166
1329
try:
1167
1330
if int(line.strip().split()[0]) > 1:
1168
1331
raise RuntimeError
1169
except (ValueError, IndexError, RuntimeError), error:
1170
logger.error(u"Unknown protocol version: %s", error)
1332
except (ValueError, IndexError, RuntimeError) as error:
1333
logger.error("Unknown protocol version: %s", error)
1171
1334
return
1172
1335
1173
1336
# Start GnuTLS connection
1174
1337
try:
1175
1338
session.handshake()
1176
except gnutls.errors.GNUTLSError, error:
1177
logger.warning(u"Handshake failed: %s", error)
1339
except gnutls.errors.GNUTLSError as error:
1340
logger.warning("Handshake failed: %s", error)
1178
1341
# Do not run session.bye() here: the session is not
1179
1342
# established. Just abandon the request.
1180
1343
return
1181
logger.debug(u"Handshake succeeded")
1182
1344
logger.debug("Handshake succeeded")
1345
1183
1346
approval_required = False
1184
1347
try:
1185
1348
try:
1186
1349
fpr = self.fingerprint(self.peer_certificate
1187
1350
(session))
1188
except (TypeError, gnutls.errors.GNUTLSError), error:
1189
logger.warning(u"Bad certificate: %s", error)
1351
except (TypeError,
1352
gnutls.errors.GNUTLSError) as error:
1353
logger.warning("Bad certificate: %s", error)
1190
1354
return
1191
logger.debug(u"Fingerprint: %s", fpr)
1192
1355
logger.debug("Fingerprint: %s", fpr)
1356
1193
1357
try:
1194
1358
client = ProxyClient(child_pipe, fpr,
1195
1359
self.client_address)
1203
1367
1204
1368
while True:
1205
1369
if not client.enabled:
1206
logger.warning(u"Client %s is disabled",
1370
logger.info("Client %s is disabled",
1207
1371
client.name)
1208
1372
if self.server.use_dbus:
1209
1373
# Emit D-Bus signal
1210
client.Rejected("Disabled")
1374
client.Rejected("Disabled")
1211
1375
return
1212
1376
1213
1377
if client._approved or not client.approval_delay:
1214
1378
#We are approved or approval is disabled
1215
1379
break
1216
1380
elif client._approved is None:
1217
logger.info(u"Client %s needs approval",
1381
logger.info("Client %s needs approval",
1218
1382
client.name)
1219
1383
if self.server.use_dbus:
1220
1384
# Emit D-Bus signal
1222
1386
client.approval_delay_milliseconds(),
1223
1387
client.approved_by_default)
1224
1388
else:
1225
logger.warning(u"Client %s was not approved",
1389
logger.warning("Client %s was not approved",
1226
1390
client.name)
1227
1391
if self.server.use_dbus:
1228
1392
# Emit D-Bus signal
1230
1394
return
1231
1395
1232
1396
#wait until timeout or approved
1233
#x = float(client._timedelta_to_milliseconds(delay))
1234
1397
time = datetime.datetime.now()
1235
1398
client.changedstate.acquire()
1236
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1399
(client.changedstate.wait
1400
(float(client._timedelta_to_milliseconds(delay)
1401
/ 1000)))
1237
1402
client.changedstate.release()
1238
1403
time2 = datetime.datetime.now()
1239
1404
if (time2 - time) >= delay:
1254
1419
while sent_size < len(client.secret):
1255
1420
try:
1256
1421
sent = session.send(client.secret[sent_size:])
1257
except (gnutls.errors.GNUTLSError), error:
1422
except gnutls.errors.GNUTLSError as error:
1258
1423
logger.warning("gnutls send failed")
1259
1424
return
1260
logger.debug(u"Sent: %d, remaining: %d",
1425
logger.debug("Sent: %d, remaining: %d",
1261
1426
sent, len(client.secret)
1262
1427
- (sent_size + sent))
1263
1428
sent_size += sent
1264
1265
logger.info(u"Sending secret to %s", client.name)
1429
1430
logger.info("Sending secret to %s", client.name)
1266
1431
# bump the timeout as if seen
1267
client.checked_ok()
1432
client.checked_ok(client.extended_timeout)
1268
1433
if self.server.use_dbus:
1269
1434
# Emit D-Bus signal
1270
1435
client.GotSecret()
1274
1439
client.approvals_pending -= 1
1275
1440
try:
1276
1441
session.bye()
1277
except (gnutls.errors.GNUTLSError), error:
1442
except gnutls.errors.GNUTLSError as error:
1278
1443
logger.warning("GnuTLS bye failed")
1279
1444
1280
1445
@staticmethod
1291
1456
.gnutls_certificate_get_peers
1292
1457
(session._c_object, ctypes.byref(list_size)))
1293
1458
if not bool(cert_list) and list_size.value != 0:
1294
raise gnutls.errors.GNUTLSError(u"error getting peer"
1295
u" certificate")
1459
raise gnutls.errors.GNUTLSError("error getting peer"
1460
" certificate")
1296
1461
