To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to mandos
- browse files at revision 515
- compare with another revision
- download diff
- download tarball
- view history from revision 515
- Committer: Teddy Hogeborn
- Date: 2011-10-10 20:30:55 UTC
- mfrom: (505.1.13 teddy)
- Revision ID: teddy@recompile.se-20111010203055-a4crqy7gw2ln252r
Miscellaneous fixes prompted by lintian:
* debian/control (Conflicts): Changed to "Breaks:".
* debian/copyright: Updated format.
* debian/mandos-client.postinst: Use "set -e" instead of "#!/bin/sh -e".
* debian/mandos-client.postrm: - '' -
* debian/mandos.postinst: - '' -
* debian/mandos.prerm: Consistent magic.
* mandos: Small comment change.
* mandos-clients.conf.xml (OPTIONS/extended_timeout): Fix spelling.
* debian/control (Conflicts): Changed to "Breaks:".
* debian/copyright: Updated format.
* debian/mandos-client.postinst: Use "set -e" instead of "#!/bin/sh -e".
* debian/mandos-client.postrm: - '' -
* debian/mandos.postinst: - '' -
* debian/mandos.prerm: Consistent magic.
* mandos: Small comment change.
* mandos-clients.conf.xml (OPTIONS/extended_timeout): Fix spelling.
- files added:
- debian/source
- files modified:
- .bzrignore
added
removed
mandos
11
11
# "AvahiService" class, and some lines in "main".
12
12
#
13
13
# Everything else is
14
# Copyright © 2008-2010 Teddy Hogeborn
15
# Copyright © 2008-2010 Björn Påhlsson
14
# Copyright © 2008-2011 Teddy Hogeborn
15
# Copyright © 2008-2011 Björn Påhlsson
16
16
#
17
17
# This program is free software: you can redistribute it and/or modify
18
18
# it under the terms of the GNU General Public License as published by
28
28
# along with this program. If not, see
29
29
# <http://www.gnu.org/licenses/>.
30
30
#
31
# Contact the authors at <mandos@fukt.bsnet.se>.
31
# Contact the authors at <mandos@recompile.se>.
32
32
#
33
33
34
from __future__ import division, with_statement, absolute_import
34
from __future__ import (division, absolute_import, print_function,
35
unicode_literals)
35
36
36
37
import SocketServer as socketserver
37
38
import socket
38
import optparse
39
import argparse
39
40
import datetime
40
41
import errno
41
42
import gnutls.crypto
61
62
import functools
62
63
import cPickle as pickle
63
64
import multiprocessing
65
import types
64
66
65
67
import dbus
66
68
import dbus.service
81
83
SO_BINDTODEVICE = None
82
84
83
85
84
version = "1.0.14"
86
version = "1.4.0"
85
87
86
#logger = logging.getLogger(u'mandos')
87
logger = logging.Logger(u'mandos')
88
#logger = logging.getLogger('mandos')
89
logger = logging.Logger('mandos')
88
90
syslogger = (logging.handlers.SysLogHandler
89
91
(facility = logging.handlers.SysLogHandler.LOG_DAEMON,
90
address = "/dev/log"))
92
address = str("/dev/log")))
91
93
syslogger.setFormatter(logging.Formatter
92
(u'Mandos [%(process)d]: %(levelname)s:'
93
u' %(message)s'))
94
('Mandos [%(process)d]: %(levelname)s:'
95
' %(message)s'))
94
96
logger.addHandler(syslogger)
95
97
96
98
console = logging.StreamHandler()
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
98
u' %(levelname)s:'
99
u' %(message)s'))
99
console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'
100
' %(levelname)s:'
101
' %(message)s'))
100
102
logger.addHandler(console)
101
103
102
104
class AvahiError(Exception):
119
121
Attributes:
120
122
interface: integer; avahi.IF_UNSPEC or an interface index.
121
123
Used to optionally bind to the specified interface.
122
name: string; Example: u'Mandos'
123
type: string; Example: u'_mandos._tcp'.
124
name: string; Example: 'Mandos'
125
type: string; Example: '_mandos._tcp'.
124
126
See <http://www.dns-sd.org/ServiceTypes.html>
125
127
port: integer; what port to announce
126
128
TXT: list of strings; TXT record for the service
135
137
"""
136
138
def __init__(self, interface = avahi.IF_UNSPEC, name = None,
137
139
servicetype = None, port = None, TXT = None,
138
domain = u"", host = u"", max_renames = 32768,
140
domain = "", host = "", max_renames = 32768,
139
141
protocol = avahi.PROTO_UNSPEC, bus = None):
140
142
self.interface = interface
141
143
self.name = name
150
152
self.group = None # our entry group
151
153
self.server = None
152
154
self.bus = bus
155
self.entry_group_state_changed_match = None
153
156
def rename(self):
154
157
"""Derived from the Avahi example code"""
155
158
if self.rename_count >= self.max_renames:
156
logger.critical(u"No suitable Zeroconf service name found"
157
u" after %i retries, exiting.",
159
logger.critical("No suitable Zeroconf service name found"
160
" after %i retries, exiting.",
158
161
self.rename_count)
159
raise AvahiServiceError(u"Too many renames")
160
self.name = unicode(self.server.GetAlternativeServiceName(self.name))
161
logger.info(u"Changing Zeroconf service name to %r ...",
162
raise AvahiServiceError("Too many renames")
163
self.name = unicode(self.server
164
.GetAlternativeServiceName(self.name))
165
logger.info("Changing Zeroconf service name to %r ...",
162
166
self.name)
163
167
syslogger.setFormatter(logging.Formatter
164
(u'Mandos (%s) [%%(process)d]:'
165
u' %%(levelname)s: %%(message)s'
168
('Mandos (%s) [%%(process)d]:'
169
' %%(levelname)s: %%(message)s'
166
170
% self.name))
167
171
self.remove()
168
172
try:
169
173
self.add()
170
except dbus.exceptions.DBusException, error:
171
logger.critical(u"DBusException: %s", error)
174
except dbus.exceptions.DBusException as error:
175
logger.critical("DBusException: %s", error)
172
176
self.cleanup()
173
177
os._exit(1)
174
178
self.rename_count += 1
175
179
def remove(self):
176
180
"""Derived from the Avahi example code"""
181
if self.entry_group_state_changed_match is not None:
182
self.entry_group_state_changed_match.remove()
183
self.entry_group_state_changed_match = None
177
184
if self.group is not None:
178
185
self.group.Reset()
179
186
def add(self):
180
187
"""Derived from the Avahi example code"""
188
self.remove()
181
189
if self.group is None:
182
190
self.group = dbus.Interface(
183
191
self.bus.get_object(avahi.DBUS_NAME,
184
192
self.server.EntryGroupNew()),
185
193
avahi.DBUS_INTERFACE_ENTRY_GROUP)
186
self.group.connect_to_signal('StateChanged',
187
self
188
.entry_group_state_changed)
189
logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
194
self.entry_group_state_changed_match = (
195
self.group.connect_to_signal(
196
'StateChanged', self .entry_group_state_changed))
197
logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
190
198
self.name, self.type)
191
199
self.group.AddService(
192
200
self.interface,
199
207
self.group.Commit()
200
208
def entry_group_state_changed(self, state, error):
201
209
"""Derived from the Avahi example code"""
202
logger.debug(u"Avahi entry group state change: %i", state)
210
logger.debug("Avahi entry group state change: %i", state)
203
211
204
212
if state == avahi.ENTRY_GROUP_ESTABLISHED:
205
logger.debug(u"Zeroconf service established.")
213
logger.debug("Zeroconf service established.")
206
214
elif state == avahi.ENTRY_GROUP_COLLISION:
207
logger.warning(u"Zeroconf service name collision.")
215
logger.info("Zeroconf service name collision.")
208
216
self.rename()
209
217
elif state == avahi.ENTRY_GROUP_FAILURE:
210
logger.critical(u"Avahi: Error in group state changed %s",
218
logger.critical("Avahi: Error in group state changed %s",
211
219
unicode(error))
212
raise AvahiGroupError(u"State changed: %s"
220
raise AvahiGroupError("State changed: %s"
213
221
% unicode(error))
214
222
def cleanup(self):
215
223
"""Derived from the Avahi example code"""
216
224
if self.group is not None:
217
self.group.Free()
225
try:
226
self.group.Free()
227
except (dbus.exceptions.UnknownMethodException,
228
dbus.exceptions.DBusException) as e:
229
pass
218
230
self.group = None
219
def server_state_changed(self, state):
231
self.remove()
232
def server_state_changed(self, state, error=None):
220
233
"""Derived from the Avahi example code"""
221
logger.debug(u"Avahi server state change: %i", state)
222
if state == avahi.SERVER_COLLISION:
223
logger.error(u"Zeroconf server name collision")
224
self.remove()
234
logger.debug("Avahi server state change: %i", state)
235
bad_states = { avahi.SERVER_INVALID:
236
"Zeroconf server invalid",
237
avahi.SERVER_REGISTERING: None,
238
avahi.SERVER_COLLISION:
239
"Zeroconf server name collision",
240
avahi.SERVER_FAILURE:
241
"Zeroconf server failure" }
242
if state in bad_states:
243
if bad_states[state] is not None:
244
if error is None:
245
logger.error(bad_states[state])
246
else:
247
logger.error(bad_states[state] + ": %r", error)
248
self.cleanup()
225
249
elif state == avahi.SERVER_RUNNING:
226
250
self.add()
251
else:
252
if error is None:
253
logger.debug("Unknown state: %r", state)
254
else:
255
logger.debug("Unknown state: %r: %r", state, error)
227
256
def activate(self):
228
257
"""Derived from the Avahi example code"""
229
258
if self.server is None:
230
259
self.server = dbus.Interface(
231
260
self.bus.get_object(avahi.DBUS_NAME,
232
avahi.DBUS_PATH_SERVER),
261
avahi.DBUS_PATH_SERVER,
262
follow_name_owner_changes=True),
233
263
avahi.DBUS_INTERFACE_SERVER)
234
self.server.connect_to_signal(u"StateChanged",
264
self.server.connect_to_signal("StateChanged",
235
265
self.server_state_changed)
236
266
self.server_state_changed(self.server.GetState())
237
267
238
268
269
def _timedelta_to_milliseconds(td):
270
"Convert a datetime.timedelta() to milliseconds"
271
return ((td.days * 24 * 60 * 60 * 1000)
272
+ (td.seconds * 1000)
273
+ (td.microseconds // 1000))
274
239
275
class Client(object):
240
276
"""A representation of a client host served by this server.
241
277
269
305
secret: bytestring; sent verbatim (over TLS) to client
270
306
timeout: datetime.timedelta(); How long from last_checked_ok
271
307
until this client is disabled
308
extended_timeout: extra long timeout when password has been sent
272
309
runtime_expansions: Allowed attributes for runtime expansion.
