/mandos/release : revision 237.16.24

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

61

62

import functools

62

63

import cPickle as pickle

63

64

import multiprocessing

65

import types

64

66

65

67

import dbus

66

68

import dbus.service

81

83

SO_BINDTODEVICE = None

82

84

83

85

84

version = "1.0.14"

86

version = "1.4.1"

85

87

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

88

90

syslogger = (logging.handlers.SysLogHandler

89

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

90

address = "/dev/log"))

92

address = str("/dev/log")))

91

93

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

94

96

logger.addHandler(syslogger)

95

97

96

98

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

100

102

logger.addHandler(console)

101

103

102

104

class AvahiError(Exception):

119

121

Attributes:

120

122

interface: integer; avahi.IF_UNSPEC or an interface index.

121

123

Used to optionally bind to the specified interface.

122

name: string; Example: u'Mandos'

123

type: string; Example: u'_mandos._tcp'.

124

name: string; Example: 'Mandos'

125

type: string; Example: '_mandos._tcp'.

124

126

See <http://www.dns-sd.org/ServiceTypes.html>

125

127

port: integer; what port to announce

126

128

TXT: list of strings; TXT record for the service

135

137

"""

136

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

137

139

servicetype = None, port = None, TXT = None,

138

domain = u"", host = u"", max_renames = 32768,

140

domain = "", host = "", max_renames = 32768,

139

141

protocol = avahi.PROTO_UNSPEC, bus = None):

140

142

self.interface = interface

141

143

self.name = name

150

152

self.group = None # our entry group

151

153

self.server = None

152

154

self.bus = bus

155

self.entry_group_state_changed_match = None

153

156

def rename(self):

154

157

"""Derived from the Avahi example code"""

155

158

if self.rename_count >= self.max_renames:

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

158

161

self.rename_count)

159

raise AvahiServiceError(u"Too many renames")

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server

164

.GetAlternativeServiceName(self.name))

165

logger.info("Changing Zeroconf service name to %r ...",

162

166

self.name)

163

167

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

166

170

% self.name))

167

171

self.remove()

168

172

try:

169

173

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

174

except dbus.exceptions.DBusException as error:

175

logger.critical("DBusException: %s", error)

172

176

self.cleanup()

173

177

os._exit(1)

174

178

self.rename_count += 1

175

179

def remove(self):

176

180

"""Derived from the Avahi example code"""

181

if self.entry_group_state_changed_match is not None:

182

self.entry_group_state_changed_match.remove()

183

self.entry_group_state_changed_match = None

177

184

if self.group is not None:

178

185

self.group.Reset()

179

186

def add(self):

180

187

"""Derived from the Avahi example code"""

188

self.remove()

181

189

if self.group is None:

182

190

self.group = dbus.Interface(

183

191

self.bus.get_object(avahi.DBUS_NAME,

184

192

self.server.EntryGroupNew()),

185

193

avahi.DBUS_INTERFACE_ENTRY_GROUP)

186

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

194

self.entry_group_state_changed_match = (

195

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

190

198

self.name, self.type)

191

199

self.group.AddService(

192

200

self.interface,

199

207

self.group.Commit()

200

208

def entry_group_state_changed(self, state, error):

201

209

"""Derived from the Avahi example code"""

202

logger.debug(u"Avahi entry group state change: %i", state)

210

logger.debug("Avahi entry group state change: %i", state)

203

211

204

212

if state == avahi.ENTRY_GROUP_ESTABLISHED:

205

logger.debug(u"Zeroconf service established.")

213

logger.debug("Zeroconf service established.")

206

214

elif state == avahi.ENTRY_GROUP_COLLISION:

207

logger.warning(u"Zeroconf service name collision.")

215

logger.info("Zeroconf service name collision.")

208

216

self.rename()

209

217

elif state == avahi.ENTRY_GROUP_FAILURE:

210

logger.critical(u"Avahi: Error in group state changed %s",

218

logger.critical("Avahi: Error in group state changed %s",

211

219

unicode(error))

212

raise AvahiGroupError(u"State changed: %s"

220

raise AvahiGroupError("State changed: %s"

213

221

% unicode(error))

214

222

def cleanup(self):

215

223

"""Derived from the Avahi example code"""

216

224

if self.group is not None:

217

self.group.Free()

225

try:

226

self.group.Free()

227

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

229

pass

218

230

self.group = None

219

def server_state_changed(self, state):

231

self.remove()

232

def server_state_changed(self, state, error=None):

220

233

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

222

if state == avahi.SERVER_COLLISION:

223

logger.error(u"Zeroconf server name collision")

224

self.remove()

234

logger.debug("Avahi server state change: %i", state)

235

bad_states = { avahi.SERVER_INVALID:

236

"Zeroconf server invalid",

237

avahi.SERVER_REGISTERING: None,

238

avahi.SERVER_COLLISION:

239

"Zeroconf server name collision",

240

avahi.SERVER_FAILURE:

241

"Zeroconf server failure" }

242

if state in bad_states:

243

if bad_states[state] is not None:

244

if error is None:

245

logger.error(bad_states[state])

246

else:

247

logger.error(bad_states[state] + ": %r", error)

248

self.cleanup()

225

249

elif state == avahi.SERVER_RUNNING:

226

250

self.add()

251

else:

252

if error is None:

253

logger.debug("Unknown state: %r", state)

254

else:

255

logger.debug("Unknown state: %r: %r", state, error)

227

256

def activate(self):

228

257

"""Derived from the Avahi example code"""

229

258

if self.server is None:

230

259

self.server = dbus.Interface(

231

260

self.bus.get_object(avahi.DBUS_NAME,

232

avahi.DBUS_PATH_SERVER),

261

avahi.DBUS_PATH_SERVER,

262

follow_name_owner_changes=True),

233

263

avahi.DBUS_INTERFACE_SERVER)

234

self.server.connect_to_signal(u"StateChanged",

264

self.server.connect_to_signal("StateChanged",

235

265

self.server_state_changed)

236

266

self.server_state_changed(self.server.GetState())

237

267

238

268

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

274

239

275

class Client(object):

240

276

"""A representation of a client host served by this server.

241

277

269

305

secret: bytestring; sent verbatim (over TLS) to client

270

306

timeout: datetime.timedelta(); How long from last_checked_ok

271

307

until this client is disabled

308

extended_timeout: extra long timeout when password has been sent

272

309

runtime_expansions: Allowed attributes for runtime expansion.

310

expires: datetime.datetime(); time (UTC) when a client will be

311

disabled, or None

273

312

"""

274

313

275

runtime_expansions = (u"approval_delay", u"approval_duration",

276

u"created", u"enabled", u"fingerprint",

277

u"host", u"interval", u"last_checked_ok",

278

u"last_enabled", u"name", u"timeout")

279

280

@staticmethod

281

def _timedelta_to_milliseconds(td):

282

"Convert a datetime.timedelta() to milliseconds"

283

return ((td.days * 24 * 60 * 60 * 1000)

284

+ (td.seconds * 1000)

285

+ (td.microseconds // 1000))

314

runtime_expansions = ("approval_delay", "approval_duration",

315

"created", "enabled", "fingerprint",

316

"host", "interval", "last_checked_ok",

317

"last_enabled", "name", "timeout")

286

318

287

319

def timeout_milliseconds(self):

288

320

"Return the 'timeout' attribute in milliseconds"

289

return self._timedelta_to_milliseconds(self.timeout)

321

return _timedelta_to_milliseconds(self.timeout)

322

323

def extended_timeout_milliseconds(self):

324

"Return the 'extended_timeout' attribute in milliseconds"

325

return _timedelta_to_milliseconds(self.extended_timeout)

290

326

291

327

def interval_milliseconds(self):

292

328

"Return the 'interval' attribute in milliseconds"

293

return self._timedelta_to_milliseconds(self.interval)

294

329

return _timedelta_to_milliseconds(self.interval)

330

295

331

def approval_delay_milliseconds(self):

296

return self._timedelta_to_milliseconds(self.approval_delay)

332

return _timedelta_to_milliseconds(self.approval_delay)

297

333

298

334

def __init__(self, name = None, disable_hook=None, config=None):

299

335

"""Note: the 'checker' key in 'config' sets the

302

338

self.name = name

303

339

if config is None:

304

340

config = {}

305

logger.debug(u"Creating client %r", self.name)

341

logger.debug("Creating client %r", self.name)

306

342

# Uppercase and remove spaces from fingerprint for later

307

343

# comparison purposes with return value from the fingerprint()

308

344

# function

309

self.fingerprint = (config[u"fingerprint"].upper()

310

.replace(u" ", u""))

311

logger.debug(u" Fingerprint: %s", self.fingerprint)

312

if u"secret" in config:

313

self.secret = config[u"secret"].decode(u"base64")

314

elif u"secfile" in config:

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

347

logger.debug(" Fingerprint: %s", self.fingerprint)

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

315

351

with open(os.path.expanduser(os.path.expandvars

316

(config[u"secfile"])),

352

(config["secfile"])),

317

353

"rb") as secfile:

318

354

self.secret = secfile.read()

319

355

else:

320

raise TypeError(u"No secret or secfile for client %s"

356

raise TypeError("No secret or secfile for client %s"

321

357

% self.name)

322

self.host = config.get(u"host", u"")

358

self.host = config.get("host", "")

323

359

self.created = datetime.datetime.utcnow()

324

360

self.enabled = False

325

361

self.last_approval_request = None

326

362

self.last_enabled = None

327

363

self.last_checked_ok = None

328

self.timeout = string_to_delta(config[u"timeout"])

329

self.interval = string_to_delta(config[u"interval"])

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

330

368

self.disable_hook = disable_hook

331

369

self.checker = None

332

370

self.checker_initiator_tag = None

333

371

self.disable_initiator_tag = None

372

self.expires = None

334

373

self.checker_callback_tag = None

335

self.checker_command = config[u"checker"]

374

self.checker_command = config["checker"]

336

375

self.current_checker_command = None

337

376

self.last_connect = None

338

377

self._approved = None

339

self.approved_by_default = config.get(u"approved_by_default",

378

self.approved_by_default = config.get("approved_by_default",

340

379

True)

341

380

self.approvals_pending = 0

342

381

self.approval_delay = string_to_delta(

343

config[u"approval_delay"])

382

config["approval_delay"])

344

383

self.approval_duration = string_to_delta(

345

config[u"approval_duration"])

346

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

384

config["approval_duration"])

385

self.changedstate = (multiprocessing_manager

386

.Condition(multiprocessing_manager

387

.Lock()))

347

388

348

389

def send_changedstate(self):

349

390

self.changedstate.acquire()

350

391

self.changedstate.notify_all()

351

392

self.changedstate.release()

352

393

353

394

def enable(self):

354

395

"""Start this client's checker and timeout hooks"""

355

if getattr(self, u"enabled", False):

396

if getattr(self, "enabled", False):

356

397

# Already enabled

357

398

return

358

399

self.send_changedstate()

359

self.last_enabled = datetime.datetime.utcnow()