if list_size.value == 0:
1297
1462
return None
1298
1463
cert = cert_list[0]
1324
1489
if crtverify.value != 0:
1325
1490
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1326
1491
raise (gnutls.errors.CertificateSecurityError
1327
(u"Verify failed"))
1492
("Verify failed"))
1328
1493
# New buffer for the fingerprint
1329
1494
buf = ctypes.create_string_buffer(20)
1330
1495
buf_len = ctypes.c_size_t()
1337
1502
# Convert the buffer to a Python bytestring
1338
1503
fpr = ctypes.string_at(buf, buf_len.value)
1339
1504
# Convert the bytestring to hexadecimal notation
1340
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1505
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1341
1506
return hex_fpr
1342
1507
1343
1508
1349
1514
except:
1350
1515
self.handle_error(request, address)
1351
1516
self.close_request(request)
1352
1517
1353
1518
def process_request(self, request, address):
1354
1519
"""Start a new process to process the request."""
1355
multiprocessing.Process(target = self.sub_process_main,
1356
args = (request, address)).start()
1520
proc = multiprocessing.Process(target = self.sub_process_main,
1521
args = (request,
1522
address))
1523
proc.start()
1524
return proc
1525
1357
1526
1358
1527
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1359
1528
""" adds a pipe to the MixIn """
1363
1532
This function creates a new pipe in self.pipe
1364
1533
"""
1365
1534
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1366
1367
super(MultiprocessingMixInWithPipe,
1368
self).process_request(request, client_address)
1535
1536
proc = MultiprocessingMixIn.process_request(self, request,
1537
client_address)
1369
1538
self.child_pipe.close()
1370
self.add_pipe(parent_pipe)
1371
1372
def add_pipe(self, parent_pipe):
1539
self.add_pipe(parent_pipe, proc)
1540
1541
def add_pipe(self, parent_pipe, proc):
1373
1542
"""Dummy function; override as necessary"""
1374
pass
1543
raise NotImplementedError
1544
1375
1545
1376
1546
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1377
1547
socketserver.TCPServer, object):
1395
1565
bind to an address or port if they were not specified."""
1396
1566
if self.interface is not None:
1397
1567
if SO_BINDTODEVICE is None:
1398
logger.error(u"SO_BINDTODEVICE does not exist;"
1399
u" cannot bind to interface %s",
1568
logger.error("SO_BINDTODEVICE does not exist;"
1569
" cannot bind to interface %s",
1400
1570
self.interface)
1401
1571
else:
1402
1572
try:
1403
1573
self.socket.setsockopt(socket.SOL_SOCKET,
1404
1574
SO_BINDTODEVICE,
1405
1575
str(self.interface
1406
+ u'\0'))
1407
except socket.error, error:
1576
+ '\0'))
1577
except socket.error as error:
1408
1578
if error[0] == errno.EPERM:
1409
logger.error(u"No permission to"
1410
u" bind to interface %s",
1579
logger.error("No permission to"
1580
" bind to interface %s",
1411
1581
self.interface)
1412
1582
elif error[0] == errno.ENOPROTOOPT:
1413
logger.error(u"SO_BINDTODEVICE not available;"
1414
u" cannot bind to interface %s",
1583
logger.error("SO_BINDTODEVICE not available;"
1584
" cannot bind to interface %s",
1415
1585
self.interface)
1416
1586
else:
1417
1587
raise
1419
1589
if self.server_address[0] or self.server_address[1]:
1420
1590
if not self.server_address[0]:
1421
1591
if self.address_family == socket.AF_INET6:
1422
any_address = u"::" # in6addr_any
1592
any_address = "::" # in6addr_any
1423
1593
else:
1424
1594
any_address = socket.INADDR_ANY
1425
1595
self.server_address = (any_address,
1462
1632
def server_activate(self):
1463
1633
if self.enabled:
1464
1634
return socketserver.TCPServer.server_activate(self)
1635
1465
1636
def enable(self):
1466
1637
self.enabled = True
1467
def add_pipe(self, parent_pipe):
1638
1639
def add_pipe(self, parent_pipe, proc):
1468
1640
# Call "handle_ipc" for both data and EOF events
1469
1641
gobject.io_add_watch(parent_pipe.fileno(),
1470
1642
gobject.IO_IN | gobject.IO_HUP,
1471
1643
functools.partial(self.handle_ipc,
1472
parent_pipe = parent_pipe))
1473
1644
parent_pipe =
1645
parent_pipe,
1646
proc = proc))
1647
1474
1648
def handle_ipc(self, source, condition, parent_pipe=None,
1475
client_object=None):
1649
proc = None, client_object=None):
1476
1650
condition_names = {
1477
gobject.IO_IN: u"IN", # There is data to read.
