/mandos/release : revision 237.11.4

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

61

62

import functools

62

63

import cPickle as pickle

63

64

import multiprocessing

65

import types

64

66

65

67

import dbus

66

68

import dbus.service

81

83

SO_BINDTODEVICE = None

82

84

83

85

84

version = "1.2"

86

version = "1.3.1"

85

87

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

88

90

syslogger = (logging.handlers.SysLogHandler

89

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

90

address = "/dev/log"))

92

address = str("/dev/log")))

91

93

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

94

96

logger.addHandler(syslogger)

95

97

96

98

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

100

102

logger.addHandler(console)

101

103

102

104

class AvahiError(Exception):

119

121

Attributes:

120

122

interface: integer; avahi.IF_UNSPEC or an interface index.

121

123

Used to optionally bind to the specified interface.

122

name: string; Example: u'Mandos'

123

type: string; Example: u'_mandos._tcp'.

124

name: string; Example: 'Mandos'

125

type: string; Example: '_mandos._tcp'.

124

126

See <http://www.dns-sd.org/ServiceTypes.html>

125

127

port: integer; what port to announce

126

128

TXT: list of strings; TXT record for the service

135

137

"""

136

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

137

139

servicetype = None, port = None, TXT = None,

138

domain = u"", host = u"", max_renames = 32768,

140

domain = "", host = "", max_renames = 32768,

139

141

protocol = avahi.PROTO_UNSPEC, bus = None):

140

142

self.interface = interface

141

143

self.name = name

150

152

self.group = None # our entry group

151

153

self.server = None

152

154

self.bus = bus

155

self.entry_group_state_changed_match = None

153

156

def rename(self):

154

157

"""Derived from the Avahi example code"""

155

158

if self.rename_count >= self.max_renames:

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

158

161

self.rename_count)

159

raise AvahiServiceError(u"Too many renames")

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server

164

.GetAlternativeServiceName(self.name))

165

logger.info("Changing Zeroconf service name to %r ...",

162

166

self.name)

163

167

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

166

170

% self.name))

167

171

self.remove()

168

172

try:

169

173

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

174

except dbus.exceptions.DBusException as error:

175

logger.critical("DBusException: %s", error)

172

176

self.cleanup()

173

177

os._exit(1)

174

178

self.rename_count += 1

175

179

def remove(self):

176

180

"""Derived from the Avahi example code"""

181

if self.entry_group_state_changed_match is not None:

182

self.entry_group_state_changed_match.remove()

183

self.entry_group_state_changed_match = None

177

184

if self.group is not None:

178

185

self.group.Reset()

179

186

def add(self):

180

187

"""Derived from the Avahi example code"""

188

self.remove()

181

189

if self.group is None:

182

190

self.group = dbus.Interface(

183

191

self.bus.get_object(avahi.DBUS_NAME,

184

192

self.server.EntryGroupNew()),

185

193

avahi.DBUS_INTERFACE_ENTRY_GROUP)

186

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

194

self.entry_group_state_changed_match = (

195

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

190

198

self.name, self.type)

191

199

self.group.AddService(

192

200

self.interface,

199

207

self.group.Commit()

200

208

def entry_group_state_changed(self, state, error):

201

209

"""Derived from the Avahi example code"""

202

logger.debug(u"Avahi entry group state change: %i", state)

210

logger.debug("Avahi entry group state change: %i", state)

203

211

204

212

if state == avahi.ENTRY_GROUP_ESTABLISHED:

205

logger.debug(u"Zeroconf service established.")

213

logger.debug("Zeroconf service established.")

206

214

elif state == avahi.ENTRY_GROUP_COLLISION:

207

logger.warning(u"Zeroconf service name collision.")

215

logger.info("Zeroconf service name collision.")

208

216

self.rename()

209

217

elif state == avahi.ENTRY_GROUP_FAILURE:

210

logger.critical(u"Avahi: Error in group state changed %s",

218

logger.critical("Avahi: Error in group state changed %s",

211

219

unicode(error))

212

raise AvahiGroupError(u"State changed: %s"

220

raise AvahiGroupError("State changed: %s"

213

221

% unicode(error))

214

222

def cleanup(self):

215

223

"""Derived from the Avahi example code"""

216

224

if self.group is not None:

217

self.group.Free()

225

try:

226

self.group.Free()

227

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

229

pass

218

230

self.group = None

219

def server_state_changed(self, state):

231

self.remove()

232

def server_state_changed(self, state, error=None):

220

233

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

222

if state == avahi.SERVER_COLLISION:

223

logger.error(u"Zeroconf server name collision")

224

self.remove()

234

logger.debug("Avahi server state change: %i", state)

235

bad_states = { avahi.SERVER_INVALID:

236

"Zeroconf server invalid",

237

avahi.SERVER_REGISTERING: None,

238

avahi.SERVER_COLLISION:

239

"Zeroconf server name collision",

240

avahi.SERVER_FAILURE:

241

"Zeroconf server failure" }

242

if state in bad_states:

243

if bad_states[state] is not None:

244

if error is None:

245

logger.error(bad_states[state])

246

else:

247

logger.error(bad_states[state] + ": %r", error)

248

self.cleanup()

225

249

elif state == avahi.SERVER_RUNNING:

226

250

self.add()

251

else:

252

if error is None:

253

logger.debug("Unknown state: %r", state)

254

else:

255

logger.debug("Unknown state: %r: %r", state, error)

227

256

def activate(self):

228

257

"""Derived from the Avahi example code"""

229

258

if self.server is None:

230

259

self.server = dbus.Interface(

231

260

self.bus.get_object(avahi.DBUS_NAME,

232

avahi.DBUS_PATH_SERVER),

261

avahi.DBUS_PATH_SERVER,

262

follow_name_owner_changes=True),

233

263

avahi.DBUS_INTERFACE_SERVER)

234

self.server.connect_to_signal(u"StateChanged",

264

self.server.connect_to_signal("StateChanged",

235

265

self.server_state_changed)

236

266

self.server_state_changed(self.server.GetState())

237

267

238

268

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

274

239

275

class Client(object):

240

276

"""A representation of a client host served by this server.

241

277

269

305

secret: bytestring; sent verbatim (over TLS) to client

270

306

timeout: datetime.timedelta(); How long from last_checked_ok

271

307

until this client is disabled

308

extended_timeout: extra long timeout when password has been sent

272

309

runtime_expansions: Allowed attributes for runtime expansion.

310

expires: datetime.datetime(); time (UTC) when a client will be

311

disabled, or None

273

312

"""

274

313

275

runtime_expansions = (u"approval_delay", u"approval_duration",

276

u"created", u"enabled", u"fingerprint",

277

u"host", u"interval", u"last_checked_ok",

278

u"last_enabled", u"name", u"timeout")

279

280

@staticmethod

281

def _timedelta_to_milliseconds(td):

282

"Convert a datetime.timedelta() to milliseconds"

283

return ((td.days * 24 * 60 * 60 * 1000)

284

+ (td.seconds * 1000)

285

+ (td.microseconds // 1000))

314

runtime_expansions = ("approval_delay", "approval_duration",

315

"created", "enabled", "fingerprint",

316

"host", "interval", "last_checked_ok",

317

"last_enabled", "name", "timeout")

286

318

287

319

def timeout_milliseconds(self):

288

320

"Return the 'timeout' attribute in milliseconds"

289

return self._timedelta_to_milliseconds(self.timeout)

321

return _timedelta_to_milliseconds(self.timeout)

322

323

def extended_timeout_milliseconds(self):

324

"Return the 'extended_timeout' attribute in milliseconds"

325

return _timedelta_to_milliseconds(self.extended_timeout)

290

326

291

327

def interval_milliseconds(self):

292

328

"Return the 'interval' attribute in milliseconds"

293

return self._timedelta_to_milliseconds(self.interval)

294

329

return _timedelta_to_milliseconds(self.interval)

330

295

331

def approval_delay_milliseconds(self):

296

return self._timedelta_to_milliseconds(self.approval_delay)

332

return _timedelta_to_milliseconds(self.approval_delay)

297

333

298

334

def __init__(self, name = None, disable_hook=None, config=None):

299

335

"""Note: the 'checker' key in 'config' sets the

302

338

self.name = name

303

339

if config is None:

304

340

config = {}

305

logger.debug(u"Creating client %r", self.name)

341

logger.debug("Creating client %r", self.name)

306

342

# Uppercase and remove spaces from fingerprint for later

307

343

# comparison purposes with return value from the fingerprint()

308

344

# function

309

self.fingerprint = (config[u"fingerprint"].upper()

310

.replace(u" ", u""))

311

logger.debug(u" Fingerprint: %s", self.fingerprint)

312

if u"secret" in config:

313

self.secret = config[u"secret"].decode(u"base64")

314

elif u"secfile" in config:

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

347

logger.debug(" Fingerprint: %s", self.fingerprint)

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

315

351

with open(os.path.expanduser(os.path.expandvars

316

(config[u"secfile"])),

352

(config["secfile"])),

317

353

"rb") as secfile:

318

354

self.secret = secfile.read()

319

355

else:

320

raise TypeError(u"No secret or secfile for client %s"

356

raise TypeError("No secret or secfile for client %s"

321

357

% self.name)

322

self.host = config.get(u"host", u"")

358

self.host = config.get("host", "")

323

359

self.created = datetime.datetime.utcnow()

324

360

self.enabled = False

325

361

self.last_approval_request = None

326

362

self.last_enabled = None

327

363

self.last_checked_ok = None

328

self.timeout = string_to_delta(config[u"timeout"])

329

self.interval = string_to_delta(config[u"interval"])

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

330

368

self.disable_hook = disable_hook

331

369

self.checker = None

332

370

self.checker_initiator_tag = None

333

371

self.disable_initiator_tag = None

372

self.expires = None

334

373

self.checker_callback_tag = None

335

self.checker_command = config[u"checker"]

374

self.checker_command = config["checker"]

336

375

self.current_checker_command = None

337

376

self.last_connect = None

338

377

self._approved = None

339

self.approved_by_default = config.get(u"approved_by_default",

378

self.approved_by_default = config.get("approved_by_default",

340

379

True)

341

380

self.approvals_pending = 0

342

381

self.approval_delay = string_to_delta(

343

config[u"approval_delay"])

382

config["approval_delay"])

344

383

self.approval_duration = string_to_delta(

345

config[u"approval_duration"])

346

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

384

config["approval_duration"])

385

self.changedstate = (multiprocessing_manager

386

.Condition(multiprocessing_manager

387

.Lock()))

347

388

348

389

def send_changedstate(self):

349

390

self.changedstate.acquire()

350

391

self.changedstate.notify_all()

351

392

self.changedstate.release()

352

393

353

394

def enable(self):

