/mandos/release : revision 237.2.154

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

56

55

import logging

57

56

import logging.handlers

58

57

import pwd

59

import contextlib

58

from contextlib import closing

60

59

import struct

61

60

import fcntl

62

61

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

62

67

63

import dbus

68

64

import dbus.service

83

79

SO_BINDTODEVICE = None

84

80

85

81

86

version = "1.3.1"

82

version = "1.0.12"

87

83

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

84

logger = logging.Logger(u'mandos')

90

85

syslogger = (logging.handlers.SysLogHandler

91

86

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

address = str("/dev/log")))

87

address = "/dev/log"))

93

88

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

89

(u'Mandos [%(process)d]: %(levelname)s:'

90

u' %(message)s'))

96

91

logger.addHandler(syslogger)

97

92

98

93

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

94

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

95

u' %(levelname)s:'

96

u' %(message)s'))

102

97

logger.addHandler(console)

103

98

104

99

class AvahiError(Exception):

121

116

Attributes:

122

117

interface: integer; avahi.IF_UNSPEC or an interface index.

123

118

Used to optionally bind to the specified interface.

124

125

type: string; Example: '_mandos._tcp'.

119

120

type: string; Example: u'_mandos._tcp'.

126

121

See <http://www.dns-sd.org/ServiceTypes.html>

127

122

port: integer; what port to announce

128

123

TXT: list of strings; TXT record for the service

137

132

"""

138

133

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

139

134

servicetype = None, port = None, TXT = None,

140

domain = "", host = "", max_renames = 32768,

135

domain = u"", host = u"", max_renames = 32768,

141

136

protocol = avahi.PROTO_UNSPEC, bus = None):

142

137

self.interface = interface

143

138

self.name = name

152

147

self.group = None # our entry group

153

148

self.server = None

154

149

self.bus = bus

155

self.entry_group_state_changed_match = None

156

150

def rename(self):

157

151

"""Derived from the Avahi example code"""

158

152

if self.rename_count >= self.max_renames:

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

153

logger.critical(u"No suitable Zeroconf service name found"

154

u" after %i retries, exiting.",

161

155

self.rename_count)

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

164

logger.info("Changing Zeroconf service name to %r ...",

165

self.name)

156

raise AvahiServiceError(u"Too many renames")

157

self.name = self.server.GetAlternativeServiceName(self.name)

158

logger.info(u"Changing Zeroconf service name to %r ...",

159

unicode(self.name))

166

160

syslogger.setFormatter(logging.Formatter

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

161

(u'Mandos (%s) [%%(process)d]:'

162

u' %%(levelname)s: %%(message)s'

169

163

% self.name))

170

164

self.remove()

171

try:

172

self.add()

173

except dbus.exceptions.DBusException as error:

174

logger.critical("DBusException: %s", error)

175

self.cleanup()

176

os._exit(1)

165

self.add()

177

166

self.rename_count += 1

178

167

def remove(self):

179

168

"""Derived from the Avahi example code"""

180

if self.entry_group_state_changed_match is not None:

181

self.entry_group_state_changed_match.remove()

182

self.entry_group_state_changed_match = None

183

169

if self.group is not None:

184

170

self.group.Reset()

185

171

def add(self):

186

172

"""Derived from the Avahi example code"""

187

self.remove()

188

173

if self.group is None:

189

174

self.group = dbus.Interface(

190

175

self.bus.get_object(avahi.DBUS_NAME,

191

176

self.server.EntryGroupNew()),

192

177

avahi.DBUS_INTERFACE_ENTRY_GROUP)

193

self.entry_group_state_changed_match = (

194

self.group.connect_to_signal(

195

'StateChanged', self .entry_group_state_changed))

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

178

self.group.connect_to_signal('StateChanged',

179

self

180

.entry_group_state_changed)

181

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

197

182

self.name, self.type)

198

183

self.group.AddService(

199

184

self.interface,

206

191

self.group.Commit()

207

192

def entry_group_state_changed(self, state, error):

208

193

"""Derived from the Avahi example code"""

209

logger.debug("Avahi entry group state change: %i", state)

194

logger.debug(u"Avahi state change: %i", state)

210

195

211

196

if state == avahi.ENTRY_GROUP_ESTABLISHED:

212

logger.debug("Zeroconf service established.")

197

logger.debug(u"Zeroconf service established.")

213

198

elif state == avahi.ENTRY_GROUP_COLLISION:

214

logger.info("Zeroconf service name collision.")

199

logger.warning(u"Zeroconf service name collision.")

215

200

self.rename()

216

201

elif state == avahi.ENTRY_GROUP_FAILURE:

217

logger.critical("Avahi: Error in group state changed %s",

202

logger.critical(u"Avahi: Error in group state changed %s",

218

203

unicode(error))

219

raise AvahiGroupError("State changed: %s"

204

raise AvahiGroupError(u"State changed: %s"

220

205

% unicode(error))

221

206

def cleanup(self):

222

207

"""Derived from the Avahi example code"""

223

208

if self.group is not None:

224

try:

225

self.group.Free()

226

except (dbus.exceptions.UnknownMethodException,

227

dbus.exceptions.DBusException) as e:

228

pass

209

self.group.Free()

229

210

self.group = None

230

self.remove()

231

def server_state_changed(self, state, error=None):

211

def server_state_changed(self, state):

232

212

"""Derived from the Avahi example code"""

233

logger.debug("Avahi server state change: %i", state)

234

bad_states = { avahi.SERVER_INVALID:

235

"Zeroconf server invalid",

236

avahi.SERVER_REGISTERING: None,

237

avahi.SERVER_COLLISION:

238

"Zeroconf server name collision",

239

avahi.SERVER_FAILURE:

240

"Zeroconf server failure" }

241

if state in bad_states:

242

if bad_states[state] is not None:

243

if error is None:

244

logger.error(bad_states[state])

245

else:

246

logger.error(bad_states[state] + ": %r", error)

247

self.cleanup()

213

if state == avahi.SERVER_COLLISION:

214

logger.error(u"Zeroconf server name collision")

215

self.remove()

248

216

elif state == avahi.SERVER_RUNNING:

249

217

self.add()

250

else:

251

if error is None:

252

logger.debug("Unknown state: %r", state)

253

else:

254

logger.debug("Unknown state: %r: %r", state, error)

255

218

def activate(self):

256

219

"""Derived from the Avahi example code"""

257

220

if self.server is None:

258

221

self.server = dbus.Interface(

259

222

self.bus.get_object(avahi.DBUS_NAME,

260

avahi.DBUS_PATH_SERVER,

261

follow_name_owner_changes=True),

223

avahi.DBUS_PATH_SERVER),

262

224

avahi.DBUS_INTERFACE_SERVER)

263

self.server.connect_to_signal("StateChanged",

225

self.server.connect_to_signal(u"StateChanged",

264

226

self.server_state_changed)

265

227

self.server_state_changed(self.server.GetState())

266

228

267

229

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

274

230

class Client(object):

275

231

"""A representation of a client host served by this server.

276

232

277

233

Attributes:

278

_approved: bool(); 'None' if not yet approved/disapproved

279

approval_delay: datetime.timedelta(); Time to wait for approval

280

approval_duration: datetime.timedelta(); Duration of one approval

234

235

D-Bus identifiers

236

fingerprint: string (40 or 32 hexadecimal digits); used to

237

uniquely identify the client

238

secret: bytestring; sent verbatim (over TLS) to client

239

host: string; available for use by the checker command

240

created: datetime.datetime(); (UTC) object creation

241

last_enabled: datetime.datetime(); (UTC)

242

enabled: bool()

243

last_checked_ok: datetime.datetime(); (UTC) or None

244

timeout: datetime.timedelta(); How long from last_checked_ok

245

until this client is invalid

246

interval: datetime.timedelta(); How often to start a new checker

247

disable_hook: If set, called by disable() as disable_hook(self)

281

248

checker: subprocess.Popen(); a running checker process used

282

249

to see if the client lives.

283

250

'None' if no process is running.

284

checker_callback_tag: a gobject event source tag, or None

285

checker_command: string; External command which is run to check

286

if client lives. %() expansions are done at

251

checker_initiator_tag: a gobject event source tag, or None

252

disable_initiator_tag: - '' -

253

checker_callback_tag: - '' -

254

checker_command: string; External command which is run to check if

255

client lives. %() expansions are done at

287

256

runtime with vars(self) as dict, so that for

288

257

instance %(name)s can be used in the command.

289

checker_initiator_tag: a gobject event source tag, or None

290

created: datetime.datetime(); (UTC) object creation

291

258

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

293

disable_initiator_tag: a gobject event source tag, or None

294

enabled: bool()

295

fingerprint: string (40 or 32 hexadecimal digits); used to

296

uniquely identify the client

297

host: string; available for use by the checker command

298

interval: datetime.timedelta(); How often to start a new checker

299

last_approval_request: datetime.datetime(); (UTC) or None

300

last_checked_ok: datetime.datetime(); (UTC) or None

301

last_enabled: datetime.datetime(); (UTC)

302

303

D-Bus identifiers

304

secret: bytestring; sent verbatim (over TLS) to client

305

timeout: datetime.timedelta(); How long from last_checked_ok

306

until this client is disabled

307

extended_timeout: extra long timeout when password has been sent

308

runtime_expansions: Allowed attributes for runtime expansion.

309

expires: datetime.datetime(); time (UTC) when a client will be

310

disabled, or None

311

259

"""

312

260

313

runtime_expansions = ("approval_delay", "approval_duration",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

316

"last_enabled", "name", "timeout")

261

@staticmethod

262

def _timedelta_to_milliseconds(td):

263

"Convert a datetime.timedelta() to milliseconds"

264

return ((td.days * 24 * 60 * 60 * 1000)

265

+ (td.seconds * 1000)

266

+ (td.microseconds // 1000))

317

267

318

268

def timeout_milliseconds(self):

319

269

"Return the 'timeout' attribute in milliseconds"

320

return _timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

270

return self._timedelta_to_milliseconds(self.timeout)

325

271

326

272

def interval_milliseconds(self):

327

273

"Return the 'interval' attribute in milliseconds"

328

return _timedelta_to_milliseconds(self.interval)

329

330

def approval_delay_milliseconds(self):

331

return _timedelta_to_milliseconds(self.approval_delay)

274

return self._timedelta_to_milliseconds(self.interval)

332

275

333

276

def __init__(self, name = None, disable_hook=None, config=None):

334

277

"""Note: the 'checker' key in 'config' sets the

337

280

self.name = name

338

281

if config is None:

339

282

config = {}

340

logger.debug("Creating client %r", self.name)

283

logger.debug(u"Creating client %r", self.name)

341

284

# Uppercase and remove spaces from fingerprint for later

342

285

# comparison purposes with return value from the fingerprint()

343

286

# function

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

350

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

352

"rb") as secfile:

287

self.fingerprint = (config[u"fingerprint"].upper()

288

.replace(u" ", u""))

289

logger.debug(u" Fingerprint: %s", self.fingerprint)

290

if u"secret" in config:

291

self.secret = config[u"secret"].decode(u"base64")

292

elif u"secfile" in config:

293

with closing(open(os.path.expanduser

294

(os.path.expandvars

295

(config[u"secfile"])),

296

"rb")) as secfile:

353

297

self.secret = secfile.read()

354

298

else:

355

raise TypeError("No secret or secfile for client %s"

299

raise TypeError(u"No secret or secfile for client %s"

356

300

% self.name)

357

self.host = config.get("host", "")

301

self.host = config.get(u"host", u"")

358

302

self.created = datetime.datetime.utcnow()

359

303

self.enabled = False

360

self.last_approval_request = None

361

304

self.last_enabled = None

362

305

self.last_checked_ok = None

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

306

self.timeout = string_to_delta(config[u"timeout"])

307

self.interval = string_to_delta(config[u"interval"])

366

308

self.disable_hook = disable_hook

367

309

self.checker = None

368

310

self.checker_initiator_tag = None

369

311

self.disable_initiator_tag = None

370

self.expires = None

371

312

self.checker_callback_tag = None

372

self.checker_command = config["checker"]

313

self.checker_command = config[u"checker"]

373

314

self.current_checker_command = None

374

315

self.last_connect = None

375

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

377

True)

378

self.approvals_pending = 0

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

384

316

385

def send_changedstate(self):

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

390

317

def enable(self):

391

318

"""Start this client's checker and timeout hooks"""

392

if getattr(self, "enabled", False):

319

if getattr(self, u"enabled", False):

393

320

# Already enabled

394

321

return

395

self.send_changedstate()

322

self.last_enabled = datetime.datetime.utcnow()

396

323

# Schedule a new checker to be started an 'interval' from now,

397

324

# and every interval from then on.

398

325

self.checker_initiator_tag = (gobject.timeout_add

399

326

(self.interval_milliseconds(),

400

327

self.start_checker))

328

# Also start a new checker *right now*.

329

self.start_checker()

401

330

# Schedule a disable() when 'timeout' has passed

402

self.expires = datetime.datetime.utcnow() + self.timeout

403

331

self.disable_initiator_tag = (gobject.timeout_add

404

332

(self.timeout_milliseconds(),

405

333

self.disable))

406

334

self.enabled = True

407

self.last_enabled = datetime.datetime.utcnow()

408

# Also start a new checker *right now*.

409

self.start_checker()

410

335

411

def disable(self, quiet=True):

336

def disable(self):

412

337

"""Disable this client."""

413

338

if not getattr(self, "enabled", False):

414

339

return False

415

if not quiet:

416

self.send_changedstate()

417

if not quiet:

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

340

logger.info(u"Disabling client %s", self.name)

341

if getattr(self, u"disable_initiator_tag", False):

420

342

gobject.source_remove(self.disable_initiator_tag)

421

343

self.disable_initiator_tag = None

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

344

if getattr(self, u"checker_initiator_tag", False):

424

345

gobject.source_remove(self.checker_initiator_tag)

425

346

self.checker_initiator_tag = None

426

347

self.stop_checker()

441

362

if os.WIFEXITED(condition):

442

363

exitstatus = os.WEXITSTATUS(condition)

443

364

if exitstatus == 0:

444

logger.info("Checker for %(name)s succeeded",

365

logger.info(u"Checker for %(name)s succeeded",

445

366

vars(self))

446

367

self.checked_ok()

447

368

else:

448

logger.info("Checker for %(name)s failed",

369

logger.info(u"Checker for %(name)s failed",

449

370

vars(self))

450

371

else:

451

logger.warning("Checker for %(name)s crashed?",

372

logger.warning(u"Checker for %(name)s crashed?",

452

373

vars(self))

453

374

454

def checked_ok(self, timeout=None):

375

def checked_ok(self):

455

376

"""Bump up the timeout for this client.

456

377

457

378

This should only be called when the client has been seen,

458

379

alive and well.

459

380

"""

460

if timeout is None:

461

timeout = self.timeout

462

381

self.last_checked_ok = datetime.datetime.utcnow()

463

382

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

383

self.disable_initiator_tag = (gobject.timeout_add

466

(_timedelta_to_milliseconds(timeout),

384

(self.timeout_milliseconds(),

467

385

self.disable))

468

386

469

def need_approval(self):

470

self.last_approval_request = datetime.datetime.utcnow()

471

472

387

def start_checker(self):

473

388

"""Start a new checker subprocess if one is not running.

474

389

480

395

# client would inevitably timeout, since no checker would get

481

396

# a chance to run to completion. If we instead leave running

482

397

# checkers alone, the checker would have to take more time

483

# than 'timeout' for the client to be disabled, which is as it

484

# should be.

398

# than 'timeout' for the client to be declared invalid, which

399

# is as it should be.

485

400

486

401

# If a checker exists, make sure it is not a zombie

487

402

try:

488

403

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

489

except (AttributeError, OSError) as error:

404

except (AttributeError, OSError), error:

490

405

if (isinstance(error, OSError)

491

406

and error.errno != errno.ECHILD):

492

407

raise error

493

408

else:

494

409

if pid:

495

logger.warning("Checker was a zombie")

410

logger.warning(u"Checker was a zombie")

496

411

gobject.source_remove(self.checker_callback_tag)

497

412

self.checker_callback(pid, status,

498

413

self.current_checker_command)

503

418

command = self.checker_command % self.host

504

419

except TypeError:

505

420

# Escape attributes for the shell

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

421

escaped_attrs = dict((key,

422

re.escape(unicode(str(val),

423

errors=

424

u'replace')))

425

for key, val in

426

vars(self).iteritems())

514

427

try:

515

428

command = self.checker_command % escaped_attrs

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

429

except TypeError, error:

430

logger.error(u'Could not format string "%s":'

431

u' %s', self.checker_command, error)

519

432

return True # Try again later

520

433

self.current_checker_command = command

521

434

try:

522

logger.info("Starting checker %r for %s",

435

logger.info(u"Starting checker %r for %s",

523

436

command, self.name)

524

437

# We don't need to redirect stdout and stderr, since

525

438

# in normal mode, that is already done by daemon(),

527

440

# always replaced by /dev/null.)

528

441

self.checker = subprocess.Popen(command,

529

442

close_fds=True,

530

shell=True, cwd="/")

443

shell=True, cwd=u"/")

531

444

self.checker_callback_tag = (gobject.child_watch_add

532

445

(self.checker.pid,

533

446

self.checker_callback,

538

451

if pid:

539

452

gobject.source_remove(self.checker_callback_tag)

540

453

self.checker_callback(pid, status, command)

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

454

except OSError, error:

455

logger.error(u"Failed to start subprocess: %s",

543

456

error)

544

457

# Re-run this periodically if run by gobject.timeout_add

545

458

return True

549

462

if self.checker_callback_tag:

550

463

gobject.source_remove(self.checker_callback_tag)

551

464

self.checker_callback_tag = None

552

if getattr(self, "checker", None) is None:

465

if getattr(self, u"checker", None) is None:

553

466

return

554

logger.debug("Stopping checker for %(name)s", vars(self))

467

logger.debug(u"Stopping checker for %(name)s", vars(self))

555

468

try:

556

469

os.kill(self.checker.pid, signal.SIGTERM)

557

#time.sleep(0.5)

470

#os.sleep(0.5)

558

471

#if self.checker.poll() is None:

559

472

# os.kill(self.checker.pid, signal.SIGKILL)

560

except OSError as error:

473

except OSError, error:

561

474

if error.errno != errno.ESRCH: # No such process

562

475

raise

563

476

self.checker = None

564

565

566

def dbus_service_property(dbus_interface, signature="v",

567

access="readwrite", byte_arrays=False):

477

478

def still_valid(self):

479

"""Has the timeout not yet passed for this client?"""

480

if not getattr(self, u"enabled", False):

481

return False

482

now = datetime.datetime.utcnow()

483

if self.last_checked_ok is None:

484

return now < (self.created + self.timeout)

485

else:

486

return now < (self.last_checked_ok + self.timeout)

487

488

489

def dbus_service_property(dbus_interface, signature=u"v",

490

access=u"readwrite", byte_arrays=False):

568

491

"""Decorators for marking methods of a DBusObjectWithProperties to

569

492

become properties on the D-Bus.

570

493

575

498

dbus.service.method, except there is only "signature", since the

576

499

type from Get() and the type sent to Set() is the same.

577

500

"""

578

# Encoding deeply encoded byte arrays is not supported yet by the

579

# "Set" method, so we fail early here:

580

if byte_arrays and signature != "ay":

581

raise ValueError("Byte arrays not supported for non-'ay'"

582

" signature %r" % signature)

583

501

def decorator(func):

584

502

func._dbus_is_property = True

585

503

func._dbus_interface = dbus_interface

586

504

func._dbus_signature = signature

587

505

func._dbus_access = access

588

506

func._dbus_name = func.__name__

589

if func._dbus_name.endswith("_dbus_property"):

507

if func._dbus_name.endswith(u"_dbus_property"):

590

508

func._dbus_name = func._dbus_name[:-14]

591

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

509

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

592

510

return func

593

511

return decorator

594

512

614

532

615

533

class DBusObjectWithProperties(dbus.service.Object):

616

534

"""A D-Bus object with properties.

617

535

618

536

Classes inheriting from this can use the dbus_service_property

619

537

decorator to expose methods as D-Bus properties. It exposes the

620

538

standard Get(), Set(), and GetAll() methods on the D-Bus.

622

540

623

541

@staticmethod

624

542

def _is_dbus_property(obj):

625

return getattr(obj, "_dbus_is_property", False)

543

return getattr(obj, u"_dbus_is_property", False)

626

544

627

545

def _get_all_dbus_properties(self):

628

546

"""Returns a generator of (name, attribute) pairs

629

547

"""

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

631

for cls in self.__class__.__mro__

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

548

return ((prop._dbus_name, prop)

549

for name, prop in

550

inspect.getmembers(self, self._is_dbus_property))

633

551

634

552

def _get_dbus_property(self, interface_name, property_name):

635

553

"""Returns a bound method if one exists which is a D-Bus

636

554

property with the specified name and interface.

637

555

"""

638

for cls in self.__class__.__mro__:

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

641

return value.__get__(self)

642

556

for name in (property_name,

557

property_name + u"_dbus_property"):

558

prop = getattr(self, name, None)

559

if (prop is None

560

or not self._is_dbus_property(prop)

561

or prop._dbus_name != property_name

562

or (interface_name and prop._dbus_interface

563

and interface_name != prop._dbus_interface)):

564

continue

565

return prop

643

566

# No such property

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

645

+ interface_name + "."

567

raise DBusPropertyNotFound(self.dbus_object_path + u":"

568

+ interface_name + u"."

646

569

+ property_name)

647

570

648

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

649

out_signature="v")

571

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

572

out_signature=u"v")

650

573

def Get(self, interface_name, property_name):

651

574

"""Standard D-Bus property Get() method, see D-Bus standard.

652

575

"""

653

576

prop = self._get_dbus_property(interface_name, property_name)

654

if prop._dbus_access == "write":

577

if prop._dbus_access == u"write":

655

578

raise DBusPropertyAccessException(property_name)

656

579

value = prop()

657

if not hasattr(value, "variant_level"):

580

if not hasattr(value, u"variant_level"):

658

581

return value

659

582

return type(value)(value, variant_level=value.variant_level+1)

660

583

661

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

584

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

662

585

def Set(self, interface_name, property_name, value):

663

586

"""Standard D-Bus property Set() method, see D-Bus standard.

664

587

"""

665

588

prop = self._get_dbus_property(interface_name, property_name)

666

if prop._dbus_access == "read":

589

if prop._dbus_access == u"read":

667

590

raise DBusPropertyAccessException(property_name)

668

if prop._dbus_get_args_options["byte_arrays"]:

669

# The byte_arrays option is not supported yet on

670

# signatures other than "ay".

671

if prop._dbus_signature != "ay":

672

raise ValueError

591

if prop._dbus_get_args_options[u"byte_arrays"]:

673

592

value = dbus.ByteArray(''.join(unichr(byte)

674

593

for byte in value))

675

594

prop(value)

676

595

677

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

678

out_signature="a{sv}")

596

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

597

out_signature=u"a{sv}")

679

598

def GetAll(self, interface_name):

680

599

"""Standard D-Bus property GetAll() method, see D-Bus

681

600

standard.

682

601

683

602

Note: Will not include properties with access="write".

684

603

"""

685

604

all = {}

689

608

# Interface non-empty but did not match

690

609

continue

691

610

# Ignore write-only properties

692

if prop._dbus_access == "write":

611

if prop._dbus_access == u"write":

693

612

continue

694

613

value = prop()

695

if not hasattr(value, "variant_level"):

614

if not hasattr(value, u"variant_level"):

696

615

all[name] = value

697

616

continue

698

617

all[name] = type(value)(value, variant_level=

699

618

value.variant_level+1)

700

return dbus.Dictionary(all, signature="sv")

619

return dbus.Dictionary(all, signature=u"sv")

701

620

702

621

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

703

out_signature="s",

622

out_signature=u"s",

704

623

path_keyword='object_path',

705

624

connection_keyword='connection')

706

625

def Introspect(self, object_path, connection):

711

630

try:

712

631

document = xml.dom.minidom.parseString(xmlstring)

713

632

def make_tag(document, name, prop):

714

e = document.createElement("property")

715

e.setAttribute("name", name)

716

e.setAttribute("type", prop._dbus_signature)

717

e.setAttribute("access", prop._dbus_access)

633

e = document.createElement(u"property")

634

e.setAttribute(u"name", name)

635

e.setAttribute(u"type", prop._dbus_signature)

636

e.setAttribute(u"access", prop._dbus_access)

718

637

return e

719

for if_tag in document.getElementsByTagName("interface"):

638

for if_tag in document.getElementsByTagName(u"interface"):

720

639

for tag in (make_tag(document, name, prop)

721

640

for name, prop

722

641

in self._get_all_dbus_properties()

723

642

if prop._dbus_interface

724

== if_tag.getAttribute("name")):

643

== if_tag.getAttribute(u"name")):

725

644

if_tag.appendChild(tag)

726

645

# Add the names to the return values for the

727

646

# "org.freedesktop.DBus.Properties" methods

728

if (if_tag.getAttribute("name")

729

== "org.freedesktop.DBus.Properties"):

730

for cn in if_tag.getElementsByTagName("method"):

731

if cn.getAttribute("name") == "Get":

732

for arg in cn.getElementsByTagName("arg"):

733

if (arg.getAttribute("direction")

734

== "out"):

735

arg.setAttribute("name", "value")

736

elif cn.getAttribute("name") == "GetAll":

737

for arg in cn.getElementsByTagName("arg"):

738

if (arg.getAttribute("direction")

739

== "out"):

740

arg.setAttribute("name", "props")

741

xmlstring = document.toxml("utf-8")

647

if (if_tag.getAttribute(u"name")

648

== u"org.freedesktop.DBus.Properties"):

649

for cn in if_tag.getElementsByTagName(u"method"):

650

if cn.getAttribute(u"name") == u"Get":

651

for arg in cn.getElementsByTagName(u"arg"):

652

if (arg.getAttribute(u"direction")

653

== u"out"):

654

arg.setAttribute(u"name", u"value")

655

elif cn.getAttribute(u"name") == u"GetAll":

656

for arg in cn.getElementsByTagName(u"arg"):

657

if (arg.getAttribute(u"direction")

658

== u"out"):

659

arg.setAttribute(u"name", u"props")

660

xmlstring = document.toxml(u"utf-8")

742

661

document.unlink()

743

662

except (AttributeError, xml.dom.DOMException,

744

xml.parsers.expat.ExpatError) as error:

745

logger.error("Failed to override Introspection method",

663

xml.parsers.expat.ExpatError), error:

664

logger.error(u"Failed to override Introspection method",

746

665

error)

747

666

return xmlstring

748

667

749

668

750

def datetime_to_dbus (dt, variant_level=0):

751

"""Convert a UTC datetime.datetime() to a D-Bus type."""

752

if dt is None:

753

return dbus.String("", variant_level = variant_level)

754

return dbus.String(dt.isoformat(),

755

variant_level=variant_level)

756

757

class transitional_dbus_metaclass(DBusObjectWithProperties.__metaclass__):

758

def __new__(mcs, name, bases, attr):

759

for attrname, old_dbusobj in inspect.getmembers(bases[0]):

760

new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")

761

if (getattr(old_dbusobj, "_dbus_is_signal", False)

762

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

763

unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,

764

old_dbusobj.__closure__))["func"].cell_contents

765

newfunc = types.FunctionType(unwrappedfunc.func_code,

766

unwrappedfunc.func_globals,

767

unwrappedfunc.func_name,

768

unwrappedfunc.func_defaults,

769

unwrappedfunc.func_closure)

770

new_dbusfunc = dbus.service.signal(

771

new_interface, old_dbusobj._dbus_signature)(newfunc)

772

attr["_transitional_" + attrname] = new_dbusfunc

773

774

def fixscope(func1, func2):

775

def newcall(*args, **kwargs):

776

func1(*args, **kwargs)

777

func2(*args, **kwargs)

778

return newcall

779

780

attr[attrname] = fixscope(old_dbusobj, new_dbusfunc)

781

782

elif (getattr(old_dbusobj, "_dbus_is_method", False)

783

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

784

new_dbusfunc = (dbus.service.method

785

(new_interface,

786

old_dbusobj._dbus_in_signature,

787

old_dbusobj._dbus_out_signature)

788

(types.FunctionType

789

(old_dbusobj.func_code,

790

old_dbusobj.func_globals,

791

old_dbusobj.func_name,

792

old_dbusobj.func_defaults,

793

old_dbusobj.func_closure)))

794

795

attr[attrname] = new_dbusfunc

796

elif (getattr(old_dbusobj, "_dbus_is_property", False)

797

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

798

new_dbusfunc = (dbus_service_property

799

(new_interface,

800

old_dbusobj._dbus_signature,

801

old_dbusobj._dbus_access,

802

old_dbusobj._dbus_get_args_options["byte_arrays"])

803

(types.FunctionType

804

(old_dbusobj.func_code,

805

old_dbusobj.func_globals,

806

old_dbusobj.func_name,

807

old_dbusobj.func_defaults,

808

old_dbusobj.func_closure)))

809

810

attr[attrname] = new_dbusfunc

811

return type.__new__(mcs, name, bases, attr)

812

813

669

class ClientDBus(Client, DBusObjectWithProperties):

814

670

"""A Client class using D-Bus

815

671

817

673

dbus_object_path: dbus.ObjectPath

818

674

bus: dbus.SystemBus()

819

675

"""

820

821

runtime_expansions = (Client.runtime_expansions

822

+ ("dbus_object_path",))

823

824

676

# dbus.service.Object doesn't use super(), so we can't either.

825

677

826

678

def __init__(self, bus = None, *args, **kwargs):

827

self._approvals_pending = 0

828

679

self.bus = bus

829

680

Client.__init__(self, *args, **kwargs)

830

681

# Only now, when this client is initialized, can it show up on

831

682

# the D-Bus

832

client_object_name = unicode(self.name).translate(

833

{ord("."): ord("_"),

834

ord("-"): ord("_")})

835

683

self.dbus_object_path = (dbus.ObjectPath

836

("/clients/" + client_object_name))

684

(u"/clients/"

685

+ self.name.replace(u".", u"_")))

837

686

DBusObjectWithProperties.__init__(self, self.bus,

838

687

self.dbus_object_path)

839

840

def notifychangeproperty(transform_func,

841

dbus_name, type_func=lambda x: x,

842

variant_level=1):

843

""" Modify a variable so that its a property that announce its

844

changes to DBus.

845

transform_fun: Function that takes a value and transform it to

846

DBus type.

847

dbus_name: DBus name of the variable

848

type_func: Function that transform the value before sending it

849

to DBus

850

variant_level: DBus variant level. default: 1

851

"""

852

real_value = [None,]

853

def setter(self, value):

854

old_value = real_value[0]

855

real_value[0] = value

856

if hasattr(self, "dbus_object_path"):

857

if type_func(old_value) != type_func(real_value[0]):

858

dbus_value = transform_func(type_func(real_value[0]),

859

variant_level)

860

self.PropertyChanged(dbus.String(dbus_name),

861

dbus_value)

862

863

return property(lambda self: real_value[0], setter)

864

865

866

expires = notifychangeproperty(datetime_to_dbus, "Expires")

867

approvals_pending = notifychangeproperty(dbus.Boolean,

868

"ApprovalPending",

869

type_func = bool)

870

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

871

last_enabled = notifychangeproperty(datetime_to_dbus,

872

"LastEnabled")

873

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

874

type_func = lambda checker: checker is not None)

875

last_checked_ok = notifychangeproperty(datetime_to_dbus,

876

"LastCheckedOK")

877

last_approval_request = notifychangeproperty(datetime_to_dbus,

878

"LastApprovalRequest")

879

approved_by_default = notifychangeproperty(dbus.Boolean,

880

"ApprovedByDefault")

881

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

882

type_func = _timedelta_to_milliseconds)

883

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

884

type_func = _timedelta_to_milliseconds)

885

host = notifychangeproperty(dbus.String, "Host")

886

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

887

type_func = _timedelta_to_milliseconds)

888

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

889

type_func = _timedelta_to_milliseconds)

890

interval = notifychangeproperty(dbus.UInt16, "Interval",

891

type_func = _timedelta_to_milliseconds)

892

checker_command = notifychangeproperty(dbus.String, "Checker")

893

894

del notifychangeproperty

688

689

@staticmethod

690

def _datetime_to_dbus(dt, variant_level=0):

691

"""Convert a UTC datetime.datetime() to a D-Bus type."""

692

return dbus.String(dt.isoformat(),

693

variant_level=variant_level)

694

695

def enable(self):

696

oldstate = getattr(self, u"enabled", False)

697

r = Client.enable(self)

698

if oldstate != self.enabled:

699

# Emit D-Bus signals

700

self.PropertyChanged(dbus.String(u"enabled"),

701

dbus.Boolean(True, variant_level=1))

702

self.PropertyChanged(

703

dbus.String(u"last_enabled"),

704

self._datetime_to_dbus(self.last_enabled,

705

variant_level=1))

706

return r

707

708

def disable(self, signal = True):

709

oldstate = getattr(self, u"enabled", False)

710

r = Client.disable(self)

711

if signal and oldstate != self.enabled:

712

# Emit D-Bus signal

713

self.PropertyChanged(dbus.String(u"enabled"),

714

dbus.Boolean(False, variant_level=1))

715

return r

895

716

896

717

def __del__(self, *args, **kwargs):

897

718

try:

898

719

self.remove_from_connection()

899

720

except LookupError:

900

721

pass

901

if hasattr(DBusObjectWithProperties, "__del__"):

722

if hasattr(DBusObjectWithProperties, u"__del__"):

902

723

DBusObjectWithProperties.__del__(self, *args, **kwargs)

903

724

Client.__del__(self, *args, **kwargs)

904

725

906

727

*args, **kwargs):

907

728

self.checker_callback_tag = None

908

729

self.checker = None

730

# Emit D-Bus signal

731

self.PropertyChanged(dbus.String(u"checker_running"),

732

dbus.Boolean(False, variant_level=1))

909

733

if os.WIFEXITED(condition):

910

734

exitstatus = os.WEXITSTATUS(condition)

911

735

# Emit D-Bus signal

921

745

return Client.checker_callback(self, pid, condition, command,

922

746

*args, **kwargs)

923

747

748

def checked_ok(self, *args, **kwargs):

749

r = Client.checked_ok(self, *args, **kwargs)

750

# Emit D-Bus signal

751

self.PropertyChanged(

752

dbus.String(u"last_checked_ok"),

753

(self._datetime_to_dbus(self.last_checked_ok,

754

variant_level=1)))

755

return r

756

924

757

def start_checker(self, *args, **kwargs):

925

758

old_checker = self.checker

926

759

if self.checker is not None:

933

766

and old_checker_pid != self.checker.pid):

934

767

# Emit D-Bus signal

935

768

self.CheckerStarted(self.current_checker_command)

936

return r

937

938

def _reset_approved(self):

939

self._approved = None

940

return False

941

942

def approve(self, value=True):

943

self.send_changedstate()

944

self._approved = value

945

gobject.timeout_add(_timedelta_to_milliseconds

946

(self.approval_duration),

947

self._reset_approved)

948

949

950

## D-Bus methods, signals & properties

951

_interface = "se.bsnet.fukt.Mandos.Client"

952

953

## Signals

769

self.PropertyChanged(

770

dbus.String(u"checker_running"),

771

dbus.Boolean(True, variant_level=1))

772

return r

773

774

def stop_checker(self, *args, **kwargs):

775

old_checker = getattr(self, u"checker", None)

776

r = Client.stop_checker(self, *args, **kwargs)

777

if (old_checker is not None

778

and getattr(self, u"checker", None) is None):

779

self.PropertyChanged(dbus.String(u"checker_running"),

780

dbus.Boolean(False, variant_level=1))

781

return r

782

783

## D-Bus methods & signals

784

_interface = u"se.bsnet.fukt.Mandos.Client"

785

786

# CheckedOK - method

787

@dbus.service.method(_interface)

788

def CheckedOK(self):

789

return self.checked_ok()

954

790

955

791

# CheckerCompleted - signal

956

@dbus.service.signal(_interface, signature="nxs")

792

@dbus.service.signal(_interface, signature=u"nxs")

957

793

def CheckerCompleted(self, exitcode, waitstatus, command):

958

794

"D-Bus signal"

959

795

pass

960

796

961

797

# CheckerStarted - signal

962

@dbus.service.signal(_interface, signature="s")

798

@dbus.service.signal(_interface, signature=u"s")

963

799

def CheckerStarted(self, command):

964

800

"D-Bus signal"

965

801

pass

966

802

967

803

# PropertyChanged - signal

968

@dbus.service.signal(_interface, signature="sv")

804

@dbus.service.signal(_interface, signature=u"sv")

969

805

def PropertyChanged(self, property, value):

970

806

"D-Bus signal"

971

807

pass

973

809

# GotSecret - signal

974

810

@dbus.service.signal(_interface)

975

811

def GotSecret(self):

976

"""D-Bus signal

977

Is sent after a successful transfer of secret from the Mandos

978

server to mandos-client

979

"""

812

"D-Bus signal"

980

813

pass

981

814

982

815

# Rejected - signal

983

@dbus.service.signal(_interface, signature="s")

984

def Rejected(self, reason):

816

@dbus.service.signal(_interface)

817

def Rejected(self):

985

818

"D-Bus signal"

986

819

pass

987

820

988

# NeedApproval - signal

989

@dbus.service.signal(_interface, signature="tb")

990

def NeedApproval(self, timeout, default):

991

"D-Bus signal"

992

return self.need_approval()

993

994

## Methods

995

996

# Approve - method

997

@dbus.service.method(_interface, in_signature="b")

998

def Approve(self, value):

999

self.approve(value)

1000

1001

# CheckedOK - method

1002

@dbus.service.method(_interface)

1003

def CheckedOK(self):

1004

self.checked_ok()

1005

1006

821

# Enable - method

1007

822

@dbus.service.method(_interface)

1008

823

def Enable(self):

1026

841

def StopChecker(self):

1027

842

self.stop_checker()

1028

843

1029

## Properties

1030

1031

# ApprovalPending - property

1032

@dbus_service_property(_interface, signature="b", access="read")

1033

def ApprovalPending_dbus_property(self):

1034

return dbus.Boolean(bool(self.approvals_pending))

1035

1036

# ApprovedByDefault - property

1037

@dbus_service_property(_interface, signature="b",

1038

access="readwrite")

1039

def ApprovedByDefault_dbus_property(self, value=None):

1040

if value is None: # get

1041

return dbus.Boolean(self.approved_by_default)

1042

self.approved_by_default = bool(value)

1043

1044

# ApprovalDelay - property

1045

@dbus_service_property(_interface, signature="t",

1046

access="readwrite")

1047

def ApprovalDelay_dbus_property(self, value=None):

1048

if value is None: # get

1049

return dbus.UInt64(self.approval_delay_milliseconds())

1050

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1051

1052

# ApprovalDuration - property

1053

@dbus_service_property(_interface, signature="t",

1054

access="readwrite")

1055

def ApprovalDuration_dbus_property(self, value=None):

1056

if value is None: # get

1057

return dbus.UInt64(_timedelta_to_milliseconds(

1058

self.approval_duration))

1059

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1060

1061

# Name - property

1062

@dbus_service_property(_interface, signature="s", access="read")

1063

def Name_dbus_property(self):

844

# name - property

845

@dbus_service_property(_interface, signature=u"s", access=u"read")

846

def name_dbus_property(self):

1064

847

return dbus.String(self.name)

1065

848

1066

# Fingerprint - property

1067

@dbus_service_property(_interface, signature="s", access="read")

1068

def Fingerprint_dbus_property(self):

849

# fingerprint - property

850

@dbus_service_property(_interface, signature=u"s", access=u"read")

851

def fingerprint_dbus_property(self):

1069

852

return dbus.String(self.fingerprint)

1070

853

1071

# Host - property

1072

@dbus_service_property(_interface, signature="s",

1073

access="readwrite")

1074

def Host_dbus_property(self, value=None):

854

# host - property

855

@dbus_service_property(_interface, signature=u"s",

856

access=u"readwrite")

857

def host_dbus_property(self, value=None):

1075

858

if value is None: # get

1076

859

return dbus.String(self.host)

1077

860

self.host = value

1078

1079

# Created - property

1080

@dbus_service_property(_interface, signature="s", access="read")

1081

def Created_dbus_property(self):

1082

return dbus.String(datetime_to_dbus(self.created))

1083

1084

# LastEnabled - property

1085

@dbus_service_property(_interface, signature="s", access="read")

1086

def LastEnabled_dbus_property(self):

1087

return datetime_to_dbus(self.last_enabled)

1088

1089

# Enabled - property

1090

@dbus_service_property(_interface, signature="b",

1091

access="readwrite")

1092

def Enabled_dbus_property(self, value=None):

861

# Emit D-Bus signal

862

self.PropertyChanged(dbus.String(u"host"),

863

dbus.String(value, variant_level=1))

864

865

# created - property

866

@dbus_service_property(_interface, signature=u"s", access=u"read")

867

def created_dbus_property(self):

868

return dbus.String(self._datetime_to_dbus(self.created))

869

870

# last_enabled - property

871

@dbus_service_property(_interface, signature=u"s", access=u"read")

872

def last_enabled_dbus_property(self):

873

if self.last_enabled is None:

874

return dbus.String(u"")

875

return dbus.String(self._datetime_to_dbus(self.last_enabled))

876

877

# enabled - property

878

@dbus_service_property(_interface, signature=u"b",

879

access=u"readwrite")

880

def enabled_dbus_property(self, value=None):

1093

881

if value is None: # get

1094

882

return dbus.Boolean(self.enabled)

1095

883

if value:

1097

885

else:

1098

886

self.disable()

1099

887

1100

# LastCheckedOK - property

1101

@dbus_service_property(_interface, signature="s",

1102

access="readwrite")

1103

def LastCheckedOK_dbus_property(self, value=None):

888

# last_checked_ok - property

889

@dbus_service_property(_interface, signature=u"s",

890

access=u"readwrite")

891

def last_checked_ok_dbus_property(self, value=None):

1104

892

if value is not None:

1105

893

self.checked_ok()

1106

894

return

1107

return datetime_to_dbus(self.last_checked_ok)

1108

1109

# Expires - property

1110

@dbus_service_property(_interface, signature="s", access="read")

1111

def Expires_dbus_property(self):

1112

return datetime_to_dbus(self.expires)

1113

1114

# LastApprovalRequest - property

1115

@dbus_service_property(_interface, signature="s", access="read")

1116

def LastApprovalRequest_dbus_property(self):

1117

return datetime_to_dbus(self.last_approval_request)

1118

1119

# Timeout - property

1120

@dbus_service_property(_interface, signature="t",

1121

access="readwrite")

1122

def Timeout_dbus_property(self, value=None):

895

if self.last_checked_ok is None:

896

return dbus.String(u"")

897

return dbus.String(self._datetime_to_dbus(self

898

.last_checked_ok))

899

900

# timeout - property

901

@dbus_service_property(_interface, signature=u"t",

902

access=u"readwrite")

903

def timeout_dbus_property(self, value=None):

1123

904

if value is None: # get

1124

905

return dbus.UInt64(self.timeout_milliseconds())

1125

906

self.timeout = datetime.timedelta(0, 0, 0, value)

1126

if getattr(self, "disable_initiator_tag", None) is None:

907

# Emit D-Bus signal

908

self.PropertyChanged(dbus.String(u"timeout"),

909

dbus.UInt64(value, variant_level=1))

910

if getattr(self, u"disable_initiator_tag", None) is None:

1127

911

return

1128

912

# Reschedule timeout

1129

913

gobject.source_remove(self.disable_initiator_tag)

1130

914

self.disable_initiator_tag = None

1131

self.expires = None

1132

915

time_to_die = (self.

1133

916

_timedelta_to_milliseconds((self

1134

917

.last_checked_ok

1139

922

# The timeout has passed

1140

923

self.disable()

1141

924

else:

1142

self.expires = (datetime.datetime.utcnow()

1143

+ datetime.timedelta(milliseconds = time_to_die))

1144

925

self.disable_initiator_tag = (gobject.timeout_add

1145

926

(time_to_die, self.disable))

1146

927

1147

# ExtendedTimeout - property

1148

@dbus_service_property(_interface, signature="t",

1149

access="readwrite")

1150

def ExtendedTimeout_dbus_property(self, value=None):

1151

if value is None: # get

1152

return dbus.UInt64(self.extended_timeout_milliseconds())

1153

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1154

1155

# Interval - property

1156

@dbus_service_property(_interface, signature="t",

1157

access="readwrite")

1158

def Interval_dbus_property(self, value=None):

928

# interval - property

929

@dbus_service_property(_interface, signature=u"t",

930

access=u"readwrite")

931

def interval_dbus_property(self, value=None):

1159

932

if value is None: # get

1160

933

return dbus.UInt64(self.interval_milliseconds())

1161

934

self.interval = datetime.timedelta(0, 0, 0, value)

1162

if getattr(self, "checker_initiator_tag", None) is None:

935

# Emit D-Bus signal

936

self.PropertyChanged(dbus.String(u"interval"),

937

dbus.UInt64(value, variant_level=1))

938

if getattr(self, u"checker_initiator_tag", None) is None:

1163

939

return

1164

940

# Reschedule checker run

1165

941

gobject.source_remove(self.checker_initiator_tag)

1166

942

self.checker_initiator_tag = (gobject.timeout_add

1167

943

(value, self.start_checker))

1168

944

self.start_checker() # Start one now, too

1169

1170

# Checker - property

1171

@dbus_service_property(_interface, signature="s",

1172

access="readwrite")

1173

def Checker_dbus_property(self, value=None):

945

946

# checker - property

947

@dbus_service_property(_interface, signature=u"s",

948

access=u"readwrite")

949

def checker_dbus_property(self, value=None):

1174

950

if value is None: # get

1175

951

return dbus.String(self.checker_command)

1176

952

self.checker_command = value

953

# Emit D-Bus signal

954

self.PropertyChanged(dbus.String(u"checker"),

955

dbus.String(self.checker_command,

956

variant_level=1))

1177

957

1178

# CheckerRunning - property

1179

@dbus_service_property(_interface, signature="b",

1180

access="readwrite")

1181

def CheckerRunning_dbus_property(self, value=None):

958

# checker_running - property

959

@dbus_service_property(_interface, signature=u"b",

960

access=u"readwrite")

961

def checker_running_dbus_property(self, value=None):

1182

962

if value is None: # get

1183

963

return dbus.Boolean(self.checker is not None)

1184

964

if value:

1186

966

else:

1187

967

self.stop_checker()

1188

968

1189

# ObjectPath - property

1190

@dbus_service_property(_interface, signature="o", access="read")

1191

def ObjectPath_dbus_property(self):

969

# object_path - property

970

@dbus_service_property(_interface, signature=u"o", access=u"read")

971

def object_path_dbus_property(self):

1192

972

return self.dbus_object_path # is already a dbus.ObjectPath

1193

973

1194

# Secret = property

1195

@dbus_service_property(_interface, signature="ay",

1196

access="write", byte_arrays=True)

1197

def Secret_dbus_property(self, value):

974

# secret = property

975

@dbus_service_property(_interface, signature=u"ay",

976

access=u"write", byte_arrays=True)

977

def secret_dbus_property(self, value):

1198

978

self.secret = str(value)

1199

979

1200

980

del _interface

1201

981

1202

982

1203

class ProxyClient(object):

1204

def __init__(self, child_pipe, fpr, address):

1205

self._pipe = child_pipe

1206

self._pipe.send(('init', fpr, address))

1207

if not self._pipe.recv():

1208

raise KeyError()

1209

1210

def __getattribute__(self, name):

1211

if(name == '_pipe'):

1212

return super(ProxyClient, self).__getattribute__(name)

1213

self._pipe.send(('getattr', name))

1214

data = self._pipe.recv()

1215

if data[0] == 'data':

1216

return data[1]

1217

if data[0] == 'function':

1218

def func(*args, **kwargs):

1219

self._pipe.send(('funcall', name, args, kwargs))

1220

return self._pipe.recv()[1]

1221

return func

1222

1223

def __setattr__(self, name, value):

1224

if(name == '_pipe'):

1225

return super(ProxyClient, self).__setattr__(name, value)

1226

self._pipe.send(('setattr', name, value))

1227

1228

class ClientDBusTransitional(ClientDBus):

1229

__metaclass__ = transitional_dbus_metaclass

1230

1231

983

class ClientHandler(socketserver.BaseRequestHandler, object):

1232

984

"""A class to handle client connections.

1233

985

1235

987

Note: This will run in its own forked process."""

1236

988

1237

989

def handle(self):

1238

with contextlib.closing(self.server.child_pipe) as child_pipe:

1239

logger.info("TCP connection from: %s",

1240

unicode(self.client_address))

1241

logger.debug("Pipe FD: %d",

1242

self.server.child_pipe.fileno())

1243

990

logger.info(u"TCP connection from: %s",

991

unicode(self.client_address))

992

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

993

# Open IPC pipe to parent process

994

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

1244

995

session = (gnutls.connection

1245

996

.ClientSession(self.request,

1246

997

gnutls.connection

1247

998

.X509Credentials()))

1248

999

1000

line = self.request.makefile().readline()

1001

logger.debug(u"Protocol version: %r", line)

1002

try:

1003

if int(line.strip().split()[0]) > 1:

1004

raise RuntimeError

1005

except (ValueError, IndexError, RuntimeError), error:

1006

logger.error(u"Unknown protocol version: %s", error)

1007

return

1008

1249

1009

# Note: gnutls.connection.X509Credentials is really a

1250

1010

# generic GnuTLS certificate credentials object so long as

1251

1011

# no X.509 keys are added to it. Therefore, we can use it

1252

1012

# here despite using OpenPGP certificates.

1253

1013

1254

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1255

# "+AES-256-CBC", "+SHA1",

1256

# "+COMP-NULL", "+CTYPE-OPENPGP",

1257

# "+DHE-DSS"))

1014

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1015

# u"+AES-256-CBC", u"+SHA1",

1016

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1017

# u"+DHE-DSS"))

1258

1018

# Use a fallback default, since this MUST be set.

1259

1019

priority = self.server.gnutls_priority

1260

1020

if priority is None:

1261

priority = "NORMAL"

1021

priority = u"NORMAL"

1262

1022

(gnutls.library.functions

1263

1023

.gnutls_priority_set_direct(session._c_object,

1264

1024

priority, None))

1265

1025

1266

# Start communication using the Mandos protocol

1267

# Get protocol number

1268

line = self.request.makefile().readline()

1269

logger.debug("Protocol version: %r", line)

1270

try:

1271

if int(line.strip().split()[0]) > 1:

1272

raise RuntimeError

1273

except (ValueError, IndexError, RuntimeError) as error:

1274

logger.error("Unknown protocol version: %s", error)

1275

return

1276

1277

# Start GnuTLS connection

1278

1026

try:

1279

1027

session.handshake()

1280

except gnutls.errors.GNUTLSError as error:

1281

logger.warning("Handshake failed: %s", error)

1028

except gnutls.errors.GNUTLSError, error:

1029

logger.warning(u"Handshake failed: %s", error)

1282

1030

# Do not run session.bye() here: the session is not

1283

1031

# established. Just abandon the request.

1284

1032

return

1285

logger.debug("Handshake succeeded")

1286

1287

approval_required = False

1033

logger.debug(u"Handshake succeeded")

1288

1034

try:

1289

try:

1290

fpr = self.fingerprint(self.peer_certificate

1291

(session))

1292

except (TypeError,

1293

gnutls.errors.GNUTLSError) as error:

1294

logger.warning("Bad certificate: %s", error)

1295

return

1296

logger.debug("Fingerprint: %s", fpr)

1297

1298

try:

1299

client = ProxyClient(child_pipe, fpr,

1300

self.client_address)

1301

except KeyError:

1302

return

1303

1304

if client.approval_delay:

1305

delay = client.approval_delay

1306

client.approvals_pending += 1

1307

approval_required = True

1308

1309

while True:

1310

if not client.enabled:

1311

logger.info("Client %s is disabled",

1312

client.name)

1313

if self.server.use_dbus:

1314

# Emit D-Bus signal

1315

client.Rejected("Disabled")

1316

return

1317

1318

if client._approved or not client.approval_delay:

1319

#We are approved or approval is disabled

1320

break

1321

elif client._approved is None:

1322

logger.info("Client %s needs approval",

1323

client.name)

1324

if self.server.use_dbus:

1325

# Emit D-Bus signal

1326

client.NeedApproval(

1327

client.approval_delay_milliseconds(),

1328

client.approved_by_default)

1329

else:

1330

logger.warning("Client %s was not approved",

1331

client.name)

1332

if self.server.use_dbus:

1333

# Emit D-Bus signal

1334

client.Rejected("Denied")

1335

return

1336

1337

#wait until timeout or approved

1338

#x = float(client._timedelta_to_milliseconds(delay))

1339

time = datetime.datetime.now()

1340

client.changedstate.acquire()

1341

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1342

client.changedstate.release()

1343

time2 = datetime.datetime.now()

1344

if (time2 - time) >= delay:

1345

if not client.approved_by_default:

1346

logger.warning("Client %s timed out while"

1347

" waiting for approval",

1348

client.name)

1349

if self.server.use_dbus:

1350

# Emit D-Bus signal

1351

client.Rejected("Approval timed out")

1352

return

1353

else:

1354

break

1355

else:

1356

delay -= time2 - time

1357

1358

sent_size = 0

1359

while sent_size < len(client.secret):

1360

try:

1361

sent = session.send(client.secret[sent_size:])

1362

except gnutls.errors.GNUTLSError as error:

1363

logger.warning("gnutls send failed")

1364

return

1365

logger.debug("Sent: %d, remaining: %d",

1366

sent, len(client.secret)

1367

- (sent_size + sent))

1368

sent_size += sent

1369

1370

logger.info("Sending secret to %s", client.name)

1371

# bump the timeout as if seen

1372

client.checked_ok(client.extended_timeout)

1373

if self.server.use_dbus:

1374

# Emit D-Bus signal

1375

client.GotSecret()

1035

fpr = self.fingerprint(self.peer_certificate(session))

1036

except (TypeError, gnutls.errors.GNUTLSError), error:

1037

logger.warning(u"Bad certificate: %s", error)

1038

session.bye()

1039

return

1040

logger.debug(u"Fingerprint: %s", fpr)

1376

1041

1377

finally:

1378

if approval_required:

1379

client.approvals_pending -= 1

1380

try:

1381

session.bye()

1382

except gnutls.errors.GNUTLSError as error:

1383

logger.warning("GnuTLS bye failed")

1042

for c in self.server.clients:

1043

if c.fingerprint == fpr:

1044

client = c

1045

break

1046

else:

1047

ipc.write(u"NOTFOUND %s %s\n"

1048

% (fpr, unicode(self.client_address)))

1049

session.bye()

1050

return

1051

# Have to check if client.still_valid(), since it is

1052

# possible that the client timed out while establishing

1053

# the GnuTLS session.

1054

if not client.still_valid():

1055

ipc.write(u"INVALID %s\n" % client.name)

1056

session.bye()

1057

return

1058

ipc.write(u"SENDING %s\n" % client.name)

1059

sent_size = 0

1060

while sent_size < len(client.secret):

1061

sent = session.send(client.secret[sent_size:])

1062

logger.debug(u"Sent: %d, remaining: %d",

1063

sent, len(client.secret)

1064

- (sent_size + sent))

1065

sent_size += sent

1066

session.bye()

1384

1067

1385

1068

@staticmethod

1386

1069

def peer_certificate(session):

1396

1079

.gnutls_certificate_get_peers

1397

1080

(session._c_object, ctypes.byref(list_size)))

1398

1081

if not bool(cert_list) and list_size.value != 0:

1399

raise gnutls.errors.GNUTLSError("error getting peer"

1400

" certificate")

1082

raise gnutls.errors.GNUTLSError(u"error getting peer"

1083

u" certificate")

1401

1084

if list_size.value == 0:

1402

1085

return None

1403

1086

cert = cert_list[0]

1429

1112

if crtverify.value != 0:

1430

1113

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1431

1114

raise (gnutls.errors.CertificateSecurityError

1432

("Verify failed"))

1115

(u"Verify failed"))

1433

1116

# New buffer for the fingerprint

1434

1117

buf = ctypes.create_string_buffer(20)

1435

1118

buf_len = ctypes.c_size_t()

1442

1125

# Convert the buffer to a Python bytestring

1443

1126

fpr = ctypes.string_at(buf, buf_len.value)

1444

1127

# Convert the bytestring to hexadecimal notation

1445

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1128

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1446

1129

return hex_fpr

1447

1130

1448

1131

1449

class MultiprocessingMixIn(object):

1450

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1451

def sub_process_main(self, request, address):

1452

try:

1453

self.finish_request(request, address)

1454

except:

1455

self.handle_error(request, address)

1456

self.close_request(request)

1457

1458

def process_request(self, request, address):

1459

"""Start a new process to process the request."""

1460

multiprocessing.Process(target = self.sub_process_main,

1461

args = (request, address)).start()

1462

1463

1464

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1465

""" adds a pipe to the MixIn """

1132

class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):

1133

"""Like socketserver.ForkingMixIn, but also pass a pipe."""

1466

1134

def process_request(self, request, client_address):

1467

1135

"""Overrides and wraps the original process_request().

1468

1136

1469

1137

This function creates a new pipe in self.pipe

1470

1138

"""

1471

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1472

1473

super(MultiprocessingMixInWithPipe,

1139

self.pipe = os.pipe()

1140

super(ForkingMixInWithPipe,

1474

1141

self).process_request(request, client_address)

1475

self.child_pipe.close()

1476

self.add_pipe(parent_pipe)

1477

1478

def add_pipe(self, parent_pipe):

1142

os.close(self.pipe[1]) # close write end

1143

self.add_pipe(self.pipe[0])

1144

def add_pipe(self, pipe):

1479

1145

"""Dummy function; override as necessary"""

1480

raise NotImplementedError

1481

1482

1483

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1146

os.close(pipe)

1147

1148

1149

class IPv6_TCPServer(ForkingMixInWithPipe,

1484

1150

socketserver.TCPServer, object):

1485

1151

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1486

1152

1502

1168

bind to an address or port if they were not specified."""

1503

1169

if self.interface is not None:

1504

1170

if SO_BINDTODEVICE is None:

1505

logger.error("SO_BINDTODEVICE does not exist;"

1506

" cannot bind to interface %s",

1171

logger.error(u"SO_BINDTODEVICE does not exist;"

1172

u" cannot bind to interface %s",

1507

1173

self.interface)

1508

1174

else:

1509

1175

try:

1510

1176

self.socket.setsockopt(socket.SOL_SOCKET,

1511

1177

SO_BINDTODEVICE,

1512

1178

str(self.interface

1513

+ '\0'))

1514

except socket.error as error:

1179

+ u'\0'))

1180

except socket.error, error:

1515

1181

if error[0] == errno.EPERM:

1516

logger.error("No permission to"

1517

" bind to interface %s",

1182

logger.error(u"No permission to"

1183

u" bind to interface %s",

1518

1184

self.interface)

1519

1185

elif error[0] == errno.ENOPROTOOPT:

1520

logger.error("SO_BINDTODEVICE not available;"

1521

" cannot bind to interface %s",

1186

logger.error(u"SO_BINDTODEVICE not available;"

1187

u" cannot bind to interface %s",

1522

1188

self.interface)

1523

1189

else:

1524

1190

raise

1526

1192

if self.server_address[0] or self.server_address[1]:

1527

1193

if not self.server_address[0]:

1528

1194

if self.address_family == socket.AF_INET6:

1529

any_address = "::" # in6addr_any

1195

any_address = u"::" # in6addr_any

1530

1196

else:

1531

1197

any_address = socket.INADDR_ANY

1532

1198

self.server_address = (any_address,

1571

1237

return socketserver.TCPServer.server_activate(self)

1572

1238

def enable(self):

1573

1239

self.enabled = True

1574

def add_pipe(self, parent_pipe):

1240

def add_pipe(self, pipe):

1575

1241

# Call "handle_ipc" for both data and EOF events

1576

gobject.io_add_watch(parent_pipe.fileno(),

1577

gobject.IO_IN | gobject.IO_HUP,

1578

functools.partial(self.handle_ipc,

1579

parent_pipe = parent_pipe))

1580

1581

def handle_ipc(self, source, condition, parent_pipe=None,

1582

client_object=None):

1242

gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,

1243

self.handle_ipc)

1244

def handle_ipc(self, source, condition, file_objects={}):

1583

1245

condition_names = {

1584

gobject.IO_IN: "IN", # There is data to read.

1585

gobject.IO_OUT: "OUT", # Data can be written (without

1246

gobject.IO_IN: u"IN", # There is data to read.

1247

gobject.IO_OUT: u"OUT", # Data can be written (without

1586

1248

# blocking).

1587

gobject.IO_PRI: "PRI", # There is urgent data to read.

1588

gobject.IO_ERR: "ERR", # Error condition.

1589

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1249

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1250

gobject.IO_ERR: u"ERR", # Error condition.

1251

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1590

1252

# broken, usually for pipes and

1591

1253

# sockets).

1592

1254

}

1594

1256

for cond, name in

1595

1257

condition_names.iteritems()

1596

1258

if cond & condition)

1597

# error or the other end of multiprocessing.Pipe has closed

1598

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1599

return False

1600

1601

# Read a request from the child

1602

request = parent_pipe.recv()

1603

command = request[0]

1604

1605

if command == 'init':

1606

fpr = request[1]

1607

address = request[2]

1608

1609

for c in self.clients:

1610

if c.fingerprint == fpr:

1611

client = c

1612

break

1613

else:

1614

logger.info("Client not found for fingerprint: %s, ad"

1615

"dress: %s", fpr, address)

1616

if self.use_dbus:

1617

# Emit D-Bus signal

1618

mandos_dbus_service.ClientNotFound(fpr, address[0])

1619

parent_pipe.send(False)

1620

return False

1621

1622

gobject.io_add_watch(parent_pipe.fileno(),

1623

gobject.IO_IN | gobject.IO_HUP,

1624

functools.partial(self.handle_ipc,

1625

parent_pipe = parent_pipe,

1626

client_object = client))

1627

parent_pipe.send(True)

1628

# remove the old hook in favor of the new above hook on same fileno

1629

return False

1630

if command == 'funcall':

1631

funcname = request[1]

1632

args = request[2]

1633

kwargs = request[3]

1634

1635

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1636

1637

if command == 'getattr':

1638

attrname = request[1]

1639

if callable(client_object.__getattribute__(attrname)):

1640

parent_pipe.send(('function',))

1641

else:

1642

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1643

1644

if command == 'setattr':

1645

attrname = request[1]

1646

value = request[2]

1647

setattr(client_object, attrname, value)

1648

1259

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1260

conditions_string)

1261

1262

# Turn the pipe file descriptor into a Python file object

1263

if source not in file_objects:

1264

file_objects[source] = os.fdopen(source, u"r", 1)

1265

1266

# Read a line from the file object

1267

cmdline = file_objects[source].readline()

1268

if not cmdline: # Empty line means end of file

1269

# close the IPC pipe

1270

file_objects[source].close()

1271

del file_objects[source]

1272

1273

# Stop calling this function

1274

return False

1275

1276

logger.debug(u"IPC command: %r", cmdline)

1277

1278

# Parse and act on command

1279

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1280

1281

if cmd == u"NOTFOUND":

1282

logger.warning(u"Client not found for fingerprint: %s",

1283

args)

1284

if self.use_dbus:

1285

# Emit D-Bus signal

1286

mandos_dbus_service.ClientNotFound(args)

1287

elif cmd == u"INVALID":

1288

for client in self.clients:

1289

if client.name == args:

1290

logger.warning(u"Client %s is invalid", args)

1291

if self.use_dbus:

1292

# Emit D-Bus signal

1293

client.Rejected()

1294

break

1295

else:

1296

logger.error(u"Unknown client %s is invalid", args)

1297

elif cmd == u"SENDING":

1298

for client in self.clients:

1299

if client.name == args:

1300

logger.info(u"Sending secret to %s", client.name)

1301

client.checked_ok()

1302

if self.use_dbus:

1303

# Emit D-Bus signal

1304

client.GotSecret()

1305

break

1306

else:

1307

logger.error(u"Sending secret to unknown client %s",

1308

args)

1309

else:

1310

logger.error(u"Unknown IPC command: %r", cmdline)

1311

1312

# Keep calling this function

1649

1313

return True

1650

1314

1651

1315

1652

1316

def string_to_delta(interval):

1653

1317

"""Parse a string and return a datetime.timedelta

1654

1318

1655

>>> string_to_delta('7d')

1319

>>> string_to_delta(u'7d')

1656

1320

datetime.timedelta(7)

1657

>>> string_to_delta('60s')

1321

>>> string_to_delta(u'60s')

1658

1322

datetime.timedelta(0, 60)

1659

>>> string_to_delta('60m')

1323

>>> string_to_delta(u'60m')

1660

1324

datetime.timedelta(0, 3600)

1661

>>> string_to_delta('24h')

1325

>>> string_to_delta(u'24h')

1662

1326

datetime.timedelta(1)

1663

>>> string_to_delta('1w')

1327

>>> string_to_delta(u'1w')

1664

1328

datetime.timedelta(7)

1665

>>> string_to_delta('5m 30s')

1329

>>> string_to_delta(u'5m 30s')

1666

1330

datetime.timedelta(0, 330)

1667

1331

"""

1668

1332

timevalue = datetime.timedelta(0)

1670

1334

try:

1671

1335

suffix = unicode(s[-1])

1672

1336

value = int(s[:-1])

1673

if suffix == "d":

1337

if suffix == u"d":

1674

1338

delta = datetime.timedelta(value)

1675

elif suffix == "s":

1339

elif suffix == u"s":

1676

1340

delta = datetime.timedelta(0, value)

1677

elif suffix == "m":

1341

elif suffix == u"m":

1678

1342

delta = datetime.timedelta(0, 0, 0, 0, value)

1679

elif suffix == "h":

1343

elif suffix == u"h":

1680

1344

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1681

elif suffix == "w":

1345

elif suffix == u"w":

1682

1346

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1683

1347

else:

1684

raise ValueError("Unknown suffix %r" % suffix)

1685

except (ValueError, IndexError) as e:

1686

raise ValueError(*(e.args))

1348

raise ValueError

1349

except (ValueError, IndexError):

1350

raise ValueError

1687

1351

timevalue += delta

1688

1352

return timevalue

1689

1353

1695

1359

global if_nametoindex

1696

1360

try:

1697

1361

if_nametoindex = (ctypes.cdll.LoadLibrary

1698

(ctypes.util.find_library("c"))

1362

(ctypes.util.find_library(u"c"))

1699

1363

.if_nametoindex)

1700

1364

except (OSError, AttributeError):

1701

logger.warning("Doing if_nametoindex the hard way")

1365

logger.warning(u"Doing if_nametoindex the hard way")

1702

1366

def if_nametoindex(interface):

1703

1367

"Get an interface index the hard way, i.e. using fcntl()"

1704

1368

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1705

with contextlib.closing(socket.socket()) as s:

1369

with closing(socket.socket()) as s:

1706

1370

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1707

struct.pack(str("16s16x"),

1371

struct.pack(str(u"16s16x"),

1708

1372

interface))

1709

interface_index = struct.unpack(str("I"),

1373

interface_index = struct.unpack(str(u"I"),

1710

1374

ifreq[16:20])[0]

1711

1375

return interface_index

1712

1376

return if_nametoindex(interface)

1720

1384

sys.exit()

1721

1385

os.setsid()

1722

1386

if not nochdir:

1723

os.chdir("/")

1387

os.chdir(u"/")

1724

1388

if os.fork():

1725

1389

sys.exit()

1726

1390

if not noclose:

1728

1392

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1729

1393

if not stat.S_ISCHR(os.fstat(null).st_mode):

1730

1394

raise OSError(errno.ENODEV,

1731

"%s not a character device"

1395

u"%s not a character device"

1732

1396

% os.path.devnull)

1733

1397

os.dup2(null, sys.stdin.fileno())

1734

1398

os.dup2(null, sys.stdout.fileno())

1742

1406

##################################################################

1743

1407

# Parsing of options, both command line and config file

1744

1408

1745

parser = argparse.ArgumentParser()

1746

parser.add_argument("-v", "--version", action="version",

1747

version = "%%(prog)s %s" % version,

1748

help="show version number and exit")

1749

parser.add_argument("-i", "--interface", metavar="IF",

1750

help="Bind to interface IF")

1751

parser.add_argument("-a", "--address",

1752

help="Address to listen for requests on")

1753

parser.add_argument("-p", "--port", type=int,

1754

help="Port number to receive requests on")

1755

parser.add_argument("--check", action="store_true",

1756

help="Run self-test")

1757

parser.add_argument("--debug", action="store_true",

1758

help="Debug mode; run in foreground and log"

1759

" to terminal")

1760

parser.add_argument("--debuglevel", metavar="LEVEL",

1761

help="Debug level for stdout output")

1762

parser.add_argument("--priority", help="GnuTLS"

1763

" priority string (see GnuTLS documentation)")

1764

parser.add_argument("--servicename",

1765

metavar="NAME", help="Zeroconf service name")

1766

parser.add_argument("--configdir",

1767

default="/etc/mandos", metavar="DIR",

1768

help="Directory to search for configuration"

1769

" files")

1770

parser.add_argument("--no-dbus", action="store_false",

1771

dest="use_dbus", help="Do not provide D-Bus"

1772

" system bus interface")

1773

parser.add_argument("--no-ipv6", action="store_false",

1774

dest="use_ipv6", help="Do not use IPv6")

1775

options = parser.parse_args()

1409

parser = optparse.OptionParser(version = "%%prog %s" % version)

1410

parser.add_option("-i", u"--interface", type=u"string",

1411

metavar="IF", help=u"Bind to interface IF")

1412

parser.add_option("-a", u"--address", type=u"string",

1413

help=u"Address to listen for requests on")

1414

parser.add_option("-p", u"--port", type=u"int",

1415

help=u"Port number to receive requests on")

1416

parser.add_option("--check", action=u"store_true",

1417

help=u"Run self-test")

1418

parser.add_option("--debug", action=u"store_true",

1419

help=u"Debug mode; run in foreground and log to"

1420

u" terminal")

1421

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1422

u" priority string (see GnuTLS documentation)")

1423

parser.add_option("--servicename", type=u"string",

1424

metavar=u"NAME", help=u"Zeroconf service name")

1425

parser.add_option("--configdir", type=u"string",

1426

default=u"/etc/mandos", metavar=u"DIR",

1427

help=u"Directory to search for configuration"

1428

u" files")

1429

parser.add_option("--no-dbus", action=u"store_false",

1430

dest=u"use_dbus", help=u"Do not provide D-Bus"

1431

u" system bus interface")

1432

parser.add_option("--no-ipv6", action=u"store_false",

1433

dest=u"use_ipv6", help=u"Do not use IPv6")

1434

options = parser.parse_args()[0]

1776

1435

1777

1436

if options.check:

1778

1437

import doctest

1780

1439

sys.exit()

1781

1440

1782

1441

# Default values for config file for server-global settings

1783

server_defaults = { "interface": "",

1784

"address": "",

1785

"port": "",

1786

"debug": "False",

1787

"priority":

1788

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1789

"servicename": "Mandos",

1790

"use_dbus": "True",

1791

"use_ipv6": "True",

1792

"debuglevel": "",

1442

server_defaults = { u"interface": u"",

1443

u"address": u"",

1444

u"port": u"",

1445

u"debug": u"False",

1446

u"priority":

1447

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1448

u"servicename": u"Mandos",

1449

u"use_dbus": u"True",

1450

u"use_ipv6": u"True",

1793

1451

}

1794

1452

1795

1453

# Parse config file for server-global settings

1796

1454

server_config = configparser.SafeConfigParser(server_defaults)

1797

1455

del server_defaults

1798

1456

server_config.read(os.path.join(options.configdir,

1799

"mandos.conf"))

1457

u"mandos.conf"))

1800

1458

# Convert the SafeConfigParser object to a dict

1801

1459

server_settings = server_config.defaults()

1802

1460

# