/mandos/release : revision 237.11.1

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

61

62

import functools

62

63

import cPickle as pickle

63

64

import multiprocessing

65

import types

64

66

65

67

import dbus

66

68

import dbus.service

81

83

SO_BINDTODEVICE = None

82

84

83

85

84

version = "1.0.14"

86

version = "1.3.1"

85

87

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

88

90

syslogger = (logging.handlers.SysLogHandler

89

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

90

address = "/dev/log"))

92

address = str("/dev/log")))

91

93

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

94

96

logger.addHandler(syslogger)

95

97

96

98

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

100

102

logger.addHandler(console)

101

103

102

104

class AvahiError(Exception):

119

121

Attributes:

120

122

interface: integer; avahi.IF_UNSPEC or an interface index.

121

123

Used to optionally bind to the specified interface.

122

name: string; Example: u'Mandos'

123

type: string; Example: u'_mandos._tcp'.

124

name: string; Example: 'Mandos'

125

type: string; Example: '_mandos._tcp'.

124

126

See <http://www.dns-sd.org/ServiceTypes.html>

125

127

port: integer; what port to announce

126

128

TXT: list of strings; TXT record for the service

135

137

"""

136

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

137

139

servicetype = None, port = None, TXT = None,

138

domain = u"", host = u"", max_renames = 32768,

140

domain = "", host = "", max_renames = 32768,

139

141

protocol = avahi.PROTO_UNSPEC, bus = None):

140

142

self.interface = interface

141

143

self.name = name

150

152

self.group = None # our entry group

151

153

self.server = None

152

154

self.bus = bus

155

self.entry_group_state_changed_match = None

153

156

def rename(self):

154

157

"""Derived from the Avahi example code"""

155

158

if self.rename_count >= self.max_renames:

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

158

161

self.rename_count)

159

raise AvahiServiceError(u"Too many renames")

162

raise AvahiServiceError("Too many renames")

160

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

164

logger.info("Changing Zeroconf service name to %r ...",

162

165

self.name)

163

166

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

166

169

% self.name))

167

170

self.remove()

168

171

try:

169

172

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

173

except dbus.exceptions.DBusException as error:

174

logger.critical("DBusException: %s", error)

172

175

self.cleanup()

173

176

os._exit(1)

174

177

self.rename_count += 1

175

178

def remove(self):

176

179

"""Derived from the Avahi example code"""

180

if self.entry_group_state_changed_match is not None:

181

self.entry_group_state_changed_match.remove()

182

self.entry_group_state_changed_match = None

177

183

if self.group is not None:

178

184

self.group.Reset()

179

185

def add(self):

180

186

"""Derived from the Avahi example code"""

187

self.remove()

181

188

if self.group is None:

182

189

self.group = dbus.Interface(

183

190

self.bus.get_object(avahi.DBUS_NAME,

184

191

self.server.EntryGroupNew()),

185

192

avahi.DBUS_INTERFACE_ENTRY_GROUP)

186

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

193

self.entry_group_state_changed_match = (

194

self.group.connect_to_signal(

195

'StateChanged', self .entry_group_state_changed))

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

190

197

self.name, self.type)

191

198

self.group.AddService(

192

199

self.interface,

199

206

self.group.Commit()

200

207

def entry_group_state_changed(self, state, error):

201

208

"""Derived from the Avahi example code"""

202

logger.debug(u"Avahi entry group state change: %i", state)

209

logger.debug("Avahi entry group state change: %i", state)

203

210

204

211

if state == avahi.ENTRY_GROUP_ESTABLISHED:

205

logger.debug(u"Zeroconf service established.")

212

logger.debug("Zeroconf service established.")

206

213

elif state == avahi.ENTRY_GROUP_COLLISION:

207

logger.warning(u"Zeroconf service name collision.")

214

logger.info("Zeroconf service name collision.")

208

215

self.rename()

209

216

elif state == avahi.ENTRY_GROUP_FAILURE:

210

logger.critical(u"Avahi: Error in group state changed %s",

217

logger.critical("Avahi: Error in group state changed %s",

211

218

unicode(error))

212

raise AvahiGroupError(u"State changed: %s"

219

raise AvahiGroupError("State changed: %s"

213

220

% unicode(error))

214

221

def cleanup(self):

215

222

"""Derived from the Avahi example code"""

216

223

if self.group is not None:

217

self.group.Free()

224

try:

225

self.group.Free()

226

except (dbus.exceptions.UnknownMethodException,

227

dbus.exceptions.DBusException) as e:

228

pass

218

229

self.group = None

219

def server_state_changed(self, state):

230

self.remove()

231

def server_state_changed(self, state, error=None):

220

232

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

222

if state == avahi.SERVER_COLLISION:

223

logger.error(u"Zeroconf server name collision")

224

self.remove()

233

logger.debug("Avahi server state change: %i", state)

234

bad_states = { avahi.SERVER_INVALID:

235

"Zeroconf server invalid",

236

avahi.SERVER_REGISTERING: None,

237

avahi.SERVER_COLLISION:

238

"Zeroconf server name collision",

239

avahi.SERVER_FAILURE:

240

"Zeroconf server failure" }

241

if state in bad_states:

242

if bad_states[state] is not None:

243

if error is None:

244

logger.error(bad_states[state])

245

else:

246

logger.error(bad_states[state] + ": %r", error)

247

self.cleanup()

225

248

elif state == avahi.SERVER_RUNNING:

226

249

self.add()

250

else:

251

if error is None:

252

logger.debug("Unknown state: %r", state)

253

else:

254

logger.debug("Unknown state: %r: %r", state, error)

227

255

def activate(self):

228

256

"""Derived from the Avahi example code"""

229

257

if self.server is None:

230

258

self.server = dbus.Interface(

231

259

self.bus.get_object(avahi.DBUS_NAME,

232

avahi.DBUS_PATH_SERVER),

260

avahi.DBUS_PATH_SERVER,

261

follow_name_owner_changes=True),

233

262

avahi.DBUS_INTERFACE_SERVER)

234

self.server.connect_to_signal(u"StateChanged",

263

self.server.connect_to_signal("StateChanged",

235

264

self.server_state_changed)

236

265

self.server_state_changed(self.server.GetState())

237

266

238

267

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

239

274

class Client(object):

240

275

"""A representation of a client host served by this server.

241

276

269

304

secret: bytestring; sent verbatim (over TLS) to client

270

305

timeout: datetime.timedelta(); How long from last_checked_ok

271

306

until this client is disabled

307

extended_timeout: extra long timeout when password has been sent

272

308

runtime_expansions: Allowed attributes for runtime expansion.

309

expires: datetime.datetime(); time (UTC) when a client will be

310

disabled, or None

273

311

"""

274

312

275

runtime_expansions = (u"approval_delay", u"approval_duration",

276

u"created", u"enabled", u"fingerprint",

277

u"host", u"interval", u"last_checked_ok",

278

u"last_enabled", u"name", u"timeout")

279

280

@staticmethod

281

def _timedelta_to_milliseconds(td):

282

"Convert a datetime.timedelta() to milliseconds"

283

return ((td.days * 24 * 60 * 60 * 1000)

284

+ (td.seconds * 1000)

285

+ (td.microseconds // 1000))

313

runtime_expansions = ("approval_delay", "approval_duration",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

316

"last_enabled", "name", "timeout")

286

317

287

318

def timeout_milliseconds(self):

288

319

"Return the 'timeout' attribute in milliseconds"

289

return self._timedelta_to_milliseconds(self.timeout)

320

return _timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

290

325

291

326

def interval_milliseconds(self):

292

327

"Return the 'interval' attribute in milliseconds"

293

return self._timedelta_to_milliseconds(self.interval)

294

328

return _timedelta_to_milliseconds(self.interval)

329

295

330

def approval_delay_milliseconds(self):

296

return self._timedelta_to_milliseconds(self.approval_delay)

331

return _timedelta_to_milliseconds(self.approval_delay)

297

332

298

333

def __init__(self, name = None, disable_hook=None, config=None):

299

334

"""Note: the 'checker' key in 'config' sets the

302

337

self.name = name

303

338

if config is None:

304

339

config = {}

305

logger.debug(u"Creating client %r", self.name)

340

logger.debug("Creating client %r", self.name)

306

341

# Uppercase and remove spaces from fingerprint for later

307

342

# comparison purposes with return value from the fingerprint()

308

343

# function

309

self.fingerprint = (config[u"fingerprint"].upper()

310

.replace(u" ", u""))

311

logger.debug(u" Fingerprint: %s", self.fingerprint)

312

if u"secret" in config:

313

self.secret = config[u"secret"].decode(u"base64")

314

elif u"secfile" in config:

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

315

350

with open(os.path.expanduser(os.path.expandvars

316

(config[u"secfile"])),

351

(config["secfile"])),

317

352

"rb") as secfile:

318

353

self.secret = secfile.read()

319

354

else:

320

raise TypeError(u"No secret or secfile for client %s"

355

raise TypeError("No secret or secfile for client %s"

321

356

% self.name)

322

self.host = config.get(u"host", u"")

357

self.host = config.get("host", "")

323

358

self.created = datetime.datetime.utcnow()

324

359

self.enabled = False

325

360

self.last_approval_request = None

326

361

self.last_enabled = None

327

362

self.last_checked_ok = None

328

self.timeout = string_to_delta(config[u"timeout"])

329

self.interval = string_to_delta(config[u"interval"])

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

330

366

self.disable_hook = disable_hook

331

367

self.checker = None

332

368

self.checker_initiator_tag = None

333

369

self.disable_initiator_tag = None

370

self.expires = None

334

371

self.checker_callback_tag = None

335

self.checker_command = config[u"checker"]

372

self.checker_command = config["checker"]

336

373

self.current_checker_command = None

337

374

self.last_connect = None

338

375

self._approved = None

339

self.approved_by_default = config.get(u"approved_by_default",

376

self.approved_by_default = config.get("approved_by_default",

340

377

True)

341

378

self.approvals_pending = 0

342

379

self.approval_delay = string_to_delta(

343

config[u"approval_delay"])

380

config["approval_delay"])

344

381

self.approval_duration = string_to_delta(

345

config[u"approval_duration"])

382

config["approval_duration"])

