/mandos/release : revision 237.16.12

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

61

62

import functools

62

63

import cPickle as pickle

63

64

import multiprocessing

65

import types

64

66

65

67

import dbus

66

68

import dbus.service

81

83

SO_BINDTODEVICE = None

82

84

83

85

84

version = "1.0.14"

86

version = "1.4.1"

85

87

86

logger = logging.Logger(u'mandos')

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

87

90

syslogger = (logging.handlers.SysLogHandler

88

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

89

address = "/dev/log"))

92

address = str("/dev/log")))

90

93

syslogger.setFormatter(logging.Formatter

91

(u'Mandos [%(process)d]: %(levelname)s:'

92

u' %(message)s'))

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

93

96

logger.addHandler(syslogger)

94

97

95

98

console = logging.StreamHandler()

96

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

97

u' %(levelname)s:'

98

u' %(message)s'))

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

99

102

logger.addHandler(console)

100

103

101

multiprocessing_manager = multiprocessing.Manager()

102

103

104

class AvahiError(Exception):

104

105

def __init__(self, value, *args, **kwargs):

105

106

self.value = value

120

121

Attributes:

121

122

interface: integer; avahi.IF_UNSPEC or an interface index.

122

123

Used to optionally bind to the specified interface.

123

124

type: string; Example: u'_mandos._tcp'.

124

125

type: string; Example: '_mandos._tcp'.

125

126

See <http://www.dns-sd.org/ServiceTypes.html>

126

127

port: integer; what port to announce

127

128

TXT: list of strings; TXT record for the service

136

137

"""

137

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

138

139

servicetype = None, port = None, TXT = None,

139

domain = u"", host = u"", max_renames = 32768,

140

domain = "", host = "", max_renames = 32768,

140

141

protocol = avahi.PROTO_UNSPEC, bus = None):

141

142

self.interface = interface

142

143

self.name = name

151

152

self.group = None # our entry group

152

153

self.server = None

153

154

self.bus = bus

155

self.entry_group_state_changed_match = None

154

156

def rename(self):

155

157

"""Derived from the Avahi example code"""

156

158

if self.rename_count >= self.max_renames:

157

logger.critical(u"No suitable Zeroconf service name found"

158

u" after %i retries, exiting.",

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

159

161

self.rename_count)

160

raise AvahiServiceError(u"Too many renames")

161

self.name = self.server.GetAlternativeServiceName(self.name)

162

logger.info(u"Changing Zeroconf service name to %r ...",

163

unicode(self.name))

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server

164

.GetAlternativeServiceName(self.name))

165

logger.info("Changing Zeroconf service name to %r ...",

166

self.name)

164

167

syslogger.setFormatter(logging.Formatter

165

(u'Mandos (%s) [%%(process)d]:'

166

u' %%(levelname)s: %%(message)s'

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

167

170

% self.name))

168

171

self.remove()

169

self.add()

172

try:

173

self.add()

174

except dbus.exceptions.DBusException as error:

175

logger.critical("DBusException: %s", error)

176

self.cleanup()

177

os._exit(1)

170

178

self.rename_count += 1

171

179

def remove(self):

172

180

"""Derived from the Avahi example code"""

181

if self.entry_group_state_changed_match is not None:

182

self.entry_group_state_changed_match.remove()

183

self.entry_group_state_changed_match = None

173

184

if self.group is not None:

174

185

self.group.Reset()

175

186

def add(self):

176

187

"""Derived from the Avahi example code"""

188

self.remove()

177

189

if self.group is None:

178

190

self.group = dbus.Interface(

179

191

self.bus.get_object(avahi.DBUS_NAME,

180

192

self.server.EntryGroupNew()),

181

193

avahi.DBUS_INTERFACE_ENTRY_GROUP)

182

self.group.connect_to_signal('StateChanged',

183

self

184

.entry_group_state_changed)

185

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

194

self.entry_group_state_changed_match = (

195

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

186

198

self.name, self.type)

187

199

self.group.AddService(

188

200

self.interface,

195

207

self.group.Commit()

196

208

def entry_group_state_changed(self, state, error):

197

209

"""Derived from the Avahi example code"""

198

logger.debug(u"Avahi state change: %i", state)

210

logger.debug("Avahi entry group state change: %i", state)

199

211

200

212

if state == avahi.ENTRY_GROUP_ESTABLISHED:

201

logger.debug(u"Zeroconf service established.")

213

logger.debug("Zeroconf service established.")

202

214

elif state == avahi.ENTRY_GROUP_COLLISION:

203

logger.warning(u"Zeroconf service name collision.")

215

logger.info("Zeroconf service name collision.")

204

216

self.rename()

205

217

elif state == avahi.ENTRY_GROUP_FAILURE:

206

logger.critical(u"Avahi: Error in group state changed %s",

218

logger.critical("Avahi: Error in group state changed %s",

207

219

unicode(error))

208

raise AvahiGroupError(u"State changed: %s"

220

raise AvahiGroupError("State changed: %s"

209

221

% unicode(error))

210

222

def cleanup(self):

211

223

"""Derived from the Avahi example code"""

212

224

if self.group is not None:

213

self.group.Free()

225

try:

226

self.group.Free()

227

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

229

pass

214

230

self.group = None

215

def server_state_changed(self, state):

231

self.remove()

232

def server_state_changed(self, state, error=None):

216

233

"""Derived from the Avahi example code"""

217

if state == avahi.SERVER_COLLISION:

218

logger.error(u"Zeroconf server name collision")

219

self.remove()

234

logger.debug("Avahi server state change: %i", state)

235

bad_states = { avahi.SERVER_INVALID:

236

"Zeroconf server invalid",

237

avahi.SERVER_REGISTERING: None,

238

avahi.SERVER_COLLISION:

239

"Zeroconf server name collision",

240

avahi.SERVER_FAILURE:

241

"Zeroconf server failure" }

242

if state in bad_states:

243

if bad_states[state] is not None:

244

if error is None:

245

logger.error(bad_states[state])

246

else:

247

logger.error(bad_states[state] + ": %r", error)

248

self.cleanup()

220

249

elif state == avahi.SERVER_RUNNING:

221

250

self.add()

251

else:

252

if error is None:

253

logger.debug("Unknown state: %r", state)

254

else:

255

logger.debug("Unknown state: %r: %r", state, error)

222

256

def activate(self):

223

257

"""Derived from the Avahi example code"""

224

258

if self.server is None:

225

259

self.server = dbus.Interface(

226

260

self.bus.get_object(avahi.DBUS_NAME,

227

avahi.DBUS_PATH_SERVER),

261

avahi.DBUS_PATH_SERVER,

262

follow_name_owner_changes=True),

228

263

avahi.DBUS_INTERFACE_SERVER)

229

self.server.connect_to_signal(u"StateChanged",

264

self.server.connect_to_signal("StateChanged",

230

265

self.server_state_changed)

231

266

self.server_state_changed(self.server.GetState())

232

267

233

268

234

# XXX Need to add:

235

# approved_by_default (Config option for each client)

236

# approved_delay (config option for each client)

237

# approved_duration (config option for each client)

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

274

238

275

class Client(object):

239

276

"""A representation of a client host served by this server.

240

277

241

278

Attributes:

242

243

D-Bus identifiers

279

_approved: bool(); 'None' if not yet approved/disapproved

280

approval_delay: datetime.timedelta(); Time to wait for approval

281

approval_duration: datetime.timedelta(); Duration of one approval

282

checker: subprocess.Popen(); a running checker process used

283

to see if the client lives.

284

'None' if no process is running.

285

checker_callback_tag: a gobject event source tag, or None

286

checker_command: string; External command which is run to check

287

if client lives. %() expansions are done at

288

runtime with vars(self) as dict, so that for

289

instance %(name)s can be used in the command.

290

checker_initiator_tag: a gobject event source tag, or None

291

created: datetime.datetime(); (UTC) object creation

292

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

294

disable_initiator_tag: a gobject event source tag, or None

295

enabled: bool()

244

296

fingerprint: string (40 or 32 hexadecimal digits); used to

245

297

uniquely identify the client

246

secret: bytestring; sent verbatim (over TLS) to client

247

298

host: string; available for use by the checker command

248

created: datetime.datetime(); (UTC) object creation

299

interval: datetime.timedelta(); How often to start a new checker

300

last_approval_request: datetime.datetime(); (UTC) or None

301

last_checked_ok: datetime.datetime(); (UTC) or None

249

302

last_enabled: datetime.datetime(); (UTC)

250

enabled: bool()

251

last_checked_ok: datetime.datetime(); (UTC) or None

303

304

D-Bus identifiers

305

secret: bytestring; sent verbatim (over TLS) to client

252

306

timeout: datetime.timedelta(); How long from last_checked_ok

253

307

until this client is disabled

254

interval: datetime.timedelta(); How often to start a new checker

255

disable_hook: If set, called by disable() as disable_hook(self)

256

checker: subprocess.Popen(); a running checker process used

257

to see if the client lives.

258

'None' if no process is running.

259

checker_initiator_tag: a gobject event source tag, or None

260

disable_initiator_tag: - '' -

261

checker_callback_tag: - '' -

262

checker_command: string; External command which is run to check if

263

client lives. %() expansions are done at

264

runtime with vars(self) as dict, so that for

265

instance %(name)s can be used in the command.

266

current_checker_command: string; current running checker_command

267

approved_delay: datetime.timedelta(); Time to wait for approval

268

_approved: bool(); 'None' if not yet approved/disapproved

269

approved_duration: datetime.timedelta(); Duration of one approval

308

extended_timeout: extra long timeout when password has been sent

309

runtime_expansions: Allowed attributes for runtime expansion.

310

expires: datetime.datetime(); time (UTC) when a client will be

311

disabled, or None

270

312

"""

271

313

272

@staticmethod

273

def _timedelta_to_milliseconds(td):

274

"Convert a datetime.timedelta() to milliseconds"

275

return ((td.days * 24 * 60 * 60 * 1000)

276

+ (td.seconds * 1000)

277

+ (td.microseconds // 1000))

314

runtime_expansions = ("approval_delay", "approval_duration",

315

"created", "enabled", "fingerprint",

316

"host", "interval", "last_checked_ok",

317

"last_enabled", "name", "timeout")

278

318

279

319

def timeout_milliseconds(self):

280

320

"Return the 'timeout' attribute in milliseconds"

281

return self._timedelta_to_milliseconds(self.timeout)

321

return _timedelta_to_milliseconds(self.timeout)

322

323

def extended_timeout_milliseconds(self):

324

"Return the 'extended_timeout' attribute in milliseconds"

325

return _timedelta_to_milliseconds(self.extended_timeout)

282

326

283

327

def interval_milliseconds(self):

284

328

"Return the 'interval' attribute in milliseconds"

285

return self._timedelta_to_milliseconds(self.interval)

286

287

def approved_delay_milliseconds(self):

288

return self._timedelta_to_milliseconds(self.approved_delay)

329

return _timedelta_to_milliseconds(self.interval)

330

331

def approval_delay_milliseconds(self):

332

return _timedelta_to_milliseconds(self.approval_delay)

289

333

290

334

def __init__(self, name = None, disable_hook=None, config=None):

291

335

"""Note: the 'checker' key in 'config' sets the

294

338

self.name = name

295

339

if config is None:

296

340

config = {}

297

logger.debug(u"Creating client %r", self.name)

341

logger.debug("Creating client %r", self.name)

298

342

# Uppercase and remove spaces from fingerprint for later

299

343

# comparison purposes with return value from the fingerprint()

300

344

# function

301

self.fingerprint = (config[u"fingerprint"].upper()

302

.replace(u" ", u""))

303

logger.debug(u" Fingerprint: %s", self.fingerprint)

304

if u"secret" in config:

305

self.secret = config[u"secret"].decode(u"base64")

306

elif u"secfile" in config:

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

347

logger.debug(" Fingerprint: %s", self.fingerprint)

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

307

351

with open(os.path.expanduser(os.path.expandvars

308

(config[u"secfile"])),

352

(config["secfile"])),

309

353

"rb") as secfile:

310

354

self.secret = secfile.read()

311

355

else:

312

#XXX Need to allow secret on demand!