1478
gobject.IO_OUT: u"OUT", # Data can be written (without
1651
gobject.IO_IN: "IN", # There is data to read.
1652
gobject.IO_OUT: "OUT", # Data can be written (without
1479
1653
# blocking).
1480
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1481
gobject.IO_ERR: u"ERR", # Error condition.
1482
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1654
gobject.IO_PRI: "PRI", # There is urgent data to read.
1655
gobject.IO_ERR: "ERR", # Error condition.
1656
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1483
1657
# broken, usually for pipes and
1484
1658
# sockets).
1485
1659
}
1489
1663
if cond & condition)
1490
1664
# error or the other end of multiprocessing.Pipe has closed
1491
1665
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1666
proc.join()
1492
1667
return False
1493
1668
1494
1669
# Read a request from the child
1504
1679
client = c
1505
1680
break
1506
1681
else:
1507
logger.warning(u"Client not found for fingerprint: %s, ad"
1508
u"dress: %s", fpr, address)
1682
logger.info("Client not found for fingerprint: %s, ad"
1683
"dress: %s", fpr, address)
1509
1684
if self.use_dbus:
1510
1685
# Emit D-Bus signal
1511
mandos_dbus_service.ClientNotFound(fpr, address)
1686
mandos_dbus_service.ClientNotFound(fpr,
1687
address[0])
1512
1688
parent_pipe.send(False)
1513
1689
return False
1514
1690
1515
1691
gobject.io_add_watch(parent_pipe.fileno(),
1516
1692
gobject.IO_IN | gobject.IO_HUP,
1517
1693
functools.partial(self.handle_ipc,
1518
parent_pipe = parent_pipe,
1519
client_object = client))
1694
parent_pipe =
1695
parent_pipe,
1696
proc = proc,
1697
client_object =
1698
client))
1520
1699
parent_pipe.send(True)
1521
# remove the old hook in favor of the new above hook on same fileno
1700
# remove the old hook in favor of the new above hook on
1701
# same fileno
1522
1702
return False
1523
1703
if command == 'funcall':
1524
1704
funcname = request[1]
1525
1705
args = request[2]
1526
1706
kwargs = request[3]
1527
1707
1528
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1529
1708
parent_pipe.send(('data', getattr(client_object,
1709
funcname)(*args,
1710
**kwargs)))
1711
1530
1712
if command == 'getattr':
1531
1713
attrname = request[1]
1532
1714
if callable(client_object.__getattribute__(attrname)):
1533
1715
parent_pipe.send(('function',))
1534
1716
else:
1535
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1717
parent_pipe.send(('data', client_object
1718
.__getattribute__(attrname)))
1536
1719
1537
1720
if command == 'setattr':
1538
1721
attrname = request[1]
1539
1722
value = request[2]
1540
1723
setattr(client_object, attrname, value)
1541
1724
1542
1725
return True
1543
1726
1544
1727
1545
1728
def string_to_delta(interval):
1546
1729
"""Parse a string and return a datetime.timedelta
1547
1730
1548
>>> string_to_delta(u'7d')
1731
>>> string_to_delta('7d')
1549
1732
datetime.timedelta(7)
1550
>>> string_to_delta(u'60s')
1733
>>> string_to_delta('60s')
1551
1734
datetime.timedelta(0, 60)
1552
>>> string_to_delta(u'60m')
1735
>>> string_to_delta('60m')
1553
1736
datetime.timedelta(0, 3600)
1554
>>> string_to_delta(u'24h')
1737
>>> string_to_delta('24h')
1555
1738
datetime.timedelta(1)
1556
>>> string_to_delta(u'1w')
1739
>>> string_to_delta('1w')
1557
1740
datetime.timedelta(7)
1558
>>> string_to_delta(u'5m 30s')
1741
>>> string_to_delta('5m 30s')
1559
1742
datetime.timedelta(0, 330)
1560
1743
"""
1561
1744
timevalue = datetime.timedelta(0)
1563
1746
try:
1564
1747
suffix = unicode(s[-1])