346

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

347

384

348

385

def send_changedstate(self):

352

389

353

390

def enable(self):

354

391

"""Start this client's checker and timeout hooks"""

355

if getattr(self, u"enabled", False):

392

if getattr(self, "enabled", False):

356

393

# Already enabled

357

394

return

358

395

self.send_changedstate()

359

self.last_enabled = datetime.datetime.utcnow()

360

396

# Schedule a new checker to be started an 'interval' from now,

361

397

# and every interval from then on.

362

398

self.checker_initiator_tag = (gobject.timeout_add

363

399

(self.interval_milliseconds(),

364

400

self.start_checker))

365

401

# Schedule a disable() when 'timeout' has passed

402

self.expires = datetime.datetime.utcnow() + self.timeout

366

403

self.disable_initiator_tag = (gobject.timeout_add

367

404

(self.timeout_milliseconds(),

368

405

self.disable))

369

406

self.enabled = True

407

self.last_enabled = datetime.datetime.utcnow()

370

408

# Also start a new checker *right now*.

371

409

self.start_checker()

372

410

377

415

if not quiet:

378

416

self.send_changedstate()

379

417

if not quiet:

380

logger.info(u"Disabling client %s", self.name)

381

if getattr(self, u"disable_initiator_tag", False):

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

382

420

gobject.source_remove(self.disable_initiator_tag)

383

421

self.disable_initiator_tag = None

384

if getattr(self, u"checker_initiator_tag", False):

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

385

424

gobject.source_remove(self.checker_initiator_tag)

386

425

self.checker_initiator_tag = None

387

426

self.stop_checker()

402

441

if os.WIFEXITED(condition):

403

442

exitstatus = os.WEXITSTATUS(condition)

404

443

if exitstatus == 0:

405

logger.info(u"Checker for %(name)s succeeded",

444

logger.info("Checker for %(name)s succeeded",

406

445

vars(self))

407

446

self.checked_ok()

408

447

else:

409

logger.info(u"Checker for %(name)s failed",

448

logger.info("Checker for %(name)s failed",

410

449

vars(self))

411

450

else:

412

logger.warning(u"Checker for %(name)s crashed?",

451

logger.warning("Checker for %(name)s crashed?",

413

452

vars(self))

414

453

415

def checked_ok(self):

454

def checked_ok(self, timeout=None):

416

455

"""Bump up the timeout for this client.

417

456

418

457

This should only be called when the client has been seen,

419

458

alive and well.

420

459

"""

460

if timeout is None:

461

timeout = self.timeout

421

462

self.last_checked_ok = datetime.datetime.utcnow()

422

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

423

465

self.disable_initiator_tag = (gobject.timeout_add

424

(self.timeout_milliseconds(),

466

(_timedelta_to_milliseconds(timeout),

425

467

self.disable))

426

468

427

469

def need_approval(self):

444

486

# If a checker exists, make sure it is not a zombie

445

487

try:

446

488

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

447

except (AttributeError, OSError), error:

489

except (AttributeError, OSError) as error:

448

490

if (isinstance(error, OSError)

449

491

and error.errno != errno.ECHILD):

450

492

raise error

451

493

else:

452

494

if pid:

453

logger.warning(u"Checker was a zombie")

495

logger.warning("Checker was a zombie")

454

496

gobject.source_remove(self.checker_callback_tag)

455

497

self.checker_callback(pid, status,

456

498

self.current_checker_command)

463

505

# Escape attributes for the shell

464

506

escaped_attrs = dict(

465

507

(attr,

466

re.escape(unicode(str(getattr(self, attr, u"")),

508

re.escape(unicode(str(getattr(self, attr, "")),

467

509

errors=

468

u'replace')))

510

'replace')))

469

511

for attr in

470

512

self.runtime_expansions)

471

513

472

514

try:

473

515

command = self.checker_command % escaped_attrs

474

except TypeError, error:

475

logger.error(u'Could not format string "%s":'

476

u' %s', self.checker_command, error)

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

477

519

return True # Try again later

478

520

self.current_checker_command = command

479

521

try:

480

logger.info(u"Starting checker %r for %s",

522

logger.info("Starting checker %r for %s",

481

523

command, self.name)

482

524

# We don't need to redirect stdout and stderr, since

483

525

# in normal mode, that is already done by daemon(),

485

527

# always replaced by /dev/null.)

486

528

self.checker = subprocess.Popen(command,

487

529

close_fds=True,

488

shell=True, cwd=u"/")

530

shell=True, cwd="/")

489

531

self.checker_callback_tag = (gobject.child_watch_add

490

532

(self.checker.pid,

491

533

self.checker_callback,

496

538

if pid:

497

539

gobject.source_remove(self.checker_callback_tag)

498

540

self.checker_callback(pid, status, command)

499

except OSError, error:

500

logger.error(u"Failed to start subprocess: %s",

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

501

543

error)

502

544

# Re-run this periodically if run by gobject.timeout_add

503

545

return True

507

549

if self.checker_callback_tag:

508

550

gobject.source_remove(self.checker_callback_tag)

509

551

self.checker_callback_tag = None

510

if getattr(self, u"checker", None) is None:

552

if getattr(self, "checker", None) is None:

511

553

return

512

logger.debug(u"Stopping checker for %(name)s", vars(self))

554

logger.debug("Stopping checker for %(name)s", vars(self))

513

555

try:

514

556

os.kill(self.checker.pid, signal.SIGTERM)

515

557

#time.sleep(0.5)

516

558

#if self.checker.poll() is None:

517

559

# os.kill(self.checker.pid, signal.SIGKILL)

518

except OSError, error:

560

except OSError as error:

519

561

if error.errno != errno.ESRCH: # No such process

520

562

raise

521

563

self.checker = None

522

564

523

def dbus_service_property(dbus_interface, signature=u"v",

524

access=u"readwrite", byte_arrays=False):

565

566

def dbus_service_property(dbus_interface, signature="v",

567

access="readwrite", byte_arrays=False):

525

568

"""Decorators for marking methods of a DBusObjectWithProperties to

526

569

become properties on the D-Bus.

527

570

534

577

"""

535

578

# Encoding deeply encoded byte arrays is not supported yet by the

536

579

# "Set" method, so we fail early here:

537

if byte_arrays and signature != u"ay":

538

raise ValueError(u"Byte arrays not supported for non-'ay'"

539

u" signature %r" % signature)

580

if byte_arrays and signature != "ay":

581

raise ValueError("Byte arrays not supported for non-'ay'"

582

" signature %r" % signature)

540

583

def decorator(func):

541

584

func._dbus_is_property = True

542

585

func._dbus_interface = dbus_interface

543

586

func._dbus_signature = signature

544

587

func._dbus_access = access

545

588

func._dbus_name = func.__name__

546

if func._dbus_name.endswith(u"_dbus_property"):

589

if func._dbus_name.endswith("_dbus_property"):

547

590

func._dbus_name = func._dbus_name[:-14]

548

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

591

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

549

592

return func

550

593

return decorator

551

594

571

614

572

615

class DBusObjectWithProperties(dbus.service.Object):

573

616

"""A D-Bus object with properties.

574

617

575

618

Classes inheriting from this can use the dbus_service_property

576

619

decorator to expose methods as D-Bus properties. It exposes the

577

620

standard Get(), Set(), and GetAll() methods on the D-Bus.

579

622

580

623

@staticmethod

581

624

def _is_dbus_property(obj):

582

return getattr(obj, u"_dbus_is_property", False)

625

return getattr(obj, "_dbus_is_property", False)

583

626

584

627

def _get_all_dbus_properties(self):

585

628

"""Returns a generator of (name, attribute) pairs

586

629

"""

587

return ((prop._dbus_name, prop)

588

for name, prop in

589

inspect.getmembers(self, self._is_dbus_property))

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

631

for cls in self.__class__.__mro__

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

590

633

591

634

def _get_dbus_property(self, interface_name, property_name):

592

635

"""Returns a bound method if one exists which is a D-Bus

593

636

property with the specified name and interface.

594

637

"""

595

for name in (property_name,

596

property_name + u"_dbus_property"):

597

prop = getattr(self, name, None)

598

if (prop is None

599

or not self._is_dbus_property(prop)

600

or prop._dbus_name != property_name

601

or (interface_name and prop._dbus_interface

602

and interface_name != prop._dbus_interface)):

603

continue

604

return prop

638

for cls in self.__class__.__mro__:

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

641

return value.__get__(self)

642

605

643

# No such property

606

raise DBusPropertyNotFound(self.dbus_object_path + u":"

607

+ interface_name + u"."

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

645

+ interface_name + "."

608

646

+ property_name)

609

647

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

611

out_signature=u"v")

648

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

649

out_signature="v")

612

650

def Get(self, interface_name, property_name):

613

651

"""Standard D-Bus property Get() method, see D-Bus standard.

614

652

"""

615

653

prop = self._get_dbus_property(interface_name, property_name)

616

if prop._dbus_access == u"write":

654

if prop._dbus_access == "write":

617

655

raise DBusPropertyAccessException(property_name)

618

656

value = prop()

619

if not hasattr(value, u"variant_level"):

657

if not hasattr(value, "variant_level"):

620

658

return value

621

659

return type(value)(value, variant_level=value.variant_level+1)

622

660

623

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

661

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

624

662

def Set(self, interface_name, property_name, value):

625

663

"""Standard D-Bus property Set() method, see D-Bus standard.

626

664

"""

627

665

prop = self._get_dbus_property(interface_name, property_name)

628

if prop._dbus_access == u"read":

666

if prop._dbus_access == "read":

629

667

raise DBusPropertyAccessException(property_name)

630

if prop._dbus_get_args_options[u"byte_arrays"]:

668

if prop._dbus_get_args_options["byte_arrays"]:

631

669

# The byte_arrays option is not supported yet on

632

670

# signatures other than "ay".

633

if prop._dbus_signature != u"ay":

671

if prop._dbus_signature != "ay":

634

672

raise ValueError

635

673

value = dbus.ByteArray(''.join(unichr(byte)

636

674

for byte in value))

637

675

prop(value)

638

676

639

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

640

out_signature=u"a{sv}")

677

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

678

out_signature="a{sv}")

641

679

def GetAll(self, interface_name):

642

680

"""Standard D-Bus property GetAll() method, see D-Bus

643

681

standard.

