/mandos/release : revision 237.16.24

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

61

62

import functools

62

63

import cPickle as pickle

63

64

import multiprocessing

65

import types

64

66

65

67

import dbus

66

68

import dbus.service

81

83

SO_BINDTODEVICE = None

82

84

83

85

84

version = "1.0.14"

86

version = "1.4.1"

85

87

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

88

90

syslogger = (logging.handlers.SysLogHandler

89

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

90

address = "/dev/log"))

92

address = str("/dev/log")))

91

93

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

94

96

logger.addHandler(syslogger)

95

97

96

98

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

100

102

logger.addHandler(console)

101

103

102

104

class AvahiError(Exception):

119

121

Attributes:

120

122

interface: integer; avahi.IF_UNSPEC or an interface index.

121

123

Used to optionally bind to the specified interface.

122

123

type: string; Example: u'_mandos._tcp'.

124

125

type: string; Example: '_mandos._tcp'.

124

126

See <http://www.dns-sd.org/ServiceTypes.html>

125

127

port: integer; what port to announce

126

128

TXT: list of strings; TXT record for the service

135

137

"""

136

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

137

139

servicetype = None, port = None, TXT = None,

138

domain = u"", host = u"", max_renames = 32768,

140

domain = "", host = "", max_renames = 32768,

139

141

protocol = avahi.PROTO_UNSPEC, bus = None):

140

142

self.interface = interface

141

143

self.name = name

150

152

self.group = None # our entry group

151

153

self.server = None

152

154

self.bus = bus

155

self.entry_group_state_changed_match = None

153

156

def rename(self):

154

157

"""Derived from the Avahi example code"""

155

158

if self.rename_count >= self.max_renames:

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

158

161

self.rename_count)

159

raise AvahiServiceError(u"Too many renames")

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server

164

.GetAlternativeServiceName(self.name))

165

logger.info("Changing Zeroconf service name to %r ...",

162

166

self.name)

163

167

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

166

170

% self.name))

167

171

self.remove()

168

172

try:

169

173

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

174

except dbus.exceptions.DBusException as error:

175

logger.critical("DBusException: %s", error)

172

176

self.cleanup()

173

177

os._exit(1)

174

178

self.rename_count += 1

175

179

def remove(self):

176

180

"""Derived from the Avahi example code"""

181

if self.entry_group_state_changed_match is not None:

182

self.entry_group_state_changed_match.remove()

183

self.entry_group_state_changed_match = None

177

184

if self.group is not None:

178

185

self.group.Reset()

179

186

def add(self):

180

187

"""Derived from the Avahi example code"""

188

self.remove()

181

189

if self.group is None:

182

190

self.group = dbus.Interface(

183

191

self.bus.get_object(avahi.DBUS_NAME,

184

192

self.server.EntryGroupNew()),

185

193

avahi.DBUS_INTERFACE_ENTRY_GROUP)

186

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

194

self.entry_group_state_changed_match = (

195

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

190

198

self.name, self.type)

191

199

self.group.AddService(

192

200

self.interface,

199

207

self.group.Commit()

200

208

def entry_group_state_changed(self, state, error):

201

209

"""Derived from the Avahi example code"""

202

logger.debug(u"Avahi entry group state change: %i", state)

210

logger.debug("Avahi entry group state change: %i", state)

203

211

204

212

if state == avahi.ENTRY_GROUP_ESTABLISHED:

205

logger.debug(u"Zeroconf service established.")

213

logger.debug("Zeroconf service established.")

206

214

elif state == avahi.ENTRY_GROUP_COLLISION:

207

logger.warning(u"Zeroconf service name collision.")

215

logger.info("Zeroconf service name collision.")

208

216

self.rename()

209

217

elif state == avahi.ENTRY_GROUP_FAILURE:

210

logger.critical(u"Avahi: Error in group state changed %s",

218

logger.critical("Avahi: Error in group state changed %s",

211

219

unicode(error))

212

raise AvahiGroupError(u"State changed: %s"

220

raise AvahiGroupError("State changed: %s"

213

221

% unicode(error))

214

222

def cleanup(self):

215

223

"""Derived from the Avahi example code"""

216

224

if self.group is not None:

217

self.group.Free()

225

try:

226

self.group.Free()

227

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

229

pass

218

230

self.group = None

219

def server_state_changed(self, state):

231

self.remove()

232

def server_state_changed(self, state, error=None):

220

233

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

222

if state == avahi.SERVER_COLLISION:

223

logger.error(u"Zeroconf server name collision")

224

self.remove()

234

logger.debug("Avahi server state change: %i", state)

235

bad_states = { avahi.SERVER_INVALID:

236

"Zeroconf server invalid",

237

avahi.SERVER_REGISTERING: None,

238

avahi.SERVER_COLLISION:

239

"Zeroconf server name collision",

240

avahi.SERVER_FAILURE:

241

"Zeroconf server failure" }

242

if state in bad_states:

243

if bad_states[state] is not None:

244

if error is None:

245

logger.error(bad_states[state])

246

else:

247

logger.error(bad_states[state] + ": %r", error)

248

self.cleanup()

225

249

elif state == avahi.SERVER_RUNNING:

226

250

self.add()

251

else:

252

if error is None:

253

logger.debug("Unknown state: %r", state)

254

else:

255

logger.debug("Unknown state: %r: %r", state, error)

227

256

def activate(self):

228

257

"""Derived from the Avahi example code"""

229

258

if self.server is None:

230

259

self.server = dbus.Interface(

231

260

self.bus.get_object(avahi.DBUS_NAME,

232

avahi.DBUS_PATH_SERVER),

261

avahi.DBUS_PATH_SERVER,

262

follow_name_owner_changes=True),

233

263

avahi.DBUS_INTERFACE_SERVER)

234

self.server.connect_to_signal(u"StateChanged",

264

self.server.connect_to_signal("StateChanged",

235

265

self.server_state_changed)

236

266

self.server_state_changed(self.server.GetState())

237

267

238

268

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

274

239

275

class Client(object):

240

276

"""A representation of a client host served by this server.

241

277

246

282

checker: subprocess.Popen(); a running checker process used

247

283

to see if the client lives.

248

284

'None' if no process is running.

249

checker_callback_tag: - '' -

285

checker_callback_tag: a gobject event source tag, or None

250

286

checker_command: string; External command which is run to check

251

287

if client lives. %() expansions are done at

252

288

runtime with vars(self) as dict, so that for

255

291

created: datetime.datetime(); (UTC) object creation

256

292

current_checker_command: string; current running checker_command

257

293

disable_hook: If set, called by disable() as disable_hook(self)

258

disable_initiator_tag: - '' -

294

disable_initiator_tag: a gobject event source tag, or None

259

295

enabled: bool()

260

296

fingerprint: string (40 or 32 hexadecimal digits); used to

261

297

uniquely identify the client

262

298

host: string; available for use by the checker command

263

299

interval: datetime.timedelta(); How often to start a new checker

300

last_approval_request: datetime.datetime(); (UTC) or None

264

301

last_checked_ok: datetime.datetime(); (UTC) or None

265

302

last_enabled: datetime.datetime(); (UTC)

266

303

268

305

secret: bytestring; sent verbatim (over TLS) to client

269

306

timeout: datetime.timedelta(); How long from last_checked_ok

270

307

until this client is disabled

308

extended_timeout: extra long timeout when password has been sent

271

309

runtime_expansions: Allowed attributes for runtime expansion.

310

expires: datetime.datetime(); time (UTC) when a client will be

311

disabled, or None

272

312

"""

273

313

274

runtime_expansions = (u"approval_delay", u"approval_duration",

275

u"created", u"enabled", u"fingerprint",

276

u"host", u"interval", u"last_checked_ok",

277

u"last_enabled", u"name", u"timeout")

278

279

@staticmethod

280

def _timedelta_to_milliseconds(td):

281

"Convert a datetime.timedelta() to milliseconds"

282

return ((td.days * 24 * 60 * 60 * 1000)

283

+ (td.seconds * 1000)

284

+ (td.microseconds // 1000))

314

runtime_expansions = ("approval_delay", "approval_duration",

315

"created", "enabled", "fingerprint",

316

"host", "interval", "last_checked_ok",

317

"last_enabled", "name", "timeout")

285

318

286

319

def timeout_milliseconds(self):

287

320

"Return the 'timeout' attribute in milliseconds"

288

return self._timedelta_to_milliseconds(self.timeout)

321

return _timedelta_to_milliseconds(self.timeout)

322

323

def extended_timeout_milliseconds(self):

324

"Return the 'extended_timeout' attribute in milliseconds"

325

return _timedelta_to_milliseconds(self.extended_timeout)

289

326

290

327

def interval_milliseconds(self):

291

328

"Return the 'interval' attribute in milliseconds"

292

return self._timedelta_to_milliseconds(self.interval)

293

329

return _timedelta_to_milliseconds(self.interval)

330

294

331

def approval_delay_milliseconds(self):

295

return self._timedelta_to_milliseconds(self.approval_delay)

332

return _timedelta_to_milliseconds(self.approval_delay)

296

333

297

334

def __init__(self, name = None, disable_hook=None, config=None):

298

335

"""Note: the 'checker' key in 'config' sets the

301

338

self.name = name

302

339

if config is None:

303

340

config = {}

304

logger.debug(u"Creating client %r", self.name)

341

logger.debug("Creating client %r", self.name)

305

342

# Uppercase and remove spaces from fingerprint for later

306

343

# comparison purposes with return value from the fingerprint()

307

344

# function

308

self.fingerprint = (config[u"fingerprint"].upper()

309

.replace(u" ", u""))

310

logger.debug(u" Fingerprint: %s", self.fingerprint)

311

if u"secret" in config:

312

self.secret = config[u"secret"].decode(u"base64")

313

elif u"secfile" in config:

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

347

logger.debug(" Fingerprint: %s", self.fingerprint)

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

314

351

with open(os.path.expanduser(os.path.expandvars

315

(config[u"secfile"])),

352

(config["secfile"])),

316

353

"rb") as secfile:

317

354

self.secret = secfile.read()

318

355

else:

319

raise TypeError(u"No secret or secfile for client %s"

356

raise TypeError("No secret or secfile for client %s"

320

357

% self.name)

321

self.host = config.get(u"host", u"")

358

self.host = config.get("host", "")

322

359

self.created = datetime.datetime.utcnow()

323

360

self.enabled = False

361

self.last_approval_request = None

324

362

self.last_enabled = None

325

363

self.last_checked_ok = None

326

self.timeout = string_to_delta(config[u"timeout"])

327

self.interval = string_to_delta(config[u"interval"])

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

328

368

self.disable_hook = disable_hook

329

369

self.checker = None

330

370

self.checker_initiator_tag = None

331

371

self.disable_initiator_tag = None

372

self.expires = None

332

373

self.checker_callback_tag = None

333

self.checker_command = config[u"checker"]

374

self.checker_command = config["checker"]

334

375

self.current_checker_command = None

335

376

self.last_connect = None

336

377

self._approved = None

337

self.approved_by_default = config.get(u"approved_by_default",

378

self.approved_by_default = config.get("approved_by_default",

338

379

True)

