/mandos/release : revision 237.16.24

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

61

62

import functools

62

63

import cPickle as pickle

63

64

import multiprocessing

65

import types

64

66

65

67

import dbus

66

68

import dbus.service

81

83

SO_BINDTODEVICE = None

82

84

83

85

84

version = "1.0.14"

86

version = "1.4.1"

85

87

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

88

90

syslogger = (logging.handlers.SysLogHandler

89

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

90

address = "/dev/log"))

92

address = str("/dev/log")))

91

93

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

94

96

logger.addHandler(syslogger)

95

97

96

98

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

100

102

logger.addHandler(console)

101

103

102

104

class AvahiError(Exception):

119

121

Attributes:

120

122

interface: integer; avahi.IF_UNSPEC or an interface index.

121

123

Used to optionally bind to the specified interface.

122

123

type: string; Example: u'_mandos._tcp'.

124

125

type: string; Example: '_mandos._tcp'.

124

126

See <http://www.dns-sd.org/ServiceTypes.html>

125

127

port: integer; what port to announce

126

128

TXT: list of strings; TXT record for the service

135

137

"""

136

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

137

139

servicetype = None, port = None, TXT = None,

138

domain = u"", host = u"", max_renames = 32768,

140

domain = "", host = "", max_renames = 32768,

139

141

protocol = avahi.PROTO_UNSPEC, bus = None):

140

142

self.interface = interface

141

143

self.name = name

150

152

self.group = None # our entry group

151

153

self.server = None

152

154

self.bus = bus

155

self.entry_group_state_changed_match = None

153

156

def rename(self):

154

157

"""Derived from the Avahi example code"""

155

158

if self.rename_count >= self.max_renames:

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

158

161

self.rename_count)

159

raise AvahiServiceError(u"Too many renames")

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server

164

.GetAlternativeServiceName(self.name))

165

logger.info("Changing Zeroconf service name to %r ...",

162

166

self.name)

163

167

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

166

170

% self.name))

167

171

self.remove()

168

172

try:

169

173

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

174

except dbus.exceptions.DBusException as error:

175

logger.critical("DBusException: %s", error)

172

176

self.cleanup()

173

177

os._exit(1)

174

178

self.rename_count += 1

175

179

def remove(self):

176

180

"""Derived from the Avahi example code"""

181

if self.entry_group_state_changed_match is not None:

182

self.entry_group_state_changed_match.remove()

183

self.entry_group_state_changed_match = None

177

184

if self.group is not None:

178

185

self.group.Reset()

179

186

def add(self):

180

187

"""Derived from the Avahi example code"""

188

self.remove()

181

189

if self.group is None:

182

190

self.group = dbus.Interface(

183

191

self.bus.get_object(avahi.DBUS_NAME,

184

192

self.server.EntryGroupNew()),

185

193

avahi.DBUS_INTERFACE_ENTRY_GROUP)

186

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

194

self.entry_group_state_changed_match = (

195

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

190

198

self.name, self.type)

191

199

self.group.AddService(

192

200

self.interface,

199

207

self.group.Commit()

200

208

def entry_group_state_changed(self, state, error):

201

209

"""Derived from the Avahi example code"""

202

logger.debug(u"Avahi entry group state change: %i", state)

210

logger.debug("Avahi entry group state change: %i", state)

203

211

204

212

if state == avahi.ENTRY_GROUP_ESTABLISHED:

205

logger.debug(u"Zeroconf service established.")

213

logger.debug("Zeroconf service established.")

206

214

elif state == avahi.ENTRY_GROUP_COLLISION:

207

logger.warning(u"Zeroconf service name collision.")

215

logger.info("Zeroconf service name collision.")

208

216

self.rename()

209

217

elif state == avahi.ENTRY_GROUP_FAILURE:

210

logger.critical(u"Avahi: Error in group state changed %s",

218

logger.critical("Avahi: Error in group state changed %s",

211

219

unicode(error))

212

raise AvahiGroupError(u"State changed: %s"

220

raise AvahiGroupError("State changed: %s"

213

221

% unicode(error))

214

222

def cleanup(self):

215

223

"""Derived from the Avahi example code"""

216

224

if self.group is not None:

217

self.group.Free()

225

try:

226

self.group.Free()

227

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

229

pass

218

230

self.group = None

219

def server_state_changed(self, state):

231

self.remove()

232

def server_state_changed(self, state, error=None):

220

233

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

222

if state == avahi.SERVER_COLLISION:

223

logger.error(u"Zeroconf server name collision")

224

self.remove()

234

logger.debug("Avahi server state change: %i", state)

235

bad_states = { avahi.SERVER_INVALID:

236

"Zeroconf server invalid",

237

avahi.SERVER_REGISTERING: None,

238

avahi.SERVER_COLLISION:

239

"Zeroconf server name collision",

240

avahi.SERVER_FAILURE:

241

"Zeroconf server failure" }

242

if state in bad_states:

243

if bad_states[state] is not None:

244

if error is None:

245

logger.error(bad_states[state])

246

else:

247

logger.error(bad_states[state] + ": %r", error)

248

self.cleanup()

225

249

elif state == avahi.SERVER_RUNNING:

226

250

self.add()

251

else:

252

if error is None:

253

logger.debug("Unknown state: %r", state)

254

else:

255

logger.debug("Unknown state: %r: %r", state, error)

227

256

def activate(self):

228

257

"""Derived from the Avahi example code"""

229

258

if self.server is None:

230

259

self.server = dbus.Interface(

231

260

self.bus.get_object(avahi.DBUS_NAME,

232

avahi.DBUS_PATH_SERVER),

261

avahi.DBUS_PATH_SERVER,

262

follow_name_owner_changes=True),

233

263

avahi.DBUS_INTERFACE_SERVER)

234

self.server.connect_to_signal(u"StateChanged",

264

self.server.connect_to_signal("StateChanged",

235

265

self.server_state_changed)

236

266

self.server_state_changed(self.server.GetState())

237

267

238

268

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

274

239

275

class Client(object):

240

276

"""A representation of a client host served by this server.

241

277

242

278

Attributes:

243

244

D-Bus identifiers

279

_approved: bool(); 'None' if not yet approved/disapproved

280

approval_delay: datetime.timedelta(); Time to wait for approval

281

approval_duration: datetime.timedelta(); Duration of one approval

282

checker: subprocess.Popen(); a running checker process used

283

to see if the client lives.

284

'None' if no process is running.

285

checker_callback_tag: a gobject event source tag, or None

286

checker_command: string; External command which is run to check

287

if client lives. %() expansions are done at

288

runtime with vars(self) as dict, so that for

289

instance %(name)s can be used in the command.

290

checker_initiator_tag: a gobject event source tag, or None

291

created: datetime.datetime(); (UTC) object creation

292

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

294

disable_initiator_tag: a gobject event source tag, or None

295

enabled: bool()

245

296

fingerprint: string (40 or 32 hexadecimal digits); used to

246

297

uniquely identify the client

247

secret: bytestring; sent verbatim (over TLS) to client

248

298

host: string; available for use by the checker command

249

created: datetime.datetime(); (UTC) object creation

299

interval: datetime.timedelta(); How often to start a new checker

300

last_approval_request: datetime.datetime(); (UTC) or None

301

last_checked_ok: datetime.datetime(); (UTC) or None

250

302

last_enabled: datetime.datetime(); (UTC)

251

enabled: bool()

252

last_checked_ok: datetime.datetime(); (UTC) or None

303

304

D-Bus identifiers

305

secret: bytestring; sent verbatim (over TLS) to client

253

306

timeout: datetime.timedelta(); How long from last_checked_ok

254

307

until this client is disabled

255

interval: datetime.timedelta(); How often to start a new checker

256

disable_hook: If set, called by disable() as disable_hook(self)

257

checker: subprocess.Popen(); a running checker process used

258

to see if the client lives.

259

'None' if no process is running.

260

checker_initiator_tag: a gobject event source tag, or None

261

disable_initiator_tag: - '' -

262

checker_callback_tag: - '' -

263

checker_command: string; External command which is run to check if

264

client lives. %() expansions are done at

265

runtime with vars(self) as dict, so that for

266

instance %(name)s can be used in the command.

267

current_checker_command: string; current running checker_command

268

approved_delay: datetime.timedelta(); Time to wait for approval

269

_approved: bool(); 'None' if not yet approved/disapproved

270

approved_duration: datetime.timedelta(); Duration of one approval

308

extended_timeout: extra long timeout when password has been sent

309

runtime_expansions: Allowed attributes for runtime expansion.

310

expires: datetime.datetime(); time (UTC) when a client will be

311

disabled, or None

271

312

"""

272

313

273

@staticmethod

274

def _timedelta_to_milliseconds(td):

275

"Convert a datetime.timedelta() to milliseconds"

276

return ((td.days * 24 * 60 * 60 * 1000)

277

+ (td.seconds * 1000)

278

+ (td.microseconds // 1000))

314

runtime_expansions = ("approval_delay", "approval_duration",

315

"created", "enabled", "fingerprint",

316

"host", "interval", "last_checked_ok",

317

"last_enabled", "name", "timeout")

279

318

280

319

def timeout_milliseconds(self):

281

320

"Return the 'timeout' attribute in milliseconds"

282

return self._timedelta_to_milliseconds(self.timeout)

321

return _timedelta_to_milliseconds(self.timeout)

322

323

def extended_timeout_milliseconds(self):

324

"Return the 'extended_timeout' attribute in milliseconds"

325

return _timedelta_to_milliseconds(self.extended_timeout)

283

326

284

327

def interval_milliseconds(self):

285

328

"Return the 'interval' attribute in milliseconds"

286

return self._timedelta_to_milliseconds(self.interval)

287

288

def approved_delay_milliseconds(self):

289

return self._timedelta_to_milliseconds(self.approved_delay)

329

return _timedelta_to_milliseconds(self.interval)

330

331

def approval_delay_milliseconds(self):

332

return _timedelta_to_milliseconds(self.approval_delay)

290

333

291

334

def __init__(self, name = None, disable_hook=None, config=None):

292

335

"""Note: the 'checker' key in 'config' sets the

295

338

self.name = name

296

339

if config is None:

297

340

config = {}

298

logger.debug(u"Creating client %r", self.name)

341

logger.debug("Creating client %r", self.name)

299

342

# Uppercase and remove spaces from fingerprint for later

300

343

# comparison purposes with return value from the fingerprint()

301

344

# function

302

self.fingerprint = (config[u"fingerprint"].upper()

303

.replace(u" ", u""))

304

logger.debug(u" Fingerprint: %s", self.fingerprint)

305

if u"secret" in config:

306

self.secret = config[u"secret"].decode(u"base64")

307

elif u"secfile" in config:

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

347

logger.debug(" Fingerprint: %s", self.fingerprint)

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

308

351

with open(os.path.expanduser(os.path.expandvars

309

(config[u"secfile"])),

352

(config["secfile"])),

310

353

"rb") as secfile:

311

354

self.secret = secfile.read()

312

355

else:

313

raise TypeError(u"No secret or secfile for client %s"

356

raise TypeError("No secret or secfile for client %s"

314

357

% self.name)

315

self.host = config.get(u"host", u"")

358

self.host = config.get("host", "")

316

359

self.created = datetime.datetime.utcnow()

317

360

self.enabled = False

361

self.last_approval_request = None

318

362

self.last_enabled = None

319

363

self.last_checked_ok = None

320

self.timeout = string_to_delta(config[u"timeout"])

321

self.interval = string_to_delta(config[u"interval"])

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

322

368

self.disable_hook = disable_hook

323

369

self.checker = None

324

370

self.checker_initiator_tag = None

325

371

self.disable_initiator_tag = None

372

self.expires = None

326

373

self.checker_callback_tag = None

327

self.checker_command = config[u"checker"]

374

self.checker_command = config["checker"]

328

375

self.current_checker_command = None

329

376

self.last_connect = None

330

377

self._approved = None

331

self.approved_by_default = config.get(u"approved_by_default",

378

self.approved_by_default = config.get("approved_by_default",

332

379

True)

333

380

self.approvals_pending = 0

334

self.approved_delay = string_to_delta(

335

config[u"approved_delay"])

336

self.approved_duration = string_to_delta(

337

config[u"approved_duration"])

338

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

381

self.approval_delay = string_to_delta(

382

config["approval_delay"])

383

self.approval_duration = string_to_delta(

384

config["approval_duration"])

385

self.changedstate = (multiprocessing_manager

386

.Condition(multiprocessing_manager

387

.Lock()))

339

388

340

389

def send_changedstate(self):

341

390

self.changedstate.acquire()

342

391

self.changedstate.notify_all()

343

392

self.changedstate.release()

344

393

345

394

def enable(self):

346

395

"""Start this client's checker and timeout hooks"""

347

if getattr(self, u"enabled", False):

396

if getattr(self, "enabled", False):

348

397

# Already enabled

349

398

return

350

399

self.send_changedstate()

351

self.last_enabled = datetime.datetime.utcnow()

352

400

# Schedule a new checker to be started an 'interval' from now,

353

401

# and every interval from then on.

354

402

self.checker_initiator_tag = (gobject.timeout_add

355

403

(self.interval_milliseconds(),

356

404

self.start_checker))

357

405

# Schedule a disable() when 'timeout' has passed

406

self.expires = datetime.datetime.utcnow() + self.timeout

358

407

self.disable_initiator_tag = (gobject.timeout_add

359

408

(self.timeout_milliseconds(),

360

409

self.disable))

361

410

self.enabled = True

411

self.last_enabled = datetime.datetime.utcnow()

362

412

# Also start a new checker *right now*.

363

413

self.start_checker()

364

414

369

419

if not quiet:

370

420

self.send_changedstate()

371

421

if not quiet:

372

logger.info(u"Disabling client %s", self.name)

373

if getattr(self, u"disable_initiator_tag", False):

422

logger.info("Disabling client %s", self.name)

423

if getattr(self, "disable_initiator_tag", False):

374

424

gobject.source_remove(self.disable_initiator_tag)

375

425

self.disable_initiator_tag = None

376

if getattr(self, u"checker_initiator_tag", False):

426

self.expires = None

427

if getattr(self, "checker_initiator_tag", False):

377

428

gobject.source_remove(self.checker_initiator_tag)

378

429

self.checker_initiator_tag = None

379

430

self.stop_checker()

394

445

if os.WIFEXITED(condition):

395

446

exitstatus = os.WEXITSTATUS(condition)

396

447

if exitstatus == 0:

397

logger.info(u"Checker for %(name)s succeeded",

448

logger.info("Checker for %(name)s succeeded",

398

449

vars(self))

399

450

self.checked_ok()

400

451

else:

401

logger.info(u"Checker for %(name)s failed",

452

logger.info("Checker for %(name)s failed",

402

453

vars(self))

403

454

else:

404

logger.warning(u"Checker for %(name)s crashed?",

455

logger.warning("Checker for %(name)s crashed?",

405

456

vars(self))

406

457

407

def checked_ok(self):

458

def checked_ok(self, timeout=None):

408

459

"""Bump up the timeout for this client.

409

460

410

461

This should only be called when the client has been seen,

411

462

alive and well.

412

463

"""

464

if timeout is None:

465

timeout = self.timeout

413

466

self.last_checked_ok = datetime.datetime.utcnow()

414

gobject.source_remove(self.disable_initiator_tag)

415

self.disable_initiator_tag = (gobject.timeout_add

416

(self.timeout_milliseconds(),

417

self.disable))

467

if self.disable_initiator_tag is not None:

468

gobject.source_remove(self.disable_initiator_tag)

469

if getattr(self, "enabled", False):

470

self.disable_initiator_tag = (gobject.timeout_add

471

(_timedelta_to_milliseconds

472

(timeout), self.disable))

473

self.expires = datetime.datetime.utcnow() + timeout

474

475

def need_approval(self):

476

self.last_approval_request = datetime.datetime.utcnow()

418

477

419

478

def start_checker(self):

420

479

"""Start a new checker subprocess if one is not running.

433

492

# If a checker exists, make sure it is not a zombie

434

493

try:

435

494

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

436

except (AttributeError, OSError), error:

495

except (AttributeError, OSError) as error:

437

496

if (isinstance(error, OSError)

438

497

and error.errno != errno.ECHILD):

439

498

raise error

440

499

else:

441

500

if pid:

442

logger.warning(u"Checker was a zombie")

501

logger.warning("Checker was a zombie")

443

502

gobject.source_remove(self.checker_callback_tag)

444

503

self.checker_callback(pid, status,

445

504

self.current_checker_command)

450

509

command = self.checker_command % self.host

451

510

except TypeError:

452

511

# Escape attributes for the shell

453

escaped_attrs = dict((key,

454

re.escape(unicode(str(val),

455

errors=

456

u'replace')))

457

for key, val in

458

vars(self).iteritems())

512

escaped_attrs = dict(

513

(attr,

514

re.escape(unicode(str(getattr(self, attr, "")),

515

errors=

516

'replace')))

517

for attr in

518

self.runtime_expansions)

519

459

520

try:

460

521

command = self.checker_command % escaped_attrs

461

except TypeError, error:

462

logger.error(u'Could not format string "%s":'

463

u' %s', self.checker_command, error)

522

except TypeError as error:

523

logger.error('Could not format string "%s":'

524

' %s', self.checker_command, error)

464

525

return True # Try again later

465

526

self.current_checker_command = command

466

527

try:

467

logger.info(u"Starting checker %r for %s",

528

logger.info("Starting checker %r for %s",

468

529

command, self.name)

469

530

# We don't need to redirect stdout and stderr, since

470

531

# in normal mode, that is already done by daemon(),

472

533

# always replaced by /dev/null.)

473

534

self.checker = subprocess.Popen(command,

474

535

close_fds=True,

475

shell=True, cwd=u"/")

536

shell=True, cwd="/")

476

537

self.checker_callback_tag = (gobject.child_watch_add

477

538

(self.checker.pid,

478

539

self.checker_callback,

483

544

if pid:

484

545

gobject.source_remove(self.checker_callback_tag)

485

546

self.checker_callback(pid, status, command)

486

except OSError, error:

487

logger.error(u"Failed to start subprocess: %s",

547

except OSError as error:

548

logger.error("Failed to start subprocess: %s",

488

549

error)

489

550

# Re-run this periodically if run by gobject.timeout_add

490

551

return True

494

555

if self.checker_callback_tag:

495

556

gobject.source_remove(self.checker_callback_tag)

496

557

self.checker_callback_tag = None

497

if getattr(self, u"checker", None) is None:

558

if getattr(self, "checker", None) is None:

498

559

return

499

logger.debug(u"Stopping checker for %(name)s", vars(self))

560

logger.debug("Stopping checker for %(name)s", vars(self))

500

561

try:

501

562

os.kill(self.checker.pid, signal.SIGTERM)

502

563

#time.sleep(0.5)

503

564

#if self.checker.poll() is None:

504

565

# os.kill(self.checker.pid, signal.SIGKILL)

505

except OSError, error:

566

except OSError as error:

506

567

if error.errno != errno.ESRCH: # No such process

507

568

raise

508

569

self.checker = None

509

570

510

def dbus_service_property(dbus_interface, signature=u"v",

511

access=u"readwrite", byte_arrays=False):

571

572

def dbus_service_property(dbus_interface, signature="v",

573

access="readwrite", byte_arrays=False):

512

574

"""Decorators for marking methods of a DBusObjectWithProperties to

513

575

become properties on the D-Bus.

514

576

521

583

"""

522

584

# Encoding deeply encoded byte arrays is not supported yet by the

523

585

# "Set" method, so we fail early here:

524

if byte_arrays and signature != u"ay":

525

raise ValueError(u"Byte arrays not supported for non-'ay'"

526

u" signature %r" % signature)

586

if byte_arrays and signature != "ay":

587

raise ValueError("Byte arrays not supported for non-'ay'"

588

" signature %r" % signature)

527

589

def decorator(func):

528

590

func._dbus_is_property = True

529

591

func._dbus_interface = dbus_interface

530

592

func._dbus_signature = signature

531

593

func._dbus_access = access

532

594

func._dbus_name = func.__name__

533

if func._dbus_name.endswith(u"_dbus_property"):

595

if func._dbus_name.endswith("_dbus_property"):

534

596

func._dbus_name = func._dbus_name[:-14]

535

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

597

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

536

598

return func

537

599

return decorator

538

600

558

620

559

621

class DBusObjectWithProperties(dbus.service.Object):

560

622

"""A D-Bus object with properties.

561

623

562

624

Classes inheriting from this can use the dbus_service_property

563

625

decorator to expose methods as D-Bus properties. It exposes the

564

626

standard Get(), Set(), and GetAll() methods on the D-Bus.

566

628

567

629

@staticmethod

568

630

def _is_dbus_property(obj):

569

return getattr(obj, u"_dbus_is_property", False)

631

return getattr(obj, "_dbus_is_property", False)

570

632

571

633

def _get_all_dbus_properties(self):

572

634

"""Returns a generator of (name, attribute) pairs

573

635

"""

574

return ((prop._dbus_name, prop)

636

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

637

for cls in self.__class__.__mro__

575

638

for name, prop in

576

inspect.getmembers(self, self._is_dbus_property))

639

inspect.getmembers(cls, self._is_dbus_property))

577

640

578

641

def _get_dbus_property(self, interface_name, property_name):

579

642

"""Returns a bound method if one exists which is a D-Bus

580

643

property with the specified name and interface.

581

644

"""

582

for name in (property_name,

583

property_name + u"_dbus_property"):

584

prop = getattr(self, name, None)

585

if (prop is None

586

or not self._is_dbus_property(prop)

587

or prop._dbus_name != property_name

588

or (interface_name and prop._dbus_interface

589

and interface_name != prop._dbus_interface)):

590

continue

591

return prop

645

for cls in self.__class__.__mro__:

646

for name, value in (inspect.getmembers

647

(cls, self._is_dbus_property)):

648

if (value._dbus_name == property_name

649

and value._dbus_interface == interface_name):

650

return value.__get__(self)

651

592

652

# No such property

593

raise DBusPropertyNotFound(self.dbus_object_path + u":"

594

+ interface_name + u"."

653

raise DBusPropertyNotFound(self.dbus_object_path + ":"

654

+ interface_name + "."

595

655

+ property_name)

596

656

597

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

598

out_signature=u"v")

657

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

658

out_signature="v")

599

659

def Get(self, interface_name, property_name):

600

660

"""Standard D-Bus property Get() method, see D-Bus standard.

601

661

"""

602

662

prop = self._get_dbus_property(interface_name, property_name)

603

if prop._dbus_access == u"write":

663

if prop._dbus_access == "write":

604

664

raise DBusPropertyAccessException(property_name)

605

665

value = prop()

606

if not hasattr(value, u"variant_level"):

666

if not hasattr(value, "variant_level"):

607

667

return value

608

668

return type(value)(value, variant_level=value.variant_level+1)

609

669

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

670

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

611

671

def Set(self, interface_name, property_name, value):

612

672

"""Standard D-Bus property Set() method, see D-Bus standard.

613

673

"""

614

674

prop = self._get_dbus_property(interface_name, property_name)

615

if prop._dbus_access == u"read":

675

if prop._dbus_access == "read":

616

676

raise DBusPropertyAccessException(property_name)

617

if prop._dbus_get_args_options[u"byte_arrays"]:

677

if prop._dbus_get_args_options["byte_arrays"]:

618

678

# The byte_arrays option is not supported yet on

619

679

# signatures other than "ay".

620

if prop._dbus_signature != u"ay":

680

if prop._dbus_signature != "ay":

621

681

raise ValueError

622

682

value = dbus.ByteArray(''.join(unichr(byte)

623

683

for byte in value))

624

684

prop(value)

625

685

626

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

627

out_signature=u"a{sv}")

686

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

687

out_signature="a{sv}")

628

688

def GetAll(self, interface_name):

629

689

"""Standard D-Bus property GetAll() method, see D-Bus

630

690

standard.

631

691

632

692

Note: Will not include properties with access="write".

633

693

"""

634

694

all = {}

638

698

# Interface non-empty but did not match

639

699

continue

640

700

# Ignore write-only properties

641

if prop._dbus_access == u"write":

701

if prop._dbus_access == "write":

642

702

continue

643

703

value = prop()

644

if not hasattr(value, u"variant_level"):

704

if not hasattr(value, "variant_level"):

645

705

all[name] = value

646

706

continue

647

707

all[name] = type(value)(value, variant_level=

648

708

value.variant_level+1)

649

return dbus.Dictionary(all, signature=u"sv")

709

return dbus.Dictionary(all, signature="sv")

650

710

651

711

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

652

out_signature=u"s",

712

out_signature="s",

653

713

path_keyword='object_path',

654

714

connection_keyword='connection')

655

715

def Introspect(self, object_path, connection):

660

720

try:

661

721

document = xml.dom.minidom.parseString(xmlstring)

662

722

def make_tag(document, name, prop):

663

e = document.createElement(u"property")

664

e.setAttribute(u"name", name)

665

e.setAttribute(u"type", prop._dbus_signature)

666

e.setAttribute(u"access", prop._dbus_access)

723

e = document.createElement("property")

724

e.setAttribute("name", name)

725

e.setAttribute("type", prop._dbus_signature)

726

e.setAttribute("access", prop._dbus_access)

667

727

return e

668

for if_tag in document.getElementsByTagName(u"interface"):

728

for if_tag in document.getElementsByTagName("interface"):

669

729

for tag in (make_tag(document, name, prop)

670

730

for name, prop

671

731

in self._get_all_dbus_properties()

672

732

if prop._dbus_interface

673

== if_tag.getAttribute(u"name")):

733

== if_tag.getAttribute("name")):

674

734

if_tag.appendChild(tag)

675

735

# Add the names to the return values for the

676

736

# "org.freedesktop.DBus.Properties" methods

677

if (if_tag.getAttribute(u"name")

678

== u"org.freedesktop.DBus.Properties"):

679

for cn in if_tag.getElementsByTagName(u"method"):

680

if cn.getAttribute(u"name") == u"Get":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"value")

685

elif cn.getAttribute(u"name") == u"GetAll":

686

for arg in cn.getElementsByTagName(u"arg"):

687

if (arg.getAttribute(u"direction")

688

== u"out"):

689

arg.setAttribute(u"name", u"props")

690

xmlstring = document.toxml(u"utf-8")

737

if (if_tag.getAttribute("name")

738

== "org.freedesktop.DBus.Properties"):

739

for cn in if_tag.getElementsByTagName("method"):

740

if cn.getAttribute("name") == "Get":

741

for arg in cn.getElementsByTagName("arg"):

742

if (arg.getAttribute("direction")

743

== "out"):

744

arg.setAttribute("name", "value")

745

elif cn.getAttribute("name") == "GetAll":

746

for arg in cn.getElementsByTagName("arg"):

747

if (arg.getAttribute("direction")

748

== "out"):

749

arg.setAttribute("name", "props")

750

xmlstring = document.toxml("utf-8")

691

751

document.unlink()

692

752

except (AttributeError, xml.dom.DOMException,

693

xml.parsers.expat.ExpatError), error:

694

logger.error(u"Failed to override Introspection method",

753

xml.parsers.expat.ExpatError) as error:

754

logger.error("Failed to override Introspection method",

695

755

error)

696

756

return xmlstring

697

757

698

758

759

def datetime_to_dbus (dt, variant_level=0):

760

"""Convert a UTC datetime.datetime() to a D-Bus type."""

761

if dt is None:

762

return dbus.String("", variant_level = variant_level)

763

return dbus.String(dt.isoformat(),

764

variant_level=variant_level)

765

766

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

767

.__metaclass__):

768

"""Applied to an empty subclass of a D-Bus object, this metaclass

769

will add additional D-Bus attributes matching a certain pattern.

770

"""

771

def __new__(mcs, name, bases, attr):

772

# Go through all the base classes which could have D-Bus

773

# methods, signals, or properties in them

774

for base in (b for b in bases

775

if issubclass(b, dbus.service.Object)):

776

# Go though all attributes of the base class

777

for attrname, attribute in inspect.getmembers(base):

778

# Ignore non-D-Bus attributes, and D-Bus attributes

779

# with the wrong interface name

780

if (not hasattr(attribute, "_dbus_interface")

781

or not attribute._dbus_interface

782

.startswith("se.recompile.Mandos")):

783

continue

784

# Create an alternate D-Bus interface name based on

785

# the current name

786

alt_interface = (attribute._dbus_interface

787

.replace("se.recompile.Mandos",

788

"se.bsnet.fukt.Mandos"))

789

# Is this a D-Bus signal?

790

if getattr(attribute, "_dbus_is_signal", False):

791

# Extract the original non-method function by

792

# black magic

793

nonmethod_func = (dict(

794

zip(attribute.func_code.co_freevars,

795

attribute.__closure__))["func"]

796

.cell_contents)

797

# Create a new, but exactly alike, function

798

# object, and decorate it to be a new D-Bus signal

799

# with the alternate D-Bus interface name

800

new_function = (dbus.service.signal

801

(alt_interface,

802

attribute._dbus_signature)

803

(types.FunctionType(

804

nonmethod_func.func_code,

805

nonmethod_func.func_globals,

806

nonmethod_func.func_name,

807

nonmethod_func.func_defaults,

808

nonmethod_func.func_closure)))

809

# Define a creator of a function to call both the

810

# old and new functions, so both the old and new

811

# signals gets sent when the function is called

812

def fixscope(func1, func2):

813

"""This function is a scope container to pass

814

func1 and func2 to the "call_both" function

815

outside of its arguments"""

816

def call_both(*args, **kwargs):

817

"""This function will emit two D-Bus

818

signals by calling func1 and func2"""

819

func1(*args, **kwargs)

820

func2(*args, **kwargs)

821

return call_both

822

# Create the "call_both" function and add it to

823

# the class

824

attr[attrname] = fixscope(attribute,

825

new_function)

826

# Is this a D-Bus method?

827

elif getattr(attribute, "_dbus_is_method", False):

828

# Create a new, but exactly alike, function

829

# object. Decorate it to be a new D-Bus method

830

# with the alternate D-Bus interface name. Add it

831

# to the class.

832

attr[attrname] = (dbus.service.method

833

(alt_interface,

834

attribute._dbus_in_signature,

835

attribute._dbus_out_signature)

836

(types.FunctionType

837

(attribute.func_code,

838

attribute.func_globals,

839

attribute.func_name,

840

attribute.func_defaults,

841

attribute.func_closure)))

842

# Is this a D-Bus property?

843

elif getattr(attribute, "_dbus_is_property", False):

844

# Create a new, but exactly alike, function

845

# object, and decorate it to be a new D-Bus

846

# property with the alternate D-Bus interface

847

# name. Add it to the class.

848

attr[attrname] = (dbus_service_property

849

(alt_interface,

850

attribute._dbus_signature,

851

attribute._dbus_access,

852

attribute

853

._dbus_get_args_options

854

["byte_arrays"])

855

(types.FunctionType

856

(attribute.func_code,

857

attribute.func_globals,

858

attribute.func_name,

859

attribute.func_defaults,

860

attribute.func_closure)))

861

return type.__new__(mcs, name, bases, attr)

862

699

863

class ClientDBus(Client, DBusObjectWithProperties):

700

864

"""A Client class using D-Bus

701

865

703

867

dbus_object_path: dbus.ObjectPath

704

868

bus: dbus.SystemBus()

705

869

"""

870

871

runtime_expansions = (Client.runtime_expansions

872

+ ("dbus_object_path",))

873

706

874

# dbus.service.Object doesn't use super(), so we can't either.

707

875

708

876

def __init__(self, bus = None, *args, **kwargs):

711

879

Client.__init__(self, *args, **kwargs)

712

880

# Only now, when this client is initialized, can it show up on

713

881

# the D-Bus

882

client_object_name = unicode(self.name).translate(

883

{ord("."): ord("_"),

884

ord("-"): ord("_")})

714

885

self.dbus_object_path = (dbus.ObjectPath

715

(u"/clients/"

716

+ self.name.replace(u".", u"_")))

886

("/clients/" + client_object_name))

717

887

DBusObjectWithProperties.__init__(self, self.bus,

718

888

self.dbus_object_path)

719

720

def _get_approvals_pending(self):

721

return self._approvals_pending

722

def _set_approvals_pending(self, value):

723

old_value = self._approvals_pending

724

self._approvals_pending = value

725

bval = bool(value)

726

if (hasattr(self, "dbus_object_path")

727

and bval is not bool(old_value)):

728

dbus_bool = dbus.Boolean(bval, variant_level=1)

729

self.PropertyChanged(dbus.String(u"approved_pending"),

730

dbus_bool)

731

732

approvals_pending = property(_get_approvals_pending,

733

_set_approvals_pending)

734

del _get_approvals_pending, _set_approvals_pending

735

736

@staticmethod

737

def _datetime_to_dbus(dt, variant_level=0):

738

"""Convert a UTC datetime.datetime() to a D-Bus type."""

739

return dbus.String(dt.isoformat(),

740

variant_level=variant_level)

741

742

def enable(self):

743

oldstate = getattr(self, u"enabled", False)

744

r = Client.enable(self)

745

if oldstate != self.enabled:

746

# Emit D-Bus signals

747

self.PropertyChanged(dbus.String(u"enabled"),

748

dbus.Boolean(True, variant_level=1))

749

self.PropertyChanged(

750

dbus.String(u"last_enabled"),

751

self._datetime_to_dbus(self.last_enabled,

752

variant_level=1))

753

return r

754

755

def disable(self, quiet = False):

756

oldstate = getattr(self, u"enabled", False)

757

r = Client.disable(self, quiet=quiet)

758

if not quiet and oldstate != self.enabled:

759

# Emit D-Bus signal

760

self.PropertyChanged(dbus.String(u"enabled"),

761

dbus.Boolean(False, variant_level=1))

762

return r

889

890

def notifychangeproperty(transform_func,

891

dbus_name, type_func=lambda x: x,

892

variant_level=1):

893

""" Modify a variable so that it's a property which announces

894

its changes to DBus.

895

896

transform_fun: Function that takes a value and a variant_level

897

and transforms it to a D-Bus type.

898

dbus_name: D-Bus name of the variable

899

type_func: Function that transform the value before sending it

900

to the D-Bus. Default: no transform

901

variant_level: D-Bus variant level. Default: 1

902

"""

903

attrname = "_{0}".format(dbus_name)

904

def setter(self, value):

905

if hasattr(self, "dbus_object_path"):

906

if (not hasattr(self, attrname) or

907

type_func(getattr(self, attrname, None))

908

!= type_func(value)):

909

dbus_value = transform_func(type_func(value),

910

variant_level

911

=variant_level)

912

self.PropertyChanged(dbus.String(dbus_name),

913

dbus_value)

914

setattr(self, attrname, value)

915

916

return property(lambda self: getattr(self, attrname), setter)

917

918

919

expires = notifychangeproperty(datetime_to_dbus, "Expires")

920

approvals_pending = notifychangeproperty(dbus.Boolean,

921

"ApprovalPending",

922

type_func = bool)

923

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

924

last_enabled = notifychangeproperty(datetime_to_dbus,

925

"LastEnabled")

926

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

927

type_func = lambda checker:

928

checker is not None)

929

last_checked_ok = notifychangeproperty(datetime_to_dbus,

930

"LastCheckedOK")

931

last_approval_request = notifychangeproperty(

932

datetime_to_dbus, "LastApprovalRequest")

933

approved_by_default = notifychangeproperty(dbus.Boolean,

934

"ApprovedByDefault")

935

approval_delay = notifychangeproperty(dbus.UInt16,

936

"ApprovalDelay",

937

type_func =

938

_timedelta_to_milliseconds)

939

approval_duration = notifychangeproperty(

940

dbus.UInt16, "ApprovalDuration",

941

type_func = _timedelta_to_milliseconds)

942

host = notifychangeproperty(dbus.String, "Host")

943

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

944

type_func =

945

_timedelta_to_milliseconds)

946

extended_timeout = notifychangeproperty(

947

dbus.UInt16, "ExtendedTimeout",

948

type_func = _timedelta_to_milliseconds)

949

interval = notifychangeproperty(dbus.UInt16,

950

"Interval",

951

type_func =

952

_timedelta_to_milliseconds)

953

checker_command = notifychangeproperty(dbus.String, "Checker")

954

955

del notifychangeproperty

763

956

764

957

def __del__(self, *args, **kwargs):

765

958

try:

766

959

self.remove_from_connection()

767

960

except LookupError:

768

961

pass

769

if hasattr(DBusObjectWithProperties, u"__del__"):

962

if hasattr(DBusObjectWithProperties, "__del__"):

770

963

DBusObjectWithProperties.__del__(self, *args, **kwargs)

771

964

Client.__del__(self, *args, **kwargs)

772

965

774

967

*args, **kwargs):

775

968

self.checker_callback_tag = None

776

969

self.checker = None

777

# Emit D-Bus signal

778

self.PropertyChanged(dbus.String(u"checker_running"),

779

dbus.Boolean(False, variant_level=1))

780

970

if os.WIFEXITED(condition):

781

971

exitstatus = os.WEXITSTATUS(condition)

782

972

# Emit D-Bus signal

792

982

return Client.checker_callback(self, pid, condition, command,

793

983

*args, **kwargs)

794

984

795

def checked_ok(self, *args, **kwargs):

796

r = Client.checked_ok(self, *args, **kwargs)

797

# Emit D-Bus signal

798

self.PropertyChanged(

799

dbus.String(u"last_checked_ok"),

800

(self._datetime_to_dbus(self.last_checked_ok,

801

variant_level=1)))

802

return r

803

804

985

def start_checker(self, *args, **kwargs):

805

986

old_checker = self.checker

806

987

if self.checker is not None:

813

994

and old_checker_pid != self.checker.pid):

814

995

# Emit D-Bus signal

815

996

self.CheckerStarted(self.current_checker_command)

816

self.PropertyChanged(

817

dbus.String(u"checker_running"),

818

dbus.Boolean(True, variant_level=1))

819

997

return r

820

998

821

def stop_checker(self, *args, **kwargs):

822

old_checker = getattr(self, u"checker", None)

823

r = Client.stop_checker(self, *args, **kwargs)

824

if (old_checker is not None

825

and getattr(self, u"checker", None) is None):

826

self.PropertyChanged(dbus.String(u"checker_running"),

827

dbus.Boolean(False, variant_level=1))

828

return r

829

830

999

def _reset_approved(self):

831

1000

self._approved = None

832

1001

return False

834

1003

def approve(self, value=True):

835

1004

self.send_changedstate()

836

1005

self._approved = value

837

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),

1006

gobject.timeout_add(_timedelta_to_milliseconds

1007

(self.approval_duration),

838

1008

self._reset_approved)

839

1009

840

1010

841

1011

## D-Bus methods, signals & properties

842

_interface = u"se.bsnet.fukt.Mandos.Client"

1012

_interface = "se.recompile.Mandos.Client"

843

1013

844

1014

## Signals

845

1015

846

1016

# CheckerCompleted - signal

847

@dbus.service.signal(_interface, signature=u"nxs")

1017

@dbus.service.signal(_interface, signature="nxs")

848

1018

def CheckerCompleted(self, exitcode, waitstatus, command):

849

1019

"D-Bus signal"

850

1020

pass

851

1021

852

1022

# CheckerStarted - signal

853

@dbus.service.signal(_interface, signature=u"s")

1023

@dbus.service.signal(_interface, signature="s")

854

1024

def CheckerStarted(self, command):

855

1025

"D-Bus signal"

856

1026

pass

857

1027

858

1028

# PropertyChanged - signal

859

@dbus.service.signal(_interface, signature=u"sv")

1029

@dbus.service.signal(_interface, signature="sv")

860

1030

def PropertyChanged(self, property, value):

861

1031

"D-Bus signal"

862

1032

pass

871

1041

pass

872

1042

873

1043

# Rejected - signal

874

@dbus.service.signal(_interface, signature=u"s")

1044

@dbus.service.signal(_interface, signature="s")

875

1045

def Rejected(self, reason):

876

1046

"D-Bus signal"

877

1047

pass

878

1048

879

1049

# NeedApproval - signal

880

@dbus.service.signal(_interface, signature=u"db")

1050

@dbus.service.signal(_interface, signature="tb")

881

1051

def NeedApproval(self, timeout, default):

882

1052

"D-Bus signal"

883

pass

1053

return self.need_approval()

884

1054

885

1055

## Methods

886

1056

887

1057

# Approve - method

888

@dbus.service.method(_interface, in_signature=u"b")

1058

@dbus.service.method(_interface, in_signature="b")

889

1059

def Approve(self, value):

890

1060

self.approve(value)

891

1061

892

1062

# CheckedOK - method

893

1063

@dbus.service.method(_interface)

894

1064

def CheckedOK(self):

895

return self.checked_ok()

1065

self.checked_ok()

896

1066

897

1067

# Enable - method

898

1068

@dbus.service.method(_interface)

919

1089

920

1090

## Properties

921

1091

922

# approved_pending - property

923

@dbus_service_property(_interface, signature=u"b", access=u"read")

924

def approved_pending_dbus_property(self):

1092

# ApprovalPending - property

1093

@dbus_service_property(_interface, signature="b", access="read")

1094

def ApprovalPending_dbus_property(self):

925

1095

return dbus.Boolean(bool(self.approvals_pending))

926

1096

927

# approved_by_default - property

928

@dbus_service_property(_interface, signature=u"b",

929

access=u"readwrite")

930

def approved_by_default_dbus_property(self):

931

return dbus.Boolean(self.approved_by_default)

932

933

# approved_delay - property

934

@dbus_service_property(_interface, signature=u"t",

935

access=u"readwrite")

936

def approved_delay_dbus_property(self):

937

return dbus.UInt64(self.approved_delay_milliseconds())

938

939

# approved_duration - property

940

@dbus_service_property(_interface, signature=u"t",

941

access=u"readwrite")

942

def approved_duration_dbus_property(self):

943

return dbus.UInt64(self._timedelta_to_milliseconds(

944

self.approved_duration))

945

946

# name - property

947

@dbus_service_property(_interface, signature=u"s", access=u"read")

948

def name_dbus_property(self):

1097

# ApprovedByDefault - property

1098

@dbus_service_property(_interface, signature="b",

1099

access="readwrite")

1100

def ApprovedByDefault_dbus_property(self, value=None):

1101

if value is None: # get

1102

return dbus.Boolean(self.approved_by_default)

1103

self.approved_by_default = bool(value)

1104

1105

# ApprovalDelay - property

1106

@dbus_service_property(_interface, signature="t",

1107

access="readwrite")

1108

def ApprovalDelay_dbus_property(self, value=None):

1109

if value is None: # get

1110

return dbus.UInt64(self.approval_delay_milliseconds())

1111

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1112

1113

# ApprovalDuration - property

1114

@dbus_service_property(_interface, signature="t",

1115

access="readwrite")

1116

def ApprovalDuration_dbus_property(self, value=None):

1117

if value is None: # get

1118

return dbus.UInt64(_timedelta_to_milliseconds(

1119

self.approval_duration))

1120

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1121

1122

# Name - property

1123

@dbus_service_property(_interface, signature="s", access="read")

1124

def Name_dbus_property(self):

949

1125

return dbus.String(self.name)

950

1126

951

# fingerprint - property

952

@dbus_service_property(_interface, signature=u"s", access=u"read")

953

def fingerprint_dbus_property(self):

1127

# Fingerprint - property

1128

@dbus_service_property(_interface, signature="s", access="read")

1129

def Fingerprint_dbus_property(self):

954

1130

return dbus.String(self.fingerprint)

955

1131

956

# host - property

957

@dbus_service_property(_interface, signature=u"s",

958

access=u"readwrite")

959

def host_dbus_property(self, value=None):

1132

# Host - property

1133

@dbus_service_property(_interface, signature="s",

1134

access="readwrite")

1135

def Host_dbus_property(self, value=None):

960

1136

if value is None: # get

961

1137

return dbus.String(self.host)

962

1138

self.host = value

963

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"host"),

965

dbus.String(value, variant_level=1))

966

967

# created - property

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

969

def created_dbus_property(self):

970

return dbus.String(self._datetime_to_dbus(self.created))

971

972

# last_enabled - property

973

@dbus_service_property(_interface, signature=u"s", access=u"read")

974

def last_enabled_dbus_property(self):

975

if self.last_enabled is None:

976

return dbus.String(u"")

977

return dbus.String(self._datetime_to_dbus(self.last_enabled))

978

979

# enabled - property

980

@dbus_service_property(_interface, signature=u"b",

981

access=u"readwrite")

982

def enabled_dbus_property(self, value=None):

1139

1140

# Created - property

1141

@dbus_service_property(_interface, signature="s", access="read")

1142

def Created_dbus_property(self):

1143

return dbus.String(datetime_to_dbus(self.created))

1144

1145

# LastEnabled - property

1146

@dbus_service_property(_interface, signature="s", access="read")

1147

def LastEnabled_dbus_property(self):

1148

return datetime_to_dbus(self.last_enabled)

1149

1150

# Enabled - property

1151

@dbus_service_property(_interface, signature="b",

1152

access="readwrite")

1153

def Enabled_dbus_property(self, value=None):

983

1154

if value is None: # get

984

1155

return dbus.Boolean(self.enabled)