313

raise TypeError(u"No secret or secfile for client %s"

356

raise TypeError("No secret or secfile for client %s"

314

357

% self.name)

315

self.host = config.get(u"host", u"")

358

self.host = config.get("host", "")

316

359

self.created = datetime.datetime.utcnow()

317

360

self.enabled = False

361

self.last_approval_request = None

318

362

self.last_enabled = None

319

363

self.last_checked_ok = None

320

self.timeout = string_to_delta(config[u"timeout"])

321

self.interval = string_to_delta(config[u"interval"])

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

322

368

self.disable_hook = disable_hook

323

369

self.checker = None

324

370

self.checker_initiator_tag = None

325

371

self.disable_initiator_tag = None

372

self.expires = None

326

373

self.checker_callback_tag = None

327

self.checker_command = config[u"checker"]

374

self.checker_command = config["checker"]

328

375

self.current_checker_command = None

329

376

self.last_connect = None

330

377

self._approved = None

331

self.approved_by_default = config.get(u"approved_by_default",

332

False)

333

self.approved_delay = string_to_delta(

334

config[u"approved_delay"])

335

self.approved_duration = string_to_delta(

336

config[u"approved_duration"])

337

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

338

378

self.approved_by_default = config.get("approved_by_default",

379

True)

380

self.approvals_pending = 0

381

self.approval_delay = string_to_delta(

382

config["approval_delay"])

383

self.approval_duration = string_to_delta(

384

config["approval_duration"])

385

self.changedstate = (multiprocessing_manager

386

.Condition(multiprocessing_manager

387

.Lock()))

388

339

389

def send_changedstate(self):

340

390

self.changedstate.acquire()

341

391

self.changedstate.notify_all()

342

392

self.changedstate.release()

343

393

344

394

def enable(self):

345

395

"""Start this client's checker and timeout hooks"""

346

if getattr(self, u"enabled", False):

396

if getattr(self, "enabled", False):

347

397

# Already enabled

348

398

return

349

399

self.send_changedstate()

350

self.last_enabled = datetime.datetime.utcnow()

351

400

# Schedule a new checker to be started an 'interval' from now,

352

401

# and every interval from then on.

353

402

self.checker_initiator_tag = (gobject.timeout_add

354

403

(self.interval_milliseconds(),

355

404

self.start_checker))

356

405

# Schedule a disable() when 'timeout' has passed

406

self.expires = datetime.datetime.utcnow() + self.timeout

357

407

self.disable_initiator_tag = (gobject.timeout_add

358

408

(self.timeout_milliseconds(),

359

409

self.disable))

360

410

self.enabled = True

411

self.last_enabled = datetime.datetime.utcnow()

361

412

# Also start a new checker *right now*.

362

413

self.start_checker()

363

414

368

419

if not quiet:

369

420

self.send_changedstate()

370

421

if not quiet:

371

logger.info(u"Disabling client %s", self.name)

372

if getattr(self, u"disable_initiator_tag", False):

422

logger.info("Disabling client %s", self.name)

423

if getattr(self, "disable_initiator_tag", False):

373

424

gobject.source_remove(self.disable_initiator_tag)

374

425

self.disable_initiator_tag = None

375

if getattr(self, u"checker_initiator_tag", False):

426

self.expires = None

427

if getattr(self, "checker_initiator_tag", False):

376

428

gobject.source_remove(self.checker_initiator_tag)

377

429

self.checker_initiator_tag = None

378

430

self.stop_checker()

393

445

if os.WIFEXITED(condition):

394

446

exitstatus = os.WEXITSTATUS(condition)

395

447

if exitstatus == 0:

396

logger.info(u"Checker for %(name)s succeeded",

448

logger.info("Checker for %(name)s succeeded",

397

449

vars(self))

398

450

self.checked_ok()

399

451

else:

400

logger.info(u"Checker for %(name)s failed",

452

logger.info("Checker for %(name)s failed",

401

453

vars(self))

402

454

else:

403

logger.warning(u"Checker for %(name)s crashed?",

455

logger.warning("Checker for %(name)s crashed?",

404

456

vars(self))

405

457

406

def checked_ok(self):

458

def checked_ok(self, timeout=None):

407

459

"""Bump up the timeout for this client.

408

460

409

461

This should only be called when the client has been seen,

410

462

alive and well.

411

463

"""

464

if timeout is None:

465

timeout = self.timeout

412

466

self.last_checked_ok = datetime.datetime.utcnow()

413

gobject.source_remove(self.disable_initiator_tag)

414

self.disable_initiator_tag = (gobject.timeout_add

415

(self.timeout_milliseconds(),

416

self.disable))

467

if self.disable_initiator_tag is not None:

468

gobject.source_remove(self.disable_initiator_tag)

469

if getattr(self, "enabled", False):

470

self.disable_initiator_tag = (gobject.timeout_add

471

(_timedelta_to_milliseconds

472

(timeout), self.disable))

473

self.expires = datetime.datetime.utcnow() + timeout

474

475

def need_approval(self):

476

self.last_approval_request = datetime.datetime.utcnow()

417

477

418

478

def start_checker(self):

419

479

"""Start a new checker subprocess if one is not running.

432

492

# If a checker exists, make sure it is not a zombie

433

493

try:

434

494

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

435

except (AttributeError, OSError), error:

495

except (AttributeError, OSError) as error:

436

496

if (isinstance(error, OSError)

437

497

and error.errno != errno.ECHILD):

438

498

raise error

439

499

else:

440

500

if pid:

441

logger.warning(u"Checker was a zombie")

501

logger.warning("Checker was a zombie")

442

502

gobject.source_remove(self.checker_callback_tag)

443

503

self.checker_callback(pid, status,

444

504

self.current_checker_command)

449

509

command = self.checker_command % self.host

450

510

except TypeError:

451

511

# Escape attributes for the shell

452

escaped_attrs = dict((key,

453

re.escape(unicode(str(val),

454

errors=

455

u'replace')))

456

for key, val in

457

vars(self).iteritems())

512

escaped_attrs = dict(

513

(attr,

514

re.escape(unicode(str(getattr(self, attr, "")),

515

errors=

516

'replace')))

517

for attr in

518

self.runtime_expansions)

519

458

520

try:

459

521

command = self.checker_command % escaped_attrs

460

except TypeError, error:

461

logger.error(u'Could not format string "%s":'

462

u' %s', self.checker_command, error)

522

except TypeError as error:

523

logger.error('Could not format string "%s":'

524

' %s', self.checker_command, error)

463

525

return True # Try again later

464

526

self.current_checker_command = command

465

527

try:

466

logger.info(u"Starting checker %r for %s",

528

logger.info("Starting checker %r for %s",

467

529

command, self.name)

468

530

# We don't need to redirect stdout and stderr, since

469

531

# in normal mode, that is already done by daemon(),

471

533

# always replaced by /dev/null.)

472

534

self.checker = subprocess.Popen(command,

473

535

close_fds=True,

474

shell=True, cwd=u"/")

536

shell=True, cwd="/")

475

537

self.checker_callback_tag = (gobject.child_watch_add

476

538

(self.checker.pid,

477

539

self.checker_callback,

482

544

if pid:

483

545

gobject.source_remove(self.checker_callback_tag)

484

546

self.checker_callback(pid, status, command)

485

except OSError, error:

486

logger.error(u"Failed to start subprocess: %s",

547

except OSError as error:

548

logger.error("Failed to start subprocess: %s",

487

549

error)

488

550

# Re-run this periodically if run by gobject.timeout_add

489

551

return True

493

555

if self.checker_callback_tag:

494

556

gobject.source_remove(self.checker_callback_tag)

495

557

self.checker_callback_tag = None

496

if getattr(self, u"checker", None) is None:

558

if getattr(self, "checker", None) is None:

497

559

return

498

logger.debug(u"Stopping checker for %(name)s", vars(self))

560

logger.debug("Stopping checker for %(name)s", vars(self))

499

561

try:

500

562

os.kill(self.checker.pid, signal.SIGTERM)

501

563

#time.sleep(0.5)

502

564

#if self.checker.poll() is None:

503

565

# os.kill(self.checker.pid, signal.SIGKILL)

504

except OSError, error:

566

except OSError as error:

505

567

if error.errno != errno.ESRCH: # No such process

506

568

raise

507

569

self.checker = None

508

570

509

def dbus_service_property(dbus_interface, signature=u"v",

510

access=u"readwrite", byte_arrays=False):

571

572

def dbus_service_property(dbus_interface, signature="v",

573

access="readwrite", byte_arrays=False):

511

574

"""Decorators for marking methods of a DBusObjectWithProperties to

512

575

become properties on the D-Bus.

513

576

520

583

"""

521

584

# Encoding deeply encoded byte arrays is not supported yet by the

522

585

# "Set" method, so we fail early here:

523

if byte_arrays and signature != u"ay":

524

raise ValueError(u"Byte arrays not supported for non-'ay'"

525

u" signature %r" % signature)

586

if byte_arrays and signature != "ay":

587

raise ValueError("Byte arrays not supported for non-'ay'"

588

" signature %r" % signature)

526

589

def decorator(func):

527

590

func._dbus_is_property = True

528

591

func._dbus_interface = dbus_interface

529

592

func._dbus_signature = signature

530

593

func._dbus_access = access

531

594

func._dbus_name = func.__name__

532

if func._dbus_name.endswith(u"_dbus_property"):

595

if func._dbus_name.endswith("_dbus_property"):

533

596

func._dbus_name = func._dbus_name[:-14]

534

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

597

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

535

598

return func

536

599

return decorator

537

600

557

620

558

621

class DBusObjectWithProperties(dbus.service.Object):

559

622

"""A D-Bus object with properties.

560

623

561

624

Classes inheriting from this can use the dbus_service_property

562

625

decorator to expose methods as D-Bus properties. It exposes the

563

626

standard Get(), Set(), and GetAll() methods on the D-Bus.

565

628

566

629

@staticmethod

567

630

def _is_dbus_property(obj):

568

return getattr(obj, u"_dbus_is_property", False)

631

return getattr(obj, "_dbus_is_property", False)

569

632

570

633

def _get_all_dbus_properties(self):

571

634

"""Returns a generator of (name, attribute) pairs

572

635

"""

573

return ((prop._dbus_name, prop)

636

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

637

for cls in self.__class__.__mro__

574

638

for name, prop in

575

inspect.getmembers(self, self._is_dbus_property))

639

inspect.getmembers(cls, self._is_dbus_property))

576

640

577

641

def _get_dbus_property(self, interface_name, property_name):

578

642

"""Returns a bound method if one exists which is a D-Bus

579

643

property with the specified name and interface.