339

380

self.approvals_pending = 0

340

381

self.approval_delay = string_to_delta(

341

config[u"approval_delay"])

382

config["approval_delay"])

342

383

self.approval_duration = string_to_delta(

343

config[u"approval_duration"])

344

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

384

config["approval_duration"])

385

self.changedstate = (multiprocessing_manager

386

.Condition(multiprocessing_manager

387

.Lock()))

345

388

346

389

def send_changedstate(self):

347

390

self.changedstate.acquire()

348

391

self.changedstate.notify_all()

349

392

self.changedstate.release()

350

393

351

394

def enable(self):

352

395

"""Start this client's checker and timeout hooks"""

353

if getattr(self, u"enabled", False):

396

if getattr(self, "enabled", False):

354

397

# Already enabled

355

398

return

356

399

self.send_changedstate()

357

self.last_enabled = datetime.datetime.utcnow()

358

400

# Schedule a new checker to be started an 'interval' from now,

359

401

# and every interval from then on.

360

402

self.checker_initiator_tag = (gobject.timeout_add

361

403

(self.interval_milliseconds(),

362

404

self.start_checker))

363

405

# Schedule a disable() when 'timeout' has passed

406

self.expires = datetime.datetime.utcnow() + self.timeout

364

407

self.disable_initiator_tag = (gobject.timeout_add

365

408

(self.timeout_milliseconds(),

366

409

self.disable))

367

410

self.enabled = True

411

self.last_enabled = datetime.datetime.utcnow()

368

412

# Also start a new checker *right now*.

369

413

self.start_checker()

370

414

375

419

if not quiet:

376

420

self.send_changedstate()

377

421

if not quiet:

378

logger.info(u"Disabling client %s", self.name)

379

if getattr(self, u"disable_initiator_tag", False):

422

logger.info("Disabling client %s", self.name)

423

if getattr(self, "disable_initiator_tag", False):

380

424

gobject.source_remove(self.disable_initiator_tag)

381

425

self.disable_initiator_tag = None

382

if getattr(self, u"checker_initiator_tag", False):

426

self.expires = None

427

if getattr(self, "checker_initiator_tag", False):

383

428

gobject.source_remove(self.checker_initiator_tag)

384

429

self.checker_initiator_tag = None

385

430

self.stop_checker()

400

445

if os.WIFEXITED(condition):

401

446

exitstatus = os.WEXITSTATUS(condition)

402

447

if exitstatus == 0:

403

logger.info(u"Checker for %(name)s succeeded",

448

logger.info("Checker for %(name)s succeeded",

404

449

vars(self))

405

450

self.checked_ok()

406

451

else:

407

logger.info(u"Checker for %(name)s failed",

452

logger.info("Checker for %(name)s failed",

408

453

vars(self))

409

454

else:

410

logger.warning(u"Checker for %(name)s crashed?",

455

logger.warning("Checker for %(name)s crashed?",

411

456

vars(self))

412

457

413

def checked_ok(self):

458

def checked_ok(self, timeout=None):

414

459

"""Bump up the timeout for this client.

415

460

416

461

This should only be called when the client has been seen,

417

462

alive and well.

418

463

"""

464

if timeout is None:

465

timeout = self.timeout

419

466

self.last_checked_ok = datetime.datetime.utcnow()

420

gobject.source_remove(self.disable_initiator_tag)

421

self.disable_initiator_tag = (gobject.timeout_add

422

(self.timeout_milliseconds(),

423

self.disable))

467

if self.disable_initiator_tag is not None:

468

gobject.source_remove(self.disable_initiator_tag)

469

if getattr(self, "enabled", False):

470

self.disable_initiator_tag = (gobject.timeout_add

471

(_timedelta_to_milliseconds

472

(timeout), self.disable))

473

self.expires = datetime.datetime.utcnow() + timeout

474

475

def need_approval(self):

476

self.last_approval_request = datetime.datetime.utcnow()

424

477

425

478

def start_checker(self):

426

479

"""Start a new checker subprocess if one is not running.

439

492

# If a checker exists, make sure it is not a zombie

440

493

try:

441

494

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

442

except (AttributeError, OSError), error:

495

except (AttributeError, OSError) as error:

443

496

if (isinstance(error, OSError)

444

497

and error.errno != errno.ECHILD):

445

498

raise error

446

499

else:

447

500

if pid:

448

logger.warning(u"Checker was a zombie")

501

logger.warning("Checker was a zombie")

449

502

gobject.source_remove(self.checker_callback_tag)

450

503

self.checker_callback(pid, status,

451

504

self.current_checker_command)

458

511

# Escape attributes for the shell

459

512

escaped_attrs = dict(

460

513

(attr,

461

re.escape(unicode(str(getattr(self, attr, u"")),

514

re.escape(unicode(str(getattr(self, attr, "")),

462

515

errors=

463

u'replace')))

516

'replace')))

464

517

for attr in

465

518

self.runtime_expansions)

466

519

467

520

try:

468

521

command = self.checker_command % escaped_attrs

469

except TypeError, error:

470

logger.error(u'Could not format string "%s":'

471

u' %s', self.checker_command, error)

522

except TypeError as error:

523

logger.error('Could not format string "%s":'

524

' %s', self.checker_command, error)

472

525

return True # Try again later

473

526

self.current_checker_command = command

474

527

try:

475

logger.info(u"Starting checker %r for %s",

528

logger.info("Starting checker %r for %s",

476

529

command, self.name)

477

530

# We don't need to redirect stdout and stderr, since

478

531

# in normal mode, that is already done by daemon(),

480

533

# always replaced by /dev/null.)

481

534

self.checker = subprocess.Popen(command,

482

535

close_fds=True,

483

shell=True, cwd=u"/")

536

shell=True, cwd="/")

484

537

self.checker_callback_tag = (gobject.child_watch_add

485

538

(self.checker.pid,

486

539

self.checker_callback,

491

544

if pid:

492

545

gobject.source_remove(self.checker_callback_tag)

493

546

self.checker_callback(pid, status, command)

494

except OSError, error:

495

logger.error(u"Failed to start subprocess: %s",

547

except OSError as error:

548

logger.error("Failed to start subprocess: %s",

496

549

error)

497

550

# Re-run this periodically if run by gobject.timeout_add

498

551

return True

502

555

if self.checker_callback_tag:

503

556

gobject.source_remove(self.checker_callback_tag)

504

557

self.checker_callback_tag = None

505

if getattr(self, u"checker", None) is None:

558

if getattr(self, "checker", None) is None:

506

559

return

507

logger.debug(u"Stopping checker for %(name)s", vars(self))

560

logger.debug("Stopping checker for %(name)s", vars(self))

508

561

try:

509

562

os.kill(self.checker.pid, signal.SIGTERM)

510

563

#time.sleep(0.5)

511

564

#if self.checker.poll() is None:

512

565

# os.kill(self.checker.pid, signal.SIGKILL)

513

except OSError, error:

566

except OSError as error:

514

567

if error.errno != errno.ESRCH: # No such process

515

568

raise

516

569

self.checker = None

517

570

518

def dbus_service_property(dbus_interface, signature=u"v",

519

access=u"readwrite", byte_arrays=False):

571

572

def dbus_service_property(dbus_interface, signature="v",

573

access="readwrite", byte_arrays=False):

520

574

"""Decorators for marking methods of a DBusObjectWithProperties to

521

575

become properties on the D-Bus.

522

576

529

583

"""

530

584

# Encoding deeply encoded byte arrays is not supported yet by the

531

585

# "Set" method, so we fail early here:

532

if byte_arrays and signature != u"ay":

533

raise ValueError(u"Byte arrays not supported for non-'ay'"

534

u" signature %r" % signature)

586

if byte_arrays and signature != "ay":

587

raise ValueError("Byte arrays not supported for non-'ay'"

588

" signature %r" % signature)

535

589

def decorator(func):

536

590

func._dbus_is_property = True

537

591

func._dbus_interface = dbus_interface

538

592

func._dbus_signature = signature

539

593

func._dbus_access = access

540

594

func._dbus_name = func.__name__

541

if func._dbus_name.endswith(u"_dbus_property"):

595

if func._dbus_name.endswith("_dbus_property"):

542

596

func._dbus_name = func._dbus_name[:-14]

543

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

597

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

544

598

return func

545

599

return decorator

546

600

566

620

567

621

class DBusObjectWithProperties(dbus.service.Object):

568

622

"""A D-Bus object with properties.

569

623

570

624

Classes inheriting from this can use the dbus_service_property

571

625

decorator to expose methods as D-Bus properties. It exposes the

572

626

standard Get(), Set(), and GetAll() methods on the D-Bus.

574

628

575

629

@staticmethod

576

630

def _is_dbus_property(obj):

577

return getattr(obj, u"_dbus_is_property", False)

631

return getattr(obj, "_dbus_is_property", False)

578

632

579

633

def _get_all_dbus_properties(self):

580

634

"""Returns a generator of (name, attribute) pairs

581

635

"""

582

return ((prop._dbus_name, prop)

636

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

637

for cls in self.__class__.__mro__

583

638

for name, prop in

584

inspect.getmembers(self, self._is_dbus_property))

639

inspect.getmembers(cls, self._is_dbus_property))

585

640

586

641

def _get_dbus_property(self, interface_name, property_name):

587

642

"""Returns a bound method if one exists which is a D-Bus

588

643

property with the specified name and interface.

589

644

"""

590

for name in (property_name,

591

property_name + u"_dbus_property"):

592

prop = getattr(self, name, None)

593

if (prop is None

594

or not self._is_dbus_property(prop)

595

or prop._dbus_name != property_name

596

or (interface_name and prop._dbus_interface

597

and interface_name != prop._dbus_interface)):

598

continue

599

return prop

645

for cls in self.__class__.__mro__:

646

for name, value in (inspect.getmembers

647

(cls, self._is_dbus_property)):

648

if (value._dbus_name == property_name

649

and value._dbus_interface == interface_name):

650

return value.__get__(self)

651

600

652

# No such property

601

raise DBusPropertyNotFound(self.dbus_object_path + u":"

602

+ interface_name + u"."

653

raise DBusPropertyNotFound(self.dbus_object_path + ":"

654

+ interface_name + "."

603

655

+ property_name)

604

656

605

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

606

out_signature=u"v")

657

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

658

out_signature="v")

607

659

def Get(self, interface_name, property_name):

608

660

"""Standard D-Bus property Get() method, see D-Bus standard.

609

661

"""

610

662

prop = self._get_dbus_property(interface_name, property_name)

611

if prop._dbus_access == u"write":

663

if prop._dbus_access == "write":

612

664

raise DBusPropertyAccessException(property_name)

613

665

value = prop()

614

if not hasattr(value, u"variant_level"):

666

if not hasattr(value, "variant_level"):

615

667

return value

616

668

return type(value)(value, variant_level=value.variant_level+1)

617

669

618

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

670

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

619

671

def Set(self, interface_name, property_name, value):

620

672

"""Standard D-Bus property Set() method, see D-Bus standard.

