/mandos/release : revision 237.11.2

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

60

61

import fcntl

61

62

import functools

62

63

import cPickle as pickle

63

import select

64

import multiprocessing

65

import types

64

66

65

67

import dbus

66

68

import dbus.service

81

83

SO_BINDTODEVICE = None

82

84

83

85

84

version = "1.0.14"

86

version = "1.3.1"

85

87

86

logger = logging.Logger(u'mandos')

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

87

90

syslogger = (logging.handlers.SysLogHandler

88

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

89

address = "/dev/log"))

92

address = str("/dev/log")))

90

93

syslogger.setFormatter(logging.Formatter

91

(u'Mandos [%(process)d]: %(levelname)s:'

92

u' %(message)s'))

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

93

96

logger.addHandler(syslogger)

94

97

95

98

console = logging.StreamHandler()

96

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

97

u' %(levelname)s:'

98

u' %(message)s'))

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

99

102

logger.addHandler(console)

100

103

101

104

class AvahiError(Exception):

118

121

Attributes:

119

122

interface: integer; avahi.IF_UNSPEC or an interface index.

120

123

Used to optionally bind to the specified interface.

121

122

type: string; Example: u'_mandos._tcp'.

124

125

type: string; Example: '_mandos._tcp'.

123

126

See <http://www.dns-sd.org/ServiceTypes.html>

124

127

port: integer; what port to announce

125

128

TXT: list of strings; TXT record for the service

134

137

"""

135

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

136

139

servicetype = None, port = None, TXT = None,

137

domain = u"", host = u"", max_renames = 32768,

140

domain = "", host = "", max_renames = 32768,

138

141

protocol = avahi.PROTO_UNSPEC, bus = None):

139

142

self.interface = interface

140

143

self.name = name

149

152

self.group = None # our entry group

150

153

self.server = None

151

154

self.bus = bus

155

self.entry_group_state_changed_match = None

152

156

def rename(self):

153

157

"""Derived from the Avahi example code"""

154

158

if self.rename_count >= self.max_renames:

155

logger.critical(u"No suitable Zeroconf service name found"

156

u" after %i retries, exiting.",

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

157

161

self.rename_count)

158

raise AvahiServiceError(u"Too many renames")

159

self.name = self.server.GetAlternativeServiceName(self.name)

160

logger.info(u"Changing Zeroconf service name to %r ...",

161

unicode(self.name))

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

164

logger.info("Changing Zeroconf service name to %r ...",

165

self.name)

162

166

syslogger.setFormatter(logging.Formatter

163

(u'Mandos (%s) [%%(process)d]:'

164

u' %%(levelname)s: %%(message)s'

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

165

169

% self.name))

166

170

self.remove()

167

self.add()

171

try:

172

self.add()

173

except dbus.exceptions.DBusException as error:

174

logger.critical("DBusException: %s", error)

175

self.cleanup()

176

os._exit(1)

168

177

self.rename_count += 1

169

178

def remove(self):

170

179

"""Derived from the Avahi example code"""

180

if self.entry_group_state_changed_match is not None:

181

self.entry_group_state_changed_match.remove()

182

self.entry_group_state_changed_match = None

171

183

if self.group is not None:

172

184

self.group.Reset()

173

185

def add(self):

174

186

"""Derived from the Avahi example code"""

187

self.remove()

175

188

if self.group is None:

176

189

self.group = dbus.Interface(

177

190

self.bus.get_object(avahi.DBUS_NAME,

178

191

self.server.EntryGroupNew()),

179

192

avahi.DBUS_INTERFACE_ENTRY_GROUP)

180

self.group.connect_to_signal('StateChanged',

181

self

182

.entry_group_state_changed)

183

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

193

self.entry_group_state_changed_match = (

194

self.group.connect_to_signal(

195

'StateChanged', self .entry_group_state_changed))

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

184

197

self.name, self.type)

185

198

self.group.AddService(

186

199

self.interface,

193

206

self.group.Commit()

194

207

def entry_group_state_changed(self, state, error):

195

208

"""Derived from the Avahi example code"""

196

logger.debug(u"Avahi entry group state change: %i", state)

209

logger.debug("Avahi entry group state change: %i", state)

197

210

198

211

if state == avahi.ENTRY_GROUP_ESTABLISHED:

199

logger.debug(u"Zeroconf service established.")

212

logger.debug("Zeroconf service established.")

200

213

elif state == avahi.ENTRY_GROUP_COLLISION:

201

logger.warning(u"Zeroconf service name collision.")

214

logger.info("Zeroconf service name collision.")

202

215

self.rename()

203

216

elif state == avahi.ENTRY_GROUP_FAILURE:

204

logger.critical(u"Avahi: Error in group state changed %s",

217

logger.critical("Avahi: Error in group state changed %s",

205

218

unicode(error))

206

raise AvahiGroupError(u"State changed: %s"

219

raise AvahiGroupError("State changed: %s"

207

220

% unicode(error))

208

221

def cleanup(self):

209

222

"""Derived from the Avahi example code"""

210

223

if self.group is not None:

211

self.group.Free()

224

try:

225

self.group.Free()

226

except (dbus.exceptions.UnknownMethodException,

227

dbus.exceptions.DBusException) as e:

228

pass

212

229

self.group = None

213

def server_state_changed(self, state):

230

self.remove()

231

def server_state_changed(self, state, error=None):

214

232

"""Derived from the Avahi example code"""

215

logger.debug(u"Avahi server state change: %i", state)

216

if state == avahi.SERVER_COLLISION:

217

logger.error(u"Zeroconf server name collision")

218

self.remove()

233

logger.debug("Avahi server state change: %i", state)

234

bad_states = { avahi.SERVER_INVALID:

235

"Zeroconf server invalid",

236

avahi.SERVER_REGISTERING: None,

237

avahi.SERVER_COLLISION:

238

"Zeroconf server name collision",

239

avahi.SERVER_FAILURE:

240

"Zeroconf server failure" }

241

if state in bad_states:

242

if bad_states[state] is not None:

243

if error is None:

244

logger.error(bad_states[state])

245

else:

246

logger.error(bad_states[state] + ": %r", error)

247

self.cleanup()

219

248

elif state == avahi.SERVER_RUNNING:

220

249

self.add()

250

else:

251

if error is None:

252

logger.debug("Unknown state: %r", state)

253

else:

254

logger.debug("Unknown state: %r: %r", state, error)

221

255

def activate(self):

222

256

"""Derived from the Avahi example code"""

223

257

if self.server is None:

224

258

self.server = dbus.Interface(

225

259

self.bus.get_object(avahi.DBUS_NAME,

226

avahi.DBUS_PATH_SERVER),

260

avahi.DBUS_PATH_SERVER,

261

follow_name_owner_changes=True),

227

262

avahi.DBUS_INTERFACE_SERVER)

228

self.server.connect_to_signal(u"StateChanged",

263

self.server.connect_to_signal("StateChanged",

229

264

self.server_state_changed)

230

265

self.server_state_changed(self.server.GetState())

231

266

232

267

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

233

274

class Client(object):

234

275

"""A representation of a client host served by this server.

235

276

236

277

Attributes:

237

238

D-Bus identifiers

278

_approved: bool(); 'None' if not yet approved/disapproved

279

approval_delay: datetime.timedelta(); Time to wait for approval

280

approval_duration: datetime.timedelta(); Duration of one approval

281

checker: subprocess.Popen(); a running checker process used

282

to see if the client lives.

283

'None' if no process is running.

284

checker_callback_tag: a gobject event source tag, or None

285

checker_command: string; External command which is run to check

286

if client lives. %() expansions are done at

287

runtime with vars(self) as dict, so that for

288

instance %(name)s can be used in the command.

289

checker_initiator_tag: a gobject event source tag, or None

290

created: datetime.datetime(); (UTC) object creation

291

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

293

disable_initiator_tag: a gobject event source tag, or None

294

enabled: bool()

239

295

fingerprint: string (40 or 32 hexadecimal digits); used to

240

296

uniquely identify the client

241

secret: bytestring; sent verbatim (over TLS) to client

242

297

host: string; available for use by the checker command

243

created: datetime.datetime(); (UTC) object creation

298

interval: datetime.timedelta(); How often to start a new checker

299

last_approval_request: datetime.datetime(); (UTC) or None

300

last_checked_ok: datetime.datetime(); (UTC) or None

244

301

last_enabled: datetime.datetime(); (UTC)

245

enabled: bool()

246

last_checked_ok: datetime.datetime(); (UTC) or None

302

303

D-Bus identifiers

304

secret: bytestring; sent verbatim (over TLS) to client

247

305

timeout: datetime.timedelta(); How long from last_checked_ok

248

306

until this client is disabled

249

interval: datetime.timedelta(); How often to start a new checker

250

disable_hook: If set, called by disable() as disable_hook(self)

251

checker: subprocess.Popen(); a running checker process used

252

to see if the client lives.

253

'None' if no process is running.

254

checker_initiator_tag: a gobject event source tag, or None

255

disable_initiator_tag: - '' -

256

checker_callback_tag: - '' -

257

checker_command: string; External command which is run to check if

258

client lives. %() expansions are done at

259

runtime with vars(self) as dict, so that for

260

instance %(name)s can be used in the command.

261

current_checker_command: string; current running checker_command

307

extended_timeout: extra long timeout when password has been sent

308

runtime_expansions: Allowed attributes for runtime expansion.

309

expires: datetime.datetime(); time (UTC) when a client will be

310

disabled, or None

262

311

"""

263

312

264

@staticmethod

265

def _timedelta_to_milliseconds(td):

266

"Convert a datetime.timedelta() to milliseconds"

267

return ((td.days * 24 * 60 * 60 * 1000)

268

+ (td.seconds * 1000)

269

+ (td.microseconds // 1000))

313

runtime_expansions = ("approval_delay", "approval_duration",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

316

"last_enabled", "name", "timeout")

270

317

271

318

def timeout_milliseconds(self):

272

319

"Return the 'timeout' attribute in milliseconds"

273

return self._timedelta_to_milliseconds(self.timeout)

320

return _timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

274

325

275

326

def interval_milliseconds(self):

276

327

"Return the 'interval' attribute in milliseconds"

277

return self._timedelta_to_milliseconds(self.interval)

328

return _timedelta_to_milliseconds(self.interval)

329

330

def approval_delay_milliseconds(self):

331

return _timedelta_to_milliseconds(self.approval_delay)

278

332

279

333

def __init__(self, name = None, disable_hook=None, config=None):

280

334

"""Note: the 'checker' key in 'config' sets the

283

337

self.name = name

284

338

if config is None:

285

339

config = {}

286

logger.debug(u"Creating client %r", self.name)

340

logger.debug("Creating client %r", self.name)

287

341

# Uppercase and remove spaces from fingerprint for later

288

342

# comparison purposes with return value from the fingerprint()

289

343

# function

290

self.fingerprint = (config[u"fingerprint"].upper()

291

.replace(u" ", u""))

292

logger.debug(u" Fingerprint: %s", self.fingerprint)

293

if u"secret" in config:

294

self.secret = config[u"secret"].decode(u"base64")

295

elif u"secfile" in config:

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

296

350

with open(os.path.expanduser(os.path.expandvars

297

(config[u"secfile"])),

351

(config["secfile"])),

298

352

"rb") as secfile:

299

353

self.secret = secfile.read()

300

354

else:

301

raise TypeError(u"No secret or secfile for client %s"

355

raise TypeError("No secret or secfile for client %s"

302

356

% self.name)

303

self.host = config.get(u"host", u"")

357

self.host = config.get("host", "")

304

358

self.created = datetime.datetime.utcnow()

305

359

self.enabled = False

360

self.last_approval_request = None

306

361

self.last_enabled = None

307

362

self.last_checked_ok = None

308

self.timeout = string_to_delta(config[u"timeout"])

309

self.interval = string_to_delta(config[u"interval"])

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

310

366

self.disable_hook = disable_hook

311

367

self.checker = None

312

368

self.checker_initiator_tag = None

313

369

self.disable_initiator_tag = None

370

self.expires = None

314

371

self.checker_callback_tag = None

315

self.checker_command = config[u"checker"]

372

self.checker_command = config["checker"]

316

373

self.current_checker_command = None

317

374

self.last_connect = None

375

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

377

True)

378

self.approvals_pending = 0

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

318

384

385

def send_changedstate(self):

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

319

390

def enable(self):

320

391

"""Start this client's checker and timeout hooks"""

321

if getattr(self, u"enabled", False):

392

if getattr(self, "enabled", False):

322

393

# Already enabled

323

394

return

324

self.last_enabled = datetime.datetime.utcnow()

395

self.send_changedstate()

325

396

# Schedule a new checker to be started an 'interval' from now,

326

397

# and every interval from then on.

327

398

self.checker_initiator_tag = (gobject.timeout_add

328

399

(self.interval_milliseconds(),

329

400

self.start_checker))

330

401

# Schedule a disable() when 'timeout' has passed

402

self.expires = datetime.datetime.utcnow() + self.timeout

331

403

self.disable_initiator_tag = (gobject.timeout_add

332

404

(self.timeout_milliseconds(),

333

405

self.disable))

334

406

self.enabled = True

407

self.last_enabled = datetime.datetime.utcnow()

335

408

# Also start a new checker *right now*.

336

409

self.start_checker()

337

410

340

413

if not getattr(self, "enabled", False):

341

414

return False

342

415

if not quiet:

343

logger.info(u"Disabling client %s", self.name)

344

if getattr(self, u"disable_initiator_tag", False):

416

self.send_changedstate()

417

if not quiet:

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

345

420

gobject.source_remove(self.disable_initiator_tag)

346

421

self.disable_initiator_tag = None

347

if getattr(self, u"checker_initiator_tag", False):

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

348

424

gobject.source_remove(self.checker_initiator_tag)

349

425

self.checker_initiator_tag = None

350

426

self.stop_checker()

365

441

if os.WIFEXITED(condition):

366

442

exitstatus = os.WEXITSTATUS(condition)

367

443

if exitstatus == 0:

368

logger.info(u"Checker for %(name)s succeeded",

444

logger.info("Checker for %(name)s succeeded",

369

445

vars(self))

370

446

self.checked_ok()

371

447

else:

372

logger.info(u"Checker for %(name)s failed",

448

logger.info("Checker for %(name)s failed",

373

449

vars(self))

374

450

else:

375

logger.warning(u"Checker for %(name)s crashed?",

451

logger.warning("Checker for %(name)s crashed?",

376

452

vars(self))

377

453

378

def checked_ok(self):

454

def checked_ok(self, timeout=None):

379

455

"""Bump up the timeout for this client.

380

456

381

457

This should only be called when the client has been seen,

382

458

alive and well.

383

459

"""

460

if timeout is None:

461

timeout = self.timeout

384

462

self.last_checked_ok = datetime.datetime.utcnow()

385

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

386

465

self.disable_initiator_tag = (gobject.timeout_add

387

(self.timeout_milliseconds(),

466

(_timedelta_to_milliseconds(timeout),

388

467

self.disable))

389

468

469

def need_approval(self):

470

self.last_approval_request = datetime.datetime.utcnow()

471

390

472

def start_checker(self):

391

473

"""Start a new checker subprocess if one is not running.

392

474

404

486

# If a checker exists, make sure it is not a zombie

405

487

try:

406

488

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

407

except (AttributeError, OSError), error:

489

except (AttributeError, OSError) as error:

408

490

if (isinstance(error, OSError)

409

491

and error.errno != errno.ECHILD):

410

492

raise error

411

493

else:

412

494

if pid:

413

logger.warning(u"Checker was a zombie")

495

logger.warning("Checker was a zombie")

414

496

gobject.source_remove(self.checker_callback_tag)

415

497

self.checker_callback(pid, status,

416

498

self.current_checker_command)

421

503

command = self.checker_command % self.host

422

504

except TypeError:

423

505

# Escape attributes for the shell

424

escaped_attrs = dict((key,

425

re.escape(unicode(str(val),

426

errors=

427

u'replace')))

428

for key, val in

429

vars(self).iteritems())

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

430

514

try:

431

515

command = self.checker_command % escaped_attrs

432

except TypeError, error:

433

logger.error(u'Could not format string "%s":'

434

u' %s', self.checker_command, error)

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

435

519

return True # Try again later

436

520

self.current_checker_command = command

437

521

try:

438

logger.info(u"Starting checker %r for %s",

522

logger.info("Starting checker %r for %s",

439

523

command, self.name)

440

524

# We don't need to redirect stdout and stderr, since

441

525

# in normal mode, that is already done by daemon(),

443

527

# always replaced by /dev/null.)

444

528

self.checker = subprocess.Popen(command,

445

529

close_fds=True,

446

shell=True, cwd=u"/")

530

shell=True, cwd="/")

447

531

self.checker_callback_tag = (gobject.child_watch_add

448

532

(self.checker.pid,

449

533

self.checker_callback,

454

538

if pid:

455

539

gobject.source_remove(self.checker_callback_tag)

456

540

self.checker_callback(pid, status, command)

457

except OSError, error:

458

logger.error(u"Failed to start subprocess: %s",

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

459

543

error)

460

544

# Re-run this periodically if run by gobject.timeout_add

461

545

return True

465

549

if self.checker_callback_tag:

466

550

gobject.source_remove(self.checker_callback_tag)

467

551

self.checker_callback_tag = None

468

if getattr(self, u"checker", None) is None:

552

if getattr(self, "checker", None) is None:

469

553

return

470

logger.debug(u"Stopping checker for %(name)s", vars(self))

554

logger.debug("Stopping checker for %(name)s", vars(self))

471

555

try:

472

556

os.kill(self.checker.pid, signal.SIGTERM)

473

557

#time.sleep(0.5)

474

558

#if self.checker.poll() is None:

475

559

# os.kill(self.checker.pid, signal.SIGKILL)

476

except OSError, error:

560

except OSError as error:

477

561

if error.errno != errno.ESRCH: # No such process

478

562

raise

479

563

self.checker = None

480

564

481

565

482

def dbus_service_property(dbus_interface, signature=u"v",

483

access=u"readwrite", byte_arrays=False):

566

def dbus_service_property(dbus_interface, signature="v",

567

access="readwrite", byte_arrays=False):

484

568

"""Decorators for marking methods of a DBusObjectWithProperties to

485

569

become properties on the D-Bus.

486

570

493

577

"""

494

578

# Encoding deeply encoded byte arrays is not supported yet by the

495

579

# "Set" method, so we fail early here:

496

if byte_arrays and signature != u"ay":

497

raise ValueError(u"Byte arrays not supported for non-'ay'"

498

u" signature %r" % signature)

580

if byte_arrays and signature != "ay":

581

raise ValueError("Byte arrays not supported for non-'ay'"

582

" signature %r" % signature)

499

583

def decorator(func):

500

584

func._dbus_is_property = True

501

585

func._dbus_interface = dbus_interface

502

586

func._dbus_signature = signature

503

587

func._dbus_access = access

504

588

func._dbus_name = func.__name__

505

if func._dbus_name.endswith(u"_dbus_property"):

589

if func._dbus_name.endswith("_dbus_property"):

506

590

func._dbus_name = func._dbus_name[:-14]

507

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

591

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

508

592

return func

509

593

return decorator

510

594

530

614

531

615

class DBusObjectWithProperties(dbus.service.Object):

532

616

"""A D-Bus object with properties.

533

617

534

618

Classes inheriting from this can use the dbus_service_property

535

619

decorator to expose methods as D-Bus properties. It exposes the

536

620

standard Get(), Set(), and GetAll() methods on the D-Bus.

538

622

539

623

@staticmethod

540

624

def _is_dbus_property(obj):

541

return getattr(obj, u"_dbus_is_property", False)

625

return getattr(obj, "_dbus_is_property", False)

542

626

543

627

def _get_all_dbus_properties(self):

544

628

"""Returns a generator of (name, attribute) pairs

545

629

"""

546

return ((prop._dbus_name, prop)

547

for name, prop in

548

inspect.getmembers(self, self._is_dbus_property))

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

631

for cls in self.__class__.__mro__

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

549

633

550

634

def _get_dbus_property(self, interface_name, property_name):

551

635

"""Returns a bound method if one exists which is a D-Bus

552

636

property with the specified name and interface.

553

637

"""

554

for name in (property_name,

555

property_name + u"_dbus_property"):

556

prop = getattr(self, name, None)

557

if (prop is None

558

or not self._is_dbus_property(prop)

559

or prop._dbus_name != property_name

560

or (interface_name and prop._dbus_interface

561

and interface_name != prop._dbus_interface)):

562

continue

563

return prop

638

for cls in self.__class__.__mro__:

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

641

return value.__get__(self)

642

564

643

# No such property

565

raise DBusPropertyNotFound(self.dbus_object_path + u":"

566

+ interface_name + u"."

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

645

+ interface_name + "."

567

646

+ property_name)

568

647

569

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

570

out_signature=u"v")

648

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

649

out_signature="v")

571

650

def Get(self, interface_name, property_name):

572

651

"""Standard D-Bus property Get() method, see D-Bus standard.

573

652

"""

574

653

prop = self._get_dbus_property(interface_name, property_name)

575

if prop._dbus_access == u"write":

654

if prop._dbus_access == "write":

576

655

raise DBusPropertyAccessException(property_name)

577

656

value = prop()

578

if not hasattr(value, u"variant_level"):

657

if not hasattr(value, "variant_level"):

579

658

return value

580

659

return type(value)(value, variant_level=value.variant_level+1)

581

660

582

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

661

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

583

662

def Set(self, interface_name, property_name, value):

584

663

"""Standard D-Bus property Set() method, see D-Bus standard.

585

664

"""

586

665

prop = self._get_dbus_property(interface_name, property_name)

587

if prop._dbus_access == u"read":

666

if prop._dbus_access == "read":

588

667

raise DBusPropertyAccessException(property_name)

589

if prop._dbus_get_args_options[u"byte_arrays"]:

668

if prop._dbus_get_args_options["byte_arrays"]:

590

669

# The byte_arrays option is not supported yet on

591

670

# signatures other than "ay".

592

if prop._dbus_signature != u"ay":

671

if prop._dbus_signature != "ay":

593

672

raise ValueError

594

673

value = dbus.ByteArray(''.join(unichr(byte)

595

674

for byte in value))

596

675

prop(value)

597

676

598

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

599

out_signature=u"a{sv}")

677

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

678

out_signature="a{sv}")

600

679

def GetAll(self, interface_name):

601

680

"""Standard D-Bus property GetAll() method, see D-Bus

602

681

standard.

603

682

604

683

Note: Will not include properties with access="write".

605

684

"""

606

685

all = {}

610

689

# Interface non-empty but did not match

611

690

continue

612

691

# Ignore write-only properties

613

if prop._dbus_access == u"write":

692

if prop._dbus_access == "write":

614

693

continue

615

694

value = prop()

616

if not hasattr(value, u"variant_level"):

695

if not hasattr(value, "variant_level"):

617

696

all[name] = value

618

697

continue

619

698

all[name] = type(value)(value, variant_level=

620

699

value.variant_level+1)

621

return dbus.Dictionary(all, signature=u"sv")

700

return dbus.Dictionary(all, signature="sv")

622

701

623

702

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

624

out_signature=u"s",

703

out_signature="s",

625

704

path_keyword='object_path',

626

705

connection_keyword='connection')

627

706

def Introspect(self, object_path, connection):

632

711

try:

633

712

document = xml.dom.minidom.parseString(xmlstring)

634

713

def make_tag(document, name, prop):

635

e = document.createElement(u"property")

636

e.setAttribute(u"name", name)

637

e.setAttribute(u"type", prop._dbus_signature)

638

e.setAttribute(u"access", prop._dbus_access)

714

e = document.createElement("property")

715

e.setAttribute("name", name)

716

e.setAttribute("type", prop._dbus_signature)

717

e.setAttribute("access", prop._dbus_access)

639

718

return e

640

for if_tag in document.getElementsByTagName(u"interface"):

719

for if_tag in document.getElementsByTagName("interface"):

641

720

for tag in (make_tag(document, name, prop)

642

721

for name, prop

643

722

in self._get_all_dbus_properties()

644

723

if prop._dbus_interface

645

== if_tag.getAttribute(u"name")):

724

== if_tag.getAttribute("name")):

646

725

if_tag.appendChild(tag)

647

726

# Add the names to the return values for the

648

727

# "org.freedesktop.DBus.Properties" methods

649

if (if_tag.getAttribute(u"name")

650

== u"org.freedesktop.DBus.Properties"):

651

for cn in if_tag.getElementsByTagName(u"method"):

652

if cn.getAttribute(u"name") == u"Get":

653

for arg in cn.getElementsByTagName(u"arg"):

654

if (arg.getAttribute(u"direction")

655

== u"out"):

656

arg.setAttribute(u"name", u"value")

657

elif cn.getAttribute(u"name") == u"GetAll":

658

for arg in cn.getElementsByTagName(u"arg"):

659

if (arg.getAttribute(u"direction")

660

== u"out"):

661

arg.setAttribute(u"name", u"props")

662

xmlstring = document.toxml(u"utf-8")

728

if (if_tag.getAttribute("name")

729

== "org.freedesktop.DBus.Properties"):

730

for cn in if_tag.getElementsByTagName("method"):

731

if cn.getAttribute("name") == "Get":

732

for arg in cn.getElementsByTagName("arg"):

733

if (arg.getAttribute("direction")

734

== "out"):

735

arg.setAttribute("name", "value")

736

elif cn.getAttribute("name") == "GetAll":

737

for arg in cn.getElementsByTagName("arg"):

738

if (arg.getAttribute("direction")

739

== "out"):

740

arg.setAttribute("name", "props")

741

xmlstring = document.toxml("utf-8")

663

742

document.unlink()

664

743

except (AttributeError, xml.dom.DOMException,

665

xml.parsers.expat.ExpatError), error:

666

logger.error(u"Failed to override Introspection method",

744

xml.parsers.expat.ExpatError) as error:

745

logger.error("Failed to override Introspection method",

667

746

error)

668

747

return xmlstring

669

748

670

749

750

def datetime_to_dbus (dt, variant_level=0):

751

"""Convert a UTC datetime.datetime() to a D-Bus type."""

752

if dt is None:

753

return dbus.String("", variant_level = variant_level)

754

return dbus.String(dt.isoformat(),

755

variant_level=variant_level)

756

757

class AlternateDBusNamesMetaclass(DBusObjectWithProperties.__metaclass__):

758

"""Applied to an empty subclass of a D-Bus object, this metaclass

759

will add additional D-Bus attributes matching a certain pattern.

760

"""

761

def __new__(mcs, name, bases, attr):

762

# Go through all the base classes which could have D-Bus

763

# methods, signals, or properties in them

764

for base in (b for b in bases

765

if issubclass(b, dbus.service.Object)):

766

# Go though all attributes of the base class

767

for attrname, attribute in inspect.getmembers(base):

768

# Ignore non-D-Bus attributes, and D-Bus attributes

769

# with the wrong interface name

770

if (not hasattr(attribute, "_dbus_interface")

771

or not attribute._dbus_interface

772

.startswith("se.recompile.Mandos")):

773

continue

774

# Create an alternate D-Bus interface name based on

775

# the current name

776

alt_interface = (attribute._dbus_interface

777

.replace("se.recompile.Mandos",

778

"se.bsnet.fukt.Mandos"))

779

# Is this a D-Bus signal?

780

if getattr(attribute, "_dbus_is_signal", False):

781

# Extract the original non-method function by

782

# black magic

783

nonmethod_func = (dict(

784

zip(attribute.func_code.co_freevars,

785

attribute.__closure__))["func"]

786

.cell_contents)

787

# Create a new, but exactly alike, function

788

# object, and decorate it to be a new D-Bus signal

789

# with the alternate D-Bus interface name

790

new_function = (dbus.service.signal

791

(alt_interface,

792

attribute._dbus_signature)

793

(types.FunctionType(

794

nonmethod_func.func_code,

795

nonmethod_func.func_globals,

796

nonmethod_func.func_name,

797

nonmethod_func.func_defaults,

798

nonmethod_func.func_closure)))

799

# Define a creator of a function to call both the

800

# old and new functions, so both the old and new

801

# signals gets sent when the function is called

802

def fixscope(func1, func2):

803

"""This function is a scope container to pass

804

func1 and func2 to the "call_both" function

805

outside of its arguments"""

806

def call_both(*args, **kwargs):

807

"""This function will emit two D-Bus

808

signals by calling func1 and func2"""

809

func1(*args, **kwargs)

810

func2(*args, **kwargs)

811

return call_both

812

# Create the "call_both" function and add it to

813

# the class

814

attr[attrname] = fixscope(attribute,

815

new_function)

816

# Is this a D-Bus method?

817

elif getattr(attribute, "_dbus_is_method", False):

818

# Create a new, but exactly alike, function

819

# object. Decorate it to be a new D-Bus method

820

# with the alternate D-Bus interface name. Add it

821

# to the class.

822

attr[attrname] = (dbus.service.method

823

(alt_interface,

824

attribute._dbus_in_signature,

825

attribute._dbus_out_signature)

826

(types.FunctionType

827

(attribute.func_code,

828

attribute.func_globals,

829

attribute.func_name,

830

attribute.func_defaults,

831

attribute.func_closure)))

832

# Is this a D-Bus property?

833

elif getattr(attribute, "_dbus_is_property", False):

834

# Create a new, but exactly alike, function

835

# object, and decorate it to be a new D-Bus

836

# property with the alternate D-Bus interface

837

# name. Add it to the class.

838

attr[attrname] = (dbus_service_property

839

(alt_interface,

840

attribute._dbus_signature,

841

attribute._dbus_access,

842

attribute

843

._dbus_get_args_options

844

["byte_arrays"])

845

(types.FunctionType

846

(attribute.func_code,

847

attribute.func_globals,

848

attribute.func_name,

849

attribute.func_defaults,

850

attribute.func_closure)))

851

return type.__new__(mcs, name, bases, attr)

852

671

853

class ClientDBus(Client, DBusObjectWithProperties):

672

854

"""A Client class using D-Bus

673

855

675

857

dbus_object_path: dbus.ObjectPath

676

858

bus: dbus.SystemBus()

677

859

"""

860

861

runtime_expansions = (Client.runtime_expansions

862

+ ("dbus_object_path",))

863

678

864

# dbus.service.Object doesn't use super(), so we can't either.

679

865

680

866

def __init__(self, bus = None, *args, **kwargs):

867

self._approvals_pending = 0

681

868

self.bus = bus

682

869

Client.__init__(self, *args, **kwargs)

683

870

# Only now, when this client is initialized, can it show up on

684

871

# the D-Bus

872

client_object_name = unicode(self.name).translate(

873

{ord("."): ord("_"),

874

ord("-"): ord("_")})

685

875

self.dbus_object_path = (dbus.ObjectPath

686

(u"/clients/"

687

+ self.name.replace(u".", u"_")))

876

("/clients/" + client_object_name))

688

877

DBusObjectWithProperties.__init__(self, self.bus,

689

878

self.dbus_object_path)

690

691

@staticmethod

692

def _datetime_to_dbus(dt, variant_level=0):

693

"""Convert a UTC datetime.datetime() to a D-Bus type."""

694

return dbus.String(dt.isoformat(),

695

variant_level=variant_level)

696

697

def enable(self):

698

oldstate = getattr(self, u"enabled", False)

699

r = Client.enable(self)

700

if oldstate != self.enabled:

701

# Emit D-Bus signals

702

self.PropertyChanged(dbus.String(u"enabled"),

703

dbus.Boolean(True, variant_level=1))

704

self.PropertyChanged(

705

dbus.String(u"last_enabled"),

706

self._datetime_to_dbus(self.last_enabled,

707

variant_level=1))

708

return r

709

710

def disable(self, quiet = False):

711

oldstate = getattr(self, u"enabled", False)

712

r = Client.disable(self, quiet=quiet)

713

if not quiet and oldstate != self.enabled:

714

# Emit D-Bus signal

715

self.PropertyChanged(dbus.String(u"enabled"),

716

dbus.Boolean(False, variant_level=1))

717

return r

879

880

def notifychangeproperty(transform_func,

881

dbus_name, type_func=lambda x: x,

882

variant_level=1):

883

""" Modify a variable so that it's a property which announces

884

its changes to DBus.

885

886

transform_fun: Function that takes a value and transforms it

887

to a D-Bus type.

888

dbus_name: D-Bus name of the variable

889

type_func: Function that transform the value before sending it

890

to the D-Bus. Default: no transform

891

variant_level: D-Bus variant level. Default: 1

892

"""

893

real_value = [None,]

894

def setter(self, value):

895

old_value = real_value[0]

896

real_value[0] = value

897

if hasattr(self, "dbus_object_path"):

898

if type_func(old_value) != type_func(real_value[0]):

899

dbus_value = transform_func(type_func(real_value[0]),

900

variant_level)

901

self.PropertyChanged(dbus.String(dbus_name),

902

dbus_value)

903

904

return property(lambda self: real_value[0], setter)

905

906

907

expires = notifychangeproperty(datetime_to_dbus, "Expires")

908

approvals_pending = notifychangeproperty(dbus.Boolean,

909

"ApprovalPending",

910

type_func = bool)

911

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

912

last_enabled = notifychangeproperty(datetime_to_dbus,

913

"LastEnabled")

914

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

915

type_func = lambda checker: checker is not None)

916

last_checked_ok = notifychangeproperty(datetime_to_dbus,

917

"LastCheckedOK")

918

last_approval_request = notifychangeproperty(datetime_to_dbus,

919

"LastApprovalRequest")

920

approved_by_default = notifychangeproperty(dbus.Boolean,

921

"ApprovedByDefault")

922

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

923

type_func = _timedelta_to_milliseconds)

924

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

925

type_func = _timedelta_to_milliseconds)

926

host = notifychangeproperty(dbus.String, "Host")

927

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

928

type_func = _timedelta_to_milliseconds)

929

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

930

type_func = _timedelta_to_milliseconds)

931

interval = notifychangeproperty(dbus.UInt16, "Interval",

932

type_func = _timedelta_to_milliseconds)

933

checker_command = notifychangeproperty(dbus.String, "Checker")

934

935

del notifychangeproperty

718

936

719

937

def __del__(self, *args, **kwargs):

720

938

try:

721

939

self.remove_from_connection()

722

940

except LookupError:

723

941

pass

724

if hasattr(DBusObjectWithProperties, u"__del__"):

942

if hasattr(DBusObjectWithProperties, "__del__"):

725

943

DBusObjectWithProperties.__del__(self, *args, **kwargs)

726

944

Client.__del__(self, *args, **kwargs)

727

945

729

947

*args, **kwargs):

730

948

self.checker_callback_tag = None

731

949

self.checker = None

732

# Emit D-Bus signal

733

self.PropertyChanged(dbus.String(u"checker_running"),

734

dbus.Boolean(False, variant_level=1))

735

950

if os.WIFEXITED(condition):

736

951

exitstatus = os.WEXITSTATUS(condition)

737

952

# Emit D-Bus signal

747

962

return Client.checker_callback(self, pid, condition, command,

748

963

*args, **kwargs)

749

964

750

def checked_ok(self, *args, **kwargs):

751

r = Client.checked_ok(self, *args, **kwargs)

752

# Emit D-Bus signal

753

self.PropertyChanged(

754

dbus.String(u"last_checked_ok"),

755

(self._datetime_to_dbus(self.last_checked_ok,

756

variant_level=1)))

757

return r

758

759

965

def start_checker(self, *args, **kwargs):

760

966

old_checker = self.checker

761

967

if self.checker is not None:

768

974

and old_checker_pid != self.checker.pid):

769

975

# Emit D-Bus signal

770

976

self.CheckerStarted(self.current_checker_command)

771

self.PropertyChanged(

772

dbus.String(u"checker_running"),

773

dbus.Boolean(True, variant_level=1))

774

return r

775

776

def stop_checker(self, *args, **kwargs):

777

old_checker = getattr(self, u"checker", None)

778

r = Client.stop_checker(self, *args, **kwargs)

779

if (old_checker is not None

780

and getattr(self, u"checker", None) is None):

781

self.PropertyChanged(dbus.String(u"checker_running"),

782

dbus.Boolean(False, variant_level=1))

783

return r

977

return r

978

979

def _reset_approved(self):

980

self._approved = None

981

return False

982

983

def approve(self, value=True):

984

self.send_changedstate()

985

self._approved = value

986

gobject.timeout_add(_timedelta_to_milliseconds

987

(self.approval_duration),

988

self._reset_approved)

989

784

990

785

991

## D-Bus methods, signals & properties

786

_interface = u"se.bsnet.fukt.Mandos.Client"

992

_interface = "se.recompile.Mandos.Client"

787

993

788

994

## Signals

789

995

790

996

# CheckerCompleted - signal

791

@dbus.service.signal(_interface, signature=u"nxs")

997

@dbus.service.signal(_interface, signature="nxs")

792

998

def CheckerCompleted(self, exitcode, waitstatus, command):

793

999

"D-Bus signal"

794

1000

pass

795

1001

796

1002

# CheckerStarted - signal

797

@dbus.service.signal(_interface, signature=u"s")

1003

@dbus.service.signal(_interface, signature="s")

798

1004

def CheckerStarted(self, command):

799

1005

"D-Bus signal"

800

1006

pass

801

1007

802

1008

# PropertyChanged - signal

803

@dbus.service.signal(_interface, signature=u"sv")

1009

@dbus.service.signal(_interface, signature="sv")

804

1010

def PropertyChanged(self, property, value):

805

1011

"D-Bus signal"

806

1012

pass

808

1014

# GotSecret - signal

809

1015

@dbus.service.signal(_interface)

810

1016

def GotSecret(self):

811

"D-Bus signal"

1017

"""D-Bus signal

1018

Is sent after a successful transfer of secret from the Mandos

1019

server to mandos-client

1020

"""

812

1021

pass

813

1022

814

1023

# Rejected - signal

815

@dbus.service.signal(_interface)

816

def Rejected(self):

1024

@dbus.service.signal(_interface, signature="s")

1025

def Rejected(self, reason):

817

1026

"D-Bus signal"

818

1027

pass

819

1028

1029

# NeedApproval - signal

1030

@dbus.service.signal(_interface, signature="tb")

1031

def NeedApproval(self, timeout, default):

1032

"D-Bus signal"

1033

return self.need_approval()

1034

820

1035

## Methods

821

1036

1037

# Approve - method

1038

@dbus.service.method(_interface, in_signature="b")

1039

def Approve(self, value):

1040

self.approve(value)

1041

822

1042

# CheckedOK - method

823

1043

@dbus.service.method(_interface)

824

1044

def CheckedOK(self):

825

return self.checked_ok()

1045

self.checked_ok()

826

1046

827

1047

# Enable - method

828

1048

@dbus.service.method(_interface)

849

1069

850

1070

## Properties

851

1071

852

# name - property

853

@dbus_service_property(_interface, signature=u"s", access=u"read")

854

def name_dbus_property(self):

1072

# ApprovalPending - property

1073

@dbus_service_property(_interface, signature="b", access="read")

1074

def ApprovalPending_dbus_property(self):

1075

return dbus.Boolean(bool(self.approvals_pending))

1076

1077

# ApprovedByDefault - property

1078

@dbus_service_property(_interface, signature="b",

1079

access="readwrite")

1080

def ApprovedByDefault_dbus_property(self, value=None):

1081

if value is None: # get

1082

return dbus.Boolean(self.approved_by_default)

1083

self.approved_by_default = bool(value)

1084

1085

# ApprovalDelay - property

1086

@dbus_service_property(_interface, signature="t",

1087

access="readwrite")

1088

def ApprovalDelay_dbus_property(self, value=None):

1089

if value is None: # get

1090

return dbus.UInt64(self.approval_delay_milliseconds())

1091

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1092

1093

# ApprovalDuration - property

1094

@dbus_service_property(_interface, signature="t",

1095

access="readwrite")

1096

def ApprovalDuration_dbus_property(self, value=None):

1097

if value is None: # get

1098

return dbus.UInt64(_timedelta_to_milliseconds(

1099

self.approval_duration))

1100

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1101

1102

# Name - property

1103

@dbus_service_property(_interface, signature="s", access="read")

1104

def Name_dbus_property(self):

855

1105

return dbus.String(self.name)

856

1106

857

# fingerprint - property

858

@dbus_service_property(_interface, signature=u"s", access=u"read")

859

def fingerprint_dbus_property(self):

1107

# Fingerprint - property

1108

@dbus_service_property(_interface, signature="s", access="read")

1109

def Fingerprint_dbus_property(self):

860

1110

return dbus.String(self.fingerprint)

861

1111

862

# host - property

863

@dbus_service_property(_interface, signature=u"s",

864

access=u"readwrite")

865

def host_dbus_property(self, value=None):

1112

# Host - property

1113

@dbus_service_property(_interface, signature="s",

1114

access="readwrite")

1115

def Host_dbus_property(self, value=None):

866

1116

if value is None: # get

867

1117

return dbus.String(self.host)

868

1118

self.host = value

869

# Emit D-Bus signal

870

self.PropertyChanged(dbus.String(u"host"),

871

dbus.String(value, variant_level=1))

872

873

# created - property

874

@dbus_service_property(_interface, signature=u"s", access=u"read")

875

def created_dbus_property(self):

876

return dbus.String(self._datetime_to_dbus(self.created))

877

878

# last_enabled - property

879

@dbus_service_property(_interface, signature=u"s", access=u"read")

880

def last_enabled_dbus_property(self):

881

if self.last_enabled is None:

882

return dbus.String(u"")

883

return dbus.String(self._datetime_to_dbus(self.last_enabled))

884

885

# enabled - property

886

@dbus_service_property(_interface, signature=u"b",

887

access=u"readwrite")

888

def enabled_dbus_property(self, value=None):

1119

1120

# Created - property

1121

@dbus_service_property(_interface, signature="s", access="read")

1122

def Created_dbus_property(self):

1123

return dbus.String(datetime_to_dbus(self.created))

1124

1125

# LastEnabled - property

1126

@dbus_service_property(_interface, signature="s", access="read")

1127

def LastEnabled_dbus_property(self):

1128

return datetime_to_dbus(self.last_enabled)

1129

1130

# Enabled - property

1131

@dbus_service_property(_interface, signature="b",

1132

access="readwrite")

1133

def Enabled_dbus_property(self, value=None):

889

1134

if value is None: # get

890

1135

return dbus.Boolean(self.enabled)

891

1136

if value:

893

1138

else:

894

1139

self.disable()

895

1140

896

# last_checked_ok - property

897

@dbus_service_property(_interface, signature=u"s",

898

access=u"readwrite")

899

def last_checked_ok_dbus_property(self, value=None):

1141

# LastCheckedOK - property

1142

@dbus_service_property(_interface, signature="s",

1143

access="readwrite")

1144

def LastCheckedOK_dbus_property(self, value=None):

900

1145

if value is not None:

901

1146

self.checked_ok()

902

1147

return

903

if self.last_checked_ok is None:

904

return dbus.String(u"")

905

return dbus.String(self._datetime_to_dbus(self

906

.last_checked_ok))

907

908

# timeout - property

909

@dbus_service_property(_interface, signature=u"t",

910

access=u"readwrite")

911

def timeout_dbus_property(self, value=None):

1148

return datetime_to_dbus(self.last_checked_ok)

1149

1150

# Expires - property

1151

@dbus_service_property(_interface, signature="s", access="read")

1152

def Expires_dbus_property(self):

1153

return datetime_to_dbus(self.expires)

1154

1155

# LastApprovalRequest - property

1156

@dbus_service_property(_interface, signature="s", access="read")

1157

def LastApprovalRequest_dbus_property(self):

1158

return datetime_to_dbus(self.last_approval_request)

1159

1160

# Timeout - property

1161

@dbus_service_property(_interface, signature="t",

1162

access="readwrite")

1163

def Timeout_dbus_property(self, value=None):

912

1164

if value is None: # get

913

1165

return dbus.UInt64(self.timeout_milliseconds())

914

1166

self.timeout = datetime.timedelta(0, 0, 0, value)

915

# Emit D-Bus signal

916

self.PropertyChanged(dbus.String(u"timeout"),

917

dbus.UInt64(value, variant_level=1))

918

if getattr(self, u"disable_initiator_tag", None) is None:

1167

if getattr(self, "disable_initiator_tag", None) is None:

919

1168

return

920

1169

# Reschedule timeout

921

1170

gobject.source_remove(self.disable_initiator_tag)

922

1171

self.disable_initiator_tag = None

1172

self.expires = None

923

1173

time_to_die = (self.

924

1174

_timedelta_to_milliseconds((self

925

1175

.last_checked_ok

930

1180

# The timeout has passed

931

1181

self.disable()

932

1182

else:

1183

self.expires = (datetime.datetime.utcnow()

1184

+ datetime.timedelta(milliseconds = time_to_die))

933

1185

self.disable_initiator_tag = (gobject.timeout_add

934

1186

(time_to_die, self.disable))

935

1187

936

# interval - property

937

@dbus_service_property(_interface, signature=u"t",

938

access=u"readwrite")

939

def interval_dbus_property(self, value=None):

1188

# ExtendedTimeout - property

1189

@dbus_service_property(_interface, signature="t",

1190

access="readwrite")

1191

def ExtendedTimeout_dbus_property(self, value=None):

1192

if value is None: # get

1193

return dbus.UInt64(self.extended_timeout_milliseconds())

1194

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1195

1196

# Interval - property

1197

@dbus_service_property(_interface, signature="t",

1198

access="readwrite")

1199

def Interval_dbus_property(self, value=None):

940

1200

if value is None: # get

941

1201

return dbus.UInt64(self.interval_milliseconds())

942

1202

self.interval = datetime.timedelta(0, 0, 0, value)

943

# Emit D-Bus signal

944

self.PropertyChanged(dbus.String(u"interval"),

945

dbus.UInt64(value, variant_level=1))

946

if getattr(self, u"checker_initiator_tag", None) is None:

1203

if getattr(self, "checker_initiator_tag", None) is None:

947

1204

return

948

1205

# Reschedule checker run

949

1206

gobject.source_remove(self.checker_initiator_tag)

950

1207

self.checker_initiator_tag = (gobject.timeout_add

951

1208

(value, self.start_checker))

952

1209

self.start_checker() # Start one now, too

953

954

# checker - property

955

@dbus_service_property(_interface, signature=u"s",

956

access=u"readwrite")

957

def checker_dbus_property(self, value=None):

1210

1211

# Checker - property

1212

@dbus_service_property(_interface, signature="s",

1213

access="readwrite")

1214

def Checker_dbus_property(self, value=None):

958

1215

if value is None: # get

959

1216

return dbus.String(self.checker_command)

960

1217

self.checker_command = value

961

# Emit D-Bus signal

962

self.PropertyChanged(dbus.String(u"checker"),

963

dbus.String(self.checker_command,

964

variant_level=1))

965

1218

966

# checker_running - property

967

@dbus_service_property(_interface, signature=u"b",

968

access=u"readwrite")

969

def checker_running_dbus_property(self, value=None):

1219

# CheckerRunning - property

1220

@dbus_service_property(_interface, signature="b",

1221

access="readwrite")

1222

def CheckerRunning_dbus_property(self, value=None):

970

1223

if value is None: # get

971

1224

return dbus.Boolean(self.checker is not None)

972

1225

if value:

974

1227

else:

975

1228

self.stop_checker()

976

1229

977

# object_path - property

978

@dbus_service_property(_interface, signature=u"o", access=u"read")

979

def object_path_dbus_property(self):

1230

# ObjectPath - property

1231

@dbus_service_property(_interface, signature="o", access="read")

1232

def ObjectPath_dbus_property(self):

980

1233

return self.dbus_object_path # is already a dbus.ObjectPath

981

1234

982

# secret = property

983

@dbus_service_property(_interface, signature=u"ay",

984

access=u"write", byte_arrays=True)

985

def secret_dbus_property(self, value):

1235

# Secret = property

1236

@dbus_service_property(_interface, signature="ay",

1237

access="write", byte_arrays=True)

1238

def Secret_dbus_property(self, value):

986

1239

self.secret = str(value)

987

1240

988

1241

del _interface

989

1242

990

1243

1244

class ProxyClient(object):

1245

def __init__(self, child_pipe, fpr, address):

1246

self._pipe = child_pipe

1247

self._pipe.send(('init', fpr, address))

1248

if not self._pipe.recv():

1249

raise KeyError()

1250

1251

def __getattribute__(self, name):

1252

if(name == '_pipe'):

1253

return super(ProxyClient, self).__getattribute__(name)

1254

self._pipe.send(('getattr', name))

1255

data = self._pipe.recv()

1256

if data[0] == 'data':

1257

return data[1]

1258

if data[0] == 'function':

1259

def func(*args, **kwargs):

1260

self._pipe.send(('funcall', name, args, kwargs))

1261

return self._pipe.recv()[1]

1262

return func

1263

1264

def __setattr__(self, name, value):

1265

if(name == '_pipe'):

1266

return super(ProxyClient, self).__setattr__(name, value)

1267

self._pipe.send(('setattr', name, value))

1268

1269

class ClientDBusTransitional(ClientDBus):

1270

__metaclass__ = AlternateDBusNamesMetaclass

1271

991

1272

class ClientHandler(socketserver.BaseRequestHandler, object):

992

1273

"""A class to handle client connections.

993

1274

995

1276

Note: This will run in its own forked process."""

996

1277

997

1278

def handle(self):

998

logger.info(u"TCP connection from: %s",

999

unicode(self.client_address))

1000

logger.debug(u"IPC Pipe FD: %d",

1001

self.server.child_pipe[1].fileno())

1002

# Open IPC pipe to parent process

1003

with contextlib.nested(self.server.child_pipe[1],

1004

self.server.parent_pipe[0]

1005

) as (ipc, ipc_return):

1279

with contextlib.closing(self.server.child_pipe) as child_pipe:

1280

logger.info("TCP connection from: %s",

1281

unicode(self.client_address))

1282

logger.debug("Pipe FD: %d",

1283

self.server.child_pipe.fileno())

1284

1006

1285

session = (gnutls.connection

1007

1286

.ClientSession(self.request,

1008

1287

gnutls.connection

1013

1292

# no X.509 keys are added to it. Therefore, we can use it

1014

1293

# here despite using OpenPGP certificates.

1015

1294

1016

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1017

# u"+AES-256-CBC", u"+SHA1",

1018

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1019

# u"+DHE-DSS"))

1295

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1296

# "+AES-256-CBC", "+SHA1",

1297

# "+COMP-NULL", "+CTYPE-OPENPGP",

1298

# "+DHE-DSS"))

1020

1299

# Use a fallback default, since this MUST be set.

1021

1300

priority = self.server.gnutls_priority

1022

1301

if priority is None:

1023

priority = u"NORMAL"

1302

priority = "NORMAL"

1024

1303

(gnutls.library.functions

1025

1304

.gnutls_priority_set_direct(session._c_object,

1026

1305

priority, None))

1028

1307

# Start communication using the Mandos protocol

1029

1308

# Get protocol number

1030

1309

line = self.request.makefile().readline()

1031

logger.debug(u"Protocol version: %r", line)

1310

logger.debug("Protocol version: %r", line)

1032

1311

try:

1033

1312

if int(line.strip().split()[0]) > 1:

1034

1313

raise RuntimeError

1035

except (ValueError, IndexError, RuntimeError), error:

1036

logger.error(u"Unknown protocol version: %s", error)

1314

except (ValueError, IndexError, RuntimeError) as error:

1315

logger.error("Unknown protocol version: %s", error)

1037

1316

return

1038

1317

1039

1318

# Start GnuTLS connection

1040

1319

try:

1041

1320

session.handshake()

1042

except gnutls.errors.GNUTLSError, error:

1043

logger.warning(u"Handshake failed: %s", error)

1321

except gnutls.errors.GNUTLSError as error:

1322

logger.warning("Handshake failed: %s", error)

1044

1323

# Do not run session.bye() here: the session is not

1045

1324

# established. Just abandon the request.

1046

1325

return

1047

logger.debug(u"Handshake succeeded")

1326

logger.debug("Handshake succeeded")

1327

1328

approval_required = False

1048

1329

try:

1049

1330

try:

1050

1331

fpr = self.fingerprint(self.peer_certificate

1051

1332

(session))

1052

except (TypeError, gnutls.errors.GNUTLSError), error:

1053

logger.warning(u"Bad certificate: %s", error)

1054

return

1055

logger.debug(u"Fingerprint: %s", fpr)

1056

1057

for c in self.server.clients:

1058

if c.fingerprint == fpr:

1059

client = c

1333

except (TypeError,

1334

gnutls.errors.GNUTLSError) as error:

1335

logger.warning("Bad certificate: %s", error)

1336

return

1337

logger.debug("Fingerprint: %s", fpr)

1338

1339

try:

1340

client = ProxyClient(child_pipe, fpr,

1341

self.client_address)

1342

except KeyError:

1343

return

1344

1345

if client.approval_delay:

1346

delay = client.approval_delay

1347

client.approvals_pending += 1

1348

approval_required = True

1349

1350

while True:

1351

if not client.enabled:

1352

logger.info("Client %s is disabled",

1353

client.name)

1354

if self.server.use_dbus:

1355

# Emit D-Bus signal

1356

client.Rejected("Disabled")

1357

return

1358

1359

if client._approved or not client.approval_delay:

1360

#We are approved or approval is disabled

1060

1361

break

1061

else:

1062

ipc.write(u"NOTFOUND %s %s\n"

1063

% (fpr, unicode(self.client_address)))

1064

return

1065

1066

class ClientProxy(object):

1067

"""Client proxy object. Not for calling methods."""

1068

def __init__(self, client):

1069

self.client = client

1070

def __getattr__(self, name):

1071

if name.startswith("ipc_"):

1072

def tempfunc():

1073

ipc.write("%s %s\n" % (name[4:].upper(),

1074

self.client.name))

1075

return tempfunc

1076

if not hasattr(self.client, name):

1077

raise AttributeError

1078

ipc.write(u"GETATTR %s %s\n"

1079

% (name, self.client.fingerprint))

1080

return pickle.load(ipc_return)

1081

clientproxy = ClientProxy(client)

1082

# Have to check if client.enabled, since it is

1083

# possible that the client was disabled since the

1084

# GnuTLS session was established.

1085

if not clientproxy.enabled:

1086

clientproxy.ipc_disabled()

1087

return

1088

1089

clientproxy.ipc_sending()

1362

elif client._approved is None:

1363

logger.info("Client %s needs approval",

1364

client.name)

1365

if self.server.use_dbus:

1366

# Emit D-Bus signal

1367

client.NeedApproval(

1368

client.approval_delay_milliseconds(),

1369

client.approved_by_default)

1370

else:

1371

logger.warning("Client %s was not approved",

1372

client.name)

1373

if self.server.use_dbus:

1374

# Emit D-Bus signal

1375

client.Rejected("Denied")

1376

return

1377

1378

#wait until timeout or approved

1379

#x = float(client._timedelta_to_milliseconds(delay))

1380

time = datetime.datetime.now()

1381

client.changedstate.acquire()

1382

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1383

client.changedstate.release()

1384

time2 = datetime.datetime.now()

1385

if (time2 - time) >= delay:

1386

if not client.approved_by_default:

1387

logger.warning("Client %s timed out while"

1388

" waiting for approval",

1389

client.name)

1390

if self.server.use_dbus:

1391

# Emit D-Bus signal

1392

client.Rejected("Approval timed out")

1393

return

1394

else:

1395

break

1396

else:

1397

delay -= time2 - time

1398

1090

1399

sent_size = 0

1091

1400

while sent_size < len(client.secret):

1092

sent = session.send(client.secret[sent_size:])

1093

logger.debug(u"Sent: %d, remaining: %d",

1401

try:

1402

sent = session.send(client.secret[sent_size:])

1403

except gnutls.errors.GNUTLSError as error:

1404

logger.warning("gnutls send failed")

1405

return

1406

logger.debug("Sent: %d, remaining: %d",

1094

1407

sent, len(client.secret)

1095

1408

- (sent_size + sent))

1096

1409

sent_size += sent

1410

1411

logger.info("Sending secret to %s", client.name)

1412

# bump the timeout as if seen

1413

client.checked_ok(client.extended_timeout)

1414

if self.server.use_dbus:

1415

# Emit D-Bus signal

1416

client.GotSecret()

1417

1097

1418

finally:

1098

session.bye()

1419

if approval_required:

1420

client.approvals_pending -= 1

1421

try:

1422

session.bye()

1423

except gnutls.errors.GNUTLSError as error:

1424

logger.warning("GnuTLS bye failed")

1099

1425

1100

1426

@staticmethod

1101

1427

def peer_certificate(session):

1111

1437

.gnutls_certificate_get_peers

1112

1438

(session._c_object, ctypes.byref(list_size)))

1113

1439

if not bool(cert_list) and list_size.value != 0:

1114

raise gnutls.errors.GNUTLSError(u"error getting peer"

1115

u" certificate")

1440

raise gnutls.errors.GNUTLSError("error getting peer"

1441

" certificate")

1116

1442

if list_size.value == 0:

1117

1443

return None

1118

1444

cert = cert_list[0]

1144

1470

if crtverify.value != 0:

1145

1471

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1146

1472

raise (gnutls.errors.CertificateSecurityError

1147

(u"Verify failed"))

1473

("Verify failed"))

1148

1474

# New buffer for the fingerprint

1149

1475

buf = ctypes.create_string_buffer(20)

1150

1476

buf_len = ctypes.c_size_t()

1157

1483

# Convert the buffer to a Python bytestring

1158

1484

fpr = ctypes.string_at(buf, buf_len.value)

1159

1485

# Convert the bytestring to hexadecimal notation

1160

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1486

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1161

1487

return hex_fpr

1162

1488

1163

1489

1164

class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):

1165

"""Like socketserver.ForkingMixIn, but also pass a pipe pair."""

1490

class MultiprocessingMixIn(object):

1491

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1492

def sub_process_main(self, request, address):

1493

try:

1494

self.finish_request(request, address)

1495

except:

1496

self.handle_error(request, address)

1497

self.close_request(request)

1498

1499

def process_request(self, request, address):

1500

"""Start a new process to process the request."""

1501

multiprocessing.Process(target = self.sub_process_main,

1502

args = (request, address)).start()

1503

1504

1505

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1506

""" adds a pipe to the MixIn """

1166

1507

def process_request(self, request, client_address):

1167

1508

"""Overrides and wraps the original process_request().

1168

1509

1169

1510

This function creates a new pipe in self.pipe

1170

1511

"""

1171

# Child writes to child_pipe

1172

self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))

1173

# Parent writes to parent_pipe

1174

self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))

1175

super(ForkingMixInWithPipes,

1512

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1513

1514

super(MultiprocessingMixInWithPipe,

1176

1515

self).process_request(request, client_address)

1177

# Close unused ends for parent

1178

self.parent_pipe[0].close() # close read end

1179

self.child_pipe[1].close() # close write end

1180

self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])

1181

def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):

1516

self.child_pipe.close()

1517

self.add_pipe(parent_pipe)

1518

1519

def add_pipe(self, parent_pipe):

1182

1520

"""Dummy function; override as necessary"""

1183

child_pipe_fd.close()

1184

parent_pipe_fd.close()

1185

1186

1187

class IPv6_TCPServer(ForkingMixInWithPipes,

1521

raise NotImplementedError

1522

1523

1524

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1188

1525

socketserver.TCPServer, object):

1189

1526

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1190

1527

1206

1543

bind to an address or port if they were not specified."""

1207

1544

if self.interface is not None:

1208

1545

if SO_BINDTODEVICE is None:

1209

logger.error(u"SO_BINDTODEVICE does not exist;"

1210

u" cannot bind to interface %s",

1546

logger.error("SO_BINDTODEVICE does not exist;"

1547

" cannot bind to interface %s",

1211

1548

self.interface)

1212

1549

else:

1213

1550

try:

1214

1551

self.socket.setsockopt(socket.SOL_SOCKET,

1215

1552

SO_BINDTODEVICE,

1216

1553

str(self.interface

1217

+ u'\0'))

1218

except socket.error, error:

1554

+ '\0'))

1555

except socket.error as error:

1219

1556

if error[0] == errno.EPERM:

1220

logger.error(u"No permission to"

1221

u" bind to interface %s",

1557

logger.error("No permission to"

1558

" bind to interface %s",

1222

1559

self.interface)

1223

1560

elif error[0] == errno.ENOPROTOOPT:

1224

logger.error(u"SO_BINDTODEVICE not available;"

1225

u" cannot bind to interface %s",

1561

logger.error("SO_BINDTODEVICE not available;"

1562

" cannot bind to interface %s",

1226

1563

self.interface)

1227

1564

else:

1228

1565

raise

1230

1567

if self.server_address[0] or self.server_address[1]:

1231

1568

if not self.server_address[0]:

1232

1569

if self.address_family == socket.AF_INET6:

1233

any_address = u"::" # in6addr_any

1570

any_address = "::" # in6addr_any

1234

1571

else:

1235

1572

any_address = socket.INADDR_ANY

1236

1573

self.server_address = (any_address,

1275

1612

return socketserver.TCPServer.server_activate(self)

1276

1613

def enable(self):

1277

1614

self.enabled = True

1278

def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):

1615

def add_pipe(self, parent_pipe):

1279

1616

# Call "handle_ipc" for both data and EOF events

1280

gobject.io_add_watch(child_pipe_fd.fileno(),

1617

gobject.io_add_watch(parent_pipe.fileno(),

1281

1618

gobject.IO_IN | gobject.IO_HUP,

1282

1619

functools.partial(self.handle_ipc,

1283

reply = parent_pipe_fd,

1284

sender= child_pipe_fd))

1285

def handle_ipc(self, source, condition, reply=None, sender=None):

1620

parent_pipe = parent_pipe))

1621

1622

def handle_ipc(self, source, condition, parent_pipe=None,

1623

client_object=None):

1286

1624

condition_names = {

1287

gobject.IO_IN: u"IN", # There is data to read.

1288

gobject.IO_OUT: u"OUT", # Data can be written (without

1625

gobject.IO_IN: "IN", # There is data to read.

1626

gobject.IO_OUT: "OUT", # Data can be written (without

1289

1627

# blocking).

1290

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1291

gobject.IO_ERR: u"ERR", # Error condition.

1292

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1628

gobject.IO_PRI: "PRI", # There is urgent data to read.

1629

gobject.IO_ERR: "ERR", # Error condition.

1630

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1293

1631

# broken, usually for pipes and

1294

1632

# sockets).

1295

1633

}

1297

1635

for cond, name in

1298

1636

condition_names.iteritems()

1299

1637

if cond & condition)

1300

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1301

conditions_string)

1302

1303

# Read a line from the file object

1304

cmdline = sender.readline()

1305

if not cmdline: # Empty line means end of file

1306

# close the IPC pipes

1307

sender.close()

1308

reply.close()

1309

1310

# Stop calling this function

1311

return False

1312

1313

logger.debug(u"IPC command: %r", cmdline)

1314

1315

# Parse and act on command

1316

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1317

1318

if cmd == u"NOTFOUND":

1319

fpr, address = args.split(None, 1)

1320

logger.warning(u"Client not found for fingerprint: %s, ad"

1321

u"dress: %s", fpr, address)

1322

if self.use_dbus:

1323

# Emit D-Bus signal

1324

mandos_dbus_service.ClientNotFound(fpr, address)

1325

elif cmd == u"DISABLED":

1326

for client in self.clients:

1327

if client.name == args:

1328

logger.warning(u"Client %s is disabled", args)

1329

if self.use_dbus:

1330

# Emit D-Bus signal

1331

client.Rejected()

1332

break

1333

else:

1334

logger.error(u"Unknown client %s is disabled", args)

1335

elif cmd == u"SENDING":

1336

for client in self.clients:

1337

if client.name == args:

1338

logger.info(u"Sending secret to %s", client.name)

1339

client.checked_ok()

1340

if self.use_dbus:

1341

# Emit D-Bus signal

1342

client.GotSecret()

1343

break

1344

else:

1345

logger.error(u"Sending secret to unknown client %s",

1346

args)

1347

elif cmd == u"GETATTR":

1348

attr_name, fpr = args.split(None, 1)

1349

for client in self.clients:

1350

if client.fingerprint == fpr:

1351

attr_value = getattr(client, attr_name, None)

1352

logger.debug("IPC reply: %r", attr_value)

1353

pickle.dump(attr_value, reply)

1354

break

1355

else:

1356

logger.error(u"Client %s on address %s requesting "

1357

u"attribute %s not found", fpr, address,

1358

attr_name)

1359

pickle.dump(None, reply)

1360

else:

1361

logger.error(u"Unknown IPC command: %r", cmdline)

1362

1363

# Keep calling this function

1638

# error or the other end of multiprocessing.Pipe has closed

1639

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1640

return False

1641

1642

# Read a request from the child

1643

request = parent_pipe.recv()

1644

command = request[0]

1645

1646

if command == 'init':

1647

fpr = request[1]

1648

address = request[2]

1649

1650

for c in self.clients:

1651

if c.fingerprint == fpr:

1652

client = c

1653

break

1654

else:

1655

logger.info("Client not found for fingerprint: %s, ad"

1656

"dress: %s", fpr, address)

1657

if self.use_dbus:

1658

# Emit D-Bus signal

1659

mandos_dbus_service.ClientNotFound(fpr, address[0])

1660

parent_pipe.send(False)

1661

return False

1662

1663

gobject.io_add_watch(parent_pipe.fileno(),

1664

gobject.IO_IN | gobject.IO_HUP,

1665

functools.partial(self.handle_ipc,

1666

parent_pipe = parent_pipe,

1667

client_object = client))

1668

parent_pipe.send(True)

1669

# remove the old hook in favor of the new above hook on same fileno

1670

return False

1671

if command == 'funcall':

1672

funcname = request[1]

1673

args = request[2]

1674

kwargs = request[3]

1675

1676

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1677

1678

if command == 'getattr':

1679

attrname = request[1]

1680

if callable(client_object.__getattribute__(attrname)):

1681

parent_pipe.send(('function',))

1682

else:

1683

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1684

1685

if command == 'setattr':

1686

attrname = request[1]

1687

value = request[2]

1688

setattr(client_object, attrname, value)

1689

1364

1690

return True

1365

1691

1366

1692

1367

1693

def string_to_delta(interval):

1368

1694

"""Parse a string and return a datetime.timedelta

1369

1695

1370

>>> string_to_delta(u'7d')

1696

>>> string_to_delta('7d')

1371

1697

datetime.timedelta(7)

1372

>>> string_to_delta(u'60s')

1698

>>> string_to_delta('60s')

1373

1699

datetime.timedelta(0, 60)

1374

>>> string_to_delta(u'60m')

1700

>>> string_to_delta('60m')

1375

1701

datetime.timedelta(0, 3600)

1376

>>> string_to_delta(u'24h')

1702

>>> string_to_delta('24h')

1377

1703

datetime.timedelta(1)

1378

>>> string_to_delta(u'1w')

1704

>>> string_to_delta('1w')

1379

1705

datetime.timedelta(7)

1380

>>> string_to_delta(u'5m 30s')

1706

>>> string_to_delta('5m 30s')

1381

1707

datetime.timedelta(0, 330)

1382

1708

"""

1383

1709

timevalue = datetime.timedelta(0)

1385

1711

try:

1386

1712

suffix = unicode(s[-1])

1387

1713

value = int(s[:-1])

1388

if suffix == u"d":

1714

if suffix == "d":

1389

1715

delta = datetime.timedelta(value)

1390

elif suffix == u"s":

1716

elif suffix == "s":

1391

1717

delta = datetime.timedelta(0, value)

1392

elif suffix == u"m":

1718

elif suffix == "m":

1393

1719

delta = datetime.timedelta(0, 0, 0, 0, value)

1394

elif suffix == u"h":

1720

elif suffix == "h":

1395

1721

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1396

elif suffix == u"w":

1722

elif suffix == "w":

1397

1723

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1398

1724

else:

1399

raise ValueError(u"Unknown suffix %r" % suffix)

1400

except (ValueError, IndexError), e:

1401

raise ValueError(e.message)

1725

raise ValueError("Unknown suffix %r" % suffix)

1726

except (ValueError, IndexError) as e:

1727

raise ValueError(*(e.args))

1402

1728

timevalue += delta

1403

1729

return timevalue

1404

1730

1410

1736

global if_nametoindex

1411

1737

try:

1412

1738

if_nametoindex = (ctypes.cdll.LoadLibrary

1413

(ctypes.util.find_library(u"c"))

1739

(ctypes.util.find_library("c"))

1414

1740

.if_nametoindex)

1415

1741

except (OSError, AttributeError):

1416

logger.warning(u"Doing if_nametoindex the hard way")

1742

logger.warning("Doing if_nametoindex the hard way")

1417

1743

def if_nametoindex(interface):

1418

1744

"Get an interface index the hard way, i.e. using fcntl()"

1419

1745

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1420

1746

with contextlib.closing(socket.socket()) as s:

1421

1747

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1422

struct.pack(str(u"16s16x"),

1748

struct.pack(str("16s16x"),

1423

1749

interface))

1424

interface_index = struct.unpack(str(u"I"),

1750

interface_index = struct.unpack(str("I"),

1425

1751

ifreq[16:20])[0]

1426

1752

return interface_index

1427

1753

return if_nametoindex(interface)

1435

1761

sys.exit()

1436

1762

os.setsid()

1437

1763

if not nochdir:

1438

os.chdir(u"/")

1764

os.chdir("/")

1439

1765

if os.fork():

1440

1766

sys.exit()

1441

1767

if not noclose:

1443

1769

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1444

1770

if not stat.S_ISCHR(os.fstat(null).st_mode):

1445

1771

raise OSError(errno.ENODEV,

1446

u"%s not a character device"

1772

"%s not a character device"

1447

1773

% os.path.devnull)

1448

1774

os.dup2(null, sys.stdin.fileno())

1449

1775

os.dup2(null, sys.stdout.fileno())

1457

1783

##################################################################

1458

1784

# Parsing of options, both command line and config file

1459

1785

1460

parser = optparse.OptionParser(version = "%%prog %s" % version)

1461

parser.add_option("-i", u"--interface", type=u"string",

1462

metavar="IF", help=u"Bind to interface IF")

1463

parser.add_option("-a", u"--address", type=u"string",

1464

help=u"Address to listen for requests on")

1465

parser.add_option("-p", u"--port", type=u"int",

1466

help=u"Port number to receive requests on")

1467

parser.add_option("--check", action=u"store_true",

1468

help=u"Run self-test")

1469

parser.add_option("--debug", action=u"store_true",

1470

help=u"Debug mode; run in foreground and log to"

1471

u" terminal")

1472

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1473

u" priority string (see GnuTLS documentation)")

1474

parser.add_option("--servicename", type=u"string",

1475

metavar=u"NAME", help=u"Zeroconf service name")

1476

parser.add_option("--configdir", type=u"string",

1477

default=u"/etc/mandos", metavar=u"DIR",

1478

help=u"Directory to search for configuration"

1479

u" files")

1480

parser.add_option("--no-dbus", action=u"store_false",

1481

dest=u"use_dbus", help=u"Do not provide D-Bus"

1482

u" system bus interface")

1483

parser.add_option("--no-ipv6", action=u"store_false",

1484

dest=u"use_ipv6", help=u"Do not use IPv6")

1485

options = parser.parse_args()[0]

1786

parser = argparse.ArgumentParser()

1787

parser.add_argument("-v", "--version", action="version",

1788

version = "%%(prog)s %s" % version,

1789

help="show version number and exit")

1790

parser.add_argument("-i", "--interface", metavar="IF",

1791

help="Bind to interface IF")

1792

parser.add_argument("-a", "--address",

1793

help="Address to listen for requests on")

1794

parser.add_argument("-p", "--port", type=int,

1795

help="Port number to receive requests on")

1796

parser.add_argument("--check", action="store_true",

1797

help="Run self-test")

1798

parser.add_argument("--debug", action="store_true",

1799

help="Debug mode; run in foreground and log"

1800

" to terminal")

1801

parser.add_argument("--debuglevel", metavar="LEVEL",

1802

help="Debug level for stdout output")

1803

parser.add_argument("--priority", help="GnuTLS"

1804

" priority string (see GnuTLS documentation)")

1805

parser.add_argument("--servicename",

1806

metavar="NAME", help="Zeroconf service name")

1807

parser.add_argument("--configdir",

1808

default="/etc/mandos", metavar="DIR",

1809

help="Directory to search for configuration"

1810

" files")

1811

parser.add_argument("--no-dbus", action="store_false",

1812

dest="use_dbus", help="Do not provide D-Bus"

1813

" system bus interface")

1814

parser.add_argument("--no-ipv6", action="store_false",

1815

dest="use_ipv6", help="Do not use IPv6")

1816

options = parser.parse_args()

1486

1817

1487

1818

if options.check:

1488

1819

import doctest

1490

1821

sys.exit()

1491

1822

1492

1823

# Default values for config file for server-global settings

1493

server_defaults = { u"interface": u"",

1494

u"address": u"",

1495

u"port": u"",

1496

u"debug": u"False",

1497

u"priority":

1498

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1499

u"servicename": u"Mandos",

1500

u"use_dbus": u"True",

1501

u"use_ipv6": u"True",

1824

server_defaults = { "interface": "",

1825

"address": "",

1826

"port": "",

1827

"debug": "False",

1828

"priority":

1829

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1830

"servicename": "Mandos",

1831

"use_dbus": "True",

1832

"use_ipv6": "True",

1833

"debuglevel": "",

1502

1834

}

1503

1835

1504

1836

# Parse config file for server-global settings

1505

1837

server_config = configparser.SafeConfigParser(server_defaults)

1506

1838

del server_defaults

1507

1839

server_config.read(os.path.join(options.configdir,

1508

u"mandos.conf"))

1840

"mandos.conf"))

1509

1841

# Convert the SafeConfigParser object to a dict

1510

1842

server_settings = server_config.defaults()

1511

1843

# Use the appropriate methods on the non-string config options

1512

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1513

server_settings[option] = server_config.getboolean(u"DEFAULT",

1844

for option in ("debug", "use_dbus", "use_ipv6"):

1845

server_settings[option] = server_config.getboolean("DEFAULT",

1514

1846

option)

1515

1847

if server_settings["port"]:

1516

server_settings["port"] = server_config.getint(u"DEFAULT",

1517

u"port")

1848

server_settings["port"] = server_config.getint("DEFAULT",

1849

"port")

1518

1850

del server_config

1519

1851

1520

1852

# Override the settings from the config file with command line

1521

1853

# options, if set.

1522

for option in (u"interface", u"address", u"port", u"debug",

1523

u"priority", u"servicename", u"configdir",

1524

u"use_dbus", u"use_ipv6"):

1854

for option in ("interface", "address", "port", "debug",

1855

"priority", "servicename", "configdir",

1856

"use_dbus", "use_ipv6", "debuglevel"):

1525

1857

value = getattr(options, option)

1526

1858

if value is not None:

1527

1859

server_settings[option] = value

1535

1867

##################################################################

1536

1868

1537

1869

# For convenience

1538

debug = server_settings[u"debug"]

1539

use_dbus = server_settings[u"use_dbus"]

1540

use_ipv6 = server_settings[u"use_ipv6"]

1541

1542

if not debug:

1543

syslogger.setLevel(logging.WARNING)

1544

console.setLevel(logging.WARNING)

1545

1546

if server_settings[u"servicename"] != u"Mandos":

1870

debug = server_settings["debug"]

1871

debuglevel = server_settings["debuglevel"]

1872

use_dbus = server_settings["use_dbus"]

1873

use_ipv6 = server_settings["use_ipv6"]

1874

1875

if server_settings["servicename"] != "Mandos":

1547

1876

syslogger.setFormatter(logging.Formatter

1548

(u'Mandos (%s) [%%(process)d]:'

1549

u' %%(levelname)s: %%(message)s'

1550

% server_settings[u"servicename"]))

1877

('Mandos (%s) [%%(process)d]:'

1878

' %%(levelname)s: %%(message)s'

1879

% server_settings["servicename"]))

1551

1880

1552

1881

# Parse config file with clients

1553

client_defaults = { u"timeout": u"1h",

1554

u"interval": u"5m",

1555

u"checker": u"fping -q -- %%(host)s",

1556

u"host": u"",

1882

client_defaults = { "timeout": "5m",

1883

"extended_timeout": "15m",

1884

"interval": "2m",

1885

"checker": "fping -q -- %%(host)s",

1886

"host": "",

1887

"approval_delay": "0s",

1888

"approval_duration": "1s",

1557

1889

}

1558

1890

client_config = configparser.SafeConfigParser(client_defaults)

1559

client_config.read(os.path.join(server_settings[u"configdir"],

1560

u"clients.conf"))

1891

client_config.read(os.path.join(server_settings["configdir"],

1892

"clients.conf"))

1561

1893

1562

1894

global mandos_dbus_service

1563

1895

mandos_dbus_service = None

1564

1896

1565

tcp_server = MandosServer((server_settings[u"address"],

1566

server_settings[u"port"]),

1897

tcp_server = MandosServer((server_settings["address"],

1898

server_settings["port"]),

1567

1899

ClientHandler,

1568

interface=(server_settings[u"interface"]

1900

interface=(server_settings["interface"]

1569

1901

or None),

1570

1902

use_ipv6=use_ipv6,

1571

1903

gnutls_priority=

1572

server_settings[u"priority"],

1904

server_settings["priority"],

1573

1905

use_dbus=use_dbus)

1574

pidfilename = u"/var/run/mandos.pid"

1575

try:

1576

pidfile = open(pidfilename, u"w")

1577

except IOError:

1578

logger.error(u"Could not open file %r", pidfilename)

1906

if not debug:

1907

pidfilename = "/var/run/mandos.pid"

1908

try:

1909

pidfile = open(pidfilename, "w")

1910

except IOError:

1911

logger.error("Could not open file %r", pidfilename)

1579

1912

1580

1913

try:

1581

uid = pwd.getpwnam(u"_mandos").pw_uid

1582

gid = pwd.getpwnam(u"_mandos").pw_gid

1914

uid = pwd.getpwnam("_mandos").pw_uid

1915

gid = pwd.getpwnam("_mandos").pw_gid

1583

1916

except KeyError:

1584

1917

try:

1585

uid = pwd.getpwnam(u"mandos").pw_uid

1586

gid = pwd.getpwnam(u"mandos").pw_gid

1918

uid = pwd.getpwnam("mandos").pw_uid

1919

gid = pwd.getpwnam("mandos").pw_gid

1587

1920

except KeyError:

1588

1921

try:

1589

uid = pwd.getpwnam(u"nobody").pw_uid

1590

gid = pwd.getpwnam(u"nobody").pw_gid

1922

uid = pwd.getpwnam("nobody").pw_uid

1923

gid = pwd.getpwnam("nobody").pw_gid

1591

1924

except KeyError:

1592

1925

uid = 65534

1593

1926

gid = 65534

1594

1927

try:

1595

1928

os.setgid(gid)

1596

1929

os.setuid(uid)

1597

except OSError, error:

1930

except OSError as error:

1598

1931

if error[0] != errno.EPERM:

1599

1932

raise error

1600

1933

1601

# Enable all possible GnuTLS debugging

1934

if not debug and not debuglevel:

1935

syslogger.setLevel(logging.WARNING)

1936

console.setLevel(logging.WARNING)

1937

if debuglevel:

1938

level = getattr(logging, debuglevel.upper())

1939

syslogger.setLevel(level)

1940

console.setLevel(level)

1941

1602

1942

if debug:

1943

# Enable all possible GnuTLS debugging

1944

1603

1945

# "Use a log level over 10 to enable all debugging options."

1604

1946

# - GnuTLS manual

1605

1947

gnutls.library.functions.gnutls_global_set_log_level(11)

1606

1948

1607

1949

@gnutls.library.types.gnutls_log_func

1608

1950

def debug_gnutls(level, string):

1609

logger.debug(u"GnuTLS: %s", string[:-1])

1951

logger.debug("GnuTLS: %s", string[:-1])

1610

1952

1611

1953

(gnutls.library.functions

1612

1954

.gnutls_global_set_log_function(debug_gnutls))

1955

1956

# Redirect stdin so all checkers get /dev/null

1957

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1958

os.dup2(null, sys.stdin.fileno())

1959

if null > 2:

1960

os.close(null)

1961

else:

1962

# No console logging

1963

logger.removeHandler(console)

1964

1965

# Need to fork before connecting to D-Bus

1966

if not debug:

1967

# Close all input and output, do double fork, etc.

1968

daemon()

1613

1969

1614

1970

global main_loop

1615

1971

# From the Avahi example code

1619

1975

# End of Avahi example code

1620

1976

if use_dbus:

1621

1977

try:

1622

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1978

bus_name = dbus.service.BusName("se.recompile.Mandos",

1623

1979

bus, do_not_queue=True)

1624

except dbus.exceptions.NameExistsException, e:

1625

logger.error(unicode(e) + u", disabling D-Bus")

1980

old_bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1981

bus, do_not_queue=True)

1982

except dbus.exceptions.NameExistsException as e:

1983

logger.error(unicode(e) + ", disabling D-Bus")

1626

1984

use_dbus = False

1627

server_settings[u"use_dbus"] = False

1985

server_settings["use_dbus"] = False

1628

1986

tcp_server.use_dbus = False

1629

1987

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1630

service = AvahiService(name = server_settings[u"servicename"],

1631

servicetype = u"_mandos._tcp",

1988

service = AvahiService(name = server_settings["servicename"],

1989

servicetype = "_mandos._tcp",

1632

1990

protocol = protocol, bus = bus)

1633

1991

if server_settings["interface"]:

1634

1992

service.interface = (if_nametoindex

1635

(str(server_settings[u"interface"])))

1993

(str(server_settings["interface"])))

1994

1995

global multiprocessing_manager

1996

multiprocessing_manager = multiprocessing.Manager()

1636

1997

1637

1998

client_class = Client

1638

1999

if use_dbus:

1639

client_class = functools.partial(ClientDBus, bus = bus)

2000

client_class = functools.partial(ClientDBusTransitional, bus = bus)

2001

def client_config_items(config, section):

2002

special_settings = {

2003

"approved_by_default":

2004

lambda: config.getboolean(section,

2005

"approved_by_default"),

2006

}

2007

for name, value in config.items(section):

2008

try:

2009

yield (name, special_settings[name]())

2010

except KeyError:

2011

yield (name, value)

2012

1640

2013

tcp_server.clients.update(set(

1641

2014

client_class(name = section,

1642

config= dict(client_config.items(section)))

2015

config= dict(client_config_items(

2016

client_config, section)))

1643

2017

for section in client_config.sections()))

1644

2018

if not tcp_server.clients:

1645

logger.warning(u"No clients defined")

1646

1647

if debug:

1648

# Redirect stdin so all checkers get /dev/null

1649

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1650

os.dup2(null, sys.stdin.fileno())

1651

if null > 2:

1652

os.close(null)

1653

else:

1654

# No console logging

1655

logger.removeHandler(console)

1656

# Close all input and output, do double fork, etc.

1657

daemon()

1658

1659

try:

1660

with pidfile:

1661

pid = os.getpid()

1662

pidfile.write(str(pid) + "\n")

1663

del pidfile

1664

except IOError:

1665

logger.error(u"Could not write to file %r with PID %d",

1666

pidfilename, pid)

1667

except NameError:

1668

# "pidfile" was never created

1669

pass

1670

del pidfilename

1671

2019

logger.warning("No clients defined")

2020

1672

2021

if not debug:

2022

try:

2023

with pidfile:

2024

pid = os.getpid()

2025

pidfile.write(str(pid) + "\n".encode("utf-8"))

2026

del pidfile

2027

except IOError:

2028

logger.error("Could not write to file %r with PID %d",

2029

pidfilename, pid)

2030

except NameError:

2031

# "pidfile" was never created

2032

pass

2033

del pidfilename

2034

1673

2035

signal.signal(signal.SIGINT, signal.SIG_IGN)

2036

1674

2037

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1675

2038

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1676

2039

1678

2041

class MandosDBusService(dbus.service.Object):

1679

2042

"""A D-Bus proxy object"""

1680

2043

def __init__(self):

1681

dbus.service.Object.__init__(self, bus, u"/")

1682

_interface = u"se.bsnet.fukt.Mandos"

2044

dbus.service.Object.__init__(self, bus, "/")

2045

_interface = "se.recompile.Mandos"

1683

2046

1684

@dbus.service.signal(_interface, signature=u"o")

2047

@dbus.service.signal(_interface, signature="o")

1685

2048

def ClientAdded(self, objpath):

1686

2049

"D-Bus signal"

1687

2050

pass

1688

2051

1689

@dbus.service.signal(_interface, signature=u"ss")

2052

@dbus.service.signal(_interface, signature="ss")

1690

2053

def ClientNotFound(self, fingerprint, address):

1691

2054

"D-Bus signal"

1692

2055

pass

1693

2056

1694

@dbus.service.signal(_interface, signature=u"os")

2057

@dbus.service.signal(_interface, signature="os")

1695

2058

def ClientRemoved(self, objpath, name):

1696

2059

"D-Bus signal"

1697

2060

pass

1698

2061

1699

@dbus.service.method(_interface, out_signature=u"ao")

2062

@dbus.service.method(_interface, out_signature="ao")

1700

2063

def GetAllClients(self):

1701

2064

"D-Bus method"

1702

2065

return dbus.Array(c.dbus_object_path

1703

2066

for c in tcp_server.clients)

1704

2067

1705

2068

@dbus.service.method(_interface,

1706

out_signature=u"a{oa{sv}}")

2069

out_signature="a{oa{sv}}")

1707

2070

def GetAllClientsWithProperties(self):

1708

2071

"D-Bus method"

1709

2072

return dbus.Dictionary(

1710

((c.dbus_object_path, c.GetAll(u""))

2073

((c.dbus_object_path, c.GetAll(""))

1711

2074

for c in tcp_server.clients),

1712

signature=u"oa{sv}")

2075

signature="oa{sv}")

1713

2076

1714

@dbus.service.method(_interface, in_signature=u"o")

2077

@dbus.service.method(_interface, in_signature="o")

1715

2078

def RemoveClient(self, object_path):

1716

2079

"D-Bus method"

1717

2080

for c in tcp_server.clients:

1727

2090

1728

2091

del _interface

1729

2092

1730

mandos_dbus_service = MandosDBusService()

2093

class MandosDBusServiceTransitional(MandosDBusService):

2094

__metaclass__ = AlternateDBusNamesMetaclass

2095

mandos_dbus_service = MandosDBusServiceTransitional()

1731

2096

1732

2097

def cleanup():

1733

2098

"Cleanup function; run on exit"

1759

2124

# Find out what port we got

1760

2125

service.port = tcp_server.socket.getsockname()[1]

1761

2126

if use_ipv6:

1762

logger.info(u"Now listening on address %r, port %d,"

2127

logger.info("Now listening on address %r, port %d,"

1763

2128

" flowinfo %d, scope_id %d"

1764

2129

% tcp_server.socket.getsockname())

1765

2130

else: # IPv4

1766

logger.info(u"Now listening on address %r, port %d"

2131

logger.info("Now listening on address %r, port %d"

1767

2132

% tcp_server.socket.getsockname())

1768

2133

1769

2134

#service.interface = tcp_server.socket.getsockname()[3]

1772

2137

# From the Avahi example code

1773

2138

try:

1774

2139

service.activate()

1775

except dbus.exceptions.DBusException, error:

1776

logger.critical(u"DBusException: %s", error)

2140

except dbus.exceptions.DBusException as error:

2141

logger.critical("DBusException: %s", error)

1777

2142

cleanup()

1778

2143

sys.exit(1)

1779

2144

# End of Avahi example code

1783

2148

(tcp_server.handle_request

1784

2149

(*args[2:], **kwargs) or True))

1785

2150

1786

logger.debug(u"Starting main loop")

2151

logger.debug("Starting main loop")

1787

2152

main_loop.run()

1788

except AvahiError, error:

1789

logger.critical(u"AvahiError: %s", error)

2153

except AvahiError as error:

2154

logger.critical("AvahiError: %s", error)

1790

2155

cleanup()

1791

2156

sys.exit(1)

1792

2157

except KeyboardInterrupt:

1793

2158

if debug:

1794

print >> sys.stderr

1795

logger.debug(u"Server received KeyboardInterrupt")

1796

logger.debug(u"Server exiting")

2159

print("", file=sys.stderr)

2160

logger.debug("Server received KeyboardInterrupt")

2161

logger.debug("Server exiting")

1797

2162

# Must run before the D-Bus bus name gets deregistered

1798

2163

cleanup()

1799

2164

2165

1800

2166

if __name__ == '__main__':

1801

2167

main()