/mandos/release : revision 237.11.13

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

60

61

import fcntl

61

62

import functools

62

63

import cPickle as pickle

63

import select

64

import multiprocessing

65

import types

64

66

65

67

import dbus

66

68

import dbus.service

81

83

SO_BINDTODEVICE = None

82

84

83

85

84

version = "1.0.14"

86

version = "1.4.0"

85

87

86

logger = logging.Logger(u'mandos')

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

87

90

syslogger = (logging.handlers.SysLogHandler

88

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

89

address = "/dev/log"))

92

address = str("/dev/log")))

90

93

syslogger.setFormatter(logging.Formatter

91

(u'Mandos [%(process)d]: %(levelname)s:'

92

u' %(message)s'))

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

93

96

logger.addHandler(syslogger)

94

97

95

98

console = logging.StreamHandler()

96

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

97

u' %(levelname)s:'

98

u' %(message)s'))

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

99

102

logger.addHandler(console)

100

103

101

104

class AvahiError(Exception):

118

121

Attributes:

119

122

interface: integer; avahi.IF_UNSPEC or an interface index.

120

123

Used to optionally bind to the specified interface.

121

122

type: string; Example: u'_mandos._tcp'.

124

125

type: string; Example: '_mandos._tcp'.

123

126

See <http://www.dns-sd.org/ServiceTypes.html>

124

127

port: integer; what port to announce

125

128

TXT: list of strings; TXT record for the service

134

137

"""

135

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

136

139

servicetype = None, port = None, TXT = None,

137

domain = u"", host = u"", max_renames = 32768,

140

domain = "", host = "", max_renames = 32768,

138

141

protocol = avahi.PROTO_UNSPEC, bus = None):

139

142

self.interface = interface

140

143

self.name = name

149

152

self.group = None # our entry group

150

153

self.server = None

151

154

self.bus = bus

155

self.entry_group_state_changed_match = None

152

156

def rename(self):

153

157

"""Derived from the Avahi example code"""

154

158

if self.rename_count >= self.max_renames:

155

logger.critical(u"No suitable Zeroconf service name found"

156

u" after %i retries, exiting.",

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

157

161

self.rename_count)

158

raise AvahiServiceError(u"Too many renames")

159

self.name = self.server.GetAlternativeServiceName(self.name)

160

logger.info(u"Changing Zeroconf service name to %r ...",

161

unicode(self.name))

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server

164

.GetAlternativeServiceName(self.name))

165

logger.info("Changing Zeroconf service name to %r ...",

166

self.name)

162

167

syslogger.setFormatter(logging.Formatter

163

(u'Mandos (%s) [%%(process)d]:'

164

u' %%(levelname)s: %%(message)s'

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

165

170

% self.name))

166

171

self.remove()

167

self.add()

172

try:

173

self.add()

174

except dbus.exceptions.DBusException as error:

175

logger.critical("DBusException: %s", error)

176

self.cleanup()

177

os._exit(1)

168

178

self.rename_count += 1

169

179

def remove(self):

170

180

"""Derived from the Avahi example code"""

181

if self.entry_group_state_changed_match is not None:

182

self.entry_group_state_changed_match.remove()

183

self.entry_group_state_changed_match = None

171

184

if self.group is not None:

172

185

self.group.Reset()

173

186

def add(self):

174

187

"""Derived from the Avahi example code"""

188

self.remove()

175

189

if self.group is None:

176

190

self.group = dbus.Interface(

177

191

self.bus.get_object(avahi.DBUS_NAME,

178

192

self.server.EntryGroupNew()),

179

193

avahi.DBUS_INTERFACE_ENTRY_GROUP)

180

self.group.connect_to_signal('StateChanged',

181

self

182

.entry_group_state_changed)

183

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

194

self.entry_group_state_changed_match = (

195

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

184

198

self.name, self.type)

185

199

self.group.AddService(

186

200

self.interface,

193

207

self.group.Commit()

194

208

def entry_group_state_changed(self, state, error):

195

209

"""Derived from the Avahi example code"""

196

logger.debug(u"Avahi entry group state change: %i", state)

210

logger.debug("Avahi entry group state change: %i", state)

197

211

198

212

if state == avahi.ENTRY_GROUP_ESTABLISHED:

199

logger.debug(u"Zeroconf service established.")

213

logger.debug("Zeroconf service established.")

200

214

elif state == avahi.ENTRY_GROUP_COLLISION:

201

logger.warning(u"Zeroconf service name collision.")

215

logger.info("Zeroconf service name collision.")

202

216

self.rename()

203

217

elif state == avahi.ENTRY_GROUP_FAILURE:

204

logger.critical(u"Avahi: Error in group state changed %s",

218

logger.critical("Avahi: Error in group state changed %s",

205

219

unicode(error))

206

raise AvahiGroupError(u"State changed: %s"

220

raise AvahiGroupError("State changed: %s"

207

221

% unicode(error))

208

222

def cleanup(self):

209

223

"""Derived from the Avahi example code"""

210

224

if self.group is not None:

211

self.group.Free()

225

try:

226

self.group.Free()

227

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

229

pass

212

230

self.group = None

213

def server_state_changed(self, state):

231

self.remove()

232

def server_state_changed(self, state, error=None):

214

233

"""Derived from the Avahi example code"""

215

logger.debug(u"Avahi server state change: %i", state)

216

if state == avahi.SERVER_COLLISION:

217

logger.error(u"Zeroconf server name collision")

218

self.remove()

234

logger.debug("Avahi server state change: %i", state)

235

bad_states = { avahi.SERVER_INVALID:

236

"Zeroconf server invalid",

237

avahi.SERVER_REGISTERING: None,

238

avahi.SERVER_COLLISION:

239

"Zeroconf server name collision",

240

avahi.SERVER_FAILURE:

241

"Zeroconf server failure" }

242

if state in bad_states:

243

if bad_states[state] is not None:

244

if error is None:

245

logger.error(bad_states[state])

246

else:

247

logger.error(bad_states[state] + ": %r", error)

248

self.cleanup()

219

249

elif state == avahi.SERVER_RUNNING:

220

250

self.add()

251

else:

252

if error is None:

253

logger.debug("Unknown state: %r", state)

254

else:

255

logger.debug("Unknown state: %r: %r", state, error)

221

256

def activate(self):

222

257

"""Derived from the Avahi example code"""

223

258

if self.server is None:

224

259

self.server = dbus.Interface(

225

260

self.bus.get_object(avahi.DBUS_NAME,

226

avahi.DBUS_PATH_SERVER),

261

avahi.DBUS_PATH_SERVER,

262

follow_name_owner_changes=True),

227

263

avahi.DBUS_INTERFACE_SERVER)

228

self.server.connect_to_signal(u"StateChanged",

264

self.server.connect_to_signal("StateChanged",

229

265

self.server_state_changed)

230

266

self.server_state_changed(self.server.GetState())

231

267

232

268

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

274

233

275

class Client(object):

234

276

"""A representation of a client host served by this server.

235

277

236

278

Attributes:

237

238

D-Bus identifiers

279

_approved: bool(); 'None' if not yet approved/disapproved

280

approval_delay: datetime.timedelta(); Time to wait for approval

281

approval_duration: datetime.timedelta(); Duration of one approval

282

checker: subprocess.Popen(); a running checker process used

283

to see if the client lives.

284

'None' if no process is running.

285

checker_callback_tag: a gobject event source tag, or None

286

checker_command: string; External command which is run to check

287

if client lives. %() expansions are done at

288

runtime with vars(self) as dict, so that for

289

instance %(name)s can be used in the command.

290

checker_initiator_tag: a gobject event source tag, or None

291

created: datetime.datetime(); (UTC) object creation

292

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

294

disable_initiator_tag: a gobject event source tag, or None

295

enabled: bool()

239

296

fingerprint: string (40 or 32 hexadecimal digits); used to

240

297

uniquely identify the client

241

secret: bytestring; sent verbatim (over TLS) to client

242

298

host: string; available for use by the checker command

243

created: datetime.datetime(); (UTC) object creation

299

interval: datetime.timedelta(); How often to start a new checker

300

last_approval_request: datetime.datetime(); (UTC) or None

301

last_checked_ok: datetime.datetime(); (UTC) or None

244

302

last_enabled: datetime.datetime(); (UTC)

245

enabled: bool()

246

last_checked_ok: datetime.datetime(); (UTC) or None

303

304

D-Bus identifiers

305

secret: bytestring; sent verbatim (over TLS) to client

247

306

timeout: datetime.timedelta(); How long from last_checked_ok

248

307

until this client is disabled

249

interval: datetime.timedelta(); How often to start a new checker

250

disable_hook: If set, called by disable() as disable_hook(self)

251

checker: subprocess.Popen(); a running checker process used

252

to see if the client lives.

253

'None' if no process is running.

254

checker_initiator_tag: a gobject event source tag, or None

255

disable_initiator_tag: - '' -

256

checker_callback_tag: - '' -

257

checker_command: string; External command which is run to check if

258

client lives. %() expansions are done at

259

runtime with vars(self) as dict, so that for

260

instance %(name)s can be used in the command.

261

current_checker_command: string; current running checker_command

308

extended_timeout: extra long timeout when password has been sent

309

runtime_expansions: Allowed attributes for runtime expansion.

310

expires: datetime.datetime(); time (UTC) when a client will be

311

disabled, or None

262

312

"""

263

313

264

@staticmethod

265

def _timedelta_to_milliseconds(td):

266

"Convert a datetime.timedelta() to milliseconds"

267

return ((td.days * 24 * 60 * 60 * 1000)

268

+ (td.seconds * 1000)

269

+ (td.microseconds // 1000))

314

runtime_expansions = ("approval_delay", "approval_duration",

315

"created", "enabled", "fingerprint",

316

"host", "interval", "last_checked_ok",

317

"last_enabled", "name", "timeout")

270

318

271

319

def timeout_milliseconds(self):

272

320

"Return the 'timeout' attribute in milliseconds"

273

return self._timedelta_to_milliseconds(self.timeout)

321

return _timedelta_to_milliseconds(self.timeout)

322

323

def extended_timeout_milliseconds(self):

324

"Return the 'extended_timeout' attribute in milliseconds"

325

return _timedelta_to_milliseconds(self.extended_timeout)

274

326

275

327

def interval_milliseconds(self):

276

328

"Return the 'interval' attribute in milliseconds"

277

return self._timedelta_to_milliseconds(self.interval)

329

return _timedelta_to_milliseconds(self.interval)

330

331

def approval_delay_milliseconds(self):

332

return _timedelta_to_milliseconds(self.approval_delay)

278

333

279

334

def __init__(self, name = None, disable_hook=None, config=None):

280

335

"""Note: the 'checker' key in 'config' sets the

283

338

self.name = name

284

339

if config is None:

285

340

config = {}

286

logger.debug(u"Creating client %r", self.name)

341

logger.debug("Creating client %r", self.name)

287

342

# Uppercase and remove spaces from fingerprint for later

288

343

# comparison purposes with return value from the fingerprint()

289

344

# function

290

self.fingerprint = (config[u"fingerprint"].upper()

291

.replace(u" ", u""))

292

logger.debug(u" Fingerprint: %s", self.fingerprint)

293

if u"secret" in config:

294

self.secret = config[u"secret"].decode(u"base64")

295

elif u"secfile" in config:

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

347

logger.debug(" Fingerprint: %s", self.fingerprint)

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

296

351

with open(os.path.expanduser(os.path.expandvars

297

(config[u"secfile"])),

352

(config["secfile"])),

298

353

"rb") as secfile:

299

354

self.secret = secfile.read()

300

355

else:

301

raise TypeError(u"No secret or secfile for client %s"

356

raise TypeError("No secret or secfile for client %s"

302

357

% self.name)

303

self.host = config.get(u"host", u"")

358

self.host = config.get("host", "")

304

359

self.created = datetime.datetime.utcnow()

305

360

self.enabled = False

361

self.last_approval_request = None

306

362

self.last_enabled = None

307

363

self.last_checked_ok = None

308

self.timeout = string_to_delta(config[u"timeout"])

309

self.interval = string_to_delta(config[u"interval"])

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

310

368

self.disable_hook = disable_hook

311

369

self.checker = None

312

370

self.checker_initiator_tag = None

313

371

self.disable_initiator_tag = None

372

self.expires = None

314

373

self.checker_callback_tag = None

315

self.checker_command = config[u"checker"]

374

self.checker_command = config["checker"]

316

375

self.current_checker_command = None

317

376

self.last_connect = None

377

self._approved = None

378

self.approved_by_default = config.get("approved_by_default",

379

True)

380

self.approvals_pending = 0

381

self.approval_delay = string_to_delta(

382

config["approval_delay"])

383

self.approval_duration = string_to_delta(

384

config["approval_duration"])

385

self.changedstate = (multiprocessing_manager

386

.Condition(multiprocessing_manager

387

.Lock()))

388

389

def send_changedstate(self):

390

self.changedstate.acquire()

391

self.changedstate.notify_all()

392

self.changedstate.release()

318

393

319

394

def enable(self):

320

395

"""Start this client's checker and timeout hooks"""

321

if getattr(self, u"enabled", False):

396

if getattr(self, "enabled", False):

322

397

# Already enabled

323

398

return

324

self.last_enabled = datetime.datetime.utcnow()

399

self.send_changedstate()

325

400

# Schedule a new checker to be started an 'interval' from now,

326

401

# and every interval from then on.

327

402

self.checker_initiator_tag = (gobject.timeout_add

328

403

(self.interval_milliseconds(),

329

404

self.start_checker))

330

405

# Schedule a disable() when 'timeout' has passed

406

self.expires = datetime.datetime.utcnow() + self.timeout

331

407

self.disable_initiator_tag = (gobject.timeout_add

332

408

(self.timeout_milliseconds(),

333

409

self.disable))

334

410

self.enabled = True

411

self.last_enabled = datetime.datetime.utcnow()

335

412

# Also start a new checker *right now*.

336

413

self.start_checker()

337

414

340

417

if not getattr(self, "enabled", False):

341

418

return False

342

419

if not quiet:

343

logger.info(u"Disabling client %s", self.name)

344

if getattr(self, u"disable_initiator_tag", False):

420

self.send_changedstate()

421

if not quiet:

422

logger.info("Disabling client %s", self.name)

423

if getattr(self, "disable_initiator_tag", False):

345

424

gobject.source_remove(self.disable_initiator_tag)

346

425

self.disable_initiator_tag = None

347

if getattr(self, u"checker_initiator_tag", False):

426

self.expires = None

427

if getattr(self, "checker_initiator_tag", False):

348

428

gobject.source_remove(self.checker_initiator_tag)

349

429

self.checker_initiator_tag = None

350

430

self.stop_checker()

365

445

if os.WIFEXITED(condition):

366

446

exitstatus = os.WEXITSTATUS(condition)

367

447

if exitstatus == 0:

368

logger.info(u"Checker for %(name)s succeeded",

448

logger.info("Checker for %(name)s succeeded",

369

449

vars(self))

370

450

self.checked_ok()

371

451

else:

372

logger.info(u"Checker for %(name)s failed",

452

logger.info("Checker for %(name)s failed",

373

453

vars(self))

374

454

else:

375

logger.warning(u"Checker for %(name)s crashed?",

455

logger.warning("Checker for %(name)s crashed?",

376

456

vars(self))

377

457

378

def checked_ok(self):

458

def checked_ok(self, timeout=None):

379

459

"""Bump up the timeout for this client.

380

460

381

461

This should only be called when the client has been seen,

382

462

alive and well.

383

463

"""

464

if timeout is None:

465

timeout = self.timeout

384

466

self.last_checked_ok = datetime.datetime.utcnow()

385

467

gobject.source_remove(self.disable_initiator_tag)

386

468

self.disable_initiator_tag = (gobject.timeout_add

387

(self.timeout_milliseconds(),

388

self.disable))

469

(_timedelta_to_milliseconds

470

(timeout), self.disable))

471

self.expires = datetime.datetime.utcnow() + timeout

472

473

def need_approval(self):

474

self.last_approval_request = datetime.datetime.utcnow()

389

475

390

476

def start_checker(self):

391

477

"""Start a new checker subprocess if one is not running.

404

490

# If a checker exists, make sure it is not a zombie

405

491

try:

406

492

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

407

except (AttributeError, OSError), error:

493

except (AttributeError, OSError) as error:

408

494

if (isinstance(error, OSError)

409

495

and error.errno != errno.ECHILD):

410

496

raise error

411

497

else:

412

498

if pid:

413

logger.warning(u"Checker was a zombie")

499

logger.warning("Checker was a zombie")

414

500

gobject.source_remove(self.checker_callback_tag)

415

501

self.checker_callback(pid, status,

416

502

self.current_checker_command)

421

507

command = self.checker_command % self.host

422

508

except TypeError:

423

509

# Escape attributes for the shell

424

escaped_attrs = dict((key,

425

re.escape(unicode(str(val),

426

errors=

427

u'replace')))

428

for key, val in

429

vars(self).iteritems())

510

escaped_attrs = dict(

511

(attr,

512

re.escape(unicode(str(getattr(self, attr, "")),

513

errors=

514

'replace')))

515

for attr in

516

self.runtime_expansions)

517

430

518

try:

431

519

command = self.checker_command % escaped_attrs

432

except TypeError, error:

433

logger.error(u'Could not format string "%s":'

434

u' %s', self.checker_command, error)

520

except TypeError as error:

521

logger.error('Could not format string "%s":'

522

' %s', self.checker_command, error)

435

523

return True # Try again later

436

524

self.current_checker_command = command

437

525

try:

438

logger.info(u"Starting checker %r for %s",

526

logger.info("Starting checker %r for %s",

439

527

command, self.name)

440

528

# We don't need to redirect stdout and stderr, since

441

529

# in normal mode, that is already done by daemon(),

443

531

# always replaced by /dev/null.)

444

532

self.checker = subprocess.Popen(command,

445

533

close_fds=True,

446

shell=True, cwd=u"/")

534

shell=True, cwd="/")

447

535

self.checker_callback_tag = (gobject.child_watch_add

448

536

(self.checker.pid,

449

537

self.checker_callback,

454

542

if pid:

455

543

gobject.source_remove(self.checker_callback_tag)

456

544

self.checker_callback(pid, status, command)

457

except OSError, error:

458

logger.error(u"Failed to start subprocess: %s",

545

except OSError as error:

546

logger.error("Failed to start subprocess: %s",

459

547

error)

460

548

# Re-run this periodically if run by gobject.timeout_add

461

549

return True

465

553

if self.checker_callback_tag:

466

554

gobject.source_remove(self.checker_callback_tag)

467

555

self.checker_callback_tag = None

468

if getattr(self, u"checker", None) is None:

556

if getattr(self, "checker", None) is None:

469

557

return

470

logger.debug(u"Stopping checker for %(name)s", vars(self))

558

logger.debug("Stopping checker for %(name)s", vars(self))

471

559

try:

472

560

os.kill(self.checker.pid, signal.SIGTERM)

473

561

#time.sleep(0.5)

474

562

#if self.checker.poll() is None:

475

563

# os.kill(self.checker.pid, signal.SIGKILL)

476

except OSError, error:

564

except OSError as error:

477

565

if error.errno != errno.ESRCH: # No such process

478

566

raise

479

567

self.checker = None

480

568

481

569

482

def dbus_service_property(dbus_interface, signature=u"v",

483

access=u"readwrite", byte_arrays=False):

570

def dbus_service_property(dbus_interface, signature="v",

571

access="readwrite", byte_arrays=False):

484

572

"""Decorators for marking methods of a DBusObjectWithProperties to

485

573

become properties on the D-Bus.

486

574

493

581

"""

494

582

# Encoding deeply encoded byte arrays is not supported yet by the

495

583

# "Set" method, so we fail early here:

496

if byte_arrays and signature != u"ay":

497

raise ValueError(u"Byte arrays not supported for non-'ay'"

498

u" signature %r" % signature)

584

if byte_arrays and signature != "ay":

585

raise ValueError("Byte arrays not supported for non-'ay'"

586

" signature %r" % signature)

499

587

def decorator(func):

500

588

func._dbus_is_property = True

501

589

func._dbus_interface = dbus_interface

502

590

func._dbus_signature = signature

503

591

func._dbus_access = access

504

592

func._dbus_name = func.__name__

505

if func._dbus_name.endswith(u"_dbus_property"):

593

if func._dbus_name.endswith("_dbus_property"):

506

594

func._dbus_name = func._dbus_name[:-14]

507

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

595

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

508

596

return func

509

597

return decorator

510

598

530

618

531

619

class DBusObjectWithProperties(dbus.service.Object):

532

620

"""A D-Bus object with properties.

533

621

534

622

Classes inheriting from this can use the dbus_service_property

535

623

decorator to expose methods as D-Bus properties. It exposes the

536

624

standard Get(), Set(), and GetAll() methods on the D-Bus.

538

626

539

627

@staticmethod

540

628

def _is_dbus_property(obj):

541

return getattr(obj, u"_dbus_is_property", False)

629

return getattr(obj, "_dbus_is_property", False)

542

630

543

631

def _get_all_dbus_properties(self):

544

632

"""Returns a generator of (name, attribute) pairs

545

633

"""

546

return ((prop._dbus_name, prop)

634

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

635

for cls in self.__class__.__mro__

547

636

for name, prop in

548

inspect.getmembers(self, self._is_dbus_property))

637

inspect.getmembers(cls, self._is_dbus_property))

549

638

550

639

def _get_dbus_property(self, interface_name, property_name):

551

640

"""Returns a bound method if one exists which is a D-Bus

552

641

property with the specified name and interface.

553

642

"""

554

for name in (property_name,

555

property_name + u"_dbus_property"):

556

prop = getattr(self, name, None)

557

if (prop is None

558

or not self._is_dbus_property(prop)

559

or prop._dbus_name != property_name

560

or (interface_name and prop._dbus_interface

561

and interface_name != prop._dbus_interface)):

562

continue

563

return prop

643

for cls in self.__class__.__mro__:

644

for name, value in (inspect.getmembers

645

(cls, self._is_dbus_property)):

646

if (value._dbus_name == property_name

647

and value._dbus_interface == interface_name):

648

return value.__get__(self)

649

564

650

# No such property

565

raise DBusPropertyNotFound(self.dbus_object_path + u":"

566

+ interface_name + u"."

651

raise DBusPropertyNotFound(self.dbus_object_path + ":"

652

+ interface_name + "."

567

653

+ property_name)

568

654

569

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

570

out_signature=u"v")

655

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

656

out_signature="v")

571

657

def Get(self, interface_name, property_name):

572

658

"""Standard D-Bus property Get() method, see D-Bus standard.

573

659

"""

574

660

prop = self._get_dbus_property(interface_name, property_name)

575

if prop._dbus_access == u"write":

661

if prop._dbus_access == "write":

576

662

raise DBusPropertyAccessException(property_name)

577

663

value = prop()

578

if not hasattr(value, u"variant_level"):

664

if not hasattr(value, "variant_level"):

579

665

return value

580

666

return type(value)(value, variant_level=value.variant_level+1)

581

667

582

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

668

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

583

669

def Set(self, interface_name, property_name, value):

584

670

"""Standard D-Bus property Set() method, see D-Bus standard.

585

671

"""

586

672

prop = self._get_dbus_property(interface_name, property_name)

587

if prop._dbus_access == u"read":

673

if prop._dbus_access == "read":

588

674

raise DBusPropertyAccessException(property_name)

589

if prop._dbus_get_args_options[u"byte_arrays"]:

675

if prop._dbus_get_args_options["byte_arrays"]:

590

676

# The byte_arrays option is not supported yet on

591

677

# signatures other than "ay".

592

if prop._dbus_signature != u"ay":

678

if prop._dbus_signature != "ay":

593

679

raise ValueError

594

680

value = dbus.ByteArray(''.join(unichr(byte)

595

681

for byte in value))

596

682

prop(value)

597

683

598

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

599

out_signature=u"a{sv}")

684

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

685

out_signature="a{sv}")

600

686

def GetAll(self, interface_name):

601

687

"""Standard D-Bus property GetAll() method, see D-Bus

602

688

standard.

603

689

604

690

Note: Will not include properties with access="write".

605

691

"""

606

692

all = {}

610

696

# Interface non-empty but did not match

611

697

continue

612

698

# Ignore write-only properties

613

if prop._dbus_access == u"write":

699

if prop._dbus_access == "write":

614

700

continue

615

701

value = prop()

616

if not hasattr(value, u"variant_level"):

702

if not hasattr(value, "variant_level"):

617

703

all[name] = value

618

704

continue

619

705

all[name] = type(value)(value, variant_level=

620

706

value.variant_level+1)

621

return dbus.Dictionary(all, signature=u"sv")

707

return dbus.Dictionary(all, signature="sv")

622

708

623

709

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

624

out_signature=u"s",

710

out_signature="s",

625

711

path_keyword='object_path',

626

712

connection_keyword='connection')

627

713

def Introspect(self, object_path, connection):

632

718

try:

633

719

document = xml.dom.minidom.parseString(xmlstring)

634

720

def make_tag(document, name, prop):

635

e = document.createElement(u"property")

636

e.setAttribute(u"name", name)

637

e.setAttribute(u"type", prop._dbus_signature)

638

e.setAttribute(u"access", prop._dbus_access)

721

e = document.createElement("property")

722

e.setAttribute("name", name)

723

e.setAttribute("type", prop._dbus_signature)

724

e.setAttribute("access", prop._dbus_access)

639

725

return e

640

for if_tag in document.getElementsByTagName(u"interface"):

726

for if_tag in document.getElementsByTagName("interface"):

641

727

for tag in (make_tag(document, name, prop)

642

728

for name, prop

643

729

in self._get_all_dbus_properties()

644

730

if prop._dbus_interface

645

== if_tag.getAttribute(u"name")):

731

== if_tag.getAttribute("name")):

646

732

if_tag.appendChild(tag)

647

733

# Add the names to the return values for the

648

734

# "org.freedesktop.DBus.Properties" methods

649

if (if_tag.getAttribute(u"name")

650

== u"org.freedesktop.DBus.Properties"):

651

for cn in if_tag.getElementsByTagName(u"method"):

652

if cn.getAttribute(u"name") == u"Get":

653

for arg in cn.getElementsByTagName(u"arg"):

654

if (arg.getAttribute(u"direction")

655

== u"out"):

656

arg.setAttribute(u"name", u"value")

657

elif cn.getAttribute(u"name") == u"GetAll":

658

for arg in cn.getElementsByTagName(u"arg"):

659

if (arg.getAttribute(u"direction")

660

== u"out"):

661

arg.setAttribute(u"name", u"props")

662

xmlstring = document.toxml(u"utf-8")

735

if (if_tag.getAttribute("name")

736

== "org.freedesktop.DBus.Properties"):

737

for cn in if_tag.getElementsByTagName("method"):

738

if cn.getAttribute("name") == "Get":

739

for arg in cn.getElementsByTagName("arg"):

740

if (arg.getAttribute("direction")

741

== "out"):

742

arg.setAttribute("name", "value")

743

elif cn.getAttribute("name") == "GetAll":

744

for arg in cn.getElementsByTagName("arg"):

745

if (arg.getAttribute("direction")

746

== "out"):

747

arg.setAttribute("name", "props")

748

xmlstring = document.toxml("utf-8")

663

749

document.unlink()

664

750

except (AttributeError, xml.dom.DOMException,

665

xml.parsers.expat.ExpatError), error:

666

logger.error(u"Failed to override Introspection method",

751

xml.parsers.expat.ExpatError) as error:

752

logger.error("Failed to override Introspection method",

667

753

error)

668

754

return xmlstring

669

755

670

756

757

def datetime_to_dbus (dt, variant_level=0):

758

"""Convert a UTC datetime.datetime() to a D-Bus type."""

759

if dt is None:

760

return dbus.String("", variant_level = variant_level)

761

return dbus.String(dt.isoformat(),

762

variant_level=variant_level)

763

764

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

765

.__metaclass__):

766

"""Applied to an empty subclass of a D-Bus object, this metaclass

767

will add additional D-Bus attributes matching a certain pattern.

768

"""

769

def __new__(mcs, name, bases, attr):

770

# Go through all the base classes which could have D-Bus

771

# methods, signals, or properties in them

772

for base in (b for b in bases

773

if issubclass(b, dbus.service.Object)):

774

# Go though all attributes of the base class

775

for attrname, attribute in inspect.getmembers(base):

776

# Ignore non-D-Bus attributes, and D-Bus attributes

777

# with the wrong interface name

778

if (not hasattr(attribute, "_dbus_interface")

779

or not attribute._dbus_interface

780

.startswith("se.recompile.Mandos")):

781

continue

782

# Create an alternate D-Bus interface name based on

783

# the current name

784

alt_interface = (attribute._dbus_interface

785

.replace("se.recompile.Mandos",

786

"se.bsnet.fukt.Mandos"))

787

# Is this a D-Bus signal?

788

if getattr(attribute, "_dbus_is_signal", False):

789

# Extract the original non-method function by

790

# black magic

791

nonmethod_func = (dict(

792

zip(attribute.func_code.co_freevars,

793

attribute.__closure__))["func"]

794

.cell_contents)

795

# Create a new, but exactly alike, function

796

# object, and decorate it to be a new D-Bus signal

797

# with the alternate D-Bus interface name

798

new_function = (dbus.service.signal

799

(alt_interface,

800

attribute._dbus_signature)

801

(types.FunctionType(

802

nonmethod_func.func_code,

803

nonmethod_func.func_globals,

804

nonmethod_func.func_name,

805

nonmethod_func.func_defaults,

806

nonmethod_func.func_closure)))

807

# Define a creator of a function to call both the

808

# old and new functions, so both the old and new

809

# signals gets sent when the function is called

810

def fixscope(func1, func2):

811

"""This function is a scope container to pass

812

func1 and func2 to the "call_both" function

813

outside of its arguments"""

814

def call_both(*args, **kwargs):

815

"""This function will emit two D-Bus

816

signals by calling func1 and func2"""

817

func1(*args, **kwargs)

818

func2(*args, **kwargs)

819

return call_both

820

# Create the "call_both" function and add it to

821

# the class

822

attr[attrname] = fixscope(attribute,

823

new_function)

824

# Is this a D-Bus method?

825

elif getattr(attribute, "_dbus_is_method", False):

826

# Create a new, but exactly alike, function

827

# object. Decorate it to be a new D-Bus method

828

# with the alternate D-Bus interface name. Add it

829

# to the class.

830

attr[attrname] = (dbus.service.method

831

(alt_interface,

832

attribute._dbus_in_signature,

833

attribute._dbus_out_signature)

834

(types.FunctionType

835

(attribute.func_code,

836

attribute.func_globals,

837

attribute.func_name,

838

attribute.func_defaults,

839

attribute.func_closure)))

840

# Is this a D-Bus property?

841

elif getattr(attribute, "_dbus_is_property", False):

842

# Create a new, but exactly alike, function

843

# object, and decorate it to be a new D-Bus

844

# property with the alternate D-Bus interface

845

# name. Add it to the class.

846

attr[attrname] = (dbus_service_property

847

(alt_interface,

848

attribute._dbus_signature,

849

attribute._dbus_access,

850

attribute

851

._dbus_get_args_options

852

["byte_arrays"])

853

(types.FunctionType

854

(attribute.func_code,

855

attribute.func_globals,

856

attribute.func_name,

857

attribute.func_defaults,

858

attribute.func_closure)))

859

return type.__new__(mcs, name, bases, attr)

860

671

861

class ClientDBus(Client, DBusObjectWithProperties):

672

862

"""A Client class using D-Bus

673

863

675

865

dbus_object_path: dbus.ObjectPath

676

866

bus: dbus.SystemBus()

677

867

"""

868

869

runtime_expansions = (Client.runtime_expansions

870

+ ("dbus_object_path",))

871

678

872

# dbus.service.Object doesn't use super(), so we can't either.

679

873

680

874

def __init__(self, bus = None, *args, **kwargs):

875

self._approvals_pending = 0

681

876

self.bus = bus

682

877

Client.__init__(self, *args, **kwargs)

683

878

# Only now, when this client is initialized, can it show up on

684

879

# the D-Bus

880

client_object_name = unicode(self.name).translate(

881

{ord("."): ord("_"),

882

ord("-"): ord("_")})

685

883

self.dbus_object_path = (dbus.ObjectPath

686

(u"/clients/"

687

+ self.name.replace(u".", u"_")))

884

("/clients/" + client_object_name))

688

885

DBusObjectWithProperties.__init__(self, self.bus,

689

886

self.dbus_object_path)

690

691

@staticmethod

692

def _datetime_to_dbus(dt, variant_level=0):

693

"""Convert a UTC datetime.datetime() to a D-Bus type."""

694

return dbus.String(dt.isoformat(),

695

variant_level=variant_level)

696

697

def enable(self):

698

oldstate = getattr(self, u"enabled", False)

699

r = Client.enable(self)

700

if oldstate != self.enabled:

701

# Emit D-Bus signals

702

self.PropertyChanged(dbus.String(u"enabled"),

703

dbus.Boolean(True, variant_level=1))

704

self.PropertyChanged(

705

dbus.String(u"last_enabled"),

706

self._datetime_to_dbus(self.last_enabled,

707

variant_level=1))

708

return r

709

710

def disable(self, quiet = False):

711

oldstate = getattr(self, u"enabled", False)

712

r = Client.disable(self, quiet=quiet)

713

if not quiet and oldstate != self.enabled:

714

# Emit D-Bus signal

715

self.PropertyChanged(dbus.String(u"enabled"),

716

dbus.Boolean(False, variant_level=1))

717

return r

887

888

def notifychangeproperty(transform_func,

889

dbus_name, type_func=lambda x: x,

890

variant_level=1):

891

""" Modify a variable so that it's a property which announces

892

its changes to DBus.

893

894

transform_fun: Function that takes a value and transforms it

895

to a D-Bus type.

896

dbus_name: D-Bus name of the variable

897

type_func: Function that transform the value before sending it

898

to the D-Bus. Default: no transform

899

variant_level: D-Bus variant level. Default: 1

900

"""

901

attrname = "_{0}".format(dbus_name)

902

def setter(self, value):

903

if hasattr(self, "dbus_object_path"):

904

if (not hasattr(self, attrname) or

905

type_func(getattr(self, attrname, None))

906

!= type_func(value)):

907

dbus_value = transform_func(type_func(value),

908

variant_level)

909

self.PropertyChanged(dbus.String(dbus_name),

910

dbus_value)

911

setattr(self, attrname, value)

912

913

return property(lambda self: getattr(self, attrname), setter)

914

915

916

expires = notifychangeproperty(datetime_to_dbus, "Expires")

917

approvals_pending = notifychangeproperty(dbus.Boolean,

918

"ApprovalPending",

919

type_func = bool)

920

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

921

last_enabled = notifychangeproperty(datetime_to_dbus,

922

"LastEnabled")

923

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

924

type_func = lambda checker:

925

checker is not None)

926

last_checked_ok = notifychangeproperty(datetime_to_dbus,

927

"LastCheckedOK")

928

last_approval_request = notifychangeproperty(

929

datetime_to_dbus, "LastApprovalRequest")

930

approved_by_default = notifychangeproperty(dbus.Boolean,

931

"ApprovedByDefault")

932

approval_delay = notifychangeproperty(dbus.UInt16,

933

"ApprovalDelay",

934

type_func =

935

_timedelta_to_milliseconds)

936

approval_duration = notifychangeproperty(

937

dbus.UInt16, "ApprovalDuration",

938

type_func = _timedelta_to_milliseconds)

939

host = notifychangeproperty(dbus.String, "Host")

940

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

941

type_func =

942

_timedelta_to_milliseconds)

943

extended_timeout = notifychangeproperty(

944

dbus.UInt16, "ExtendedTimeout",

945

type_func = _timedelta_to_milliseconds)

946

interval = notifychangeproperty(dbus.UInt16,

947

"Interval",

948

type_func =

949

_timedelta_to_milliseconds)

950

checker_command = notifychangeproperty(dbus.String, "Checker")

951

952

del notifychangeproperty

718

953

719

954

def __del__(self, *args, **kwargs):

720

955

try:

721

956

self.remove_from_connection()

722

957

except LookupError:

723

958

pass

724

if hasattr(DBusObjectWithProperties, u"__del__"):

959

if hasattr(DBusObjectWithProperties, "__del__"):

725

960

DBusObjectWithProperties.__del__(self, *args, **kwargs)

726

961

Client.__del__(self, *args, **kwargs)

727

962

729

964

*args, **kwargs):

730

965

self.checker_callback_tag = None

731

966

self.checker = None

732

# Emit D-Bus signal

733

self.PropertyChanged(dbus.String(u"checker_running"),

734

dbus.Boolean(False, variant_level=1))

735

967

if os.WIFEXITED(condition):

736

968

exitstatus = os.WEXITSTATUS(condition)

737

969

# Emit D-Bus signal

747

979

return Client.checker_callback(self, pid, condition, command,

748

980

*args, **kwargs)

749

981

750

def checked_ok(self, *args, **kwargs):

751

r = Client.checked_ok(self, *args, **kwargs)

752

# Emit D-Bus signal

753

self.PropertyChanged(

754

dbus.String(u"last_checked_ok"),

755

(self._datetime_to_dbus(self.last_checked_ok,

756

variant_level=1)))

757

return r

758

759

982

def start_checker(self, *args, **kwargs):

760

983

old_checker = self.checker

761

984

if self.checker is not None:

768

991

and old_checker_pid != self.checker.pid):

769

992

# Emit D-Bus signal

770

993

self.CheckerStarted(self.current_checker_command)

771

self.PropertyChanged(

772

dbus.String(u"checker_running"),

773

dbus.Boolean(True, variant_level=1))

774

return r

775

776

def stop_checker(self, *args, **kwargs):

777

old_checker = getattr(self, u"checker", None)

778

r = Client.stop_checker(self, *args, **kwargs)

779

if (old_checker is not None

780

and getattr(self, u"checker", None) is None):

781

self.PropertyChanged(dbus.String(u"checker_running"),

782

dbus.Boolean(False, variant_level=1))

783

return r

994

return r

995

996

def _reset_approved(self):

997

self._approved = None

998

return False

999

1000

def approve(self, value=True):

1001

self.send_changedstate()

1002

self._approved = value

1003

gobject.timeout_add(_timedelta_to_milliseconds

1004

(self.approval_duration),

1005

self._reset_approved)

1006

784

1007

785

1008

## D-Bus methods, signals & properties

786

_interface = u"se.bsnet.fukt.Mandos.Client"

1009

_interface = "se.recompile.Mandos.Client"

787

1010

788

1011

## Signals

789

1012

790

1013

# CheckerCompleted - signal

791

@dbus.service.signal(_interface, signature=u"nxs")

1014

@dbus.service.signal(_interface, signature="nxs")

792

1015

def CheckerCompleted(self, exitcode, waitstatus, command):

793

1016

"D-Bus signal"

794

1017

pass

795

1018

796

1019

# CheckerStarted - signal

797

@dbus.service.signal(_interface, signature=u"s")

1020

@dbus.service.signal(_interface, signature="s")

798

1021

def CheckerStarted(self, command):

799

1022

"D-Bus signal"

800

1023

pass

801

1024

802

1025

# PropertyChanged - signal

803

@dbus.service.signal(_interface, signature=u"sv")

1026

@dbus.service.signal(_interface, signature="sv")

804

1027

def PropertyChanged(self, property, value):

805

1028

"D-Bus signal"

806

1029

pass

808

1031

# GotSecret - signal

809

1032

@dbus.service.signal(_interface)

810

1033

def GotSecret(self):

811

"D-Bus signal"

1034

"""D-Bus signal

1035

Is sent after a successful transfer of secret from the Mandos

1036

server to mandos-client

1037

"""

812

1038

pass

813

1039

814

1040

# Rejected - signal

815

@dbus.service.signal(_interface)

816

def Rejected(self):

1041

@dbus.service.signal(_interface, signature="s")

1042

def Rejected(self, reason):

817

1043

"D-Bus signal"

818

1044

pass

819

1045

1046

# NeedApproval - signal

1047

@dbus.service.signal(_interface, signature="tb")

1048

def NeedApproval(self, timeout, default):

1049

"D-Bus signal"

1050

return self.need_approval()

1051

820

1052

## Methods

821

1053

1054

# Approve - method

1055

@dbus.service.method(_interface, in_signature="b")

1056

def Approve(self, value):

1057

self.approve(value)

1058

822

1059

# CheckedOK - method

823

1060

@dbus.service.method(_interface)

824

1061

def CheckedOK(self):

825

return self.checked_ok()

1062

self.checked_ok()

826

1063

827

1064

# Enable - method

828

1065

@dbus.service.method(_interface)

849

1086

850

1087

## Properties

851

1088

852

# name - property

853

@dbus_service_property(_interface, signature=u"s", access=u"read")

854

def name_dbus_property(self):

1089

# ApprovalPending - property

1090

@dbus_service_property(_interface, signature="b", access="read")

1091

def ApprovalPending_dbus_property(self):

1092

return dbus.Boolean(bool(self.approvals_pending))

1093

1094

# ApprovedByDefault - property

1095

@dbus_service_property(_interface, signature="b",

1096

access="readwrite")

1097

def ApprovedByDefault_dbus_property(self, value=None):

1098

if value is None: # get

1099

return dbus.Boolean(self.approved_by_default)

1100

self.approved_by_default = bool(value)

1101

1102

# ApprovalDelay - property

1103

@dbus_service_property(_interface, signature="t",

1104

access="readwrite")

1105

def ApprovalDelay_dbus_property(self, value=None):

1106

if value is None: # get

1107

return dbus.UInt64(self.approval_delay_milliseconds())

1108

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1109

1110

# ApprovalDuration - property

1111

@dbus_service_property(_interface, signature="t",

1112

access="readwrite")

1113

def ApprovalDuration_dbus_property(self, value=None):

1114

if value is None: # get

1115

return dbus.UInt64(_timedelta_to_milliseconds(

1116

self.approval_duration))

1117

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1118

1119

# Name - property

1120

@dbus_service_property(_interface, signature="s", access="read")

1121

def Name_dbus_property(self):

855

1122

return dbus.String(self.name)

856

1123

857

# fingerprint - property

858

@dbus_service_property(_interface, signature=u"s", access=u"read")

859

def fingerprint_dbus_property(self):

1124

# Fingerprint - property

1125

@dbus_service_property(_interface, signature="s", access="read")

1126

def Fingerprint_dbus_property(self):

860

1127

return dbus.String(self.fingerprint)

861

1128

862

# host - property

863

@dbus_service_property(_interface, signature=u"s",

864

access=u"readwrite")

865

def host_dbus_property(self, value=None):

1129

# Host - property

1130

@dbus_service_property(_interface, signature="s",

1131

access="readwrite")

1132

def Host_dbus_property(self, value=None):

866

1133

if value is None: # get

867

1134

return dbus.String(self.host)

868

1135

self.host = value

869

# Emit D-Bus signal

870

self.PropertyChanged(dbus.String(u"host"),

871

dbus.String(value, variant_level=1))

872

873

# created - property

874

@dbus_service_property(_interface, signature=u"s", access=u"read")

875

def created_dbus_property(self):

876

return dbus.String(self._datetime_to_dbus(self.created))

877

878

# last_enabled - property

879

@dbus_service_property(_interface, signature=u"s", access=u"read")

880

def last_enabled_dbus_property(self):

881

if self.last_enabled is None:

882

return dbus.String(u"")

883

return dbus.String(self._datetime_to_dbus(self.last_enabled))

884

885

# enabled - property

886

@dbus_service_property(_interface, signature=u"b",

887

access=u"readwrite")

888

def enabled_dbus_property(self, value=None):

1136

1137

# Created - property

1138

@dbus_service_property(_interface, signature="s", access="read")

1139

def Created_dbus_property(self):

1140

return dbus.String(datetime_to_dbus(self.created))

1141

1142

# LastEnabled - property

1143

@dbus_service_property(_interface, signature="s", access="read")

1144

def LastEnabled_dbus_property(self):

1145

return datetime_to_dbus(self.last_enabled)

1146

1147

# Enabled - property

1148

@dbus_service_property(_interface, signature="b",

1149

access="readwrite")

1150

def Enabled_dbus_property(self, value=None):

889

1151

if value is None: # get

890

1152

return dbus.Boolean(self.enabled)

891

1153

if value:

893

1155

else:

894

1156

self.disable()

895

1157

896

# last_checked_ok - property

897

@dbus_service_property(_interface, signature=u"s",

898

access=u"readwrite")

899

def last_checked_ok_dbus_property(self, value=None):

1158

# LastCheckedOK - property

1159

@dbus_service_property(_interface, signature="s",

1160

access="readwrite")

1161

def LastCheckedOK_dbus_property(self, value=None):

900

1162

if value is not None:

901

1163

self.checked_ok()

902

1164

return

903

if self.last_checked_ok is None:

904

return dbus.String(u"")

905

return dbus.String(self._datetime_to_dbus(self

906

.last_checked_ok))

907

908

# timeout - property

909

@dbus_service_property(_interface, signature=u"t",

910

access=u"readwrite")

911

def timeout_dbus_property(self, value=None):

1165

return datetime_to_dbus(self.last_checked_ok)

1166

1167

# Expires - property

1168

@dbus_service_property(_interface, signature="s", access="read")

1169

def Expires_dbus_property(self):

1170

return datetime_to_dbus(self.expires)

1171

1172

# LastApprovalRequest - property

1173

@dbus_service_property(_interface, signature="s", access="read")

1174

def LastApprovalRequest_dbus_property(self):

1175

return datetime_to_dbus(self.last_approval_request)

1176

1177

# Timeout - property

1178

@dbus_service_property(_interface, signature="t",

1179

access="readwrite")

1180

def Timeout_dbus_property(self, value=None):

912

1181

if value is None: # get

913

1182

return dbus.UInt64(self.timeout_milliseconds())

914

1183

self.timeout = datetime.timedelta(0, 0, 0, value)

915

# Emit D-Bus signal

916

self.PropertyChanged(dbus.String(u"timeout"),

917

dbus.UInt64(value, variant_level=1))

918

if getattr(self, u"disable_initiator_tag", None) is None:

1184

if getattr(self, "disable_initiator_tag", None) is None:

919

1185

return

920

1186

# Reschedule timeout

921

1187

gobject.source_remove(self.disable_initiator_tag)

922

1188

self.disable_initiator_tag = None

1189

self.expires = None

923

1190

time_to_die = (self.

924

1191

_timedelta_to_milliseconds((self

925

1192

.last_checked_ok

930

1197

# The timeout has passed

931

1198

self.disable()

932

1199

else:

1200

self.expires = (datetime.datetime.utcnow()

1201

+ datetime.timedelta(milliseconds =

1202

time_to_die))

933

1203

self.disable_initiator_tag = (gobject.timeout_add

934

1204

(time_to_die, self.disable))

935

1205

936

# interval - property

937

@dbus_service_property(_interface, signature=u"t",

938

access=u"readwrite")

939

def interval_dbus_property(self, value=None):

1206

# ExtendedTimeout - property

1207

@dbus_service_property(_interface, signature="t",

1208

access="readwrite")

1209

def ExtendedTimeout_dbus_property(self, value=None):

1210

if value is None: # get

1211

return dbus.UInt64(self.extended_timeout_milliseconds())

1212

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1213

1214

# Interval - property

1215

@dbus_service_property(_interface, signature="t",

1216

access="readwrite")

1217

def Interval_dbus_property(self, value=None):

940

1218

if value is None: # get

941

1219

return dbus.UInt64(self.interval_milliseconds())

942

1220

self.interval = datetime.timedelta(0, 0, 0, value)

943

# Emit D-Bus signal

944

self.PropertyChanged(dbus.String(u"interval"),

945

dbus.UInt64(value, variant_level=1))

946

if getattr(self, u"checker_initiator_tag", None) is None:

1221

if getattr(self, "checker_initiator_tag", None) is None:

947

1222

return

948

1223

# Reschedule checker run

949

1224

gobject.source_remove(self.checker_initiator_tag)

950

1225

self.checker_initiator_tag = (gobject.timeout_add

951

1226

(value, self.start_checker))

952

1227

self.start_checker() # Start one now, too

953

954

# checker - property

955

@dbus_service_property(_interface, signature=u"s",

956

access=u"readwrite")

957

def checker_dbus_property(self, value=None):

1228

1229

# Checker - property

1230

@dbus_service_property(_interface, signature="s",

1231

access="readwrite")

1232

def Checker_dbus_property(self, value=None):

958

1233

if value is None: # get

959

1234

return dbus.String(self.checker_command)

960

1235

self.checker_command = value

961

# Emit D-Bus signal

962

self.PropertyChanged(dbus.String(u"checker"),

963

dbus.String(self.checker_command,

964

variant_level=1))

965

1236

966

# checker_running - property

967

@dbus_service_property(_interface, signature=u"b",

968

access=u"readwrite")

969

def checker_running_dbus_property(self, value=None):

1237

# CheckerRunning - property

1238

@dbus_service_property(_interface, signature="b",

1239

access="readwrite")

1240

def CheckerRunning_dbus_property(self, value=None):

970

1241

if value is None: # get

971

1242

return dbus.Boolean(self.checker is not None)

972

1243

if value:

974

1245

else:

975

1246

self.stop_checker()

976

1247

977

# object_path - property

978

@dbus_service_property(_interface, signature=u"o", access=u"read")

979

def object_path_dbus_property(self):

1248

# ObjectPath - property

1249

@dbus_service_property(_interface, signature="o", access="read")

1250

def ObjectPath_dbus_property(self):

980

1251

return self.dbus_object_path # is already a dbus.ObjectPath

981

1252

982

# secret = property

983

@dbus_service_property(_interface, signature=u"ay",

984

access=u"write", byte_arrays=True)

985

def secret_dbus_property(self, value):

1253

# Secret = property

1254

@dbus_service_property(_interface, signature="ay",

1255

access="write", byte_arrays=True)

1256

def Secret_dbus_property(self, value):

986

1257

self.secret = str(value)

987

1258

988

1259

del _interface

989

1260

990

1261

1262

class ProxyClient(object):

1263

def __init__(self, child_pipe, fpr, address):

1264

self._pipe = child_pipe

1265

self._pipe.send(('init', fpr, address))

1266

if not self._pipe.recv():

1267

raise KeyError()

1268

1269

def __getattribute__(self, name):

1270

if(name == '_pipe'):

1271

return super(ProxyClient, self).__getattribute__(name)

1272

self._pipe.send(('getattr', name))

1273

data = self._pipe.recv()

1274

if data[0] == 'data':

1275

return data[1]

1276

if data[0] == 'function':

1277

def func(*args, **kwargs):

1278

self._pipe.send(('funcall', name, args, kwargs))

1279

return self._pipe.recv()[1]

1280

return func

1281

1282

def __setattr__(self, name, value):

1283

if(name == '_pipe'):

1284

return super(ProxyClient, self).__setattr__(name, value)

1285

self._pipe.send(('setattr', name, value))

1286

1287

class ClientDBusTransitional(ClientDBus):

1288

__metaclass__ = AlternateDBusNamesMetaclass

1289

991

1290

class ClientHandler(socketserver.BaseRequestHandler, object):

992

1291

"""A class to handle client connections.

993

1292

995

1294

Note: This will run in its own forked process."""

996

1295

997

1296

def handle(self):

998

logger.info(u"TCP connection from: %s",

999

unicode(self.client_address))

1000

logger.debug(u"IPC Pipe FD: %d",

1001

self.server.child_pipe[1].fileno())

1002

# Open IPC pipe to parent process

1003

with contextlib.nested(self.server.child_pipe[1],

1004

self.server.parent_pipe[0]

1005

) as (ipc, ipc_return):

1297

with contextlib.closing(self.server.child_pipe) as child_pipe:

1298

logger.info("TCP connection from: %s",

1299

unicode(self.client_address))

1300

logger.debug("Pipe FD: %d",

1301

self.server.child_pipe.fileno())

1302

1006

1303

session = (gnutls.connection

1007

1304

.ClientSession(self.request,

1008

1305

gnutls.connection

1013

1310

# no X.509 keys are added to it. Therefore, we can use it

1014

1311

# here despite using OpenPGP certificates.

1015

1312

1016

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1017

# u"+AES-256-CBC", u"+SHA1",

1018

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1019

# u"+DHE-DSS"))

1313

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1314

# "+AES-256-CBC", "+SHA1",

1315

# "+COMP-NULL", "+CTYPE-OPENPGP",

1316

# "+DHE-DSS"))

1020

1317

# Use a fallback default, since this MUST be set.

1021

1318

priority = self.server.gnutls_priority

1022

1319

if priority is None:

1023

priority = u"NORMAL"

1320

priority = "NORMAL"

1024

1321

(gnutls.library.functions

1025

1322

.gnutls_priority_set_direct(session._c_object,

1026

1323

priority, None))

1028

1325

# Start communication using the Mandos protocol

1029

1326

# Get protocol number

1030

1327

line = self.request.makefile().readline()

1031

logger.debug(u"Protocol version: %r", line)

1328

logger.debug("Protocol version: %r", line)

1032

1329

try:

1033

1330

if int(line.strip().split()[0]) > 1:

1034

1331

raise RuntimeError

1035

except (ValueError, IndexError, RuntimeError), error:

1036

logger.error(u"Unknown protocol version: %s", error)

1332

except (ValueError, IndexError, RuntimeError) as error:

1333

logger.error("Unknown protocol version: %s", error)

1037

1334

return

1038

1335

1039

1336

# Start GnuTLS connection

1040

1337

try:

1041

1338

session.handshake()

1042

except gnutls.errors.GNUTLSError, error:

1043

logger.warning(u"Handshake failed: %s", error)

1339

except gnutls.errors.GNUTLSError as error:

1340

logger.warning("Handshake failed: %s", error)

1044

1341

# Do not run session.bye() here: the session is not

1045

1342

# established. Just abandon the request.

1046

1343

return

1047

logger.debug(u"Handshake succeeded")

1344

logger.debug("Handshake succeeded")

1345

1346

approval_required = False

1048

1347

try:

1049

1348

try:

1050

1349

fpr = self.fingerprint(self.peer_certificate

1051

1350

(session))

1052

except (TypeError, gnutls.errors.GNUTLSError), error:

1053

logger.warning(u"Bad certificate: %s", error)

1054

return

1055

logger.debug(u"Fingerprint: %s", fpr)

1056

1057

for c in self.server.clients:

1058

if c.fingerprint == fpr:

1059

client = c

1351

except (TypeError,

1352

gnutls.errors.GNUTLSError) as error:

1353

logger.warning("Bad certificate: %s", error)

1354

return

1355

logger.debug("Fingerprint: %s", fpr)

1356

1357

try:

1358

client = ProxyClient(child_pipe, fpr,

1359

self.client_address)

1360

except KeyError:

1361

return

1362

1363

if client.approval_delay:

1364

delay = client.approval_delay

1365

client.approvals_pending += 1

1366

approval_required = True

1367

1368

while True:

1369

if not client.enabled:

1370

logger.info("Client %s is disabled",

1371

client.name)

1372

if self.server.use_dbus:

1373

# Emit D-Bus signal

1374

client.Rejected("Disabled")

1375

return

1376

1377

if client._approved or not client.approval_delay:

1378

#We are approved or approval is disabled

1060

1379

break

1061

else:

1062

ipc.write(u"NOTFOUND %s %s\n"

1063

% (fpr, unicode(self.client_address)))

1064

return

1065

1066

class ClientProxy(object):

1067

"""Client proxy object. Not for calling methods."""

1068

def __init__(self, client):

1069

self.client = client

1070

def __getattr__(self, name):

1071

if name.startswith("ipc_"):

1072

def tempfunc():

1073

ipc.write("%s %s\n" % (name[4:].upper(),

1074

self.client.name))

1075

return tempfunc

1076

if not hasattr(self.client, name):

1077

raise AttributeError

1078

ipc.write(u"GETATTR %s %s\n"

1079

% (name, self.client.fingerprint))

1080

return pickle.load(ipc_return)

1081

clientproxy = ClientProxy(client)

1082

# Have to check if client.enabled, since it is

1083

# possible that the client was disabled since the

1084

# GnuTLS session was established.

1085

if not clientproxy.enabled:

1086

clientproxy.ipc_disabled()

1087

return

1088

1089

clientproxy.ipc_sending()

1380

elif client._approved is None:

1381

logger.info("Client %s needs approval",

1382

client.name)

1383

if self.server.use_dbus:

1384

# Emit D-Bus signal

1385

client.NeedApproval(

1386

client.approval_delay_milliseconds(),

1387

client.approved_by_default)

1388

else:

1389

logger.warning("Client %s was not approved",

1390

client.name)

1391

if self.server.use_dbus:

1392

# Emit D-Bus signal

1393

client.Rejected("Denied")

1394

return

1395

1396

#wait until timeout or approved

1397

time = datetime.datetime.now()

1398

client.changedstate.acquire()

1399

(client.changedstate.wait

1400

(float(client._timedelta_to_milliseconds(delay)

1401

/ 1000)))

1402

client.changedstate.release()

1403

time2 = datetime.datetime.now()

1404

if (time2 - time) >= delay:

1405

if not client.approved_by_default:

1406

logger.warning("Client %s timed out while"

1407

" waiting for approval",

1408

client.name)

1409

if self.server.use_dbus:

1410

# Emit D-Bus signal

1411

client.Rejected("Approval timed out")

1412

return

1413

else:

1414

break

1415

else:

1416

delay -= time2 - time

1417

1090

1418

sent_size = 0

1091

1419

while sent_size < len(client.secret):

1092

sent = session.send(client.secret[sent_size:])

1093

logger.debug(u"Sent: %d, remaining: %d",

1420

try:

1421

sent = session.send(client.secret[sent_size:])

1422

except gnutls.errors.GNUTLSError as error:

1423

logger.warning("gnutls send failed")

1424

return

1425

logger.debug("Sent: %d, remaining: %d",

1094

1426

sent, len(client.secret)

1095

1427

- (sent_size + sent))

1096

1428

sent_size += sent

1429

1430

logger.info("Sending secret to %s", client.name)

1431

# bump the timeout using extended_timeout

1432

client.checked_ok(client.extended_timeout)

1433

if self.server.use_dbus:

1434

# Emit D-Bus signal

1435

client.GotSecret()

1436

1097

1437

finally:

1098

session.bye()

1438

if approval_required:

1439

client.approvals_pending -= 1

1440

try:

1441

session.bye()

1442

except gnutls.errors.GNUTLSError as error:

1443

logger.warning("GnuTLS bye failed")

1099

1444

1100

1445

@staticmethod

1101

1446

def peer_certificate(session):

1111

1456

.gnutls_certificate_get_peers

1112

1457

(session._c_object, ctypes.byref(list_size)))

1113

1458

if not bool(cert_list) and list_size.value != 0:

1114

raise gnutls.errors.GNUTLSError(u"error getting peer"

1115

u" certificate")

1459

raise gnutls.errors.GNUTLSError("error getting peer"

1460

" certificate")

1116

1461

if list_size.value == 0:

1117

1462

return None

1118

1463

cert = cert_list[0]

1144

1489

if crtverify.value != 0:

1145

1490

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1146

1491

raise (gnutls.errors.CertificateSecurityError

1147

(u"Verify failed"))

1492

("Verify failed"))

1148

1493

# New buffer for the fingerprint

1149

1494

buf = ctypes.create_string_buffer(20)

1150

1495

buf_len = ctypes.c_size_t()

1157

1502

# Convert the buffer to a Python bytestring

1158

1503

fpr = ctypes.string_at(buf, buf_len.value)

1159

1504

# Convert the bytestring to hexadecimal notation

1160

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1505

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1161

1506

return hex_fpr

1162

1507

1163

1508

1164

class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):

1165

"""Like socketserver.ForkingMixIn, but also pass a pipe pair."""

1509

class MultiprocessingMixIn(object):

1510

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1511

def sub_process_main(self, request, address):

1512

try:

1513

self.finish_request(request, address)

1514

except:

1515

self.handle_error(request, address)

1516

self.close_request(request)

1517

1518

def process_request(self, request, address):

1519

"""Start a new process to process the request."""

1520

proc = multiprocessing.Process(target = self.sub_process_main,

1521

args = (request,

1522

address))

1523

proc.start()

1524

return proc

1525

1526

1527

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1528

""" adds a pipe to the MixIn """

1166

1529

def process_request(self, request, client_address):

1167

1530

"""Overrides and wraps the original process_request().

1168

1531

1169

1532

This function creates a new pipe in self.pipe

1170

1533

"""

1171

# Child writes to child_pipe

1172

self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))

1173

# Parent writes to parent_pipe

1174

self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))

1175

super(ForkingMixInWithPipes,

1176

self).process_request(request, client_address)

1177

# Close unused ends for parent

1178

self.parent_pipe[0].close() # close read end

1179

self.child_pipe[1].close() # close write end

1180

self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])

1181

def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):

1534

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1535

1536

proc = MultiprocessingMixIn.process_request(self, request,

1537

client_address)

1538

self.child_pipe.close()

1539

self.add_pipe(parent_pipe, proc)

1540

1541

def add_pipe(self, parent_pipe, proc):

1182

1542

"""Dummy function; override as necessary"""

1183

child_pipe_fd.close()

1184

parent_pipe_fd.close()

1185

1186

1187

class IPv6_TCPServer(ForkingMixInWithPipes,

1543

raise NotImplementedError

1544

1545

1546

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1188

1547

socketserver.TCPServer, object):

1189

1548

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1190

1549

1206

1565

bind to an address or port if they were not specified."""

1207

1566

if self.interface is not None:

1208

1567

if SO_BINDTODEVICE is None:

1209

logger.error(u"SO_BINDTODEVICE does not exist;"

1210

u" cannot bind to interface %s",

1568

logger.error("SO_BINDTODEVICE does not exist;"

1569

" cannot bind to interface %s",

1211

1570

self.interface)

1212

1571

else:

1213

1572

try:

1214

1573

self.socket.setsockopt(socket.SOL_SOCKET,

1215

1574

SO_BINDTODEVICE,

1216

1575

str(self.interface

1217

+ u'\0'))

1218

except socket.error, error:

1576

+ '\0'))

1577

except socket.error as error:

1219

1578

if error[0] == errno.EPERM:

1220

logger.error(u"No permission to"

1221

u" bind to interface %s",

1579

logger.error("No permission to"

1580

" bind to interface %s",

1222

1581

self.interface)

1223

1582

elif error[0] == errno.ENOPROTOOPT:

1224

logger.error(u"SO_BINDTODEVICE not available;"

1225

u" cannot bind to interface %s",

1583

logger.error("SO_BINDTODEVICE not available;"

1584

" cannot bind to interface %s",

1226

1585

self.interface)

1227

1586

else:

1228

1587

raise

1230

1589

if self.server_address[0] or self.server_address[1]:

1231

1590

if not self.server_address[0]:

1232

1591

if self.address_family == socket.AF_INET6:

1233

any_address = u"::" # in6addr_any

1592

any_address = "::" # in6addr_any

1234

1593

else:

1235

1594

any_address = socket.INADDR_ANY

1236

1595

self.server_address = (any_address,

1273

1632

def server_activate(self):

1274

1633

if self.enabled:

1275

1634

return socketserver.TCPServer.server_activate(self)

1635

1276

1636

def enable(self):

1277

1637

self.enabled = True

1278

def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):

1638

1639

def add_pipe(self, parent_pipe, proc):

1279

1640

# Call "handle_ipc" for both data and EOF events

1280

gobject.io_add_watch(child_pipe_fd.fileno(),

1641

gobject.io_add_watch(parent_pipe.fileno(),

1281

1642

gobject.IO_IN | gobject.IO_HUP,

1282

1643

functools.partial(self.handle_ipc,

1283

reply = parent_pipe_fd,

1284

sender= child_pipe_fd))

1285

def handle_ipc(self, source, condition, reply=None, sender=None):

1644

parent_pipe =

1645

parent_pipe,

1646

proc = proc))

1647

1648

def handle_ipc(self, source, condition, parent_pipe=None,

1649

proc = None, client_object=None):

1286

1650

condition_names = {

1287

gobject.IO_IN: u"IN", # There is data to read.

1288

gobject.IO_OUT: u"OUT", # Data can be written (without

1651

gobject.IO_IN: "IN", # There is data to read.

1652

gobject.IO_OUT: "OUT", # Data can be written (without

1289

1653

# blocking).

1290

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1291

gobject.IO_ERR: u"ERR", # Error condition.

1292

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1654

gobject.IO_PRI: "PRI", # There is urgent data to read.

1655

gobject.IO_ERR: "ERR", # Error condition.

1656

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1293

1657

# broken, usually for pipes and

1294

1658

# sockets).

1295

1659

}

1297

1661

for cond, name in

1298

1662

condition_names.iteritems()

1299

1663

if cond & condition)

1300

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1301

conditions_string)

1302

1303

# Read a line from the file object

1304

cmdline = sender.readline()

1305

if not cmdline: # Empty line means end of file

1306

# close the IPC pipes

1307

sender.close()

1308

reply.close()

1309

1310

# Stop calling this function

1311

return False

1312

1313

logger.debug(u"IPC command: %r", cmdline)

1314

1315

# Parse and act on command

1316

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1317

1318

if cmd == u"NOTFOUND":

1319

fpr, address = args.split(None, 1)

1320

logger.warning(u"Client not found for fingerprint: %s, ad"

1321

u"dress: %s", fpr, address)

1322

if self.use_dbus:

1323

# Emit D-Bus signal

1324

mandos_dbus_service.ClientNotFound(fpr, address)

1325

elif cmd == u"DISABLED":

1326

for client in self.clients:

1327

if client.name == args:

1328

logger.warning(u"Client %s is disabled", args)

1329

if self.use_dbus:

1330

# Emit D-Bus signal

1331

client.Rejected()

1332

break

1333

else:

1334

logger.error(u"Unknown client %s is disabled", args)

1335

elif cmd == u"SENDING":

1336

for client in self.clients:

1337

if client.name == args:

1338

logger.info(u"Sending secret to %s", client.name)

1339

client.checked_ok()

1340

if self.use_dbus:

1341

# Emit D-Bus signal

1342

client.GotSecret()

1343

break

1344

else:

1345

logger.error(u"Sending secret to unknown client %s",

1346

args)

1347

elif cmd == u"GETATTR":

1348

attr_name, fpr = args.split(None, 1)

1349

for client in self.clients:

1350

if client.fingerprint == fpr:

1351

attr_value = getattr(client, attr_name, None)

1352

logger.debug("IPC reply: %r", attr_value)

1353

pickle.dump(attr_value, reply)

1354

break

1355

else:

1356

logger.error(u"Client %s on address %s requesting "

1357

u"attribute %s not found", fpr, address,

1358

attr_name)

1359

pickle.dump(None, reply)

1360

else:

1361

logger.error(u"Unknown IPC command: %r", cmdline)

1362

1363

# Keep calling this function

1664

# error, or the other end of multiprocessing.Pipe has closed

1665

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1666

# Wait for other process to exit

1667

proc.join()

1668

return False

1669

1670

# Read a request from the child

1671

request = parent_pipe.recv()

1672

command = request[0]

1673

1674

if command == 'init':

1675

fpr = request[1]

1676

address = request[2]

1677

1678

for c in self.clients:

1679

if c.fingerprint == fpr:

1680

client = c

1681

break

1682

else:

1683

logger.info("Client not found for fingerprint: %s, ad"

1684

"dress: %s", fpr, address)

1685

if self.use_dbus:

1686

# Emit D-Bus signal

1687

mandos_dbus_service.ClientNotFound(fpr,

1688

address[0])

1689

parent_pipe.send(False)

1690

return False

1691

1692

gobject.io_add_watch(parent_pipe.fileno(),

1693

gobject.IO_IN | gobject.IO_HUP,

1694

functools.partial(self.handle_ipc,

1695

parent_pipe =

1696

parent_pipe,

1697

proc = proc,

1698

client_object =

1699

client))

1700

parent_pipe.send(True)

1701

# remove the old hook in favor of the new above hook on

1702

# same fileno

1703

return False

1704

if command == 'funcall':

1705

funcname = request[1]

1706

args = request[2]

1707

kwargs = request[3]

1708

1709

parent_pipe.send(('data', getattr(client_object,

1710

funcname)(*args,

1711

**kwargs)))

1712

1713

if command == 'getattr':

1714

attrname = request[1]

1715

if callable(client_object.__getattribute__(attrname)):

1716

parent_pipe.send(('function',))

1717

else:

1718

parent_pipe.send(('data', client_object

1719

.__getattribute__(attrname)))

1720

1721

if command == 'setattr':

1722

attrname = request[1]

1723

value = request[2]

1724

setattr(client_object, attrname, value)

1725

1364

1726

return True

1365

1727

1366

1728

1367

1729

def string_to_delta(interval):

1368

1730

"""Parse a string and return a datetime.timedelta

1369

1731

1370

>>> string_to_delta(u'7d')

1732

>>> string_to_delta('7d')

1371

1733

datetime.timedelta(7)

1372

>>> string_to_delta(u'60s')

1734

>>> string_to_delta('60s')

1373

1735

datetime.timedelta(0, 60)

1374

>>> string_to_delta(u'60m')

1736

>>> string_to_delta('60m')

1375

1737

datetime.timedelta(0, 3600)

1376

>>> string_to_delta(u'24h')

1738

>>> string_to_delta('24h')

1377

1739

datetime.timedelta(1)

1378

>>> string_to_delta(u'1w')

1740

>>> string_to_delta('1w')

1379

1741

datetime.timedelta(7)

1380

>>> string_to_delta(u'5m 30s')

1742

>>> string_to_delta('5m 30s')

1381

1743

datetime.timedelta(0, 330)

1382

1744

"""

1383

1745

timevalue = datetime.timedelta(0)

1385

1747

try:

1386

1748

suffix = unicode(s[-1])

1387

1749

value = int(s[:-1])

1388

if suffix == u"d":

1750

if suffix == "d":

1389

1751

delta = datetime.timedelta(value)

1390

elif suffix == u"s":

1752

elif suffix == "s":

1391

1753

delta = datetime.timedelta(0, value)

1392

elif suffix == u"m":

1754

elif suffix == "m":

1393

1755

delta = datetime.timedelta(0, 0, 0, 0, value)

1394

elif suffix == u"h":

1756

elif suffix == "h":

1395

1757

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1396

elif suffix == u"w":

1758

elif suffix == "w":

1397

1759

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1398

1760

else:

1399

raise ValueError(u"Unknown suffix %r" % suffix)

1400

except (ValueError, IndexError), e:

1401

raise ValueError(e.message)

1761

raise ValueError("Unknown suffix %r" % suffix)

1762

except (ValueError, IndexError) as e:

1763

raise ValueError(*(e.args))

1402

1764

timevalue += delta

1403

1765

return timevalue

1404

1766

1410

1772

global if_nametoindex

1411

1773

try:

1412

1774

if_nametoindex = (ctypes.cdll.LoadLibrary

1413

(ctypes.util.find_library(u"c"))

1775

(ctypes.util.find_library("c"))

1414

1776

.if_nametoindex)

1415

1777

except (OSError, AttributeError):

1416

logger.warning(u"Doing if_nametoindex the hard way")

1778

logger.warning("Doing if_nametoindex the hard way")

1417

1779

def if_nametoindex(interface):

1418

1780

"Get an interface index the hard way, i.e. using fcntl()"

1419

1781

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1420

1782

with contextlib.closing(socket.socket()) as s:

1421

1783

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1422

struct.pack(str(u"16s16x"),

1784

struct.pack(str("16s16x"),

1423

1785

interface))

1424

interface_index = struct.unpack(str(u"I"),

1786

interface_index = struct.unpack(str("I"),

1425

1787

ifreq[16:20])[0]

1426

1788

return interface_index

1427

1789

return if_nametoindex(interface)

1435

1797

sys.exit()

1436

1798

os.setsid()

1437

1799

if not nochdir:

1438

os.chdir(u"/")

1800

os.chdir("/")

1439

1801

if os.fork():

1440

1802

sys.exit()

1441

1803

if not noclose:

1443

1805

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1444

1806

if not stat.S_ISCHR(os.fstat(null).st_mode):

1445

1807

raise OSError(errno.ENODEV,

1446

u"%s not a character device"

1808

"%s not a character device"

1447

1809

% os.path.devnull)

1448

1810

os.dup2(null, sys.stdin.fileno())

1449

1811

os.dup2(null, sys.stdout.fileno())

1457

1819

##################################################################

1458

1820

# Parsing of options, both command line and config file

1459

1821

1460

parser = optparse.OptionParser(version = "%%prog %s" % version)

1461

parser.add_option("-i", u"--interface", type=u"string",

1462

metavar="IF", help=u"Bind to interface IF")

1463

parser.add_option("-a", u"--address", type=u"string",

1464

help=u"Address to listen for requests on")

1465

parser.add_option("-p", u"--port", type=u"int",

1466

help=u"Port number to receive requests on")

1467

parser.add_option("--check", action=u"store_true",

1468

help=u"Run self-test")

1469

parser.add_option("--debug", action=u"store_true",

1470

help=u"Debug mode; run in foreground and log to"

1471

u" terminal")

1472

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1473

u" priority string (see GnuTLS documentation)")

1474

parser.add_option("--servicename", type=u"string",

1475

metavar=u"NAME", help=u"Zeroconf service name")

1476

parser.add_option("--configdir", type=u"string",

1477

default=u"/etc/mandos", metavar=u"DIR",

1478

help=u"Directory to search for configuration"

1479

u" files")

1480

parser.add_option("--no-dbus", action=u"store_false",

1481

dest=u"use_dbus", help=u"Do not provide D-Bus"

1482

u" system bus interface")

1483

parser.add_option("--no-ipv6", action=u"store_false",

1484

dest=u"use_ipv6", help=u"Do not use IPv6")

1485

options = parser.parse_args()[0]

1822

parser = argparse.ArgumentParser()

1823

parser.add_argument("-v", "--version", action="version",

1824

version = "%%(prog)s %s" % version,

1825

help="show version number and exit")

1826

parser.add_argument("-i", "--interface", metavar="IF",

1827

help="Bind to interface IF")

1828

parser.add_argument("-a", "--address",

1829

help="Address to listen for requests on")

1830

parser.add_argument("-p", "--port", type=int,

1831

help="Port number to receive requests on")

1832

parser.add_argument("--check", action="store_true",

1833

help="Run self-test")

1834

parser.add_argument("--debug", action="store_true",

1835

help="Debug mode; run in foreground and log"

1836

" to terminal")

1837

parser.add_argument("--debuglevel", metavar="LEVEL",

1838

help="Debug level for stdout output")

1839

parser.add_argument("--priority", help="GnuTLS"

1840

" priority string (see GnuTLS documentation)")

1841

parser.add_argument("--servicename",

1842

metavar="NAME", help="Zeroconf service name")

1843

parser.add_argument("--configdir",

1844

default="/etc/mandos", metavar="DIR",

1845

help="Directory to search for configuration"

1846

" files")

1847

parser.add_argument("--no-dbus", action="store_false",

1848

dest="use_dbus", help="Do not provide D-Bus"

1849

" system bus interface")

1850

parser.add_argument("--no-ipv6", action="store_false",

1851

dest="use_ipv6", help="Do not use IPv6")

1852

options = parser.parse_args()

1486

1853

1487

1854

if options.check:

1488

1855

import doctest

1490

1857

sys.exit()

1491

1858

1492

1859

# Default values for config file for server-global settings

1493

server_defaults = { u"interface": u"",

1494

u"address": u"",

1495

u"port": u"",

1496

u"debug": u"False",

1497

u"priority":

1498

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1499

u"servicename": u"Mandos",

1500

u"use_dbus": u"True",

1501

u"use_ipv6": u"True",

1860

server_defaults = { "interface": "",

1861

"address": "",

1862

"port": "",

1863

"debug": "False",

1864

"priority":

1865

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1866

"servicename": "Mandos",

1867

"use_dbus": "True",

1868

"use_ipv6": "True",

1869

"debuglevel": "",

1502

1870

}

1503

1871

1504

1872

# Parse config file for server-global settings

1505

1873

server_config = configparser.SafeConfigParser(server_defaults)

1506

1874

del server_defaults

1507

1875

server_config.read(os.path.join(options.configdir,

1508

u"mandos.conf"))

1876

"mandos.conf"))

1509

1877

# Convert the SafeConfigParser object to a dict

1510

1878

server_settings = server_config.defaults()

1511

1879

# Use the appropriate methods on the non-string config options

1512

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1513

server_settings[option] = server_config.getboolean(u"DEFAULT",

1880

for option in ("debug", "use_dbus", "use_ipv6"):

1881

server_settings[option] = server_config.getboolean("DEFAULT",

1514

1882

option)

1515

1883

if server_settings["port"]:

1516

server_settings["port"] = server_config.getint(u"DEFAULT",

1517

u"port")

1884

server_settings["port"] = server_config.getint("DEFAULT",

1885

"port")

1518

1886

del server_config

1519

1887

1520

1888

# Override the settings from the config file with command line

1521

1889

# options, if set.

1522

for option in (u"interface", u"address", u"port", u"debug",

1523

u"priority", u"servicename", u"configdir",

1524

u"use_dbus", u"use_ipv6"):

1890

for option in ("interface", "address", "port", "debug",

1891

"priority", "servicename", "configdir",

1892

"use_dbus", "use_ipv6", "debuglevel"):

1525

1893

value = getattr(options, option)

1526

1894

if value is not None:

1527

1895

server_settings[option] = value

1535

1903

##################################################################

1536

1904

1537

1905

# For convenience

1538

debug = server_settings[u"debug"]

1539

use_dbus = server_settings[u"use_dbus"]

1540

use_ipv6 = server_settings[u"use_ipv6"]

1541

1542

if not debug:

1543

syslogger.setLevel(logging.WARNING)

1544

console.setLevel(logging.WARNING)

1545

1546

if server_settings[u"servicename"] != u"Mandos":

1906

debug = server_settings["debug"]

1907

debuglevel = server_settings["debuglevel"]

1908

use_dbus = server_settings["use_dbus"]

1909

use_ipv6 = server_settings["use_ipv6"]

1910

1911

if server_settings["servicename"] != "Mandos":

1547

1912

syslogger.setFormatter(logging.Formatter

1548

(u'Mandos (%s) [%%(process)d]:'

1549

u' %%(levelname)s: %%(message)s'

1550

% server_settings[u"servicename"]))

1913

('Mandos (%s) [%%(process)d]:'

1914

' %%(levelname)s: %%(message)s'

1915

% server_settings["servicename"]))

1551

1916

1552

1917

# Parse config file with clients

1553

client_defaults = { u"timeout": u"1h",

1554

u"interval": u"5m",

1555

u"checker": u"fping -q -- %%(host)s",

1556

u"host": u"",

1918

client_defaults = { "timeout": "5m",

1919

"extended_timeout": "15m",

1920

"interval": "2m",

1921

"checker": "fping -q -- %%(host)s",

1922

"host": "",

1923

"approval_delay": "0s",

1924

"approval_duration": "1s",

1557

1925

}

1558

1926

client_config = configparser.SafeConfigParser(client_defaults)

1559

client_config.read(os.path.join(server_settings[u"configdir"],

1560

u"clients.conf"))

1927

client_config.read(os.path.join(server_settings["configdir"],

1928

"clients.conf"))

1561

1929

1562

1930

global mandos_dbus_service

1563

1931

mandos_dbus_service = None

1564

1932

1565

tcp_server = MandosServer((server_settings[u"address"],

1566

server_settings[u"port"]),

1933

tcp_server = MandosServer((server_settings["address"],

1934

server_settings["port"]),

1567

1935

ClientHandler,

1568

interface=(server_settings[u"interface"]

1936

interface=(server_settings["interface"]

1569

1937

or None),

1570

1938

use_ipv6=use_ipv6,

1571

1939

gnutls_priority=

1572

server_settings[u"priority"],

1940

server_settings["priority"],

1573

1941

use_dbus=use_dbus)

1574

pidfilename = u"/var/run/mandos.pid"

1575

try:

1576

pidfile = open(pidfilename, u"w")

1577

except IOError:

1578

logger.error(u"Could not open file %r", pidfilename)

1942

if not debug:

1943

pidfilename = "/var/run/mandos.pid"

1944

try:

1945

pidfile = open(pidfilename, "w")

1946

except IOError:

1947

logger.error("Could not open file %r", pidfilename)

1579

1948

1580

1949

try:

1581

uid = pwd.getpwnam(u"_mandos").pw_uid

1582

gid = pwd.getpwnam(u"_mandos").pw_gid

1950

uid = pwd.getpwnam("_mandos").pw_uid

1951

gid = pwd.getpwnam("_mandos").pw_gid

1583

1952

except KeyError:

1584

1953

try:

1585

uid = pwd.getpwnam(u"mandos").pw_uid

1586

gid = pwd.getpwnam(u"mandos").pw_gid

1954

uid = pwd.getpwnam("mandos").pw_uid

1955

gid = pwd.getpwnam("mandos").pw_gid

1587

1956

except KeyError:

1588

1957

try:

1589

uid = pwd.getpwnam(u"nobody").pw_uid

1590

gid = pwd.getpwnam(u"nobody").pw_gid

1958

uid = pwd.getpwnam("nobody").pw_uid

1959

gid = pwd.getpwnam("nobody").pw_gid

1591

1960

except KeyError:

1592

1961

uid = 65534

1593

1962

gid = 65534

1594

1963

try:

1595

1964

os.setgid(gid)

1596

1965

os.setuid(uid)

1597

except OSError, error:

1966

except OSError as error:

1598

1967

if error[0] != errno.EPERM:

1599

1968

raise error

1600

1969

1601

# Enable all possible GnuTLS debugging

1970

if not debug and not debuglevel:

1971

syslogger.setLevel(logging.WARNING)

1972

console.setLevel(logging.WARNING)

1973

if debuglevel:

1974

level = getattr(logging, debuglevel.upper())

1975

syslogger.setLevel(level)

1976

console.setLevel(level)

1977

1602

1978

if debug:

1979

# Enable all possible GnuTLS debugging

1980

1603

1981

# "Use a log level over 10 to enable all debugging options."

1604

1982

# - GnuTLS manual

1605

1983

gnutls.library.functions.gnutls_global_set_log_level(11)

1606

1984

1607

1985

@gnutls.library.types.gnutls_log_func

1608

1986

def debug_gnutls(level, string):

1609

logger.debug(u"GnuTLS: %s", string[:-1])

1987

logger.debug("GnuTLS: %s", string[:-1])

1610

1988

1611

1989

(gnutls.library.functions

1612

1990

.gnutls_global_set_log_function(debug_gnutls))

1991

1992

# Redirect stdin so all checkers get /dev/null

1993

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1994

os.dup2(null, sys.stdin.fileno())

1995

if null > 2:

1996

os.close(null)

1997

else:

1998

# No console logging

1999

logger.removeHandler(console)

2000

2001

# Need to fork before connecting to D-Bus

2002

if not debug:

2003

# Close all input and output, do double fork, etc.

2004

daemon()

1613

2005

1614

2006

global main_loop

1615

2007

# From the Avahi example code

1619

2011

# End of Avahi example code

1620

2012

if use_dbus:

1621

2013

try:

1622

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2014

bus_name = dbus.service.BusName("se.recompile.Mandos",

1623

2015

bus, do_not_queue=True)

1624

except dbus.exceptions.NameExistsException, e:

1625

logger.error(unicode(e) + u", disabling D-Bus")

2016

old_bus_name = (dbus.service.BusName

2017

("se.bsnet.fukt.Mandos", bus,

2018

do_not_queue=True))

2019

except dbus.exceptions.NameExistsException as e:

2020

logger.error(unicode(e) + ", disabling D-Bus")

1626

2021

use_dbus = False

1627

server_settings[u"use_dbus"] = False

2022

server_settings["use_dbus"] = False

1628

2023

tcp_server.use_dbus = False

1629

2024

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1630

service = AvahiService(name = server_settings[u"servicename"],

1631

servicetype = u"_mandos._tcp",

2025

service = AvahiService(name = server_settings["servicename"],

2026

servicetype = "_mandos._tcp",

1632

2027

protocol = protocol, bus = bus)

1633

2028

if server_settings["interface"]:

1634

2029

service.interface = (if_nametoindex

1635

(str(server_settings[u"interface"])))

2030

(str(server_settings["interface"])))

2031

2032

global multiprocessing_manager

2033

multiprocessing_manager = multiprocessing.Manager()

1636

2034

1637

2035

client_class = Client

1638

2036

if use_dbus:

1639

client_class = functools.partial(ClientDBus, bus = bus)

2037

client_class = functools.partial(ClientDBusTransitional,

2038

bus = bus)

2039

def client_config_items(config, section):

2040

special_settings = {

2041

"approved_by_default":

2042

lambda: config.getboolean(section,

2043

"approved_by_default"),

2044

}

2045

for name, value in config.items(section):

2046

try:

2047

yield (name, special_settings[name]())

2048

except KeyError:

2049

yield (name, value)

2050

1640

2051

tcp_server.clients.update(set(

1641

2052

client_class(name = section,

1642

config= dict(client_config.items(section)))

2053

config= dict(client_config_items(

2054

client_config, section)))

1643

2055

for section in client_config.sections()))

1644

2056

if not tcp_server.clients:

1645

logger.warning(u"No clients defined")

1646

1647

if debug:

1648

# Redirect stdin so all checkers get /dev/null

1649

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1650

os.dup2(null, sys.stdin.fileno())

1651

if null > 2:

1652

os.close(null)

1653

else:

1654

# No console logging

1655

logger.removeHandler(console)

1656

# Close all input and output, do double fork, etc.

1657

daemon()

1658

1659

try:

1660

with pidfile:

1661

pid = os.getpid()

1662

pidfile.write(str(pid) + "\n")

1663

del pidfile

1664

except IOError:

1665

logger.error(u"Could not write to file %r with PID %d",

1666

pidfilename, pid)

1667

except NameError:

1668

# "pidfile" was never created

1669

pass

1670

del pidfilename

1671

2057

logger.warning("No clients defined")

2058

1672

2059

if not debug:

2060

try:

2061

with pidfile:

2062

pid = os.getpid()

2063

pidfile.write(str(pid) + "\n".encode("utf-8"))

2064

del pidfile

2065

except IOError:

2066

logger.error("Could not write to file %r with PID %d",

2067

pidfilename, pid)

2068

except NameError:

2069

# "pidfile" was never created

2070

pass

2071

del pidfilename

2072

1673

2073

signal.signal(signal.SIGINT, signal.SIG_IGN)

2074

1674

2075

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1675

2076

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1676

2077

1678

2079

class MandosDBusService(dbus.service.Object):

1679

2080

"""A D-Bus proxy object"""

1680

2081

def __init__(self):

1681

dbus.service.Object.__init__(self, bus, u"/")

1682

_interface = u"se.bsnet.fukt.Mandos"

2082

dbus.service.Object.__init__(self, bus, "/")

2083

_interface = "se.recompile.Mandos"

1683

2084

1684

@dbus.service.signal(_interface, signature=u"o")

2085

@dbus.service.signal(_interface, signature="o")

1685

2086

def ClientAdded(self, objpath):

1686

2087

"D-Bus signal"

1687

2088

pass

1688

2089

1689

@dbus.service.signal(_interface, signature=u"ss")

2090

@dbus.service.signal(_interface, signature="ss")

1690

2091

def ClientNotFound(self, fingerprint, address):

1691

2092

"D-Bus signal"

1692

2093

pass

1693

2094

1694

@dbus.service.signal(_interface, signature=u"os")

2095

@dbus.service.signal(_interface, signature="os")

1695

2096

def ClientRemoved(self, objpath, name):

1696

2097

"D-Bus signal"

1697

2098

pass

1698

2099

1699

@dbus.service.method(_interface, out_signature=u"ao")

2100

@dbus.service.method(_interface, out_signature="ao")

1700

2101

def GetAllClients(self):

1701

2102

"D-Bus method"

1702

2103

return dbus.Array(c.dbus_object_path

1703

2104

for c in tcp_server.clients)

1704

2105

1705

2106

@dbus.service.method(_interface,

1706

out_signature=u"a{oa{sv}}")

2107

out_signature="a{oa{sv}}")

1707

2108

def GetAllClientsWithProperties(self):

1708

2109

"D-Bus method"

1709

2110

return dbus.Dictionary(

1710

((c.dbus_object_path, c.GetAll(u""))

2111

((c.dbus_object_path, c.GetAll(""))

1711

2112

for c in tcp_server.clients),

1712

signature=u"oa{sv}")

2113

signature="oa{sv}")

1713

2114

1714

@dbus.service.method(_interface, in_signature=u"o")

2115

@dbus.service.method(_interface, in_signature="o")

1715

2116

def RemoveClient(self, object_path):

1716

2117

"D-Bus method"

1717

2118

for c in tcp_server.clients:

1727

2128

1728

2129

del _interface

1729

2130

1730

mandos_dbus_service = MandosDBusService()

2131

class MandosDBusServiceTransitional(MandosDBusService):

2132

__metaclass__ = AlternateDBusNamesMetaclass

2133

mandos_dbus_service = MandosDBusServiceTransitional()

1731

2134

1732

2135

def cleanup():

1733

2136

"Cleanup function; run on exit"

1734

2137

service.cleanup()

1735

2138

2139

multiprocessing.active_children()

1736

2140

while tcp_server.clients:

1737

2141

client = tcp_server.clients.pop()

1738

2142

if use_dbus:

1742

2146

client.disable(quiet=True)

1743

2147

if use_dbus:

1744

2148

# Emit D-Bus signal

1745

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2149

mandos_dbus_service.ClientRemoved(client

2150

.dbus_object_path,

1746

2151

client.name)

1747

2152

1748

2153

atexit.register(cleanup)

1759

2164

# Find out what port we got

1760

2165

service.port = tcp_server.socket.getsockname()[1]

1761

2166

if use_ipv6:

1762

logger.info(u"Now listening on address %r, port %d,"

2167

logger.info("Now listening on address %r, port %d,"

1763

2168

" flowinfo %d, scope_id %d"

1764

2169

% tcp_server.socket.getsockname())

1765

2170

else: # IPv4

1766

logger.info(u"Now listening on address %r, port %d"

2171

logger.info("Now listening on address %r, port %d"

1767

2172

% tcp_server.socket.getsockname())

1768

2173

1769

2174

#service.interface = tcp_server.socket.getsockname()[3]

1772

2177

# From the Avahi example code

1773

2178

try:

1774

2179

service.activate()

1775

except dbus.exceptions.DBusException, error:

1776

logger.critical(u"DBusException: %s", error)

2180

except dbus.exceptions.DBusException as error:

2181

logger.critical("DBusException: %s", error)

1777

2182

cleanup()

1778

2183

sys.exit(1)

1779

2184

# End of Avahi example code

1783

2188

(tcp_server.handle_request

1784

2189

(*args[2:], **kwargs) or True))

1785

2190

1786

logger.debug(u"Starting main loop")

2191

logger.debug("Starting main loop")

1787

2192

main_loop.run()

1788

except AvahiError, error:

1789

logger.critical(u"AvahiError: %s", error)

2193

except AvahiError as error:

2194

logger.critical("AvahiError: %s", error)

1790

2195

cleanup()

1791

2196

sys.exit(1)

1792

2197

except KeyboardInterrupt:

1793

2198

if debug:

1794

print >> sys.stderr

1795

logger.debug(u"Server received KeyboardInterrupt")

1796

logger.debug(u"Server exiting")

2199

print("", file=sys.stderr)

2200

logger.debug("Server received KeyboardInterrupt")

2201

logger.debug("Server exiting")

1797

2202

# Must run before the D-Bus bus name gets deregistered

1798

2203

cleanup()

1799

2204

2205

1800

2206

if __name__ == '__main__':

1801

2207

main()