621

673

"""

622

674

prop = self._get_dbus_property(interface_name, property_name)

623

if prop._dbus_access == u"read":

675

if prop._dbus_access == "read":

624

676

raise DBusPropertyAccessException(property_name)

625

if prop._dbus_get_args_options[u"byte_arrays"]:

677

if prop._dbus_get_args_options["byte_arrays"]:

626

678

# The byte_arrays option is not supported yet on

627

679

# signatures other than "ay".

628

if prop._dbus_signature != u"ay":

680

if prop._dbus_signature != "ay":

629

681

raise ValueError

630

682

value = dbus.ByteArray(''.join(unichr(byte)

631

683

for byte in value))

632

684

prop(value)

633

685

634

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

635

out_signature=u"a{sv}")

686

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

687

out_signature="a{sv}")

636

688

def GetAll(self, interface_name):

637

689

"""Standard D-Bus property GetAll() method, see D-Bus

638

690

standard.

639

691

640

692

Note: Will not include properties with access="write".

641

693

"""

642

694

all = {}

646

698

# Interface non-empty but did not match

647

699

continue

648

700

# Ignore write-only properties

649

if prop._dbus_access == u"write":

701

if prop._dbus_access == "write":

650

702

continue

651

703

value = prop()

652

if not hasattr(value, u"variant_level"):

704

if not hasattr(value, "variant_level"):

653

705

all[name] = value

654

706

continue

655

707

all[name] = type(value)(value, variant_level=

656

708

value.variant_level+1)

657

return dbus.Dictionary(all, signature=u"sv")

709

return dbus.Dictionary(all, signature="sv")

658

710

659

711

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

660

out_signature=u"s",

712

out_signature="s",

661

713

path_keyword='object_path',

662

714

connection_keyword='connection')

663

715

def Introspect(self, object_path, connection):

668

720

try:

669

721

document = xml.dom.minidom.parseString(xmlstring)

670

722

def make_tag(document, name, prop):

671

e = document.createElement(u"property")

672

e.setAttribute(u"name", name)

673

e.setAttribute(u"type", prop._dbus_signature)

674

e.setAttribute(u"access", prop._dbus_access)

723

e = document.createElement("property")

724

e.setAttribute("name", name)

725

e.setAttribute("type", prop._dbus_signature)

726

e.setAttribute("access", prop._dbus_access)

675

727

return e

676

for if_tag in document.getElementsByTagName(u"interface"):

728

for if_tag in document.getElementsByTagName("interface"):

677

729

for tag in (make_tag(document, name, prop)

678

730

for name, prop

679

731

in self._get_all_dbus_properties()

680

732

if prop._dbus_interface

681

== if_tag.getAttribute(u"name")):

733

== if_tag.getAttribute("name")):

682

734

if_tag.appendChild(tag)

683

735

# Add the names to the return values for the

684

736

# "org.freedesktop.DBus.Properties" methods

685

if (if_tag.getAttribute(u"name")

686

== u"org.freedesktop.DBus.Properties"):

687

for cn in if_tag.getElementsByTagName(u"method"):

688

if cn.getAttribute(u"name") == u"Get":

689

for arg in cn.getElementsByTagName(u"arg"):

690

if (arg.getAttribute(u"direction")

691

== u"out"):

692

arg.setAttribute(u"name", u"value")

693

elif cn.getAttribute(u"name") == u"GetAll":

694

for arg in cn.getElementsByTagName(u"arg"):

695

if (arg.getAttribute(u"direction")

696

== u"out"):

697

arg.setAttribute(u"name", u"props")

698

xmlstring = document.toxml(u"utf-8")

737

if (if_tag.getAttribute("name")

738

== "org.freedesktop.DBus.Properties"):

739

for cn in if_tag.getElementsByTagName("method"):

740

if cn.getAttribute("name") == "Get":

741

for arg in cn.getElementsByTagName("arg"):

742

if (arg.getAttribute("direction")

743

== "out"):

744

arg.setAttribute("name", "value")

745

elif cn.getAttribute("name") == "GetAll":

746

for arg in cn.getElementsByTagName("arg"):

747

if (arg.getAttribute("direction")

748

== "out"):

749

arg.setAttribute("name", "props")

750

xmlstring = document.toxml("utf-8")

699

751

document.unlink()

700

752

except (AttributeError, xml.dom.DOMException,

701

xml.parsers.expat.ExpatError), error:

702

logger.error(u"Failed to override Introspection method",

753

xml.parsers.expat.ExpatError) as error:

754

logger.error("Failed to override Introspection method",

703

755

error)

704

756

return xmlstring

705

757

706

758

759

def datetime_to_dbus (dt, variant_level=0):

760

"""Convert a UTC datetime.datetime() to a D-Bus type."""

761

if dt is None:

762

return dbus.String("", variant_level = variant_level)

763

return dbus.String(dt.isoformat(),

764

variant_level=variant_level)

765

766

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

767

.__metaclass__):

768

"""Applied to an empty subclass of a D-Bus object, this metaclass

769

will add additional D-Bus attributes matching a certain pattern.

770

"""

771

def __new__(mcs, name, bases, attr):

772

# Go through all the base classes which could have D-Bus

773

# methods, signals, or properties in them

774

for base in (b for b in bases

775

if issubclass(b, dbus.service.Object)):

776

# Go though all attributes of the base class

777

for attrname, attribute in inspect.getmembers(base):

778

# Ignore non-D-Bus attributes, and D-Bus attributes

779

# with the wrong interface name

780

if (not hasattr(attribute, "_dbus_interface")

781

or not attribute._dbus_interface

782

.startswith("se.recompile.Mandos")):

783

continue

784

# Create an alternate D-Bus interface name based on

785

# the current name

786

alt_interface = (attribute._dbus_interface

787

.replace("se.recompile.Mandos",

788

"se.bsnet.fukt.Mandos"))

789

# Is this a D-Bus signal?

790

if getattr(attribute, "_dbus_is_signal", False):

791

# Extract the original non-method function by

792

# black magic

793

nonmethod_func = (dict(

794

zip(attribute.func_code.co_freevars,

795

attribute.__closure__))["func"]

796

.cell_contents)

797

# Create a new, but exactly alike, function

798

# object, and decorate it to be a new D-Bus signal

799

# with the alternate D-Bus interface name

800

new_function = (dbus.service.signal

801

(alt_interface,

802

attribute._dbus_signature)

803

(types.FunctionType(

804

nonmethod_func.func_code,

805

nonmethod_func.func_globals,

806

nonmethod_func.func_name,

807

nonmethod_func.func_defaults,

808

nonmethod_func.func_closure)))

809

# Define a creator of a function to call both the

810

# old and new functions, so both the old and new

811

# signals gets sent when the function is called

812

def fixscope(func1, func2):

813

"""This function is a scope container to pass

814

func1 and func2 to the "call_both" function

815

outside of its arguments"""

816

def call_both(*args, **kwargs):

817

"""This function will emit two D-Bus

818

signals by calling func1 and func2"""

819

func1(*args, **kwargs)

820

func2(*args, **kwargs)

821

return call_both

822

# Create the "call_both" function and add it to

823

# the class

824

attr[attrname] = fixscope(attribute,

825

new_function)

826

# Is this a D-Bus method?

827

elif getattr(attribute, "_dbus_is_method", False):

828

# Create a new, but exactly alike, function

829

# object. Decorate it to be a new D-Bus method

830

# with the alternate D-Bus interface name. Add it

831

# to the class.

832

attr[attrname] = (dbus.service.method

833

(alt_interface,

834

attribute._dbus_in_signature,

835

attribute._dbus_out_signature)

836

(types.FunctionType

837

(attribute.func_code,

838

attribute.func_globals,

839

attribute.func_name,

840

attribute.func_defaults,

841

attribute.func_closure)))

842

# Is this a D-Bus property?

843

elif getattr(attribute, "_dbus_is_property", False):

844

# Create a new, but exactly alike, function

845

# object, and decorate it to be a new D-Bus

846

# property with the alternate D-Bus interface

847

# name. Add it to the class.

848

attr[attrname] = (dbus_service_property

849

(alt_interface,

850

attribute._dbus_signature,

851

attribute._dbus_access,

852

attribute

853

._dbus_get_args_options

854

["byte_arrays"])

855

(types.FunctionType

856

(attribute.func_code,

857

attribute.func_globals,

858

attribute.func_name,

859

attribute.func_defaults,

860

attribute.func_closure)))

861

return type.__new__(mcs, name, bases, attr)

862

707

863

class ClientDBus(Client, DBusObjectWithProperties):

708

864

"""A Client class using D-Bus

709

865

713

869

"""

714

870

715

871

runtime_expansions = (Client.runtime_expansions

716

+ (u"dbus_object_path",))

872

+ ("dbus_object_path",))

717

873

718

874

# dbus.service.Object doesn't use super(), so we can't either.

719

875

724

880

# Only now, when this client is initialized, can it show up on

725

881

# the D-Bus

726

882

client_object_name = unicode(self.name).translate(

727

{ord(u"."): ord(u"_"),

728

ord(u"-"): ord(u"_")})

883

{ord("."): ord("_"),

884

ord("-"): ord("_")})

729

885

self.dbus_object_path = (dbus.ObjectPath

730

(u"/clients/" + client_object_name))

886

("/clients/" + client_object_name))

731

887

DBusObjectWithProperties.__init__(self, self.bus,

732

888

self.dbus_object_path)

733

889

734

def _get_approvals_pending(self):

735

return self._approvals_pending

736

def _set_approvals_pending(self, value):

737

old_value = self._approvals_pending

738

self._approvals_pending = value

739

bval = bool(value)

740

if (hasattr(self, "dbus_object_path")

741

and bval is not bool(old_value)):

742

dbus_bool = dbus.Boolean(bval, variant_level=1)

743

self.PropertyChanged(dbus.String(u"ApprovalPending"),

744

dbus_bool)

890

def notifychangeproperty(transform_func,

891

dbus_name, type_func=lambda x: x,

892

variant_level=1):

893

""" Modify a variable so that it's a property which announces

894

its changes to DBus.

745

895

746

approvals_pending = property(_get_approvals_pending,

747

_set_approvals_pending)

748

del _get_approvals_pending, _set_approvals_pending

749

750

@staticmethod

751

def _datetime_to_dbus(dt, variant_level=0):

752

"""Convert a UTC datetime.datetime() to a D-Bus type."""

753

return dbus.String(dt.isoformat(),

754

variant_level=variant_level)

755

756

def enable(self):

757

oldstate = getattr(self, u"enabled", False)

758

r = Client.enable(self)

759

if oldstate != self.enabled:

760

# Emit D-Bus signals

761

self.PropertyChanged(dbus.String(u"Enabled"),

762

dbus.Boolean(True, variant_level=1))

763

self.PropertyChanged(

764

dbus.String(u"LastEnabled"),

765

self._datetime_to_dbus(self.last_enabled,

766

variant_level=1))

767

return r

768

769

def disable(self, quiet = False):

770

oldstate = getattr(self, u"enabled", False)

771

r = Client.disable(self, quiet=quiet)

772

if not quiet and oldstate != self.enabled:

773

# Emit D-Bus signal

774

self.PropertyChanged(dbus.String(u"Enabled"),

775

dbus.Boolean(False, variant_level=1))

776

return r

896

transform_fun: Function that takes a value and a variant_level

897

and transforms it to a D-Bus type.