985

1156

if value:

987

1158

else:

988

1159

self.disable()

989

1160

990

# last_checked_ok - property

991

@dbus_service_property(_interface, signature=u"s",

992

access=u"readwrite")

993

def last_checked_ok_dbus_property(self, value=None):

1161

# LastCheckedOK - property

1162

@dbus_service_property(_interface, signature="s",

1163

access="readwrite")

1164

def LastCheckedOK_dbus_property(self, value=None):

994

1165

if value is not None:

995

1166

self.checked_ok()

996

1167

return

997

if self.last_checked_ok is None:

998

return dbus.String(u"")

999

return dbus.String(self._datetime_to_dbus(self

1000

.last_checked_ok))

1001

1002

# timeout - property

1003

@dbus_service_property(_interface, signature=u"t",

1004

access=u"readwrite")

1005

def timeout_dbus_property(self, value=None):

1168

return datetime_to_dbus(self.last_checked_ok)

1169

1170

# Expires - property

1171

@dbus_service_property(_interface, signature="s", access="read")

1172

def Expires_dbus_property(self):

1173

return datetime_to_dbus(self.expires)

1174

1175

# LastApprovalRequest - property

1176

@dbus_service_property(_interface, signature="s", access="read")

1177

def LastApprovalRequest_dbus_property(self):

1178

return datetime_to_dbus(self.last_approval_request)

1179

1180

# Timeout - property

1181

@dbus_service_property(_interface, signature="t",

1182

access="readwrite")

1183

def Timeout_dbus_property(self, value=None):

1006

1184

if value is None: # get

1007

1185

return dbus.UInt64(self.timeout_milliseconds())

1008

1186

self.timeout = datetime.timedelta(0, 0, 0, value)

1009

# Emit D-Bus signal

1010

self.PropertyChanged(dbus.String(u"timeout"),

1011

dbus.UInt64(value, variant_level=1))

1012

if getattr(self, u"disable_initiator_tag", None) is None:

1187

if getattr(self, "disable_initiator_tag", None) is None:

1013

1188

return

1014

1189

# Reschedule timeout

1015

1190

gobject.source_remove(self.disable_initiator_tag)

1016

1191

self.disable_initiator_tag = None

1017

time_to_die = (self.

1018

_timedelta_to_milliseconds((self

1019

.last_checked_ok

1020

+ self.timeout)

1021

- datetime.datetime

1022

.utcnow()))

1192

self.expires = None

1193

time_to_die = _timedelta_to_milliseconds((self

1194

.last_checked_ok

1195

+ self.timeout)

1196

- datetime.datetime

1197

.utcnow())

1023

1198

if time_to_die <= 0:

1024

1199

# The timeout has passed

1025

1200

self.disable()

1026

1201

else:

1202

self.expires = (datetime.datetime.utcnow()

1203

+ datetime.timedelta(milliseconds =

1204

time_to_die))

1027

1205

self.disable_initiator_tag = (gobject.timeout_add

1028

1206

(time_to_die, self.disable))

1029

1207

1030

# interval - property

1031

@dbus_service_property(_interface, signature=u"t",

1032

access=u"readwrite")

1033

def interval_dbus_property(self, value=None):

1208

# ExtendedTimeout - property

1209

@dbus_service_property(_interface, signature="t",

1210

access="readwrite")

1211

def ExtendedTimeout_dbus_property(self, value=None):

1212

if value is None: # get

1213

return dbus.UInt64(self.extended_timeout_milliseconds())

1214

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1215

1216

# Interval - property

1217

@dbus_service_property(_interface, signature="t",

1218

access="readwrite")

1219

def Interval_dbus_property(self, value=None):

1034

1220

if value is None: # get

1035

1221

return dbus.UInt64(self.interval_milliseconds())

1036

1222

self.interval = datetime.timedelta(0, 0, 0, value)

1037

# Emit D-Bus signal

1038

self.PropertyChanged(dbus.String(u"interval"),

1039

dbus.UInt64(value, variant_level=1))

1040

if getattr(self, u"checker_initiator_tag", None) is None:

1223

if getattr(self, "checker_initiator_tag", None) is None:

1041

1224

return

1042

1225

# Reschedule checker run

1043

1226

gobject.source_remove(self.checker_initiator_tag)

1044

1227

self.checker_initiator_tag = (gobject.timeout_add

1045

1228

(value, self.start_checker))

1046

1229

self.start_checker() # Start one now, too

1047

1048

# checker - property

1049

@dbus_service_property(_interface, signature=u"s",

1050

access=u"readwrite")

1051

def checker_dbus_property(self, value=None):

1230

1231

# Checker - property

1232

@dbus_service_property(_interface, signature="s",

1233

access="readwrite")

1234

def Checker_dbus_property(self, value=None):

1052

1235

if value is None: # get

1053

1236

return dbus.String(self.checker_command)

1054

1237

self.checker_command = value

1055

# Emit D-Bus signal

1056

self.PropertyChanged(dbus.String(u"checker"),

1057

dbus.String(self.checker_command,

1058

variant_level=1))

1059

1238

1060

# checker_running - property

1061

@dbus_service_property(_interface, signature=u"b",

1062

access=u"readwrite")

1063

def checker_running_dbus_property(self, value=None):

1239

# CheckerRunning - property

1240

@dbus_service_property(_interface, signature="b",

1241

access="readwrite")

1242

def CheckerRunning_dbus_property(self, value=None):

1064

1243

if value is None: # get

1065

1244

return dbus.Boolean(self.checker is not None)

1066

1245

if value:

1068

1247

else:

1069

1248

self.stop_checker()

1070

1249

1071

# object_path - property

1072

@dbus_service_property(_interface, signature=u"o", access=u"read")

1073

def object_path_dbus_property(self):

1250

# ObjectPath - property

1251

@dbus_service_property(_interface, signature="o", access="read")

1252

def ObjectPath_dbus_property(self):

1074

1253

return self.dbus_object_path # is already a dbus.ObjectPath

1075

1254

1076

# secret = property

1077

@dbus_service_property(_interface, signature=u"ay",

1078

access=u"write", byte_arrays=True)

1079

def secret_dbus_property(self, value):

1255

# Secret = property

1256

@dbus_service_property(_interface, signature="ay",

1257

access="write", byte_arrays=True)

1258

def Secret_dbus_property(self, value):

1080

1259

self.secret = str(value)

1081

1260

1082

1261

del _interface

1088

1267

self._pipe.send(('init', fpr, address))

1089

1268

if not self._pipe.recv():

1090

1269

raise KeyError()

1091

1270

1092

1271

def __getattribute__(self, name):

1093

1272

if(name == '_pipe'):

1094

1273

return super(ProxyClient, self).__getattribute__(name)

1101

1280

self._pipe.send(('funcall', name, args, kwargs))

1102

1281

return self._pipe.recv()[1]

1103

1282

return func

1104

1283

1105

1284

def __setattr__(self, name, value):

1106

1285

if(name == '_pipe'):

1107

1286

return super(ProxyClient, self).__setattr__(name, value)

1108

1287

self._pipe.send(('setattr', name, value))

1109

1288

1289

class ClientDBusTransitional(ClientDBus):

1290

__metaclass__ = AlternateDBusNamesMetaclass

1110

1291

1111

1292

class ClientHandler(socketserver.BaseRequestHandler, object):

1112

1293

"""A class to handle client connections.

1116

1297

1117

1298

def handle(self):

1118

1299

with contextlib.closing(self.server.child_pipe) as child_pipe:

1119

logger.info(u"TCP connection from: %s",

1300

logger.info("TCP connection from: %s",

1120

1301

unicode(self.client_address))

1121

logger.debug(u"Pipe FD: %d",

1302

logger.debug("Pipe FD: %d",

1122

1303

self.server.child_pipe.fileno())

1123

1304

1124

1305

session = (gnutls.connection

1125

1306

.ClientSession(self.request,

1126

1307

gnutls.connection

1127

1308

.X509Credentials()))

1128

1309

1129

1310

# Note: gnutls.connection.X509Credentials is really a

1130

1311

# generic GnuTLS certificate credentials object so long as

1131

1312

# no X.509 keys are added to it. Therefore, we can use it

1132

1313

# here despite using OpenPGP certificates.

1133

1134

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1135

# u"+AES-256-CBC", u"+SHA1",

1136

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1137

# u"+DHE-DSS"))

1314

1315

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1316

# "+AES-256-CBC", "+SHA1",

1317

# "+COMP-NULL", "+CTYPE-OPENPGP",

1318

# "+DHE-DSS"))

1138

1319

# Use a fallback default, since this MUST be set.

1139

1320

priority = self.server.gnutls_priority

1140

1321

if priority is None:

1141

priority = u"NORMAL"

1322

priority = "NORMAL"

1142

1323

(gnutls.library.functions

1143

1324

.gnutls_priority_set_direct(session._c_object,

1144

1325

priority, None))

1145

1326

1146

1327

# Start communication using the Mandos protocol

1147

1328

# Get protocol number

1148

1329

line = self.request.makefile().readline()

1149

logger.debug(u"Protocol version: %r", line)

1330

logger.debug("Protocol version: %r", line)

1150

1331

try:

1151

1332

if int(line.strip().split()[0]) > 1:

1152

1333

raise RuntimeError

1153

except (ValueError, IndexError, RuntimeError), error:

1154

logger.error(u"Unknown protocol version: %s", error)

1334

except (ValueError, IndexError, RuntimeError) as error:

1335

logger.error("Unknown protocol version: %s", error)

1155

1336

return

1156

1337

1157

1338

# Start GnuTLS connection

1158

1339

try:

1159

1340

session.handshake()

1160

except gnutls.errors.GNUTLSError, error:

1161

logger.warning(u"Handshake failed: %s", error)

1341

except gnutls.errors.GNUTLSError as error:

1342

logger.warning("Handshake failed: %s", error)

1162

1343

# Do not run session.bye() here: the session is not

1163

1344

# established. Just abandon the request.

1164

1345

return

1165

logger.debug(u"Handshake succeeded")

1166

1346

logger.debug("Handshake succeeded")

1347

1167

1348

approval_required = False

1168

1349

try:

1169

1350

try:

1170

1351

fpr = self.fingerprint(self.peer_certificate

1171

1352

(session))

1172

except (TypeError, gnutls.errors.GNUTLSError), error:

1173

logger.warning(u"Bad certificate: %s", error)

1353

except (TypeError,

1354

gnutls.errors.GNUTLSError) as error:

1355

logger.warning("Bad certificate: %s", error)

1174

1356

return

1175

logger.debug(u"Fingerprint: %s", fpr)

1176

1357

logger.debug("Fingerprint: %s", fpr)

1358

1177

1359

try:

1178

1360

client = ProxyClient(child_pipe, fpr,

1179

1361

self.client_address)

1180

1362

except KeyError:

1181

1363

return

1182

1364

1183

if client.approved_delay:

1184

delay = client.approved_delay

1365

if client.approval_delay:

1366

delay = client.approval_delay

1185

1367

client.approvals_pending += 1

1186

1368

approval_required = True

1187

1369

1188

1370

while True:

1189

1371

if not client.enabled:

1190

logger.warning(u"Client %s is disabled",

1372

logger.info("Client %s is disabled",

1191

1373

client.name)

1192

1374

if self.server.use_dbus:

1193

1375

# Emit D-Bus signal

1194

client.Rejected("Disabled")

1376

client.Rejected("Disabled")