310
expires: datetime.datetime(); time (UTC) when a client will be
311
disabled, or None
273
312
"""
274
313
275
runtime_expansions = (u"approval_delay", u"approval_duration",
276
u"created", u"enabled", u"fingerprint",
277
u"host", u"interval", u"last_checked_ok",
278
u"last_enabled", u"name", u"timeout")
279
280
@staticmethod
281
def _timedelta_to_milliseconds(td):
282
"Convert a datetime.timedelta() to milliseconds"
283
return ((td.days * 24 * 60 * 60 * 1000)
284
+ (td.seconds * 1000)
285
+ (td.microseconds // 1000))
314
runtime_expansions = ("approval_delay", "approval_duration",
315
"created", "enabled", "fingerprint",
316
"host", "interval", "last_checked_ok",
317
"last_enabled", "name", "timeout")
286
318
287
319
def timeout_milliseconds(self):
288
320
"Return the 'timeout' attribute in milliseconds"
289
return self._timedelta_to_milliseconds(self.timeout)
321
return _timedelta_to_milliseconds(self.timeout)
322
323
def extended_timeout_milliseconds(self):
324
"Return the 'extended_timeout' attribute in milliseconds"
325
return _timedelta_to_milliseconds(self.extended_timeout)
290
326
291
327
def interval_milliseconds(self):
292
328
"Return the 'interval' attribute in milliseconds"
293
return self._timedelta_to_milliseconds(self.interval)
294
329
return _timedelta_to_milliseconds(self.interval)
330
295
331
def approval_delay_milliseconds(self):
296
return self._timedelta_to_milliseconds(self.approval_delay)
332
return _timedelta_to_milliseconds(self.approval_delay)
297
333
298
334
def __init__(self, name = None, disable_hook=None, config=None):
299
335
"""Note: the 'checker' key in 'config' sets the
302
338
self.name = name
303
339
if config is None:
304
340
config = {}
305
logger.debug(u"Creating client %r", self.name)
341
logger.debug("Creating client %r", self.name)
306
342
# Uppercase and remove spaces from fingerprint for later
307
343
# comparison purposes with return value from the fingerprint()
308
344
# function
309
self.fingerprint = (config[u"fingerprint"].upper()
310
.replace(u" ", u""))
311
logger.debug(u" Fingerprint: %s", self.fingerprint)
312
if u"secret" in config:
313
self.secret = config[u"secret"].decode(u"base64")
314
elif u"secfile" in config:
345
self.fingerprint = (config["fingerprint"].upper()
346
.replace(" ", ""))
347
logger.debug(" Fingerprint: %s", self.fingerprint)
348
if "secret" in config:
349
self.secret = config["secret"].decode("base64")
350
elif "secfile" in config:
315
351
with open(os.path.expanduser(os.path.expandvars
316
(config[u"secfile"])),
352
(config["secfile"])),
317
353
"rb") as secfile:
318
354
self.secret = secfile.read()
319
355
else:
320
raise TypeError(u"No secret or secfile for client %s"
356
raise TypeError("No secret or secfile for client %s"
321
357
% self.name)
322
self.host = config.get(u"host", u"")
358
self.host = config.get("host", "")
323
359
self.created = datetime.datetime.utcnow()
324
360
self.enabled = False
325
361
self.last_approval_request = None
326
362
self.last_enabled = None
327
363
self.last_checked_ok = None
328
self.timeout = string_to_delta(config[u"timeout"])
329
self.interval = string_to_delta(config[u"interval"])
364
self.timeout = string_to_delta(config["timeout"])
365
self.extended_timeout = string_to_delta(config
366
["extended_timeout"])
367
self.interval = string_to_delta(config["interval"])
330
368
self.disable_hook = disable_hook
331
369
self.checker = None
332
370
self.checker_initiator_tag = None
333
371
self.disable_initiator_tag = None
372
self.expires = None
334
373
self.checker_callback_tag = None
335
self.checker_command = config[u"checker"]
374
self.checker_command = config["checker"]
336
375
self.current_checker_command = None
337
376
self.last_connect = None
338
377
self._approved = None
339
self.approved_by_default = config.get(u"approved_by_default",
378
self.approved_by_default = config.get("approved_by_default",
340
379
True)
341
380
self.approvals_pending = 0
342
381
self.approval_delay = string_to_delta(
343
config[u"approval_delay"])
382
config["approval_delay"])
344
383
self.approval_duration = string_to_delta(
345
config[u"approval_duration"])
346
self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
384
config["approval_duration"])
385
self.changedstate = (multiprocessing_manager
386
.Condition(multiprocessing_manager
387
.Lock()))
347
388
348
389
def send_changedstate(self):
349
390
self.changedstate.acquire()
350
391
self.changedstate.notify_all()
351
392
self.changedstate.release()
352
393
353
394
def enable(self):
354
395
"""Start this client's checker and timeout hooks"""
355
if getattr(self, u"enabled", False):
396
if getattr(self, "enabled", False):
356
397
# Already enabled
357
398
return
358
399
self.send_changedstate()
359
self.last_enabled = datetime.datetime.utcnow()
360
400
# Schedule a new checker to be started an 'interval' from now,
361
401
# and every interval from then on.
362
402
self.checker_initiator_tag = (gobject.timeout_add
363
403
(self.interval_milliseconds(),
364
404
self.start_checker))
365
405
# Schedule a disable() when 'timeout' has passed
406
self.expires = datetime.datetime.utcnow() + self.timeout
366
407
self.disable_initiator_tag = (gobject.timeout_add
367
408
(self.timeout_milliseconds(),
368
409
self.disable))
369
410
self.enabled = True
411
self.last_enabled = datetime.datetime.utcnow()
370
412
# Also start a new checker *right now*.
371
413
self.start_checker()
372
414
377
419
if not quiet:
378
420
self.send_changedstate()
379
421
if not quiet:
380
logger.info(u"Disabling client %s", self.name)
381
if getattr(self, u"disable_initiator_tag", False):
422
logger.info("Disabling client %s", self.name)
423
if getattr(self, "disable_initiator_tag", False):
382
424
gobject.source_remove(self.disable_initiator_tag)
383
425
self.disable_initiator_tag = None
384
if getattr(self, u"checker_initiator_tag", False):
426
self.expires = None
427
if getattr(self, "checker_initiator_tag", False):
385
428
gobject.source_remove(self.checker_initiator_tag)
386
429
self.checker_initiator_tag = None
387
430
self.stop_checker()
402
445
if os.WIFEXITED(condition):
403
446
exitstatus = os.WEXITSTATUS(condition)
404
447
if exitstatus == 0:
405
logger.info(u"Checker for %(name)s succeeded",
448
logger.info("Checker for %(name)s succeeded",
406
449
vars(self))
407
450
self.checked_ok()
408
451
else:
409
logger.info(u"Checker for %(name)s failed",
452
logger.info("Checker for %(name)s failed",
410
453
vars(self))
411
454
else:
412
logger.warning(u"Checker for %(name)s crashed?",
455
logger.warning("Checker for %(name)s crashed?",
413
456
vars(self))
414
457
415
def checked_ok(self):
458
def checked_ok(self, timeout=None):
416
459
"""Bump up the timeout for this client.
417
460
418
461
This should only be called when the client has been seen,
419
462
alive and well.
420
463
"""
464
if timeout is None:
465
timeout = self.timeout
421
466
self.last_checked_ok = datetime.datetime.utcnow()
422
467
gobject.source_remove(self.disable_initiator_tag)
423
468
self.disable_initiator_tag = (gobject.timeout_add
424
(self.timeout_milliseconds(),
425
self.disable))
469
(_timedelta_to_milliseconds
470
(timeout), self.disable))
471
self.expires = datetime.datetime.utcnow() + timeout
426
472
427
473
def need_approval(self):
428
474
self.last_approval_request = datetime.datetime.utcnow()
444
490
# If a checker exists, make sure it is not a zombie
445
491
try:
446
492
pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
447
except (AttributeError, OSError), error:
493
except (AttributeError, OSError) as error:
448
494
if (isinstance(error, OSError)
449
495
and error.errno != errno.ECHILD):
450
496
raise error
451
497
else:
452
498
if pid:
453
logger.warning(u"Checker was a zombie")
499
logger.warning("Checker was a zombie")
454
500
gobject.source_remove(self.checker_callback_tag)
455
501
self.checker_callback(pid, status,
456
502
self.current_checker_command)
463
509
# Escape attributes for the shell
464
510
escaped_attrs = dict(
465
511
(attr,
466
re.escape(unicode(str(getattr(self, attr, u"")),
512
re.escape(unicode(str(getattr(self, attr, "")),
467
513
errors=
468
u'replace')))
514
'replace')))
469
515
for attr in
470
516
self.runtime_expansions)
471
517
472
518
try:
473
519
command = self.checker_command % escaped_attrs
474
except TypeError, error:
475
logger.error(u'Could not format string "%s":'
476
u' %s', self.checker_command, error)
520
except TypeError as error:
521
logger.error('Could not format string "%s":'
522
' %s', self.checker_command, error)
477
523
return True # Try again later
478
524
self.current_checker_command = command
479
525
try:
480
logger.info(u"Starting checker %r for %s",
526
logger.info("Starting checker %r for %s",
481
527
command, self.name)
482
528
# We don't need to redirect stdout and stderr, since
483
529
# in normal mode, that is already done by daemon(),
485
531
# always replaced by /dev/null.)
486
532
self.checker = subprocess.Popen(command,
487
533
close_fds=True,
488
shell=True, cwd=u"/")
534
shell=True, cwd="/")
489
535
self.checker_callback_tag = (gobject.child_watch_add
490
536
(self.checker.pid,
491
537
self.checker_callback,
496
542
if pid:
497
543
gobject.source_remove(self.checker_callback_tag)
498
544
self.checker_callback(pid, status, command)
499
except OSError, error:
500
logger.error(u"Failed to start subprocess: %s",
545
except OSError as error:
546
logger.error("Failed to start subprocess: %s",
501
547
error)
502
548
# Re-run this periodically if run by gobject.timeout_add
503
549
return True
507
553
if self.checker_callback_tag:
508
554
gobject.source_remove(self.checker_callback_tag)
509
555
self.checker_callback_tag = None
510
if getattr(self, u"checker", None) is None:
556
if getattr(self, "checker", None) is None:
511
557
return
512
logger.debug(u"Stopping checker for %(name)s", vars(self))
558
logger.debug("Stopping checker for %(name)s", vars(self))
513
559
try:
514
560
os.kill(self.checker.pid, signal.SIGTERM)
515
561
#time.sleep(0.5)
516
562
#if self.checker.poll() is None:
517
563
# os.kill(self.checker.pid, signal.SIGKILL)
518
except OSError, error:
564
except OSError as error:
519
565
if error.errno != errno.ESRCH: # No such process
520
566
raise
521
567
self.checker = None
522
568
523
def dbus_service_property(dbus_interface, signature=u"v",
524
access=u"readwrite", byte_arrays=False):
569
570
def dbus_service_property(dbus_interface, signature="v",
571
access="readwrite", byte_arrays=False):
525
572
"""Decorators for marking methods of a DBusObjectWithProperties to
526
573
become properties on the D-Bus.
527
574
534
581
"""
535
582
# Encoding deeply encoded byte arrays is not supported yet by the
536
583
# "Set" method, so we fail early here:
537
if byte_arrays and signature != u"ay":
538
raise ValueError(u"Byte arrays not supported for non-'ay'"
539
u" signature %r" % signature)
584
if byte_arrays and signature != "ay":
585
raise ValueError("Byte arrays not supported for non-'ay'"
586
" signature %r" % signature)
540
587
def decorator(func):
541
588
func._dbus_is_property = True
542
589
func._dbus_interface = dbus_interface
543
590
func._dbus_signature = signature
544
591
func._dbus_access = access
545
592
func._dbus_name = func.__name__
546
if func._dbus_name.endswith(u"_dbus_property"):
593
if func._dbus_name.endswith("_dbus_property"):
547
594
func._dbus_name = func._dbus_name[:-14]
548
func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
595
func._dbus_get_args_options = {'byte_arrays': byte_arrays }
549
596
return func
550
597
return decorator
551
598
571
618
572
619
class DBusObjectWithProperties(dbus.service.Object):
573
620
"""A D-Bus object with properties.
574
621
575
622
Classes inheriting from this can use the dbus_service_property
576
623
decorator to expose methods as D-Bus properties. It exposes the
577
624
standard Get(), Set(), and GetAll() methods on the D-Bus.