898

dbus_name: D-Bus name of the variable

899

type_func: Function that transform the value before sending it

900

to the D-Bus. Default: no transform

901

variant_level: D-Bus variant level. Default: 1

902

"""

903

attrname = "_{0}".format(dbus_name)

904

def setter(self, value):

905

if hasattr(self, "dbus_object_path"):

906

if (not hasattr(self, attrname) or

907

type_func(getattr(self, attrname, None))

908

!= type_func(value)):

909

dbus_value = transform_func(type_func(value),

910

variant_level

911

=variant_level)

912

self.PropertyChanged(dbus.String(dbus_name),

913

dbus_value)

914

setattr(self, attrname, value)

915

916

return property(lambda self: getattr(self, attrname), setter)

917

918

919

expires = notifychangeproperty(datetime_to_dbus, "Expires")

920

approvals_pending = notifychangeproperty(dbus.Boolean,

921

"ApprovalPending",

922

type_func = bool)

923

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

924

last_enabled = notifychangeproperty(datetime_to_dbus,

925

"LastEnabled")

926

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

927

type_func = lambda checker:

928

checker is not None)

929

last_checked_ok = notifychangeproperty(datetime_to_dbus,

930

"LastCheckedOK")

931

last_approval_request = notifychangeproperty(

932

datetime_to_dbus, "LastApprovalRequest")

933

approved_by_default = notifychangeproperty(dbus.Boolean,

934

"ApprovedByDefault")

935

approval_delay = notifychangeproperty(dbus.UInt16,

936

"ApprovalDelay",

937

type_func =

938

_timedelta_to_milliseconds)

939

approval_duration = notifychangeproperty(

940

dbus.UInt16, "ApprovalDuration",

941

type_func = _timedelta_to_milliseconds)

942

host = notifychangeproperty(dbus.String, "Host")

943

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

944

type_func =

945

_timedelta_to_milliseconds)

946

extended_timeout = notifychangeproperty(

947

dbus.UInt16, "ExtendedTimeout",

948

type_func = _timedelta_to_milliseconds)

949

interval = notifychangeproperty(dbus.UInt16,

950

"Interval",

951

type_func =

952

_timedelta_to_milliseconds)

953

checker_command = notifychangeproperty(dbus.String, "Checker")

954

955

del notifychangeproperty

777

956

778

957

def __del__(self, *args, **kwargs):

779

958

try:

780

959

self.remove_from_connection()

781

960

except LookupError:

782

961

pass

783

if hasattr(DBusObjectWithProperties, u"__del__"):

962

if hasattr(DBusObjectWithProperties, "__del__"):

784

963

DBusObjectWithProperties.__del__(self, *args, **kwargs)

785

964

Client.__del__(self, *args, **kwargs)

786

965

788

967

*args, **kwargs):

789

968

self.checker_callback_tag = None

790

969

self.checker = None

791

# Emit D-Bus signal

792

self.PropertyChanged(dbus.String(u"CheckerRunning"),

793

dbus.Boolean(False, variant_level=1))

794

970

if os.WIFEXITED(condition):

795

971

exitstatus = os.WEXITSTATUS(condition)

796

972

# Emit D-Bus signal

806

982

return Client.checker_callback(self, pid, condition, command,

807

983

*args, **kwargs)

808

984

809

def checked_ok(self, *args, **kwargs):

810

r = Client.checked_ok(self, *args, **kwargs)

811

# Emit D-Bus signal

812

self.PropertyChanged(

813

dbus.String(u"LastCheckedOK"),

814

(self._datetime_to_dbus(self.last_checked_ok,

815

variant_level=1)))

816

return r

817

818

985

def start_checker(self, *args, **kwargs):

819

986

old_checker = self.checker

820

987

if self.checker is not None:

827

994

and old_checker_pid != self.checker.pid):

828

995

# Emit D-Bus signal

829

996

self.CheckerStarted(self.current_checker_command)

830

self.PropertyChanged(

831

dbus.String(u"CheckerRunning"),

832

dbus.Boolean(True, variant_level=1))

833

997

return r

834

998

835

def stop_checker(self, *args, **kwargs):

836

old_checker = getattr(self, u"checker", None)

837

r = Client.stop_checker(self, *args, **kwargs)

838

if (old_checker is not None

839

and getattr(self, u"checker", None) is None):

840

self.PropertyChanged(dbus.String(u"CheckerRunning"),

841

dbus.Boolean(False, variant_level=1))

842

return r

843

844

999

def _reset_approved(self):

845

1000

self._approved = None

846

1001

return False

848

1003

def approve(self, value=True):

849

1004

self.send_changedstate()

850

1005

self._approved = value

851

gobject.timeout_add(self._timedelta_to_milliseconds

1006

gobject.timeout_add(_timedelta_to_milliseconds

852

1007

(self.approval_duration),

853

1008

self._reset_approved)

854

1009

855

1010

856

1011

## D-Bus methods, signals & properties

857

_interface = u"se.bsnet.fukt.Mandos.Client"

1012

_interface = "se.recompile.Mandos.Client"

858

1013

859

1014

## Signals

860

1015

861

1016

# CheckerCompleted - signal

862

@dbus.service.signal(_interface, signature=u"nxs")

1017

@dbus.service.signal(_interface, signature="nxs")

863

1018

def CheckerCompleted(self, exitcode, waitstatus, command):

864

1019

"D-Bus signal"

865

1020

pass

866

1021

867

1022

# CheckerStarted - signal

868

@dbus.service.signal(_interface, signature=u"s")

1023

@dbus.service.signal(_interface, signature="s")

869

1024

def CheckerStarted(self, command):

870

1025

"D-Bus signal"

871

1026

pass

872

1027

873

1028

# PropertyChanged - signal

874

@dbus.service.signal(_interface, signature=u"sv")

1029

@dbus.service.signal(_interface, signature="sv")

875

1030

def PropertyChanged(self, property, value):

876

1031

"D-Bus signal"

877

1032

pass

886

1041

pass

887

1042

888

1043

# Rejected - signal

889

@dbus.service.signal(_interface, signature=u"s")

1044

@dbus.service.signal(_interface, signature="s")

890

1045

def Rejected(self, reason):

891

1046

"D-Bus signal"

892

1047

pass

893

1048

894

1049

# NeedApproval - signal

895

@dbus.service.signal(_interface, signature=u"tb")

1050

@dbus.service.signal(_interface, signature="tb")

896

1051

def NeedApproval(self, timeout, default):

897

1052

"D-Bus signal"

898

pass

1053

return self.need_approval()

899

1054

900

1055

## Methods

901

1056

902

1057

# Approve - method

903

@dbus.service.method(_interface, in_signature=u"b")

1058

@dbus.service.method(_interface, in_signature="b")

904

1059

def Approve(self, value):

905

1060

self.approve(value)

906

1061

907

1062

# CheckedOK - method

908

1063

@dbus.service.method(_interface)

909

1064

def CheckedOK(self):

910

return self.checked_ok()

1065

self.checked_ok()

911

1066

912

1067

# Enable - method

913

1068

@dbus.service.method(_interface)

935

1090

## Properties

936

1091

937

1092

# ApprovalPending - property

938

@dbus_service_property(_interface, signature=u"b", access=u"read")

1093

@dbus_service_property(_interface, signature="b", access="read")

939

1094

def ApprovalPending_dbus_property(self):

940

1095

return dbus.Boolean(bool(self.approvals_pending))

941

1096

942

1097

# ApprovedByDefault - property

943

@dbus_service_property(_interface, signature=u"b",

944

access=u"readwrite")

1098

@dbus_service_property(_interface, signature="b",

1099

access="readwrite")

945

1100

def ApprovedByDefault_dbus_property(self, value=None):

946

1101

if value is None: # get

947

1102

return dbus.Boolean(self.approved_by_default)

948

1103

self.approved_by_default = bool(value)

949

# Emit D-Bus signal

950

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

951

dbus.Boolean(value, variant_level=1))

952

1104

953

1105

# ApprovalDelay - property

954

@dbus_service_property(_interface, signature=u"t",

955

access=u"readwrite")

1106

@dbus_service_property(_interface, signature="t",

1107

access="readwrite")

956

1108

def ApprovalDelay_dbus_property(self, value=None):

957

1109

if value is None: # get

958

1110

return dbus.UInt64(self.approval_delay_milliseconds())

959

1111

self.approval_delay = datetime.timedelta(0, 0, 0, value)

960

# Emit D-Bus signal

961

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

962

dbus.UInt64(value, variant_level=1))

963

1112

964

1113

# ApprovalDuration - property

965

@dbus_service_property(_interface, signature=u"t",

966

access=u"readwrite")

1114

@dbus_service_property(_interface, signature="t",

1115

access="readwrite")

967

1116

def ApprovalDuration_dbus_property(self, value=None):

968

1117

if value is None: # get

969

return dbus.UInt64(self._timedelta_to_milliseconds(

1118

return dbus.UInt64(_timedelta_to_milliseconds(

970

1119

self.approval_duration))

971

1120

self.approval_duration = datetime.timedelta(0, 0, 0, value)

972

# Emit D-Bus signal

973

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

974

dbus.UInt64(value, variant_level=1))

975

1121

976

1122

# Name - property

977

@dbus_service_property(_interface, signature=u"s", access=u"read")

1123

@dbus_service_property(_interface, signature="s", access="read")

978

1124

def Name_dbus_property(self):

979

1125

return dbus.String(self.name)

980

1126

981

1127

# Fingerprint - property

982

@dbus_service_property(_interface, signature=u"s", access=u"read")

1128

@dbus_service_property(_interface, signature="s", access="read")

983

1129

def Fingerprint_dbus_property(self):

984

1130

return dbus.String(self.fingerprint)

985

1131

986

1132

# Host - property

987

@dbus_service_property(_interface, signature=u"s",

988

access=u"readwrite")

1133

@dbus_service_property(_interface, signature="s",

1134

access="readwrite")

989

1135

def Host_dbus_property(self, value=None):

990

1136

if value is None: # get

991

1137

return dbus.String(self.host)

992

1138

self.host = value

993

# Emit D-Bus signal

994

self.PropertyChanged(dbus.String(u"Host"),

995

dbus.String(value, variant_level=1))

996

1139

997

1140

# Created - property

998

@dbus_service_property(_interface, signature=u"s", access=u"read")

1141

@dbus_service_property(_interface, signature="s", access="read")

999

1142

def Created_dbus_property(self):

1000

return dbus.String(self._datetime_to_dbus(self.created))

1143

return dbus.String(datetime_to_dbus(self.created))

1001

1144

1002

1145

# LastEnabled - property

1003

@dbus_service_property(_interface, signature=u"s", access=u"read")