354

395

"""Start this client's checker and timeout hooks"""

355

if getattr(self, u"enabled", False):

396

if getattr(self, "enabled", False):

356

397

# Already enabled

357

398

return

358

399

self.send_changedstate()

359

self.last_enabled = datetime.datetime.utcnow()

360

400

# Schedule a new checker to be started an 'interval' from now,

361

401

# and every interval from then on.

362

402

self.checker_initiator_tag = (gobject.timeout_add

363

403

(self.interval_milliseconds(),

364

404

self.start_checker))

365

405

# Schedule a disable() when 'timeout' has passed

406

self.expires = datetime.datetime.utcnow() + self.timeout

366

407

self.disable_initiator_tag = (gobject.timeout_add

367

408

(self.timeout_milliseconds(),

368

409

self.disable))

369

410

self.enabled = True

411

self.last_enabled = datetime.datetime.utcnow()

370

412

# Also start a new checker *right now*.

371

413

self.start_checker()

372

414

377

419

if not quiet:

378

420

self.send_changedstate()

379

421

if not quiet:

380

logger.info(u"Disabling client %s", self.name)

381

if getattr(self, u"disable_initiator_tag", False):

422

logger.info("Disabling client %s", self.name)

423

if getattr(self, "disable_initiator_tag", False):

382

424

gobject.source_remove(self.disable_initiator_tag)

383

425

self.disable_initiator_tag = None

384

if getattr(self, u"checker_initiator_tag", False):

426

self.expires = None

427

if getattr(self, "checker_initiator_tag", False):

385

428

gobject.source_remove(self.checker_initiator_tag)

386

429

self.checker_initiator_tag = None

387

430

self.stop_checker()

402

445

if os.WIFEXITED(condition):

403

446

exitstatus = os.WEXITSTATUS(condition)

404

447

if exitstatus == 0:

405

logger.info(u"Checker for %(name)s succeeded",

448

logger.info("Checker for %(name)s succeeded",

406

449

vars(self))

407

450

self.checked_ok()

408

451

else:

409

logger.info(u"Checker for %(name)s failed",

452

logger.info("Checker for %(name)s failed",

410

453

vars(self))

411

454

else:

412

logger.warning(u"Checker for %(name)s crashed?",

455

logger.warning("Checker for %(name)s crashed?",

413

456

vars(self))

414

457

415

def checked_ok(self):

458

def checked_ok(self, timeout=None):

416

459

"""Bump up the timeout for this client.

417

460

418

461

This should only be called when the client has been seen,

419

462

alive and well.

420

463

"""

464

if timeout is None:

465

timeout = self.timeout

421

466

self.last_checked_ok = datetime.datetime.utcnow()

422

467

gobject.source_remove(self.disable_initiator_tag)

468

self.expires = datetime.datetime.utcnow() + timeout

423

469

self.disable_initiator_tag = (gobject.timeout_add

424

(self.timeout_milliseconds(),

425

self.disable))

470

(_timedelta_to_milliseconds

471

(timeout), self.disable))

426

472

427

473

def need_approval(self):

428

474

self.last_approval_request = datetime.datetime.utcnow()

444

490

# If a checker exists, make sure it is not a zombie

445

491

try:

446

492

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

447

except (AttributeError, OSError), error:

493

except (AttributeError, OSError) as error:

448

494

if (isinstance(error, OSError)

449

495

and error.errno != errno.ECHILD):

450

496

raise error

451

497

else:

452

498

if pid:

453

logger.warning(u"Checker was a zombie")

499

logger.warning("Checker was a zombie")

454

500

gobject.source_remove(self.checker_callback_tag)

455

501

self.checker_callback(pid, status,

456

502

self.current_checker_command)

463

509

# Escape attributes for the shell

464

510

escaped_attrs = dict(

465

511

(attr,

466

re.escape(unicode(str(getattr(self, attr, u"")),

512

re.escape(unicode(str(getattr(self, attr, "")),

467

513

errors=

468

u'replace')))

514

'replace')))

469

515

for attr in

470

516

self.runtime_expansions)

471

517

472

518

try:

473

519

command = self.checker_command % escaped_attrs

474

except TypeError, error:

475

logger.error(u'Could not format string "%s":'

476

u' %s', self.checker_command, error)

520

except TypeError as error:

521

logger.error('Could not format string "%s":'

522

' %s', self.checker_command, error)

477

523

return True # Try again later

478

524

self.current_checker_command = command

479

525

try:

480

logger.info(u"Starting checker %r for %s",

526

logger.info("Starting checker %r for %s",

481

527

command, self.name)

482

528

# We don't need to redirect stdout and stderr, since

483

529

# in normal mode, that is already done by daemon(),

485

531

# always replaced by /dev/null.)

486

532

self.checker = subprocess.Popen(command,

487

533

close_fds=True,

488

shell=True, cwd=u"/")

534

shell=True, cwd="/")

489

535

self.checker_callback_tag = (gobject.child_watch_add

490

536

(self.checker.pid,

491

537

self.checker_callback,

496

542

if pid:

497

543

gobject.source_remove(self.checker_callback_tag)

498

544

self.checker_callback(pid, status, command)

499

except OSError, error:

500

logger.error(u"Failed to start subprocess: %s",

545

except OSError as error:

546

logger.error("Failed to start subprocess: %s",

501

547

error)

502

548

# Re-run this periodically if run by gobject.timeout_add

503

549

return True

507

553

if self.checker_callback_tag:

508

554

gobject.source_remove(self.checker_callback_tag)

509

555

self.checker_callback_tag = None

510

if getattr(self, u"checker", None) is None:

556

if getattr(self, "checker", None) is None:

511

557

return

512

logger.debug(u"Stopping checker for %(name)s", vars(self))

558

logger.debug("Stopping checker for %(name)s", vars(self))

513

559

try:

514

560

os.kill(self.checker.pid, signal.SIGTERM)

515

561

#time.sleep(0.5)

516

562

#if self.checker.poll() is None:

517

563

# os.kill(self.checker.pid, signal.SIGKILL)

518

except OSError, error:

564

except OSError as error:

519

565

if error.errno != errno.ESRCH: # No such process

520

566

raise

521

567

self.checker = None

522

568

523

def dbus_service_property(dbus_interface, signature=u"v",

524

access=u"readwrite", byte_arrays=False):

569

570

def dbus_service_property(dbus_interface, signature="v",

571

access="readwrite", byte_arrays=False):

525

572

"""Decorators for marking methods of a DBusObjectWithProperties to

526

573

become properties on the D-Bus.

527

574

534

581

"""

535

582

# Encoding deeply encoded byte arrays is not supported yet by the

536

583

# "Set" method, so we fail early here:

537

if byte_arrays and signature != u"ay":

538

raise ValueError(u"Byte arrays not supported for non-'ay'"

539

u" signature %r" % signature)

584

if byte_arrays and signature != "ay":

585

raise ValueError("Byte arrays not supported for non-'ay'"

586

" signature %r" % signature)

540

587

def decorator(func):

541

588

func._dbus_is_property = True

542

589

func._dbus_interface = dbus_interface

543

590

func._dbus_signature = signature

544

591

func._dbus_access = access

545

592

func._dbus_name = func.__name__

546

if func._dbus_name.endswith(u"_dbus_property"):

593

if func._dbus_name.endswith("_dbus_property"):

547

594

func._dbus_name = func._dbus_name[:-14]

548

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

595

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

549

596

return func

550

597

return decorator

551

598

571

618

572

619

class DBusObjectWithProperties(dbus.service.Object):

573

620

"""A D-Bus object with properties.

574

621

575

622

Classes inheriting from this can use the dbus_service_property

576

623

decorator to expose methods as D-Bus properties. It exposes the

577

624

standard Get(), Set(), and GetAll() methods on the D-Bus.

579

626

580

627

@staticmethod

581

628

def _is_dbus_property(obj):

582

return getattr(obj, u"_dbus_is_property", False)

629

return getattr(obj, "_dbus_is_property", False)

583

630

584

631

def _get_all_dbus_properties(self):

585

632

"""Returns a generator of (name, attribute) pairs

586

633

"""

587

return ((prop._dbus_name, prop)

634

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

635

for cls in self.__class__.__mro__

588

636

for name, prop in

589

inspect.getmembers(self, self._is_dbus_property))

637

inspect.getmembers(cls, self._is_dbus_property))

590

638

591

639

def _get_dbus_property(self, interface_name, property_name):

592

640

"""Returns a bound method if one exists which is a D-Bus

593

641

property with the specified name and interface.

594

642

"""

595

for name in (property_name,

596

property_name + u"_dbus_property"):

597

prop = getattr(self, name, None)

598

if (prop is None

599

or not self._is_dbus_property(prop)

600

or prop._dbus_name != property_name

601

or (interface_name and prop._dbus_interface

602

and interface_name != prop._dbus_interface)):

603

continue

604

return prop

643

for cls in self.__class__.__mro__:

644

for name, value in (inspect.getmembers

645

(cls, self._is_dbus_property)):

646

if (value._dbus_name == property_name

647

and value._dbus_interface == interface_name):

648

return value.__get__(self)

649

605

650

# No such property

606

raise DBusPropertyNotFound(self.dbus_object_path + u":"

607

+ interface_name + u"."

651

raise DBusPropertyNotFound(self.dbus_object_path + ":"

652

+ interface_name + "."

608

653

+ property_name)

609

654

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

611

out_signature=u"v")

655

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

656

out_signature="v")

612

657

def Get(self, interface_name, property_name):

613

658

"""Standard D-Bus property Get() method, see D-Bus standard.

614

659

"""

615

660

prop = self._get_dbus_property(interface_name, property_name)

616

if prop._dbus_access == u"write":

661

if prop._dbus_access == "write":

617

662

raise DBusPropertyAccessException(property_name)

618

663

value = prop()

619

if not hasattr(value, u"variant_level"):

664

if not hasattr(value, "variant_level"):

620

665

return value

621

666

return type(value)(value, variant_level=value.variant_level+1)

622

667

623

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

668

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

624

669

def Set(self, interface_name, property_name, value):

625

670

"""Standard D-Bus property Set() method, see D-Bus standard.

626

671

"""

627

672

prop = self._get_dbus_property(interface_name, property_name)

628

if prop._dbus_access == u"read":

673

if prop._dbus_access == "read":

629

674

raise DBusPropertyAccessException(property_name)

630

if prop._dbus_get_args_options[u"byte_arrays"]:

675

if prop._dbus_get_args_options["byte_arrays"]:

631

676

# The byte_arrays option is not supported yet on

632

677

# signatures other than "ay".

633

if prop._dbus_signature != u"ay":

678

if prop._dbus_signature != "ay":

634

679

raise ValueError

635

680

value = dbus.ByteArray(''.join(unichr(byte)

636

681

for byte in value))

637

682

prop(value)

638

683

639

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

640

out_signature=u"a{sv}")

684

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

685

out_signature="a{sv}")

641

686

def GetAll(self, interface_name):

642

687

"""Standard D-Bus property GetAll() method, see D-Bus

643

688

standard.