579
626
580
627
@staticmethod
581
628
def _is_dbus_property(obj):
582
return getattr(obj, u"_dbus_is_property", False)
629
return getattr(obj, "_dbus_is_property", False)
583
630
584
631
def _get_all_dbus_properties(self):
585
632
"""Returns a generator of (name, attribute) pairs
586
633
"""
587
return ((prop._dbus_name, prop)
634
return ((prop.__get__(self)._dbus_name, prop.__get__(self))
635
for cls in self.__class__.__mro__
588
636
for name, prop in
589
inspect.getmembers(self, self._is_dbus_property))
637
inspect.getmembers(cls, self._is_dbus_property))
590
638
591
639
def _get_dbus_property(self, interface_name, property_name):
592
640
"""Returns a bound method if one exists which is a D-Bus
593
641
property with the specified name and interface.
594
642
"""
595
for name in (property_name,
596
property_name + u"_dbus_property"):
597
prop = getattr(self, name, None)
598
if (prop is None
599
or not self._is_dbus_property(prop)
600
or prop._dbus_name != property_name
601
or (interface_name and prop._dbus_interface
602
and interface_name != prop._dbus_interface)):
603
continue
604
return prop
643
for cls in self.__class__.__mro__:
644
for name, value in (inspect.getmembers
645
(cls, self._is_dbus_property)):
646
if (value._dbus_name == property_name
647
and value._dbus_interface == interface_name):
648
return value.__get__(self)
649
605
650
# No such property
606
raise DBusPropertyNotFound(self.dbus_object_path + u":"
607
+ interface_name + u"."
651
raise DBusPropertyNotFound(self.dbus_object_path + ":"
652
+ interface_name + "."
608
653
+ property_name)
609
654
610
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
611
out_signature=u"v")
655
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
656
out_signature="v")
612
657
def Get(self, interface_name, property_name):
613
658
"""Standard D-Bus property Get() method, see D-Bus standard.
614
659
"""
615
660
prop = self._get_dbus_property(interface_name, property_name)
616
if prop._dbus_access == u"write":
661
if prop._dbus_access == "write":
617
662
raise DBusPropertyAccessException(property_name)
618
663
value = prop()
619
if not hasattr(value, u"variant_level"):
664
if not hasattr(value, "variant_level"):
620
665
return value
621
666
return type(value)(value, variant_level=value.variant_level+1)
622
667
623
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
668
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
624
669
def Set(self, interface_name, property_name, value):
625
670
"""Standard D-Bus property Set() method, see D-Bus standard.
626
671
"""
627
672
prop = self._get_dbus_property(interface_name, property_name)
628
if prop._dbus_access == u"read":
673
if prop._dbus_access == "read":
629
674
raise DBusPropertyAccessException(property_name)
630
if prop._dbus_get_args_options[u"byte_arrays"]:
675
if prop._dbus_get_args_options["byte_arrays"]:
631
676
# The byte_arrays option is not supported yet on
632
677
# signatures other than "ay".
633
if prop._dbus_signature != u"ay":
678
if prop._dbus_signature != "ay":
634
679
raise ValueError
635
680
value = dbus.ByteArray(''.join(unichr(byte)
636
681
for byte in value))
637
682
prop(value)
638
683
639
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
640
out_signature=u"a{sv}")
684
@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
685
out_signature="a{sv}")
641
686
def GetAll(self, interface_name):
642
687
"""Standard D-Bus property GetAll() method, see D-Bus
643
688
standard.
644
689
645
690
Note: Will not include properties with access="write".
646
691
"""
647
692
all = {}
651
696
# Interface non-empty but did not match
652
697
continue
653
698
# Ignore write-only properties
654
if prop._dbus_access == u"write":
699
if prop._dbus_access == "write":
655
700
continue
656
701
value = prop()
657
if not hasattr(value, u"variant_level"):
702
if not hasattr(value, "variant_level"):
658
703
all[name] = value
659
704
continue
660
705
all[name] = type(value)(value, variant_level=
661
706
value.variant_level+1)
662
return dbus.Dictionary(all, signature=u"sv")
707
return dbus.Dictionary(all, signature="sv")
663
708
664
709
@dbus.service.method(dbus.INTROSPECTABLE_IFACE,
665
out_signature=u"s",
710
out_signature="s",
666
711
path_keyword='object_path',
667
712
connection_keyword='connection')
668
713
def Introspect(self, object_path, connection):
673
718
try:
674
719
document = xml.dom.minidom.parseString(xmlstring)
675
720
def make_tag(document, name, prop):
676
e = document.createElement(u"property")
677
e.setAttribute(u"name", name)
678
e.setAttribute(u"type", prop._dbus_signature)
679
e.setAttribute(u"access", prop._dbus_access)
721
e = document.createElement("property")
722
e.setAttribute("name", name)
723
e.setAttribute("type", prop._dbus_signature)
724
e.setAttribute("access", prop._dbus_access)
680
725
return e
681
for if_tag in document.getElementsByTagName(u"interface"):
726
for if_tag in document.getElementsByTagName("interface"):
682
727
for tag in (make_tag(document, name, prop)
683
728
for name, prop
684
729
in self._get_all_dbus_properties()
685
730
if prop._dbus_interface
686
== if_tag.getAttribute(u"name")):
731
== if_tag.getAttribute("name")):
687
732
if_tag.appendChild(tag)
688
733
# Add the names to the return values for the
689
734
# "org.freedesktop.DBus.Properties" methods
690
if (if_tag.getAttribute(u"name")
691
== u"org.freedesktop.DBus.Properties"):
692
for cn in if_tag.getElementsByTagName(u"method"):
693
if cn.getAttribute(u"name") == u"Get":
694
for arg in cn.getElementsByTagName(u"arg"):
695
if (arg.getAttribute(u"direction")
696
== u"out"):
697
arg.setAttribute(u"name", u"value")
698
elif cn.getAttribute(u"name") == u"GetAll":
699
for arg in cn.getElementsByTagName(u"arg"):
700
if (arg.getAttribute(u"direction")
701
== u"out"):
702
arg.setAttribute(u"name", u"props")
703
xmlstring = document.toxml(u"utf-8")
735
if (if_tag.getAttribute("name")
736
== "org.freedesktop.DBus.Properties"):
737
for cn in if_tag.getElementsByTagName("method"):
738
if cn.getAttribute("name") == "Get":
739
for arg in cn.getElementsByTagName("arg"):
740
if (arg.getAttribute("direction")
741
== "out"):
742
arg.setAttribute("name", "value")
743
elif cn.getAttribute("name") == "GetAll":
744
for arg in cn.getElementsByTagName("arg"):
745
if (arg.getAttribute("direction")
746
== "out"):
747
arg.setAttribute("name", "props")
748
xmlstring = document.toxml("utf-8")
704
749
document.unlink()
705
750
except (AttributeError, xml.dom.DOMException,
706
xml.parsers.expat.ExpatError), error:
707
logger.error(u"Failed to override Introspection method",
751
xml.parsers.expat.ExpatError) as error:
752
logger.error("Failed to override Introspection method",
708
753
error)
709
754
return xmlstring
710
755
711
756
757
def datetime_to_dbus (dt, variant_level=0):
758
"""Convert a UTC datetime.datetime() to a D-Bus type."""
759
if dt is None:
760
return dbus.String("", variant_level = variant_level)
761
return dbus.String(dt.isoformat(),
762
variant_level=variant_level)
763
764
class AlternateDBusNamesMetaclass(DBusObjectWithProperties
765
.__metaclass__):
766
"""Applied to an empty subclass of a D-Bus object, this metaclass
767
will add additional D-Bus attributes matching a certain pattern.
768
"""
769
def __new__(mcs, name, bases, attr):
770
# Go through all the base classes which could have D-Bus
771
# methods, signals, or properties in them
772
for base in (b for b in bases
773
if issubclass(b, dbus.service.Object)):
774
# Go though all attributes of the base class
775
for attrname, attribute in inspect.getmembers(base):
776
# Ignore non-D-Bus attributes, and D-Bus attributes
777
# with the wrong interface name
778
if (not hasattr(attribute, "_dbus_interface")
779
or not attribute._dbus_interface
780
.startswith("se.recompile.Mandos")):
781
continue
782
# Create an alternate D-Bus interface name based on
783
# the current name
784
alt_interface = (attribute._dbus_interface
785
.replace("se.recompile.Mandos",
786
"se.bsnet.fukt.Mandos"))
787
# Is this a D-Bus signal?
788
if getattr(attribute, "_dbus_is_signal", False):
789
# Extract the original non-method function by
790
# black magic
791
nonmethod_func = (dict(
792
zip(attribute.func_code.co_freevars,
793
attribute.__closure__))["func"]
794
.cell_contents)
795
# Create a new, but exactly alike, function
796
# object, and decorate it to be a new D-Bus signal
797
# with the alternate D-Bus interface name
798
new_function = (dbus.service.signal
799
(alt_interface,
800
attribute._dbus_signature)
801
(types.FunctionType(
802
nonmethod_func.func_code,
803
nonmethod_func.func_globals,
804
nonmethod_func.func_name,
805
nonmethod_func.func_defaults,
806
nonmethod_func.func_closure)))
807
# Define a creator of a function to call both the
808
# old and new functions, so both the old and new
809
# signals gets sent when the function is called
810
def fixscope(func1, func2):
811
"""This function is a scope container to pass
812
func1 and func2 to the "call_both" function
813
outside of its arguments"""
814
def call_both(*args, **kwargs):
815
"""This function will emit two D-Bus
816
signals by calling func1 and func2"""
817
func1(*args, **kwargs)
818
func2(*args, **kwargs)
819
return call_both
820
# Create the "call_both" function and add it to
821
# the class
822
attr[attrname] = fixscope(attribute,
823
new_function)
824
# Is this a D-Bus method?
825
elif getattr(attribute, "_dbus_is_method", False):
826
# Create a new, but exactly alike, function
827
# object. Decorate it to be a new D-Bus method
828
# with the alternate D-Bus interface name. Add it
829
# to the class.
830
attr[attrname] = (dbus.service.method
831
(alt_interface,
832
attribute._dbus_in_signature,
833
attribute._dbus_out_signature)
834
(types.FunctionType
835
(attribute.func_code,
836
attribute.func_globals,
837
attribute.func_name,
838
attribute.func_defaults,
839
attribute.func_closure)))
840
# Is this a D-Bus property?
841
elif getattr(attribute, "_dbus_is_property", False):
842
# Create a new, but exactly alike, function
843
# object, and decorate it to be a new D-Bus
844
# property with the alternate D-Bus interface
845
# name. Add it to the class.
846
attr[attrname] = (dbus_service_property
847
(alt_interface,
848
attribute._dbus_signature,
849
attribute._dbus_access,
850
attribute
851
._dbus_get_args_options
852
["byte_arrays"])
853
(types.FunctionType
854
(attribute.func_code,
855
attribute.func_globals,
856
attribute.func_name,
857
attribute.func_defaults,
858
attribute.func_closure)))
859
return type.__new__(mcs, name, bases, attr)
860
712
861
class ClientDBus(Client, DBusObjectWithProperties):
713
862
"""A Client class using D-Bus
714
863
718
867
"""
719
868
720
869
runtime_expansions = (Client.runtime_expansions
721
+ (u"dbus_object_path",))
870
+ ("dbus_object_path",))
722
871
723
872
# dbus.service.Object doesn't use super(), so we can't either.
724
873
729
878
# Only now, when this client is initialized, can it show up on
730
879
# the D-Bus
731
880
client_object_name = unicode(self.name).translate(
732
{ord(u"."): ord(u"_"),
733
ord(u"-"): ord(u"_")})
881
{ord("."): ord("_"),
882
ord("-"): ord("_")})
734
883
self.dbus_object_path = (dbus.ObjectPath
735
(u"/clients/" + client_object_name))
884
("/clients/" + client_object_name))
736
885
DBusObjectWithProperties.__init__(self, self.bus,
737
886
self.dbus_object_path)
738
887
739
def _get_approvals_pending(self):
740
return self._approvals_pending
741
def _set_approvals_pending(self, value):
742
old_value = self._approvals_pending
743
self._approvals_pending = value
744
bval = bool(value)
745
if (hasattr(self, "dbus_object_path")
746
and bval is not bool(old_value)):
747
dbus_bool = dbus.Boolean(bval, variant_level=1)
748
self.PropertyChanged(dbus.String(u"ApprovalPending"),
749
dbus_bool)
888
def notifychangeproperty(transform_func,
889
dbus_name, type_func=lambda x: x,
890
variant_level=1):
891
""" Modify a variable so that it's a property which announces
892
its changes to DBus.
750
893
751
approvals_pending = property(_get_approvals_pending,
752
_set_approvals_pending)
753
del _get_approvals_pending, _set_approvals_pending
754
755
@staticmethod
756
def _datetime_to_dbus(dt, variant_level=0):
757
"""Convert a UTC datetime.datetime() to a D-Bus type."""
758
return dbus.String(dt.isoformat(),
759
variant_level=variant_level)
760
761
def enable(self):
762
oldstate = getattr(self, u"enabled", False)
763
r = Client.enable(self)
764
if oldstate != self.enabled:
765
# Emit D-Bus signals
766
self.PropertyChanged(dbus.String(u"Enabled"),
767
dbus.Boolean(True, variant_level=1))
768
self.PropertyChanged(
769
dbus.String(u"LastEnabled"),
770
self._datetime_to_dbus(self.last_enabled,
771
variant_level=1))
772
return r
773
774
def disable(self, quiet = False):
775
oldstate = getattr(self, u"enabled", False)
776
r = Client.disable(self, quiet=quiet)
777
if not quiet and oldstate != self.enabled:
778
# Emit D-Bus signal
779
self.PropertyChanged(dbus.String(u"Enabled"),
780
dbus.Boolean(False, variant_level=1))
781
return r
894
transform_fun: Function that takes a value and transforms it
895
to a D-Bus type.
896
dbus_name: D-Bus name of the variable
897
type_func: Function that transform the value before sending it
898
to the D-Bus. Default: no transform
899
variant_level: D-Bus variant level. Default: 1
900
"""
901
attrname = "_{0}".format(dbus_name)
902
def setter(self, value):
903
if hasattr(self, "dbus_object_path"):
904
if (not hasattr(self, attrname) or
905
type_func(getattr(self, attrname, None))
906
!= type_func(value)):
907
dbus_value = transform_func(type_func(value),
908
variant_level)
909
self.PropertyChanged(dbus.String(dbus_name),
910
dbus_value)
911
setattr(self, attrname, value)
912
913
return property(lambda self: getattr(self, attrname), setter)
914
915
916
expires = notifychangeproperty(datetime_to_dbus, "Expires")
917
approvals_pending = notifychangeproperty(dbus.Boolean,
918
"ApprovalPending",
919
type_func = bool)
920
enabled = notifychangeproperty(dbus.Boolean, "Enabled")
921
last_enabled = notifychangeproperty(datetime_to_dbus,
922
"LastEnabled")
923
checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
924
type_func = lambda checker:
925
checker is not None)
926
last_checked_ok = notifychangeproperty(datetime_to_dbus,
927
"LastCheckedOK")
928
last_approval_request = notifychangeproperty(
929
datetime_to_dbus, "LastApprovalRequest")
930
approved_by_default = notifychangeproperty(dbus.Boolean,
931
"ApprovedByDefault")
932
approval_delay = notifychangeproperty(dbus.UInt16,
933
"ApprovalDelay",
934
type_func =
935
_timedelta_to_milliseconds)
936
approval_duration = notifychangeproperty(
937
dbus.UInt16, "ApprovalDuration",
938
type_func = _timedelta_to_milliseconds)
939
host = notifychangeproperty(dbus.String, "Host")
940
timeout = notifychangeproperty(dbus.UInt16, "Timeout",
941
type_func =
942
_timedelta_to_milliseconds)
943
extended_timeout = notifychangeproperty(
944
dbus.UInt16, "ExtendedTimeout",
945
type_func = _timedelta_to_milliseconds)
946
interval = notifychangeproperty(dbus.UInt16,
947
"Interval",
948
type_func =
949
_timedelta_to_milliseconds)
950
checker_command = notifychangeproperty(dbus.String, "Checker")
951
952
del notifychangeproperty
782
953
783
954
def __del__(self, *args, **kwargs):
784
955
try:
785
956
self.remove_from_connection()
786
957
except LookupError:
787
958
pass
788
if hasattr(DBusObjectWithProperties, u"__del__"):
959
if hasattr(DBusObjectWithProperties, "__del__"):
789
960
DBusObjectWithProperties.__del__(self, *args, **kwargs)
790
961
Client.__del__(self, *args, **kwargs)
791
962
793
964
*args, **kwargs):
794
965
self.checker_callback_tag = None
795
966
self.checker = None
796
# Emit D-Bus signal
797
self.PropertyChanged(dbus.String(u"CheckerRunning"),
798
dbus.Boolean(False, variant_level=1))
799
967
if os.WIFEXITED(condition):
800
968
exitstatus = os.WEXITSTATUS(condition)
801
969
# Emit D-Bus signal
811
979
return Client.checker_callback(self, pid, condition, command,
812
980
*args, **kwargs)
813
981
814
def checked_ok(self, *args, **kwargs):
815
r = Client.checked_ok(self, *args, **kwargs)
816
# Emit D-Bus signal
817
self.PropertyChanged(
818
dbus.String(u"LastCheckedOK"),
819
(self._datetime_to_dbus(self.last_checked_ok,
820
variant_level=1)))
821
return r
822
823
def need_approval(self, *args, **kwargs):
824
r = Client.need_approval(self, *args, **kwargs)
825
# Emit D-Bus signal
826
self.PropertyChanged(
827
dbus.String(u"LastApprovalRequest"),
828
(self._datetime_to_dbus(self.last_approval_request,
829
variant_level=1)))
830
return r
831
832
982
def start_checker(self, *args, **kwargs):
833
983
old_checker = self.checker
834
984
if self.checker is not None:
841
991
and old_checker_pid != self.checker.pid):
842
992
# Emit D-Bus signal
843
993
self.CheckerStarted(self.current_checker_command)
844
self.PropertyChanged(
845
dbus.String(u"CheckerRunning"),
846
dbus.Boolean(True, variant_level=1))
847
994
return r
848
995
849
def stop_checker(self, *args, **kwargs):
850
old_checker = getattr(self, u"checker", None)
851
r = Client.stop_checker(self, *args, **kwargs)
852
if (old_checker is not None
853
and getattr(self, u"checker", None) is None):
854
self.PropertyChanged(dbus.String(u"CheckerRunning"),
855
dbus.Boolean(False, variant_level=1))
856
return r
857
858
996
def _reset_approved(self):
859
997
self._approved = None
860
998
return False
862
1000
def approve(self, value=True):
863
1001
self.send_changedstate()
864
1002
self._approved = value
865
gobject.timeout_add(self._timedelta_to_milliseconds
1003
gobject.timeout_add(_timedelta_to_milliseconds
866
1004
(self.approval_duration),
867
1005
self._reset_approved)
868
1006
869
1007
870
1008
## D-Bus methods, signals & properties
871
_interface = u"se.bsnet.fukt.Mandos.Client"
1009
_interface = "se.recompile.Mandos.Client"
872
1010
873
1011
## Signals
874
1012
875
1013
# CheckerCompleted - signal
876
@dbus.service.signal(_interface, signature=u"nxs")
1014
@dbus.service.signal(_interface, signature="nxs")
877
1015
def CheckerCompleted(self, exitcode, waitstatus, command):
878
1016
"D-Bus signal"
879
1017
pass
880
1018
881
1019
# CheckerStarted - signal
882
@dbus.service.signal(_interface, signature=u"s")
1020
@dbus.service.signal(_interface, signature="s")
883
1021
def CheckerStarted(self, command):
884
1022
"D-Bus signal"
885
1023
pass
886
1024
887
1025
# PropertyChanged - signal
888
@dbus.service.signal(_interface, signature=u"sv")
1026
@dbus.service.signal(_interface, signature="sv")
889
1027
def PropertyChanged(self, property, value):
890
1028
"D-Bus signal"
891
1029
pass
900
1038
pass
901
1039
902
1040
# Rejected - signal
903
@dbus.service.signal(_interface, signature=u"s")
1041
@dbus.service.signal(_interface, signature="s")
904
1042
def Rejected(self, reason):
905
1043
"D-Bus signal"
906
1044
pass
907
1045
908
1046
# NeedApproval - signal
909
@dbus.service.signal(_interface, signature=u"tb")
1047
@dbus.service.signal(_interface, signature="tb")
910
1048
def NeedApproval(self, timeout, default):
911
1049
"D-Bus signal"
912
1050
return self.need_approval()
914
1052
## Methods
915
1053
916
1054
# Approve - method
917
@dbus.service.method(_interface, in_signature=u"b")
1055
@dbus.service.method(_interface, in_signature="b")
918
1056
def Approve(self, value):
919
1057
self.approve(value)
920
1058
921
1059
# CheckedOK - method
922
1060
@dbus.service.method(_interface)
923
1061
def CheckedOK(self):
924
return self.checked_ok()
1062
self.checked_ok()
925
1063
926
1064
# Enable - method
927
1065
@dbus.service.method(_interface)
949
1087
## Properties
950
1088
951
1089
# ApprovalPending - property
952
@dbus_service_property(_interface, signature=u"b", access=u"read")
1090
@dbus_service_property(_interface, signature="b", access="read")
953
1091
def ApprovalPending_dbus_property(self):
954
1092
return dbus.Boolean(bool(self.approvals_pending))
955
1093
956
1094
# ApprovedByDefault - property
957
@dbus_service_property(_interface, signature=u"b",
958
access=u"readwrite")
1095
@dbus_service_property(_interface, signature="b",
1096
access="readwrite")
959
1097
def ApprovedByDefault_dbus_property(self, value=None):
960
1098
if value is None: # get
961
1099
return dbus.Boolean(self.approved_by_default)
962
1100
self.approved_by_default = bool(value)
963
# Emit D-Bus signal
964
self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
965
dbus.Boolean(value, variant_level=1))
966
1101
967
1102
# ApprovalDelay - property
968
@dbus_service_property(_interface, signature=u"t",
969
access=u"readwrite")
1103
@dbus_service_property(_interface, signature="t",
1104
access="readwrite")
970
1105
def ApprovalDelay_dbus_property(self, value=None):
971
1106
if value is None: # get
972
1107
return dbus.UInt64(self.approval_delay_milliseconds())
973
1108
self.approval_delay = datetime.timedelta(0, 0, 0, value)
974
# Emit D-Bus signal
975
self.PropertyChanged(dbus.String(u"ApprovalDelay"),
976
dbus.UInt64(value, variant_level=1))
977
1109
978
1110
# ApprovalDuration - property
979
@dbus_service_property(_interface, signature=u"t",
980
access=u"readwrite")
1111
@dbus_service_property(_interface, signature="t",
1112
access="readwrite")
981
1113
def ApprovalDuration_dbus_property(self, value=None):
982
1114
if value is None: # get
983
return dbus.UInt64(self._timedelta_to_milliseconds(
1115
return dbus.UInt64(_timedelta_to_milliseconds(
984
1116
self.approval_duration))
985
1117
self.approval_duration = datetime.timedelta(0, 0, 0, value)
986
# Emit D-Bus signal
987
self.PropertyChanged(dbus.String(u"ApprovalDuration"),
988
dbus.UInt64(value, variant_level=1))
989
1118
990
1119
# Name - property
991
@dbus_service_property(_interface, signature=u"s", access=u"read")
1120
@dbus_service_property(_interface, signature="s", access="read")
992
1121
def Name_dbus_property(self):
993
1122
return dbus.String(self.name)
994
1123
995
1124
# Fingerprint - property
996
@dbus_service_property(_interface, signature=u"s", access=u"read")
1125
@dbus_service_property(_interface, signature="s", access="read")
997
1126
def Fingerprint_dbus_property(self):
998
1127
return dbus.String(self.fingerprint)
999
1128
1000
1129
# Host - property
1001
@dbus_service_property(_interface, signature=u"s",
1002
access=u"readwrite")
1130
@dbus_service_property(_interface, signature="s",
1131
access="readwrite")
1003
1132
def Host_dbus_property(self, value=None):
1004
1133
if value is None: # get
1005
1134
return dbus.String(self.host)
1006
1135
self.host = value
1007
# Emit D-Bus signal
1008
self.PropertyChanged(dbus.String(u"Host"),
1009
dbus.String(value, variant_level=1))
1010
1136
1011
1137
# Created - property
1012
@dbus_service_property(_interface, signature=u"s", access=u"read")
1138
@dbus_service_property(_interface, signature="s", access="read")
1013
1139
def Created_dbus_property(self):
1014
return dbus.String(self._datetime_to_dbus(self.created))
1140
return dbus.String(datetime_to_dbus(self.created))
1015
1141
1016
1142
# LastEnabled - property
1017
@dbus_service_property(_interface, signature=u"s", access=u"read")
1143
@dbus_service_property(_interface, signature="s", access="read")
1018
1144
def LastEnabled_dbus_property(self):
1019
if self.last_enabled is None:
1020
return dbus.String(u"")
1021
return dbus.String(self._datetime_to_dbus(self.last_enabled))
1145
return datetime_to_dbus(self.last_enabled)
1022
1146
1023
1147
# Enabled - property
1024
@dbus_service_property(_interface, signature=u"b",
1025
access=u"readwrite")
1148
@dbus_service_property(_interface, signature="b",
1149
access="readwrite")
1026
1150
def Enabled_dbus_property(self, value=None):
1027
1151
if value is None: # get
1028
1152
return dbus.Boolean(self.enabled)
1032
1156
self.disable()
1033
1157
1034
1158
# LastCheckedOK - property
1035
@dbus_service_property(_interface, signature=u"s",
1036
access=u"readwrite")
1159
@dbus_service_property(_interface, signature="s",
1160
access="readwrite")
1037
1161
def LastCheckedOK_dbus_property(self, value=None):
1038
1162
if value is not None:
1039
1163
self.checked_ok()
1040
1164
return
1041
if self.last_checked_ok is None:
1042
return dbus.String(u"")
1043
return dbus.String(self._datetime_to_dbus(self
1044
.last_checked_ok))
1165
return datetime_to_dbus(self.last_checked_ok)
1166
1167
# Expires - property
1168
@dbus_service_property(_interface, signature="s", access="read")
1169
def Expires_dbus_property(self):
1170
return datetime_to_dbus(self.expires)
1045
1171
1046
1172
# LastApprovalRequest - property
1047
@dbus_service_property(_interface, signature=u"s", access=u"read")
1173
@dbus_service_property(_interface, signature="s", access="read")
1048
1174
def LastApprovalRequest_dbus_property(self):
1049
if self.last_approval_request is None:
1050
return dbus.String(u"")
1051
return dbus.String(self.
1052
_datetime_to_dbus(self
1053
.last_approval_request))
1175
return datetime_to_dbus(self.last_approval_request)
1054
1176
1055
1177
# Timeout - property
1056
@dbus_service_property(_interface, signature=u"t",
1057
access=u"readwrite")
1178
@dbus_service_property(_interface, signature="t",
1179
access="readwrite")
1058
1180
def Timeout_dbus_property(self, value=None):
1059
1181
if value is None: # get
1060
1182
return dbus.UInt64(self.timeout_milliseconds())
1061
1183
self.timeout = datetime.timedelta(0, 0, 0, value)
1062
# Emit D-Bus signal
1063
self.PropertyChanged(dbus.String(u"Timeout"),
1064
dbus.UInt64(value, variant_level=1))
1065
if getattr(self, u"disable_initiator_tag", None) is None:
1184
if getattr(self, "disable_initiator_tag", None) is None:
1066
1185
return
1067
1186
# Reschedule timeout
1068
1187
gobject.source_remove(self.disable_initiator_tag)
1069
1188
self.disable_initiator_tag = None
1189
self.expires = None
1070
1190
time_to_die = (self.
1071
1191
_timedelta_to_milliseconds((self
1072
1192
.last_checked_ok
1077
1197
# The timeout has passed
1078
1198
self.disable()
1079
1199
else:
1200
self.expires = (datetime.datetime.utcnow()
1201
+ datetime.timedelta(milliseconds =
1202
time_to_die))
1080
1203
self.disable_initiator_tag = (gobject.timeout_add
1081
1204
(time_to_die, self.disable))
1082
1205
1206
# ExtendedTimeout - property
1207
@dbus_service_property(_interface, signature="t",
1208
access="readwrite")
1209
def ExtendedTimeout_dbus_property(self, value=None):
1210
if value is None: # get
1211
return dbus.UInt64(self.extended_timeout_milliseconds())
1212
self.extended_timeout = datetime.timedelta(0, 0, 0, value)
1213
1083
1214
# Interval - property
1084
@dbus_service_property(_interface, signature=u"t",
1085
access=u"readwrite")
1215
@dbus_service_property(_interface, signature="t",
1216
access="readwrite")
1086
1217
def Interval_dbus_property(self, value=None):
1087
1218
if value is None: # get
1088
1219
return dbus.UInt64(self.interval_milliseconds())
1089
1220
self.interval = datetime.timedelta(0, 0, 0, value)
1090
# Emit D-Bus signal
1091
self.PropertyChanged(dbus.String(u"Interval"),
1092
dbus.UInt64(value, variant_level=1))
1093
if getattr(self, u"checker_initiator_tag", None) is None:
1221
if getattr(self, "checker_initiator_tag", None) is None:
1094
1222
return
1095
1223
# Reschedule checker run
1096
1224
gobject.source_remove(self.checker_initiator_tag)
1097
1225
self.checker_initiator_tag = (gobject.timeout_add
1098
1226
(value, self.start_checker))
1099
1227
self.start_checker() # Start one now, too
1100
1228
1101
1229
# Checker - property
1102
@dbus_service_property(_interface, signature=u"s",
1103
access=u"readwrite")
1230
@dbus_service_property(_interface, signature="s",
1231
access="readwrite")
1104
1232
def Checker_dbus_property(self, value=None):
1105
1233
if value is None: # get
1106
1234
return dbus.String(self.checker_command)
1107
1235
self.checker_command = value
1108
# Emit D-Bus signal
1109
self.PropertyChanged(dbus.String(u"Checker"),
1110
dbus.String(self.checker_command,
1111
variant_level=1))
1112
1236
1113
1237
# CheckerRunning - property
1114
@dbus_service_property(_interface, signature=u"b",
1115
access=u"readwrite")
1238
@dbus_service_property(_interface, signature="b",
1239
access="readwrite")
1116
1240
def CheckerRunning_dbus_property(self, value=None):
1117
1241
if value is None: # get
1118
1242
return dbus.Boolean(self.checker is not None)
1122
1246
self.stop_checker()
1123
1247
1124
1248
# ObjectPath - property
1125
@dbus_service_property(_interface, signature=u"o", access=u"read")
1249
@dbus_service_property(_interface, signature="o", access="read")
1126
1250
def ObjectPath_dbus_property(self):
1127
1251
return self.dbus_object_path # is already a dbus.ObjectPath
1128
1252
1129
1253
# Secret = property
1130
@dbus_service_property(_interface, signature=u"ay",
1131
access=u"write", byte_arrays=True)
1254
@dbus_service_property(_interface, signature="ay",
1255
access="write", byte_arrays=True)
1132
1256
def Secret_dbus_property(self, value):
1133
1257
self.secret = str(value)
1134
1258
1141
1265
self._pipe.send(('init', fpr, address))
1142
1266
if not self._pipe.recv():
1143
1267
raise KeyError()
1144
1268
1145
1269
def __getattribute__(self, name):
1146
1270
if(name == '_pipe'):
1147
1271
return super(ProxyClient, self).__getattribute__(name)
1154
1278
self._pipe.send(('funcall', name, args, kwargs))
1155
1279
return self._pipe.recv()[1]
1156
1280
return func
1157
1281
1158
1282
def __setattr__(self, name, value):
1159
1283
if(name == '_pipe'):
1160
1284
return super(ProxyClient, self).__setattr__(name, value)
1161
1285
self._pipe.send(('setattr', name, value))
1162
1286
1287
class ClientDBusTransitional(ClientDBus):
1288
__metaclass__ = AlternateDBusNamesMetaclass
1163
1289
1164
1290
class ClientHandler(socketserver.BaseRequestHandler, object):
1165
1291
"""A class to handle client connections.
1169
1295
1170
1296
def handle(self):
1171
1297
with contextlib.closing(self.server.child_pipe) as child_pipe:
1172
logger.info(u"TCP connection from: %s",
1298
logger.info("TCP connection from: %s",
1173
1299
unicode(self.client_address))
1174
logger.debug(u"Pipe FD: %d",
1300
logger.debug("Pipe FD: %d",
1175
1301
self.server.child_pipe.fileno())
1176
1302
1177
1303
session = (gnutls.connection
1178
1304
.ClientSession(self.request,
1179
1305
gnutls.connection
1180
1306
.X509Credentials()))
1181
1307
1182
1308
# Note: gnutls.connection.X509Credentials is really a
1183
1309
# generic GnuTLS certificate credentials object so long as
1184
1310
# no X.509 keys are added to it. Therefore, we can use it
1185
1311
# here despite using OpenPGP certificates.
1186
1187
#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
1188
# u"+AES-256-CBC", u"+SHA1",
1189
# u"+COMP-NULL", u"+CTYPE-OPENPGP",
1190
# u"+DHE-DSS"))
1312
1313
#priority = ':'.join(("NONE", "+VERS-TLS1.1",
1314
# "+AES-256-CBC", "+SHA1",
1315
# "+COMP-NULL", "+CTYPE-OPENPGP",
1316
# "+DHE-DSS"))
1191
1317
# Use a fallback default, since this MUST be set.
1192
1318
priority = self.server.gnutls_priority
1193
1319
if priority is None:
1194
priority = u"NORMAL"
1320
priority = "NORMAL"
1195
1321
(gnutls.library.functions
1196
1322
.gnutls_priority_set_direct(session._c_object,
1197
1323
priority, None))
1198
1324
1199
1325
# Start communication using the Mandos protocol
1200
1326
# Get protocol number
1201
1327
line = self.request.makefile().readline()
1202
logger.debug(u"Protocol version: %r", line)
1328
logger.debug("Protocol version: %r", line)
1203
1329
try:
1204
1330
if int(line.strip().split()[0]) > 1:
1205
1331
raise RuntimeError
1206
except (ValueError, IndexError, RuntimeError), error:
1207
logger.error(u"Unknown protocol version: %s", error)
1332
except (ValueError, IndexError, RuntimeError) as error:
1333
logger.error("Unknown protocol version: %s", error)
1208
1334
return
1209
1335
1210
1336
# Start GnuTLS connection
1211
1337
try:
1212
1338
session.handshake()
1213
except gnutls.errors.GNUTLSError, error:
1214
logger.warning(u"Handshake failed: %s", error)
1339
except gnutls.errors.GNUTLSError as error:
1340
logger.warning("Handshake failed: %s", error)
1215
1341
# Do not run session.bye() here: the session is not
1216
1342
# established. Just abandon the request.
1217
1343
return
1218
logger.debug(u"Handshake succeeded")
1219
1344
logger.debug("Handshake succeeded")
1345
1220
1346
approval_required = False
1221
1347
try:
1222
1348
try:
1223
1349
fpr = self.fingerprint(self.peer_certificate
1224
1350
(session))
1225
except (TypeError, gnutls.errors.GNUTLSError), error:
1226
logger.warning(u"Bad certificate: %s", error)
1351
except (TypeError,
1352
gnutls.errors.GNUTLSError) as error:
1353
logger.warning("Bad certificate: %s", error)
1227
1354
return
1228
logger.debug(u"Fingerprint: %s", fpr)
1229
1355
logger.debug("Fingerprint: %s", fpr)
1356
1230
1357
try:
1231
1358
client = ProxyClient(child_pipe, fpr,
1232
1359
self.client_address)
1240
1367
1241
1368
while True:
1242
1369
if not client.enabled:
1243
logger.warning(u"Client %s is disabled",
1370
logger.info("Client %s is disabled",
1244
1371
client.name)
1245
1372
if self.server.use_dbus:
1246
1373
# Emit D-Bus signal
1247
client.Rejected("Disabled")
1374
client.Rejected("Disabled")
1248
1375
return
1249
1376
1250
1377
if client._approved or not client.approval_delay:
1251
1378
#We are approved or approval is disabled
1252
1379
break
1253
1380
elif client._approved is None:
1254
logger.info(u"Client %s needs approval",
1381
logger.info("Client %s needs approval",
1255
1382
client.name)
1256
1383
if self.server.use_dbus:
1257
1384
# Emit D-Bus signal
1259
1386
client.approval_delay_milliseconds(),
1260
1387
client.approved_by_default)
1261
1388
else:
1262
logger.warning(u"Client %s was not approved",
1389
logger.warning("Client %s was not approved",
1263
1390
client.name)
1264
1391
if self.server.use_dbus:
1265
1392
# Emit D-Bus signal
1267
1394
return
1268
1395
1269
1396
#wait until timeout or approved
1270
#x = float(client._timedelta_to_milliseconds(delay))
1271
1397
time = datetime.datetime.now()
1272
1398
client.changedstate.acquire()
1273
client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
1399
(client.changedstate.wait
1400
(float(client._timedelta_to_milliseconds(delay)
1401
/ 1000)))
1274
1402
client.changedstate.release()
1275
1403
time2 = datetime.datetime.now()
1276
1404
if (time2 - time) >= delay:
1291
1419
while sent_size < len(client.secret):
1292
1420
try:
1293
1421
sent = session.send(client.secret[sent_size:])
1294
except (gnutls.errors.GNUTLSError), error:
1422
except gnutls.errors.GNUTLSError as error:
1295
1423
logger.warning("gnutls send failed")
1296
1424
return
1297
logger.debug(u"Sent: %d, remaining: %d",
1425
logger.debug("Sent: %d, remaining: %d",
1298
1426
sent, len(client.secret)
1299
1427
- (sent_size + sent))
1300
1428
sent_size += sent
1301
1302
logger.info(u"Sending secret to %s", client.name)
1303
# bump the timeout as if seen
1304
client.checked_ok()
1429
1430
logger.info("Sending secret to %s", client.name)
1431
# bump the timeout using extended_timeout
1432
client.checked_ok(client.extended_timeout)
1305
1433
if self.server.use_dbus:
1306
1434
# Emit D-Bus signal
1307
1435
client.GotSecret()
1311
1439
client.approvals_pending -= 1
1312
1440
try:
1313
1441
session.bye()
1314
except (gnutls.errors.GNUTLSError), error:
1442
except gnutls.errors.GNUTLSError as error:
1315
1443
logger.warning("GnuTLS bye failed")
1316
1444
1317
1445
@staticmethod
1328
1456
.gnutls_certificate_get_peers
1329
1457
(session._c_object, ctypes.byref(list_size)))
1330
1458
if not bool(cert_list) and list_size.value != 0:
1331
raise gnutls.errors.GNUTLSError(u"error getting peer"
1332
u" certificate")
1459
raise gnutls.errors.GNUTLSError("error getting peer"
1460
" certificate")
1333
1461
if list_size.value == 0:
1334
1462
return None
1335
1463
cert = cert_list[0]
1361
1489
if crtverify.value != 0:
1362
1490
gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1363
1491
raise (gnutls.errors.CertificateSecurityError
1364
(u"Verify failed"))
1492
("Verify failed"))
1365
1493
# New buffer for the fingerprint
1366
1494
buf = ctypes.create_string_buffer(20)
1367
1495
buf_len = ctypes.c_size_t()
1374
1502
# Convert the buffer to a Python bytestring
1375
1503
fpr = ctypes.string_at(buf, buf_len.value)
1376
1504
# Convert the bytestring to hexadecimal notation
1377
hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
1505
hex_fpr = ''.join("%02X" % ord(char) for char in fpr)
1378
1506
return hex_fpr
1379
1507
1380
1508
1386
1514
except:
1387
1515
self.handle_error(request, address)
1388
1516
self.close_request(request)
1389
1517
1390
1518
def process_request(self, request, address):
1391
1519
"""Start a new process to process the request."""
1392
multiprocessing.Process(target = self.sub_process_main,
1393
args = (request, address)).start()
1520
proc = multiprocessing.Process(target = self.sub_process_main,
1521
args = (request,
1522
address))
1523
proc.start()
1524
return proc
1525
1394
1526
1395
1527
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1396
1528
""" adds a pipe to the MixIn """
1400
1532
This function creates a new pipe in self.pipe
1401
1533
"""
1402
1534
parent_pipe, self.child_pipe = multiprocessing.Pipe()
1403
1404
super(MultiprocessingMixInWithPipe,
1405
self).process_request(request, client_address)
1535
1536
proc = MultiprocessingMixIn.process_request(self, request,
1537
client_address)
1406
1538
self.child_pipe.close()
1407
self.add_pipe(parent_pipe)
1408
1409
def add_pipe(self, parent_pipe):
1539
self.add_pipe(parent_pipe, proc)
1540
1541
def add_pipe(self, parent_pipe, proc):
1410
1542
"""Dummy function; override as necessary"""
1411
pass
1543
raise NotImplementedError
1544
1412
1545
1413
1546
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
1414
1547
socketserver.TCPServer, object):
1432
1565
bind to an address or port if they were not specified."""
1433
1566
if self.interface is not None:
1434
1567
if SO_BINDTODEVICE is None:
1435
logger.error(u"SO_BINDTODEVICE does not exist;"
1436
u" cannot bind to interface %s",
1568
logger.error("SO_BINDTODEVICE does not exist;"
1569
" cannot bind to interface %s",
1437
1570
self.interface)
1438
1571
else:
1439
1572
try:
1440
1573
self.socket.setsockopt(socket.SOL_SOCKET,
1441
1574
SO_BINDTODEVICE,
1442
1575
str(self.interface
1443
+ u'\0'))
1444
except socket.error, error:
1576
+ '\0'))
1577
except socket.error as error:
1445
1578
if error[0] == errno.EPERM:
1446
logger.error(u"No permission to"
1447
u" bind to interface %s",
1579
logger.error("No permission to"
1580
" bind to interface %s",
1448
1581
self.interface)
1449
1582
elif error[0] == errno.ENOPROTOOPT:
1450
logger.error(u"SO_BINDTODEVICE not available;"
1451
u" cannot bind to interface %s",
1583
logger.error("SO_BINDTODEVICE not available;"
1584
" cannot bind to interface %s",
1452
1585
self.interface)
1453
1586
else:
1454
1587
raise
1456
1589
if self.server_address[0] or self.server_address[1]:
1457
1590
if not self.server_address[0]:
1458
1591
if self.address_family == socket.AF_INET6:
1459
any_address = u"::" # in6addr_any
1592
any_address = "::" # in6addr_any
1460
1593
else:
1461
1594
any_address = socket.INADDR_ANY
1462
1595
self.server_address = (any_address,
1499
1632
def server_activate(self):
1500
1633
if self.enabled:
1501
1634
return socketserver.TCPServer.server_activate(self)
1635
1502
1636
def enable(self):
1503
1637
self.enabled = True
1504
def add_pipe(self, parent_pipe):
1638
1639
def add_pipe(self, parent_pipe, proc):
1505
1640
# Call "handle_ipc" for both data and EOF events
1506
1641
gobject.io_add_watch(parent_pipe.fileno(),
1507
1642
gobject.IO_IN | gobject.IO_HUP,
1508
1643
functools.partial(self.handle_ipc,
1509
parent_pipe = parent_pipe))
1510
1644
parent_pipe =
1645
parent_pipe,
1646
proc = proc))
1647
1511
1648
def handle_ipc(self, source, condition, parent_pipe=None,
1512
client_object=None):
1649
proc = None, client_object=None):
1513
1650
condition_names = {
1514
gobject.IO_IN: u"IN", # There is data to read.
1515
gobject.IO_OUT: u"OUT", # Data can be written (without
1651
gobject.IO_IN: "IN", # There is data to read.
1652
gobject.IO_OUT: "OUT", # Data can be written (without
1516
1653
# blocking).
1517
gobject.IO_PRI: u"PRI", # There is urgent data to read.
1518
gobject.IO_ERR: u"ERR", # Error condition.
1519
gobject.IO_HUP: u"HUP" # Hung up (the connection has been
1654
gobject.IO_PRI: "PRI", # There is urgent data to read.
1655
gobject.IO_ERR: "ERR", # Error condition.