1146

@dbus_service_property(_interface, signature="s", access="read")

1004

1147

def LastEnabled_dbus_property(self):

1005

if self.last_enabled is None:

1006

return dbus.String(u"")

1007

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1148

return datetime_to_dbus(self.last_enabled)

1008

1149

1009

1150

# Enabled - property

1010

@dbus_service_property(_interface, signature=u"b",

1011

access=u"readwrite")

1151

@dbus_service_property(_interface, signature="b",

1152

access="readwrite")

1012

1153

def Enabled_dbus_property(self, value=None):

1013

1154

if value is None: # get

1014

1155

return dbus.Boolean(self.enabled)

1018

1159

self.disable()

1019

1160

1020

1161

# LastCheckedOK - property

1021

@dbus_service_property(_interface, signature=u"s",

1022

access=u"readwrite")

1162

@dbus_service_property(_interface, signature="s",

1163

access="readwrite")

1023

1164

def LastCheckedOK_dbus_property(self, value=None):

1024

1165

if value is not None:

1025

1166

self.checked_ok()

1026

1167

return

1027

if self.last_checked_ok is None:

1028

return dbus.String(u"")

1029

return dbus.String(self._datetime_to_dbus(self

1030

.last_checked_ok))

1168

return datetime_to_dbus(self.last_checked_ok)

1169

1170

# Expires - property

1171

@dbus_service_property(_interface, signature="s", access="read")

1172

def Expires_dbus_property(self):

1173

return datetime_to_dbus(self.expires)

1174

1175

# LastApprovalRequest - property

1176

@dbus_service_property(_interface, signature="s", access="read")

1177

def LastApprovalRequest_dbus_property(self):

1178

return datetime_to_dbus(self.last_approval_request)

1031

1179

1032

1180

# Timeout - property

1033

@dbus_service_property(_interface, signature=u"t",

1034

access=u"readwrite")

1181

@dbus_service_property(_interface, signature="t",

1182

access="readwrite")

1035

1183

def Timeout_dbus_property(self, value=None):

1036

1184

if value is None: # get

1037

1185

return dbus.UInt64(self.timeout_milliseconds())

1038

1186

self.timeout = datetime.timedelta(0, 0, 0, value)

1039

# Emit D-Bus signal

1040

self.PropertyChanged(dbus.String(u"Timeout"),

1041

dbus.UInt64(value, variant_level=1))

1042

if getattr(self, u"disable_initiator_tag", None) is None:

1187

if getattr(self, "disable_initiator_tag", None) is None:

1043

1188

return

1044

1189

# Reschedule timeout

1045

1190

gobject.source_remove(self.disable_initiator_tag)

1046

1191

self.disable_initiator_tag = None

1047

time_to_die = (self.

1048

_timedelta_to_milliseconds((self

1049

.last_checked_ok

1050

+ self.timeout)

1051

- datetime.datetime

1052

.utcnow()))

1192

self.expires = None

1193

time_to_die = _timedelta_to_milliseconds((self

1194

.last_checked_ok

1195

+ self.timeout)

1196

- datetime.datetime

1197

.utcnow())

1053

1198

if time_to_die <= 0:

1054

1199

# The timeout has passed

1055

1200

self.disable()

1056

1201

else:

1202

self.expires = (datetime.datetime.utcnow()

1203

+ datetime.timedelta(milliseconds =

1204

time_to_die))

1057

1205

self.disable_initiator_tag = (gobject.timeout_add

1058

1206

(time_to_die, self.disable))

1059

1207

1208

# ExtendedTimeout - property

1209

@dbus_service_property(_interface, signature="t",

1210

access="readwrite")

1211

def ExtendedTimeout_dbus_property(self, value=None):

1212

if value is None: # get

1213

return dbus.UInt64(self.extended_timeout_milliseconds())

1214

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1215

1060

1216

# Interval - property

1061

@dbus_service_property(_interface, signature=u"t",

1062

access=u"readwrite")

1217

@dbus_service_property(_interface, signature="t",

1218

access="readwrite")

1063

1219

def Interval_dbus_property(self, value=None):

1064

1220

if value is None: # get

1065

1221

return dbus.UInt64(self.interval_milliseconds())

1066

1222

self.interval = datetime.timedelta(0, 0, 0, value)

1067

# Emit D-Bus signal

1068

self.PropertyChanged(dbus.String(u"Interval"),

1069

dbus.UInt64(value, variant_level=1))

1070

if getattr(self, u"checker_initiator_tag", None) is None:

1223

if getattr(self, "checker_initiator_tag", None) is None:

1071

1224

return

1072

1225

# Reschedule checker run

1073

1226

gobject.source_remove(self.checker_initiator_tag)

1074

1227

self.checker_initiator_tag = (gobject.timeout_add

1075

1228

(value, self.start_checker))

1076

1229

self.start_checker() # Start one now, too

1077

1230

1078

1231

# Checker - property

1079

@dbus_service_property(_interface, signature=u"s",

1080

access=u"readwrite")

1232

@dbus_service_property(_interface, signature="s",

1233

access="readwrite")

1081

1234

def Checker_dbus_property(self, value=None):

1082

1235

if value is None: # get

1083

1236

return dbus.String(self.checker_command)

1084

1237

self.checker_command = value

1085

# Emit D-Bus signal

1086

self.PropertyChanged(dbus.String(u"Checker"),

1087

dbus.String(self.checker_command,

1088

variant_level=1))

1089

1238

1090

1239

# CheckerRunning - property

1091

@dbus_service_property(_interface, signature=u"b",

1092

access=u"readwrite")

1240

@dbus_service_property(_interface, signature="b",

1241

access="readwrite")

1093

1242

def CheckerRunning_dbus_property(self, value=None):

1094

1243

if value is None: # get

1095

1244

return dbus.Boolean(self.checker is not None)

1099

1248

self.stop_checker()

1100

1249

1101

1250

# ObjectPath - property

1102

@dbus_service_property(_interface, signature=u"o", access=u"read")

1251

@dbus_service_property(_interface, signature="o", access="read")

1103

1252

def ObjectPath_dbus_property(self):

1104

1253

return self.dbus_object_path # is already a dbus.ObjectPath

1105

1254

1106

1255

# Secret = property

1107

@dbus_service_property(_interface, signature=u"ay",

1108

access=u"write", byte_arrays=True)

1256

@dbus_service_property(_interface, signature="ay",

1257

access="write", byte_arrays=True)

1109

1258

def Secret_dbus_property(self, value):

1110

1259

self.secret = str(value)

1111

1260

1118

1267

self._pipe.send(('init', fpr, address))

1119

1268

if not self._pipe.recv():

1120

1269

raise KeyError()

1121

1270

1122

1271

def __getattribute__(self, name):

1123

1272

if(name == '_pipe'):

1124

1273

return super(ProxyClient, self).__getattribute__(name)

1131

1280

self._pipe.send(('funcall', name, args, kwargs))

1132

1281

return self._pipe.recv()[1]

1133

1282

return func

1134

1283

1135

1284

def __setattr__(self, name, value):

1136

1285

if(name == '_pipe'):

1137

1286

return super(ProxyClient, self).__setattr__(name, value)

1138

1287

self._pipe.send(('setattr', name, value))

1139

1288

1289

class ClientDBusTransitional(ClientDBus):

1290

__metaclass__ = AlternateDBusNamesMetaclass

1140

1291

1141

1292

class ClientHandler(socketserver.BaseRequestHandler, object):

1142

1293

"""A class to handle client connections.

1146

1297

1147

1298

def handle(self):

1148

1299

with contextlib.closing(self.server.child_pipe) as child_pipe:

1149

logger.info(u"TCP connection from: %s",

1300

logger.info("TCP connection from: %s",

1150

1301

unicode(self.client_address))

1151

logger.debug(u"Pipe FD: %d",

1302

logger.debug("Pipe FD: %d",

1152

1303

self.server.child_pipe.fileno())

1153

1304

1154

1305

session = (gnutls.connection

1155

1306

.ClientSession(self.request,

1156

1307

gnutls.connection

1157

1308

.X509Credentials()))

1158

1309

1159

1310

# Note: gnutls.connection.X509Credentials is really a

1160

1311

# generic GnuTLS certificate credentials object so long as

1161

1312

# no X.509 keys are added to it. Therefore, we can use it

1162

1313

# here despite using OpenPGP certificates.

1163

1164

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1165

# u"+AES-256-CBC", u"+SHA1",

1166

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1167

# u"+DHE-DSS"))

1314

1315

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1316

# "+AES-256-CBC", "+SHA1",

1317

# "+COMP-NULL", "+CTYPE-OPENPGP",

1318

# "+DHE-DSS"))

1168

1319

# Use a fallback default, since this MUST be set.

1169

1320

priority = self.server.gnutls_priority

1170

1321

if priority is None:

1171

priority = u"NORMAL"

1322

priority = "NORMAL"

1172

1323

(gnutls.library.functions

1173

1324

.gnutls_priority_set_direct(session._c_object,

1174

1325

priority, None))

1175

1326

1176

1327

# Start communication using the Mandos protocol

1177

1328

# Get protocol number

1178

1329

line = self.request.makefile().readline()

1179

logger.debug(u"Protocol version: %r", line)

1330

logger.debug("Protocol version: %r", line)

1180

1331

try:

1181

1332

if int(line.strip().split()[0]) > 1:

1182

1333

raise RuntimeError

1183

except (ValueError, IndexError, RuntimeError), error:

1184

logger.error(u"Unknown protocol version: %s", error)

1334

except (ValueError, IndexError, RuntimeError) as error:

1335

logger.error("Unknown protocol version: %s", error)

1185

1336

return

1186

1337

1187

1338

# Start GnuTLS connection

1188

1339

try:

1189

1340

session.handshake()

1190

except gnutls.errors.GNUTLSError, error:

1191

logger.warning(u"Handshake failed: %s", error)

1341

except gnutls.errors.GNUTLSError as error:

1342

logger.warning("Handshake failed: %s", error)

1192

1343

# Do not run session.bye() here: the session is not

1193

1344

# established. Just abandon the request.

1194

1345

return

1195

logger.debug(u"Handshake succeeded")

1196

1346

logger.debug("Handshake succeeded")

1347

1197

1348

approval_required = False

1198

1349

try:

1199

1350

try:

1200

1351

fpr = self.fingerprint(self.peer_certificate

1201

1352

(session))

1202

except (TypeError, gnutls.errors.GNUTLSError), error:

1203

logger.warning(u"Bad certificate: %s", error)

1353

except (TypeError,

1354

gnutls.errors.GNUTLSError) as error:

1355

logger.warning("Bad certificate: %s", error)

1204

1356

return

1205

logger.debug(u"Fingerprint: %s", fpr)

1206

1357

logger.debug("Fingerprint: %s", fpr)

1358

1207

1359

try:

1208

1360

client = ProxyClient(child_pipe, fpr,

1209

1361

self.client_address)

1217

1369

1218

1370

while True:

1219

1371

if not client.enabled:

1220

logger.warning(u"Client %s is disabled",

1372

logger.info("Client %s is disabled",

1221

1373

client.name)

1222

1374

if self.server.use_dbus:

1223

1375

# Emit D-Bus signal

1224

client.Rejected("Disabled")

1376

client.Rejected("Disabled")

1225

1377

return

1226

1378

1227

1379

if client._approved or not client.approval_delay:

1228

1380

#We are approved or approval is disabled

1229

1381

break

1230

1382

elif client._approved is None:

1231

logger.info(u"Client %s needs approval",

1383

logger.info("Client %s needs approval",

1232

1384

client.name)

1233

1385

if self.server.use_dbus:

1234

1386

# Emit D-Bus signal

1236

1388

client.approval_delay_milliseconds(),

1237

1389

client.approved_by_default)

1238

1390

else:

1239

logger.warning(u"Client %s was not approved",

1391

logger.warning("Client %s was not approved",

1240

1392

client.name)

1241

1393

if self.server.use_dbus:

1242

1394

# Emit D-Bus signal

1244

1396

return

1245

1397

1246

1398

#wait until timeout or approved

1247

#x = float(client._timedelta_to_milliseconds(delay))

1248

1399

time = datetime.datetime.now()

1249

1400

client.changedstate.acquire()

1250

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1401

(client.changedstate.wait

1402

(float(client._timedelta_to_milliseconds(delay)

1403

/ 1000)))

1251

1404

client.changedstate.release()

1252

1405

time2 = datetime.datetime.now()

1253

1406

if (time2 - time) >= delay:

1268

1421

while sent_size < len(client.secret):

1269

1422

try:

1270

1423

sent = session.send(client.secret[sent_size:])

1271

except (gnutls.errors.GNUTLSError), error:

1424

except gnutls.errors.GNUTLSError as error:

1272

1425

logger.warning("gnutls send failed")

1273

1426

return

1274

logger.debug(u"Sent: %d, remaining: %d",

1427

logger.debug("Sent: %d, remaining: %d",

1275

1428

sent, len(client.secret)

1276

1429

- (sent_size + sent))

1277

1430

sent_size += sent

1278

1279

logger.info(u"Sending secret to %s", client.name)

1280

# bump the timeout as if seen

1281

client.checked_ok()

1431

1432

logger.info("Sending secret to %s", client.name)

1433

# bump the timeout using extended_timeout

1434

client.checked_ok(client.extended_timeout)

1282

1435

if self.server.use_dbus:

1283

1436

# Emit D-Bus signal

1284

1437

client.GotSecret()

1288

1441

client.approvals_pending -= 1

1289

1442

try:

1290

1443

session.bye()

1291

except (gnutls.errors.GNUTLSError), error:

1444

except gnutls.errors.GNUTLSError as error:

1292

1445

logger.warning("GnuTLS bye failed")

1293

1446

1294

1447

@staticmethod

1305

1458

.gnutls_certificate_get_peers

1306

1459

(session._c_object, ctypes.byref(list_size)))

1307

1460

if not bool(cert_list) and list_size.value != 0:

1308

raise gnutls.errors.GNUTLSError(u"error getting peer"

1309

u" certificate")

1461

raise gnutls.errors.GNUTLSError("error getting peer"

1462

" certificate")

1310

1463

if list_size.value == 0:

1311

1464

return None

1312

1465

cert = cert_list[0]

1338

1491

if crtverify.value != 0:

1339

1492

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1340

1493

raise (gnutls.errors.CertificateSecurityError

1341

(u"Verify failed"))

1494

("Verify failed"))

1342

1495

# New buffer for the fingerprint

1343

1496

buf = ctypes.create_string_buffer(20)

1344

1497

buf_len = ctypes.c_size_t()

1351

1504

# Convert the buffer to a Python bytestring

1352

1505

fpr = ctypes.string_at(buf, buf_len.value)

1353

1506

# Convert the bytestring to hexadecimal notation

1354

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1355

1508

return hex_fpr

1356

1509

1357

1510

1363

1516

except:

1364

1517

self.handle_error(request, address)

1365

1518

self.close_request(request)

1366

1519

1367

1520

def process_request(self, request, address):

1368

1521

"""Start a new process to process the request."""

1369

multiprocessing.Process(target = self.sub_process_main,

1370

args = (request, address)).start()

1522

proc = multiprocessing.Process(target = self.sub_process_main,

1523

args = (request,

1524

address))

1525

proc.start()

1526

return proc

1527

1371

1528

1372

1529

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1373

1530

""" adds a pipe to the MixIn """

1377

1534

This function creates a new pipe in self.pipe

1378

1535

"""

1379

1536

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1380

1381

super(MultiprocessingMixInWithPipe,

1382

self).process_request(request, client_address)

1537

1538

proc = MultiprocessingMixIn.process_request(self, request,

1539

client_address)

1383

1540

self.child_pipe.close()

1384

self.add_pipe(parent_pipe)

1385

1386

def add_pipe(self, parent_pipe):

1541

self.add_pipe(parent_pipe, proc)

1542

1543

def add_pipe(self, parent_pipe, proc):

1387

1544

"""Dummy function; override as necessary"""

1388

pass

1545

raise NotImplementedError

1546

1389

1547

1390

1548

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1391

1549

socketserver.TCPServer, object):

1409

1567

bind to an address or port if they were not specified."""

1410

1568

if self.interface is not None:

1411

1569

if SO_BINDTODEVICE is None:

1412

logger.error(u"SO_BINDTODEVICE does not exist;"

1413

u" cannot bind to interface %s",

1570

logger.error("SO_BINDTODEVICE does not exist;"

1571

" cannot bind to interface %s",

1414

1572

self.interface)

1415

1573

else:

1416

1574

try:

1417

1575

self.socket.setsockopt(socket.SOL_SOCKET,

1418

1576

SO_BINDTODEVICE,

1419

1577

str(self.interface

1420

+ u'\0'))

1421

except socket.error, error:

1578

+ '\0'))

1579

except socket.error as error:

1422

1580

if error[0] == errno.EPERM:

1423

logger.error(u"No permission to"

1424

u" bind to interface %s",

1581

logger.error("No permission to"

1582

" bind to interface %s",

1425

1583

self.interface)

1426

1584

elif error[0] == errno.ENOPROTOOPT:

1427

logger.error(u"SO_BINDTODEVICE not available;"

1428

u" cannot bind to interface %s",

1585

logger.error("SO_BINDTODEVICE not available;"

1586

" cannot bind to interface %s",

1429

1587

self.interface)

1430

1588

else:

1431

1589

raise

1433

1591

if self.server_address[0] or self.server_address[1]:

1434

1592

if not self.server_address[0]:

1435

1593

if self.address_family == socket.AF_INET6:

1436

any_address = u"::" # in6addr_any

1594

any_address = "::" # in6addr_any

1437

1595

else:

1438

1596

any_address = socket.INADDR_ANY

1439

1597

self.server_address = (any_address,

1476

1634

def server_activate(self):

1477

1635

if self.enabled:

1478

1636

return socketserver.TCPServer.server_activate(self)

1637

1479

1638

def enable(self):

1480

1639

self.enabled = True

1481

def add_pipe(self, parent_pipe):

1640

1641

def add_pipe(self, parent_pipe, proc):

1482

1642

# Call "handle_ipc" for both data and EOF events

1483

1643

gobject.io_add_watch(parent_pipe.fileno(),

1484

1644

gobject.IO_IN | gobject.IO_HUP,

1485

1645

functools.partial(self.handle_ipc,

1486

parent_pipe = parent_pipe))

1487

1646

parent_pipe =

1647

parent_pipe,

1648

proc = proc))

1649

1488

1650

def handle_ipc(self, source, condition, parent_pipe=None,

1489

client_object=None):

1651

proc = None, client_object=None):

1490

1652

condition_names = {

1491

gobject.IO_IN: u"IN", # There is data to read.

1492

gobject.IO_OUT: u"OUT", # Data can be written (without

1653

gobject.IO_IN: "IN", # There is data to read.

1654

gobject.IO_OUT: "OUT", # Data can be written (without

1493

1655

# blocking).

1494

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1495

gobject.IO_ERR: u"ERR", # Error condition.

1496

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1656

gobject.IO_PRI: "PRI", # There is urgent data to read.

1657

gobject.IO_ERR: "ERR", # Error condition.

1658

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1497

1659

# broken, usually for pipes and

1498

1660

# sockets).

1499

1661

}

1501

1663

for cond, name in

1502

1664

condition_names.iteritems()

1503

1665

if cond & condition)

1504

# error or the other end of multiprocessing.Pipe has closed

1666

# error, or the other end of multiprocessing.Pipe has closed

1505

1667

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1668

# Wait for other process to exit

1669

proc.join()

1506

1670

return False

1507

1671

1508

1672

# Read a request from the child

1518

1682

client = c

1519

1683

break

1520

1684

else:

1521

logger.warning(u"Client not found for fingerprint: %s, ad"

1522

u"dress: %s", fpr, address)

1685

logger.info("Client not found for fingerprint: %s, ad"

1686

"dress: %s", fpr, address)

1523

1687

if self.use_dbus:

1524

1688

# Emit D-Bus signal

1525

mandos_dbus_service.ClientNotFound(fpr, address[0])

1689

mandos_dbus_service.ClientNotFound(fpr,

1690

address[0])

1526

1691

parent_pipe.send(False)

1527

1692

return False

1528

1693

1529

1694

gobject.io_add_watch(parent_pipe.fileno(),

1530

1695

gobject.IO_IN | gobject.IO_HUP,

1531

1696

functools.partial(self.handle_ipc,

1532

parent_pipe = parent_pipe,

1533

client_object = client))

1697

parent_pipe =

1698

parent_pipe,

1699

proc = proc,

1700

client_object =

1701

client))

1534

1702

parent_pipe.send(True)

1535

# remove the old hook in favor of the new above hook on same fileno

1703

# remove the old hook in favor of the new above hook on

1704

# same fileno

1536

1705

return False

1537

1706

if command == 'funcall':

1538

1707

funcname = request[1]

1539

1708

args = request[2]

1540

1709

kwargs = request[3]

1541

1710

1542

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1543

1711

parent_pipe.send(('data', getattr(client_object,

1712

funcname)(*args,

1713

**kwargs)))

1714

1544

1715

if command == 'getattr':

1545

1716

attrname = request[1]

1546

1717

if callable(client_object.__getattribute__(attrname)):

1547

1718

parent_pipe.send(('function',))

1548

1719

else:

1549

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1720

parent_pipe.send(('data', client_object

1721

.__getattribute__(attrname)))

1550

1722

1551

1723

if command == 'setattr':

1552

1724

attrname = request[1]

1553

1725

value = request[2]

1554

1726

setattr(client_object, attrname, value)

1555

1727

1556

1728

return True

1557

1729

1558

1730

1559

1731

def string_to_delta(interval):

1560

1732

"""Parse a string and return a datetime.timedelta

1561

1733

1562

>>> string_to_delta(u'7d')

1734

>>> string_to_delta('7d')

1563

1735

datetime.timedelta(7)

1564

>>> string_to_delta(u'60s')

1736

>>> string_to_delta('60s')

1565

1737

datetime.timedelta(0, 60)

1566

>>> string_to_delta(u'60m')

1738

>>> string_to_delta('60m')

1567

1739

datetime.timedelta(0, 3600)

1568

>>> string_to_delta(u'24h')

1740

>>> string_to_delta('24h')

1569

1741

datetime.timedelta(1)

1570

>>> string_to_delta(u'1w')

1742

>>> string_to_delta('1w')

1571

1743

datetime.timedelta(7)

1572

>>> string_to_delta(u'5m 30s')

1744

>>> string_to_delta('5m 30s')

1573

1745

datetime.timedelta(0, 330)

1574

1746

"""

1575

1747

timevalue = datetime.timedelta(0)

1577

1749

try:

1578

1750

suffix = unicode(s[-1])

1579

1751

value = int(s[:-1])

1580

if suffix == u"d":

1752

if suffix == "d":

1581

1753

delta = datetime.timedelta(value)

1582

elif suffix == u"s":

1754

elif suffix == "s":

1583

1755

delta = datetime.timedelta(0, value)

1584

elif suffix == u"m":

1756

elif suffix == "m":

1585

1757

delta = datetime.timedelta(0, 0, 0, 0, value)

1586

elif suffix == u"h":

1758

elif suffix == "h":

1587

1759

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1588

elif suffix == u"w":

1760

elif suffix == "w":

1589

1761

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1590

1762

else:

1591

raise ValueError(u"Unknown suffix %r" % suffix)

1592

except (ValueError, IndexError), e:

1593

raise ValueError(e.message)

1763

raise ValueError("Unknown suffix %r" % suffix)

1764

except (ValueError, IndexError) as e:

1765

raise ValueError(*(e.args))

1594

1766

timevalue += delta

1595

1767

return timevalue

1596

1768

1602

1774

global if_nametoindex

1603

1775

try:

1604

1776

if_nametoindex = (ctypes.cdll.LoadLibrary

1605

(ctypes.util.find_library(u"c"))

1777

(ctypes.util.find_library("c"))

1606

1778

.if_nametoindex)

1607

1779

except (OSError, AttributeError):

1608

logger.warning(u"Doing if_nametoindex the hard way")

1780

logger.warning("Doing if_nametoindex the hard way")

1609

1781

def if_nametoindex(interface):

1610

1782

"Get an interface index the hard way, i.e. using fcntl()"

1611

1783

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1612

1784

with contextlib.closing(socket.socket()) as s:

1613

1785

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1614

struct.pack(str(u"16s16x"),

1786

struct.pack(str("16s16x"),

1615

1787

interface))

1616

interface_index = struct.unpack(str(u"I"),

1788

interface_index = struct.unpack(str("I"),

1617

1789

ifreq[16:20])[0]

1618

1790

return interface_index

1619

1791

return if_nametoindex(interface)

1627

1799

sys.exit()

1628

1800

os.setsid()

1629

1801

if not nochdir:

1630

os.chdir(u"/")

1802

os.chdir("/")

1631

1803

if os.fork():

1632

1804

sys.exit()

1633

1805

if not noclose:

1635

1807

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1636

1808

if not stat.S_ISCHR(os.fstat(null).st_mode):

1637

1809

raise OSError(errno.ENODEV,

1638

u"%s not a character device"

1810

"%s not a character device"

1639

1811

% os.path.devnull)

1640

1812

os.dup2(null, sys.stdin.fileno())

1641

1813

os.dup2(null, sys.stdout.fileno())

1649

1821

##################################################################

1650

1822

# Parsing of options, both command line and config file

1651

1823

1652

parser = optparse.OptionParser(version = "%%prog %s" % version)

1653

parser.add_option("-i", u"--interface", type=u"string",

1654

metavar="IF", help=u"Bind to interface IF")

1655

parser.add_option("-a", u"--address", type=u"string",

1656

help=u"Address to listen for requests on")

1657

parser.add_option("-p", u"--port", type=u"int",

1658

help=u"Port number to receive requests on")

1659

parser.add_option("--check", action=u"store_true",

1660

help=u"Run self-test")

1661

parser.add_option("--debug", action=u"store_true",

1662

help=u"Debug mode; run in foreground and log to"

1663

u" terminal")

1664

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1665

help=u"Debug level for stdout output")

1666

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1667

u" priority string (see GnuTLS documentation)")

1668

parser.add_option("--servicename", type=u"string",

1669

metavar=u"NAME", help=u"Zeroconf service name")

1670

parser.add_option("--configdir", type=u"string",

1671

default=u"/etc/mandos", metavar=u"DIR",

1672

help=u"Directory to search for configuration"

1673

u" files")

1674

parser.add_option("--no-dbus", action=u"store_false",

1675

dest=u"use_dbus", help=u"Do not provide D-Bus"

1676

u" system bus interface")

1677

parser.add_option("--no-ipv6", action=u"store_false",

1678

dest=u"use_ipv6", help=u"Do not use IPv6")

1679

options = parser.parse_args()[0]

1824

parser = argparse.ArgumentParser()

1825

parser.add_argument("-v", "--version", action="version",

1826

version = "%%(prog)s %s" % version,

1827

help="show version number and exit")

1828

parser.add_argument("-i", "--interface", metavar="IF",

1829

help="Bind to interface IF")

1830

parser.add_argument("-a", "--address",

1831

help="Address to listen for requests on")

1832

parser.add_argument("-p", "--port", type=int,

1833

help="Port number to receive requests on")

1834

parser.add_argument("--check", action="store_true",

1835

help="Run self-test")

1836

parser.add_argument("--debug", action="store_true",

1837

help="Debug mode; run in foreground and log"

1838

" to terminal")

1839

parser.add_argument("--debuglevel", metavar="LEVEL",

1840

help="Debug level for stdout output")

1841

parser.add_argument("--priority", help="GnuTLS"

1842

" priority string (see GnuTLS documentation)")

1843

parser.add_argument("--servicename",

1844

metavar="NAME", help="Zeroconf service name")

1845

parser.add_argument("--configdir",

1846

default="/etc/mandos", metavar="DIR",

1847

help="Directory to search for configuration"

1848

" files")

1849

parser.add_argument("--no-dbus", action="store_false",

1850

dest="use_dbus", help="Do not provide D-Bus"

1851

" system bus interface")

1852

parser.add_argument("--no-ipv6", action="store_false",

1853

dest="use_ipv6", help="Do not use IPv6")

1854

options = parser.parse_args()

1680

1855

1681

1856

if options.check:

1682

1857

import doctest

1684

1859

sys.exit()

1685

1860

1686

1861

# Default values for config file for server-global settings

1687

server_defaults = { u"interface": u"",

1688

u"address": u"",

1689

u"port": u"",

1690

u"debug": u"False",

1691

u"priority":

1692

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1693

u"servicename": u"Mandos",

1694

u"use_dbus": u"True",

1695

u"use_ipv6": u"True",

1696

u"debuglevel": u"",

1862

server_defaults = { "interface": "",

1863

"address": "",

1864

"port": "",

1865

"debug": "False",

1866

"priority":

1867

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1868

"servicename": "Mandos",

1869

"use_dbus": "True",

1870

"use_ipv6": "True",

1871

"debuglevel": "",

1697

1872

}

1698

1873

1699

1874

# Parse config file for server-global settings

1700

1875

server_config = configparser.SafeConfigParser(server_defaults)

1701

1876

del server_defaults

1702

1877

server_config.read(os.path.join(options.configdir,

1703

u"mandos.conf"))

1878

"mandos.conf"))

1704

1879

# Convert the SafeConfigParser object to a dict

1705

1880

server_settings = server_config.defaults()

1706

1881

# Use the appropriate methods on the non-string config options

1707

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1708

server_settings[option] = server_config.getboolean(u"DEFAULT",

1882

for option in ("debug", "use_dbus", "use_ipv6"):

1883

server_settings[option] = server_config.getboolean("DEFAULT",

1709

1884

option)

1710

1885

if server_settings["port"]:

1711

server_settings["port"] = server_config.getint(u"DEFAULT",

1712

u"port")

1886

server_settings["port"] = server_config.getint("DEFAULT",

1887

"port")

1713

1888

del server_config

1714

1889

1715

1890

# Override the settings from the config file with command line

1716

1891

# options, if set.

1717

for option in (u"interface", u"address", u"port", u"debug",

1718

u"priority", u"servicename", u"configdir",

1719

u"use_dbus", u"use_ipv6", u"debuglevel"):

1892

for option in ("interface", "address", "port", "debug",

1893

"priority", "servicename", "configdir",

1894

"use_dbus", "use_ipv6", "debuglevel"):

1720

1895

value = getattr(options, option)

1721

1896

if value is not None:

1722

1897

server_settings[option] = value

1730

1905

##################################################################

1731

1906

1732

1907

# For convenience

1733

debug = server_settings[u"debug"]

1734

debuglevel = server_settings[u"debuglevel"]

1735

use_dbus = server_settings[u"use_dbus"]

1736

use_ipv6 = server_settings[u"use_ipv6"]

1737

1738

if server_settings[u"servicename"] != u"Mandos":

1908

debug = server_settings["debug"]

1909

debuglevel = server_settings["debuglevel"]

1910

use_dbus = server_settings["use_dbus"]

1911

use_ipv6 = server_settings["use_ipv6"]

1912

1913

if server_settings["servicename"] != "Mandos":

1739

1914

syslogger.setFormatter(logging.Formatter

1740

(u'Mandos (%s) [%%(process)d]:'

1741

u' %%(levelname)s: %%(message)s'

1742

% server_settings[u"servicename"]))

1915

('Mandos (%s) [%%(process)d]:'

1916

' %%(levelname)s: %%(message)s'

1917

% server_settings["servicename"]))

1743

1918

1744

1919

# Parse config file with clients

1745

client_defaults = { u"timeout": u"1h",

1746

u"interval": u"5m",

1747

u"checker": u"fping -q -- %%(host)s",

1748

u"host": u"",

1749

u"approval_delay": u"0s",

1750

u"approval_duration": u"1s",

1920

client_defaults = { "timeout": "5m",

1921

"extended_timeout": "15m",

1922

"interval": "2m",

1923

"checker": "fping -q -- %%(host)s",

1924

"host": "",

1925

"approval_delay": "0s",

1926

"approval_duration": "1s",

1751

1927

}

1752

1928

client_config = configparser.SafeConfigParser(client_defaults)

1753

client_config.read(os.path.join(server_settings[u"configdir"],

1754

u"clients.conf"))

1929

client_config.read(os.path.join(server_settings["configdir"],

1930

"clients.conf"))

1755

1931

1756

1932

global mandos_dbus_service

1757

1933

mandos_dbus_service = None

1758

1934

1759

tcp_server = MandosServer((server_settings[u"address"],

1760

server_settings[u"port"]),

1935

tcp_server = MandosServer((server_settings["address"],

1936

server_settings["port"]),

1761

1937

ClientHandler,

1762

interface=(server_settings[u"interface"]