580

644

"""

581

for name in (property_name,

582

property_name + u"_dbus_property"):

583

prop = getattr(self, name, None)

584

if (prop is None

585

or not self._is_dbus_property(prop)

586

or prop._dbus_name != property_name

587

or (interface_name and prop._dbus_interface

588

and interface_name != prop._dbus_interface)):

589

continue

590

return prop

645

for cls in self.__class__.__mro__:

646

for name, value in (inspect.getmembers

647

(cls, self._is_dbus_property)):

648

if (value._dbus_name == property_name

649

and value._dbus_interface == interface_name):

650

return value.__get__(self)

651

591

652

# No such property

592

raise DBusPropertyNotFound(self.dbus_object_path + u":"

593

+ interface_name + u"."

653

raise DBusPropertyNotFound(self.dbus_object_path + ":"

654

+ interface_name + "."

594

655

+ property_name)

595

656

596

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

597

out_signature=u"v")

657

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

658

out_signature="v")

598

659

def Get(self, interface_name, property_name):

599

660

"""Standard D-Bus property Get() method, see D-Bus standard.

600

661

"""

601

662

prop = self._get_dbus_property(interface_name, property_name)

602

if prop._dbus_access == u"write":

663

if prop._dbus_access == "write":

603

664

raise DBusPropertyAccessException(property_name)

604

665

value = prop()

605

if not hasattr(value, u"variant_level"):

666

if not hasattr(value, "variant_level"):

606

667

return value

607

668

return type(value)(value, variant_level=value.variant_level+1)

608

669

609

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

670

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

610

671

def Set(self, interface_name, property_name, value):

611

672

"""Standard D-Bus property Set() method, see D-Bus standard.

612

673

"""

613

674

prop = self._get_dbus_property(interface_name, property_name)

614

if prop._dbus_access == u"read":

675

if prop._dbus_access == "read":

615

676

raise DBusPropertyAccessException(property_name)

616

if prop._dbus_get_args_options[u"byte_arrays"]:

677

if prop._dbus_get_args_options["byte_arrays"]:

617

678

# The byte_arrays option is not supported yet on

618

679

# signatures other than "ay".

619

if prop._dbus_signature != u"ay":

680

if prop._dbus_signature != "ay":

620

681

raise ValueError

621

682

value = dbus.ByteArray(''.join(unichr(byte)

622

683

for byte in value))

623

684

prop(value)

624

685

625

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

626

out_signature=u"a{sv}")

686

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

687

out_signature="a{sv}")

627

688

def GetAll(self, interface_name):

628

689

"""Standard D-Bus property GetAll() method, see D-Bus

629

690

standard.

630

691

631

692

Note: Will not include properties with access="write".

632

693

"""

633

694

all = {}

637

698

# Interface non-empty but did not match

638

699

continue

639

700

# Ignore write-only properties

640

if prop._dbus_access == u"write":

701

if prop._dbus_access == "write":

641

702

continue

642

703

value = prop()

643

if not hasattr(value, u"variant_level"):

704

if not hasattr(value, "variant_level"):

644

705

all[name] = value

645

706

continue

646

707

all[name] = type(value)(value, variant_level=

647

708

value.variant_level+1)

648

return dbus.Dictionary(all, signature=u"sv")

709

return dbus.Dictionary(all, signature="sv")

649

710

650

711

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

651

out_signature=u"s",

712

out_signature="s",

652

713

path_keyword='object_path',

653

714

connection_keyword='connection')

654

715

def Introspect(self, object_path, connection):

659

720

try:

660

721

document = xml.dom.minidom.parseString(xmlstring)

661

722

def make_tag(document, name, prop):

662

e = document.createElement(u"property")

663

e.setAttribute(u"name", name)

664

e.setAttribute(u"type", prop._dbus_signature)

665

e.setAttribute(u"access", prop._dbus_access)

723

e = document.createElement("property")

724

e.setAttribute("name", name)

725

e.setAttribute("type", prop._dbus_signature)

726

e.setAttribute("access", prop._dbus_access)

666

727

return e

667

for if_tag in document.getElementsByTagName(u"interface"):

728

for if_tag in document.getElementsByTagName("interface"):

668

729

for tag in (make_tag(document, name, prop)

669

730

for name, prop

670

731

in self._get_all_dbus_properties()

671

732

if prop._dbus_interface

672

== if_tag.getAttribute(u"name")):

733

== if_tag.getAttribute("name")):

673

734

if_tag.appendChild(tag)

674

735

# Add the names to the return values for the

675

736

# "org.freedesktop.DBus.Properties" methods

676

if (if_tag.getAttribute(u"name")

677

== u"org.freedesktop.DBus.Properties"):

678

for cn in if_tag.getElementsByTagName(u"method"):

679

if cn.getAttribute(u"name") == u"Get":

680

for arg in cn.getElementsByTagName(u"arg"):

681

if (arg.getAttribute(u"direction")

682

== u"out"):

683

arg.setAttribute(u"name", u"value")

684

elif cn.getAttribute(u"name") == u"GetAll":

685

for arg in cn.getElementsByTagName(u"arg"):

686

if (arg.getAttribute(u"direction")

687

== u"out"):

688

arg.setAttribute(u"name", u"props")

689

xmlstring = document.toxml(u"utf-8")

737

if (if_tag.getAttribute("name")

738

== "org.freedesktop.DBus.Properties"):

739

for cn in if_tag.getElementsByTagName("method"):

740

if cn.getAttribute("name") == "Get":

741

for arg in cn.getElementsByTagName("arg"):

742

if (arg.getAttribute("direction")

743

== "out"):

744

arg.setAttribute("name", "value")

745

elif cn.getAttribute("name") == "GetAll":

746

for arg in cn.getElementsByTagName("arg"):

747

if (arg.getAttribute("direction")

748

== "out"):

749

arg.setAttribute("name", "props")

750

xmlstring = document.toxml("utf-8")

690

751

document.unlink()

691

752

except (AttributeError, xml.dom.DOMException,

692

xml.parsers.expat.ExpatError), error:

693

logger.error(u"Failed to override Introspection method",

753

xml.parsers.expat.ExpatError) as error:

754

logger.error("Failed to override Introspection method",

694

755

error)

695

756

return xmlstring

696

757

697

758

759

def datetime_to_dbus (dt, variant_level=0):

760

"""Convert a UTC datetime.datetime() to a D-Bus type."""

761

if dt is None:

762

return dbus.String("", variant_level = variant_level)

763

return dbus.String(dt.isoformat(),

764

variant_level=variant_level)

765

766

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

767

.__metaclass__):

768

"""Applied to an empty subclass of a D-Bus object, this metaclass

769

will add additional D-Bus attributes matching a certain pattern.

770

"""

771

def __new__(mcs, name, bases, attr):

772

# Go through all the base classes which could have D-Bus

773

# methods, signals, or properties in them

774

for base in (b for b in bases

775

if issubclass(b, dbus.service.Object)):

776

# Go though all attributes of the base class

777

for attrname, attribute in inspect.getmembers(base):

778

# Ignore non-D-Bus attributes, and D-Bus attributes

779

# with the wrong interface name

780

if (not hasattr(attribute, "_dbus_interface")

781

or not attribute._dbus_interface

782

.startswith("se.recompile.Mandos")):

783

continue

784

# Create an alternate D-Bus interface name based on

785

# the current name

786

alt_interface = (attribute._dbus_interface

787

.replace("se.recompile.Mandos",

788

"se.bsnet.fukt.Mandos"))

789

# Is this a D-Bus signal?

790

if getattr(attribute, "_dbus_is_signal", False):

791

# Extract the original non-method function by

792

# black magic

793

nonmethod_func = (dict(

794

zip(attribute.func_code.co_freevars,

795

attribute.__closure__))["func"]

796

.cell_contents)

797

# Create a new, but exactly alike, function

798

# object, and decorate it to be a new D-Bus signal

799

# with the alternate D-Bus interface name

800

new_function = (dbus.service.signal

801

(alt_interface,

802

attribute._dbus_signature)

803

(types.FunctionType(

804

nonmethod_func.func_code,

805

nonmethod_func.func_globals,

806

nonmethod_func.func_name,

807

nonmethod_func.func_defaults,

808

nonmethod_func.func_closure)))

809

# Define a creator of a function to call both the

810

# old and new functions, so both the old and new

811

# signals gets sent when the function is called

812

def fixscope(func1, func2):

813

"""This function is a scope container to pass

814

func1 and func2 to the "call_both" function

815

outside of its arguments"""

816

def call_both(*args, **kwargs):

817

"""This function will emit two D-Bus

818

signals by calling func1 and func2"""

819

func1(*args, **kwargs)

820

func2(*args, **kwargs)

821

return call_both

822

# Create the "call_both" function and add it to

823

# the class

824

attr[attrname] = fixscope(attribute,

825

new_function)

826

# Is this a D-Bus method?

827

elif getattr(attribute, "_dbus_is_method", False):

828

# Create a new, but exactly alike, function

829

# object. Decorate it to be a new D-Bus method

830

# with the alternate D-Bus interface name. Add it

831

# to the class.

832

attr[attrname] = (dbus.service.method

833

(alt_interface,

834

attribute._dbus_in_signature,

835

attribute._dbus_out_signature)

836

(types.FunctionType

837

(attribute.func_code,

838

attribute.func_globals,

839

attribute.func_name,

840

attribute.func_defaults,

841

attribute.func_closure)))

842

# Is this a D-Bus property?

843

elif getattr(attribute, "_dbus_is_property", False):

844

# Create a new, but exactly alike, function

845

# object, and decorate it to be a new D-Bus

846

# property with the alternate D-Bus interface

847

# name. Add it to the class.

848

attr[attrname] = (dbus_service_property

849

(alt_interface,

850

attribute._dbus_signature,

851

attribute._dbus_access,

852

attribute

853

._dbus_get_args_options

854

["byte_arrays"])

855

(types.FunctionType

856

(attribute.func_code,

857

attribute.func_globals,

858

attribute.func_name,

859

attribute.func_defaults,

860

attribute.func_closure)))

861

return type.__new__(mcs, name, bases, attr)

862

698

863

class ClientDBus(Client, DBusObjectWithProperties):

699

864

"""A Client class using D-Bus

700

865

702

867

dbus_object_path: dbus.ObjectPath

703

868

bus: dbus.SystemBus()

704

869

"""

870

871

runtime_expansions = (Client.runtime_expansions

872

+ ("dbus_object_path",))

873

705

874

# dbus.service.Object doesn't use super(), so we can't either.

706

875

707

876

def __init__(self, bus = None, *args, **kwargs):

877

self._approvals_pending = 0

708

878

self.bus = bus

709

879

Client.__init__(self, *args, **kwargs)

710

880

# Only now, when this client is initialized, can it show up on

711

881

# the D-Bus

882

client_object_name = unicode(self.name).translate(

883

{ord("."): ord("_"),

884

ord("-"): ord("_")})

712

885

self.dbus_object_path = (dbus.ObjectPath

713

(u"/clients/"

714

+ self.name.replace(u".", u"_")))

886

("/clients/" + client_object_name))

715

887

DBusObjectWithProperties.__init__(self, self.bus,

716

888

self.dbus_object_path)

717

718

@staticmethod

719

def _datetime_to_dbus(dt, variant_level=0):

720

"""Convert a UTC datetime.datetime() to a D-Bus type."""