360

400

# Schedule a new checker to be started an 'interval' from now,

361

401

# and every interval from then on.

362

402

self.checker_initiator_tag = (gobject.timeout_add

363

403

(self.interval_milliseconds(),

364

404

self.start_checker))

365

405

# Schedule a disable() when 'timeout' has passed

406

self.expires = datetime.datetime.utcnow() + self.timeout

366

407

self.disable_initiator_tag = (gobject.timeout_add

367

408

(self.timeout_milliseconds(),

368

409

self.disable))

369

410

self.enabled = True

411

self.last_enabled = datetime.datetime.utcnow()

370

412

# Also start a new checker *right now*.

371

413

self.start_checker()

372

414

377

419

if not quiet:

378

420

self.send_changedstate()

379

421

if not quiet:

380

logger.info(u"Disabling client %s", self.name)

381

if getattr(self, u"disable_initiator_tag", False):

422

logger.info("Disabling client %s", self.name)

423

if getattr(self, "disable_initiator_tag", False):

382

424

gobject.source_remove(self.disable_initiator_tag)

383

425

self.disable_initiator_tag = None

384

if getattr(self, u"checker_initiator_tag", False):

426

self.expires = None

427

if getattr(self, "checker_initiator_tag", False):

385

428

gobject.source_remove(self.checker_initiator_tag)

386

429

self.checker_initiator_tag = None

387

430

self.stop_checker()

402

445

if os.WIFEXITED(condition):

403

446

exitstatus = os.WEXITSTATUS(condition)

404

447

if exitstatus == 0:

405

logger.info(u"Checker for %(name)s succeeded",

448

logger.info("Checker for %(name)s succeeded",

406

449

vars(self))

407

450

self.checked_ok()

408

451

else:

409

logger.info(u"Checker for %(name)s failed",

452

logger.info("Checker for %(name)s failed",

410

453

vars(self))

411

454

else:

412

logger.warning(u"Checker for %(name)s crashed?",

455

logger.warning("Checker for %(name)s crashed?",

413

456

vars(self))

414

457

415

def checked_ok(self):

458

def checked_ok(self, timeout=None):

416

459

"""Bump up the timeout for this client.

417

460

418

461

This should only be called when the client has been seen,

419

462

alive and well.

420

463

"""

464

if timeout is None:

465

timeout = self.timeout

421

466

self.last_checked_ok = datetime.datetime.utcnow()

422

gobject.source_remove(self.disable_initiator_tag)

423

self.disable_initiator_tag = (gobject.timeout_add

424

(self.timeout_milliseconds(),

425

self.disable))

467

if self.disable_initiator_tag is not None:

468

gobject.source_remove(self.disable_initiator_tag)

469

if getattr(self, "enabled", False):

470

self.disable_initiator_tag = (gobject.timeout_add

471

(_timedelta_to_milliseconds

472

(timeout), self.disable))

473

self.expires = datetime.datetime.utcnow() + timeout

426

474

427

475

def need_approval(self):

428

476

self.last_approval_request = datetime.datetime.utcnow()

444

492

# If a checker exists, make sure it is not a zombie

445

493

try:

446

494

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

447

except (AttributeError, OSError), error:

495

except (AttributeError, OSError) as error:

448

496

if (isinstance(error, OSError)

449

497

and error.errno != errno.ECHILD):

450

498

raise error

451

499

else:

452

500

if pid:

453

logger.warning(u"Checker was a zombie")

501

logger.warning("Checker was a zombie")

454

502

gobject.source_remove(self.checker_callback_tag)

455

503

self.checker_callback(pid, status,

456

504

self.current_checker_command)

463

511

# Escape attributes for the shell

464

512

escaped_attrs = dict(

465

513

(attr,

466

re.escape(unicode(str(getattr(self, attr, u"")),

514

re.escape(unicode(str(getattr(self, attr, "")),

467

515

errors=

468

u'replace')))

516

'replace')))

469

517

for attr in

470

518

self.runtime_expansions)

471

519

472

520

try:

473

521

command = self.checker_command % escaped_attrs

474

except TypeError, error:

475

logger.error(u'Could not format string "%s":'

476

u' %s', self.checker_command, error)

522

except TypeError as error:

523

logger.error('Could not format string "%s":'

524

' %s', self.checker_command, error)

477

525

return True # Try again later

478

526

self.current_checker_command = command

479

527

try:

480

logger.info(u"Starting checker %r for %s",

528

logger.info("Starting checker %r for %s",

481

529

command, self.name)

482

530

# We don't need to redirect stdout and stderr, since

483

531

# in normal mode, that is already done by daemon(),

485

533

# always replaced by /dev/null.)

486

534

self.checker = subprocess.Popen(command,

487

535

close_fds=True,

488

shell=True, cwd=u"/")

536

shell=True, cwd="/")

489

537

self.checker_callback_tag = (gobject.child_watch_add

490

538

(self.checker.pid,

491

539

self.checker_callback,

496

544

if pid:

497

545

gobject.source_remove(self.checker_callback_tag)

498

546

self.checker_callback(pid, status, command)

499

except OSError, error:

500

logger.error(u"Failed to start subprocess: %s",

547

except OSError as error:

548

logger.error("Failed to start subprocess: %s",

501

549

error)

502

550

# Re-run this periodically if run by gobject.timeout_add

503

551

return True

507

555

if self.checker_callback_tag:

508

556

gobject.source_remove(self.checker_callback_tag)

509

557

self.checker_callback_tag = None

510

if getattr(self, u"checker", None) is None:

558

if getattr(self, "checker", None) is None:

511

559

return

512

logger.debug(u"Stopping checker for %(name)s", vars(self))

560

logger.debug("Stopping checker for %(name)s", vars(self))

513

561

try:

514

562

os.kill(self.checker.pid, signal.SIGTERM)

515

563

#time.sleep(0.5)

516

564

#if self.checker.poll() is None:

517

565

# os.kill(self.checker.pid, signal.SIGKILL)

518

except OSError, error:

566

except OSError as error:

519

567

if error.errno != errno.ESRCH: # No such process

520

568

raise

521

569

self.checker = None

522

570

523

def dbus_service_property(dbus_interface, signature=u"v",

524

access=u"readwrite", byte_arrays=False):

571

572

def dbus_service_property(dbus_interface, signature="v",

573

access="readwrite", byte_arrays=False):

525

574

"""Decorators for marking methods of a DBusObjectWithProperties to

526

575

become properties on the D-Bus.

527

576

534

583

"""

535

584

# Encoding deeply encoded byte arrays is not supported yet by the

536

585

# "Set" method, so we fail early here:

537

if byte_arrays and signature != u"ay":

538

raise ValueError(u"Byte arrays not supported for non-'ay'"

539

u" signature %r" % signature)

586

if byte_arrays and signature != "ay":

587

raise ValueError("Byte arrays not supported for non-'ay'"

588

" signature %r" % signature)

540

589

def decorator(func):

541

590

func._dbus_is_property = True

542

591

func._dbus_interface = dbus_interface

543

592

func._dbus_signature = signature

544

593

func._dbus_access = access

545

594

func._dbus_name = func.__name__

546

if func._dbus_name.endswith(u"_dbus_property"):

595

if func._dbus_name.endswith("_dbus_property"):

547

596

func._dbus_name = func._dbus_name[:-14]

548

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

597

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

549

598

return func

550

599

return decorator

551

600

571

620

572

621

class DBusObjectWithProperties(dbus.service.Object):

573

622

"""A D-Bus object with properties.

574

623

575

624

Classes inheriting from this can use the dbus_service_property

576

625

decorator to expose methods as D-Bus properties. It exposes the

577

626

standard Get(), Set(), and GetAll() methods on the D-Bus.

579

628

580

629

@staticmethod

581

630

def _is_dbus_property(obj):

582

return getattr(obj, u"_dbus_is_property", False)

631

return getattr(obj, "_dbus_is_property", False)

583

632

584

633

def _get_all_dbus_properties(self):

585

634

"""Returns a generator of (name, attribute) pairs

586

635

"""

587

return ((prop._dbus_name, prop)

636

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

637

for cls in self.__class__.__mro__

588

638

for name, prop in

589

inspect.getmembers(self, self._is_dbus_property))

639

inspect.getmembers(cls, self._is_dbus_property))

590

640

591

641

def _get_dbus_property(self, interface_name, property_name):

592

642

"""Returns a bound method if one exists which is a D-Bus

593

643

property with the specified name and interface.

594

644

"""

595

for name in (property_name,

596

property_name + u"_dbus_property"):

597

prop = getattr(self, name, None)

598

if (prop is None

599

or not self._is_dbus_property(prop)

600

or prop._dbus_name != property_name

601

or (interface_name and prop._dbus_interface

602

and interface_name != prop._dbus_interface)):

603

continue

604

return prop

645

for cls in self.__class__.__mro__:

646

for name, value in (inspect.getmembers

647

(cls, self._is_dbus_property)):

648

if (value._dbus_name == property_name

649

and value._dbus_interface == interface_name):

650

return value.__get__(self)

651

605

652

# No such property

606

raise DBusPropertyNotFound(self.dbus_object_path + u":"

607

+ interface_name + u"."

653

raise DBusPropertyNotFound(self.dbus_object_path + ":"

654

+ interface_name + "."

608

655

+ property_name)

609

656

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

611

out_signature=u"v")

657

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

658

out_signature="v")

612

659

def Get(self, interface_name, property_name):

613

660

"""Standard D-Bus property Get() method, see D-Bus standard.

614

661

"""

615

662

prop = self._get_dbus_property(interface_name, property_name)

616

if prop._dbus_access == u"write":

663

if prop._dbus_access == "write":

617

664

raise DBusPropertyAccessException(property_name)

618

665

value = prop()

619

if not hasattr(value, u"variant_level"):

666

if not hasattr(value, "variant_level"):

620

667

return value

621

668

return type(value)(value, variant_level=value.variant_level+1)

622

669

623

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

670

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

624

671

def Set(self, interface_name, property_name, value):

625

672

"""Standard D-Bus property Set() method, see D-Bus standard.

626

673

"""

627

674

prop = self._get_dbus_property(interface_name, property_name)

628

if prop._dbus_access == u"read":

675

if prop._dbus_access == "read":

629

676

raise DBusPropertyAccessException(property_name)

630

if prop._dbus_get_args_options[u"byte_arrays"]:

677

if prop._dbus_get_args_options["byte_arrays"]:

631

678

# The byte_arrays option is not supported yet on

632

679

# signatures other than "ay".

633

if prop._dbus_signature != u"ay":

680

if prop._dbus_signature != "ay":

634

681

raise ValueError

635

682

value = dbus.ByteArray(''.join(unichr(byte)

636

683

for byte in value))

637

684

prop(value)

638

685

639

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

640

out_signature=u"a{sv}")

686

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

687

out_signature="a{sv}")

641

688

def GetAll(self, interface_name):

642

689

"""Standard D-Bus property GetAll() method, see D-Bus

643

690

standard.