644

682

645

683

Note: Will not include properties with access="write".

646

684

"""

647

685

all = {}

651

689

# Interface non-empty but did not match

652

690

continue

653

691

# Ignore write-only properties

654

if prop._dbus_access == u"write":

692

if prop._dbus_access == "write":

655

693

continue

656

694

value = prop()

657

if not hasattr(value, u"variant_level"):

695

if not hasattr(value, "variant_level"):

658

696

all[name] = value

659

697

continue

660

698

all[name] = type(value)(value, variant_level=

661

699

value.variant_level+1)

662

return dbus.Dictionary(all, signature=u"sv")

700

return dbus.Dictionary(all, signature="sv")

663

701

664

702

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

665

out_signature=u"s",

703

out_signature="s",

666

704

path_keyword='object_path',

667

705

connection_keyword='connection')

668

706

def Introspect(self, object_path, connection):

673

711

try:

674

712

document = xml.dom.minidom.parseString(xmlstring)

675

713

def make_tag(document, name, prop):

676

e = document.createElement(u"property")

677

e.setAttribute(u"name", name)

678

e.setAttribute(u"type", prop._dbus_signature)

679

e.setAttribute(u"access", prop._dbus_access)

714

e = document.createElement("property")

715

e.setAttribute("name", name)

716

e.setAttribute("type", prop._dbus_signature)

717

e.setAttribute("access", prop._dbus_access)

680

718

return e

681

for if_tag in document.getElementsByTagName(u"interface"):

719

for if_tag in document.getElementsByTagName("interface"):

682

720

for tag in (make_tag(document, name, prop)

683

721

for name, prop

684

722

in self._get_all_dbus_properties()

685

723

if prop._dbus_interface

686

== if_tag.getAttribute(u"name")):

724

== if_tag.getAttribute("name")):

687

725

if_tag.appendChild(tag)

688

726

# Add the names to the return values for the

689

727

# "org.freedesktop.DBus.Properties" methods

690

if (if_tag.getAttribute(u"name")

691

== u"org.freedesktop.DBus.Properties"):

692

for cn in if_tag.getElementsByTagName(u"method"):

693

if cn.getAttribute(u"name") == u"Get":

694

for arg in cn.getElementsByTagName(u"arg"):

695

if (arg.getAttribute(u"direction")

696

== u"out"):

697

arg.setAttribute(u"name", u"value")

698

elif cn.getAttribute(u"name") == u"GetAll":

699

for arg in cn.getElementsByTagName(u"arg"):

700

if (arg.getAttribute(u"direction")

701

== u"out"):

702

arg.setAttribute(u"name", u"props")

703

xmlstring = document.toxml(u"utf-8")

728

if (if_tag.getAttribute("name")

729

== "org.freedesktop.DBus.Properties"):

730

for cn in if_tag.getElementsByTagName("method"):

731

if cn.getAttribute("name") == "Get":

732

for arg in cn.getElementsByTagName("arg"):

733

if (arg.getAttribute("direction")

734

== "out"):

735

arg.setAttribute("name", "value")

736

elif cn.getAttribute("name") == "GetAll":

737

for arg in cn.getElementsByTagName("arg"):

738

if (arg.getAttribute("direction")

739

== "out"):

740

arg.setAttribute("name", "props")

741

xmlstring = document.toxml("utf-8")

704

742

document.unlink()

705

743

except (AttributeError, xml.dom.DOMException,

706

xml.parsers.expat.ExpatError), error:

707

logger.error(u"Failed to override Introspection method",

744

xml.parsers.expat.ExpatError) as error:

745

logger.error("Failed to override Introspection method",

708

746

error)

709

747

return xmlstring

710

748

711

749

750

def datetime_to_dbus (dt, variant_level=0):

751

"""Convert a UTC datetime.datetime() to a D-Bus type."""

752

if dt is None:

753

return dbus.String("", variant_level = variant_level)

754

return dbus.String(dt.isoformat(),

755

variant_level=variant_level)

756

757

class AlternateDBusNamesMetaclass(DBusObjectWithProperties.__metaclass__):

758

"""Applied to an empty subclass of a D-Bus object, this metaclass

759

will add additional D-Bus attributes matching a certain pattern.

760

"""

761

def __new__(mcs, name, bases, attr):

762

# Go through all the base classes which could have D-Bus

763

# methods, signals, or properties in them

764

for base in (b for b in bases

765

if issubclass(b, dbus.service.Object)):

766

# Go though all attributes of the base class

767

for attrname, attribute in inspect.getmembers(base):

768

# Ignore non-D-Bus attributes, and D-Bus attributes

769

# with the wrong interface name

770

if (not hasattr(attribute, "_dbus_interface")

771

or not attribute._dbus_interface

772

.startswith("se.recompile.Mandos")):

773

continue

774

# Create an alternate D-Bus interface name based on

775

# the current name

776

alt_interface = (attribute._dbus_interface

777

.replace("se.recompile.Mandos",

778

"se.bsnet.fukt.Mandos"))

779

# Is this a D-Bus signal?

780

if getattr(attribute, "_dbus_is_signal", False):

781

# Extract the original non-method function by

782

# black magic

783

nonmethod_func = (dict(

784

zip(attribute.func_code.co_freevars,

785

attribute.__closure__))["func"]

786

.cell_contents)

787

# Create a new, but exactly alike, function

788

# object, and decorate it to be a new D-Bus signal

789

# with the alternate D-Bus interface name

790

new_function = (dbus.service.signal

791

(alt_interface,

792

attribute._dbus_signature)

793

(types.FunctionType(

794

nonmethod_func.func_code,

795

nonmethod_func.func_globals,

796

nonmethod_func.func_name,

797

nonmethod_func.func_defaults,

798

nonmethod_func.func_closure)))

799

# Define a creator of a function to call both the

800

# old and new functions, so both the old and new

801

# signals gets sent when the function is called

802

def fixscope(func1, func2):

803

"""This function is a scope container to pass

804

func1 and func2 to the "call_both" function

805

outside of its arguments"""

806

def call_both(*args, **kwargs):

807

"""This function will emit two D-Bus

808

signals by calling func1 and func2"""

809

func1(*args, **kwargs)

810

func2(*args, **kwargs)

811

return call_both

812

# Create the "call_both" function and add it to

813

# the class

814

attr[attrname] = fixscope(attribute,

815

new_function)

816

# Is this a D-Bus method?

817

elif getattr(attribute, "_dbus_is_method", False):

818

# Create a new, but exactly alike, function

819

# object. Decorate it to be a new D-Bus method

820

# with the alternate D-Bus interface name. Add it

821

# to the class.

822

attr[attrname] = (dbus.service.method

823

(alt_interface,

824

attribute._dbus_in_signature,

825

attribute._dbus_out_signature)

826

(types.FunctionType

827

(attribute.func_code,

828

attribute.func_globals,

829

attribute.func_name,

830

attribute.func_defaults,

831

attribute.func_closure)))

832

# Is this a D-Bus property?

833

elif getattr(attribute, "_dbus_is_property", False):

834

# Create a new, but exactly alike, function

835

# object, and decorate it to be a new D-Bus

836

# property with the alternate D-Bus interface

837

# name. Add it to the class.

838

attr[attrname] = (dbus_service_property

839

(alt_interface,

840

attribute._dbus_signature,

841

attribute._dbus_access,

842

attribute

843

._dbus_get_args_options

844

["byte_arrays"])

845

(types.FunctionType

846

(attribute.func_code,

847

attribute.func_globals,

848

attribute.func_name,

849

attribute.func_defaults,

850

attribute.func_closure)))

851

return type.__new__(mcs, name, bases, attr)

852

712

853

class ClientDBus(Client, DBusObjectWithProperties):

713

854

"""A Client class using D-Bus

714

855

718

859

"""

719

860

720

861

runtime_expansions = (Client.runtime_expansions

721

+ (u"dbus_object_path",))

862

+ ("dbus_object_path",))

722

863

723

864

# dbus.service.Object doesn't use super(), so we can't either.

724

865

729

870

# Only now, when this client is initialized, can it show up on

730

871

# the D-Bus

731

872

client_object_name = unicode(self.name).translate(

732

{ord(u"."): ord(u"_"),

733

ord(u"-"): ord(u"_")})

873

{ord("."): ord("_"),

874

ord("-"): ord("_")})

734

875

self.dbus_object_path = (dbus.ObjectPath

735

(u"/clients/" + client_object_name))

876

("/clients/" + client_object_name))

736

877

DBusObjectWithProperties.__init__(self, self.bus,

737

878

self.dbus_object_path)

738

879

739

def _get_approvals_pending(self):

740

return self._approvals_pending

741

def _set_approvals_pending(self, value):

742

old_value = self._approvals_pending

743

self._approvals_pending = value

744

bval = bool(value)

745

if (hasattr(self, "dbus_object_path")

746

and bval is not bool(old_value)):

747

dbus_bool = dbus.Boolean(bval, variant_level=1)

748

self.PropertyChanged(dbus.String(u"ApprovalPending"),

749

dbus_bool)

880

def notifychangeproperty(transform_func,

881

dbus_name, type_func=lambda x: x,

882

variant_level=1):

883

""" Modify a variable so that it's a property which announces

884

its changes to DBus.

750

885

751

approvals_pending = property(_get_approvals_pending,

752

_set_approvals_pending)

753

del _get_approvals_pending, _set_approvals_pending

754

755

@staticmethod

756

def _datetime_to_dbus(dt, variant_level=0):

757

"""Convert a UTC datetime.datetime() to a D-Bus type."""

758

return dbus.String(dt.isoformat(),

759

variant_level=variant_level)

760

761

def enable(self):

762

oldstate = getattr(self, u"enabled", False)

763

r = Client.enable(self)

764

if oldstate != self.enabled:

765

# Emit D-Bus signals

766

self.PropertyChanged(dbus.String(u"Enabled"),

767

dbus.Boolean(True, variant_level=1))

768

self.PropertyChanged(

769

dbus.String(u"LastEnabled"),

770

self._datetime_to_dbus(self.last_enabled,

771

variant_level=1))

772

return r

773

774

def disable(self, quiet = False):

775

oldstate = getattr(self, u"enabled", False)

776

r = Client.disable(self, quiet=quiet)

777

if not quiet and oldstate != self.enabled:

778

# Emit D-Bus signal

779

self.PropertyChanged(dbus.String(u"Enabled"),

780

dbus.Boolean(False, variant_level=1))

781

return r

886

transform_fun: Function that takes a value and transforms it

887

to a D-Bus type.