1565
1748
value = int(s[:-1])
1566
if suffix == u"d":
1749
if suffix == "d":
1567
1750
delta = datetime.timedelta(value)
1568
elif suffix == u"s":
1751
elif suffix == "s":
1569
1752
delta = datetime.timedelta(0, value)
1570
elif suffix == u"m":
1753
elif suffix == "m":
1571
1754
delta = datetime.timedelta(0, 0, 0, 0, value)
1572
elif suffix == u"h":
1755
elif suffix == "h":
1573
1756
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1574
elif suffix == u"w":
1757
elif suffix == "w":
1575
1758
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1576
1759
else:
1577
raise ValueError(u"Unknown suffix %r" % suffix)
1578
except (ValueError, IndexError), e:
1579
raise ValueError(e.message)
1760
raise ValueError("Unknown suffix %r" % suffix)
1761
except (ValueError, IndexError) as e:
1762
raise ValueError(*(e.args))
1580
1763
timevalue += delta
1581
1764
return timevalue
1582
1765
1588
1771
global if_nametoindex
1589
1772
try:
1590
1773
if_nametoindex = (ctypes.cdll.LoadLibrary
1591
(ctypes.util.find_library(u"c"))
1774
(ctypes.util.find_library("c"))
1592
1775
.if_nametoindex)
1593
1776
except (OSError, AttributeError):
1594
logger.warning(u"Doing if_nametoindex the hard way")
1777
logger.warning("Doing if_nametoindex the hard way")
1595
1778
def if_nametoindex(interface):
1596
1779
"Get an interface index the hard way, i.e. using fcntl()"
1597
1780
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1598
1781
with contextlib.closing(socket.socket()) as s:
1599
1782
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1600
struct.pack(str(u"16s16x"),
1783
struct.pack(str("16s16x"),
1601
1784
interface))
1602
interface_index = struct.unpack(str(u"I"),
1785
interface_index = struct.unpack(str("I"),
1603
1786
ifreq[16:20])[0]
1604
1787
return interface_index
1605
1788
return if_nametoindex(interface)
1613
1796
sys.exit()
1614
1797
os.setsid()
1615
1798
if not nochdir:
1616
os.chdir(u"/")
1799
os.chdir("/")
1617
1800
if os.fork():
1618
1801
sys.exit()
1619
1802
if not noclose:
1621
1804
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1622
1805
if not stat.S_ISCHR(os.fstat(null).st_mode):
1623
1806
raise OSError(errno.ENODEV,
1624
u"%s not a character device"
1807
"%s not a character device"
1625
1808
% os.path.devnull)
1626
1809
os.dup2(null, sys.stdin.fileno())
1627
1810
os.dup2(null, sys.stdout.fileno())
1635
1818
##################################################################
1636
1819
# Parsing of options, both command line and config file
1637
1820
1638
parser = optparse.OptionParser(version = "%%prog %s" % version)
1639
parser.add_option("-i", u"--interface", type=u"string",
1640
metavar="IF", help=u"Bind to interface IF")
1641
parser.add_option("-a", u"--address", type=u"string",
1642
help=u"Address to listen for requests on")
1643
parser.add_option("-p", u"--port", type=u"int",
1644
help=u"Port number to receive requests on")
1645
parser.add_option("--check", action=u"store_true",
1646
help=u"Run self-test")
1647
parser.add_option("--debug", action=u"store_true",
1648
help=u"Debug mode; run in foreground and log to"
1649
u" terminal")
1650
parser.add_option("--debuglevel", type=u"string", metavar="Level",
1651
help=u"Debug level for stdout output")
1652
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1653
u" priority string (see GnuTLS documentation)")
1654
parser.add_option("--servicename", type=u"string",
1655
metavar=u"NAME", help=u"Zeroconf service name")
1656
parser.add_option("--configdir", type=u"string",