1656
gobject.IO_HUP: "HUP" # Hung up (the connection has been
1520
1657
# broken, usually for pipes and
1521
1658
# sockets).
1522
1659
}
1524
1661
for cond, name in
1525
1662
condition_names.iteritems()
1526
1663
if cond & condition)
1527
# error or the other end of multiprocessing.Pipe has closed
1664
# error, or the other end of multiprocessing.Pipe has closed
1528
1665
if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
1666
# Wait for other process to exit
1667
proc.join()
1529
1668
return False
1530
1669
1531
1670
# Read a request from the child
1541
1680
client = c
1542
1681
break
1543
1682
else:
1544
logger.warning(u"Client not found for fingerprint: %s, ad"
1545
u"dress: %s", fpr, address)
1683
logger.info("Client not found for fingerprint: %s, ad"
1684
"dress: %s", fpr, address)
1546
1685
if self.use_dbus:
1547
1686
# Emit D-Bus signal
1548
mandos_dbus_service.ClientNotFound(fpr, address[0])
1687
mandos_dbus_service.ClientNotFound(fpr,
1688
address[0])
1549
1689
parent_pipe.send(False)
1550
1690
return False
1551
1691
1552
1692
gobject.io_add_watch(parent_pipe.fileno(),
1553
1693
gobject.IO_IN | gobject.IO_HUP,
1554
1694
functools.partial(self.handle_ipc,
1555
parent_pipe = parent_pipe,
1556
client_object = client))
1695
parent_pipe =
1696
parent_pipe,
1697
proc = proc,
1698
client_object =
1699
client))
1557
1700
parent_pipe.send(True)
1558
# remove the old hook in favor of the new above hook on same fileno
1701
# remove the old hook in favor of the new above hook on
1702
# same fileno
1559
1703
return False
1560
1704
if command == 'funcall':
1561
1705
funcname = request[1]
1562
1706
args = request[2]
1563
1707
kwargs = request[3]
1564
1708
1565
parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
1566
1709
parent_pipe.send(('data', getattr(client_object,
1710
funcname)(*args,
1711
**kwargs)))
1712
1567
1713
if command == 'getattr':
1568
1714
attrname = request[1]
1569
1715
if callable(client_object.__getattribute__(attrname)):
1570
1716
parent_pipe.send(('function',))
1571
1717
else:
1572
parent_pipe.send(('data', client_object.__getattribute__(attrname)))
1718
parent_pipe.send(('data', client_object
1719
.__getattribute__(attrname)))
1573
1720
1574
1721
if command == 'setattr':
1575
1722
attrname = request[1]
1576
1723
value = request[2]
1577
1724
setattr(client_object, attrname, value)
1578
1725
1579
1726
return True
1580
1727
1581
1728
1582
1729
def string_to_delta(interval):
1583
1730
"""Parse a string and return a datetime.timedelta
1584
1731
1585
>>> string_to_delta(u'7d')
1732
>>> string_to_delta('7d')
1586
1733
datetime.timedelta(7)
1587
>>> string_to_delta(u'60s')
1734
>>> string_to_delta('60s')
1588
1735
datetime.timedelta(0, 60)
1589
>>> string_to_delta(u'60m')
1736
>>> string_to_delta('60m')
1590
1737
datetime.timedelta(0, 3600)
1591
>>> string_to_delta(u'24h')
1738
>>> string_to_delta('24h')
1592
1739
datetime.timedelta(1)
1593
>>> string_to_delta(u'1w')
1740
>>> string_to_delta('1w')
1594
1741
datetime.timedelta(7)
1595
>>> string_to_delta(u'5m 30s')
1742
>>> string_to_delta('5m 30s')
1596
1743
datetime.timedelta(0, 330)
1597
1744
"""
1598
1745
timevalue = datetime.timedelta(0)
1600
1747
try:
1601
1748
suffix = unicode(s[-1])
1602
1749
value = int(s[:-1])
1603
if suffix == u"d":
1750
if suffix == "d":
1604
1751
delta = datetime.timedelta(value)
1605
elif suffix == u"s":
1752
elif suffix == "s":
1606
1753
delta = datetime.timedelta(0, value)
1607
elif suffix == u"m":
1754
elif suffix == "m":
1608
1755
delta = datetime.timedelta(0, 0, 0, 0, value)
1609
elif suffix == u"h":
1756
elif suffix == "h":
1610
1757
delta = datetime.timedelta(0, 0, 0, 0, 0, value)
1611
elif suffix == u"w":
1758
elif suffix == "w":
1612
1759
delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
1613
1760
else:
1614
raise ValueError(u"Unknown suffix %r" % suffix)
1615
except (ValueError, IndexError), e:
1616
raise ValueError(e.message)
1761
raise ValueError("Unknown suffix %r" % suffix)
1762
except (ValueError, IndexError) as e:
1763
raise ValueError(*(e.args))
1617
1764
timevalue += delta
1618
1765
return timevalue
1619
1766
1625
1772
global if_nametoindex
1626
1773
try:
1627
1774
if_nametoindex = (ctypes.cdll.LoadLibrary
1628
(ctypes.util.find_library(u"c"))
1775
(ctypes.util.find_library("c"))
1629
1776
.if_nametoindex)
1630
1777
except (OSError, AttributeError):
1631
logger.warning(u"Doing if_nametoindex the hard way")
1778
logger.warning("Doing if_nametoindex the hard way")
1632
1779
def if_nametoindex(interface):
1633
1780
"Get an interface index the hard way, i.e. using fcntl()"
1634
1781
SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h
1635
1782
with contextlib.closing(socket.socket()) as s:
1636
1783
ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
1637
struct.pack(str(u"16s16x"),
1784
struct.pack(str("16s16x"),
1638
1785
interface))
1639
interface_index = struct.unpack(str(u"I"),
1786
interface_index = struct.unpack(str("I"),
1640
1787
ifreq[16:20])[0]
1641
1788
return interface_index
1642
1789
return if_nametoindex(interface)
1650
1797
sys.exit()
1651
1798
os.setsid()
1652
1799
if not nochdir:
1653
os.chdir(u"/")
1800
os.chdir("/")
1654
1801
if os.fork():
1655
1802
sys.exit()
1656
1803
if not noclose:
1658
1805
null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
1659
1806
if not stat.S_ISCHR(os.fstat(null).st_mode):
1660
1807
raise OSError(errno.ENODEV,
1661
u"%s not a character device"
1808
"%s not a character device"
1662
1809
% os.path.devnull)
1663
1810
os.dup2(null, sys.stdin.fileno())
1664
1811
os.dup2(null, sys.stdout.fileno())
1672
1819
##################################################################
1673
1820
# Parsing of options, both command line and config file
1674
1821
1675
parser = optparse.OptionParser(version = "%%prog %s" % version)
1676
parser.add_option("-i", u"--interface", type=u"string",
1677
metavar="IF", help=u"Bind to interface IF")
1678
parser.add_option("-a", u"--address", type=u"string",
1679
help=u"Address to listen for requests on")
1680
parser.add_option("-p", u"--port", type=u"int",
1681
help=u"Port number to receive requests on")
1682
parser.add_option("--check", action=u"store_true",
1683
help=u"Run self-test")
1684
parser.add_option("--debug", action=u"store_true",
1685
help=u"Debug mode; run in foreground and log to"
1686
u" terminal")
1687
parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",
1688
help=u"Debug level for stdout output")
1689
parser.add_option("--priority", type=u"string", help=u"GnuTLS"
1690
u" priority string (see GnuTLS documentation)")
1691
parser.add_option("--servicename", type=u"string",
1692
metavar=u"NAME", help=u"Zeroconf service name")
1693
parser.add_option("--configdir", type=u"string",
1694
default=u"/etc/mandos", metavar=u"DIR",
1695
help=u"Directory to search for configuration"
1696
u" files")
1697
parser.add_option("--no-dbus", action=u"store_false",
1698
dest=u"use_dbus", help=u"Do not provide D-Bus"
1699
u" system bus interface")
1700
parser.add_option("--no-ipv6", action=u"store_false",
1701
dest=u"use_ipv6", help=u"Do not use IPv6")
1702
options = parser.parse_args()[0]
1822
parser = argparse.ArgumentParser()
1823
parser.add_argument("-v", "--version", action="version",
1824
version = "%%(prog)s %s" % version,
1825
help="show version number and exit")
1826
parser.add_argument("-i", "--interface", metavar="IF",
1827
help="Bind to interface IF")
1828
parser.add_argument("-a", "--address",
1829
help="Address to listen for requests on")
1830
parser.add_argument("-p", "--port", type=int,
1831
help="Port number to receive requests on")
1832
parser.add_argument("--check", action="store_true",
1833
help="Run self-test")
1834
parser.add_argument("--debug", action="store_true",
1835
help="Debug mode; run in foreground and log"
1836
" to terminal")
1837
parser.add_argument("--debuglevel", metavar="LEVEL",
1838
help="Debug level for stdout output")
1839
parser.add_argument("--priority", help="GnuTLS"
1840
" priority string (see GnuTLS documentation)")
1841
parser.add_argument("--servicename",
1842
metavar="NAME", help="Zeroconf service name")
1843
parser.add_argument("--configdir",
1844
default="/etc/mandos", metavar="DIR",
1845
help="Directory to search for configuration"
1846
" files")
1847
parser.add_argument("--no-dbus", action="store_false",
1848
dest="use_dbus", help="Do not provide D-Bus"
1849
" system bus interface")
1850
parser.add_argument("--no-ipv6", action="store_false",
1851
dest="use_ipv6", help="Do not use IPv6")
1852
options = parser.parse_args()
1703
1853
1704
1854
if options.check:
1705
1855
import doctest
1707
1857
sys.exit()
1708
1858
1709
1859
# Default values for config file for server-global settings
1710
server_defaults = { u"interface": u"",
1711
u"address": u"",
1712
u"port": u"",
1713
u"debug": u"False",
1714
u"priority":
1715
u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1716
u"servicename": u"Mandos",
1717
u"use_dbus": u"True",
1718
u"use_ipv6": u"True",
1719
u"debuglevel": u"",
1860
server_defaults = { "interface": "",
1861
"address": "",
1862
"port": "",
1863
"debug": "False",
1864
"priority":
1865
"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
1866
"servicename": "Mandos",
1867
"use_dbus": "True",
1868
"use_ipv6": "True",
1869
"debuglevel": "",
1720
1870
}
1721
1871
1722
1872
# Parse config file for server-global settings
1723
1873
server_config = configparser.SafeConfigParser(server_defaults)
1724
1874
del server_defaults
1725
1875
server_config.read(os.path.join(options.configdir,
1726
u"mandos.conf"))
1876
"mandos.conf"))
1727
1877
# Convert the SafeConfigParser object to a dict
1728
1878
server_settings = server_config.defaults()
1729
1879
# Use the appropriate methods on the non-string config options
1730
for option in (u"debug", u"use_dbus", u"use_ipv6"):
1731
server_settings[option] = server_config.getboolean(u"DEFAULT",
1880
for option in ("debug", "use_dbus", "use_ipv6"):
1881
server_settings[option] = server_config.getboolean("DEFAULT",
1732
1882
option)
1733
1883
if server_settings["port"]:
1734
server_settings["port"] = server_config.getint(u"DEFAULT",
1735
u"port")
1884
server_settings["port"] = server_config.getint("DEFAULT",
1885
"port")