644

691

645

692

Note: Will not include properties with access="write".

646

693

"""

647

694

all = {}

651

698

# Interface non-empty but did not match

652

699

continue

653

700

# Ignore write-only properties

654

if prop._dbus_access == u"write":

701

if prop._dbus_access == "write":

655

702

continue

656

703

value = prop()

657

if not hasattr(value, u"variant_level"):

704

if not hasattr(value, "variant_level"):

658

705

all[name] = value

659

706

continue

660

707

all[name] = type(value)(value, variant_level=

661

708

value.variant_level+1)

662

return dbus.Dictionary(all, signature=u"sv")

709

return dbus.Dictionary(all, signature="sv")

663

710

664

711

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

665

out_signature=u"s",

712

out_signature="s",

666

713

path_keyword='object_path',

667

714

connection_keyword='connection')

668

715

def Introspect(self, object_path, connection):

673

720

try:

674

721

document = xml.dom.minidom.parseString(xmlstring)

675

722

def make_tag(document, name, prop):

676

e = document.createElement(u"property")

677

e.setAttribute(u"name", name)

678

e.setAttribute(u"type", prop._dbus_signature)

679

e.setAttribute(u"access", prop._dbus_access)

723

e = document.createElement("property")

724

e.setAttribute("name", name)

725

e.setAttribute("type", prop._dbus_signature)

726

e.setAttribute("access", prop._dbus_access)

680

727

return e

681

for if_tag in document.getElementsByTagName(u"interface"):

728

for if_tag in document.getElementsByTagName("interface"):

682

729

for tag in (make_tag(document, name, prop)

683

730

for name, prop

684

731

in self._get_all_dbus_properties()

685

732

if prop._dbus_interface

686

== if_tag.getAttribute(u"name")):

733

== if_tag.getAttribute("name")):

687

734

if_tag.appendChild(tag)

688

735

# Add the names to the return values for the

689

736

# "org.freedesktop.DBus.Properties" methods

690

if (if_tag.getAttribute(u"name")

691

== u"org.freedesktop.DBus.Properties"):

692

for cn in if_tag.getElementsByTagName(u"method"):

693

if cn.getAttribute(u"name") == u"Get":

694

for arg in cn.getElementsByTagName(u"arg"):

695

if (arg.getAttribute(u"direction")

696

== u"out"):

697

arg.setAttribute(u"name", u"value")

698

elif cn.getAttribute(u"name") == u"GetAll":

699

for arg in cn.getElementsByTagName(u"arg"):

700

if (arg.getAttribute(u"direction")

701

== u"out"):

702

arg.setAttribute(u"name", u"props")

703

xmlstring = document.toxml(u"utf-8")

737

if (if_tag.getAttribute("name")

738

== "org.freedesktop.DBus.Properties"):

739

for cn in if_tag.getElementsByTagName("method"):

740

if cn.getAttribute("name") == "Get":

741

for arg in cn.getElementsByTagName("arg"):

742

if (arg.getAttribute("direction")

743

== "out"):

744

arg.setAttribute("name", "value")

745

elif cn.getAttribute("name") == "GetAll":

746

for arg in cn.getElementsByTagName("arg"):

747

if (arg.getAttribute("direction")

748

== "out"):

749

arg.setAttribute("name", "props")

750

xmlstring = document.toxml("utf-8")

704

751

document.unlink()

705

752

except (AttributeError, xml.dom.DOMException,

706

xml.parsers.expat.ExpatError), error:

707

logger.error(u"Failed to override Introspection method",

753

xml.parsers.expat.ExpatError) as error:

754

logger.error("Failed to override Introspection method",

708

755

error)

709

756

return xmlstring

710

757

711

758

759

def datetime_to_dbus (dt, variant_level=0):

760

"""Convert a UTC datetime.datetime() to a D-Bus type."""

761

if dt is None:

762

return dbus.String("", variant_level = variant_level)

763

return dbus.String(dt.isoformat(),

764

variant_level=variant_level)

765

766

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

767

.__metaclass__):

768

"""Applied to an empty subclass of a D-Bus object, this metaclass

769

will add additional D-Bus attributes matching a certain pattern.

770

"""

771

def __new__(mcs, name, bases, attr):

772

# Go through all the base classes which could have D-Bus

773

# methods, signals, or properties in them

774

for base in (b for b in bases

775

if issubclass(b, dbus.service.Object)):

776

# Go though all attributes of the base class

777

for attrname, attribute in inspect.getmembers(base):

778

# Ignore non-D-Bus attributes, and D-Bus attributes

779

# with the wrong interface name

780

if (not hasattr(attribute, "_dbus_interface")

781

or not attribute._dbus_interface

782

.startswith("se.recompile.Mandos")):

783

continue

784

# Create an alternate D-Bus interface name based on

785

# the current name

786

alt_interface = (attribute._dbus_interface

787

.replace("se.recompile.Mandos",

788

"se.bsnet.fukt.Mandos"))

789

# Is this a D-Bus signal?

790

if getattr(attribute, "_dbus_is_signal", False):

791

# Extract the original non-method function by

792

# black magic

793

nonmethod_func = (dict(

794

zip(attribute.func_code.co_freevars,

795

attribute.__closure__))["func"]

796

.cell_contents)

797

# Create a new, but exactly alike, function

798

# object, and decorate it to be a new D-Bus signal

799

# with the alternate D-Bus interface name

800

new_function = (dbus.service.signal

801

(alt_interface,

802

attribute._dbus_signature)

803

(types.FunctionType(

804

nonmethod_func.func_code,

805

nonmethod_func.func_globals,

806

nonmethod_func.func_name,

807

nonmethod_func.func_defaults,

808

nonmethod_func.func_closure)))

809

# Define a creator of a function to call both the

810

# old and new functions, so both the old and new

811

# signals gets sent when the function is called

812

def fixscope(func1, func2):

813

"""This function is a scope container to pass

814

func1 and func2 to the "call_both" function

815

outside of its arguments"""

816

def call_both(*args, **kwargs):

817

"""This function will emit two D-Bus

818

signals by calling func1 and func2"""

819

func1(*args, **kwargs)

820

func2(*args, **kwargs)

821

return call_both

822

# Create the "call_both" function and add it to

823

# the class

824

attr[attrname] = fixscope(attribute,

825

new_function)

826

# Is this a D-Bus method?

827

elif getattr(attribute, "_dbus_is_method", False):

828

# Create a new, but exactly alike, function

829

# object. Decorate it to be a new D-Bus method

830

# with the alternate D-Bus interface name. Add it

831

# to the class.

832

attr[attrname] = (dbus.service.method

833

(alt_interface,

834

attribute._dbus_in_signature,

835

attribute._dbus_out_signature)

836

(types.FunctionType

837

(attribute.func_code,

838

attribute.func_globals,

839

attribute.func_name,

840

attribute.func_defaults,

841

attribute.func_closure)))

842

# Is this a D-Bus property?

843

elif getattr(attribute, "_dbus_is_property", False):

844

# Create a new, but exactly alike, function

845

# object, and decorate it to be a new D-Bus

846

# property with the alternate D-Bus interface

847

# name. Add it to the class.

848

attr[attrname] = (dbus_service_property

849

(alt_interface,

850

attribute._dbus_signature,

851

attribute._dbus_access,

852

attribute

853

._dbus_get_args_options

854

["byte_arrays"])

855

(types.FunctionType

856

(attribute.func_code,

857

attribute.func_globals,

858

attribute.func_name,

859

attribute.func_defaults,

860

attribute.func_closure)))

861

return type.__new__(mcs, name, bases, attr)

862

712

863

class ClientDBus(Client, DBusObjectWithProperties):

713

864

"""A Client class using D-Bus

714

865

718

869

"""

719

870

720

871

runtime_expansions = (Client.runtime_expansions

721

+ (u"dbus_object_path",))

872

+ ("dbus_object_path",))

722

873

723

874

# dbus.service.Object doesn't use super(), so we can't either.

724

875

729

880

# Only now, when this client is initialized, can it show up on

730

881

# the D-Bus

731

882

client_object_name = unicode(self.name).translate(

732

{ord(u"."): ord(u"_"),

733

ord(u"-"): ord(u"_")})

883

{ord("."): ord("_"),

884

ord("-"): ord("_")})

734

885

self.dbus_object_path = (dbus.ObjectPath

735

(u"/clients/" + client_object_name))

886

("/clients/" + client_object_name))

736

887

DBusObjectWithProperties.__init__(self, self.bus,

737

888

self.dbus_object_path)

738

889

739

def _get_approvals_pending(self):

740

return self._approvals_pending

741

def _set_approvals_pending(self, value):

742

old_value = self._approvals_pending

743

self._approvals_pending = value

744

bval = bool(value)

745

if (hasattr(self, "dbus_object_path")

746

and bval is not bool(old_value)):

747

dbus_bool = dbus.Boolean(bval, variant_level=1)

748

self.PropertyChanged(dbus.String(u"ApprovalPending"),

749

dbus_bool)

890

def notifychangeproperty(transform_func,

891

dbus_name, type_func=lambda x: x,

892

variant_level=1):

893

""" Modify a variable so that it's a property which announces

894

its changes to DBus.

750

895

751

approvals_pending = property(_get_approvals_pending,

752

_set_approvals_pending)

753

del _get_approvals_pending, _set_approvals_pending

754

755

@staticmethod

756

def _datetime_to_dbus(dt, variant_level=0):

757

"""Convert a UTC datetime.datetime() to a D-Bus type."""

758

return dbus.String(dt.isoformat(),

759

variant_level=variant_level)

760

761

def enable(self):

762

oldstate = getattr(self, u"enabled", False)

763

r = Client.enable(self)

764

if oldstate != self.enabled:

765

# Emit D-Bus signals

766

self.PropertyChanged(dbus.String(u"Enabled"),

767

dbus.Boolean(True, variant_level=1))

768

self.PropertyChanged(

769

dbus.String(u"LastEnabled"),

770

self._datetime_to_dbus(self.last_enabled,

771

variant_level=1))

772

return r

773

774

def disable(self, quiet = False):

775

oldstate = getattr(self, u"enabled", False)

776

r = Client.disable(self, quiet=quiet)

777

if not quiet and oldstate != self.enabled:

778

# Emit D-Bus signal

779

self.PropertyChanged(dbus.String(u"Enabled"),

780

dbus.Boolean(False, variant_level=1))

781

return r

896

transform_fun: Function that takes a value and a variant_level

897

and transforms it to a D-Bus type.