1938

interface=(server_settings["interface"]

1763

1939

or None),

1764

1940

use_ipv6=use_ipv6,

1765

1941

gnutls_priority=

1766

server_settings[u"priority"],

1942

server_settings["priority"],

1767

1943

use_dbus=use_dbus)

1768

1944

if not debug:

1769

pidfilename = u"/var/run/mandos.pid"

1945

pidfilename = "/var/run/mandos.pid"

1770

1946

try:

1771

pidfile = open(pidfilename, u"w")

1947

pidfile = open(pidfilename, "w")

1772

1948

except IOError:

1773

logger.error(u"Could not open file %r", pidfilename)

1949

logger.error("Could not open file %r", pidfilename)

1774

1950

1775

1951

try:

1776

uid = pwd.getpwnam(u"_mandos").pw_uid

1777

gid = pwd.getpwnam(u"_mandos").pw_gid

1952

uid = pwd.getpwnam("_mandos").pw_uid

1953

gid = pwd.getpwnam("_mandos").pw_gid

1778

1954

except KeyError:

1779

1955

try:

1780

uid = pwd.getpwnam(u"mandos").pw_uid

1781

gid = pwd.getpwnam(u"mandos").pw_gid

1956

uid = pwd.getpwnam("mandos").pw_uid

1957

gid = pwd.getpwnam("mandos").pw_gid

1782

1958

except KeyError:

1783

1959

try:

1784

uid = pwd.getpwnam(u"nobody").pw_uid

1785

gid = pwd.getpwnam(u"nobody").pw_gid

1960

uid = pwd.getpwnam("nobody").pw_uid

1961

gid = pwd.getpwnam("nobody").pw_gid

1786

1962

except KeyError:

1787

1963

uid = 65534

1788

1964

gid = 65534

1789

1965

try:

1790

1966

os.setgid(gid)

1791

1967

os.setuid(uid)

1792

except OSError, error:

1968

except OSError as error:

1793

1969

if error[0] != errno.EPERM:

1794

1970

raise error

1795

1971

1800

1976

level = getattr(logging, debuglevel.upper())

1801

1977

syslogger.setLevel(level)

1802

1978

console.setLevel(level)

1803

1979

1804

1980

if debug:

1805

1981

# Enable all possible GnuTLS debugging

1806

1982

1810

1986

1811

1987

@gnutls.library.types.gnutls_log_func

1812

1988

def debug_gnutls(level, string):

1813

logger.debug(u"GnuTLS: %s", string[:-1])

1989

logger.debug("GnuTLS: %s", string[:-1])

1814

1990

1815

1991

(gnutls.library.functions

1816

1992

.gnutls_global_set_log_function(debug_gnutls))

1824

2000

# No console logging

1825

2001

logger.removeHandler(console)

1826

2002

2003

# Need to fork before connecting to D-Bus

2004

if not debug:

2005

# Close all input and output, do double fork, etc.

2006

daemon()

1827

2007

1828

2008

global main_loop

1829

2009

# From the Avahi example code

1833

2013

# End of Avahi example code

1834

2014

if use_dbus:

1835

2015

try:

1836

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2016

bus_name = dbus.service.BusName("se.recompile.Mandos",

1837

2017

bus, do_not_queue=True)

1838

except dbus.exceptions.NameExistsException, e:

1839

logger.error(unicode(e) + u", disabling D-Bus")

2018

old_bus_name = (dbus.service.BusName

2019

("se.bsnet.fukt.Mandos", bus,

2020

do_not_queue=True))

2021

except dbus.exceptions.NameExistsException as e:

2022

logger.error(unicode(e) + ", disabling D-Bus")

1840

2023

use_dbus = False

1841

server_settings[u"use_dbus"] = False

2024

server_settings["use_dbus"] = False

1842

2025

tcp_server.use_dbus = False

1843

2026

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1844

service = AvahiService(name = server_settings[u"servicename"],

1845

servicetype = u"_mandos._tcp",

2027

service = AvahiService(name = server_settings["servicename"],

2028

servicetype = "_mandos._tcp",

1846

2029

protocol = protocol, bus = bus)

1847

2030

if server_settings["interface"]:

1848

2031

service.interface = (if_nametoindex

1849

(str(server_settings[u"interface"])))

1850

1851

if not debug:

1852

# Close all input and output, do double fork, etc.

1853

daemon()

1854

2032

(str(server_settings["interface"])))

2033

1855

2034

global multiprocessing_manager

1856

2035

multiprocessing_manager = multiprocessing.Manager()

1857

2036

1858

2037

client_class = Client

1859

2038

if use_dbus:

1860

client_class = functools.partial(ClientDBus, bus = bus)

2039

client_class = functools.partial(ClientDBusTransitional,

2040

bus = bus)

1861

2041

def client_config_items(config, section):

1862

2042

special_settings = {

1863

2043

"approved_by_default":

1876

2056

client_config, section)))

1877

2057

for section in client_config.sections()))

1878

2058

if not tcp_server.clients:

1879

logger.warning(u"No clients defined")

2059

logger.warning("No clients defined")

1880

2060

1881

2061

if not debug:

1882

2062

try:

1883

2063

with pidfile:

1884

2064

pid = os.getpid()

1885

pidfile.write(str(pid) + "\n")

2065

pidfile.write(str(pid) + "\n".encode("utf-8"))

1886

2066

del pidfile

1887

2067

except IOError:

1888

logger.error(u"Could not write to file %r with PID %d",

2068

logger.error("Could not write to file %r with PID %d",

1889

2069

pidfilename, pid)

1890

2070

except NameError:

1891

2071

# "pidfile" was never created

1893

2073

del pidfilename

1894

2074

1895

2075

signal.signal(signal.SIGINT, signal.SIG_IGN)

1896

2076

1897

2077

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1898

2078

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1899

2079

1901

2081

class MandosDBusService(dbus.service.Object):

1902

2082

"""A D-Bus proxy object"""

1903

2083

def __init__(self):

1904

dbus.service.Object.__init__(self, bus, u"/")

1905

_interface = u"se.bsnet.fukt.Mandos"

2084

dbus.service.Object.__init__(self, bus, "/")

2085

_interface = "se.recompile.Mandos"

1906

2086

1907

@dbus.service.signal(_interface, signature=u"o")

2087

@dbus.service.signal(_interface, signature="o")

1908

2088

def ClientAdded(self, objpath):

1909

2089

"D-Bus signal"

1910

2090

pass

1911

2091

1912

@dbus.service.signal(_interface, signature=u"ss")

2092

@dbus.service.signal(_interface, signature="ss")

1913

2093

def ClientNotFound(self, fingerprint, address):

1914

2094

"D-Bus signal"

1915

2095

pass

1916

2096

1917

@dbus.service.signal(_interface, signature=u"os")

2097

@dbus.service.signal(_interface, signature="os")

1918

2098

def ClientRemoved(self, objpath, name):

1919

2099

"D-Bus signal"

1920

2100

pass

1921

2101

1922

@dbus.service.method(_interface, out_signature=u"ao")

2102

@dbus.service.method(_interface, out_signature="ao")

1923

2103

def GetAllClients(self):

1924

2104

"D-Bus method"

1925

2105

return dbus.Array(c.dbus_object_path

1926

2106

for c in tcp_server.clients)

1927

2107

1928

2108

@dbus.service.method(_interface,

1929

out_signature=u"a{oa{sv}}")

2109

out_signature="a{oa{sv}}")

1930

2110

def GetAllClientsWithProperties(self):

1931

2111

"D-Bus method"

1932

2112

return dbus.Dictionary(

1933

((c.dbus_object_path, c.GetAll(u""))

2113

((c.dbus_object_path, c.GetAll(""))

1934

2114

for c in tcp_server.clients),

1935

signature=u"oa{sv}")

2115

signature="oa{sv}")

1936

2116

1937

@dbus.service.method(_interface, in_signature=u"o")

2117

@dbus.service.method(_interface, in_signature="o")

1938

2118

def RemoveClient(self, object_path):

1939

2119

"D-Bus method"

1940

2120

for c in tcp_server.clients:

1950

2130

1951

2131

del _interface

1952

2132

1953

mandos_dbus_service = MandosDBusService()

2133

class MandosDBusServiceTransitional(MandosDBusService):

2134

__metaclass__ = AlternateDBusNamesMetaclass

2135

mandos_dbus_service = MandosDBusServiceTransitional()

1954

2136

1955

2137

def cleanup():

1956

2138

"Cleanup function; run on exit"

1957

2139

service.cleanup()

1958

2140

2141

multiprocessing.active_children()

1959

2142

while tcp_server.clients:

1960

2143

client = tcp_server.clients.pop()

1961

2144

if use_dbus:

1965

2148

client.disable(quiet=True)

1966

2149

if use_dbus:

1967

2150

# Emit D-Bus signal

1968

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2151

mandos_dbus_service.ClientRemoved(client

2152

.dbus_object_path,

1969

2153

client.name)

1970

2154

1971

2155

atexit.register(cleanup)

1982

2166

# Find out what port we got

1983

2167

service.port = tcp_server.socket.getsockname()[1]

1984

2168

if use_ipv6:

1985

logger.info(u"Now listening on address %r, port %d,"

2169

logger.info("Now listening on address %r, port %d,"

1986

2170

" flowinfo %d, scope_id %d"

1987

2171

% tcp_server.socket.getsockname())

1988

2172

else: # IPv4

1989

logger.info(u"Now listening on address %r, port %d"

2173

logger.info("Now listening on address %r, port %d"

1990

2174

% tcp_server.socket.getsockname())

1991

2175

1992

2176

#service.interface = tcp_server.socket.getsockname()[3]

1995

2179

# From the Avahi example code

1996

2180

try:

1997

2181

service.activate()

1998

except dbus.exceptions.DBusException, error:

1999

logger.critical(u"DBusException: %s", error)

2182

except dbus.exceptions.DBusException as error:

2183

logger.critical("DBusException: %s", error)

2000

2184

cleanup()

2001

2185

sys.exit(1)

2002

2186

# End of Avahi example code

2006

2190

(tcp_server.handle_request

2007

2191

(*args[2:], **kwargs) or True))

2008

2192

2009

logger.debug(u"Starting main loop")

2193

logger.debug("Starting main loop")

2010

2194

main_loop.run()

2011

except AvahiError, error:

2012

logger.critical(u"AvahiError: %s", error)

2195

except AvahiError as error:

2196

logger.critical("AvahiError: %s", error)

2013

2197

cleanup()

2014

2198

sys.exit(1)

2015

2199

except KeyboardInterrupt:

2016

2200

if debug:

2017

print >> sys.stderr

2018

logger.debug(u"Server received KeyboardInterrupt")

2019

logger.debug(u"Server exiting")

2201

print("", file=sys.stderr)

2202

logger.debug("Server received KeyboardInterrupt")

2203

logger.debug("Server exiting")

2020

2204

# Must run before the D-Bus bus name gets deregistered

2021

2205

cleanup()

2022

2206

2207

2023

2208

if __name__ == '__main__':

2024

2209

main()