1195

1377

return

1196

1378

1197

if client._approved or not client.approved_delay:

1379

if client._approved or not client.approval_delay:

1198

1380

#We are approved or approval is disabled

1199

1381

break

1200

1382

elif client._approved is None:

1201

logger.info(u"Client %s need approval",

1383

logger.info("Client %s needs approval",

1202

1384

client.name)

1203

1385

if self.server.use_dbus:

1204

1386

# Emit D-Bus signal

1205

1387

client.NeedApproval(

1206

client.approved_delay_milliseconds(),

1388

client.approval_delay_milliseconds(),

1207

1389

client.approved_by_default)

1208

1390

else:

1209

logger.warning(u"Client %s was not approved",

1391

logger.warning("Client %s was not approved",

1210

1392

client.name)

1211

1393

if self.server.use_dbus:

1212

1394

# Emit D-Bus signal

1213

client.Rejected("Disapproved")

1395

client.Rejected("Denied")

1214

1396

return

1215

1397

1216

1398

#wait until timeout or approved

1217

#x = float(client._timedelta_to_milliseconds(delay))

1218

1399

time = datetime.datetime.now()

1219

1400

client.changedstate.acquire()

1220

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1401

(client.changedstate.wait

1402

(float(client._timedelta_to_milliseconds(delay)

1403

/ 1000)))

1221

1404

client.changedstate.release()

1222

1405

time2 = datetime.datetime.now()

1223

1406

if (time2 - time) >= delay:

1227

1410

client.name)

1228

1411

if self.server.use_dbus:

1229

1412

# Emit D-Bus signal

1230

client.Rejected("Time out")

1413

client.Rejected("Approval timed out")

1231

1414

return

1232

1415

else:

1233

1416

break

1238

1421

while sent_size < len(client.secret):

1239

1422

try:

1240

1423

sent = session.send(client.secret[sent_size:])

1241

except (gnutls.errors.GNUTLSError), error:

1424

except gnutls.errors.GNUTLSError as error:

1242

1425

logger.warning("gnutls send failed")

1243

1426

return

1244

logger.debug(u"Sent: %d, remaining: %d",

1427

logger.debug("Sent: %d, remaining: %d",

1245

1428

sent, len(client.secret)

1246

1429

- (sent_size + sent))

1247

1430

sent_size += sent

1248

1249

logger.info(u"Sending secret to %s", client.name)

1250

# bump the timeout as if seen

1251

client.checked_ok()

1431

1432

logger.info("Sending secret to %s", client.name)

1433

# bump the timeout using extended_timeout

1434

client.checked_ok(client.extended_timeout)

1252

1435

if self.server.use_dbus:

1253

1436

# Emit D-Bus signal

1254

1437

client.GotSecret()

1258

1441

client.approvals_pending -= 1

1259

1442

try:

1260

1443

session.bye()

1261

except (gnutls.errors.GNUTLSError), error:

1262

logger.warning("gnutls bye failed")

1444

except gnutls.errors.GNUTLSError as error:

1445

logger.warning("GnuTLS bye failed")

1263

1446

1264

1447

@staticmethod

1265

1448

def peer_certificate(session):

1275

1458

.gnutls_certificate_get_peers

1276

1459

(session._c_object, ctypes.byref(list_size)))

1277

1460

if not bool(cert_list) and list_size.value != 0:

1278

raise gnutls.errors.GNUTLSError(u"error getting peer"

1279

u" certificate")

1461

raise gnutls.errors.GNUTLSError("error getting peer"

1462

" certificate")

1280

1463

if list_size.value == 0:

1281

1464

return None

1282

1465

cert = cert_list[0]

1308

1491

if crtverify.value != 0:

1309

1492

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1310

1493

raise (gnutls.errors.CertificateSecurityError

1311

(u"Verify failed"))

1494

("Verify failed"))

1312

1495

# New buffer for the fingerprint

1313

1496

buf = ctypes.create_string_buffer(20)

1314

1497

buf_len = ctypes.c_size_t()

1321

1504

# Convert the buffer to a Python bytestring

1322

1505

fpr = ctypes.string_at(buf, buf_len.value)

1323

1506

# Convert the bytestring to hexadecimal notation

1324

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1325

1508

return hex_fpr

1326

1509

1327

1510

1333

1516

except:

1334

1517

self.handle_error(request, address)

1335

1518

self.close_request(request)

1336

1519

1337

1520

def process_request(self, request, address):

1338

1521

"""Start a new process to process the request."""

1339

multiprocessing.Process(target = self.sub_process_main,

1340

args = (request, address)).start()

1522

proc = multiprocessing.Process(target = self.sub_process_main,

1523

args = (request,

1524

address))

1525

proc.start()

1526

return proc

1527

1341

1528

1342

1529

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1343

1530

""" adds a pipe to the MixIn """

1347

1534

This function creates a new pipe in self.pipe

1348

1535

"""

1349

1536

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1350

1351

super(MultiprocessingMixInWithPipe,

1352

self).process_request(request, client_address)

1537

1538

proc = MultiprocessingMixIn.process_request(self, request,

1539

client_address)

1353

1540

self.child_pipe.close()

1354

self.add_pipe(parent_pipe)

1355

1356

def add_pipe(self, parent_pipe):

1541

self.add_pipe(parent_pipe, proc)

1542

1543

def add_pipe(self, parent_pipe, proc):

1357

1544

"""Dummy function; override as necessary"""

1358

pass

1545

raise NotImplementedError

1546

1359

1547

1360

1548

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1361

1549

socketserver.TCPServer, object):

1379

1567

bind to an address or port if they were not specified."""

1380

1568

if self.interface is not None:

1381

1569

if SO_BINDTODEVICE is None:

1382

logger.error(u"SO_BINDTODEVICE does not exist;"

1383

u" cannot bind to interface %s",

1570

logger.error("SO_BINDTODEVICE does not exist;"

1571

" cannot bind to interface %s",

1384

1572

self.interface)

1385

1573

else:

1386

1574

try:

1387

1575

self.socket.setsockopt(socket.SOL_SOCKET,

1388

1576

SO_BINDTODEVICE,

1389

1577

str(self.interface

1390

+ u'\0'))

1391

except socket.error, error:

1578

+ '\0'))

1579

except socket.error as error:

1392

1580

if error[0] == errno.EPERM:

1393

logger.error(u"No permission to"

1394

u" bind to interface %s",

1581

logger.error("No permission to"

1582

" bind to interface %s",

1395

1583

self.interface)

1396

1584

elif error[0] == errno.ENOPROTOOPT:

1397

logger.error(u"SO_BINDTODEVICE not available;"

1398

u" cannot bind to interface %s",

1585

logger.error("SO_BINDTODEVICE not available;"

1586

" cannot bind to interface %s",

1399

1587

self.interface)

1400

1588

else:

1401

1589

raise

1403

1591

if self.server_address[0] or self.server_address[1]:

1404

1592

if not self.server_address[0]:

1405

1593

if self.address_family == socket.AF_INET6:

1406

any_address = u"::" # in6addr_any

1594

any_address = "::" # in6addr_any

1407

1595

else:

1408

1596

any_address = socket.INADDR_ANY

1409

1597

self.server_address = (any_address,

1446

1634

def server_activate(self):

1447

1635

if self.enabled:

1448

1636

return socketserver.TCPServer.server_activate(self)

1637

1449

1638

def enable(self):

1450

1639

self.enabled = True

1451

def add_pipe(self, parent_pipe):

1640

1641

def add_pipe(self, parent_pipe, proc):

1452

1642

# Call "handle_ipc" for both data and EOF events

1453

1643

gobject.io_add_watch(parent_pipe.fileno(),

1454

1644

gobject.IO_IN | gobject.IO_HUP,

1455

1645

functools.partial(self.handle_ipc,

1456

parent_pipe = parent_pipe))

1457

1646

parent_pipe =

1647

parent_pipe,

1648

proc = proc))

1649

1458

1650

def handle_ipc(self, source, condition, parent_pipe=None,

1459

client_object=None):

1651

proc = None, client_object=None):

1460

1652

condition_names = {

1461

gobject.IO_IN: u"IN", # There is data to read.

1462

gobject.IO_OUT: u"OUT", # Data can be written (without

1653

gobject.IO_IN: "IN", # There is data to read.

1654

gobject.IO_OUT: "OUT", # Data can be written (without

1463

1655

# blocking).

1464

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1465

gobject.IO_ERR: u"ERR", # Error condition.

1466

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1656

gobject.IO_PRI: "PRI", # There is urgent data to read.

1657

gobject.IO_ERR: "ERR", # Error condition.

1658

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1467

1659

# broken, usually for pipes and

1468

1660

# sockets).

1469

1661

}

1471

1663

for cond, name in

1472

1664

condition_names.iteritems()

1473

1665

if cond & condition)

1474

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1475

conditions_string)

1476

1477

# error or the other end of multiprocessing.Pipe has closed

1666

# error, or the other end of multiprocessing.Pipe has closed

1478

1667

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1668

# Wait for other process to exit

1669

proc.join()

1479

1670

return False

1480

1671

1481

1672

# Read a request from the child

1482

1673

request = parent_pipe.recv()

1483

logger.debug(u"IPC request: %s", repr(request))

1484

1674

command = request[0]

1485

1675

1486

1676

if command == 'init':

1492

1682

client = c

1493

1683

break

1494

1684

else:

1495

logger.warning(u"Client not found for fingerprint: %s, ad"

1496

u"dress: %s", fpr, address)

1685

logger.info("Client not found for fingerprint: %s, ad"

1686

"dress: %s", fpr, address)

1497

1687

if self.use_dbus:

1498

1688

# Emit D-Bus signal

1499

mandos_dbus_service.ClientNotFound(fpr, address)

1689

mandos_dbus_service.ClientNotFound(fpr,

1690

address[0])

1500

1691

parent_pipe.send(False)

1501

1692

return False

1502

1693

1503

1694

gobject.io_add_watch(parent_pipe.fileno(),

1504

1695

gobject.IO_IN | gobject.IO_HUP,

1505

1696

functools.partial(self.handle_ipc,

1506

parent_pipe = parent_pipe,

1507

client_object = client))

1697

parent_pipe =

1698

parent_pipe,

1699

proc = proc,

1700

client_object =

1701

client))

1508

1702

parent_pipe.send(True)

1509

# remove the old hook in favor of the new above hook on same fileno

1703

# remove the old hook in favor of the new above hook on

1704

# same fileno

1510

1705

return False

1511

1706

if command == 'funcall':

1512

1707

funcname = request[1]

1513

1708

args = request[2]

1514

1709

kwargs = request[3]

1515

1710

1516

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1517

1711

parent_pipe.send(('data', getattr(client_object,

1712

funcname)(*args,

1713

**kwargs)))

1714

1518

1715

if command == 'getattr':

1519

1716

attrname = request[1]

1520

1717

if callable(client_object.__getattribute__(attrname)):

1521

1718

parent_pipe.send(('function',))

1522

1719

else:

1523

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1720

parent_pipe.send(('data', client_object

1721

.__getattribute__(attrname)))

1524

1722

1525

1723

if command == 'setattr':

1526

1724

attrname = request[1]

1527

1725

value = request[2]

1528

1726

setattr(client_object, attrname, value)

1529

1727

1530

1728

return True

1531

1729

1532

1730

1533

1731

def string_to_delta(interval):

1534

1732

"""Parse a string and return a datetime.timedelta

1535

1733

1536

>>> string_to_delta(u'7d')

1734

>>> string_to_delta('7d')

1537

1735

datetime.timedelta(7)

1538

>>> string_to_delta(u'60s')

1736

>>> string_to_delta('60s')

1539

1737

datetime.timedelta(0, 60)

1540

>>> string_to_delta(u'60m')

1738

>>> string_to_delta('60m')

1541

1739

datetime.timedelta(0, 3600)

1542

>>> string_to_delta(u'24h')

1740

>>> string_to_delta('24h')

1543

1741

datetime.timedelta(1)

1544

>>> string_to_delta(u'1w')

1742

>>> string_to_delta('1w')

1545

1743

datetime.timedelta(7)

1546

>>> string_to_delta(u'5m 30s')

1744

>>> string_to_delta('5m 30s')

1547

1745

datetime.timedelta(0, 330)

1548

1746

"""

1549

1747

timevalue = datetime.timedelta(0)

1551

1749

try:

1552

1750

suffix = unicode(s[-1])

1553

1751

value = int(s[:-1])

1554

if suffix == u"d":

1752

if suffix == "d":

1555

1753

delta = datetime.timedelta(value)

1556

elif suffix == u"s":

1754

elif suffix == "s":

1557

1755

delta = datetime.timedelta(0, value)

1558

elif suffix == u"m":

1756

elif suffix == "m":

1559

1757

delta = datetime.timedelta(0, 0, 0, 0, value)

1560

elif suffix == u"h":

1758

elif suffix == "h":

1561

1759

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1562

elif suffix == u"w":

1760

elif suffix == "w":

1563

1761

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1564

1762

else:

1565

raise ValueError(u"Unknown suffix %r" % suffix)

1566

except (ValueError, IndexError), e:

1567

raise ValueError(e.message)

1763

raise ValueError("Unknown suffix %r" % suffix)

1764

except (ValueError, IndexError) as e:

1765

raise ValueError(*(e.args))

1568

1766

timevalue += delta

1569

1767

return timevalue

1570

1768

1576

1774

global if_nametoindex

1577

1775

try:

1578

1776

if_nametoindex = (ctypes.cdll.LoadLibrary

1579

(ctypes.util.find_library(u"c"))

1777

(ctypes.util.find_library("c"))

1580

1778

.if_nametoindex)

1581

1779

except (OSError, AttributeError):

1582

logger.warning(u"Doing if_nametoindex the hard way")

1780

logger.warning("Doing if_nametoindex the hard way")

1583

1781

def if_nametoindex(interface):

1584

1782

"Get an interface index the hard way, i.e. using fcntl()"

1585

1783

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1586

1784

with contextlib.closing(socket.socket()) as s:

1587

1785

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1588

struct.pack(str(u"16s16x"),

1786

struct.pack(str("16s16x"),

1589

1787

interface))

1590

interface_index = struct.unpack(str(u"I"),

1788

interface_index = struct.unpack(str("I"),

1591

1789

ifreq[16:20])[0]

1592

1790

return interface_index

1593

1791

return if_nametoindex(interface)

1601

1799

sys.exit()

1602

1800

os.setsid()

1603

1801

if not nochdir:

1604

os.chdir(u"/")

1802

os.chdir("/")

1605

1803

if os.fork():

1606

1804

sys.exit()

1607

1805

if not noclose:

1609

1807

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1610

1808

if not stat.S_ISCHR(os.fstat(null).st_mode):

1611

1809

raise OSError(errno.ENODEV,

1612

u"%s not a character device"

1810

"%s not a character device"

1613

1811

% os.path.devnull)

1614

1812

os.dup2(null, sys.stdin.fileno())

1615

1813

os.dup2(null, sys.stdout.fileno())

1623

1821

##################################################################

1624

1822

# Parsing of options, both command line and config file

1625

1823

1626

parser = optparse.OptionParser(version = "%%prog %s" % version)

1627

parser.add_option("-i", u"--interface", type=u"string",

1628

metavar="IF", help=u"Bind to interface IF")

1629

parser.add_option("-a", u"--address", type=u"string",

1630

help=u"Address to listen for requests on")

1631

parser.add_option("-p", u"--port", type=u"int",

1632

help=u"Port number to receive requests on")

1633

parser.add_option("--check", action=u"store_true",

1634

help=u"Run self-test")

1635

parser.add_option("--debug", action=u"store_true",

1636

help=u"Debug mode; run in foreground and log to"

1637

u" terminal")

1638

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1639

help=u"Debug level for stdout output")

1640

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1641

u" priority string (see GnuTLS documentation)")

1642

parser.add_option("--servicename", type=u"string",

1643

metavar=u"NAME", help=u"Zeroconf service name")

1644

parser.add_option("--configdir", type=u"string",

1645

default=u"/etc/mandos", metavar=u"DIR",

1646

help=u"Directory to search for configuration"

1647

u" files")

1648

parser.add_option("--no-dbus", action=u"store_false",

1649

dest=u"use_dbus", help=u"Do not provide D-Bus"

1650

u" system bus interface")

1651

parser.add_option("--no-ipv6", action=u"store_false",

1652

dest=u"use_ipv6", help=u"Do not use IPv6")

1653

options = parser.parse_args()[0]

1824

parser = argparse.ArgumentParser()

1825

parser.add_argument("-v", "--version", action="version",

1826

version = "%%(prog)s %s" % version,

1827

help="show version number and exit")

1828

parser.add_argument("-i", "--interface", metavar="IF",

1829

help="Bind to interface IF")

1830

parser.add_argument("-a", "--address",

1831

help="Address to listen for requests on")

1832

parser.add_argument("-p", "--port", type=int,

1833

help="Port number to receive requests on")

1834

parser.add_argument("--check", action="store_true",

1835

help="Run self-test")

1836

parser.add_argument("--debug", action="store_true",

1837

help="Debug mode; run in foreground and log"

1838

" to terminal")

1839

parser.add_argument("--debuglevel", metavar="LEVEL",

1840

help="Debug level for stdout output")

1841

parser.add_argument("--priority", help="GnuTLS"

1842

" priority string (see GnuTLS documentation)")

1843

parser.add_argument("--servicename",

1844

metavar="NAME", help="Zeroconf service name")

1845

parser.add_argument("--configdir",

1846

default="/etc/mandos", metavar="DIR",

1847

help="Directory to search for configuration"

1848

" files")

1849

parser.add_argument("--no-dbus", action="store_false",

1850

dest="use_dbus", help="Do not provide D-Bus"

1851

" system bus interface")

1852

parser.add_argument("--no-ipv6", action="store_false",

1853

dest="use_ipv6", help="Do not use IPv6")

1854

options = parser.parse_args()

1654

1855

1655

1856

if options.check:

1656

1857

import doctest

1658

1859

sys.exit()

1659

1860

1660

1861

# Default values for config file for server-global settings

1661

server_defaults = { u"interface": u"",

1662

u"address": u"",

1663

u"port": u"",

1664

u"debug": u"False",

1665

u"priority":

1666

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1667

u"servicename": u"Mandos",

1668

u"use_dbus": u"True",

1669

u"use_ipv6": u"True",

1670

u"debuglevel": u"",

1862

server_defaults = { "interface": "",

1863

"address": "",

1864

"port": "",

1865

"debug": "False",

1866

"priority":

1867

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1868

"servicename": "Mandos",

1869

"use_dbus": "True",

1870

"use_ipv6": "True",

1871

"debuglevel": "",

1671

1872

}

1672

1873

1673

1874

# Parse config file for server-global settings

1674

1875

server_config = configparser.SafeConfigParser(server_defaults)

1675

1876

del server_defaults

1676

1877

server_config.read(os.path.join(options.configdir,

1677

u"mandos.conf"))

1878

"mandos.conf"))

1678

1879

# Convert the SafeConfigParser object to a dict

1679

1880

server_settings = server_config.defaults()

1680

1881

# Use the appropriate methods on the non-string config options

1681

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1682

server_settings[option] = server_config.getboolean(u"DEFAULT",

1882

for option in ("debug", "use_dbus", "use_ipv6"):

1883

server_settings[option] = server_config.getboolean("DEFAULT",

1683

1884

option)

1684

1885

if server_settings["port"]:

1685

server_settings["port"] = server_config.getint(u"DEFAULT",

1686

u"port")

1886

server_settings["port"] = server_config.getint("DEFAULT",

1887

"port")

1687

1888

del server_config

1688

1889

1689

1890

# Override the settings from the config file with command line

1690

1891

# options, if set.

1691

for option in (u"interface", u"address", u"port", u"debug",

1692

u"priority", u"servicename", u"configdir",

1693

u"use_dbus", u"use_ipv6", u"debuglevel"):

1892

for option in ("interface", "address", "port", "debug",

1893

"priority", "servicename", "configdir",

1894

"use_dbus", "use_ipv6", "debuglevel"):

1694

1895

value = getattr(options, option)

1695

1896

if value is not None:

1696

1897

server_settings[option] = value

1704

1905

##################################################################

1705

1906

1706

1907

# For convenience

1707

debug = server_settings[u"debug"]

1708

debuglevel = server_settings[u"debuglevel"]

1709

use_dbus = server_settings[u"use_dbus"]

1710

use_ipv6 = server_settings[u"use_ipv6"]

1711

1712

if server_settings[u"servicename"] != u"Mandos":

1908

debug = server_settings["debug"]

1909

debuglevel = server_settings["debuglevel"]

1910

use_dbus = server_settings["use_dbus"]

1911

use_ipv6 = server_settings["use_ipv6"]

1912

1913

if server_settings["servicename"] != "Mandos":

1713

1914

syslogger.setFormatter(logging.Formatter

1714

(u'Mandos (%s) [%%(process)d]:'

1715

u' %%(levelname)s: %%(message)s'

1716

% server_settings[u"servicename"]))

1915

('Mandos (%s) [%%(process)d]:'

1916

' %%(levelname)s: %%(message)s'

1917

% server_settings["servicename"]))

1717

1918

1718

1919

# Parse config file with clients

1719

client_defaults = { u"timeout": u"1h",

1720

u"interval": u"5m",

1721

u"checker": u"fping -q -- %%(host)s",

1722

u"host": u"",

1723

u"approved_delay": u"0s",

1724

u"approved_duration": u"1s",

1920

client_defaults = { "timeout": "5m",

1921

"extended_timeout": "15m",

1922

"interval": "2m",

1923

"checker": "fping -q -- %%(host)s",

1924

"host": "",

1925

"approval_delay": "0s",

1926

"approval_duration": "1s",

1725

1927

}

1726

1928

client_config = configparser.SafeConfigParser(client_defaults)

1727

client_config.read(os.path.join(server_settings[u"configdir"],

1728

u"clients.conf"))

1929

client_config.read(os.path.join(server_settings["configdir"],

1930

"clients.conf"))

1729

1931

1730

1932

global mandos_dbus_service

1731

1933

mandos_dbus_service = None

1732

1934

1733

tcp_server = MandosServer((server_settings[u"address"],

1734

server_settings[u"port"]),

1935

tcp_server = MandosServer((server_settings["address"],

1936

server_settings["port"]),

1735

1937

ClientHandler,

1736

interface=(server_settings[u"interface"]

1938

interface=(server_settings["interface"]

1737

1939

or None),

1738

1940

use_ipv6=use_ipv6,

1739

1941

gnutls_priority=

1740

server_settings[u"priority"],

1942

server_settings["priority"],

1741

1943

use_dbus=use_dbus)

1742

pidfilename = u"/var/run/mandos.pid"

1743

try:

1744

pidfile = open(pidfilename, u"w")

1745

except IOError:

1746

logger.error(u"Could not open file %r", pidfilename)

1944

if not debug:

1945

pidfilename = "/var/run/mandos.pid"

1946

try:

1947

pidfile = open(pidfilename, "w")

1948

except IOError:

1949

logger.error("Could not open file %r", pidfilename)

1747

1950

1748

1951

try:

1749

uid = pwd.getpwnam(u"_mandos").pw_uid

1750

gid = pwd.getpwnam(u"_mandos").pw_gid

1952

uid = pwd.getpwnam("_mandos").pw_uid

1953

gid = pwd.getpwnam("_mandos").pw_gid

1751

1954

except KeyError:

1752

1955

try:

1753

uid = pwd.getpwnam(u"mandos").pw_uid

1754

gid = pwd.getpwnam(u"mandos").pw_gid

1956

uid = pwd.getpwnam("mandos").pw_uid

1957

gid = pwd.getpwnam("mandos").pw_gid

1755

1958

except KeyError:

1756

1959

try:

1757

uid = pwd.getpwnam(u"nobody").pw_uid

1758

gid = pwd.getpwnam(u"nobody").pw_gid

1960

uid = pwd.getpwnam("nobody").pw_uid

1961

gid = pwd.getpwnam("nobody").pw_gid

1759

1962

except KeyError:

1760

1963

uid = 65534

1761

1964

gid = 65534

1762

1965

try:

1763

1966

os.setgid(gid)

1764

1967

os.setuid(uid)

1765

except OSError, error:

1968

except OSError as error:

1766

1969

if error[0] != errno.EPERM:

1767

1970

raise error

1768

1971

1769

# Enable all possible GnuTLS debugging

1770

1771

1772

1972

if not debug and not debuglevel:

1773

1973

syslogger.setLevel(logging.WARNING)

1774

1974

console.setLevel(logging.WARNING)

1776

1976

level = getattr(logging, debuglevel.upper())

1777

1977

syslogger.setLevel(level)

1778

1978

console.setLevel(level)

1779

1979

1780

1980

if debug:

1981

# Enable all possible GnuTLS debugging

1982

1781

1983

# "Use a log level over 10 to enable all debugging options."

1782

1984

# - GnuTLS manual

1783

1985

gnutls.library.functions.gnutls_global_set_log_level(11)

1784

1986

1785

1987

@gnutls.library.types.gnutls_log_func

1786

1988

def debug_gnutls(level, string):

1787

logger.debug(u"GnuTLS: %s", string[:-1])

1989

logger.debug("GnuTLS: %s", string[:-1])

1788

1990

1789

1991

(gnutls.library.functions

1790

1992

.gnutls_global_set_log_function(debug_gnutls))

1791

1993

1792

1994

# Redirect stdin so all checkers get /dev/null

1793

1995

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1794

1996

os.dup2(null, sys.stdin.fileno())

1797

1999

else:

1798

2000

# No console logging

1799

2001

logger.removeHandler(console)

1800

2002

2003

# Need to fork before connecting to D-Bus

2004

if not debug:

2005

# Close all input and output, do double fork, etc.

2006

daemon()

1801

2007

1802

2008

global main_loop

1803

2009

# From the Avahi example code

1807

2013

# End of Avahi example code

1808

2014

if use_dbus:

1809

2015

try:

1810

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2016

bus_name = dbus.service.BusName("se.recompile.Mandos",

1811

2017

bus, do_not_queue=True)

1812

except dbus.exceptions.NameExistsException, e:

1813

logger.error(unicode(e) + u", disabling D-Bus")

2018

old_bus_name = (dbus.service.BusName

2019

("se.bsnet.fukt.Mandos", bus,

2020

do_not_queue=True))

2021

except dbus.exceptions.NameExistsException as e:

2022

logger.error(unicode(e) + ", disabling D-Bus")

1814

2023

use_dbus = False

1815

server_settings[u"use_dbus"] = False

2024

server_settings["use_dbus"] = False

1816

2025

tcp_server.use_dbus = False

1817

2026

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1818

service = AvahiService(name = server_settings[u"servicename"],

1819

servicetype = u"_mandos._tcp",

2027

service = AvahiService(name = server_settings["servicename"],

2028

servicetype = "_mandos._tcp",

1820

2029

protocol = protocol, bus = bus)

1821

2030

if server_settings["interface"]:

1822

2031

service.interface = (if_nametoindex

1823

(str(server_settings[u"interface"])))

1824

1825

if not debug:

1826

# Close all input and output, do double fork, etc.

1827

daemon()

1828

2032

(str(server_settings["interface"])))

2033

1829

2034

global multiprocessing_manager

1830

2035

multiprocessing_manager = multiprocessing.Manager()

1831

2036

1832

2037

client_class = Client

1833

2038

if use_dbus:

1834

client_class = functools.partial(ClientDBus, bus = bus)

2039

client_class = functools.partial(ClientDBusTransitional,

2040

bus = bus)

1835

2041

def client_config_items(config, section):

1836

2042

special_settings = {

1837

2043

"approved_by_default":

1850

2056

client_config, section)))

1851

2057

for section in client_config.sections()))

1852

2058

if not tcp_server.clients:

1853

logger.warning(u"No clients defined")

2059

logger.warning("No clients defined")

1854

2060

1855

try:

1856

with pidfile:

1857

pid = os.getpid()

1858

pidfile.write(str(pid) + "\n")

1859

del pidfile

1860

except IOError:

1861

logger.error(u"Could not write to file %r with PID %d",

1862

pidfilename, pid)

1863

except NameError:

1864

# "pidfile" was never created

1865

pass

1866

del pidfilename

1867

1868

2061

if not debug:

2062

try:

2063

with pidfile:

2064

pid = os.getpid()

2065

pidfile.write(str(pid) + "\n".encode("utf-8"))

2066

del pidfile

2067

except IOError:

2068

logger.error("Could not write to file %r with PID %d",

2069

pidfilename, pid)

2070

except NameError:

2071

# "pidfile" was never created

2072

pass

2073

del pidfilename

2074

1869

2075

signal.signal(signal.SIGINT, signal.SIG_IGN)

2076

1870

2077

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1871

2078

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1872

2079

1874

2081

class MandosDBusService(dbus.service.Object):

1875

2082

"""A D-Bus proxy object"""

1876

2083

def __init__(self):

1877

dbus.service.Object.__init__(self, bus, u"/")

1878

_interface = u"se.bsnet.fukt.Mandos"

2084

dbus.service.Object.__init__(self, bus, "/")

2085

_interface = "se.recompile.Mandos"

1879

2086

1880

@dbus.service.signal(_interface, signature=u"o")

2087

@dbus.service.signal(_interface, signature="o")

1881

2088

def ClientAdded(self, objpath):

1882

2089

"D-Bus signal"

1883

2090

pass

1884

2091

1885

@dbus.service.signal(_interface, signature=u"ss")

2092

@dbus.service.signal(_interface, signature="ss")

1886

2093

def ClientNotFound(self, fingerprint, address):

1887

2094

"D-Bus signal"

1888

2095

pass

1889

2096

1890

@dbus.service.signal(_interface, signature=u"os")

2097

@dbus.service.signal(_interface, signature="os")

1891

2098

def ClientRemoved(self, objpath, name):

1892

2099

"D-Bus signal"

1893

2100

pass

1894

2101

1895

@dbus.service.method(_interface, out_signature=u"ao")

2102

@dbus.service.method(_interface, out_signature="ao")

1896

2103

def GetAllClients(self):

1897

2104

"D-Bus method"

1898

2105

return dbus.Array(c.dbus_object_path

1899

2106

for c in tcp_server.clients)

1900

2107

1901

2108

@dbus.service.method(_interface,

1902

out_signature=u"a{oa{sv}}")

2109

out_signature="a{oa{sv}}")

1903

2110

def GetAllClientsWithProperties(self):

1904

2111

"D-Bus method"

1905

2112

return dbus.Dictionary(

1906

((c.dbus_object_path, c.GetAll(u""))

2113

((c.dbus_object_path, c.GetAll(""))

1907

2114

for c in tcp_server.clients),

1908

signature=u"oa{sv}")

2115

signature="oa{sv}")

1909

2116

1910

@dbus.service.method(_interface, in_signature=u"o")

2117

@dbus.service.method(_interface, in_signature="o")

1911

2118

def RemoveClient(self, object_path):

1912

2119

"D-Bus method"

1913

2120

for c in tcp_server.clients:

1923

2130

1924

2131

del _interface

1925

2132

1926

mandos_dbus_service = MandosDBusService()

2133

class MandosDBusServiceTransitional(MandosDBusService):

2134

__metaclass__ = AlternateDBusNamesMetaclass

2135

mandos_dbus_service = MandosDBusServiceTransitional()

1927

2136

1928

2137

def cleanup():

1929

2138

"Cleanup function; run on exit"

1930

2139

service.cleanup()

1931

2140

2141

multiprocessing.active_children()

1932

2142

while tcp_server.clients:

1933

2143

client = tcp_server.clients.pop()

1934

2144

if use_dbus:

1938

2148

client.disable(quiet=True)

1939

2149

if use_dbus:

1940

2150

# Emit D-Bus signal

1941

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2151

mandos_dbus_service.ClientRemoved(client

2152

.dbus_object_path,

1942

2153

client.name)

1943

2154

1944

2155

atexit.register(cleanup)

1955

2166

# Find out what port we got

1956

2167

service.port = tcp_server.socket.getsockname()[1]

1957

2168

if use_ipv6:

1958

logger.info(u"Now listening on address %r, port %d,"

2169

logger.info("Now listening on address %r, port %d,"

1959

2170

" flowinfo %d, scope_id %d"

1960

2171

% tcp_server.socket.getsockname())

1961

2172

else: # IPv4

1962

logger.info(u"Now listening on address %r, port %d"

2173

logger.info("Now listening on address %r, port %d"

1963

2174

% tcp_server.socket.getsockname())

1964

2175

1965

2176

#service.interface = tcp_server.socket.getsockname()[3]

1968

2179

# From the Avahi example code

1969

2180

try:

1970

2181

service.activate()

1971

except dbus.exceptions.DBusException, error:

1972

logger.critical(u"DBusException: %s", error)

2182

except dbus.exceptions.DBusException as error:

2183

logger.critical("DBusException: %s", error)

1973

2184

cleanup()

1974

2185

sys.exit(1)

1975

2186

# End of Avahi example code

1979

2190

(tcp_server.handle_request

1980

2191

(*args[2:], **kwargs) or True))

1981

2192

1982

logger.debug(u"Starting main loop")

2193

logger.debug("Starting main loop")

1983

2194

main_loop.run()

1984

except AvahiError, error:

1985

logger.critical(u"AvahiError: %s", error)

2195

except AvahiError as error:

2196

logger.critical("AvahiError: %s", error)

1986

2197

cleanup()

1987

2198

sys.exit(1)

1988

2199

except KeyboardInterrupt:

1989

2200

if debug:

1990

print >> sys.stderr

1991

logger.debug(u"Server received KeyboardInterrupt")

1992

logger.debug(u"Server exiting")

2201

print("", file=sys.stderr)

2202

logger.debug("Server received KeyboardInterrupt")

2203

logger.debug("Server exiting")

1993

2204

# Must run before the D-Bus bus name gets deregistered

1994

2205

cleanup()

1995

2206

2207

1996

2208

if __name__ == '__main__':

1997

2209

main()