898

dbus_name: D-Bus name of the variable

899

type_func: Function that transform the value before sending it

900

to the D-Bus. Default: no transform

901

variant_level: D-Bus variant level. Default: 1

902

"""

903

attrname = "_{0}".format(dbus_name)

904

def setter(self, value):

905

if hasattr(self, "dbus_object_path"):

906

if (not hasattr(self, attrname) or

907

type_func(getattr(self, attrname, None))

908

!= type_func(value)):

909

dbus_value = transform_func(type_func(value),

910

variant_level

911

=variant_level)

912

self.PropertyChanged(dbus.String(dbus_name),

913

dbus_value)

914

setattr(self, attrname, value)

915

916

return property(lambda self: getattr(self, attrname), setter)

917

918

919

expires = notifychangeproperty(datetime_to_dbus, "Expires")

920

approvals_pending = notifychangeproperty(dbus.Boolean,

921

"ApprovalPending",

922

type_func = bool)

923

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

924

last_enabled = notifychangeproperty(datetime_to_dbus,

925

"LastEnabled")

926

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

927

type_func = lambda checker:

928

checker is not None)

929

last_checked_ok = notifychangeproperty(datetime_to_dbus,

930

"LastCheckedOK")

931

last_approval_request = notifychangeproperty(

932

datetime_to_dbus, "LastApprovalRequest")

933

approved_by_default = notifychangeproperty(dbus.Boolean,

934

"ApprovedByDefault")

935

approval_delay = notifychangeproperty(dbus.UInt16,

936

"ApprovalDelay",

937

type_func =

938

_timedelta_to_milliseconds)

939

approval_duration = notifychangeproperty(

940

dbus.UInt16, "ApprovalDuration",

941

type_func = _timedelta_to_milliseconds)

942

host = notifychangeproperty(dbus.String, "Host")

943

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

944

type_func =

945

_timedelta_to_milliseconds)

946

extended_timeout = notifychangeproperty(

947

dbus.UInt16, "ExtendedTimeout",

948

type_func = _timedelta_to_milliseconds)

949

interval = notifychangeproperty(dbus.UInt16,

950

"Interval",

951

type_func =

952

_timedelta_to_milliseconds)

953

checker_command = notifychangeproperty(dbus.String, "Checker")

954

955

del notifychangeproperty

782

956

783

957

def __del__(self, *args, **kwargs):

784

958

try:

785

959

self.remove_from_connection()

786

960

except LookupError:

787

961

pass

788

if hasattr(DBusObjectWithProperties, u"__del__"):

962

if hasattr(DBusObjectWithProperties, "__del__"):

789

963

DBusObjectWithProperties.__del__(self, *args, **kwargs)

790

964

Client.__del__(self, *args, **kwargs)

791

965

793

967

*args, **kwargs):

794

968

self.checker_callback_tag = None

795

969

self.checker = None

796

# Emit D-Bus signal

797

self.PropertyChanged(dbus.String(u"CheckerRunning"),

798

dbus.Boolean(False, variant_level=1))

799

970

if os.WIFEXITED(condition):

800

971

exitstatus = os.WEXITSTATUS(condition)

801

972

# Emit D-Bus signal

811

982

return Client.checker_callback(self, pid, condition, command,

812

983

*args, **kwargs)

813

984

814

def checked_ok(self, *args, **kwargs):

815

r = Client.checked_ok(self, *args, **kwargs)

816

# Emit D-Bus signal

817

self.PropertyChanged(

818

dbus.String(u"LastCheckedOK"),

819

(self._datetime_to_dbus(self.last_checked_ok,

820

variant_level=1)))

821

return r

822

823

def need_approval(self, *args, **kwargs):

824

r = Client.need_approval(self, *args, **kwargs)

825

# Emit D-Bus signal

826

self.PropertyChanged(

827

dbus.String(u"LastApprovalRequest"),

828

(self._datetime_to_dbus(self.last_approval_request,

829

variant_level=1)))

830

return r

831

832

985

def start_checker(self, *args, **kwargs):

833

986

old_checker = self.checker

834

987

if self.checker is not None:

841

994

and old_checker_pid != self.checker.pid):

842

995

# Emit D-Bus signal

843

996

self.CheckerStarted(self.current_checker_command)

844

self.PropertyChanged(

845

dbus.String(u"CheckerRunning"),

846

dbus.Boolean(True, variant_level=1))

847

997

return r

848

998

849

def stop_checker(self, *args, **kwargs):

850

old_checker = getattr(self, u"checker", None)

851

r = Client.stop_checker(self, *args, **kwargs)

852

if (old_checker is not None

853

and getattr(self, u"checker", None) is None):

854

self.PropertyChanged(dbus.String(u"CheckerRunning"),

855

dbus.Boolean(False, variant_level=1))

856

return r

857

858

999

def _reset_approved(self):

859

1000

self._approved = None

860

1001

return False

862

1003

def approve(self, value=True):

863

1004

self.send_changedstate()

864

1005

self._approved = value

865

gobject.timeout_add(self._timedelta_to_milliseconds

1006

gobject.timeout_add(_timedelta_to_milliseconds

866

1007

(self.approval_duration),

867

1008

self._reset_approved)

868

1009

869

1010

870

1011

## D-Bus methods, signals & properties

871

_interface = u"se.bsnet.fukt.Mandos.Client"

1012

_interface = "se.recompile.Mandos.Client"

872

1013

873

1014

## Signals

874

1015

875

1016

# CheckerCompleted - signal

876

@dbus.service.signal(_interface, signature=u"nxs")

1017

@dbus.service.signal(_interface, signature="nxs")

877

1018

def CheckerCompleted(self, exitcode, waitstatus, command):

878

1019

"D-Bus signal"

879

1020

pass

880

1021

881

1022

# CheckerStarted - signal

882

@dbus.service.signal(_interface, signature=u"s")

1023

@dbus.service.signal(_interface, signature="s")

883

1024

def CheckerStarted(self, command):

884

1025

"D-Bus signal"

885

1026

pass

886

1027

887

1028

# PropertyChanged - signal

888

@dbus.service.signal(_interface, signature=u"sv")

1029

@dbus.service.signal(_interface, signature="sv")

889

1030

def PropertyChanged(self, property, value):

890

1031

"D-Bus signal"

891

1032

pass

900

1041

pass

901

1042

902

1043

# Rejected - signal

903

@dbus.service.signal(_interface, signature=u"s")

1044

@dbus.service.signal(_interface, signature="s")

904

1045

def Rejected(self, reason):

905

1046

"D-Bus signal"

906

1047

pass

907

1048

908

1049

# NeedApproval - signal

909

@dbus.service.signal(_interface, signature=u"tb")

1050

@dbus.service.signal(_interface, signature="tb")

910

1051

def NeedApproval(self, timeout, default):

911

1052

"D-Bus signal"

912

1053

return self.need_approval()

914

1055

## Methods

915

1056

916

1057

# Approve - method

917

@dbus.service.method(_interface, in_signature=u"b")

1058

@dbus.service.method(_interface, in_signature="b")

918

1059

def Approve(self, value):

919

1060

self.approve(value)

920

1061

921

1062

# CheckedOK - method

922

1063

@dbus.service.method(_interface)

923

1064

def CheckedOK(self):

924

return self.checked_ok()

1065

self.checked_ok()

925

1066

926

1067

# Enable - method

927

1068

@dbus.service.method(_interface)

949

1090

## Properties

950

1091

951

1092

# ApprovalPending - property

952

@dbus_service_property(_interface, signature=u"b", access=u"read")

1093

@dbus_service_property(_interface, signature="b", access="read")

953

1094

def ApprovalPending_dbus_property(self):

954

1095

return dbus.Boolean(bool(self.approvals_pending))

955

1096

956

1097

# ApprovedByDefault - property

957

@dbus_service_property(_interface, signature=u"b",

958

access=u"readwrite")

1098

@dbus_service_property(_interface, signature="b",

1099

access="readwrite")

959

1100

def ApprovedByDefault_dbus_property(self, value=None):

960

1101

if value is None: # get

961

1102

return dbus.Boolean(self.approved_by_default)

962

1103

self.approved_by_default = bool(value)

963

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

965

dbus.Boolean(value, variant_level=1))

966

1104

967

1105

# ApprovalDelay - property

968

@dbus_service_property(_interface, signature=u"t",

969

access=u"readwrite")

1106

@dbus_service_property(_interface, signature="t",

1107

access="readwrite")

970

1108

def ApprovalDelay_dbus_property(self, value=None):

971

1109

if value is None: # get

972

1110

return dbus.UInt64(self.approval_delay_milliseconds())

973

1111

self.approval_delay = datetime.timedelta(0, 0, 0, value)

974

# Emit D-Bus signal

975

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

976

dbus.UInt64(value, variant_level=1))

977

1112

978

1113

# ApprovalDuration - property

979

@dbus_service_property(_interface, signature=u"t",

980

access=u"readwrite")

1114

@dbus_service_property(_interface, signature="t",

1115

access="readwrite")

981

1116

def ApprovalDuration_dbus_property(self, value=None):

982

1117

if value is None: # get

983

return dbus.UInt64(self._timedelta_to_milliseconds(

1118

return dbus.UInt64(_timedelta_to_milliseconds(

984

1119

self.approval_duration))

985

1120

self.approval_duration = datetime.timedelta(0, 0, 0, value)

986

# Emit D-Bus signal

987

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

988

dbus.UInt64(value, variant_level=1))

989

1121

990

1122

# Name - property

991

@dbus_service_property(_interface, signature=u"s", access=u"read")

1123

@dbus_service_property(_interface, signature="s", access="read")

992

1124

def Name_dbus_property(self):

993

1125

return dbus.String(self.name)

994

1126

995

1127

# Fingerprint - property

996

@dbus_service_property(_interface, signature=u"s", access=u"read")

1128

@dbus_service_property(_interface, signature="s", access="read")

997

1129

def Fingerprint_dbus_property(self):

998

1130

return dbus.String(self.fingerprint)

999

1131

1000

1132

# Host - property

1001

@dbus_service_property(_interface, signature=u"s",

1002

access=u"readwrite")

1133

@dbus_service_property(_interface, signature="s",

1134

access="readwrite")

1003

1135

def Host_dbus_property(self, value=None):

1004

1136

if value is None: # get

1005

1137

return dbus.String(self.host)

1006

1138

self.host = value

1007

# Emit D-Bus signal

1008

self.PropertyChanged(dbus.String(u"Host"),

1009

dbus.String(value, variant_level=1))

1010

1139

1011

1140

# Created - property

1012

@dbus_service_property(_interface, signature=u"s", access=u"read")

1141

@dbus_service_property(_interface, signature="s", access="read")

1013

1142

def Created_dbus_property(self):

1014

return dbus.String(self._datetime_to_dbus(self.created))

1143

return dbus.String(datetime_to_dbus(self.created))

1015

1144

1016

1145

# LastEnabled - property

1017

@dbus_service_property(_interface, signature=u"s", access=u"read")

1146

@dbus_service_property(_interface, signature="s", access="read")

1018

1147

def LastEnabled_dbus_property(self):

1019

if self.last_enabled is None:

1020

return dbus.String(u"")

1021

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1148

return datetime_to_dbus(self.last_enabled)

1022

1149

1023

1150

# Enabled - property

1024

@dbus_service_property(_interface, signature=u"b",

1025

access=u"readwrite")

1151

@dbus_service_property(_interface, signature="b",

1152

access="readwrite")

1026

1153

def Enabled_dbus_property(self, value=None):

1027

1154

if value is None: # get

1028

1155

return dbus.Boolean(self.enabled)

1032

1159

self.disable()

1033

1160

1034

1161

# LastCheckedOK - property

1035

@dbus_service_property(_interface, signature=u"s",

1036

access=u"readwrite")

1162

@dbus_service_property(_interface, signature="s",

1163

access="readwrite")

1037

1164

def LastCheckedOK_dbus_property(self, value=None):

1038

1165

if value is not None:

1039

1166

self.checked_ok()

1040

1167

return

1041

if self.last_checked_ok is None:

1042

return dbus.String(u"")

1043

return dbus.String(self._datetime_to_dbus(self

1044

.last_checked_ok))

1168

return datetime_to_dbus(self.last_checked_ok)

1169

1170

# Expires - property

1171

@dbus_service_property(_interface, signature="s", access="read")

1172

def Expires_dbus_property(self):

1173

return datetime_to_dbus(self.expires)

1045

1174

1046

1175

# LastApprovalRequest - property

1047

@dbus_service_property(_interface, signature=u"s", access=u"read")

1176

@dbus_service_property(_interface, signature="s", access="read")

1048

1177

def LastApprovalRequest_dbus_property(self):

1049

if self.last_approval_request is None:

1050

return dbus.String(u"")

1051

return dbus.String(self.