644

689

645

690

Note: Will not include properties with access="write".

646

691

"""

647

692

all = {}

651

696

# Interface non-empty but did not match

652

697

continue

653

698

# Ignore write-only properties

654

if prop._dbus_access == u"write":

699

if prop._dbus_access == "write":

655

700

continue

656

701

value = prop()

657

if not hasattr(value, u"variant_level"):

702

if not hasattr(value, "variant_level"):

658

703

all[name] = value

659

704

continue

660

705

all[name] = type(value)(value, variant_level=

661

706

value.variant_level+1)

662

return dbus.Dictionary(all, signature=u"sv")

707

return dbus.Dictionary(all, signature="sv")

663

708

664

709

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

665

out_signature=u"s",

710

out_signature="s",

666

711

path_keyword='object_path',

667

712

connection_keyword='connection')

668

713

def Introspect(self, object_path, connection):

673

718

try:

674

719

document = xml.dom.minidom.parseString(xmlstring)

675

720

def make_tag(document, name, prop):

676

e = document.createElement(u"property")

677

e.setAttribute(u"name", name)

678

e.setAttribute(u"type", prop._dbus_signature)

679

e.setAttribute(u"access", prop._dbus_access)

721

e = document.createElement("property")

722

e.setAttribute("name", name)

723

e.setAttribute("type", prop._dbus_signature)

724

e.setAttribute("access", prop._dbus_access)

680

725

return e

681

for if_tag in document.getElementsByTagName(u"interface"):

726

for if_tag in document.getElementsByTagName("interface"):

682

727

for tag in (make_tag(document, name, prop)

683

728

for name, prop

684

729

in self._get_all_dbus_properties()

685

730

if prop._dbus_interface

686

== if_tag.getAttribute(u"name")):

731

== if_tag.getAttribute("name")):

687

732

if_tag.appendChild(tag)

688

733

# Add the names to the return values for the

689

734

# "org.freedesktop.DBus.Properties" methods

690

if (if_tag.getAttribute(u"name")

691

== u"org.freedesktop.DBus.Properties"):

692

for cn in if_tag.getElementsByTagName(u"method"):

693

if cn.getAttribute(u"name") == u"Get":

694

for arg in cn.getElementsByTagName(u"arg"):

695

if (arg.getAttribute(u"direction")

696

== u"out"):

697

arg.setAttribute(u"name", u"value")

698

elif cn.getAttribute(u"name") == u"GetAll":

699

for arg in cn.getElementsByTagName(u"arg"):

700

if (arg.getAttribute(u"direction")

701

== u"out"):

702

arg.setAttribute(u"name", u"props")

703

xmlstring = document.toxml(u"utf-8")

735

if (if_tag.getAttribute("name")

736

== "org.freedesktop.DBus.Properties"):

737

for cn in if_tag.getElementsByTagName("method"):

738

if cn.getAttribute("name") == "Get":

739

for arg in cn.getElementsByTagName("arg"):

740

if (arg.getAttribute("direction")

741

== "out"):

742

arg.setAttribute("name", "value")

743

elif cn.getAttribute("name") == "GetAll":

744

for arg in cn.getElementsByTagName("arg"):

745

if (arg.getAttribute("direction")

746

== "out"):

747

arg.setAttribute("name", "props")

748

xmlstring = document.toxml("utf-8")

704

749

document.unlink()

705

750

except (AttributeError, xml.dom.DOMException,

706

xml.parsers.expat.ExpatError), error:

707

logger.error(u"Failed to override Introspection method",

751

xml.parsers.expat.ExpatError) as error:

752

logger.error("Failed to override Introspection method",

708

753

error)

709

754

return xmlstring

710

755

711

756

757

def datetime_to_dbus (dt, variant_level=0):

758

"""Convert a UTC datetime.datetime() to a D-Bus type."""

759

if dt is None:

760

return dbus.String("", variant_level = variant_level)

761

return dbus.String(dt.isoformat(),

762

variant_level=variant_level)

763

764

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

765

.__metaclass__):

766

"""Applied to an empty subclass of a D-Bus object, this metaclass

767

will add additional D-Bus attributes matching a certain pattern.

768

"""

769

def __new__(mcs, name, bases, attr):

770

# Go through all the base classes which could have D-Bus

771

# methods, signals, or properties in them

772

for base in (b for b in bases

773

if issubclass(b, dbus.service.Object)):

774

# Go though all attributes of the base class

775

for attrname, attribute in inspect.getmembers(base):

776

# Ignore non-D-Bus attributes, and D-Bus attributes

777

# with the wrong interface name

778

if (not hasattr(attribute, "_dbus_interface")

779

or not attribute._dbus_interface

780

.startswith("se.recompile.Mandos")):

781

continue

782

# Create an alternate D-Bus interface name based on

783

# the current name

784

alt_interface = (attribute._dbus_interface

785

.replace("se.recompile.Mandos",

786

"se.bsnet.fukt.Mandos"))

787

# Is this a D-Bus signal?

788

if getattr(attribute, "_dbus_is_signal", False):

789

# Extract the original non-method function by

790

# black magic

791

nonmethod_func = (dict(

792

zip(attribute.func_code.co_freevars,

793

attribute.__closure__))["func"]

794

.cell_contents)

795

# Create a new, but exactly alike, function

796

# object, and decorate it to be a new D-Bus signal

797

# with the alternate D-Bus interface name

798

new_function = (dbus.service.signal

799

(alt_interface,

800

attribute._dbus_signature)

801

(types.FunctionType(

802

nonmethod_func.func_code,

803

nonmethod_func.func_globals,

804

nonmethod_func.func_name,

805

nonmethod_func.func_defaults,

806

nonmethod_func.func_closure)))

807

# Define a creator of a function to call both the

808

# old and new functions, so both the old and new

809

# signals gets sent when the function is called

810

def fixscope(func1, func2):

811

"""This function is a scope container to pass

812

func1 and func2 to the "call_both" function

813

outside of its arguments"""

814

def call_both(*args, **kwargs):

815

"""This function will emit two D-Bus

816

signals by calling func1 and func2"""

817

func1(*args, **kwargs)

818

func2(*args, **kwargs)

819

return call_both

820

# Create the "call_both" function and add it to

821

# the class

822

attr[attrname] = fixscope(attribute,

823

new_function)

824

# Is this a D-Bus method?

825

elif getattr(attribute, "_dbus_is_method", False):

826

# Create a new, but exactly alike, function

827

# object. Decorate it to be a new D-Bus method

828

# with the alternate D-Bus interface name. Add it

829

# to the class.

830

attr[attrname] = (dbus.service.method

831

(alt_interface,

832

attribute._dbus_in_signature,

833

attribute._dbus_out_signature)

834

(types.FunctionType

835

(attribute.func_code,

836

attribute.func_globals,

837

attribute.func_name,

838

attribute.func_defaults,

839

attribute.func_closure)))

840

# Is this a D-Bus property?

841

elif getattr(attribute, "_dbus_is_property", False):

842

# Create a new, but exactly alike, function

843

# object, and decorate it to be a new D-Bus

844

# property with the alternate D-Bus interface

845

# name. Add it to the class.

846

attr[attrname] = (dbus_service_property

847

(alt_interface,

848

attribute._dbus_signature,

849

attribute._dbus_access,

850

attribute

851

._dbus_get_args_options

852

["byte_arrays"])

853

(types.FunctionType

854

(attribute.func_code,

855

attribute.func_globals,

856

attribute.func_name,

857

attribute.func_defaults,

858

attribute.func_closure)))

859

return type.__new__(mcs, name, bases, attr)

860

712

861

class ClientDBus(Client, DBusObjectWithProperties):

713

862

"""A Client class using D-Bus

714

863

718

867

"""

719

868

720

869

runtime_expansions = (Client.runtime_expansions

721

+ (u"dbus_object_path",))

870

+ ("dbus_object_path",))

722

871

723

872

# dbus.service.Object doesn't use super(), so we can't either.

724

873

729

878

# Only now, when this client is initialized, can it show up on

730

879

# the D-Bus

731

880

client_object_name = unicode(self.name).translate(

732

{ord(u"."): ord(u"_"),

733

ord(u"-"): ord(u"_")})

881

{ord("."): ord("_"),

882

ord("-"): ord("_")})

734

883

self.dbus_object_path = (dbus.ObjectPath

735

(u"/clients/" + client_object_name))

884

("/clients/" + client_object_name))

736

885

DBusObjectWithProperties.__init__(self, self.bus,

737

886

self.dbus_object_path)

738

887

739

def _get_approvals_pending(self):

740

return self._approvals_pending

741

def _set_approvals_pending(self, value):

742

old_value = self._approvals_pending

743

self._approvals_pending = value

744

bval = bool(value)

745

if (hasattr(self, "dbus_object_path")

746

and bval is not bool(old_value)):

747

dbus_bool = dbus.Boolean(bval, variant_level=1)

748

self.PropertyChanged(dbus.String(u"ApprovalPending"),

749

dbus_bool)

888

def notifychangeproperty(transform_func,

889

dbus_name, type_func=lambda x: x,

890

variant_level=1):

891

""" Modify a variable so that it's a property which announces

892

its changes to DBus.

750

893

751

approvals_pending = property(_get_approvals_pending,

752

_set_approvals_pending)

753

del _get_approvals_pending, _set_approvals_pending

754

755

@staticmethod

756

def _datetime_to_dbus(dt, variant_level=0):

757

"""Convert a UTC datetime.datetime() to a D-Bus type."""

758

return dbus.String(dt.isoformat(),

759

variant_level=variant_level)

760

761

def enable(self):

762

oldstate = getattr(self, u"enabled", False)

763

r = Client.enable(self)

764

if oldstate != self.enabled:

765

# Emit D-Bus signals

766

self.PropertyChanged(dbus.String(u"Enabled"),

767

dbus.Boolean(True, variant_level=1))

768

self.PropertyChanged(

769

dbus.String(u"LastEnabled"),

770

self._datetime_to_dbus(self.last_enabled,

771

variant_level=1))

772

return r

773

774

def disable(self, quiet = False):

775

oldstate = getattr(self, u"enabled", False)

776

r = Client.disable(self, quiet=quiet)

777

if not quiet and oldstate != self.enabled:

778

# Emit D-Bus signal

779

self.PropertyChanged(dbus.String(u"Enabled"),

780

dbus.Boolean(False, variant_level=1))

781

return r

894

transform_fun: Function that takes a value and transforms it

895

to a D-Bus type.