1657
default=u"/etc/mandos", metavar=u"DIR",
1658
help=u"Directory to search for configuration"
1659
u" files")
1660
parser.add_option("--no-dbus", action=u"store_false",
1661
dest=u"use_dbus", help=u"Do not provide D-Bus"
1662
u" system bus interface")
1663
parser.add_option("--no-ipv6", action=u"store_false",
1664
dest=u"use_ipv6", help=u"Do not use IPv6")
1665
options = parser.parse_args()[0]
1821
parser = argparse.ArgumentParser()
1822
parser.add_argument("-v", "--version", action="version",
1823
version = "%%(prog)s %s" % version,
1824
help="show version number and exit")
1825
parser.add_argument("-i", "--interface", metavar="IF",
1826
help="Bind to interface IF")
1827
parser.add_argument("-a", "--address",
1828
help="Address to listen for requests on")
1829
parser.add_argument("-p", "--port", type=int,
1830
help="Port number to receive requests on")
1831
parser.add_argument("--check", action="store_true",
1832
help="Run self-test")
1833
parser.add_argument("--debug", action="store_true",
1834
help="Debug mode; run in foreground and log"
1835
" to terminal")
1836
parser.add_argument("--debuglevel", metavar="LEVEL",
1837
help="Debug level for stdout output")
1838
parser.add_argument("--priority", help="GnuTLS"
1839
" priority string (see GnuTLS documentation)")
1840
parser.add_argument("--servicename",
1841
metavar="NAME", help="Zeroconf service name")
1842
parser.add_argument("--configdir",
1843
default="/etc/mandos", metavar="DIR",
1844
help="Directory to search for configuration"
1845
" files")
1846
parser.add_argument("--no-dbus", action="store_false",
1847
dest="use_dbus", help="Do not provide D-Bus"
1848
" system bus interface")
1849
parser.add_argument("--no-ipv6", action="store_false",
1850
dest="use_ipv6", help="Do not use IPv6")
1851
options = parser.parse_args()
1666
1852
1667
1853
if options.check:
1668
1854
import doctest
1670
1856
sys.exit()
1671
1857
1672
1858
# Default values for config file for server-global settings
1673
server_defaults = { u"interface": u"",
1674
u"address": u"",
1675
u"port": u"",
1676
u"debug": u"False",
1677
u"priority":
1678
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1679
u"servicename": u"Mandos",
1680
u"use_dbus": u"True",
1681
u"use_ipv6": u"True",
1682
u"debuglevel": u"",
1859
server_defaults = { "interface": "",
1860
"address": "",
1861
"port": "",
1862
"debug": "False",
1863
"priority":
1864
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1865
"servicename": "Mandos",
1866
"use_dbus": "True",
1867
"use_ipv6": "True",
1868
"debuglevel": "",
1683
1869
}
1684
1870
1685
1871
# Parse config file for server-global settings
1686
1872
server_config = configparser.SafeConfigParser(server_defaults)
1687
1873
del server_defaults
1688
1874
server_config.read(os.path.join(options.configdir,
1689
u"mandos.conf"))
1875
"mandos.conf"))
1690
1876
# Convert the SafeConfigParser object to a dict
1691
1877
server_settings = server_config.defaults()
1692
1878
# Use the appropriate methods on the non-string config options
1693
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1694
server_settings[option] = server_config.getboolean(u"DEFAULT",
1879
for option in ("debug", "use_dbus", "use_ipv6"):
1880
server_settings[option] = server_config.getboolean("DEFAULT",
1695
1881
option)
1696
1882
if server_settings["port"]:
1697
server_settings["port"] = server_config.getint(u"DEFAULT",
1698
u"port")
1883
server_settings["port"] = server_config.getint("DEFAULT",
1884
"port")