1052

_datetime_to_dbus(self

1053

.last_approval_request))

1178

return datetime_to_dbus(self.last_approval_request)

1054

1179

1055

1180

# Timeout - property

1056

@dbus_service_property(_interface, signature=u"t",

1057

access=u"readwrite")

1181

@dbus_service_property(_interface, signature="t",

1182

access="readwrite")

1058

1183

def Timeout_dbus_property(self, value=None):

1059

1184

if value is None: # get

1060

1185

return dbus.UInt64(self.timeout_milliseconds())

1061

1186

self.timeout = datetime.timedelta(0, 0, 0, value)

1062

# Emit D-Bus signal

1063

self.PropertyChanged(dbus.String(u"Timeout"),

1064

dbus.UInt64(value, variant_level=1))

1065

if getattr(self, u"disable_initiator_tag", None) is None:

1187

if getattr(self, "disable_initiator_tag", None) is None:

1066

1188

return

1067

1189

# Reschedule timeout

1068

1190

gobject.source_remove(self.disable_initiator_tag)

1069

1191

self.disable_initiator_tag = None

1070

time_to_die = (self.

1071

_timedelta_to_milliseconds((self

1072

.last_checked_ok

1073

+ self.timeout)

1074

- datetime.datetime

1075

.utcnow()))

1192

self.expires = None

1193

time_to_die = _timedelta_to_milliseconds((self

1194

.last_checked_ok

1195

+ self.timeout)

1196

- datetime.datetime

1197

.utcnow())

1076

1198

if time_to_die <= 0:

1077

1199

# The timeout has passed

1078

1200

self.disable()

1079

1201

else:

1202

self.expires = (datetime.datetime.utcnow()

1203

+ datetime.timedelta(milliseconds =

1204

time_to_die))

1080

1205

self.disable_initiator_tag = (gobject.timeout_add

1081

1206

(time_to_die, self.disable))

1082

1207

1208

# ExtendedTimeout - property

1209

@dbus_service_property(_interface, signature="t",

1210

access="readwrite")

1211

def ExtendedTimeout_dbus_property(self, value=None):

1212

if value is None: # get

1213

return dbus.UInt64(self.extended_timeout_milliseconds())

1214

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1215

1083

1216

# Interval - property

1084

@dbus_service_property(_interface, signature=u"t",

1085

access=u"readwrite")

1217

@dbus_service_property(_interface, signature="t",

1218

access="readwrite")

1086

1219

def Interval_dbus_property(self, value=None):

1087

1220

if value is None: # get

1088

1221

return dbus.UInt64(self.interval_milliseconds())

1089

1222

self.interval = datetime.timedelta(0, 0, 0, value)

1090

# Emit D-Bus signal

1091

self.PropertyChanged(dbus.String(u"Interval"),

1092

dbus.UInt64(value, variant_level=1))

1093

if getattr(self, u"checker_initiator_tag", None) is None:

1223

if getattr(self, "checker_initiator_tag", None) is None:

1094

1224

return

1095

1225

# Reschedule checker run

1096

1226

gobject.source_remove(self.checker_initiator_tag)

1097

1227

self.checker_initiator_tag = (gobject.timeout_add

1098

1228

(value, self.start_checker))

1099

1229

self.start_checker() # Start one now, too

1100

1230

1101

1231

# Checker - property

1102

@dbus_service_property(_interface, signature=u"s",

1103

access=u"readwrite")

1232

@dbus_service_property(_interface, signature="s",

1233

access="readwrite")

1104

1234

def Checker_dbus_property(self, value=None):

1105

1235

if value is None: # get

1106

1236

return dbus.String(self.checker_command)

1107

1237

self.checker_command = value

1108

# Emit D-Bus signal

1109

self.PropertyChanged(dbus.String(u"Checker"),

1110

dbus.String(self.checker_command,

1111

variant_level=1))

1112

1238

1113

1239

# CheckerRunning - property

1114

@dbus_service_property(_interface, signature=u"b",

1115

access=u"readwrite")

1240

@dbus_service_property(_interface, signature="b",

1241

access="readwrite")

1116

1242

def CheckerRunning_dbus_property(self, value=None):

1117

1243

if value is None: # get

1118

1244

return dbus.Boolean(self.checker is not None)

1122

1248

self.stop_checker()

1123

1249

1124

1250

# ObjectPath - property

1125

@dbus_service_property(_interface, signature=u"o", access=u"read")

1251

@dbus_service_property(_interface, signature="o", access="read")

1126

1252

def ObjectPath_dbus_property(self):

1127

1253

return self.dbus_object_path # is already a dbus.ObjectPath

1128

1254

1129

1255

# Secret = property

1130

@dbus_service_property(_interface, signature=u"ay",

1131

access=u"write", byte_arrays=True)

1256

@dbus_service_property(_interface, signature="ay",

1257

access="write", byte_arrays=True)

1132

1258

def Secret_dbus_property(self, value):

1133

1259

self.secret = str(value)

1134

1260

1141

1267

self._pipe.send(('init', fpr, address))

1142

1268

if not self._pipe.recv():

1143

1269

raise KeyError()

1144

1270

1145

1271

def __getattribute__(self, name):

1146

1272

if(name == '_pipe'):

1147

1273

return super(ProxyClient, self).__getattribute__(name)

1154

1280

self._pipe.send(('funcall', name, args, kwargs))

1155

1281

return self._pipe.recv()[1]

1156

1282

return func

1157

1283

1158

1284

def __setattr__(self, name, value):

1159

1285

if(name == '_pipe'):

1160

1286

return super(ProxyClient, self).__setattr__(name, value)

1161

1287

self._pipe.send(('setattr', name, value))

1162

1288

1289

class ClientDBusTransitional(ClientDBus):

1290

__metaclass__ = AlternateDBusNamesMetaclass

1163

1291

1164

1292

class ClientHandler(socketserver.BaseRequestHandler, object):

1165

1293

"""A class to handle client connections.

1169

1297

1170

1298

def handle(self):

1171

1299

with contextlib.closing(self.server.child_pipe) as child_pipe:

1172

logger.info(u"TCP connection from: %s",

1300

logger.info("TCP connection from: %s",

1173

1301

unicode(self.client_address))

1174

logger.debug(u"Pipe FD: %d",

1302

logger.debug("Pipe FD: %d",

1175

1303

self.server.child_pipe.fileno())

1176

1304

1177

1305

session = (gnutls.connection

1178

1306

.ClientSession(self.request,

1179

1307

gnutls.connection

1180

1308

.X509Credentials()))

1181

1309

1182

1310

# Note: gnutls.connection.X509Credentials is really a

1183

1311

# generic GnuTLS certificate credentials object so long as

1184

1312

# no X.509 keys are added to it. Therefore, we can use it

1185

1313

# here despite using OpenPGP certificates.

1186

1187

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1188

# u"+AES-256-CBC", u"+SHA1",

1189

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1190

# u"+DHE-DSS"))

1314

1315

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1316

# "+AES-256-CBC", "+SHA1",

1317

# "+COMP-NULL", "+CTYPE-OPENPGP",

1318

# "+DHE-DSS"))

1191

1319

# Use a fallback default, since this MUST be set.

1192

1320

priority = self.server.gnutls_priority

1193

1321

if priority is None:

1194

priority = u"NORMAL"

1322

priority = "NORMAL"

1195

1323

(gnutls.library.functions

1196

1324

.gnutls_priority_set_direct(session._c_object,

1197

1325

priority, None))

1198

1326

1199

1327

# Start communication using the Mandos protocol

1200

1328

# Get protocol number

1201

1329

line = self.request.makefile().readline()

1202

logger.debug(u"Protocol version: %r", line)

1330

logger.debug("Protocol version: %r", line)

1203

1331

try:

1204

1332

if int(line.strip().split()[0]) > 1:

1205

1333

raise RuntimeError

1206

except (ValueError, IndexError, RuntimeError), error:

1207

logger.error(u"Unknown protocol version: %s", error)

1334

except (ValueError, IndexError, RuntimeError) as error:

1335

logger.error("Unknown protocol version: %s", error)

1208

1336

return

1209

1337

1210

1338

# Start GnuTLS connection

1211

1339

try:

1212

1340

session.handshake()

1213

except gnutls.errors.GNUTLSError, error:

1214

logger.warning(u"Handshake failed: %s", error)

1341

except gnutls.errors.GNUTLSError as error:

1342

logger.warning("Handshake failed: %s", error)

1215

1343

# Do not run session.bye() here: the session is not

1216

1344

# established. Just abandon the request.

1217

1345

return

1218

logger.debug(u"Handshake succeeded")

1219

1346

logger.debug("Handshake succeeded")

1347

1220

1348

approval_required = False

1221

1349

try:

1222

1350

try:

1223

1351

fpr = self.fingerprint(self.peer_certificate

1224

1352

(session))

1225

except (TypeError, gnutls.errors.GNUTLSError), error:

1226

logger.warning(u"Bad certificate: %s", error)

1353

except (TypeError,

1354

gnutls.errors.GNUTLSError) as error:

1355

logger.warning("Bad certificate: %s", error)

1227

1356

return

1228

logger.debug(u"Fingerprint: %s", fpr)

1229

1357

logger.debug("Fingerprint: %s", fpr)

1358

1230

1359

try:

1231

1360

client = ProxyClient(child_pipe, fpr,

1232

1361

self.client_address)

1240

1369

1241

1370

while True:

1242

1371

if not client.enabled:

1243

logger.warning(u"Client %s is disabled",

1372

logger.info("Client %s is disabled",

1244

1373

client.name)

1245

1374

if self.server.use_dbus:

1246

1375

# Emit D-Bus signal

1247

client.Rejected("Disabled")