721

return dbus.String(dt.isoformat(),

722

variant_level=variant_level)

723

724

def enable(self):

725

oldstate = getattr(self, u"enabled", False)

726

r = Client.enable(self)

727

if oldstate != self.enabled:

728

# Emit D-Bus signals

729

self.PropertyChanged(dbus.String(u"enabled"),

730

dbus.Boolean(True, variant_level=1))

731

self.PropertyChanged(

732

dbus.String(u"last_enabled"),

733

self._datetime_to_dbus(self.last_enabled,

734

variant_level=1))

735

return r

736

737

def disable(self, quiet = False):

738

oldstate = getattr(self, u"enabled", False)

739

r = Client.disable(self, quiet=quiet)

740

if not quiet and oldstate != self.enabled:

741

# Emit D-Bus signal

742

self.PropertyChanged(dbus.String(u"enabled"),

743

dbus.Boolean(False, variant_level=1))

744

return r

889

890

def notifychangeproperty(transform_func,

891

dbus_name, type_func=lambda x: x,

892

variant_level=1):

893

""" Modify a variable so that it's a property which announces

894

its changes to DBus.

895

896

transform_fun: Function that takes a value and a variant_level

897

and transforms it to a D-Bus type.

898

dbus_name: D-Bus name of the variable

899

type_func: Function that transform the value before sending it

900

to the D-Bus. Default: no transform

901

variant_level: D-Bus variant level. Default: 1

902

"""

903

attrname = "_{0}".format(dbus_name)

904

def setter(self, value):

905

if hasattr(self, "dbus_object_path"):

906

if (not hasattr(self, attrname) or

907

type_func(getattr(self, attrname, None))

908

!= type_func(value)):

909

dbus_value = transform_func(type_func(value),

910

variant_level

911

=variant_level)

912

self.PropertyChanged(dbus.String(dbus_name),

913

dbus_value)

914

setattr(self, attrname, value)

915

916

return property(lambda self: getattr(self, attrname), setter)

917

918

919

expires = notifychangeproperty(datetime_to_dbus, "Expires")

920

approvals_pending = notifychangeproperty(dbus.Boolean,

921

"ApprovalPending",

922

type_func = bool)

923

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

924

last_enabled = notifychangeproperty(datetime_to_dbus,

925

"LastEnabled")

926

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

927

type_func = lambda checker:

928

checker is not None)

929

last_checked_ok = notifychangeproperty(datetime_to_dbus,

930

"LastCheckedOK")

931

last_approval_request = notifychangeproperty(

932

datetime_to_dbus, "LastApprovalRequest")

933

approved_by_default = notifychangeproperty(dbus.Boolean,

934

"ApprovedByDefault")

935

approval_delay = notifychangeproperty(dbus.UInt16,

936

"ApprovalDelay",

937

type_func =

938

_timedelta_to_milliseconds)

939

approval_duration = notifychangeproperty(

940

dbus.UInt16, "ApprovalDuration",

941

type_func = _timedelta_to_milliseconds)

942

host = notifychangeproperty(dbus.String, "Host")

943

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

944

type_func =

945

_timedelta_to_milliseconds)

946

extended_timeout = notifychangeproperty(

947

dbus.UInt16, "ExtendedTimeout",

948

type_func = _timedelta_to_milliseconds)

949

interval = notifychangeproperty(dbus.UInt16,

950

"Interval",

951

type_func =

952

_timedelta_to_milliseconds)

953

checker_command = notifychangeproperty(dbus.String, "Checker")

954

955

del notifychangeproperty

745

956

746

957

def __del__(self, *args, **kwargs):

747

958

try:

748

959

self.remove_from_connection()

749

960

except LookupError:

750

961

pass

751

if hasattr(DBusObjectWithProperties, u"__del__"):

962

if hasattr(DBusObjectWithProperties, "__del__"):

752

963

DBusObjectWithProperties.__del__(self, *args, **kwargs)

753

964

Client.__del__(self, *args, **kwargs)

754

965

756

967

*args, **kwargs):

757

968

self.checker_callback_tag = None

758

969

self.checker = None

759

# Emit D-Bus signal

760

self.PropertyChanged(dbus.String(u"checker_running"),

761

dbus.Boolean(False, variant_level=1))

762

970

if os.WIFEXITED(condition):

763

971

exitstatus = os.WEXITSTATUS(condition)

764

972

# Emit D-Bus signal

774

982

return Client.checker_callback(self, pid, condition, command,

775

983

*args, **kwargs)

776

984

777

def checked_ok(self, *args, **kwargs):

778

r = Client.checked_ok(self, *args, **kwargs)

779

# Emit D-Bus signal

780

self.PropertyChanged(

781

dbus.String(u"last_checked_ok"),

782

(self._datetime_to_dbus(self.last_checked_ok,

783

variant_level=1)))

784

return r

785

786

985

def start_checker(self, *args, **kwargs):

787

986

old_checker = self.checker

788

987

if self.checker is not None:

795

994

and old_checker_pid != self.checker.pid):

796

995

# Emit D-Bus signal

797

996

self.CheckerStarted(self.current_checker_command)

798

self.PropertyChanged(

799

dbus.String(u"checker_running"),

800

dbus.Boolean(True, variant_level=1))

801

997

return r

802

998

803

def stop_checker(self, *args, **kwargs):

804

old_checker = getattr(self, u"checker", None)

805

r = Client.stop_checker(self, *args, **kwargs)

806

if (old_checker is not None

807

and getattr(self, u"checker", None) is None):

808

self.PropertyChanged(dbus.String(u"checker_running"),

809

dbus.Boolean(False, variant_level=1))

810

return r

811

812

999

def _reset_approved(self):

813

1000

self._approved = None

814

1001

return False

815

1002

816

1003

def approve(self, value=True):

1004

self.send_changedstate()

817

1005

self._approved = value

818

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))

1006

gobject.timeout_add(_timedelta_to_milliseconds

1007

(self.approval_duration),

1008

self._reset_approved)

1009

819

1010

820

1011

## D-Bus methods, signals & properties

821

_interface = u"se.bsnet.fukt.Mandos.Client"

1012

_interface = "se.recompile.Mandos.Client"

822

1013

823

1014

## Signals

824

1015

825

1016

# CheckerCompleted - signal

826

@dbus.service.signal(_interface, signature=u"nxs")

1017

@dbus.service.signal(_interface, signature="nxs")

827

1018

def CheckerCompleted(self, exitcode, waitstatus, command):

828

1019

"D-Bus signal"

829

1020

pass

830

1021

831

1022

# CheckerStarted - signal

832

@dbus.service.signal(_interface, signature=u"s")

1023

@dbus.service.signal(_interface, signature="s")

833

1024

def CheckerStarted(self, command):

834

1025

"D-Bus signal"

835

1026

pass

836

1027

837

1028

# PropertyChanged - signal

838

@dbus.service.signal(_interface, signature=u"sv")

1029

@dbus.service.signal(_interface, signature="sv")

839

1030

def PropertyChanged(self, property, value):

840

1031

"D-Bus signal"

841

1032

pass

843

1034

# GotSecret - signal

844

1035

@dbus.service.signal(_interface)

845

1036

def GotSecret(self):

846

"D-Bus signal"

1037

"""D-Bus signal

1038

Is sent after a successful transfer of secret from the Mandos

1039

server to mandos-client

1040

"""

847

1041

pass

848

1042

849

1043

# Rejected - signal

850

@dbus.service.signal(_interface, signature=u"s")

1044

@dbus.service.signal(_interface, signature="s")

851

1045

def Rejected(self, reason):

852

1046

"D-Bus signal"

853

1047

pass

854

1048

855

1049

# NeedApproval - signal

856

@dbus.service.signal(_interface, signature=u"db")

1050

@dbus.service.signal(_interface, signature="tb")

857

1051

def NeedApproval(self, timeout, default):

858

1052

"D-Bus signal"

859

pass

1053

return self.need_approval()

860

1054

861

1055

## Methods

862

1056

863

1057

# Approve - method

864

@dbus.service.method(_interface, in_signature=u"b")

1058

@dbus.service.method(_interface, in_signature="b")

865

1059

def Approve(self, value):

866

1060

self.approve(value)

867

1061

868

1062

# CheckedOK - method

869

1063

@dbus.service.method(_interface)

870

1064

def CheckedOK(self):

871

return self.checked_ok()

1065

self.checked_ok()

872

1066

873

1067

# Enable - method

874

1068

@dbus.service.method(_interface)

895

1089

896

1090

## Properties

897

1091

898

# xxx 3 new properties

899

900

# name - property

901

@dbus_service_property(_interface, signature=u"s", access=u"read")

902

def name_dbus_property(self):

1092

# ApprovalPending - property

1093

@dbus_service_property(_interface, signature="b", access="read")

1094

def ApprovalPending_dbus_property(self):

1095

return dbus.Boolean(bool(self.approvals_pending))

1096

1097

# ApprovedByDefault - property

1098

@dbus_service_property(_interface, signature="b",

1099

access="readwrite")

1100

def ApprovedByDefault_dbus_property(self, value=None):

1101

if value is None: # get

1102

return dbus.Boolean(self.approved_by_default)

1103

self.approved_by_default = bool(value)

1104

1105

# ApprovalDelay - property

1106

@dbus_service_property(_interface, signature="t",

1107

access="readwrite")

1108

def ApprovalDelay_dbus_property(self, value=None):

1109

if value is None: # get

1110

return dbus.UInt64(self.approval_delay_milliseconds())

1111

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1112

1113

# ApprovalDuration - property

1114

@dbus_service_property(_interface, signature="t",

1115

access="readwrite")

1116

def ApprovalDuration_dbus_property(self, value=None):

1117

if value is None: # get

1118

return dbus.UInt64(_timedelta_to_milliseconds(

1119

self.approval_duration))

1120

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1121

1122

# Name - property

1123

@dbus_service_property(_interface, signature="s", access="read")

1124

def Name_dbus_property(self):

903

1125

return dbus.String(self.name)

904

1126

905

# fingerprint - property

906

@dbus_service_property(_interface, signature=u"s", access=u"read")

907

def fingerprint_dbus_property(self):

1127

# Fingerprint - property

1128

@dbus_service_property(_interface, signature="s", access="read")

1129

def Fingerprint_dbus_property(self):

908

1130

return dbus.String(self.fingerprint)

909

1131

910

# host - property

911

@dbus_service_property(_interface, signature=u"s",

912

access=u"readwrite")

913

def host_dbus_property(self, value=None):

1132

# Host - property

1133

@dbus_service_property(_interface, signature="s",

1134

access="readwrite")

1135

def Host_dbus_property(self, value=None):

914

1136

if value is None: # get

915

1137

return dbus.String(self.host)

916

1138

self.host = value

917

# Emit D-Bus signal

918

self.PropertyChanged(dbus.String(u"host"),

919

dbus.String(value, variant_level=1))

920

921

# created - property

922

@dbus_service_property(_interface, signature=u"s", access=u"read")

923

def created_dbus_property(self):

924

return dbus.String(self._datetime_to_dbus(self.created))

925

926

# last_enabled - property

927

@dbus_service_property(_interface, signature=u"s", access=u"read")

928

def last_enabled_dbus_property(self):

929

if self.last_enabled is None:

930

return dbus.String(u"")

931

return dbus.String(self._datetime_to_dbus(self.last_enabled))

932

933

# enabled - property

934

@dbus_service_property(_interface, signature=u"b",

935

access=u"readwrite")

936

def enabled_dbus_property(self, value=None):

1139

1140

# Created - property

1141

@dbus_service_property(_interface, signature="s", access="read")

1142

def Created_dbus_property(self):

1143

return dbus.String(datetime_to_dbus(self.created))

1144

1145

# LastEnabled - property

1146

@dbus_service_property(_interface, signature="s", access="read")

1147

def LastEnabled_dbus_property(self):

1148

return datetime_to_dbus(self.last_enabled)