1736
1886
del server_config
1737
1887
1738
1888
# Override the settings from the config file with command line
1739
1889
# options, if set.
1740
for option in (u"interface", u"address", u"port", u"debug",
1741
u"priority", u"servicename", u"configdir",
1742
u"use_dbus", u"use_ipv6", u"debuglevel"):
1890
for option in ("interface", "address", "port", "debug",
1891
"priority", "servicename", "configdir",
1892
"use_dbus", "use_ipv6", "debuglevel"):
1743
1893
value = getattr(options, option)
1744
1894
if value is not None:
1745
1895
server_settings[option] = value
1753
1903
##################################################################
1754
1904
1755
1905
# For convenience
1756
debug = server_settings[u"debug"]
1757
debuglevel = server_settings[u"debuglevel"]
1758
use_dbus = server_settings[u"use_dbus"]
1759
use_ipv6 = server_settings[u"use_ipv6"]
1760
1761
if server_settings[u"servicename"] != u"Mandos":
1906
debug = server_settings["debug"]
1907
debuglevel = server_settings["debuglevel"]
1908
use_dbus = server_settings["use_dbus"]
1909
use_ipv6 = server_settings["use_ipv6"]
1910
1911
if server_settings["servicename"] != "Mandos":
1762
1912
syslogger.setFormatter(logging.Formatter
1763
(u'Mandos (%s) [%%(process)d]:'
1764
u' %%(levelname)s: %%(message)s'
1765
% server_settings[u"servicename"]))
1913
('Mandos (%s) [%%(process)d]:'
1914
' %%(levelname)s: %%(message)s'
1915
% server_settings["servicename"]))
1766
1916
1767
1917
# Parse config file with clients
1768
client_defaults = { u"timeout": u"1h",
1769
u"interval": u"5m",
1770
u"checker": u"fping -q -- %%(host)s",
1771
u"host": u"",
1772
u"approval_delay": u"0s",
1773
u"approval_duration": u"1s",
1918
client_defaults = { "timeout": "5m",
1919
"extended_timeout": "15m",
1920
"interval": "2m",
1921
"checker": "fping -q -- %%(host)s",
1922
"host": "",
1923
"approval_delay": "0s",
1924
"approval_duration": "1s",
1774
1925
}
1775
1926
client_config = configparser.SafeConfigParser(client_defaults)
1776
client_config.read(os.path.join(server_settings[u"configdir"],
1777
u"clients.conf"))
1927
client_config.read(os.path.join(server_settings["configdir"],
1928
"clients.conf"))
1778
1929
1779
1930
global mandos_dbus_service
1780
1931
mandos_dbus_service = None
1781
1932
1782
tcp_server = MandosServer((server_settings[u"address"],
1783
server_settings[u"port"]),
1933
tcp_server = MandosServer((server_settings["address"],
1934
server_settings["port"]),
1784
1935
ClientHandler,
1785
interface=(server_settings[u"interface"]
1936
interface=(server_settings["interface"]
1786
1937
or None),
1787
1938
use_ipv6=use_ipv6,
1788
1939
gnutls_priority=
1789
server_settings[u"priority"],
1940
server_settings["priority"],
1790
1941
use_dbus=use_dbus)
1791
1942
if not debug:
1792
pidfilename = u"/var/run/mandos.pid"
1943
pidfilename = "/var/run/mandos.pid"
1793
1944
try:
1794
pidfile = open(pidfilename, u"w")
1945
pidfile = open(pidfilename, "w")
1795
1946
except IOError:
1796
logger.error(u"Could not open file %r", pidfilename)
1947
logger.error("Could not open file %r", pidfilename)
1797
1948
1798
1949
try:
1799
uid = pwd.getpwnam(u"_mandos").pw_uid
1800
gid = pwd.getpwnam(u"_mandos").pw_gid
1950
uid = pwd.getpwnam("_mandos").pw_uid
1951
gid = pwd.getpwnam("_mandos").pw_gid
1801
1952
except KeyError:
1802
1953
try:
1803
uid = pwd.getpwnam(u"mandos").pw_uid
1804
gid = pwd.getpwnam(u"mandos").pw_gid
1954
uid = pwd.getpwnam("mandos").pw_uid
1955
gid = pwd.getpwnam("mandos").pw_gid
1805
1956
except KeyError:
1806
1957
try:
1807
uid = pwd.getpwnam(u"nobody").pw_uid
1808
gid = pwd.getpwnam(u"nobody").pw_gid
1958
uid = pwd.getpwnam("nobody").pw_uid
1959
gid = pwd.getpwnam("nobody").pw_gid
1809
1960
except KeyError:
1810
1961
uid = 65534
1811
1962
gid = 65534
1812
1963
try:
1813
1964
os.setgid(gid)
1814
1965
os.setuid(uid)
1815
except OSError, error:
1966
except OSError as error:
1816
1967
if error[0] != errno.EPERM:
1817
1968
raise error
1818
1969
1823
1974
level = getattr(logging, debuglevel.upper())
1824
1975
syslogger.setLevel(level)
1825
1976
console.setLevel(level)
1826
1977
1827
1978
if debug:
1828
1979
# Enable all possible GnuTLS debugging
1829
1980
1833
1984
1834
1985
@gnutls.library.types.gnutls_log_func
1835
1986
def debug_gnutls(level, string):
1836
logger.debug(u"GnuTLS: %s", string[:-1])
1987
logger.debug("GnuTLS: %s", string[:-1])
1837
1988
1838
1989
(gnutls.library.functions
1839
1990
.gnutls_global_set_log_function(debug_gnutls))
1847
1998
# No console logging
1848
1999
logger.removeHandler(console)
1849
2000
2001
# Need to fork before connecting to D-Bus
2002
if not debug:
2003
# Close all input and output, do double fork, etc.
2004
daemon()
1850
2005
1851
2006
global main_loop
1852
2007
# From the Avahi example code
1856
2011
# End of Avahi example code
1857
2012
if use_dbus:
1858
2013
try:
1859
bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
2014
bus_name = dbus.service.BusName("se.recompile.Mandos",
1860
2015
bus, do_not_queue=True)
1861
except dbus.exceptions.NameExistsException, e:
1862
logger.error(unicode(e) + u", disabling D-Bus")
2016
old_bus_name = (dbus.service.BusName
2017
("se.bsnet.fukt.Mandos", bus,
2018
do_not_queue=True))
2019
except dbus.exceptions.NameExistsException as e:
2020
logger.error(unicode(e) + ", disabling D-Bus")
1863
2021
use_dbus = False
1864
server_settings[u"use_dbus"] = False
2022
server_settings["use_dbus"] = False
1865
2023
tcp_server.use_dbus = False
1866
2024
protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
1867
service = AvahiService(name = server_settings[u"servicename"],
1868
servicetype = u"_mandos._tcp",
2025
service = AvahiService(name = server_settings["servicename"],
2026
servicetype = "_mandos._tcp",
1869
2027
protocol = protocol, bus = bus)
1870
2028
if server_settings["interface"]:
1871
2029
service.interface = (if_nametoindex
1872
(str(server_settings[u"interface"])))
1873
1874
if not debug:
1875
# Close all input and output, do double fork, etc.
1876
daemon()
1877
2030
(str(server_settings["interface"])))
2031
1878
2032
global multiprocessing_manager
1879
2033
multiprocessing_manager = multiprocessing.Manager()
1880
2034
1881
2035
client_class = Client
1882
2036
if use_dbus:
1883
client_class = functools.partial(ClientDBus, bus = bus)
2037
client_class = functools.partial(ClientDBusTransitional,
2038
bus = bus)
1884
2039
def client_config_items(config, section):
1885
2040
special_settings = {
1886
2041
"approved_by_default":
1899
2054
client_config, section)))
1900
2055
for section in client_config.sections()))
1901
2056
if not tcp_server.clients:
1902
logger.warning(u"No clients defined")
2057
logger.warning("No clients defined")
1903
2058
1904
2059
if not debug:
1905
2060
try:
1906
2061
with pidfile:
1907
2062
pid = os.getpid()
1908
pidfile.write(str(pid) + "\n")
2063
pidfile.write(str(pid) + "\n".encode("utf-8"))
1909
2064
del pidfile
1910
2065
except IOError:
1911
logger.error(u"Could not write to file %r with PID %d",
2066
logger.error("Could not write to file %r with PID %d",
1912
2067
pidfilename, pid)
1913
2068
except NameError:
1914
2069
# "pidfile" was never created
1916
2071
del pidfilename
1917
2072
1918
2073
signal.signal(signal.SIGINT, signal.SIG_IGN)
1919
2074
1920
2075
signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
1921
2076
signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
1922
2077
1924
2079
class MandosDBusService(dbus.service.Object):
1925
2080
"""A D-Bus proxy object"""
1926
2081
def __init__(self):
1927
dbus.service.Object.__init__(self, bus, u"/")
1928
_interface = u"se.bsnet.fukt.Mandos"
2082
dbus.service.Object.__init__(self, bus, "/")
2083
_interface = "se.recompile.Mandos"
1929
2084
1930
@dbus.service.signal(_interface, signature=u"o")
2085
@dbus.service.signal(_interface, signature="o")
1931
2086
def ClientAdded(self, objpath):
1932
2087
"D-Bus signal"
1933
2088
pass
1934
2089
1935
@dbus.service.signal(_interface, signature=u"ss")
2090
@dbus.service.signal(_interface, signature="ss")
1936
2091
def ClientNotFound(self, fingerprint, address):
1937
2092
"D-Bus signal"
1938
2093
pass
1939
2094
1940
@dbus.service.signal(_interface, signature=u"os")
2095
@dbus.service.signal(_interface, signature="os")
1941
2096
def ClientRemoved(self, objpath, name):
1942
2097
"D-Bus signal"
1943
2098
pass
1944
2099
1945
@dbus.service.method(_interface, out_signature=u"ao")
2100
@dbus.service.method(_interface, out_signature="ao")
1946
2101
def GetAllClients(self):
1947
2102
"D-Bus method"
1948
2103
return dbus.Array(c.dbus_object_path
1949
2104
for c in tcp_server.clients)
1950
2105
1951
2106
@dbus.service.method(_interface,
1952
out_signature=u"a{oa{sv}}")
2107
out_signature="a{oa{sv}}")
1953
2108
def GetAllClientsWithProperties(self):
1954
2109
"D-Bus method"
1955
2110
return dbus.Dictionary(
1956
((c.dbus_object_path, c.GetAll(u""))
2111
((c.dbus_object_path, c.GetAll(""))
1957
2112
for c in tcp_server.clients),
1958
signature=u"oa{sv}")
2113
signature="oa{sv}")
1959
2114
1960
@dbus.service.method(_interface, in_signature=u"o")
2115
@dbus.service.method(_interface, in_signature="o")
1961
2116
def RemoveClient(self, object_path):
1962
2117
"D-Bus method"
1963
2118
for c in tcp_server.clients:
1973
2128
1974
2129
del _interface
1975
2130
1976
mandos_dbus_service = MandosDBusService()
2131
class MandosDBusServiceTransitional(MandosDBusService):
2132
__metaclass__ = AlternateDBusNamesMetaclass
2133
mandos_dbus_service = MandosDBusServiceTransitional()
1977
2134
1978
2135
def cleanup():
1979
2136
"Cleanup function; run on exit"
1980
2137
service.cleanup()
1981
2138
2139
multiprocessing.active_children()
1982
2140
while tcp_server.clients:
1983
2141
client = tcp_server.clients.pop()
1984
2142
if use_dbus:
1988
2146
client.disable(quiet=True)
1989
2147
if use_dbus:
1990
2148
# Emit D-Bus signal
1991
mandos_dbus_service.ClientRemoved(client.dbus_object_path,
2149
mandos_dbus_service.ClientRemoved(client
2150
.dbus_object_path,
1992
2151
client.name)
1993
2152
1994
2153
atexit.register(cleanup)
2005
2164
# Find out what port we got
2006
2165
service.port = tcp_server.socket.getsockname()[1]
2007
2166
if use_ipv6:
2008
logger.info(u"Now listening on address %r, port %d,"
2167
logger.info("Now listening on address %r, port %d,"
2009
2168
" flowinfo %d, scope_id %d"
2010
2169
% tcp_server.socket.getsockname())
2011
2170
else: # IPv4
2012
logger.info(u"Now listening on address %r, port %d"
2171
logger.info("Now listening on address %r, port %d"
2013
2172
% tcp_server.socket.getsockname())
2014
2173
2015
2174
#service.interface = tcp_server.socket.getsockname()[3]
2018
2177
# From the Avahi example code
2019
2178
try:
2020
2179
service.activate()
2021
except dbus.exceptions.DBusException, error:
2022
logger.critical(u"DBusException: %s", error)
2180
except dbus.exceptions.DBusException as error:
2181
logger.critical("DBusException: %s", error)
2023
2182
cleanup()
2024
2183
sys.exit(1)
2025
2184
# End of Avahi example code
2029
2188
(tcp_server.handle_request
2030
2189
(*args[2:], **kwargs) or True))
2031
2190
2032
logger.debug(u"Starting main loop")
2191
logger.debug("Starting main loop")
2033
2192
main_loop.run()
2034
except AvahiError, error:
2035
logger.critical(u"AvahiError: %s", error)
2193
except AvahiError as error:
2194
logger.critical("AvahiError: %s", error)
2036
2195
cleanup()
2037
2196
sys.exit(1)
2038
2197
except KeyboardInterrupt:
2039
2198
if debug:
2040
print >> sys.stderr
2041
logger.debug(u"Server received KeyboardInterrupt")
2042
logger.debug(u"Server exiting")
2199
print("", file=sys.stderr)
2200
logger.debug("Server received KeyboardInterrupt")
2201
logger.debug("Server exiting")
2043
2202
# Must run before the D-Bus bus name gets deregistered
2044
2203
cleanup()
2045
2204
2205
2046
2206
if __name__ == '__main__':
2047
2207
main()
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0