1376

client.Rejected("Disabled")

1248

1377

return

1249

1378

1250

1379

if client._approved or not client.approval_delay:

1251

1380

#We are approved or approval is disabled

1252

1381

break

1253

1382

elif client._approved is None:

1254

logger.info(u"Client %s needs approval",

1383

logger.info("Client %s needs approval",

1255

1384

client.name)

1256

1385

if self.server.use_dbus:

1257

1386

# Emit D-Bus signal

1259

1388

client.approval_delay_milliseconds(),

1260

1389

client.approved_by_default)

1261

1390

else:

1262

logger.warning(u"Client %s was not approved",

1391

logger.warning("Client %s was not approved",

1263

1392

client.name)

1264

1393

if self.server.use_dbus:

1265

1394

# Emit D-Bus signal

1267

1396

return

1268

1397

1269

1398

#wait until timeout or approved

1270

#x = float(client._timedelta_to_milliseconds(delay))

1271

1399

time = datetime.datetime.now()

1272

1400

client.changedstate.acquire()

1273

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1401

(client.changedstate.wait

1402

(float(client._timedelta_to_milliseconds(delay)

1403

/ 1000)))

1274

1404

client.changedstate.release()

1275

1405

time2 = datetime.datetime.now()

1276

1406

if (time2 - time) >= delay:

1291

1421

while sent_size < len(client.secret):

1292

1422

try:

1293

1423

sent = session.send(client.secret[sent_size:])

1294

except (gnutls.errors.GNUTLSError), error:

1424

except gnutls.errors.GNUTLSError as error:

1295

1425

logger.warning("gnutls send failed")

1296

1426

return

1297

logger.debug(u"Sent: %d, remaining: %d",

1427

logger.debug("Sent: %d, remaining: %d",

1298

1428

sent, len(client.secret)

1299

1429

- (sent_size + sent))

1300

1430

sent_size += sent

1301

1302

logger.info(u"Sending secret to %s", client.name)

1303

# bump the timeout as if seen

1304

client.checked_ok()

1431

1432

logger.info("Sending secret to %s", client.name)

1433

# bump the timeout using extended_timeout

1434

client.checked_ok(client.extended_timeout)

1305

1435

if self.server.use_dbus:

1306

1436

# Emit D-Bus signal

1307

1437

client.GotSecret()

1311

1441

client.approvals_pending -= 1

1312

1442

try:

1313

1443

session.bye()

1314

except (gnutls.errors.GNUTLSError), error:

1444

except gnutls.errors.GNUTLSError as error:

1315

1445

logger.warning("GnuTLS bye failed")

1316

1446

1317

1447

@staticmethod

1328

1458

.gnutls_certificate_get_peers

1329

1459

(session._c_object, ctypes.byref(list_size)))

1330

1460

if not bool(cert_list) and list_size.value != 0:

1331

raise gnutls.errors.GNUTLSError(u"error getting peer"

1332

u" certificate")

1461

raise gnutls.errors.GNUTLSError("error getting peer"

1462

" certificate")

1333

1463

if list_size.value == 0:

1334

1464

return None

1335

1465

cert = cert_list[0]

1361

1491

if crtverify.value != 0:

1362

1492

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1363

1493

raise (gnutls.errors.CertificateSecurityError

1364

(u"Verify failed"))

1494

("Verify failed"))

1365

1495

# New buffer for the fingerprint

1366

1496

buf = ctypes.create_string_buffer(20)

1367

1497

buf_len = ctypes.c_size_t()

1374

1504

# Convert the buffer to a Python bytestring

1375

1505

fpr = ctypes.string_at(buf, buf_len.value)

1376

1506

# Convert the bytestring to hexadecimal notation

1377

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1378

1508

return hex_fpr

1379

1509

1380

1510

1386

1516

except:

1387

1517

self.handle_error(request, address)

1388

1518

self.close_request(request)

1389

1519

1390

1520

def process_request(self, request, address):

1391

1521

"""Start a new process to process the request."""

1392

multiprocessing.Process(target = self.sub_process_main,

1393

args = (request, address)).start()

1522

proc = multiprocessing.Process(target = self.sub_process_main,

1523

args = (request,

1524

address))

1525

proc.start()

1526

return proc

1527

1394

1528

1395

1529

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1396

1530

""" adds a pipe to the MixIn """

1400

1534

This function creates a new pipe in self.pipe

1401

1535

"""

1402

1536

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1403

1404

super(MultiprocessingMixInWithPipe,

1405

self).process_request(request, client_address)

1537

1538

proc = MultiprocessingMixIn.process_request(self, request,

1539

client_address)

1406

1540

self.child_pipe.close()

1407

self.add_pipe(parent_pipe)

1408

1409

def add_pipe(self, parent_pipe):

1541

self.add_pipe(parent_pipe, proc)

1542

1543

def add_pipe(self, parent_pipe, proc):

1410

1544

"""Dummy function; override as necessary"""

1411

pass

1545

raise NotImplementedError

1546

1412

1547

1413

1548

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1414

1549

socketserver.TCPServer, object):

1432

1567

bind to an address or port if they were not specified."""

1433

1568

if self.interface is not None:

1434

1569

if SO_BINDTODEVICE is None:

1435

logger.error(u"SO_BINDTODEVICE does not exist;"

1436

u" cannot bind to interface %s",

1570

logger.error("SO_BINDTODEVICE does not exist;"

1571

" cannot bind to interface %s",

1437

1572

self.interface)

1438

1573

else:

1439

1574

try:

1440

1575

self.socket.setsockopt(socket.SOL_SOCKET,

1441

1576

SO_BINDTODEVICE,

1442

1577

str(self.interface

1443

+ u'\0'))

1444

except socket.error, error:

1578

+ '\0'))

1579

except socket.error as error:

1445

1580

if error[0] == errno.EPERM:

1446

logger.error(u"No permission to"

1447

u" bind to interface %s",

1581

logger.error("No permission to"

1582

" bind to interface %s",

1448

1583

self.interface)

1449

1584

elif error[0] == errno.ENOPROTOOPT:

1450

logger.error(u"SO_BINDTODEVICE not available;"

1451

u" cannot bind to interface %s",

1585

logger.error("SO_BINDTODEVICE not available;"

1586

" cannot bind to interface %s",

1452

1587

self.interface)

1453

1588

else:

1454

1589

raise

1456

1591

if self.server_address[0] or self.server_address[1]:

1457

1592

if not self.server_address[0]:

1458

1593

if self.address_family == socket.AF_INET6:

1459

any_address = u"::" # in6addr_any

1594

any_address = "::" # in6addr_any

1460

1595

else:

1461

1596

any_address = socket.INADDR_ANY

1462

1597

self.server_address = (any_address,

1499

1634

def server_activate(self):

1500

1635

if self.enabled:

1501

1636

return socketserver.TCPServer.server_activate(self)

1637

1502

1638

def enable(self):

1503

1639

self.enabled = True

1504

def add_pipe(self, parent_pipe):

1640

1641

def add_pipe(self, parent_pipe, proc):

1505

1642

# Call "handle_ipc" for both data and EOF events

1506

1643

gobject.io_add_watch(parent_pipe.fileno(),

1507

1644

gobject.IO_IN | gobject.IO_HUP,

1508

1645

functools.partial(self.handle_ipc,

1509

parent_pipe = parent_pipe))

1510

1646

parent_pipe =

1647

parent_pipe,

1648

proc = proc))

1649

1511

1650

def handle_ipc(self, source, condition, parent_pipe=None,

1512

client_object=None):

1651

proc = None, client_object=None):

1513

1652

condition_names = {

1514

gobject.IO_IN: u"IN", # There is data to read.

1515

gobject.IO_OUT: u"OUT", # Data can be written (without

1653

gobject.IO_IN: "IN", # There is data to read.

1654

gobject.IO_OUT: "OUT", # Data can be written (without

1516

1655

# blocking).

1517

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1518

gobject.IO_ERR: u"ERR", # Error condition.

1519

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1656

gobject.IO_PRI: "PRI", # There is urgent data to read.

1657

gobject.IO_ERR: "ERR", # Error condition.

1658

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1520

1659

# broken, usually for pipes and

1521

1660

# sockets).

1522

1661

}

1524

1663

for cond, name in

1525

1664

condition_names.iteritems()

1526

1665

if cond & condition)

1527

# error or the other end of multiprocessing.Pipe has closed

1666

# error, or the other end of multiprocessing.Pipe has closed

1528

1667

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1668

# Wait for other process to exit

1669

proc.join()

1529

1670

return False

1530

1671

1531

1672

# Read a request from the child

1541

1682

client = c

1542

1683

break

1543

1684

else:

1544

logger.warning(u"Client not found for fingerprint: %s, ad"

1545

u"dress: %s", fpr, address)

1685

logger.info("Client not found for fingerprint: %s, ad"

1686

"dress: %s", fpr, address)

1546

1687

if self.use_dbus:

1547

1688

# Emit D-Bus signal

1548

mandos_dbus_service.ClientNotFound(fpr, address[0])

1689

mandos_dbus_service.ClientNotFound(fpr,

1690

address[0])

1549

1691

parent_pipe.send(False)

1550

1692

return False

1551

1693

1552

1694

gobject.io_add_watch(parent_pipe.fileno(),

1553

1695

gobject.IO_IN | gobject.IO_HUP,

1554

1696

functools.partial(self.handle_ipc,

1555

parent_pipe = parent_pipe,

1556

client_object = client))

1697

parent_pipe =

1698

parent_pipe,

1699

proc = proc,

1700

client_object =

1701

client))

1557

1702

parent_pipe.send(True)

1558

# remove the old hook in favor of the new above hook on same fileno

1703

# remove the old hook in favor of the new above hook on

1704

# same fileno

1559

1705

return False

1560

1706

if command == 'funcall':

1561

1707

funcname = request[1]

1562

1708

args = request[2]

1563

1709

kwargs = request[3]

1564

1710

1565

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1566

1711

parent_pipe.send(('data', getattr(client_object,

1712

funcname)(*args,

1713

**kwargs)))

1714

1567

1715

if command == 'getattr':

1568

1716

attrname = request[1]

1569

1717

if callable(client_object.__getattribute__(attrname)):

1570

1718

parent_pipe.send(('function',))

1571

1719

else:

1572

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1720

parent_pipe.send(('data', client_object

1721

.__getattribute__(attrname)))

1573

1722

1574

1723

if command == 'setattr':

1575

1724

attrname = request[1]

1576

1725

value = request[2]

1577

1726

setattr(client_object, attrname, value)

1578

1727

1579

1728

return True

1580

1729

1581

1730

1582

1731

def string_to_delta(interval):

1583

1732

"""Parse a string and return a datetime.timedelta

1584

1733

1585

>>> string_to_delta(u'7d')

1734

>>> string_to_delta('7d')

1586

1735

datetime.timedelta(7)

1587

>>> string_to_delta(u'60s')

1736

>>> string_to_delta('60s')

1588

1737

datetime.timedelta(0, 60)

1589

>>> string_to_delta(u'60m')

1738

>>> string_to_delta('60m')

1590

1739

datetime.timedelta(0, 3600)

1591

>>> string_to_delta(u'24h')

1740

>>> string_to_delta('24h')

1592

1741

datetime.timedelta(1)

1593

>>> string_to_delta(u'1w')

1742

>>> string_to_delta('1w')

1594

1743

datetime.timedelta(7)

1595

>>> string_to_delta(u'5m 30s')

1744

>>> string_to_delta('5m 30s')

1596

1745

datetime.timedelta(0, 330)

1597

1746

"""

1598

1747

timevalue = datetime.timedelta(0)

1600

1749

try:

1601

1750

suffix = unicode(s[-1])

1602

1751

value = int(s[:-1])

1603

if suffix == u"d":

1752

if suffix == "d":

1604

1753

delta = datetime.timedelta(value)

1605

elif suffix == u"s":

1754

elif suffix == "s":

1606

1755

delta = datetime.timedelta(0, value)

1607

elif suffix == u"m":

1756

elif suffix == "m":

1608

1757

delta = datetime.timedelta(0, 0, 0, 0, value)

1609

elif suffix == u"h":

1758

elif suffix == "h":

1610

1759

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1611

elif suffix == u"w":

1760

elif suffix == "w":

1612

1761

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1613

1762

else:

1614

raise ValueError(u"Unknown suffix %r" % suffix)

1615

except (ValueError, IndexError), e:

1616

raise ValueError(e.message)

1763

raise ValueError("Unknown suffix %r" % suffix)

1764

except (ValueError, IndexError) as e:

1765

raise ValueError(*(e.args))

1617

1766

timevalue += delta

1618

1767

return timevalue

1619

1768

1625

1774

global if_nametoindex

1626

1775

try:

1627

1776

if_nametoindex = (ctypes.cdll.LoadLibrary

1628

(ctypes.util.find_library(u"c"))

1777

(ctypes.util.find_library("c"))

1629

1778

.if_nametoindex)

1630

1779

except (OSError, AttributeError):

1631

logger.warning(u"Doing if_nametoindex the hard way")

1780

logger.warning("Doing if_nametoindex the hard way")

1632

1781

def if_nametoindex(interface):

1633

1782

"Get an interface index the hard way, i.e. using fcntl()"

1634

1783

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1635

1784

with contextlib.closing(socket.socket()) as s:

1636

1785

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1637

struct.pack(str(u"16s16x"),

1786

struct.pack(str("16s16x"),

1638

1787

interface))

1639

interface_index = struct.unpack(str(u"I"),

1788

interface_index = struct.unpack(str("I"),

1640

1789

ifreq[16:20])[0]

1641

1790

return interface_index

1642

1791

return if_nametoindex(interface)

1650

1799

sys.exit()

1651

1800

os.setsid()

1652

1801

if not nochdir:

1653

os.chdir(u"/")

1802

os.chdir("/")

1654

1803

if os.fork():

1655

1804

sys.exit()

1656

1805

if not noclose:

1658

1807

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1659

1808

if not stat.S_ISCHR(os.fstat(null).st_mode):

1660

1809

raise OSError(errno.ENODEV,

1661

u"%s not a character device"

1810

"%s not a character device"

1662

1811

% os.path.devnull)

1663

1812

os.dup2(null, sys.stdin.fileno())

1664

1813

os.dup2(null, sys.stdout.fileno())

1672

1821

##################################################################

1673

1822

# Parsing of options, both command line and config file

1674

1823

1675

parser = optparse.OptionParser(version = "%%prog %s" % version)

1676

parser.add_option("-i", u"--interface", type=u"string",

1677

metavar="IF", help=u"Bind to interface IF")

1678

parser.add_option("-a", u"--address", type=u"string",

1679

help=u"Address to listen for requests on")

1680

parser.add_option("-p", u"--port", type=u"int",

1681

help=u"Port number to receive requests on")

1682

parser.add_option("--check", action=u"store_true",

1683

help=u"Run self-test")

1684

parser.add_option("--debug", action=u"store_true",

1685

help=u"Debug mode; run in foreground and log to"

1686

u" terminal")

1687

parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",

1688

help=u"Debug level for stdout output")

1689

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1690

u" priority string (see GnuTLS documentation)")

1691

parser.add_option("--servicename", type=u"string",

1692

metavar=u"NAME", help=u"Zeroconf service name")

1693

parser.add_option("--configdir", type=u"string",

1694

default=u"/etc/mandos", metavar=u"DIR",

1695

help=u"Directory to search for configuration"

1696

u" files")

1697

parser.add_option("--no-dbus", action=u"store_false",

1698

dest=u"use_dbus", help=u"Do not provide D-Bus"

1699

u" system bus interface")

1700

parser.add_option("--no-ipv6", action=u"store_false",

1701

dest=u"use_ipv6", help=u"Do not use IPv6")

1702

options = parser.parse_args()[0]

1824

parser = argparse.ArgumentParser()

1825

parser.add_argument("-v", "--version", action="version",

1826

version = "%%(prog)s %s" % version,

1827

help="show version number and exit")

1828

parser.add_argument("-i", "--interface", metavar="IF",

1829

help="Bind to interface IF")

1830

parser.add_argument("-a", "--address",

1831

help="Address to listen for requests on")

1832

parser.add_argument("-p", "--port", type=int,

1833

help="Port number to receive requests on")

1834

parser.add_argument("--check", action="store_true",

1835

help="Run self-test")

1836

parser.add_argument("--debug", action="store_true",

1837

help="Debug mode; run in foreground and log"

1838

" to terminal")

1839

parser.add_argument("--debuglevel", metavar="LEVEL",

1840

help="Debug level for stdout output")

1841

parser.add_argument("--priority", help="GnuTLS"

1842

" priority string (see GnuTLS documentation)")

1843

parser.add_argument("--servicename",

1844

metavar="NAME", help="Zeroconf service name")

1845

parser.add_argument("--configdir",

1846

default="/etc/mandos", metavar="DIR",

1847

help="Directory to search for configuration"

1848

" files")

1849

parser.add_argument("--no-dbus", action="store_false",

1850

dest="use_dbus", help="Do not provide D-Bus"

1851

" system bus interface")

1852

parser.add_argument("--no-ipv6", action="store_false",

1853

dest="use_ipv6", help="Do not use IPv6")

1854

options = parser.parse_args()

1703

1855

1704

1856

if options.check:

1705

1857

import doctest

1707

1859

sys.exit()

1708

1860

1709

1861

# Default values for config file for server-global settings

1710

server_defaults = { u"interface": u"",

1711

u"address": u"",

1712

u"port": u"",

1713

u"debug": u"False",

1714

u"priority":

1715

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1716

u"servicename": u"Mandos",

1717

u"use_dbus": u"True",

1718

u"use_ipv6": u"True",

1719

u"debuglevel": u"",

1862

server_defaults = { "interface": "",

1863

"address": "",

1864

"port": "",

1865

"debug": "False",

1866

"priority":

1867

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1868

"servicename": "Mandos",

1869

"use_dbus": "True",

1870

"use_ipv6": "True",

1871

"debuglevel": "",

1720

1872

}

1721

1873

1722

1874

# Parse config file for server-global settings

1723

1875

server_config = configparser.SafeConfigParser(server_defaults)

1724

1876

del server_defaults

1725

1877

server_config.read(os.path.join(options.configdir,

1726

u"mandos.conf"))

1878

"mandos.conf"))

1727

1879

# Convert the SafeConfigParser object to a dict

1728

1880

server_settings = server_config.defaults()

1729

1881

# Use the appropriate methods on the non-string config options

1730

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1731

server_settings[option] = server_config.getboolean(u"DEFAULT",

1882

for option in ("debug", "use_dbus", "use_ipv6"):

1883

server_settings[option] = server_config.getboolean("DEFAULT",

1732

1884

option)

1733

1885

if server_settings["port"]:

1734

server_settings["port"] = server_config.getint(u"DEFAULT",

1735

u"port")

1886

server_settings["port"] = server_config.getint("DEFAULT",

1887

"port")

1736

1888

del server_config

1737

1889

1738

1890

# Override the settings from the config file with command line

1739

1891

# options, if set.

1740

for option in (u"interface", u"address", u"port", u"debug",

1741

u"priority", u"servicename", u"configdir",

1742

u"use_dbus", u"use_ipv6", u"debuglevel"):

1892

for option in ("interface", "address", "port", "debug",

1893

"priority", "servicename", "configdir",

1894

"use_dbus", "use_ipv6", "debuglevel"):

1743

1895

value = getattr(options, option)

1744

1896

if value is not None:

1745

1897

server_settings[option] = value

1753

1905

##################################################################

1754

1906

1755

1907

# For convenience

1756

debug = server_settings[u"debug"]

1757

debuglevel = server_settings[u"debuglevel"]

1758

use_dbus = server_settings[u"use_dbus"]

1759

use_ipv6 = server_settings[u"use_ipv6"]

1760

1761

if server_settings[u"servicename"] != u"Mandos":

1908

debug = server_settings["debug"]

1909

debuglevel = server_settings["debuglevel"]

1910

use_dbus = server_settings["use_dbus"]

1911

use_ipv6 = server_settings["use_ipv6"]

1912

1913

if server_settings["servicename"] != "Mandos":

1762

1914

syslogger.setFormatter(logging.Formatter

1763

(u'Mandos (%s) [%%(process)d]:'

1764

u' %%(levelname)s: %%(message)s'

1765

% server_settings[u"servicename"]))

1915

('Mandos (%s) [%%(process)d]:'

1916

' %%(levelname)s: %%(message)s'

1917

% server_settings["servicename"]))

1766

1918

1767

1919

# Parse config file with clients

1768

client_defaults = { u"timeout": u"1h",

1769

u"interval": u"5m",

1770

u"checker": u"fping -q -- %%(host)s",

1771

u"host": u"",

1772

u"approval_delay": u"0s",

1773

u"approval_duration": u"1s",

1920

client_defaults = { "timeout": "5m",

1921

"extended_timeout": "15m",

1922

"interval": "2m",

1923

"checker": "fping -q -- %%(host)s",

1924

"host": "",

1925

"approval_delay": "0s",

1926

"approval_duration": "1s",

1774

1927

}

1775

1928

client_config = configparser.SafeConfigParser(client_defaults)

1776

client_config.read(os.path.join(server_settings[u"configdir"],

1777

u"clients.conf"))

1929

client_config.read(os.path.join(server_settings["configdir"],

1930

"clients.conf"))

1778

1931

1779

1932

global mandos_dbus_service

1780

1933

mandos_dbus_service = None

1781

1934

1782

tcp_server = MandosServer((server_settings[u"address"],

1783

server_settings[u"port"]),

1935

tcp_server = MandosServer((server_settings["address"],

1936

server_settings["port"]),

1784

1937

ClientHandler,

1785

interface=(server_settings[u"interface"]

1938

interface=(server_settings["interface"]

1786

1939

or None),

1787

1940

use_ipv6=use_ipv6,

1788

1941

gnutls_priority=

1789

server_settings[u"priority"],

1942

server_settings["priority"],

1790

1943

use_dbus=use_dbus)

1791

1944

if not debug:

1792

pidfilename = u"/var/run/mandos.pid"

1945

pidfilename = "/var/run/mandos.pid"

1793

1946

try:

1794

pidfile = open(pidfilename, u"w")

1947

pidfile = open(pidfilename, "w")

1795

1948

except IOError:

1796

logger.error(u"Could not open file %r", pidfilename)

1949

logger.error("Could not open file %r", pidfilename)

1797

1950

1798

1951

try:

1799

uid = pwd.getpwnam(u"_mandos").pw_uid

1800

gid = pwd.getpwnam(u"_mandos").pw_gid

1952

uid = pwd.getpwnam("_mandos").pw_uid

1953

gid = pwd.getpwnam("_mandos").pw_gid

1801

1954

except KeyError:

1802

1955

try:

1803

uid = pwd.getpwnam(u"mandos").pw_uid

1804

gid = pwd.getpwnam(u"mandos").pw_gid

1956

uid = pwd.getpwnam("mandos").pw_uid

1957

gid = pwd.getpwnam("mandos").pw_gid

1805

1958

except KeyError:

1806

1959

try:

1807

uid = pwd.getpwnam(u"nobody").pw_uid

1808

gid = pwd.getpwnam(u"nobody").pw_gid

1960

uid = pwd.getpwnam("nobody").pw_uid

1961

gid = pwd.getpwnam("nobody").pw_gid

1809

1962

except KeyError:

1810

1963

uid = 65534

1811

1964

gid = 65534

1812

1965

try:

1813

1966

os.setgid(gid)

1814

1967

os.setuid(uid)

1815

except OSError, error:

1968

except OSError as error:

1816

1969

if error[0] != errno.EPERM:

1817

1970

raise error

1818

1971

1823

1976

level = getattr(logging, debuglevel.upper())

1824

1977

syslogger.setLevel(level)

1825

1978

console.setLevel(level)

1826

1979

1827

1980

if debug:

1828

1981

# Enable all possible GnuTLS debugging

1829

1982

1833

1986

1834

1987

@gnutls.library.types.gnutls_log_func

1835

1988

def debug_gnutls(level, string):

1836

logger.debug(u"GnuTLS: %s", string[:-1])

1989

logger.debug("GnuTLS: %s", string[:-1])

1837

1990

1838

1991

(gnutls.library.functions

1839

1992

.gnutls_global_set_log_function(debug_gnutls))

1847

2000

# No console logging

1848

2001

logger.removeHandler(console)

1849

2002

2003

# Need to fork before connecting to D-Bus

2004

if not debug:

2005

# Close all input and output, do double fork, etc.

2006

daemon()

1850

2007

1851

2008

global main_loop

1852

2009

# From the Avahi example code

1856

2013

# End of Avahi example code

1857

2014

if use_dbus:

1858

2015

try:

1859

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2016

bus_name = dbus.service.BusName("se.recompile.Mandos",

1860

2017

bus, do_not_queue=True)

1861

except dbus.exceptions.NameExistsException, e:

1862

logger.error(unicode(e) + u", disabling D-Bus")

2018

old_bus_name = (dbus.service.BusName

2019

("se.bsnet.fukt.Mandos", bus,

2020

do_not_queue=True))

2021

except dbus.exceptions.NameExistsException as e:

2022

logger.error(unicode(e) + ", disabling D-Bus")

1863

2023

use_dbus = False

1864

server_settings[u"use_dbus"] = False

2024

server_settings["use_dbus"] = False

1865

2025

tcp_server.use_dbus = False

1866

2026

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1867

service = AvahiService(name = server_settings[u"servicename"],

1868

servicetype = u"_mandos._tcp",

2027

service = AvahiService(name = server_settings["servicename"],

2028

servicetype = "_mandos._tcp",

1869

2029

protocol = protocol, bus = bus)

1870

2030

if server_settings["interface"]:

1871

2031

service.interface = (if_nametoindex

1872

(str(server_settings[u"interface"])))

1873

1874

if not debug:

1875

# Close all input and output, do double fork, etc.

1876

daemon()

1877

2032

(str(server_settings["interface"])))

2033

1878

2034

global multiprocessing_manager

1879

2035

multiprocessing_manager = multiprocessing.Manager()

1880

2036

1881

2037

client_class = Client

1882

2038

if use_dbus:

1883

client_class = functools.partial(ClientDBus, bus = bus)

2039

client_class = functools.partial(ClientDBusTransitional,

2040

bus = bus)

1884

2041

def client_config_items(config, section):

1885

2042

special_settings = {

1886

2043

"approved_by_default":

1899

2056

client_config, section)))

1900

2057

for section in client_config.sections()))

1901

2058

if not tcp_server.clients:

1902

logger.warning(u"No clients defined")

2059

logger.warning("No clients defined")

1903

2060

1904

2061

if not debug:

1905

2062

try:

1906

2063

with pidfile:

1907

2064

pid = os.getpid()

1908

pidfile.write(str(pid) + "\n")

2065

pidfile.write(str(pid) + "\n".encode("utf-8"))

1909

2066

del pidfile

1910

2067

except IOError:

1911

logger.error(u"Could not write to file %r with PID %d",

2068

logger.error("Could not write to file %r with PID %d",

1912

2069

pidfilename, pid)

1913

2070

except NameError:

1914

2071

# "pidfile" was never created

1916

2073

del pidfilename

1917

2074

1918

2075

signal.signal(signal.SIGINT, signal.SIG_IGN)

1919

2076

1920

2077

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1921

2078

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1922

2079

1924

2081

class MandosDBusService(dbus.service.Object):

1925

2082

"""A D-Bus proxy object"""

1926

2083

def __init__(self):

1927

dbus.service.Object.__init__(self, bus, u"/")

1928

_interface = u"se.bsnet.fukt.Mandos"

2084

dbus.service.Object.__init__(self, bus, "/")

2085

_interface = "se.recompile.Mandos"

1929

2086

1930

@dbus.service.signal(_interface, signature=u"o")

2087

@dbus.service.signal(_interface, signature="o")

1931

2088

def ClientAdded(self, objpath):

1932

2089

"D-Bus signal"

1933

2090

pass

1934

2091

1935

@dbus.service.signal(_interface, signature=u"ss")

2092

@dbus.service.signal(_interface, signature="ss")

1936

2093

def ClientNotFound(self, fingerprint, address):

1937

2094

"D-Bus signal"

1938

2095

pass

1939

2096

1940

@dbus.service.signal(_interface, signature=u"os")

2097

@dbus.service.signal(_interface, signature="os")

1941

2098

def ClientRemoved(self, objpath, name):

1942

2099

"D-Bus signal"

1943

2100

pass

1944

2101

1945

@dbus.service.method(_interface, out_signature=u"ao")

2102

@dbus.service.method(_interface, out_signature="ao")

1946

2103

def GetAllClients(self):

1947

2104

"D-Bus method"

1948

2105

return dbus.Array(c.dbus_object_path

1949

2106

for c in tcp_server.clients)

1950

2107

1951

2108

@dbus.service.method(_interface,

1952

out_signature=u"a{oa{sv}}")

2109

out_signature="a{oa{sv}}")

1953

2110

def GetAllClientsWithProperties(self):

1954

2111

"D-Bus method"

1955

2112

return dbus.Dictionary(

1956

((c.dbus_object_path, c.GetAll(u""))

2113

((c.dbus_object_path, c.GetAll(""))

1957

2114

for c in tcp_server.clients),

1958

signature=u"oa{sv}")

2115

signature="oa{sv}")

1959

2116

1960

@dbus.service.method(_interface, in_signature=u"o")

2117

@dbus.service.method(_interface, in_signature="o")

1961

2118

def RemoveClient(self, object_path):

1962

2119

"D-Bus method"

1963

2120

for c in tcp_server.clients:

1973

2130

1974

2131

del _interface

1975

2132

1976

mandos_dbus_service = MandosDBusService()

2133

class MandosDBusServiceTransitional(MandosDBusService):

2134

__metaclass__ = AlternateDBusNamesMetaclass

2135

mandos_dbus_service = MandosDBusServiceTransitional()

1977

2136

1978

2137

def cleanup():

1979

2138

"Cleanup function; run on exit"

1980

2139

service.cleanup()

1981

2140

2141

multiprocessing.active_children()

1982

2142

while tcp_server.clients:

1983

2143

client = tcp_server.clients.pop()

1984

2144

if use_dbus:

1988

2148

client.disable(quiet=True)

1989

2149

if use_dbus:

1990

2150

# Emit D-Bus signal

1991

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2151

mandos_dbus_service.ClientRemoved(client

2152

.dbus_object_path,

1992

2153

client.name)

1993

2154

1994

2155

atexit.register(cleanup)

2005

2166

# Find out what port we got

2006

2167

service.port = tcp_server.socket.getsockname()[1]

2007

2168

if use_ipv6:

2008

logger.info(u"Now listening on address %r, port %d,"

2169

logger.info("Now listening on address %r, port %d,"

2009

2170

" flowinfo %d, scope_id %d"

2010

2171

% tcp_server.socket.getsockname())

2011

2172

else: # IPv4

2012

logger.info(u"Now listening on address %r, port %d"

2173

logger.info("Now listening on address %r, port %d"

2013

2174

% tcp_server.socket.getsockname())

2014

2175

2015

2176

#service.interface = tcp_server.socket.getsockname()[3]

2018

2179

# From the Avahi example code

2019

2180

try:

2020

2181

service.activate()

2021

except dbus.exceptions.DBusException, error:

2022

logger.critical(u"DBusException: %s", error)

2182

except dbus.exceptions.DBusException as error:

2183

logger.critical("DBusException: %s", error)

2023

2184

cleanup()

2024

2185

sys.exit(1)

2025

2186

# End of Avahi example code

2029

2190

(tcp_server.handle_request

2030

2191

(*args[2:], **kwargs) or True))

2031

2192

2032

logger.debug(u"Starting main loop")

2193

logger.debug("Starting main loop")

2033

2194

main_loop.run()

2034

except AvahiError, error:

2035

logger.critical(u"AvahiError: %s", error)

2195

except AvahiError as error:

2196

logger.critical("AvahiError: %s", error)

2036

2197

cleanup()

2037

2198

sys.exit(1)

2038

2199

except KeyboardInterrupt:

2039

2200

if debug:

2040

print >> sys.stderr

2041

logger.debug(u"Server received KeyboardInterrupt")

2042

logger.debug(u"Server exiting")

2201

print("", file=sys.stderr)

2202

logger.debug("Server received KeyboardInterrupt")

2203

logger.debug("Server exiting")

2043

2204

# Must run before the D-Bus bus name gets deregistered

2044

2205

cleanup()

2045

2206

2207

2046

2208

if __name__ == '__main__':

2047

2209

main()