1149

1150

# Enabled - property

1151

@dbus_service_property(_interface, signature="b",

1152

access="readwrite")

1153

def Enabled_dbus_property(self, value=None):

937

1154

if value is None: # get

938

1155

return dbus.Boolean(self.enabled)

939

1156

if value:

941

1158

else:

942

1159

self.disable()

943

1160

944

# last_checked_ok - property

945

@dbus_service_property(_interface, signature=u"s",

946

access=u"readwrite")

947

def last_checked_ok_dbus_property(self, value=None):

1161

# LastCheckedOK - property

1162

@dbus_service_property(_interface, signature="s",

1163

access="readwrite")

1164

def LastCheckedOK_dbus_property(self, value=None):

948

1165

if value is not None:

949

1166

self.checked_ok()

950

1167

return

951

if self.last_checked_ok is None:

952

return dbus.String(u"")

953

return dbus.String(self._datetime_to_dbus(self

954

.last_checked_ok))

955

956

# timeout - property

957

@dbus_service_property(_interface, signature=u"t",

958

access=u"readwrite")

959

def timeout_dbus_property(self, value=None):

1168

return datetime_to_dbus(self.last_checked_ok)

1169

1170

# Expires - property

1171

@dbus_service_property(_interface, signature="s", access="read")

1172

def Expires_dbus_property(self):

1173

return datetime_to_dbus(self.expires)

1174

1175

# LastApprovalRequest - property

1176

@dbus_service_property(_interface, signature="s", access="read")

1177

def LastApprovalRequest_dbus_property(self):

1178

return datetime_to_dbus(self.last_approval_request)

1179

1180

# Timeout - property

1181

@dbus_service_property(_interface, signature="t",

1182

access="readwrite")

1183

def Timeout_dbus_property(self, value=None):

960

1184

if value is None: # get

961

1185

return dbus.UInt64(self.timeout_milliseconds())

962

1186

self.timeout = datetime.timedelta(0, 0, 0, value)

963

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"timeout"),

965

dbus.UInt64(value, variant_level=1))

966

if getattr(self, u"disable_initiator_tag", None) is None:

1187

if getattr(self, "disable_initiator_tag", None) is None:

967

1188

return

968

1189

# Reschedule timeout

969

1190

gobject.source_remove(self.disable_initiator_tag)

970

1191

self.disable_initiator_tag = None

971

time_to_die = (self.

972

_timedelta_to_milliseconds((self

973

.last_checked_ok

974

+ self.timeout)

975

- datetime.datetime

976

.utcnow()))

1192

self.expires = None

1193

time_to_die = _timedelta_to_milliseconds((self

1194

.last_checked_ok

1195

+ self.timeout)

1196

- datetime.datetime

1197

.utcnow())

977

1198

if time_to_die <= 0:

978

1199

# The timeout has passed

979

1200

self.disable()

980

1201

else:

1202

self.expires = (datetime.datetime.utcnow()

1203

+ datetime.timedelta(milliseconds =

1204

time_to_die))

981

1205

self.disable_initiator_tag = (gobject.timeout_add

982

1206

(time_to_die, self.disable))

983

1207

984

# interval - property

985

@dbus_service_property(_interface, signature=u"t",

986

access=u"readwrite")

987

def interval_dbus_property(self, value=None):

1208

# ExtendedTimeout - property

1209

@dbus_service_property(_interface, signature="t",

1210

access="readwrite")

1211

def ExtendedTimeout_dbus_property(self, value=None):

1212

if value is None: # get

1213

return dbus.UInt64(self.extended_timeout_milliseconds())

1214

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1215

1216

# Interval - property

1217

@dbus_service_property(_interface, signature="t",

1218

access="readwrite")

1219

def Interval_dbus_property(self, value=None):

988

1220

if value is None: # get

989

1221

return dbus.UInt64(self.interval_milliseconds())

990

1222

self.interval = datetime.timedelta(0, 0, 0, value)

991

# Emit D-Bus signal

992

self.PropertyChanged(dbus.String(u"interval"),

993

dbus.UInt64(value, variant_level=1))

994

if getattr(self, u"checker_initiator_tag", None) is None:

1223

if getattr(self, "checker_initiator_tag", None) is None:

995

1224

return

996

1225

# Reschedule checker run

997

1226

gobject.source_remove(self.checker_initiator_tag)

998

1227

self.checker_initiator_tag = (gobject.timeout_add

999

1228

(value, self.start_checker))

1000

1229

self.start_checker() # Start one now, too

1001

1002

# checker - property

1003

@dbus_service_property(_interface, signature=u"s",

1004

access=u"readwrite")

1005

def checker_dbus_property(self, value=None):

1230

1231

# Checker - property

1232

@dbus_service_property(_interface, signature="s",

1233

access="readwrite")

1234

def Checker_dbus_property(self, value=None):

1006

1235

if value is None: # get

1007

1236

return dbus.String(self.checker_command)

1008

1237

self.checker_command = value

1009

# Emit D-Bus signal

1010

self.PropertyChanged(dbus.String(u"checker"),

1011

dbus.String(self.checker_command,

1012

variant_level=1))

1013

1238

1014

# checker_running - property

1015

@dbus_service_property(_interface, signature=u"b",

1016

access=u"readwrite")

1017

def checker_running_dbus_property(self, value=None):

1239

# CheckerRunning - property

1240

@dbus_service_property(_interface, signature="b",

1241

access="readwrite")

1242

def CheckerRunning_dbus_property(self, value=None):

1018

1243

if value is None: # get

1019

1244

return dbus.Boolean(self.checker is not None)

1020

1245

if value:

1022

1247

else:

1023

1248

self.stop_checker()

1024

1249

1025

# object_path - property

1026

@dbus_service_property(_interface, signature=u"o", access=u"read")

1027

def object_path_dbus_property(self):

1250

# ObjectPath - property

1251

@dbus_service_property(_interface, signature="o", access="read")

1252

def ObjectPath_dbus_property(self):

1028

1253

return self.dbus_object_path # is already a dbus.ObjectPath

1029

1254

1030

# secret = property

1031

@dbus_service_property(_interface, signature=u"ay",

1032

access=u"write", byte_arrays=True)

1033

def secret_dbus_property(self, value):

1255

# Secret = property

1256

@dbus_service_property(_interface, signature="ay",

1257

access="write", byte_arrays=True)

1258

def Secret_dbus_property(self, value):

1034

1259

self.secret = str(value)

1035

1260

1036

1261

del _interface

1042

1267

self._pipe.send(('init', fpr, address))

1043

1268

if not self._pipe.recv():

1044

1269

raise KeyError()

1045

1270

1046

1271

def __getattribute__(self, name):

1047

1272

if(name == '_pipe'):

1048

1273

return super(ProxyClient, self).__getattribute__(name)

1055

1280

self._pipe.send(('funcall', name, args, kwargs))

1056

1281

return self._pipe.recv()[1]

1057

1282

return func

1058

1283

1059

1284

def __setattr__(self, name, value):

1060

1285

if(name == '_pipe'):

1061

1286

return super(ProxyClient, self).__setattr__(name, value)

1062

1287

self._pipe.send(('setattr', name, value))

1063

1288

1289

class ClientDBusTransitional(ClientDBus):

1290

__metaclass__ = AlternateDBusNamesMetaclass

1064

1291

1065

1292

class ClientHandler(socketserver.BaseRequestHandler, object):

1066

1293

"""A class to handle client connections.

1070

1297

1071

1298

def handle(self):

1072

1299

with contextlib.closing(self.server.child_pipe) as child_pipe:

1073

logger.info(u"TCP connection from: %s",

1300

logger.info("TCP connection from: %s",

1074

1301

unicode(self.client_address))

1075

logger.debug(u"Pipe FD: %d",

1302

logger.debug("Pipe FD: %d",

1076

1303

self.server.child_pipe.fileno())

1077

1304

1078

1305

session = (gnutls.connection

1079

1306

.ClientSession(self.request,

1080

1307

gnutls.connection

1081

1308

.X509Credentials()))

1082

1309

1083

1310

# Note: gnutls.connection.X509Credentials is really a

1084

1311

# generic GnuTLS certificate credentials object so long as

1085

1312

# no X.509 keys are added to it. Therefore, we can use it

1086

1313

# here despite using OpenPGP certificates.

1087

1088

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1089

# u"+AES-256-CBC", u"+SHA1",

1090

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1091

# u"+DHE-DSS"))

1314

1315

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1316

# "+AES-256-CBC", "+SHA1",

1317

# "+COMP-NULL", "+CTYPE-OPENPGP",

1318

# "+DHE-DSS"))

1092

1319

# Use a fallback default, since this MUST be set.

1093

1320

priority = self.server.gnutls_priority

1094

1321

if priority is None:

1095

priority = u"NORMAL"

1322

priority = "NORMAL"

1096

1323

(gnutls.library.functions

1097

1324

.gnutls_priority_set_direct(session._c_object,

1098

1325

priority, None))

1099

1326

1100

1327

# Start communication using the Mandos protocol

1101

1328

# Get protocol number

1102

1329

line = self.request.makefile().readline()

1103

logger.debug(u"Protocol version: %r", line)

1330

logger.debug("Protocol version: %r", line)

1104

1331

try:

1105

1332

if int(line.strip().split()[0]) > 1:

1106

1333

raise RuntimeError

1107

except (ValueError, IndexError, RuntimeError), error:

1108

logger.error(u"Unknown protocol version: %s", error)

1334

except (ValueError, IndexError, RuntimeError) as error:

1335

logger.error("Unknown protocol version: %s", error)

1109

1336

return

1110

1337

1111

1338

# Start GnuTLS connection

1112

1339

try:

1113

1340

session.handshake()

1114

except gnutls.errors.GNUTLSError, error:

1115

logger.warning(u"Handshake failed: %s", error)

1341

except gnutls.errors.GNUTLSError as error:

1342

logger.warning("Handshake failed: %s", error)

1116

1343

# Do not run session.bye() here: the session is not

1117

1344

# established. Just abandon the request.

1118

1345

return

1119

logger.debug(u"Handshake succeeded")

1346

logger.debug("Handshake succeeded")

1347

1348

approval_required = False

1120

1349

try:

1121

1350

try:

1122

1351

fpr = self.fingerprint(self.peer_certificate

1123

1352

(session))

1124

except (TypeError, gnutls.errors.GNUTLSError), error:

1125

logger.warning(u"Bad certificate: %s", error)

1353

except (TypeError,

1354

gnutls.errors.GNUTLSError) as error:

1355

logger.warning("Bad certificate: %s", error)

1126

1356

return

1127

logger.debug(u"Fingerprint: %s", fpr)

1128

1357

logger.debug("Fingerprint: %s", fpr)

1358

1129

1359

try:

1130

1360

client = ProxyClient(child_pipe, fpr,

1131

1361

self.client_address)

1132

1362

except KeyError:

1133

1363

return

1134

1364

1135

delay = client.approved_delay

1365

if client.approval_delay:

1366

delay = client.approval_delay

1367

client.approvals_pending += 1

1368

approval_required = True

1369

1136

1370

while True:

1137

1371

if not client.enabled:

1138

logger.warning(u"Client %s is disabled",

1372

logger.info("Client %s is disabled",

1139

1373

client.name)

1140

1374

if self.server.use_dbus:

1141

1375

# Emit D-Bus signal

1142

client.Rejected("Disabled")

1376

client.Rejected("Disabled")

1143

1377

return

1144

if client._approved is None:

1145

logger.info(u"Client %s need approval",

1378

1379

if client._approved or not client.approval_delay:

1380

#We are approved or approval is disabled

1381

break

1382

elif client._approved is None:

1383

logger.info("Client %s needs approval",

1146

1384

client.name)

1147

1385

if self.server.use_dbus:

1148

1386

# Emit D-Bus signal

1149

1387

client.NeedApproval(

1150

client.approved_delay_milliseconds(),

1388

client.approval_delay_milliseconds(),

1151

1389

client.approved_by_default)

1152

elif client._approved:

1153

#We have a password and are approved

1154

break

1155

1390

else:

1156

logger.warning(u"Client %s was not approved",

1391

logger.warning("Client %s was not approved",

1157

1392

client.name)

1158

1393

if self.server.use_dbus:

1159

# Emit D-Bus signal

1160

client.Rejected("Disapproved")

1394

# Emit D-Bus signal

1395

client.Rejected("Denied")

1161

1396

return

1162

1397

1163

1398

#wait until timeout or approved

1164

#x = float(client._timedelta_to_milliseconds(delay))

1165

1399

time = datetime.datetime.now()

1166

1400

client.changedstate.acquire()

1167

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1401

(client.changedstate.wait

1402

(float(client._timedelta_to_milliseconds(delay)

1403

/ 1000)))

1168

1404

client.changedstate.release()

1169

1405

time2 = datetime.datetime.now()

1170

1406

if (time2 - time) >= delay:

1174

1410

client.name)

1175

1411

if self.server.use_dbus:

1176

1412

# Emit D-Bus signal

1177

client.Rejected("Time out")

1413

client.Rejected("Approval timed out")

1178

1414

return

1179

1415

else:

1180

1416

break

1183

1419

1184

1420

sent_size = 0

1185

1421

while sent_size < len(client.secret):

1186

# XXX handle session exception

1187

sent = session.send(client.secret[sent_size:])

1188

logger.debug(u"Sent: %d, remaining: %d",

1422

try:

1423

sent = session.send(client.secret[sent_size:])

1424

except gnutls.errors.GNUTLSError as error:

1425

logger.warning("gnutls send failed")

1426

return

1427

logger.debug("Sent: %d, remaining: %d",

1189

1428

sent, len(client.secret)

1190

1429

- (sent_size + sent))

1191

1430

sent_size += sent

1192

1193

logger.info(u"Sending secret to %s", client.name)

1194

# bump the timeout as if seen

1195

client.checked_ok()

1431

1432

logger.info("Sending secret to %s", client.name)

1433

# bump the timeout using extended_timeout

1434

client.checked_ok(client.extended_timeout)

1196

1435

if self.server.use_dbus:

1197

1436

# Emit D-Bus signal

1198

1437

client.GotSecret()

1199

1438

1200

1439

finally:

1201

session.bye()

1440

if approval_required:

1441

client.approvals_pending -= 1

1442

try:

1443

session.bye()

1444

except gnutls.errors.GNUTLSError as error:

1445

logger.warning("GnuTLS bye failed")

1202

1446

1203

1447

@staticmethod

1204

1448

def peer_certificate(session):

1214

1458

.gnutls_certificate_get_peers

1215

1459

(session._c_object, ctypes.byref(list_size)))

1216

1460

if not bool(cert_list) and list_size.value != 0:

1217

raise gnutls.errors.GNUTLSError(u"error getting peer"

1218

u" certificate")

1461

raise gnutls.errors.GNUTLSError("error getting peer"

1462

" certificate")

1219

1463

if list_size.value == 0:

1220

1464

return None

1221

1465

cert = cert_list[0]

1247

1491

if crtverify.value != 0:

1248

1492

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1249

1493

raise (gnutls.errors.CertificateSecurityError

1250

(u"Verify failed"))

1494

("Verify failed"))

1251

1495

# New buffer for the fingerprint

1252

1496

buf = ctypes.create_string_buffer(20)

1253

1497

buf_len = ctypes.c_size_t()

1260

1504

# Convert the buffer to a Python bytestring

1261

1505

fpr = ctypes.string_at(buf, buf_len.value)

1262

1506

# Convert the bytestring to hexadecimal notation

1263

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1264

1508

return hex_fpr

1265

1509

1266

1510

1272

1516

except:

1273

1517

self.handle_error(request, address)

1274

1518

self.close_request(request)

1275

1519

1276

1520

def process_request(self, request, address):

1277

1521

"""Start a new process to process the request."""

1278

multiprocessing.Process(target = self.sub_process_main,

1279

args = (request, address)).start()

1522

proc = multiprocessing.Process(target = self.sub_process_main,

1523

args = (request,

1524

address))

1525

proc.start()

1526

return proc

1527

1280

1528

1281

1529

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1282

1530

""" adds a pipe to the MixIn """

1286

1534

This function creates a new pipe in self.pipe

1287

1535

"""

1288

1536

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1289

1290

super(MultiprocessingMixInWithPipe,

1291

self).process_request(request, client_address)

1292

self.add_pipe(parent_pipe)

1293

def add_pipe(self, parent_pipe):

1537

1538

proc = MultiprocessingMixIn.process_request(self, request,

1539

client_address)

1540

self.child_pipe.close()

1541

self.add_pipe(parent_pipe, proc)

1542

1543

def add_pipe(self, parent_pipe, proc):

1294

1544

"""Dummy function; override as necessary"""

1295

pass

1545

raise NotImplementedError

1546

1296

1547

1297

1548

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1298

1549

socketserver.TCPServer, object):

1316

1567

bind to an address or port if they were not specified."""

1317

1568

if self.interface is not None:

1318

1569

if SO_BINDTODEVICE is None:

1319

logger.error(u"SO_BINDTODEVICE does not exist;"

1320

u" cannot bind to interface %s",

1570

logger.error("SO_BINDTODEVICE does not exist;"

1571

" cannot bind to interface %s",

1321

1572

self.interface)

1322

1573

else:

1323

1574

try:

1324

1575

self.socket.setsockopt(socket.SOL_SOCKET,

1325

1576

SO_BINDTODEVICE,

1326

1577

str(self.interface

1327

+ u'\0'))

1328

except socket.error, error:

1578

+ '\0'))

1579

except socket.error as error:

1329

1580

if error[0] == errno.EPERM:

1330

logger.error(u"No permission to"

1331

u" bind to interface %s",

1581

logger.error("No permission to"

1582

" bind to interface %s",

1332

1583

self.interface)

1333

1584

elif error[0] == errno.ENOPROTOOPT:

1334

logger.error(u"SO_BINDTODEVICE not available;"

1335

u" cannot bind to interface %s",

1585

logger.error("SO_BINDTODEVICE not available;"

1586

" cannot bind to interface %s",

1336

1587

self.interface)

1337

1588

else:

1338

1589

raise

1340

1591

if self.server_address[0] or self.server_address[1]:

1341

1592

if not self.server_address[0]:

1342

1593

if self.address_family == socket.AF_INET6:

1343

any_address = u"::" # in6addr_any

1594

any_address = "::" # in6addr_any

1344

1595

else:

1345

1596

any_address = socket.INADDR_ANY

1346

1597

self.server_address = (any_address,

1383

1634

def server_activate(self):

1384

1635

if self.enabled:

1385

1636

return socketserver.TCPServer.server_activate(self)

1637

1386

1638

def enable(self):

1387

1639

self.enabled = True

1388

def add_pipe(self, parent_pipe):

1640

1641

def add_pipe(self, parent_pipe, proc):

1389

1642

# Call "handle_ipc" for both data and EOF events

1390

1643

gobject.io_add_watch(parent_pipe.fileno(),

1391

1644

gobject.IO_IN | gobject.IO_HUP,

1392

1645

functools.partial(self.handle_ipc,

1393

parent_pipe = parent_pipe))

1394

1646

parent_pipe =

1647

parent_pipe,

1648

proc = proc))

1649

1395

1650

def handle_ipc(self, source, condition, parent_pipe=None,

1396

client_object=None):

1651

proc = None, client_object=None):

1397

1652

condition_names = {

1398

gobject.IO_IN: u"IN", # There is data to read.

1399

gobject.IO_OUT: u"OUT", # Data can be written (without

1653

gobject.IO_IN: "IN", # There is data to read.

1654

gobject.IO_OUT: "OUT", # Data can be written (without

1400

1655

# blocking).

1401

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1402

gobject.IO_ERR: u"ERR", # Error condition.

1403

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1656

gobject.IO_PRI: "PRI", # There is urgent data to read.

1657

gobject.IO_ERR: "ERR", # Error condition.

1658

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1404

1659

# broken, usually for pipes and

1405

1660

# sockets).

1406

1661

}

1408

1663

for cond, name in

1409

1664

condition_names.iteritems()

1410

1665

if cond & condition)

1411

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1412

conditions_string)

1666

# error, or the other end of multiprocessing.Pipe has closed

1667

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1668

# Wait for other process to exit

1669

proc.join()

1670

return False

1413

1671

1414

1672

# Read a request from the child

1415

1673

request = parent_pipe.recv()

1424

1682

client = c

1425

1683

break

1426

1684

else:

1427

logger.warning(u"Client not found for fingerprint: %s, ad"

1428

u"dress: %s", fpr, address)

1685

logger.info("Client not found for fingerprint: %s, ad"

1686

"dress: %s", fpr, address)

1429

1687

if self.use_dbus:

1430

1688

# Emit D-Bus signal

1431

mandos_dbus_service.ClientNotFound(fpr, address)

1689

mandos_dbus_service.ClientNotFound(fpr,

1690

address[0])

1432

1691

parent_pipe.send(False)

1433

1692

return False

1434

1693

1435

1694

gobject.io_add_watch(parent_pipe.fileno(),

1436

1695

gobject.IO_IN | gobject.IO_HUP,

1437

1696

functools.partial(self.handle_ipc,

1438

parent_pipe = parent_pipe,

1439

client_object = client))

1697

parent_pipe =

1698

parent_pipe,

1699

proc = proc,

1700

client_object =

1701

client))

1440

1702

parent_pipe.send(True)

1441

# remove the old hook in favor of the new above hook on same fileno

1703

# remove the old hook in favor of the new above hook on

1704

# same fileno

1442

1705

return False

1443

1706

if command == 'funcall':

1444

1707

funcname = request[1]

1445

1708

args = request[2]

1446

1709

kwargs = request[3]

1447

1710

1448

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1449

1711

parent_pipe.send(('data', getattr(client_object,

1712

funcname)(*args,

1713

**kwargs)))

1714

1450

1715

if command == 'getattr':

1451

1716

attrname = request[1]

1452

1717

if callable(client_object.__getattribute__(attrname)):

1453

1718

parent_pipe.send(('function',))

1454

1719

else:

1455

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1456

1720

parent_pipe.send(('data', client_object

1721

.__getattribute__(attrname)))

1722

1457

1723

if command == 'setattr':

1458

1724

attrname = request[1]

1459

1725

value = request[2]

1460

1726

setattr(client_object, attrname, value)

1461

1727

1462

1728

return True

1463

1729

1464

1730

1465

1731

def string_to_delta(interval):

1466

1732

"""Parse a string and return a datetime.timedelta

1467

1733

1468

>>> string_to_delta(u'7d')

1734

>>> string_to_delta('7d')

1469

1735

datetime.timedelta(7)

1470

>>> string_to_delta(u'60s')

1736

>>> string_to_delta('60s')

1471

1737

datetime.timedelta(0, 60)

1472

>>> string_to_delta(u'60m')

1738

>>> string_to_delta('60m')

1473

1739

datetime.timedelta(0, 3600)

1474

>>> string_to_delta(u'24h')

1740

>>> string_to_delta('24h')

1475

1741

datetime.timedelta(1)

1476

>>> string_to_delta(u'1w')

1742

>>> string_to_delta('1w')

1477

1743

datetime.timedelta(7)

1478

>>> string_to_delta(u'5m 30s')

1744

>>> string_to_delta('5m 30s')

1479

1745

datetime.timedelta(0, 330)

1480

1746

"""

1481

1747

timevalue = datetime.timedelta(0)

1483

1749

try:

1484

1750

suffix = unicode(s[-1])

1485

1751

value = int(s[:-1])

1486

if suffix == u"d":

1752

if suffix == "d":

1487

1753

delta = datetime.timedelta(value)

1488

elif suffix == u"s":

1754

elif suffix == "s":

1489

1755

delta = datetime.timedelta(0, value)

1490

elif suffix == u"m":

1756

elif suffix == "m":

1491

1757

delta = datetime.timedelta(0, 0, 0, 0, value)

1492

elif suffix == u"h":

1758

elif suffix == "h":

1493

1759

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1494

elif suffix == u"w":

1760

elif suffix == "w":

1495

1761

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1496

1762

else:

1497

raise ValueError(u"Unknown suffix %r" % suffix)

1498

except (ValueError, IndexError), e:

1499

raise ValueError(e.message)

1763

raise ValueError("Unknown suffix %r" % suffix)

1764

except (ValueError, IndexError) as e:

1765

raise ValueError(*(e.args))

1500

1766

timevalue += delta

1501

1767

return timevalue

1502

1768

1508

1774

global if_nametoindex

1509

1775

try:

1510

1776

if_nametoindex = (ctypes.cdll.LoadLibrary

1511

(ctypes.util.find_library(u"c"))

1777

(ctypes.util.find_library("c"))

1512

1778

.if_nametoindex)

1513

1779

except (OSError, AttributeError):

1514

logger.warning(u"Doing if_nametoindex the hard way")

1780

logger.warning("Doing if_nametoindex the hard way")

1515

1781

def if_nametoindex(interface):

1516

1782

"Get an interface index the hard way, i.e. using fcntl()"

1517

1783

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1518

1784

with contextlib.closing(socket.socket()) as s:

1519

1785

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1520

struct.pack(str(u"16s16x"),

1786

struct.pack(str("16s16x"),

1521

1787

interface))

1522

interface_index = struct.unpack(str(u"I"),

1788

interface_index = struct.unpack(str("I"),

1523

1789

ifreq[16:20])[0]

1524

1790

return interface_index

1525

1791

return if_nametoindex(interface)

1533

1799

sys.exit()

1534

1800

os.setsid()

1535

1801

if not nochdir:

1536

os.chdir(u"/")

1802

os.chdir("/")

1537

1803

if os.fork():

1538

1804

sys.exit()

1539

1805

if not noclose:

1541

1807

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1542

1808

if not stat.S_ISCHR(os.fstat(null).st_mode):

1543

1809

raise OSError(errno.ENODEV,

1544

u"%s not a character device"

1810

"%s not a character device"

1545

1811

% os.path.devnull)

1546

1812

os.dup2(null, sys.stdin.fileno())

1547

1813

os.dup2(null, sys.stdout.fileno())

1555

1821

##################################################################

1556

1822

# Parsing of options, both command line and config file

1557

1823

1558

parser = optparse.OptionParser(version = "%%prog %s" % version)

1559

parser.add_option("-i", u"--interface", type=u"string",

1560

metavar="IF", help=u"Bind to interface IF")

1561

parser.add_option("-a", u"--address", type=u"string",

1562

help=u"Address to listen for requests on")

1563

parser.add_option("-p", u"--port", type=u"int",

1564

help=u"Port number to receive requests on")

1565

parser.add_option("--check", action=u"store_true",

1566

help=u"Run self-test")

1567

parser.add_option("--debug", action=u"store_true",

1568

help=u"Debug mode; run in foreground and log to"

1569

u" terminal")

1570

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1571

u" priority string (see GnuTLS documentation)")

1572

parser.add_option("--servicename", type=u"string",

1573

metavar=u"NAME", help=u"Zeroconf service name")

1574

parser.add_option("--configdir", type=u"string",

1575

default=u"/etc/mandos", metavar=u"DIR",

1576

help=u"Directory to search for configuration"

1577

u" files")

1578

parser.add_option("--no-dbus", action=u"store_false",

1579

dest=u"use_dbus", help=u"Do not provide D-Bus"

1580

u" system bus interface")

1581

parser.add_option("--no-ipv6", action=u"store_false",

1582

dest=u"use_ipv6", help=u"Do not use IPv6")

1583

options = parser.parse_args()[0]

1824

parser = argparse.ArgumentParser()

1825

parser.add_argument("-v", "--version", action="version",

1826

version = "%%(prog)s %s" % version,

1827

help="show version number and exit")

1828

parser.add_argument("-i", "--interface", metavar="IF",

1829

help="Bind to interface IF")

1830

parser.add_argument("-a", "--address",

1831

help="Address to listen for requests on")

1832

parser.add_argument("-p", "--port", type=int,

1833

help="Port number to receive requests on")

1834

parser.add_argument("--check", action="store_true",

1835

help="Run self-test")

1836

parser.add_argument("--debug", action="store_true",

1837

help="Debug mode; run in foreground and log"

1838

" to terminal")

1839

parser.add_argument("--debuglevel", metavar="LEVEL",

1840

help="Debug level for stdout output")

1841

parser.add_argument("--priority", help="GnuTLS"

1842

" priority string (see GnuTLS documentation)")

1843

parser.add_argument("--servicename",

1844

metavar="NAME", help="Zeroconf service name")

1845

parser.add_argument("--configdir",

1846

default="/etc/mandos", metavar="DIR",

1847

help="Directory to search for configuration"

1848

" files")

1849

parser.add_argument("--no-dbus", action="store_false",

1850

dest="use_dbus", help="Do not provide D-Bus"

1851

" system bus interface")

1852

parser.add_argument("--no-ipv6", action="store_false",

1853

dest="use_ipv6", help="Do not use IPv6")

1854

options = parser.parse_args()

1584

1855

1585

1856

if options.check:

1586

1857

import doctest

1588

1859

sys.exit()

1589

1860

1590

1861

# Default values for config file for server-global settings

1591

server_defaults = { u"interface": u"",

1592

u"address": u"",

1593

u"port": u"",

1594

u"debug": u"False",

1595

u"priority":

1596

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1597

u"servicename": u"Mandos",

1598

u"use_dbus": u"True",

1599

u"use_ipv6": u"True",

1862

server_defaults = { "interface": "",

1863

"address": "",

1864

"port": "",

1865

"debug": "False",

1866

"priority":

1867

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1868

"servicename": "Mandos",

1869

"use_dbus": "True",

1870

"use_ipv6": "True",

1871

"debuglevel": "",

1600

1872

}

1601

1873

1602

1874

# Parse config file for server-global settings

1603

1875

server_config = configparser.SafeConfigParser(server_defaults)

1604

1876

del server_defaults

1605

1877

server_config.read(os.path.join(options.configdir,

1606

u"mandos.conf"))

1878

"mandos.conf"))

1607

1879

# Convert the SafeConfigParser object to a dict

1608

1880

server_settings = server_config.defaults()

1609

1881

# Use the appropriate methods on the non-string config options

1610

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1611

server_settings[option] = server_config.getboolean(u"DEFAULT",

1882

for option in ("debug", "use_dbus", "use_ipv6"):

1883

server_settings[option] = server_config.getboolean("DEFAULT",

1612

1884

option)

1613

1885

if server_settings["port"]:

1614

server_settings["port"] = server_config.getint(u"DEFAULT",

1615

u"port")

1886

server_settings["port"] = server_config.getint("DEFAULT",

1887

"port")

1616

1888

del server_config

1617

1889

1618

1890

# Override the settings from the config file with command line

1619

1891

# options, if set.

1620

for option in (u"interface", u"address", u"port", u"debug",

1621

u"priority", u"servicename", u"configdir",

1622

u"use_dbus", u"use_ipv6"):

1892

for option in ("interface", "address", "port", "debug",

1893

"priority", "servicename", "configdir",

1894

"use_dbus", "use_ipv6", "debuglevel"):

1623

1895

value = getattr(options, option)

1624

1896

if value is not None:

1625

1897

server_settings[option] = value

1633

1905

##################################################################

1634

1906

1635

1907

# For convenience

1636

debug = server_settings[u"debug"]

1637

use_dbus = server_settings[u"use_dbus"]

1638

use_ipv6 = server_settings[u"use_ipv6"]

1639

1640

if not debug:

1641

syslogger.setLevel(logging.WARNING)

1642

console.setLevel(logging.WARNING)

1643

1644

if server_settings[u"servicename"] != u"Mandos":

1908

debug = server_settings["debug"]

1909

debuglevel = server_settings["debuglevel"]

1910

use_dbus = server_settings["use_dbus"]

1911

use_ipv6 = server_settings["use_ipv6"]

1912

1913

if server_settings["servicename"] != "Mandos":

1645

1914

syslogger.setFormatter(logging.Formatter

1646

(u'Mandos (%s) [%%(process)d]:'

1647

u' %%(levelname)s: %%(message)s'

1648

% server_settings[u"servicename"]))

1915

('Mandos (%s) [%%(process)d]:'

1916

' %%(levelname)s: %%(message)s'

1917

% server_settings["servicename"]))

1649

1918

1650

1919

# Parse config file with clients

1651

client_defaults = { u"timeout": u"1h",

1652

u"interval": u"5m",

1653

u"checker": u"fping -q -- %%(host)s",

1654

u"host": u"",

1655

u"approved_delay": u"5m",

1656

u"approved_duration": u"1s",

1920

client_defaults = { "timeout": "5m",

1921

"extended_timeout": "15m",

1922

"interval": "2m",

1923

"checker": "fping -q -- %%(host)s",

1924

"host": "",

1925

"approval_delay": "0s",

1926

"approval_duration": "1s",

1657

1927

}

1658

1928

client_config = configparser.SafeConfigParser(client_defaults)

1659

client_config.read(os.path.join(server_settings[u"configdir"],

1660

u"clients.conf"))

1929

client_config.read(os.path.join(server_settings["configdir"],

1930

"clients.conf"))

1661

1931

1662

1932

global mandos_dbus_service

1663

1933

mandos_dbus_service = None

1664

1934

1665

tcp_server = MandosServer((server_settings[u"address"],

1666

server_settings[u"port"]),

1935

tcp_server = MandosServer((server_settings["address"],

1936

server_settings["port"]),

1667

1937

ClientHandler,

1668

interface=server_settings[u"interface"],

1938

interface=(server_settings["interface"]

1939

or None),

1669

1940

use_ipv6=use_ipv6,

1670

1941

gnutls_priority=

1671

server_settings[u"priority"],

1942

server_settings["priority"],

1672

1943

use_dbus=use_dbus)

1673

pidfilename = u"/var/run/mandos.pid"

1674

try:

1675

pidfile = open(pidfilename, u"w")

1676

except IOError:

1677

logger.error(u"Could not open file %r", pidfilename)

1944

if not debug:

1945

pidfilename = "/var/run/mandos.pid"

1946

try:

1947

pidfile = open(pidfilename, "w")

1948

except IOError:

1949

logger.error("Could not open file %r", pidfilename)

1678

1950

1679

1951

try:

1680

uid = pwd.getpwnam(u"_mandos").pw_uid

1681

gid = pwd.getpwnam(u"_mandos").pw_gid

1952

uid = pwd.getpwnam("_mandos").pw_uid

1953

gid = pwd.getpwnam("_mandos").pw_gid

1682

1954

except KeyError:

1683

1955

try:

1684

uid = pwd.getpwnam(u"mandos").pw_uid

1685

gid = pwd.getpwnam(u"mandos").pw_gid

1956

uid = pwd.getpwnam("mandos").pw_uid

1957

gid = pwd.getpwnam("mandos").pw_gid

1686

1958

except KeyError:

1687

1959

try:

1688

uid = pwd.getpwnam(u"nobody").pw_uid

1689

gid = pwd.getpwnam(u"nobody").pw_gid

1960

uid = pwd.getpwnam("nobody").pw_uid

1961

gid = pwd.getpwnam("nobody").pw_gid

1690

1962

except KeyError:

1691

1963

uid = 65534

1692

1964

gid = 65534

1693

1965

try:

1694

1966

os.setgid(gid)

1695

1967

os.setuid(uid)

1696

except OSError, error:

1968

except OSError as error:

1697

1969

if error[0] != errno.EPERM:

1698

1970

raise error

1699

1971

1700

# Enable all possible GnuTLS debugging

1972

if not debug and not debuglevel:

1973

syslogger.setLevel(logging.WARNING)

1974

console.setLevel(logging.WARNING)

1975

if debuglevel:

1976

level = getattr(logging, debuglevel.upper())

1977

syslogger.setLevel(level)

1978

console.setLevel(level)

1979

1701

1980

if debug:

1981

# Enable all possible GnuTLS debugging

1982

1702

1983

# "Use a log level over 10 to enable all debugging options."

1703

1984

# - GnuTLS manual

1704

1985

gnutls.library.functions.gnutls_global_set_log_level(11)

1705

1986

1706

1987

@gnutls.library.types.gnutls_log_func

1707

1988

def debug_gnutls(level, string):

1708

logger.debug(u"GnuTLS: %s", string[:-1])

1989

logger.debug("GnuTLS: %s", string[:-1])

1709

1990

1710

1991

(gnutls.library.functions

1711

1992

.gnutls_global_set_log_function(debug_gnutls))

1993

1994

# Redirect stdin so all checkers get /dev/null

1995

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1996

os.dup2(null, sys.stdin.fileno())

1997

if null > 2:

1998

os.close(null)

1999

else:

2000

# No console logging

2001

logger.removeHandler(console)

2002

2003

# Need to fork before connecting to D-Bus

2004

if not debug:

2005

# Close all input and output, do double fork, etc.

2006

daemon()

1712

2007

1713

2008

global main_loop

1714

2009

# From the Avahi example code

1718

2013

# End of Avahi example code

1719

2014

if use_dbus:

1720

2015

try:

1721

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2016

bus_name = dbus.service.BusName("se.recompile.Mandos",

1722

2017

bus, do_not_queue=True)

1723

except dbus.exceptions.NameExistsException, e:

1724

logger.error(unicode(e) + u", disabling D-Bus")

2018

old_bus_name = (dbus.service.BusName

2019

("se.bsnet.fukt.Mandos", bus,

2020

do_not_queue=True))

2021

except dbus.exceptions.NameExistsException as e:

2022

logger.error(unicode(e) + ", disabling D-Bus")

1725

2023

use_dbus = False

1726

server_settings[u"use_dbus"] = False

2024

server_settings["use_dbus"] = False

1727

2025

tcp_server.use_dbus = False

1728

2026

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1729

service = AvahiService(name = server_settings[u"servicename"],

1730

servicetype = u"_mandos._tcp",

2027

service = AvahiService(name = server_settings["servicename"],

2028

servicetype = "_mandos._tcp",

1731

2029

protocol = protocol, bus = bus)

1732

2030

if server_settings["interface"]:

1733

2031

service.interface = (if_nametoindex

1734

(str(server_settings[u"interface"])))

2032

(str(server_settings["interface"])))

2033

2034

global multiprocessing_manager

2035

multiprocessing_manager = multiprocessing.Manager()

1735

2036

1736

2037

client_class = Client

1737

2038

if use_dbus:

1738

client_class = functools.partial(ClientDBus, bus = bus)

2039

client_class = functools.partial(ClientDBusTransitional,

2040

bus = bus)

1739

2041

def client_config_items(config, section):

1740

2042

special_settings = {

1741

"approve_by_default":

2043

"approved_by_default":

1742

2044

lambda: config.getboolean(section,

1743

"approve_by_default"),

2045

"approved_by_default"),

1744

2046

}

1745

2047

for name, value in config.items(section):

1746

2048

try:

1747

yield special_settings[name]()

2049

yield (name, special_settings[name]())

1748

2050

except KeyError:

1749

2051

yield (name, value)

1750

2052

1754

2056

client_config, section)))

1755

2057

for section in client_config.sections()))

1756

2058

if not tcp_server.clients:

1757

logger.warning(u"No clients defined")

1758

1759

if debug:

1760

# Redirect stdin so all checkers get /dev/null

1761

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1762

os.dup2(null, sys.stdin.fileno())

1763

if null > 2:

1764

os.close(null)

1765

else:

1766

# No console logging

1767

logger.removeHandler(console)

1768

# Close all input and output, do double fork, etc.

1769

daemon()

1770

1771

try:

1772

with pidfile:

1773

pid = os.getpid()

1774

pidfile.write(str(pid) + "\n")

1775

del pidfile

1776

except IOError:

1777

logger.error(u"Could not write to file %r with PID %d",

1778

pidfilename, pid)

1779

except NameError:

1780

# "pidfile" was never created

1781

pass

1782

del pidfilename

1783

2059

logger.warning("No clients defined")

2060

1784

2061

if not debug:

2062

try:

2063

with pidfile:

2064

pid = os.getpid()

2065

pidfile.write(str(pid) + "\n".encode("utf-8"))

2066

del pidfile

2067

except IOError:

2068

logger.error("Could not write to file %r with PID %d",

2069

pidfilename, pid)

2070

except NameError:

2071

# "pidfile" was never created

2072

pass

2073

del pidfilename

2074

1785

2075

signal.signal(signal.SIGINT, signal.SIG_IGN)

2076

1786

2077

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1787

2078

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1788

2079

1790

2081

class MandosDBusService(dbus.service.Object):

1791

2082

"""A D-Bus proxy object"""

1792

2083

def __init__(self):

1793

dbus.service.Object.__init__(self, bus, u"/")

1794

_interface = u"se.bsnet.fukt.Mandos"

2084

dbus.service.Object.__init__(self, bus, "/")

2085

_interface = "se.recompile.Mandos"

1795

2086

1796

@dbus.service.signal(_interface, signature=u"o")

2087

@dbus.service.signal(_interface, signature="o")

1797

2088

def ClientAdded(self, objpath):

1798

2089

"D-Bus signal"

1799

2090

pass

1800

2091

1801

@dbus.service.signal(_interface, signature=u"ss")

2092

@dbus.service.signal(_interface, signature="ss")

1802

2093

def ClientNotFound(self, fingerprint, address):

1803

2094

"D-Bus signal"

1804

2095

pass

1805

2096

1806

@dbus.service.signal(_interface, signature=u"os")

2097

@dbus.service.signal(_interface, signature="os")

1807

2098

def ClientRemoved(self, objpath, name):

1808

2099

"D-Bus signal"

1809

2100

pass

1810

2101

1811

@dbus.service.method(_interface, out_signature=u"ao")

2102

@dbus.service.method(_interface, out_signature="ao")

1812

2103

def GetAllClients(self):

1813

2104

"D-Bus method"

1814

2105

return dbus.Array(c.dbus_object_path

1815

2106

for c in tcp_server.clients)

1816

2107

1817

2108

@dbus.service.method(_interface,

1818

out_signature=u"a{oa{sv}}")

2109

out_signature="a{oa{sv}}")

1819

2110

def GetAllClientsWithProperties(self):

1820

2111

"D-Bus method"

1821

2112

return dbus.Dictionary(

1822

((c.dbus_object_path, c.GetAll(u""))

2113

((c.dbus_object_path, c.GetAll(""))

1823

2114

for c in tcp_server.clients),

1824

signature=u"oa{sv}")

2115

signature="oa{sv}")

1825

2116

1826

@dbus.service.method(_interface, in_signature=u"o")

2117

@dbus.service.method(_interface, in_signature="o")

1827

2118

def RemoveClient(self, object_path):

1828

2119

"D-Bus method"

1829

2120

for c in tcp_server.clients:

1839

2130

1840

2131

del _interface

1841

2132

1842

mandos_dbus_service = MandosDBusService()

2133

class MandosDBusServiceTransitional(MandosDBusService):

2134

__metaclass__ = AlternateDBusNamesMetaclass

2135

mandos_dbus_service = MandosDBusServiceTransitional()

1843

2136

1844

2137

def cleanup():

1845

2138

"Cleanup function; run on exit"

1846

2139

service.cleanup()

1847

2140

2141

multiprocessing.active_children()

1848

2142

while tcp_server.clients:

1849

2143

client = tcp_server.clients.pop()

1850

2144

if use_dbus:

1854

2148

client.disable(quiet=True)

1855

2149

if use_dbus:

1856

2150

# Emit D-Bus signal

1857

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2151

mandos_dbus_service.ClientRemoved(client

2152

.dbus_object_path,

1858

2153

client.name)

1859

2154

1860

2155

atexit.register(cleanup)

1871

2166

# Find out what port we got

1872

2167

service.port = tcp_server.socket.getsockname()[1]

1873

2168

if use_ipv6:

1874

logger.info(u"Now listening on address %r, port %d,"

2169

logger.info("Now listening on address %r, port %d,"

1875

2170

" flowinfo %d, scope_id %d"

1876

2171

% tcp_server.socket.getsockname())

1877

2172

else: # IPv4

1878

logger.info(u"Now listening on address %r, port %d"

2173

logger.info("Now listening on address %r, port %d"

1879

2174

% tcp_server.socket.getsockname())

1880

2175

1881

2176

#service.interface = tcp_server.socket.getsockname()[3]

1884

2179

# From the Avahi example code

1885

2180

try:

1886

2181

service.activate()

1887

except dbus.exceptions.DBusException, error:

1888

logger.critical(u"DBusException: %s", error)

2182

except dbus.exceptions.DBusException as error:

2183

logger.critical("DBusException: %s", error)

1889

2184

cleanup()

1890

2185

sys.exit(1)

1891

2186

# End of Avahi example code

1895

2190

(tcp_server.handle_request

1896

2191

(*args[2:], **kwargs) or True))

1897

2192

1898

logger.debug(u"Starting main loop")

2193

logger.debug("Starting main loop")

1899

2194

main_loop.run()

1900

except AvahiError, error:

1901

logger.critical(u"AvahiError: %s", error)

2195

except AvahiError as error:

2196

logger.critical("AvahiError: %s", error)

1902

2197

cleanup()

1903

2198

sys.exit(1)

1904

2199

except KeyboardInterrupt:

1905

2200

if debug:

1906

print >> sys.stderr

1907

logger.debug(u"Server received KeyboardInterrupt")

1908

logger.debug(u"Server exiting")

2201

print("", file=sys.stderr)

2202

logger.debug("Server received KeyboardInterrupt")

2203

logger.debug("Server exiting")

1909

2204

# Must run before the D-Bus bus name gets deregistered

1910

2205

cleanup()

1911

2206

2207

1912

2208

if __name__ == '__main__':

1913

2209

main()