888

dbus_name: D-Bus name of the variable

889

type_func: Function that transform the value before sending it

890

to the D-Bus. Default: no transform

891

variant_level: D-Bus variant level. Default: 1

892

"""

893

real_value = [None,]

894

def setter(self, value):

895

old_value = real_value[0]

896

real_value[0] = value

897

if hasattr(self, "dbus_object_path"):

898

if type_func(old_value) != type_func(real_value[0]):

899

dbus_value = transform_func(type_func(real_value[0]),

900

variant_level)

901

self.PropertyChanged(dbus.String(dbus_name),

902

dbus_value)

903

904

return property(lambda self: real_value[0], setter)

905

906

907

expires = notifychangeproperty(datetime_to_dbus, "Expires")

908

approvals_pending = notifychangeproperty(dbus.Boolean,

909

"ApprovalPending",

910

type_func = bool)

911

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

912

last_enabled = notifychangeproperty(datetime_to_dbus,

913

"LastEnabled")

914

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

915

type_func = lambda checker: checker is not None)

916

last_checked_ok = notifychangeproperty(datetime_to_dbus,

917

"LastCheckedOK")

918

last_approval_request = notifychangeproperty(datetime_to_dbus,

919

"LastApprovalRequest")

920

approved_by_default = notifychangeproperty(dbus.Boolean,

921

"ApprovedByDefault")

922

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

923

type_func = _timedelta_to_milliseconds)

924

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

925

type_func = _timedelta_to_milliseconds)

926

host = notifychangeproperty(dbus.String, "Host")

927

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

928

type_func = _timedelta_to_milliseconds)

929

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

930

type_func = _timedelta_to_milliseconds)

931

interval = notifychangeproperty(dbus.UInt16, "Interval",

932

type_func = _timedelta_to_milliseconds)

933

checker_command = notifychangeproperty(dbus.String, "Checker")

934

935

del notifychangeproperty

782

936

783

937

def __del__(self, *args, **kwargs):

784

938

try:

785

939

self.remove_from_connection()

786

940

except LookupError:

787

941

pass

788

if hasattr(DBusObjectWithProperties, u"__del__"):

942

if hasattr(DBusObjectWithProperties, "__del__"):

789

943

DBusObjectWithProperties.__del__(self, *args, **kwargs)

790

944

Client.__del__(self, *args, **kwargs)

791

945

793

947

*args, **kwargs):

794

948

self.checker_callback_tag = None

795

949

self.checker = None

796

# Emit D-Bus signal

797

self.PropertyChanged(dbus.String(u"CheckerRunning"),

798

dbus.Boolean(False, variant_level=1))

799

950

if os.WIFEXITED(condition):

800

951

exitstatus = os.WEXITSTATUS(condition)

801

952

# Emit D-Bus signal

811

962

return Client.checker_callback(self, pid, condition, command,

812

963

*args, **kwargs)

813

964

814

def checked_ok(self, *args, **kwargs):

815

r = Client.checked_ok(self, *args, **kwargs)

816

# Emit D-Bus signal

817

self.PropertyChanged(

818

dbus.String(u"LastCheckedOK"),

819

(self._datetime_to_dbus(self.last_checked_ok,

820

variant_level=1)))

821

return r

822

823

def need_approval(self, *args, **kwargs):

824

r = Client.need_approval(self, *args, **kwargs)

825

# Emit D-Bus signal

826

self.PropertyChanged(

827

dbus.String(u"LastApprovalRequest"),

828

(self._datetime_to_dbus(self.last_approval_request,

829

variant_level=1)))

830

return r

831

832

965

def start_checker(self, *args, **kwargs):

833

966

old_checker = self.checker

834

967

if self.checker is not None:

841

974

and old_checker_pid != self.checker.pid):

842

975

# Emit D-Bus signal

843

976

self.CheckerStarted(self.current_checker_command)

844

self.PropertyChanged(

845

dbus.String(u"CheckerRunning"),

846

dbus.Boolean(True, variant_level=1))

847

977

return r

848

978

849

def stop_checker(self, *args, **kwargs):

850

old_checker = getattr(self, u"checker", None)

851

r = Client.stop_checker(self, *args, **kwargs)

852

if (old_checker is not None

853

and getattr(self, u"checker", None) is None):

854

self.PropertyChanged(dbus.String(u"CheckerRunning"),

855

dbus.Boolean(False, variant_level=1))

856

return r

857

858

979

def _reset_approved(self):

859

980

self._approved = None

860

981

return False

862

983

def approve(self, value=True):

863

984

self.send_changedstate()

864

985

self._approved = value

865

gobject.timeout_add(self._timedelta_to_milliseconds

986

gobject.timeout_add(_timedelta_to_milliseconds

866

987

(self.approval_duration),

867

988

self._reset_approved)

868

989

869

990

870

991

## D-Bus methods, signals & properties

871

_interface = u"se.bsnet.fukt.Mandos.Client"

992

_interface = "se.recompile.Mandos.Client"

872

993

873

994

## Signals

874

995

875

996

# CheckerCompleted - signal

876

@dbus.service.signal(_interface, signature=u"nxs")

997

@dbus.service.signal(_interface, signature="nxs")

877

998

def CheckerCompleted(self, exitcode, waitstatus, command):

878

999

"D-Bus signal"

879

1000

pass

880

1001

881

1002

# CheckerStarted - signal

882

@dbus.service.signal(_interface, signature=u"s")

1003

@dbus.service.signal(_interface, signature="s")

883

1004

def CheckerStarted(self, command):

884

1005

"D-Bus signal"

885

1006

pass

886

1007

887

1008

# PropertyChanged - signal

888

@dbus.service.signal(_interface, signature=u"sv")

1009

@dbus.service.signal(_interface, signature="sv")

889

1010

def PropertyChanged(self, property, value):

890

1011

"D-Bus signal"

891

1012

pass

900

1021

pass

901

1022

902

1023

# Rejected - signal

903

@dbus.service.signal(_interface, signature=u"s")

1024

@dbus.service.signal(_interface, signature="s")

904

1025

def Rejected(self, reason):

905

1026

"D-Bus signal"

906

1027

pass

907

1028

908

1029

# NeedApproval - signal

909

@dbus.service.signal(_interface, signature=u"tb")

1030

@dbus.service.signal(_interface, signature="tb")

910

1031

def NeedApproval(self, timeout, default):

911

1032

"D-Bus signal"

912

1033

return self.need_approval()

914

1035

## Methods

915

1036

916

1037

# Approve - method

917

@dbus.service.method(_interface, in_signature=u"b")

1038

@dbus.service.method(_interface, in_signature="b")

918

1039

def Approve(self, value):

919

1040

self.approve(value)

920

1041

921

1042

# CheckedOK - method

922

1043

@dbus.service.method(_interface)

923

1044

def CheckedOK(self):

924

return self.checked_ok()

1045

self.checked_ok()

925

1046

926

1047

# Enable - method

927

1048

@dbus.service.method(_interface)

949

1070

## Properties

950

1071

951

1072

# ApprovalPending - property

952

@dbus_service_property(_interface, signature=u"b", access=u"read")

1073

@dbus_service_property(_interface, signature="b", access="read")

953

1074

def ApprovalPending_dbus_property(self):

954

1075

return dbus.Boolean(bool(self.approvals_pending))

955

1076

956

1077

# ApprovedByDefault - property

957

@dbus_service_property(_interface, signature=u"b",

958

access=u"readwrite")

1078

@dbus_service_property(_interface, signature="b",

1079

access="readwrite")

959

1080

def ApprovedByDefault_dbus_property(self, value=None):

960

1081

if value is None: # get

961

1082

return dbus.Boolean(self.approved_by_default)

962

1083

self.approved_by_default = bool(value)

963

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

965

dbus.Boolean(value, variant_level=1))

966

1084

967

1085

# ApprovalDelay - property

968

@dbus_service_property(_interface, signature=u"t",

969

access=u"readwrite")

1086

@dbus_service_property(_interface, signature="t",

1087

access="readwrite")

970

1088

def ApprovalDelay_dbus_property(self, value=None):

971

1089

if value is None: # get

972

1090

return dbus.UInt64(self.approval_delay_milliseconds())

973

1091

self.approval_delay = datetime.timedelta(0, 0, 0, value)

974

# Emit D-Bus signal

975

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

976

dbus.UInt64(value, variant_level=1))

977

1092

978

1093

# ApprovalDuration - property

979

@dbus_service_property(_interface, signature=u"t",

980

access=u"readwrite")

1094

@dbus_service_property(_interface, signature="t",

1095

access="readwrite")

981

1096

def ApprovalDuration_dbus_property(self, value=None):

982

1097

if value is None: # get

983

return dbus.UInt64(self._timedelta_to_milliseconds(

1098

return dbus.UInt64(_timedelta_to_milliseconds(

984

1099

self.approval_duration))

985

1100

self.approval_duration = datetime.timedelta(0, 0, 0, value)

986

# Emit D-Bus signal

987

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

988

dbus.UInt64(value, variant_level=1))

989

1101

990

1102

# Name - property

991

@dbus_service_property(_interface, signature=u"s", access=u"read")

1103

@dbus_service_property(_interface, signature="s", access="read")

992

1104

def Name_dbus_property(self):

993

1105

return dbus.String(self.name)

994

1106

995

1107

# Fingerprint - property

996

@dbus_service_property(_interface, signature=u"s", access=u"read")

1108

@dbus_service_property(_interface, signature="s", access="read")

997

1109

def Fingerprint_dbus_property(self):

998

1110

return dbus.String(self.fingerprint)

999

1111

1000

1112

# Host - property

1001

@dbus_service_property(_interface, signature=u"s",

1002

access=u"readwrite")

1113

@dbus_service_property(_interface, signature="s",

1114

access="readwrite")

1003

1115

def Host_dbus_property(self, value=None):

1004

1116

if value is None: # get

1005

1117

return dbus.String(self.host)

1006

1118

self.host = value

1007

# Emit D-Bus signal

1008

self.PropertyChanged(dbus.String(u"Host"),

1009

dbus.String(value, variant_level=1))

1010

1119

1011

1120

# Created - property

1012

@dbus_service_property(_interface, signature=u"s", access=u"read")

1121

@dbus_service_property(_interface, signature="s", access="read")

1013

1122

def Created_dbus_property(self):

1014

return dbus.String(self._datetime_to_dbus(self.created))

1123

return dbus.String(datetime_to_dbus(self.created))

1015

1124

1016

1125

# LastEnabled - property

1017

@dbus_service_property(_interface, signature=u"s", access=u"read")

1126

@dbus_service_property(_interface, signature="s", access="read")

1018

1127

def LastEnabled_dbus_property(self):

1019

if self.last_enabled is None:

1020

return dbus.String(u"")

1021

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1128

return datetime_to_dbus(self.last_enabled)

1022

1129

1023

1130

# Enabled - property

1024

@dbus_service_property(_interface, signature=u"b",

1025

access=u"readwrite")

1131

@dbus_service_property(_interface, signature="b",

1132

access="readwrite")

1026

1133

def Enabled_dbus_property(self, value=None):

1027

1134

if value is None: # get

1028

1135

return dbus.Boolean(self.enabled)

1032

1139

self.disable()

1033

1140

1034

1141

# LastCheckedOK - property

1035

@dbus_service_property(_interface, signature=u"s",

1036

access=u"readwrite")

1142

@dbus_service_property(_interface, signature="s",

1143

access="readwrite")

1037

1144

def LastCheckedOK_dbus_property(self, value=None):

1038

1145

if value is not None:

1039

1146

self.checked_ok()

1040

1147

return

1041

if self.last_checked_ok is None:

1042

return dbus.String(u"")

1043

return dbus.String(self._datetime_to_dbus(self

1044

.last_checked_ok))

1148

return datetime_to_dbus(self.last_checked_ok)

1149

1150

# Expires - property

1151

@dbus_service_property(_interface, signature="s", access="read")

1152

def Expires_dbus_property(self):

1153

return datetime_to_dbus(self.expires)

1045

1154

1046

1155

# LastApprovalRequest - property

1047

@dbus_service_property(_interface, signature=u"s", access=u"read")

1156

@dbus_service_property(_interface, signature="s", access="read")

1048

1157

def LastApprovalRequest_dbus_property(self):

1049

if self.last_approval_request is None:

1050

return dbus.String(u"")

1051

return dbus.String(self.

1052

_datetime_to_dbus(self

1053

.last_approval_request))

1158

return datetime_to_dbus(self.last_approval_request)

1054

1159

1055

1160

# Timeout - property

1056

@dbus_service_property(_interface, signature=u"t",

1057

access=u"readwrite")

1161

@dbus_service_property(_interface, signature="t",

1162

access="readwrite")

1058

1163

def Timeout_dbus_property(self, value=None):

1059

1164

if value is None: # get

1060

1165

return dbus.UInt64(self.timeout_milliseconds())

1061

1166

self.timeout = datetime.timedelta(0, 0, 0, value)

1062

# Emit D-Bus signal

1063

self.PropertyChanged(dbus.String(u"Timeout"),

1064

dbus.UInt64(value, variant_level=1))

1065

if getattr(self, u"disable_initiator_tag", None) is None:

1167

if getattr(self, "disable_initiator_tag", None) is None:

1066

1168

return

1067

1169

# Reschedule timeout

1068

1170

gobject.source_remove(self.disable_initiator_tag)

1069

1171

self.disable_initiator_tag = None

1172

self.expires = None

1070

1173

time_to_die = (self.

1071

1174

_timedelta_to_milliseconds((self

1072

1175

.last_checked_ok

1077

1180

# The timeout has passed

1078

1181

self.disable()

1079

1182

else:

1183

self.expires = (datetime.datetime.utcnow()

1184

+ datetime.timedelta(milliseconds = time_to_die))

1080

1185

self.disable_initiator_tag = (gobject.timeout_add

1081

1186

(time_to_die, self.disable))

1082

1187

1188

# ExtendedTimeout - property

1189

@dbus_service_property(_interface, signature="t",

1190

access="readwrite")

1191

def ExtendedTimeout_dbus_property(self, value=None):

1192

if value is None: # get

1193

return dbus.UInt64(self.extended_timeout_milliseconds())

1194

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1195

1083

1196

# Interval - property

1084

@dbus_service_property(_interface, signature=u"t",

1085

access=u"readwrite")

1197

@dbus_service_property(_interface, signature="t",

1198

access="readwrite")

1086

1199

def Interval_dbus_property(self, value=None):

1087

1200

if value is None: # get

1088

1201

return dbus.UInt64(self.interval_milliseconds())

1089

1202

self.interval = datetime.timedelta(0, 0, 0, value)

1090

# Emit D-Bus signal

1091

self.PropertyChanged(dbus.String(u"Interval"),

1092

dbus.UInt64(value, variant_level=1))

1093

if getattr(self, u"checker_initiator_tag", None) is None:

1203

if getattr(self, "checker_initiator_tag", None) is None:

1094

1204

return

1095

1205

# Reschedule checker run

1096

1206

gobject.source_remove(self.checker_initiator_tag)

1097

1207

self.checker_initiator_tag = (gobject.timeout_add

1098

1208

(value, self.start_checker))

1099

1209

self.start_checker() # Start one now, too

1100

1210

1101

1211

# Checker - property

1102

@dbus_service_property(_interface, signature=u"s",

1103

access=u"readwrite")

1212

@dbus_service_property(_interface, signature="s",

1213

access="readwrite")

1104

1214

def Checker_dbus_property(self, value=None):

1105

1215

if value is None: # get

1106

1216

return dbus.String(self.checker_command)

1107

1217

self.checker_command = value

1108

# Emit D-Bus signal

1109

self.PropertyChanged(dbus.String(u"Checker"),

1110

dbus.String(self.checker_command,

1111

variant_level=1))

1112

1218

1113

1219

# CheckerRunning - property

1114

@dbus_service_property(_interface, signature=u"b",

1115

access=u"readwrite")

1220

@dbus_service_property(_interface, signature="b",

1221

access="readwrite")

1116

1222

def CheckerRunning_dbus_property(self, value=None):

1117

1223

if value is None: # get

1118

1224

return dbus.Boolean(self.checker is not None)

1122

1228

self.stop_checker()

1123

1229

1124

1230

# ObjectPath - property

1125

@dbus_service_property(_interface, signature=u"o", access=u"read")

1231

@dbus_service_property(_interface, signature="o", access="read")

1126

1232

def ObjectPath_dbus_property(self):

1127

1233

return self.dbus_object_path # is already a dbus.ObjectPath

1128

1234

1129

1235

# Secret = property

1130

@dbus_service_property(_interface, signature=u"ay",

1131

access=u"write", byte_arrays=True)

1236

@dbus_service_property(_interface, signature="ay",

1237

access="write", byte_arrays=True)

1132

1238

def Secret_dbus_property(self, value):

1133

1239

self.secret = str(value)

1134

1240

1141

1247

self._pipe.send(('init', fpr, address))

1142

1248

if not self._pipe.recv():

1143

1249

raise KeyError()

1144

1250

1145

1251

def __getattribute__(self, name):

1146

1252

if(name == '_pipe'):

1147

1253

return super(ProxyClient, self).__getattribute__(name)

1154

1260

self._pipe.send(('funcall', name, args, kwargs))

1155

1261

return self._pipe.recv()[1]

1156

1262

return func

1157

1263

1158

1264

def __setattr__(self, name, value):

1159

1265

if(name == '_pipe'):

1160

1266

return super(ProxyClient, self).__setattr__(name, value)

1161

1267

self._pipe.send(('setattr', name, value))

1162

1268

1269

class ClientDBusTransitional(ClientDBus):

1270

__metaclass__ = AlternateDBusNamesMetaclass

1163

1271

1164

1272

class ClientHandler(socketserver.BaseRequestHandler, object):

1165

1273

"""A class to handle client connections.

1169

1277

1170

1278

def handle(self):

1171

1279

with contextlib.closing(self.server.child_pipe) as child_pipe:

1172

logger.info(u"TCP connection from: %s",

1280

logger.info("TCP connection from: %s",

1173

1281

unicode(self.client_address))

1174

logger.debug(u"Pipe FD: %d",

1282

logger.debug("Pipe FD: %d",

1175

1283

self.server.child_pipe.fileno())

1176

1284

1177

1285

session = (gnutls.connection

1178

1286

.ClientSession(self.request,

1179

1287

gnutls.connection

1180

1288

.X509Credentials()))

1181

1289

1182

1290

# Note: gnutls.connection.X509Credentials is really a

1183

1291

# generic GnuTLS certificate credentials object so long as

1184

1292

# no X.509 keys are added to it. Therefore, we can use it

1185

1293

# here despite using OpenPGP certificates.

1186

1187

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1188

# u"+AES-256-CBC", u"+SHA1",

1189

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1190

# u"+DHE-DSS"))

1294

1295

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1296

# "+AES-256-CBC", "+SHA1",

1297

# "+COMP-NULL", "+CTYPE-OPENPGP",

1298

# "+DHE-DSS"))

1191

1299

# Use a fallback default, since this MUST be set.

1192

1300

priority = self.server.gnutls_priority

1193

1301

if priority is None:

1194

priority = u"NORMAL"

1302

priority = "NORMAL"

1195

1303

(gnutls.library.functions

1196

1304

.gnutls_priority_set_direct(session._c_object,

1197

1305

priority, None))

1198

1306

1199

1307

# Start communication using the Mandos protocol

1200

1308

# Get protocol number

1201

1309

line = self.request.makefile().readline()

1202

logger.debug(u"Protocol version: %r", line)

1310

logger.debug("Protocol version: %r", line)

1203

1311

try:

1204

1312

if int(line.strip().split()[0]) > 1:

1205

1313

raise RuntimeError

1206

except (ValueError, IndexError, RuntimeError), error:

1207

logger.error(u"Unknown protocol version: %s", error)

1314

except (ValueError, IndexError, RuntimeError) as error:

1315

logger.error("Unknown protocol version: %s", error)

1208

1316

return

1209

1317

1210

1318

# Start GnuTLS connection

1211

1319

try:

1212

1320

session.handshake()

1213

except gnutls.errors.GNUTLSError, error:

1214

logger.warning(u"Handshake failed: %s", error)

1321

except gnutls.errors.GNUTLSError as error:

1322

logger.warning("Handshake failed: %s", error)

1215

1323

# Do not run session.bye() here: the session is not

1216

1324

# established. Just abandon the request.

1217

1325

return

1218

logger.debug(u"Handshake succeeded")

1219

1326

logger.debug("Handshake succeeded")

1327

1220

1328

approval_required = False

1221

1329

try:

1222

1330

try:

1223

1331

fpr = self.fingerprint(self.peer_certificate

1224

1332

(session))

1225

except (TypeError, gnutls.errors.GNUTLSError), error:

1226

logger.warning(u"Bad certificate: %s", error)

1333

except (TypeError,

1334

gnutls.errors.GNUTLSError) as error:

1335

logger.warning("Bad certificate: %s", error)

1227

1336

return

1228

logger.debug(u"Fingerprint: %s", fpr)

1229

1337

logger.debug("Fingerprint: %s", fpr)

1338

1230

1339

try:

1231

1340

client = ProxyClient(child_pipe, fpr,

1232

1341

self.client_address)

1240

1349

1241

1350

while True:

1242

1351

if not client.enabled:

1243

logger.warning(u"Client %s is disabled",

1352

logger.info("Client %s is disabled",

1244

1353

client.name)

1245

1354

if self.server.use_dbus:

1246

1355

# Emit D-Bus signal

1251

1360

#We are approved or approval is disabled

1252

1361

break

1253

1362

elif client._approved is None:

1254

logger.info(u"Client %s needs approval",

1363

logger.info("Client %s needs approval",

1255

1364

client.name)

1256

1365

if self.server.use_dbus:

1257

1366

# Emit D-Bus signal

1259

1368

client.approval_delay_milliseconds(),

1260

1369

client.approved_by_default)

1261

1370

else:

1262

logger.warning(u"Client %s was not approved",

1371

logger.warning("Client %s was not approved",

1263

1372

client.name)

1264

1373

if self.server.use_dbus:

1265

1374

# Emit D-Bus signal

1291

1400

while sent_size < len(client.secret):

1292

1401

try:

1293

1402

sent = session.send(client.secret[sent_size:])

1294

except (gnutls.errors.GNUTLSError), error:

1403

except gnutls.errors.GNUTLSError as error:

1295

1404

logger.warning("gnutls send failed")

1296

1405

return

1297

logger.debug(u"Sent: %d, remaining: %d",

1406

logger.debug("Sent: %d, remaining: %d",

1298

1407

sent, len(client.secret)

1299

1408

- (sent_size + sent))

1300

1409

sent_size += sent

1301

1302

logger.info(u"Sending secret to %s", client.name)

1410

1411

logger.info("Sending secret to %s", client.name)

1303

1412

# bump the timeout as if seen

1304

client.checked_ok()

1413

client.checked_ok(client.extended_timeout)

1305

1414

if self.server.use_dbus:

1306

1415

# Emit D-Bus signal

1307

1416

client.GotSecret()

1311

1420

client.approvals_pending -= 1

1312

1421

try:

1313

1422

session.bye()

1314

except (gnutls.errors.GNUTLSError), error:

1423

except gnutls.errors.GNUTLSError as error:

1315

1424

logger.warning("GnuTLS bye failed")

1316

1425

1317

1426

@staticmethod

1328

1437

.gnutls_certificate_get_peers

1329

1438

(session._c_object, ctypes.byref(list_size)))

1330

1439

if not bool(cert_list) and list_size.value != 0:

1331

raise gnutls.errors.GNUTLSError(u"error getting peer"

1332

u" certificate")

1440

raise gnutls.errors.GNUTLSError("error getting peer"

1441

" certificate")

1333

1442

if list_size.value == 0:

1334

1443

return None

1335

1444

cert = cert_list[0]

1361

1470

if crtverify.value != 0:

1362

1471

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1363

1472

raise (gnutls.errors.CertificateSecurityError

1364

(u"Verify failed"))

1473

("Verify failed"))

1365

1474

# New buffer for the fingerprint

1366

1475

buf = ctypes.create_string_buffer(20)

1367

1476

buf_len = ctypes.c_size_t()

1374

1483

# Convert the buffer to a Python bytestring

1375

1484

fpr = ctypes.string_at(buf, buf_len.value)

1376

1485

# Convert the bytestring to hexadecimal notation

1377

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1486

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1378

1487

return hex_fpr

1379

1488

1380

1489

1392

1501

multiprocessing.Process(target = self.sub_process_main,

1393

1502

args = (request, address)).start()

1394

1503

1504

1395

1505

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1396

1506

""" adds a pipe to the MixIn """

1397

1507

def process_request(self, request, client_address):

1400

1510

This function creates a new pipe in self.pipe

1401

1511

"""

1402

1512

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1403

1513

1404

1514

super(MultiprocessingMixInWithPipe,

1405

1515

self).process_request(request, client_address)

1406

1516

self.child_pipe.close()

1407

1517

self.add_pipe(parent_pipe)

1408

1518

1409

1519

def add_pipe(self, parent_pipe):

1410

1520

"""Dummy function; override as necessary"""

1411

pass

1521

raise NotImplementedError

1522

1412

1523

1413

1524

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1414

1525

socketserver.TCPServer, object):

1432

1543

bind to an address or port if they were not specified."""

1433

1544

if self.interface is not None:

1434

1545

if SO_BINDTODEVICE is None:

1435

logger.error(u"SO_BINDTODEVICE does not exist;"

1436

u" cannot bind to interface %s",

1546

logger.error("SO_BINDTODEVICE does not exist;"

1547

" cannot bind to interface %s",

1437

1548

self.interface)

1438

1549

else:

1439

1550

try:

1440

1551

self.socket.setsockopt(socket.SOL_SOCKET,

1441

1552

SO_BINDTODEVICE,

1442

1553

str(self.interface

1443

+ u'\0'))

1444

except socket.error, error:

1554

+ '\0'))

1555

except socket.error as error:

1445

1556

if error[0] == errno.EPERM:

1446

logger.error(u"No permission to"

1447

u" bind to interface %s",

1557

logger.error("No permission to"

1558

" bind to interface %s",

1448

1559

self.interface)

1449

1560

elif error[0] == errno.ENOPROTOOPT:

1450

logger.error(u"SO_BINDTODEVICE not available;"

1451

u" cannot bind to interface %s",

1561

logger.error("SO_BINDTODEVICE not available;"

1562

" cannot bind to interface %s",

1452

1563

self.interface)

1453

1564

else:

1454

1565

raise

1456

1567

if self.server_address[0] or self.server_address[1]:

1457

1568

if not self.server_address[0]:

1458

1569

if self.address_family == socket.AF_INET6:

1459

any_address = u"::" # in6addr_any

1570

any_address = "::" # in6addr_any

1460

1571

else:

1461

1572

any_address = socket.INADDR_ANY

1462

1573

self.server_address = (any_address,

1511

1622

def handle_ipc(self, source, condition, parent_pipe=None,

1512

1623

client_object=None):

1513

1624

condition_names = {

1514

gobject.IO_IN: u"IN", # There is data to read.

1515

gobject.IO_OUT: u"OUT", # Data can be written (without

1625

gobject.IO_IN: "IN", # There is data to read.

1626

gobject.IO_OUT: "OUT", # Data can be written (without

1516

1627

# blocking).

1517

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1518

gobject.IO_ERR: u"ERR", # Error condition.

1519

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1628

gobject.IO_PRI: "PRI", # There is urgent data to read.

1629

gobject.IO_ERR: "ERR", # Error condition.

1630

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1520

1631

# broken, usually for pipes and

1521

1632

# sockets).

1522

1633

}

1541

1652

client = c

1542

1653

break

1543

1654

else:

1544

logger.warning(u"Client not found for fingerprint: %s, ad"

1545

u"dress: %s", fpr, address)

1655

logger.info("Client not found for fingerprint: %s, ad"

1656

"dress: %s", fpr, address)

1546

1657

if self.use_dbus:

1547

1658

# Emit D-Bus signal

1548

1659

mandos_dbus_service.ClientNotFound(fpr, address[0])

1563

1674

kwargs = request[3]

1564

1675

1565

1676

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1566

1677

1567

1678

if command == 'getattr':

1568

1679

attrname = request[1]

1569

1680

if callable(client_object.__getattribute__(attrname)):

1575

1686

attrname = request[1]

1576

1687

value = request[2]

1577

1688

setattr(client_object, attrname, value)

1578

1689

1579

1690

return True

1580

1691

1581

1692

1582

1693

def string_to_delta(interval):

1583

1694

"""Parse a string and return a datetime.timedelta

1584

1695

1585

>>> string_to_delta(u'7d')

1696

>>> string_to_delta('7d')

1586

1697

datetime.timedelta(7)

1587

>>> string_to_delta(u'60s')

1698

>>> string_to_delta('60s')

1588

1699

datetime.timedelta(0, 60)

1589

>>> string_to_delta(u'60m')

1700

>>> string_to_delta('60m')

1590

1701

datetime.timedelta(0, 3600)

1591

>>> string_to_delta(u'24h')

1702

>>> string_to_delta('24h')

1592

1703

datetime.timedelta(1)

1593

>>> string_to_delta(u'1w')

1704

>>> string_to_delta('1w')

1594

1705

datetime.timedelta(7)

1595

>>> string_to_delta(u'5m 30s')

1706

>>> string_to_delta('5m 30s')

1596

1707

datetime.timedelta(0, 330)

1597

1708

"""

1598

1709

timevalue = datetime.timedelta(0)

1600

1711

try:

1601

1712

suffix = unicode(s[-1])

1602

1713

value = int(s[:-1])

1603

if suffix == u"d":

1714

if suffix == "d":

1604

1715

delta = datetime.timedelta(value)

1605

elif suffix == u"s":

1716

elif suffix == "s":

1606

1717

delta = datetime.timedelta(0, value)

1607

elif suffix == u"m":

1718

elif suffix == "m":

1608

1719

delta = datetime.timedelta(0, 0, 0, 0, value)

1609

elif suffix == u"h":

1720

elif suffix == "h":

1610

1721

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1611

elif suffix == u"w":

1722

elif suffix == "w":

1612

1723

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1613

1724

else:

1614

raise ValueError(u"Unknown suffix %r" % suffix)

1615

except (ValueError, IndexError), e:

1616

raise ValueError(e.message)

1725

raise ValueError("Unknown suffix %r" % suffix)

1726

except (ValueError, IndexError) as e:

1727

raise ValueError(*(e.args))

1617

1728

timevalue += delta

1618

1729

return timevalue

1619

1730

1625

1736

global if_nametoindex

1626

1737

try:

1627

1738

if_nametoindex = (ctypes.cdll.LoadLibrary

1628

(ctypes.util.find_library(u"c"))

1739

(ctypes.util.find_library("c"))

1629

1740

.if_nametoindex)

1630

1741

except (OSError, AttributeError):

1631

logger.warning(u"Doing if_nametoindex the hard way")

1742

logger.warning("Doing if_nametoindex the hard way")

1632

1743

def if_nametoindex(interface):

1633

1744

"Get an interface index the hard way, i.e. using fcntl()"

1634

1745

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1635

1746

with contextlib.closing(socket.socket()) as s:

1636

1747

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1637

struct.pack(str(u"16s16x"),

1748

struct.pack(str("16s16x"),

1638

1749

interface))

1639

interface_index = struct.unpack(str(u"I"),

1750

interface_index = struct.unpack(str("I"),

1640

1751

ifreq[16:20])[0]

1641

1752

return interface_index

1642

1753

return if_nametoindex(interface)

1650

1761

sys.exit()

1651

1762

os.setsid()

1652

1763

if not nochdir:

1653

os.chdir(u"/")

1764

os.chdir("/")

1654

1765

if os.fork():

1655

1766

sys.exit()

1656

1767

if not noclose:

1658

1769

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1659

1770

if not stat.S_ISCHR(os.fstat(null).st_mode):

1660

1771

raise OSError(errno.ENODEV,

1661

u"%s not a character device"

1772

"%s not a character device"

1662

1773

% os.path.devnull)

1663

1774

os.dup2(null, sys.stdin.fileno())

1664

1775

os.dup2(null, sys.stdout.fileno())

1672

1783

##################################################################

1673

1784

# Parsing of options, both command line and config file

1674

1785

1675

parser = optparse.OptionParser(version = "%%prog %s" % version)

1676

parser.add_option("-i", u"--interface", type=u"string",

1677

metavar="IF", help=u"Bind to interface IF")

1678

parser.add_option("-a", u"--address", type=u"string",

1679

help=u"Address to listen for requests on")

1680

parser.add_option("-p", u"--port", type=u"int",

1681

help=u"Port number to receive requests on")

1682

parser.add_option("--check", action=u"store_true",

1683

help=u"Run self-test")

1684

parser.add_option("--debug", action=u"store_true",

1685

help=u"Debug mode; run in foreground and log to"

1686

u" terminal")

1687

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1688

help=u"Debug level for stdout output")

1689

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1690

u" priority string (see GnuTLS documentation)")

1691

parser.add_option("--servicename", type=u"string",

1692

metavar=u"NAME", help=u"Zeroconf service name")

1693

parser.add_option("--configdir", type=u"string",

1694

default=u"/etc/mandos", metavar=u"DIR",

1695

help=u"Directory to search for configuration"

1696

u" files")

1697

parser.add_option("--no-dbus", action=u"store_false",

1698

dest=u"use_dbus", help=u"Do not provide D-Bus"

1699

u" system bus interface")

1700

parser.add_option("--no-ipv6", action=u"store_false",

1701

dest=u"use_ipv6", help=u"Do not use IPv6")

1702

options = parser.parse_args()[0]

1786

parser = argparse.ArgumentParser()

1787

parser.add_argument("-v", "--version", action="version",

1788

version = "%%(prog)s %s" % version,

1789

help="show version number and exit")

1790

parser.add_argument("-i", "--interface", metavar="IF",

1791

help="Bind to interface IF")

1792

parser.add_argument("-a", "--address",

1793

help="Address to listen for requests on")

1794

parser.add_argument("-p", "--port", type=int,

1795

help="Port number to receive requests on")

1796

parser.add_argument("--check", action="store_true",

1797

help="Run self-test")

1798

parser.add_argument("--debug", action="store_true",

1799

help="Debug mode; run in foreground and log"

1800

" to terminal")

1801

parser.add_argument("--debuglevel", metavar="LEVEL",

1802

help="Debug level for stdout output")

1803

parser.add_argument("--priority", help="GnuTLS"

1804

" priority string (see GnuTLS documentation)")

1805

parser.add_argument("--servicename",

1806

metavar="NAME", help="Zeroconf service name")

1807

parser.add_argument("--configdir",

1808

default="/etc/mandos", metavar="DIR",

1809

help="Directory to search for configuration"

1810

" files")

1811

parser.add_argument("--no-dbus", action="store_false",

1812

dest="use_dbus", help="Do not provide D-Bus"

1813

" system bus interface")

1814

parser.add_argument("--no-ipv6", action="store_false",

1815

dest="use_ipv6", help="Do not use IPv6")

1816

options = parser.parse_args()

1703

1817

1704

1818

if options.check:

1705

1819

import doctest

1707

1821

sys.exit()

1708

1822

1709

1823

# Default values for config file for server-global settings

1710

server_defaults = { u"interface": u"",

1711

u"address": u"",

1712

u"port": u"",

1713

u"debug": u"False",

1714

u"priority":

1715

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1716

u"servicename": u"Mandos",

1717

u"use_dbus": u"True",

1718

u"use_ipv6": u"True",

1719

u"debuglevel": u"",

1824

server_defaults = { "interface": "",

1825

"address": "",

1826

"port": "",

1827

"debug": "False",

1828

"priority":

1829

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1830

"servicename": "Mandos",

1831

"use_dbus": "True",

1832

"use_ipv6": "True",

1833

"debuglevel": "",

1720

1834

}

1721

1835

1722

1836

# Parse config file for server-global settings

1723

1837

server_config = configparser.SafeConfigParser(server_defaults)

1724

1838

del server_defaults

1725

1839

server_config.read(os.path.join(options.configdir,

1726

u"mandos.conf"))

1840

"mandos.conf"))

1727

1841

# Convert the SafeConfigParser object to a dict

1728

1842

server_settings = server_config.defaults()

1729

1843

# Use the appropriate methods on the non-string config options

1730

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1731

server_settings[option] = server_config.getboolean(u"DEFAULT",

1844

for option in ("debug", "use_dbus", "use_ipv6"):

1845

server_settings[option] = server_config.getboolean("DEFAULT",

1732

1846

option)

1733

1847

if server_settings["port"]:

1734

server_settings["port"] = server_config.getint(u"DEFAULT",

1735

u"port")

1848

server_settings["port"] = server_config.getint("DEFAULT",

1849

"port")

1736

1850

del server_config

1737

1851

1738

1852

# Override the settings from the config file with command line

1739

1853

# options, if set.

1740

for option in (u"interface", u"address", u"port", u"debug",

1741

u"priority", u"servicename", u"configdir",

1742

u"use_dbus", u"use_ipv6", u"debuglevel"):

1854

for option in ("interface", "address", "port", "debug",

1855

"priority", "servicename", "configdir",

1856

"use_dbus", "use_ipv6", "debuglevel"):

1743

1857

value = getattr(options, option)

1744

1858

if value is not None:

1745

1859

server_settings[option] = value

1753

1867

##################################################################

1754

1868

1755

1869

# For convenience

1756

debug = server_settings[u"debug"]

1757

debuglevel = server_settings[u"debuglevel"]

1758

use_dbus = server_settings[u"use_dbus"]

1759

use_ipv6 = server_settings[u"use_ipv6"]

1760

1761

if server_settings[u"servicename"] != u"Mandos":

1870

debug = server_settings["debug"]

1871

debuglevel = server_settings["debuglevel"]

1872

use_dbus = server_settings["use_dbus"]

1873

use_ipv6 = server_settings["use_ipv6"]

1874

1875

if server_settings["servicename"] != "Mandos":

1762

1876

syslogger.setFormatter(logging.Formatter

1763

(u'Mandos (%s) [%%(process)d]:'

1764

u' %%(levelname)s: %%(message)s'

1765

% server_settings[u"servicename"]))

1877

('Mandos (%s) [%%(process)d]:'

1878

' %%(levelname)s: %%(message)s'

1879

% server_settings["servicename"]))

1766

1880

1767

1881

# Parse config file with clients

1768

client_defaults = { u"timeout": u"1h",

1769

u"interval": u"5m",

1770

u"checker": u"fping -q -- %%(host)s",

1771

u"host": u"",

1772

u"approval_delay": u"0s",

1773

u"approval_duration": u"1s",

1882

client_defaults = { "timeout": "5m",

1883

"extended_timeout": "15m",

1884

"interval": "2m",

1885

"checker": "fping -q -- %%(host)s",

1886

"host": "",

1887

"approval_delay": "0s",

1888

"approval_duration": "1s",

1774

1889

}

1775

1890

client_config = configparser.SafeConfigParser(client_defaults)

1776

client_config.read(os.path.join(server_settings[u"configdir"],

1777

u"clients.conf"))

1891

client_config.read(os.path.join(server_settings["configdir"],

1892

"clients.conf"))

1778

1893

1779

1894

global mandos_dbus_service

1780

1895

mandos_dbus_service = None

1781

1896

1782

tcp_server = MandosServer((server_settings[u"address"],

1783

server_settings[u"port"]),

1897

tcp_server = MandosServer((server_settings["address"],

1898

server_settings["port"]),

1784

1899

ClientHandler,

1785

interface=(server_settings[u"interface"]

1900

interface=(server_settings["interface"]

1786

1901

or None),

1787

1902

use_ipv6=use_ipv6,

1788

1903

gnutls_priority=

1789

server_settings[u"priority"],

1904

server_settings["priority"],

1790

1905

use_dbus=use_dbus)

1791

1906

if not debug:

1792

pidfilename = u"/var/run/mandos.pid"

1907

pidfilename = "/var/run/mandos.pid"

1793

1908

try:

1794

pidfile = open(pidfilename, u"w")

1909

pidfile = open(pidfilename, "w")

1795

1910

except IOError:

1796

logger.error(u"Could not open file %r", pidfilename)

1911

logger.error("Could not open file %r", pidfilename)

1797

1912

1798

1913

try:

1799

uid = pwd.getpwnam(u"_mandos").pw_uid

1800

gid = pwd.getpwnam(u"_mandos").pw_gid

1914

uid = pwd.getpwnam("_mandos").pw_uid

1915

gid = pwd.getpwnam("_mandos").pw_gid

1801

1916

except KeyError:

1802

1917

try:

1803

uid = pwd.getpwnam(u"mandos").pw_uid

1804

gid = pwd.getpwnam(u"mandos").pw_gid

1918

uid = pwd.getpwnam("mandos").pw_uid

1919

gid = pwd.getpwnam("mandos").pw_gid

1805

1920

except KeyError:

1806

1921

try:

1807

uid = pwd.getpwnam(u"nobody").pw_uid

1808

gid = pwd.getpwnam(u"nobody").pw_gid

1922

uid = pwd.getpwnam("nobody").pw_uid

1923

gid = pwd.getpwnam("nobody").pw_gid

1809

1924

except KeyError:

1810

1925

uid = 65534

1811

1926

gid = 65534

1812

1927

try:

1813

1928

os.setgid(gid)

1814

1929

os.setuid(uid)

1815

except OSError, error:

1930

except OSError as error:

1816

1931

if error[0] != errno.EPERM:

1817

1932

raise error

1818

1933

1823

1938

level = getattr(logging, debuglevel.upper())

1824

1939

syslogger.setLevel(level)

1825

1940

console.setLevel(level)

1826

1941

1827

1942

if debug:

1828

1943

# Enable all possible GnuTLS debugging

1829

1944

1833

1948

1834

1949

@gnutls.library.types.gnutls_log_func

1835

1950

def debug_gnutls(level, string):

1836

logger.debug(u"GnuTLS: %s", string[:-1])

1951

logger.debug("GnuTLS: %s", string[:-1])

1837

1952

1838

1953

(gnutls.library.functions

1839

1954

.gnutls_global_set_log_function(debug_gnutls))

1847

1962

# No console logging

1848

1963

logger.removeHandler(console)

1849

1964

1965

# Need to fork before connecting to D-Bus

1966

if not debug:

1967

# Close all input and output, do double fork, etc.

1968

daemon()

1850

1969

1851

1970

global main_loop

1852

1971

# From the Avahi example code

1856

1975

# End of Avahi example code

1857

1976

if use_dbus:

1858

1977

try:

1859

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1978

bus_name = dbus.service.BusName("se.recompile.Mandos",

1860

1979

bus, do_not_queue=True)

1861

except dbus.exceptions.NameExistsException, e:

1862

logger.error(unicode(e) + u", disabling D-Bus")

1980

old_bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1981

bus, do_not_queue=True)

1982

except dbus.exceptions.NameExistsException as e:

1983

logger.error(unicode(e) + ", disabling D-Bus")

1863

1984

use_dbus = False

1864

server_settings[u"use_dbus"] = False

1985

server_settings["use_dbus"] = False

1865

1986

tcp_server.use_dbus = False

1866

1987

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1867

service = AvahiService(name = server_settings[u"servicename"],

1868

servicetype = u"_mandos._tcp",

1988

service = AvahiService(name = server_settings["servicename"],

1989

servicetype = "_mandos._tcp",

1869

1990

protocol = protocol, bus = bus)

1870

1991

if server_settings["interface"]:

1871

1992

service.interface = (if_nametoindex

1872

(str(server_settings[u"interface"])))

1873

1874

if not debug:

1875

# Close all input and output, do double fork, etc.

1876

daemon()

1877

1993

(str(server_settings["interface"])))

1994

1878

1995

global multiprocessing_manager

1879

1996

multiprocessing_manager = multiprocessing.Manager()

1880

1997

1881

1998

client_class = Client

1882

1999

if use_dbus:

1883

client_class = functools.partial(ClientDBus, bus = bus)

2000

client_class = functools.partial(ClientDBusTransitional, bus = bus)

1884

2001

def client_config_items(config, section):

1885

2002

special_settings = {

1886

2003

"approved_by_default":

1899

2016

client_config, section)))

1900

2017

for section in client_config.sections()))

1901

2018

if not tcp_server.clients:

1902

logger.warning(u"No clients defined")

2019

logger.warning("No clients defined")

1903

2020

1904

2021

if not debug:

1905

2022

try:

1906

2023

with pidfile:

1907

2024

pid = os.getpid()

1908

pidfile.write(str(pid) + "\n")

2025

pidfile.write(str(pid) + "\n".encode("utf-8"))

1909

2026

del pidfile

1910

2027

except IOError:

1911

logger.error(u"Could not write to file %r with PID %d",

2028

logger.error("Could not write to file %r with PID %d",

1912

2029

pidfilename, pid)

1913

2030

except NameError:

1914

2031

# "pidfile" was never created

1916

2033

del pidfilename

1917

2034

1918

2035

signal.signal(signal.SIGINT, signal.SIG_IGN)

1919

2036

1920

2037

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1921

2038

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1922

2039

1924

2041

class MandosDBusService(dbus.service.Object):

1925

2042

"""A D-Bus proxy object"""

1926

2043

def __init__(self):

1927

dbus.service.Object.__init__(self, bus, u"/")

1928

_interface = u"se.bsnet.fukt.Mandos"

2044

dbus.service.Object.__init__(self, bus, "/")

2045

_interface = "se.recompile.Mandos"

1929

2046

1930

@dbus.service.signal(_interface, signature=u"o")

2047

@dbus.service.signal(_interface, signature="o")

1931

2048

def ClientAdded(self, objpath):

1932

2049

"D-Bus signal"

1933

2050

pass

1934

2051

1935

@dbus.service.signal(_interface, signature=u"ss")

2052

@dbus.service.signal(_interface, signature="ss")

1936

2053

def ClientNotFound(self, fingerprint, address):

1937

2054

"D-Bus signal"

1938

2055

pass

1939

2056

1940

@dbus.service.signal(_interface, signature=u"os")

2057

@dbus.service.signal(_interface, signature="os")

1941

2058

def ClientRemoved(self, objpath, name):

1942

2059

"D-Bus signal"

1943

2060

pass

1944

2061

1945

@dbus.service.method(_interface, out_signature=u"ao")

2062

@dbus.service.method(_interface, out_signature="ao")

1946

2063

def GetAllClients(self):

1947

2064

"D-Bus method"

1948

2065

return dbus.Array(c.dbus_object_path

1949

2066

for c in tcp_server.clients)

1950

2067

1951

2068

@dbus.service.method(_interface,

1952

out_signature=u"a{oa{sv}}")

2069

out_signature="a{oa{sv}}")

1953

2070

def GetAllClientsWithProperties(self):

1954

2071

"D-Bus method"

1955

2072

return dbus.Dictionary(

1956

((c.dbus_object_path, c.GetAll(u""))

2073

((c.dbus_object_path, c.GetAll(""))

1957

2074

for c in tcp_server.clients),

1958

signature=u"oa{sv}")

2075

signature="oa{sv}")

1959

2076

1960

@dbus.service.method(_interface, in_signature=u"o")

2077

@dbus.service.method(_interface, in_signature="o")

1961

2078

def RemoveClient(self, object_path):

1962

2079

"D-Bus method"

1963

2080

for c in tcp_server.clients:

1973

2090

1974

2091

del _interface

1975

2092

1976

mandos_dbus_service = MandosDBusService()

2093

class MandosDBusServiceTransitional(MandosDBusService):

2094

__metaclass__ = AlternateDBusNamesMetaclass

2095

mandos_dbus_service = MandosDBusServiceTransitional()

1977

2096

1978

2097

def cleanup():

1979

2098

"Cleanup function; run on exit"

2005

2124

# Find out what port we got

2006

2125

service.port = tcp_server.socket.getsockname()[1]

2007

2126

if use_ipv6:

2008

logger.info(u"Now listening on address %r, port %d,"

2127

logger.info("Now listening on address %r, port %d,"

2009

2128

" flowinfo %d, scope_id %d"

2010

2129

% tcp_server.socket.getsockname())

2011

2130

else: # IPv4

2012

logger.info(u"Now listening on address %r, port %d"

2131

logger.info("Now listening on address %r, port %d"

2013

2132

% tcp_server.socket.getsockname())

2014

2133

2015

2134

#service.interface = tcp_server.socket.getsockname()[3]

2018

2137

# From the Avahi example code

2019

2138

try:

2020

2139

service.activate()

2021

except dbus.exceptions.DBusException, error:

2022

logger.critical(u"DBusException: %s", error)

2140

except dbus.exceptions.DBusException as error:

2141

logger.critical("DBusException: %s", error)

2023

2142

cleanup()

2024

2143

sys.exit(1)

2025

2144

# End of Avahi example code

2029

2148

(tcp_server.handle_request

2030

2149

(*args[2:], **kwargs) or True))

2031

2150

2032

logger.debug(u"Starting main loop")

2151

logger.debug("Starting main loop")

2033

2152

main_loop.run()

2034

except AvahiError, error:

2035

logger.critical(u"AvahiError: %s", error)

2153

except AvahiError as error:

2154

logger.critical("AvahiError: %s", error)

2036

2155

cleanup()

2037

2156

sys.exit(1)

2038

2157

except KeyboardInterrupt:

2039

2158

if debug:

2040

print >> sys.stderr

2041

logger.debug(u"Server received KeyboardInterrupt")

2042

logger.debug(u"Server exiting")

2159

print("", file=sys.stderr)

2160

logger.debug("Server received KeyboardInterrupt")

2161

logger.debug("Server exiting")

2043

2162

# Must run before the D-Bus bus name gets deregistered

2044

2163

cleanup()

2045

2164

2165

2046

2166

if __name__ == '__main__':

2047

2167

main()