1699
1885
del server_config
1700
1886
1701
1887
# Override the settings from the config file with command line
1702
1888
# options, if set.
1703
for option in (u"interface", u"address", u"port", u"debug",
1704
u"priority", u"servicename", u"configdir",
1705
u"use_dbus", u"use_ipv6", u"debuglevel"):
1889
for option in ("interface", "address", "port", "debug",
1890
"priority", "servicename", "configdir",
1891
"use_dbus", "use_ipv6", "debuglevel"):
1706
1892
value = getattr(options, option)
1707
1893
if value is not None:
1708
1894
server_settings[option] = value
1716
1902
##################################################################
1717
1903
1718
1904
# For convenience
1719
debug = server_settings[u"debug"]
1720
debuglevel = server_settings[u"debuglevel"]
1721
use_dbus = server_settings[u"use_dbus"]
1722
use_ipv6 = server_settings[u"use_ipv6"]
1723
1724
if server_settings[u"servicename"] != u"Mandos":
1905
debug = server_settings["debug"]
1906
debuglevel = server_settings["debuglevel"]
1907
use_dbus = server_settings["use_dbus"]
1908
use_ipv6 = server_settings["use_ipv6"]
1909
1910
if server_settings["servicename"] != "Mandos":
1725
1911
syslogger.setFormatter(logging.Formatter
1726
(u'Mandos (%s) [%%(process)d]:'
1727
u' %%(levelname)s: %%(message)s'
1728
% server_settings[u"servicename"]))
1912
('Mandos (%s) [%%(process)d]:'
1913
' %%(levelname)s: %%(message)s'
1914
% server_settings["servicename"]))
1729
1915
1730
1916
# Parse config file with clients
1731
client_defaults = { u"timeout": u"1h",
1732
u"interval": u"5m",
1733
u"checker": u"fping -q -- %%(host)s",
1734
u"host": u"",
1735
u"approval_delay": u"0s",
1736
u"approval_duration": u"1s",
1917
client_defaults = { "timeout": "5m",
1918
"extended_timeout": "15m",
1919
"interval": "2m",
1920
"checker": "fping -q -- %%(host)s",
1921
"host": "",
1922
"approval_delay": "0s",
1923
"approval_duration": "1s",
1737
1924
}
1738
1925
client_config = configparser.SafeConfigParser(client_defaults)
1739
client_config.read(os.path.join(server_settings[u"configdir"],
1740
u"clients.conf"))
1926
client_config.read(os.path.join(server_settings["configdir"],
1927
"clients.conf"))
1741
1928
1742
1929
global mandos_dbus_service
1743
1930
mandos_dbus_service = None
1744
1931
1745
tcp_server = MandosServer((server_settings[u"address"],
1746
server_settings[u"port"]),
1932
tcp_server = MandosServer((server_settings["address"],
1933
server_settings["port"]),
1747
1934
ClientHandler,
1748
interface=(server_settings[u"interface"]
1935
interface=(server_settings["interface"]
1749
1936
or None),
1750
1937
use_ipv6=use_ipv6,
1751
1938
gnutls_priority=
1752
server_settings[u"priority"],
1939
server_settings["priority"],
1753
1940
use_dbus=use_dbus)
1754
pidfilename = u"/var/run/mandos.pid"
1755
try:
1756
pidfile = open(pidfilename, u"w")
1757
except IOError:
1758
logger.error(u"Could not open file %r", pidfilename)
1941
if not debug:
1942
pidfilename = "/var/run/mandos.pid"
1943
try:
1944
pidfile = open(pidfilename, "w")
1945
except IOError:
1946
logger.error("Could not open file %r", pidfilename)
1759
1947
1760
1948
try:
1761
uid = pwd.getpwnam(u"_mandos").pw_uid
1762
gid = pwd.getpwnam(u"_mandos").pw_gid
1949
uid = pwd.getpwnam("_mandos").pw_uid
1950
gid = pwd.getpwnam("_mandos").pw_gid
1763
1951
except KeyError:
1764
1952
try:
1765
uid = pwd.getpwnam(u"mandos").pw_uid
1766
gid = pwd.getpwnam(u"mandos").pw_gid
1953
uid = pwd.getpwnam("mandos").pw_uid
1954
gid = pwd.getpwnam("mandos").pw_gid
1767
1955
except KeyError:
1768
1956
try:
1769
uid = pwd.getpwnam(u"nobody").pw_uid
1770
gid = pwd.getpwnam(u"nobody").pw_gid
1957
uid = pwd.getpwnam("nobody").pw_uid
1958
gid = pwd.getpwnam("nobody").pw_gid
1771
1959
except KeyError:
1772
1960
uid = 65534
1773
1961
gid = 65534
1774
1962
try:
1775
1963
os.setgid(gid)
1776
1964
os.setuid(uid)
1777
except OSError, error:
1965
except OSError as error:
1778
1966
if error[0] != errno.EPERM:
1779
1967
raise error
1780
1968
1785
1973
level = getattr(logging, debuglevel.upper())
1786
1974
syslogger.setLevel(level)
1787
1975
console.setLevel(level)
1788
1976
1789
1977
if debug:
1790
1978
# Enable all possible GnuTLS debugging
1791
1979
1795
1983
1796
1984
@gnutls.library.types.gnutls_log_func
1797
1985
def debug_gnutls(level, string):
1798
logger.debug(u"GnuTLS: %s", string[:-1])
1986
logger.debug("GnuTLS: %s", string[:-1])
1799
1987
1800
1988
(gnutls.library.functions
1801
1989
.gnutls_global_set_log_function(debug_gnutls))
1809
1997
# No console logging
1810
1998
logger.removeHandler(console)
1811
1999
2000
# Need to fork before connecting to D-Bus
2001
if not debug:
2002
# Close all input and output, do double fork, etc.
2003
daemon()
1812
2004
1813
2005
global main_loop
1814
2006
# From the Avahi example code
1818
2010
# End of Avahi example code
1819
2011
if use_dbus:
1820
2012
try:
1821
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
2013
bus_name = dbus.service.BusName("se.recompile.Mandos",
1822
2014
bus, do_not_queue=True)
1823
except dbus.exceptions.NameExistsException, e:
1824
logger.error(unicode(e) + u", disabling D-Bus")
2015
old_bus_name = (dbus.service.BusName
2016
("se.bsnet.fukt.Mandos", bus,
2017
do_not_queue=True))
2018
except dbus.exceptions.NameExistsException as e:
2019
logger.error(unicode(e) + ", disabling D-Bus")
1825
2020
use_dbus = False
1826
server_settings[u"use_dbus"] = False
2021
server_settings["use_dbus"] = False
1827
2022
tcp_server.use_dbus = False
1828
2023
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1829
service = AvahiService(name = server_settings[u"servicename"],
1830
servicetype = u"_mandos._tcp",
2024
service = AvahiService(name = server_settings["servicename"],
2025
servicetype = "_mandos._tcp",
1831
2026
protocol = protocol, bus = bus)
1832
2027
if server_settings["interface"]:
1833
2028
service.interface = (if_nametoindex
1834
(str(server_settings[u"interface"])))
1835
1836
if not debug:
1837
# Close all input and output, do double fork, etc.
1838
daemon()
1839
2029
(str(server_settings["interface"])))
2030
1840
2031
global multiprocessing_manager
1841
2032
multiprocessing_manager = multiprocessing.Manager()
1842
2033
1843
2034
client_class = Client
1844
2035
if use_dbus:
1845
client_class = functools.partial(ClientDBus, bus = bus)
2036
client_class = functools.partial(ClientDBusTransitional,
2037
bus = bus)
1846
2038
def client_config_items(config, section):
1847
2039
special_settings = {
1848
2040
"approved_by_default":
1861
2053
client_config, section)))
1862
2054
for section in client_config.sections()))
1863
2055
if not tcp_server.clients:
1864
logger.warning(u"No clients defined")
2056
logger.warning("No clients defined")
1865
2057
1866
try:
1867
with pidfile:
1868
pid = os.getpid()
1869
pidfile.write(str(pid) + "\n")
1870
del pidfile
1871
except IOError:
1872
logger.error(u"Could not write to file %r with PID %d",
1873
pidfilename, pid)
1874
except NameError:
1875
# "pidfile" was never created
1876
pass
1877
del pidfilename
1878
1879
2058
if not debug:
2059
try:
2060
with pidfile:
2061
pid = os.getpid()
2062
pidfile.write(str(pid) + "\n".encode("utf-8"))
2063
del pidfile
2064
except IOError:
2065
logger.error("Could not write to file %r with PID %d",
2066
pidfilename, pid)
2067
except NameError:
2068
# "pidfile" was never created
2069
pass
2070
del pidfilename
2071
1880
2072
signal.signal(signal.SIGINT, signal.SIG_IGN)
2073
1881
2074
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1882
2075
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1883
2076
1885
2078
class MandosDBusService(dbus.service.Object):
1886
2079
"""A D-Bus proxy object"""
1887
2080
def __init__(self):
1888
dbus.service.Object.__init__(self, bus, u"/")
1889
_interface = u"se.bsnet.fukt.Mandos"
2081
dbus.service.Object.__init__(self, bus, "/")
2082
_interface = "se.recompile.Mandos"
1890
2083
1891
@dbus.service.signal(_interface, signature=u"o")
2084
@dbus.service.signal(_interface, signature="o")
1892
2085
def ClientAdded(self, objpath):
1893
2086
"D-Bus signal"
1894
2087
pass
1895
2088
1896
@dbus.service.signal(_interface, signature=u"ss")
2089
@dbus.service.signal(_interface, signature="ss")
1897
2090
def ClientNotFound(self, fingerprint, address):
1898
2091
"D-Bus signal"
1899
2092
pass
1900
2093
1901
@dbus.service.signal(_interface, signature=u"os")
2094
@dbus.service.signal(_interface, signature="os")
1902
2095
def ClientRemoved(self, objpath, name):
1903
2096
"D-Bus signal"
1904
2097
pass
1905
2098
1906
@dbus.service.method(_interface, out_signature=u"ao")
2099
@dbus.service.method(_interface, out_signature="ao")
1907
2100
def GetAllClients(self):
1908
2101
"D-Bus method"
1909
2102
return dbus.Array(c.dbus_object_path
1910
2103
for c in tcp_server.clients)
1911
2104
1912
2105
@dbus.service.method(_interface,
1913
out_signature=u"a{oa{sv}}")
2106
out_signature="a{oa{sv}}")
1914
2107
def GetAllClientsWithProperties(self):
1915
2108
"D-Bus method"
1916
2109
return dbus.Dictionary(
1917
((c.dbus_object_path, c.GetAll(u""))
2110
((c.dbus_object_path, c.GetAll(""))
1918
2111
for c in tcp_server.clients),
1919
signature=u"oa{sv}")
2112
signature="oa{sv}")
1920
2113
1921
@dbus.service.method(_interface, in_signature=u"o")
2114
@dbus.service.method(_interface, in_signature="o")
1922
2115
def RemoveClient(self, object_path):
1923
2116
"D-Bus method"
1924
2117
for c in tcp_server.clients:
1934
2127
1935
2128
del _interface
1936
2129
1937
mandos_dbus_service = MandosDBusService()
2130
class MandosDBusServiceTransitional(MandosDBusService):
2131
__metaclass__ = AlternateDBusNamesMetaclass
2132
mandos_dbus_service = MandosDBusServiceTransitional()
1938
2133
1939
2134
def cleanup():
1940
2135
"Cleanup function; run on exit"
1941
2136
service.cleanup()
1942
2137
2138
multiprocessing.active_children()
1943
2139
while tcp_server.clients:
1944
2140
client = tcp_server.clients.pop()
1945
2141
if use_dbus:
1949
2145
client.disable(quiet=True)
1950
2146
if use_dbus:
1951
2147
# Emit D-Bus signal
1952
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2148
mandos_dbus_service.ClientRemoved(client
2149
.dbus_object_path,
1953
2150
client.name)
1954
2151
1955
2152
atexit.register(cleanup)
1966
2163
# Find out what port we got
1967
2164
service.port = tcp_server.socket.getsockname()[1]
1968
2165
if use_ipv6:
1969
logger.info(u"Now listening on address %r, port %d,"
2166
logger.info("Now listening on address %r, port %d,"
1970
2167
" flowinfo %d, scope_id %d"
1971
2168
% tcp_server.socket.getsockname())
1972
2169
else: # IPv4
1973
logger.info(u"Now listening on address %r, port %d"
2170
logger.info("Now listening on address %r, port %d"
1974
2171
% tcp_server.socket.getsockname())
1975
2172
1976
2173
#service.interface = tcp_server.socket.getsockname()[3]
1979
2176
# From the Avahi example code
1980
2177
try:
1981
2178
service.activate()
1982
except dbus.exceptions.DBusException, error:
1983
logger.critical(u"DBusException: %s", error)
2179
except dbus.exceptions.DBusException as error:
2180
logger.critical("DBusException: %s", error)
1984
2181
cleanup()
1985
2182
sys.exit(1)
1986
2183
# End of Avahi example code
1990
2187
(tcp_server.handle_request
1991
2188
(*args[2:], **kwargs) or True))
1992
2189
1993
logger.debug(u"Starting main loop")
2190
logger.debug("Starting main loop")
1994
2191
main_loop.run()
1995
except AvahiError, error:
1996
logger.critical(u"AvahiError: %s", error)
2192
except AvahiError as error:
2193
logger.critical("AvahiError: %s", error)
1997
2194
cleanup()
1998
2195
sys.exit(1)
1999
2196
except KeyboardInterrupt:
2000
2197
if debug:
2001
print >> sys.stderr
2002
logger.debug(u"Server received KeyboardInterrupt")
2003
logger.debug(u"Server exiting")
2198
print("", file=sys.stderr)
2199
logger.debug("Server received KeyboardInterrupt")
2200
logger.debug("Server exiting")
2004
2201
# Must run before the D-Bus bus name gets deregistered
2005
2202
cleanup()
2006
2203
2204
2007
2205
if __name__ == '__main__':
2008
2206
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0