896

dbus_name: D-Bus name of the variable

897

type_func: Function that transform the value before sending it

898

to the D-Bus. Default: no transform

899

variant_level: D-Bus variant level. Default: 1

900

"""

901

real_value = [None,]

902

def setter(self, value):

903

old_value = real_value[0]

904

real_value[0] = value

905

if hasattr(self, "dbus_object_path"):

906

if type_func(old_value) != type_func(real_value[0]):

907

dbus_value = transform_func(type_func

908

(real_value[0]),

909

variant_level)

910

self.PropertyChanged(dbus.String(dbus_name),

911

dbus_value)

912

913

return property(lambda self: real_value[0], setter)

914

915

916

expires = notifychangeproperty(datetime_to_dbus, "Expires")

917

approvals_pending = notifychangeproperty(dbus.Boolean,

918

"ApprovalPending",

919

type_func = bool)

920

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

921

last_enabled = notifychangeproperty(datetime_to_dbus,

922

"LastEnabled")

923

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

924

type_func = lambda checker:

925

checker is not None)

926

last_checked_ok = notifychangeproperty(datetime_to_dbus,

927

"LastCheckedOK")

928

last_approval_request = notifychangeproperty(

929

datetime_to_dbus, "LastApprovalRequest")

930

approved_by_default = notifychangeproperty(dbus.Boolean,

931

"ApprovedByDefault")

932

approval_delay = notifychangeproperty(dbus.UInt16,

933

"ApprovalDelay",

934

type_func =

935

_timedelta_to_milliseconds)

936

approval_duration = notifychangeproperty(

937

dbus.UInt16, "ApprovalDuration",

938

type_func = _timedelta_to_milliseconds)

939

host = notifychangeproperty(dbus.String, "Host")

940

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

941

type_func =

942

_timedelta_to_milliseconds)

943

extended_timeout = notifychangeproperty(

944

dbus.UInt16, "ExtendedTimeout",

945

type_func = _timedelta_to_milliseconds)

946

interval = notifychangeproperty(dbus.UInt16,

947

"Interval",

948

type_func =

949

_timedelta_to_milliseconds)

950

checker_command = notifychangeproperty(dbus.String, "Checker")

951

952

del notifychangeproperty

782

953

783

954

def __del__(self, *args, **kwargs):

784

955

try:

785

956

self.remove_from_connection()

786

957

except LookupError:

787

958

pass

788

if hasattr(DBusObjectWithProperties, u"__del__"):

959

if hasattr(DBusObjectWithProperties, "__del__"):

789

960

DBusObjectWithProperties.__del__(self, *args, **kwargs)

790

961

Client.__del__(self, *args, **kwargs)

791

962

793

964

*args, **kwargs):

794

965

self.checker_callback_tag = None

795

966

self.checker = None

796

# Emit D-Bus signal

797

self.PropertyChanged(dbus.String(u"CheckerRunning"),

798

dbus.Boolean(False, variant_level=1))

799

967

if os.WIFEXITED(condition):

800

968

exitstatus = os.WEXITSTATUS(condition)

801

969

# Emit D-Bus signal

811

979

return Client.checker_callback(self, pid, condition, command,

812

980

*args, **kwargs)

813

981

814

def checked_ok(self, *args, **kwargs):

815

r = Client.checked_ok(self, *args, **kwargs)

816

# Emit D-Bus signal

817

self.PropertyChanged(

818

dbus.String(u"LastCheckedOK"),

819

(self._datetime_to_dbus(self.last_checked_ok,

820

variant_level=1)))

821

return r

822

823

def need_approval(self, *args, **kwargs):

824

r = Client.need_approval(self, *args, **kwargs)

825

# Emit D-Bus signal

826

self.PropertyChanged(

827

dbus.String(u"LastApprovalRequest"),

828

(self._datetime_to_dbus(self.last_approval_request,

829

variant_level=1)))

830

return r

831

832

982

def start_checker(self, *args, **kwargs):

833

983

old_checker = self.checker

834

984

if self.checker is not None:

841

991

and old_checker_pid != self.checker.pid):

842

992

# Emit D-Bus signal

843

993

self.CheckerStarted(self.current_checker_command)

844

self.PropertyChanged(

845

dbus.String(u"CheckerRunning"),

846

dbus.Boolean(True, variant_level=1))

847

994

return r

848

995

849

def stop_checker(self, *args, **kwargs):

850

old_checker = getattr(self, u"checker", None)

851

r = Client.stop_checker(self, *args, **kwargs)

852

if (old_checker is not None

853

and getattr(self, u"checker", None) is None):

854

self.PropertyChanged(dbus.String(u"CheckerRunning"),

855

dbus.Boolean(False, variant_level=1))

856

return r

857

858

996

def _reset_approved(self):

859

997

self._approved = None

860

998

return False

862

1000

def approve(self, value=True):

863

1001

self.send_changedstate()

864

1002

self._approved = value

865

gobject.timeout_add(self._timedelta_to_milliseconds

1003

gobject.timeout_add(_timedelta_to_milliseconds

866

1004

(self.approval_duration),

867

1005

self._reset_approved)

868

1006

869

1007

870

1008

## D-Bus methods, signals & properties

871

_interface = u"se.bsnet.fukt.Mandos.Client"

1009

_interface = "se.recompile.Mandos.Client"

872

1010

873

1011

## Signals

874

1012

875

1013

# CheckerCompleted - signal

876

@dbus.service.signal(_interface, signature=u"nxs")

1014

@dbus.service.signal(_interface, signature="nxs")

877

1015

def CheckerCompleted(self, exitcode, waitstatus, command):

878

1016

"D-Bus signal"

879

1017

pass

880

1018

881

1019

# CheckerStarted - signal

882

@dbus.service.signal(_interface, signature=u"s")

1020

@dbus.service.signal(_interface, signature="s")

883

1021

def CheckerStarted(self, command):

884

1022

"D-Bus signal"

885

1023

pass

886

1024

887

1025

# PropertyChanged - signal

888

@dbus.service.signal(_interface, signature=u"sv")

1026

@dbus.service.signal(_interface, signature="sv")

889

1027

def PropertyChanged(self, property, value):

890

1028

"D-Bus signal"

891

1029

pass

900

1038

pass

901

1039

902

1040

# Rejected - signal

903

@dbus.service.signal(_interface, signature=u"s")

1041

@dbus.service.signal(_interface, signature="s")

904

1042

def Rejected(self, reason):

905

1043

"D-Bus signal"

906

1044

pass

907

1045

908

1046

# NeedApproval - signal

909

@dbus.service.signal(_interface, signature=u"tb")

1047

@dbus.service.signal(_interface, signature="tb")

910

1048

def NeedApproval(self, timeout, default):

911

1049

"D-Bus signal"

912

1050

return self.need_approval()

914

1052

## Methods

915

1053

916

1054

# Approve - method

917

@dbus.service.method(_interface, in_signature=u"b")

1055

@dbus.service.method(_interface, in_signature="b")

918

1056

def Approve(self, value):

919

1057

self.approve(value)

920

1058

921

1059

# CheckedOK - method

922

1060

@dbus.service.method(_interface)

923

1061

def CheckedOK(self):

924

return self.checked_ok()

1062

self.checked_ok()

925

1063

926

1064

# Enable - method

927

1065

@dbus.service.method(_interface)

949

1087

## Properties

950

1088

951

1089

# ApprovalPending - property

952

@dbus_service_property(_interface, signature=u"b", access=u"read")

1090

@dbus_service_property(_interface, signature="b", access="read")

953

1091

def ApprovalPending_dbus_property(self):

954

1092

return dbus.Boolean(bool(self.approvals_pending))

955

1093

956

1094

# ApprovedByDefault - property

957

@dbus_service_property(_interface, signature=u"b",

958

access=u"readwrite")

1095

@dbus_service_property(_interface, signature="b",

1096

access="readwrite")

959

1097

def ApprovedByDefault_dbus_property(self, value=None):

960

1098

if value is None: # get

961

1099

return dbus.Boolean(self.approved_by_default)

962

1100

self.approved_by_default = bool(value)

963

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

965

dbus.Boolean(value, variant_level=1))

966

1101

967

1102

# ApprovalDelay - property

968

@dbus_service_property(_interface, signature=u"t",

969

access=u"readwrite")

1103

@dbus_service_property(_interface, signature="t",

1104

access="readwrite")

970

1105

def ApprovalDelay_dbus_property(self, value=None):

971

1106

if value is None: # get

972

1107

return dbus.UInt64(self.approval_delay_milliseconds())

973

1108

self.approval_delay = datetime.timedelta(0, 0, 0, value)

974

# Emit D-Bus signal

975

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

976

dbus.UInt64(value, variant_level=1))

977

1109

978

1110

# ApprovalDuration - property

979

@dbus_service_property(_interface, signature=u"t",

980

access=u"readwrite")

1111

@dbus_service_property(_interface, signature="t",

1112

access="readwrite")

981

1113

def ApprovalDuration_dbus_property(self, value=None):

982

1114

if value is None: # get

983

return dbus.UInt64(self._timedelta_to_milliseconds(

1115

return dbus.UInt64(_timedelta_to_milliseconds(

984

1116

self.approval_duration))

985

1117

self.approval_duration = datetime.timedelta(0, 0, 0, value)

986

# Emit D-Bus signal

987

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

988

dbus.UInt64(value, variant_level=1))

989

1118

990

1119

# Name - property

991

@dbus_service_property(_interface, signature=u"s", access=u"read")

1120

@dbus_service_property(_interface, signature="s", access="read")

992

1121

def Name_dbus_property(self):

993

1122

return dbus.String(self.name)

994

1123

995

1124

# Fingerprint - property

996

@dbus_service_property(_interface, signature=u"s", access=u"read")

1125

@dbus_service_property(_interface, signature="s", access="read")

997

1126

def Fingerprint_dbus_property(self):

998

1127

return dbus.String(self.fingerprint)

999

1128

1000

1129

# Host - property

1001

@dbus_service_property(_interface, signature=u"s",

1002

access=u"readwrite")

1130

@dbus_service_property(_interface, signature="s",

1131

access="readwrite")

1003

1132

def Host_dbus_property(self, value=None):

1004

1133

if value is None: # get

1005

1134

return dbus.String(self.host)

1006

1135

self.host = value

1007

# Emit D-Bus signal

1008

self.PropertyChanged(dbus.String(u"Host"),

1009

dbus.String(value, variant_level=1))

1010

1136

1011

1137

# Created - property

1012

@dbus_service_property(_interface, signature=u"s", access=u"read")

1138

@dbus_service_property(_interface, signature="s", access="read")

1013

1139

def Created_dbus_property(self):

1014

return dbus.String(self._datetime_to_dbus(self.created))

1140

return dbus.String(datetime_to_dbus(self.created))

1015

1141

1016

1142

# LastEnabled - property

1017

@dbus_service_property(_interface, signature=u"s", access=u"read")

1143

@dbus_service_property(_interface, signature="s", access="read")

1018

1144

def LastEnabled_dbus_property(self):

1019

if self.last_enabled is None:

1020

return dbus.String(u"")

1021

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1145

return datetime_to_dbus(self.last_enabled)

1022

1146

1023

1147

# Enabled - property

1024

@dbus_service_property(_interface, signature=u"b",

1025

access=u"readwrite")

1148

@dbus_service_property(_interface, signature="b",

1149

access="readwrite")

1026

1150

def Enabled_dbus_property(self, value=None):

1027

1151

if value is None: # get

1028

1152

return dbus.Boolean(self.enabled)

1032

1156

self.disable()

1033

1157

1034

1158

# LastCheckedOK - property

1035

@dbus_service_property(_interface, signature=u"s",

1036

access=u"readwrite")

1159

@dbus_service_property(_interface, signature="s",

1160

access="readwrite")

1037

1161

def LastCheckedOK_dbus_property(self, value=None):

1038

1162

if value is not None:

1039

1163

self.checked_ok()

1040

1164

return

1041

if self.last_checked_ok is None:

1042

return dbus.String(u"")

1043

return dbus.String(self._datetime_to_dbus(self

1044

.last_checked_ok))

1165

return datetime_to_dbus(self.last_checked_ok)

1166

1167

# Expires - property

1168

@dbus_service_property(_interface, signature="s", access="read")

1169

def Expires_dbus_property(self):

1170

return datetime_to_dbus(self.expires)

1045

1171

1046

1172

# LastApprovalRequest - property

1047

@dbus_service_property(_interface, signature=u"s", access=u"read")

1173

@dbus_service_property(_interface, signature="s", access="read")

1048

1174

def LastApprovalRequest_dbus_property(self):

1049

if self.last_approval_request is None:

1050

return dbus.String(u"")

1051

return dbus.String(self.

1052

_datetime_to_dbus(self

1053

.last_approval_request))

1175

return datetime_to_dbus(self.last_approval_request)

1054

1176

1055

1177

# Timeout - property

1056

@dbus_service_property(_interface, signature=u"t",

1057

access=u"readwrite")

1178

@dbus_service_property(_interface, signature="t",

1179

access="readwrite")

1058

1180

def Timeout_dbus_property(self, value=None):

1059

1181

if value is None: # get

1060

1182

return dbus.UInt64(self.timeout_milliseconds())

1061

1183

self.timeout = datetime.timedelta(0, 0, 0, value)

1062

# Emit D-Bus signal

1063

self.PropertyChanged(dbus.String(u"Timeout"),

1064

dbus.UInt64(value, variant_level=1))

1065

if getattr(self, u"disable_initiator_tag", None) is None:

1184

if getattr(self, "disable_initiator_tag", None) is None:

1066

1185

return

1067

1186

# Reschedule timeout

1068

1187

gobject.source_remove(self.disable_initiator_tag)

1069

1188

self.disable_initiator_tag = None

1189

self.expires = None

1070

1190

time_to_die = (self.

1071

1191

_timedelta_to_milliseconds((self

1072

1192

.last_checked_ok

1077

1197

# The timeout has passed

1078

1198

self.disable()

1079

1199

else:

1200

self.expires = (datetime.datetime.utcnow()

1201

+ datetime.timedelta(milliseconds =

1202

time_to_die))

1080

1203

self.disable_initiator_tag = (gobject.timeout_add

1081

1204

(time_to_die, self.disable))

1082

1205

1206

# ExtendedTimeout - property

1207

@dbus_service_property(_interface, signature="t",

1208

access="readwrite")

1209

def ExtendedTimeout_dbus_property(self, value=None):

1210

if value is None: # get

1211

return dbus.UInt64(self.extended_timeout_milliseconds())

1212

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1213

1083

1214

# Interval - property

1084

@dbus_service_property(_interface, signature=u"t",

1085

access=u"readwrite")

1215

@dbus_service_property(_interface, signature="t",

1216

access="readwrite")

1086

1217

def Interval_dbus_property(self, value=None):

1087

1218

if value is None: # get

1088

1219

return dbus.UInt64(self.interval_milliseconds())

1089

1220

self.interval = datetime.timedelta(0, 0, 0, value)

1090

# Emit D-Bus signal

1091

self.PropertyChanged(dbus.String(u"Interval"),

1092

dbus.UInt64(value, variant_level=1))

1093

if getattr(self, u"checker_initiator_tag", None) is None:

1221

if getattr(self, "checker_initiator_tag", None) is None:

1094

1222

return

1095

1223

# Reschedule checker run

1096

1224

gobject.source_remove(self.checker_initiator_tag)

1097

1225

self.checker_initiator_tag = (gobject.timeout_add

1098

1226

(value, self.start_checker))

1099

1227

self.start_checker() # Start one now, too

1100

1228

1101

1229

# Checker - property

1102

@dbus_service_property(_interface, signature=u"s",

1103

access=u"readwrite")

1230

@dbus_service_property(_interface, signature="s",

1231

access="readwrite")

1104

1232

def Checker_dbus_property(self, value=None):

1105

1233

if value is None: # get

1106

1234

return dbus.String(self.checker_command)

1107

1235

self.checker_command = value

1108

# Emit D-Bus signal

1109

self.PropertyChanged(dbus.String(u"Checker"),

1110

dbus.String(self.checker_command,

1111

variant_level=1))

1112

1236

1113

1237

# CheckerRunning - property

1114

@dbus_service_property(_interface, signature=u"b",

1115

access=u"readwrite")

1238

@dbus_service_property(_interface, signature="b",

1239

access="readwrite")

1116

1240

def CheckerRunning_dbus_property(self, value=None):

1117

1241

if value is None: # get

1118

1242

return dbus.Boolean(self.checker is not None)

1122

1246

self.stop_checker()

1123

1247

1124

1248

# ObjectPath - property

1125

@dbus_service_property(_interface, signature=u"o", access=u"read")

1249

@dbus_service_property(_interface, signature="o", access="read")

1126

1250

def ObjectPath_dbus_property(self):

1127

1251

return self.dbus_object_path # is already a dbus.ObjectPath

1128

1252

1129

1253

# Secret = property

1130

@dbus_service_property(_interface, signature=u"ay",

1131

access=u"write", byte_arrays=True)

1254

@dbus_service_property(_interface, signature="ay",

1255

access="write", byte_arrays=True)

1132

1256

def Secret_dbus_property(self, value):

1133

1257

self.secret = str(value)

1134

1258

1141

1265

self._pipe.send(('init', fpr, address))

1142

1266

if not self._pipe.recv():

1143

1267

raise KeyError()

1144

1268

1145

1269

def __getattribute__(self, name):

1146

1270

if(name == '_pipe'):

1147

1271

return super(ProxyClient, self).__getattribute__(name)

1154

1278

self._pipe.send(('funcall', name, args, kwargs))

1155

1279

return self._pipe.recv()[1]

1156

1280

return func

1157

1281

1158

1282

def __setattr__(self, name, value):

1159

1283

if(name == '_pipe'):

1160

1284

return super(ProxyClient, self).__setattr__(name, value)

1161

1285

self._pipe.send(('setattr', name, value))

1162

1286

1287

class ClientDBusTransitional(ClientDBus):

1288

__metaclass__ = AlternateDBusNamesMetaclass

1163

1289

1164

1290

class ClientHandler(socketserver.BaseRequestHandler, object):

1165

1291

"""A class to handle client connections.

1169

1295

1170

1296

def handle(self):

1171

1297

with contextlib.closing(self.server.child_pipe) as child_pipe:

1172

logger.info(u"TCP connection from: %s",

1298

logger.info("TCP connection from: %s",

1173

1299

unicode(self.client_address))

1174

logger.debug(u"Pipe FD: %d",

1300

logger.debug("Pipe FD: %d",

1175

1301

self.server.child_pipe.fileno())

1176

1302

1177

1303

session = (gnutls.connection

1178

1304

.ClientSession(self.request,

1179

1305

gnutls.connection

1180

1306

.X509Credentials()))

1181

1307

1182

1308

# Note: gnutls.connection.X509Credentials is really a

1183

1309

# generic GnuTLS certificate credentials object so long as

1184

1310

# no X.509 keys are added to it. Therefore, we can use it

1185

1311

# here despite using OpenPGP certificates.

1186

1187

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1188

# u"+AES-256-CBC", u"+SHA1",

1189

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1190

# u"+DHE-DSS"))

1312

1313

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1314

# "+AES-256-CBC", "+SHA1",

1315

# "+COMP-NULL", "+CTYPE-OPENPGP",

1316

# "+DHE-DSS"))

1191

1317

# Use a fallback default, since this MUST be set.

1192

1318

priority = self.server.gnutls_priority

1193

1319

if priority is None:

1194

priority = u"NORMAL"

1320

priority = "NORMAL"

1195

1321

(gnutls.library.functions

1196

1322

.gnutls_priority_set_direct(session._c_object,

1197

1323

priority, None))

1198

1324

1199

1325

# Start communication using the Mandos protocol

1200

1326

# Get protocol number

1201

1327

line = self.request.makefile().readline()

1202

logger.debug(u"Protocol version: %r", line)

1328

logger.debug("Protocol version: %r", line)

1203

1329

try:

1204

1330

if int(line.strip().split()[0]) > 1:

1205

1331

raise RuntimeError

1206

except (ValueError, IndexError, RuntimeError), error:

1207

logger.error(u"Unknown protocol version: %s", error)

1332

except (ValueError, IndexError, RuntimeError) as error:

1333

logger.error("Unknown protocol version: %s", error)

1208

1334

return

1209

1335

1210

1336

# Start GnuTLS connection

1211

1337

try:

1212

1338

session.handshake()

1213

except gnutls.errors.GNUTLSError, error:

1214

logger.warning(u"Handshake failed: %s", error)

1339

except gnutls.errors.GNUTLSError as error:

1340

logger.warning("Handshake failed: %s", error)

1215

1341

# Do not run session.bye() here: the session is not

1216

1342

# established. Just abandon the request.

1217

1343

return

1218

logger.debug(u"Handshake succeeded")

1219

1344

logger.debug("Handshake succeeded")

1345

1220

1346

approval_required = False

1221

1347

try:

1222

1348

try:

1223

1349

fpr = self.fingerprint(self.peer_certificate

1224

1350

(session))

1225

except (TypeError, gnutls.errors.GNUTLSError), error:

1226

logger.warning(u"Bad certificate: %s", error)

1351

except (TypeError,

1352

gnutls.errors.GNUTLSError) as error:

1353

logger.warning("Bad certificate: %s", error)

1227

1354

return

1228

logger.debug(u"Fingerprint: %s", fpr)

1229

1355

logger.debug("Fingerprint: %s", fpr)

1356

1230

1357

try:

1231

1358

client = ProxyClient(child_pipe, fpr,

1232

1359

self.client_address)

1240

1367

1241

1368

while True:

1242

1369

if not client.enabled:

1243

logger.warning(u"Client %s is disabled",

1370

logger.info("Client %s is disabled",

1244

1371

client.name)

1245

1372

if self.server.use_dbus:

1246

1373

# Emit D-Bus signal

1247

client.Rejected("Disabled")

1374

client.Rejected("Disabled")

1248

1375

return

1249

1376

1250

1377

if client._approved or not client.approval_delay:

1251

1378

#We are approved or approval is disabled

1252

1379

break

1253

1380

elif client._approved is None:

1254

logger.info(u"Client %s needs approval",

1381

logger.info("Client %s needs approval",

1255

1382

client.name)

1256

1383

if self.server.use_dbus:

1257

1384

# Emit D-Bus signal

1259

1386

client.approval_delay_milliseconds(),

1260

1387

client.approved_by_default)

1261

1388

else:

1262

logger.warning(u"Client %s was not approved",

1389

logger.warning("Client %s was not approved",

1263

1390

client.name)

1264

1391

if self.server.use_dbus:

1265

1392

# Emit D-Bus signal

1267

1394

return

1268

1395

1269

1396

#wait until timeout or approved

1270

#x = float(client._timedelta_to_milliseconds(delay))

1397

#x = float(client

1398

# ._timedelta_to_milliseconds(delay))

1271

1399

time = datetime.datetime.now()

1272

1400

client.changedstate.acquire()

1273

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1401

(client.changedstate.wait

1402

(float(client._timedelta_to_milliseconds(delay)

1403

/ 1000)))

1274

1404

client.changedstate.release()

1275

1405

time2 = datetime.datetime.now()

1276

1406

if (time2 - time) >= delay:

1291

1421

while sent_size < len(client.secret):

1292

1422

try:

1293

1423

sent = session.send(client.secret[sent_size:])

1294

except (gnutls.errors.GNUTLSError), error:

1424

except gnutls.errors.GNUTLSError as error:

1295

1425

logger.warning("gnutls send failed")

1296

1426

return

1297

logger.debug(u"Sent: %d, remaining: %d",

1427

logger.debug("Sent: %d, remaining: %d",

1298

1428

sent, len(client.secret)

1299

1429

- (sent_size + sent))

1300

1430

sent_size += sent

1301

1302

logger.info(u"Sending secret to %s", client.name)

1431

1432

logger.info("Sending secret to %s", client.name)

1303

1433

# bump the timeout as if seen

1304

client.checked_ok()

1434

client.checked_ok(client.extended_timeout)

1305

1435

if self.server.use_dbus:

1306

1436

# Emit D-Bus signal

1307

1437

client.GotSecret()

1311

1441

client.approvals_pending -= 1

1312

1442

try:

1313

1443

session.bye()

1314

except (gnutls.errors.GNUTLSError), error:

1444

except gnutls.errors.GNUTLSError as error:

1315

1445

logger.warning("GnuTLS bye failed")

1316

1446

1317

1447

@staticmethod

1328

1458

.gnutls_certificate_get_peers

1329

1459

(session._c_object, ctypes.byref(list_size)))

1330

1460

if not bool(cert_list) and list_size.value != 0:

1331

raise gnutls.errors.GNUTLSError(u"error getting peer"

1332

u" certificate")

1461

raise gnutls.errors.GNUTLSError("error getting peer"

1462

" certificate")

1333

1463

if list_size.value == 0:

1334

1464

return None

1335

1465

cert = cert_list[0]

1361

1491

if crtverify.value != 0:

1362

1492

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1363

1493

raise (gnutls.errors.CertificateSecurityError

1364

(u"Verify failed"))

1494

("Verify failed"))

1365

1495

# New buffer for the fingerprint

1366

1496

buf = ctypes.create_string_buffer(20)

1367

1497

buf_len = ctypes.c_size_t()

1374

1504

# Convert the buffer to a Python bytestring

1375

1505

fpr = ctypes.string_at(buf, buf_len.value)

1376

1506

# Convert the bytestring to hexadecimal notation

1377

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1378

1508

return hex_fpr

1379

1509

1380

1510

1392

1522

multiprocessing.Process(target = self.sub_process_main,

1393

1523

args = (request, address)).start()

1394

1524

1525

1395

1526

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1396

1527

""" adds a pipe to the MixIn """

1397

1528

def process_request(self, request, client_address):

1400

1531

This function creates a new pipe in self.pipe

1401

1532

"""

1402

1533

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1403

1534

1404

1535

super(MultiprocessingMixInWithPipe,

1405

1536

self).process_request(request, client_address)

1406

1537

self.child_pipe.close()

1407

1538

self.add_pipe(parent_pipe)

1408

1539

1409

1540

def add_pipe(self, parent_pipe):

1410

1541

"""Dummy function; override as necessary"""

1411

pass

1542

raise NotImplementedError

1543

1412

1544

1413

1545

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1414

1546

socketserver.TCPServer, object):

1432

1564

bind to an address or port if they were not specified."""

1433

1565

if self.interface is not None:

1434

1566

if SO_BINDTODEVICE is None:

1435

logger.error(u"SO_BINDTODEVICE does not exist;"

1436

u" cannot bind to interface %s",

1567

logger.error("SO_BINDTODEVICE does not exist;"

1568

" cannot bind to interface %s",

1437

1569

self.interface)

1438

1570

else:

1439

1571

try:

1440

1572

self.socket.setsockopt(socket.SOL_SOCKET,

1441

1573

SO_BINDTODEVICE,

1442

1574

str(self.interface

1443

+ u'\0'))

1444

except socket.error, error:

1575

+ '\0'))

1576

except socket.error as error:

1445

1577

if error[0] == errno.EPERM:

1446

logger.error(u"No permission to"

1447

u" bind to interface %s",

1578

logger.error("No permission to"

1579

" bind to interface %s",

1448

1580

self.interface)

1449

1581

elif error[0] == errno.ENOPROTOOPT:

1450

logger.error(u"SO_BINDTODEVICE not available;"

1451

u" cannot bind to interface %s",

1582

logger.error("SO_BINDTODEVICE not available;"

1583

" cannot bind to interface %s",

1452

1584

self.interface)

1453

1585

else:

1454

1586

raise

1456

1588

if self.server_address[0] or self.server_address[1]:

1457

1589

if not self.server_address[0]:

1458

1590

if self.address_family == socket.AF_INET6:

1459

any_address = u"::" # in6addr_any

1591

any_address = "::" # in6addr_any

1460

1592

else:

1461

1593

any_address = socket.INADDR_ANY

1462

1594

self.server_address = (any_address,

1506

1638

gobject.io_add_watch(parent_pipe.fileno(),

1507

1639

gobject.IO_IN | gobject.IO_HUP,

1508

1640

functools.partial(self.handle_ipc,

1509

parent_pipe = parent_pipe))

1641

parent_pipe =

1642

parent_pipe))

1510

1643

1511

1644

def handle_ipc(self, source, condition, parent_pipe=None,

1512

1645

client_object=None):

1513

1646

condition_names = {

1514

gobject.IO_IN: u"IN", # There is data to read.

1515

gobject.IO_OUT: u"OUT", # Data can be written (without

1647

gobject.IO_IN: "IN", # There is data to read.

1648

gobject.IO_OUT: "OUT", # Data can be written (without

1516

1649

# blocking).

1517

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1518

gobject.IO_ERR: u"ERR", # Error condition.

1519

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1650

gobject.IO_PRI: "PRI", # There is urgent data to read.

1651

gobject.IO_ERR: "ERR", # Error condition.

1652

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1520

1653

# broken, usually for pipes and

1521

1654

# sockets).

1522

1655

}

1541

1674

client = c

1542

1675

break

1543

1676

else:

1544

logger.warning(u"Client not found for fingerprint: %s, ad"

1545

u"dress: %s", fpr, address)

1677

logger.info("Client not found for fingerprint: %s, ad"

1678

"dress: %s", fpr, address)

1546

1679

if self.use_dbus:

1547

1680

# Emit D-Bus signal

1548

mandos_dbus_service.ClientNotFound(fpr, address[0])

1681

mandos_dbus_service.ClientNotFound(fpr,

1682

address[0])

1549

1683

parent_pipe.send(False)

1550

1684

return False

1551

1685

1552

1686

gobject.io_add_watch(parent_pipe.fileno(),

1553

1687

gobject.IO_IN | gobject.IO_HUP,

1554

1688

functools.partial(self.handle_ipc,

1555

parent_pipe = parent_pipe,

1556

client_object = client))

1689

parent_pipe =

1690

parent_pipe,

1691

client_object =

1692

client))

1557

1693

parent_pipe.send(True)

1558

# remove the old hook in favor of the new above hook on same fileno

1694

# remove the old hook in favor of the new above hook on

1695

# same fileno

1559

1696

return False

1560

1697

if command == 'funcall':

1561

1698

funcname = request[1]

1562

1699

args = request[2]

1563

1700

kwargs = request[3]

1564

1701

1565

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1566

1702

parent_pipe.send(('data', getattr(client_object,

1703

funcname)(*args,

1704

**kwargs)))

1705

1567

1706

if command == 'getattr':

1568

1707

attrname = request[1]

1569

1708

if callable(client_object.__getattribute__(attrname)):

1570

1709

parent_pipe.send(('function',))

1571

1710

else:

1572

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1711

parent_pipe.send(('data', client_object

1712

.__getattribute__(attrname)))

1573

1713

1574

1714

if command == 'setattr':

1575

1715

attrname = request[1]

1576

1716

value = request[2]

1577

1717

setattr(client_object, attrname, value)

1578

1718

1579

1719

return True

1580

1720

1581

1721

1582

1722

def string_to_delta(interval):

1583

1723

"""Parse a string and return a datetime.timedelta

1584

1724

1585

>>> string_to_delta(u'7d')

1725

>>> string_to_delta('7d')

1586

1726

datetime.timedelta(7)

1587

>>> string_to_delta(u'60s')

1727

>>> string_to_delta('60s')

1588

1728

datetime.timedelta(0, 60)

1589

>>> string_to_delta(u'60m')

1729

>>> string_to_delta('60m')

1590

1730

datetime.timedelta(0, 3600)

1591

>>> string_to_delta(u'24h')

1731

>>> string_to_delta('24h')

1592

1732

datetime.timedelta(1)

1593

>>> string_to_delta(u'1w')

1733

>>> string_to_delta('1w')

1594

1734

datetime.timedelta(7)

1595

>>> string_to_delta(u'5m 30s')

1735

>>> string_to_delta('5m 30s')

1596

1736

datetime.timedelta(0, 330)

1597

1737

"""

1598

1738

timevalue = datetime.timedelta(0)

1600

1740

try:

1601

1741

suffix = unicode(s[-1])

1602

1742

value = int(s[:-1])

1603

if suffix == u"d":

1743

if suffix == "d":

1604

1744

delta = datetime.timedelta(value)

1605

elif suffix == u"s":

1745

elif suffix == "s":

1606

1746

delta = datetime.timedelta(0, value)

1607

elif suffix == u"m":

1747

elif suffix == "m":

1608

1748

delta = datetime.timedelta(0, 0, 0, 0, value)

1609

elif suffix == u"h":

1749

elif suffix == "h":

1610

1750

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1611

elif suffix == u"w":

1751

elif suffix == "w":

1612

1752

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1613

1753

else:

1614

raise ValueError(u"Unknown suffix %r" % suffix)

1615

except (ValueError, IndexError), e:

1616

raise ValueError(e.message)

1754

raise ValueError("Unknown suffix %r" % suffix)

1755

except (ValueError, IndexError) as e:

1756

raise ValueError(*(e.args))

1617

1757

timevalue += delta

1618

1758

return timevalue

1619

1759

1625

1765

global if_nametoindex

1626

1766

try:

1627

1767

if_nametoindex = (ctypes.cdll.LoadLibrary

1628

(ctypes.util.find_library(u"c"))

1768

(ctypes.util.find_library("c"))

1629

1769

.if_nametoindex)

1630

1770

except (OSError, AttributeError):

1631

logger.warning(u"Doing if_nametoindex the hard way")

1771

logger.warning("Doing if_nametoindex the hard way")

1632

1772

def if_nametoindex(interface):

1633

1773

"Get an interface index the hard way, i.e. using fcntl()"

1634

1774

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1635

1775

with contextlib.closing(socket.socket()) as s:

1636

1776

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1637

struct.pack(str(u"16s16x"),

1777

struct.pack(str("16s16x"),

1638

1778

interface))

1639

interface_index = struct.unpack(str(u"I"),

1779

interface_index = struct.unpack(str("I"),

1640

1780

ifreq[16:20])[0]

1641

1781

return interface_index

1642

1782

return if_nametoindex(interface)

1650

1790

sys.exit()

1651

1791

os.setsid()

1652

1792

if not nochdir:

1653

os.chdir(u"/")

1793

os.chdir("/")

1654

1794

if os.fork():

1655

1795

sys.exit()

1656

1796

if not noclose:

1658

1798

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1659

1799

if not stat.S_ISCHR(os.fstat(null).st_mode):

1660

1800

raise OSError(errno.ENODEV,

1661

u"%s not a character device"

1801

"%s not a character device"

1662

1802

% os.path.devnull)

1663

1803

os.dup2(null, sys.stdin.fileno())

1664

1804

os.dup2(null, sys.stdout.fileno())

1672

1812

##################################################################

1673

1813

# Parsing of options, both command line and config file

1674

1814

1675

parser = optparse.OptionParser(version = "%%prog %s" % version)

1676

parser.add_option("-i", u"--interface", type=u"string",

1677

metavar="IF", help=u"Bind to interface IF")

1678

parser.add_option("-a", u"--address", type=u"string",

1679

help=u"Address to listen for requests on")

1680

parser.add_option("-p", u"--port", type=u"int",

1681

help=u"Port number to receive requests on")

1682

parser.add_option("--check", action=u"store_true",

1683

help=u"Run self-test")

1684

parser.add_option("--debug", action=u"store_true",

1685

help=u"Debug mode; run in foreground and log to"

1686

u" terminal")

1687

parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",

1688

help=u"Debug level for stdout output")

1689

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1690

u" priority string (see GnuTLS documentation)")

1691

parser.add_option("--servicename", type=u"string",

1692

metavar=u"NAME", help=u"Zeroconf service name")

1693

parser.add_option("--configdir", type=u"string",

1694

default=u"/etc/mandos", metavar=u"DIR",

1695

help=u"Directory to search for configuration"

1696

u" files")

1697

parser.add_option("--no-dbus", action=u"store_false",

1698

dest=u"use_dbus", help=u"Do not provide D-Bus"

1699

u" system bus interface")

1700

parser.add_option("--no-ipv6", action=u"store_false",

1701

dest=u"use_ipv6", help=u"Do not use IPv6")

1702

options = parser.parse_args()[0]

1815

parser = argparse.ArgumentParser()

1816

parser.add_argument("-v", "--version", action="version",

1817

version = "%%(prog)s %s" % version,

1818

help="show version number and exit")

1819

parser.add_argument("-i", "--interface", metavar="IF",

1820

help="Bind to interface IF")

1821

parser.add_argument("-a", "--address",

1822

help="Address to listen for requests on")

1823

parser.add_argument("-p", "--port", type=int,

1824

help="Port number to receive requests on")

1825

parser.add_argument("--check", action="store_true",

1826

help="Run self-test")

1827

parser.add_argument("--debug", action="store_true",

1828

help="Debug mode; run in foreground and log"

1829

" to terminal")

1830

parser.add_argument("--debuglevel", metavar="LEVEL",

1831

help="Debug level for stdout output")

1832

parser.add_argument("--priority", help="GnuTLS"

1833

" priority string (see GnuTLS documentation)")

1834

parser.add_argument("--servicename",

1835

metavar="NAME", help="Zeroconf service name")

1836

parser.add_argument("--configdir",

1837

default="/etc/mandos", metavar="DIR",

1838

help="Directory to search for configuration"

1839

" files")

1840

parser.add_argument("--no-dbus", action="store_false",

1841

dest="use_dbus", help="Do not provide D-Bus"

1842

" system bus interface")

1843

parser.add_argument("--no-ipv6", action="store_false",

1844

dest="use_ipv6", help="Do not use IPv6")

1845

options = parser.parse_args()

1703

1846

1704

1847

if options.check:

1705

1848

import doctest

1707

1850

sys.exit()

1708

1851

1709

1852

# Default values for config file for server-global settings

1710

server_defaults = { u"interface": u"",

1711

u"address": u"",

1712

u"port": u"",

1713

u"debug": u"False",

1714

u"priority":

1715

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1716

u"servicename": u"Mandos",

1717

u"use_dbus": u"True",

1718

u"use_ipv6": u"True",

1719

u"debuglevel": u"",

1853

server_defaults = { "interface": "",

1854

"address": "",

1855

"port": "",

1856

"debug": "False",

1857

"priority":

1858

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1859

"servicename": "Mandos",

1860

"use_dbus": "True",

1861

"use_ipv6": "True",

1862

"debuglevel": "",

1720

1863

}

1721

1864

1722

1865

# Parse config file for server-global settings

1723

1866

server_config = configparser.SafeConfigParser(server_defaults)

1724

1867

del server_defaults

1725

1868

server_config.read(os.path.join(options.configdir,

1726

u"mandos.conf"))

1869

"mandos.conf"))

1727

1870

# Convert the SafeConfigParser object to a dict

1728

1871

server_settings = server_config.defaults()

1729

1872

# Use the appropriate methods on the non-string config options

1730

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1731

server_settings[option] = server_config.getboolean(u"DEFAULT",

1873

for option in ("debug", "use_dbus", "use_ipv6"):

1874

server_settings[option] = server_config.getboolean("DEFAULT",

1732

1875

option)

1733

1876

if server_settings["port"]:

1734

server_settings["port"] = server_config.getint(u"DEFAULT",

1735

u"port")

1877

server_settings["port"] = server_config.getint("DEFAULT",

1878

"port")

1736

1879

del server_config

1737

1880

1738

1881

# Override the settings from the config file with command line

1739

1882

# options, if set.

1740

for option in (u"interface", u"address", u"port", u"debug",

1741

u"priority", u"servicename", u"configdir",

1742

u"use_dbus", u"use_ipv6", u"debuglevel"):

1883

for option in ("interface", "address", "port", "debug",

1884

"priority", "servicename", "configdir",

1885

"use_dbus", "use_ipv6", "debuglevel"):

1743

1886

value = getattr(options, option)

1744

1887

if value is not None:

1745

1888

server_settings[option] = value

1753

1896

##################################################################

1754

1897

1755

1898

# For convenience

1756

debug = server_settings[u"debug"]

1757

debuglevel = server_settings[u"debuglevel"]

1758

use_dbus = server_settings[u"use_dbus"]

1759

use_ipv6 = server_settings[u"use_ipv6"]

1760

1761

if server_settings[u"servicename"] != u"Mandos":

1899

debug = server_settings["debug"]

1900

debuglevel = server_settings["debuglevel"]

1901

use_dbus = server_settings["use_dbus"]

1902

use_ipv6 = server_settings["use_ipv6"]

1903

1904

if server_settings["servicename"] != "Mandos":

1762

1905

syslogger.setFormatter(logging.Formatter

1763

(u'Mandos (%s) [%%(process)d]:'

1764

u' %%(levelname)s: %%(message)s'

1765

% server_settings[u"servicename"]))

1906

('Mandos (%s) [%%(process)d]:'

1907

' %%(levelname)s: %%(message)s'

1908

% server_settings["servicename"]))

1766

1909

1767

1910

# Parse config file with clients

1768

client_defaults = { u"timeout": u"1h",

1769

u"interval": u"5m",

1770

u"checker": u"fping -q -- %%(host)s",

1771

u"host": u"",

1772

u"approval_delay": u"0s",

1773

u"approval_duration": u"1s",

1911

client_defaults = { "timeout": "5m",

1912

"extended_timeout": "15m",

1913

"interval": "2m",

1914

"checker": "fping -q -- %%(host)s",

1915

"host": "",

1916

"approval_delay": "0s",

1917

"approval_duration": "1s",

1774

1918

}

1775

1919

client_config = configparser.SafeConfigParser(client_defaults)

1776

client_config.read(os.path.join(server_settings[u"configdir"],

1777

u"clients.conf"))

1920

client_config.read(os.path.join(server_settings["configdir"],

1921

"clients.conf"))

1778

1922

1779

1923

global mandos_dbus_service

1780

1924

mandos_dbus_service = None

1781

1925

1782

tcp_server = MandosServer((server_settings[u"address"],

1783

server_settings[u"port"]),

1926

tcp_server = MandosServer((server_settings["address"],

1927

server_settings["port"]),

1784

1928

ClientHandler,

1785

interface=(server_settings[u"interface"]

1929

interface=(server_settings["interface"]

1786

1930

or None),

1787

1931

use_ipv6=use_ipv6,

1788

1932

gnutls_priority=

1789

server_settings[u"priority"],

1933

server_settings["priority"],

1790

1934

use_dbus=use_dbus)

1791

1935

if not debug:

1792

pidfilename = u"/var/run/mandos.pid"

1936

pidfilename = "/var/run/mandos.pid"

1793

1937

try:

1794

pidfile = open(pidfilename, u"w")

1938

pidfile = open(pidfilename, "w")

1795

1939

except IOError:

1796

logger.error(u"Could not open file %r", pidfilename)

1940

logger.error("Could not open file %r", pidfilename)

1797

1941

1798

1942

try:

1799

uid = pwd.getpwnam(u"_mandos").pw_uid

1800

gid = pwd.getpwnam(u"_mandos").pw_gid

1943

uid = pwd.getpwnam("_mandos").pw_uid

1944

gid = pwd.getpwnam("_mandos").pw_gid

1801

1945

except KeyError:

1802

1946

try:

1803

uid = pwd.getpwnam(u"mandos").pw_uid

1804

gid = pwd.getpwnam(u"mandos").pw_gid

1947

uid = pwd.getpwnam("mandos").pw_uid

1948

gid = pwd.getpwnam("mandos").pw_gid

1805

1949

except KeyError:

1806

1950

try:

1807

uid = pwd.getpwnam(u"nobody").pw_uid

1808

gid = pwd.getpwnam(u"nobody").pw_gid

1951

uid = pwd.getpwnam("nobody").pw_uid

1952

gid = pwd.getpwnam("nobody").pw_gid

1809

1953

except KeyError:

1810

1954

uid = 65534

1811

1955

gid = 65534

1812

1956

try:

1813

1957

os.setgid(gid)

1814

1958

os.setuid(uid)

1815

except OSError, error:

1959

except OSError as error:

1816

1960

if error[0] != errno.EPERM:

1817

1961

raise error

1818

1962

1823

1967

level = getattr(logging, debuglevel.upper())

1824

1968

syslogger.setLevel(level)

1825

1969

console.setLevel(level)

1826

1970

1827

1971

if debug:

1828

1972

# Enable all possible GnuTLS debugging

1829

1973

1833

1977

1834

1978

@gnutls.library.types.gnutls_log_func

1835

1979

def debug_gnutls(level, string):

1836

logger.debug(u"GnuTLS: %s", string[:-1])

1980

logger.debug("GnuTLS: %s", string[:-1])

1837

1981

1838

1982

(gnutls.library.functions

1839

1983

.gnutls_global_set_log_function(debug_gnutls))

1847

1991

# No console logging

1848

1992

logger.removeHandler(console)

1849

1993

1994

# Need to fork before connecting to D-Bus

1995

if not debug:

1996

# Close all input and output, do double fork, etc.

1997

daemon()

1850

1998

1851

1999

global main_loop

1852

2000

# From the Avahi example code

1856

2004

# End of Avahi example code

1857

2005

if use_dbus:

1858

2006

try:

1859

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2007

bus_name = dbus.service.BusName("se.recompile.Mandos",

1860

2008

bus, do_not_queue=True)

1861

except dbus.exceptions.NameExistsException, e:

1862

logger.error(unicode(e) + u", disabling D-Bus")

2009

old_bus_name = (dbus.service.BusName

2010

("se.bsnet.fukt.Mandos", bus,

2011

do_not_queue=True))

2012

except dbus.exceptions.NameExistsException as e:

2013

logger.error(unicode(e) + ", disabling D-Bus")

1863

2014

use_dbus = False

1864

server_settings[u"use_dbus"] = False

2015

server_settings["use_dbus"] = False

1865

2016

tcp_server.use_dbus = False

1866

2017

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1867

service = AvahiService(name = server_settings[u"servicename"],

1868

servicetype = u"_mandos._tcp",

2018

service = AvahiService(name = server_settings["servicename"],

2019

servicetype = "_mandos._tcp",

1869

2020

protocol = protocol, bus = bus)

1870

2021

if server_settings["interface"]:

1871

2022

service.interface = (if_nametoindex

1872

(str(server_settings[u"interface"])))

1873

1874

if not debug:

1875

# Close all input and output, do double fork, etc.

1876

daemon()

1877

2023

(str(server_settings["interface"])))

2024

1878

2025

global multiprocessing_manager

1879

2026

multiprocessing_manager = multiprocessing.Manager()

1880

2027

1881

2028

client_class = Client

1882

2029

if use_dbus:

1883

client_class = functools.partial(ClientDBus, bus = bus)

2030

client_class = functools.partial(ClientDBusTransitional,

2031

bus = bus)

1884

2032

def client_config_items(config, section):

1885

2033

special_settings = {

1886

2034

"approved_by_default":

1899

2047

client_config, section)))

1900

2048

for section in client_config.sections()))

1901

2049

if not tcp_server.clients:

1902

logger.warning(u"No clients defined")

2050

logger.warning("No clients defined")

1903

2051

1904

2052

if not debug:

1905

2053

try:

1906

2054

with pidfile:

1907

2055

pid = os.getpid()

1908

pidfile.write(str(pid) + "\n")

2056

pidfile.write(str(pid) + "\n".encode("utf-8"))

1909

2057

del pidfile

1910

2058

except IOError:

1911

logger.error(u"Could not write to file %r with PID %d",

2059

logger.error("Could not write to file %r with PID %d",

1912

2060

pidfilename, pid)

1913

2061

except NameError:

1914

2062

# "pidfile" was never created

1916

2064

del pidfilename

1917

2065

1918

2066

signal.signal(signal.SIGINT, signal.SIG_IGN)

1919

2067

1920

2068

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1921

2069

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1922

2070

1924

2072

class MandosDBusService(dbus.service.Object):

1925

2073

"""A D-Bus proxy object"""

1926

2074

def __init__(self):

1927

dbus.service.Object.__init__(self, bus, u"/")

1928

_interface = u"se.bsnet.fukt.Mandos"

2075

dbus.service.Object.__init__(self, bus, "/")

2076

_interface = "se.recompile.Mandos"

1929

2077

1930

@dbus.service.signal(_interface, signature=u"o")

2078

@dbus.service.signal(_interface, signature="o")

1931

2079

def ClientAdded(self, objpath):

1932

2080

"D-Bus signal"

1933

2081

pass

1934

2082

1935

@dbus.service.signal(_interface, signature=u"ss")

2083

@dbus.service.signal(_interface, signature="ss")

1936

2084

def ClientNotFound(self, fingerprint, address):

1937

2085

"D-Bus signal"

1938

2086

pass

1939

2087

1940

@dbus.service.signal(_interface, signature=u"os")

2088

@dbus.service.signal(_interface, signature="os")

1941

2089

def ClientRemoved(self, objpath, name):

1942

2090

"D-Bus signal"

1943

2091

pass

1944

2092

1945

@dbus.service.method(_interface, out_signature=u"ao")

2093

@dbus.service.method(_interface, out_signature="ao")

1946

2094

def GetAllClients(self):

1947

2095

"D-Bus method"

1948

2096

return dbus.Array(c.dbus_object_path

1949

2097

for c in tcp_server.clients)

1950

2098

1951

2099

@dbus.service.method(_interface,

1952

out_signature=u"a{oa{sv}}")

2100

out_signature="a{oa{sv}}")

1953

2101

def GetAllClientsWithProperties(self):

1954

2102

"D-Bus method"

1955

2103

return dbus.Dictionary(

1956

((c.dbus_object_path, c.GetAll(u""))

2104

((c.dbus_object_path, c.GetAll(""))

1957

2105

for c in tcp_server.clients),

1958

signature=u"oa{sv}")

2106

signature="oa{sv}")

1959

2107

1960

@dbus.service.method(_interface, in_signature=u"o")

2108

@dbus.service.method(_interface, in_signature="o")

1961

2109

def RemoveClient(self, object_path):

1962

2110

"D-Bus method"

1963

2111

for c in tcp_server.clients:

1973

2121

1974

2122

del _interface

1975

2123

1976

mandos_dbus_service = MandosDBusService()

2124

class MandosDBusServiceTransitional(MandosDBusService):

2125

__metaclass__ = AlternateDBusNamesMetaclass

2126

mandos_dbus_service = MandosDBusServiceTransitional()

1977

2127

1978

2128

def cleanup():

1979

2129

"Cleanup function; run on exit"

1988

2138

client.disable(quiet=True)

1989

2139

if use_dbus:

1990

2140

# Emit D-Bus signal

1991

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2141

mandos_dbus_service.ClientRemoved(client

2142

.dbus_object_path,

1992

2143

client.name)

1993

2144

1994

2145

atexit.register(cleanup)

2005

2156

# Find out what port we got

2006

2157

service.port = tcp_server.socket.getsockname()[1]

2007

2158

if use_ipv6:

2008

logger.info(u"Now listening on address %r, port %d,"

2159

logger.info("Now listening on address %r, port %d,"

2009

2160

" flowinfo %d, scope_id %d"

2010

2161

% tcp_server.socket.getsockname())

2011

2162

else: # IPv4

2012

logger.info(u"Now listening on address %r, port %d"

2163

logger.info("Now listening on address %r, port %d"

2013

2164

% tcp_server.socket.getsockname())

2014

2165

2015

2166

#service.interface = tcp_server.socket.getsockname()[3]

2018

2169

# From the Avahi example code

2019

2170

try:

2020

2171

service.activate()

2021

except dbus.exceptions.DBusException, error:

2022

logger.critical(u"DBusException: %s", error)

2172

except dbus.exceptions.DBusException as error:

2173

logger.critical("DBusException: %s", error)

2023

2174

cleanup()

2024

2175

sys.exit(1)

2025

2176

# End of Avahi example code

2029

2180

(tcp_server.handle_request

2030

2181

(*args[2:], **kwargs) or True))

2031

2182

2032

logger.debug(u"Starting main loop")

2183

logger.debug("Starting main loop")

2033

2184

main_loop.run()

2034

except AvahiError, error:

2035

logger.critical(u"AvahiError: %s", error)

2185

except AvahiError as error:

2186

logger.critical("AvahiError: %s", error)

2036

2187

cleanup()

2037

2188

sys.exit(1)

2038

2189

except KeyboardInterrupt:

2039

2190

if debug:

2040

print >> sys.stderr

2041

logger.debug(u"Server received KeyboardInterrupt")

2042

logger.debug(u"Server exiting")

2191

print("", file=sys.stderr)

2192

logger.debug("Server received KeyboardInterrupt")

2193

logger.debug("Server exiting")

2043

2194

# Must run before the D-Bus bus name gets deregistered

2044

2195

cleanup()

2045

2196

2197

2046

2198

if __name__ == '__main__':

2047

2199

main()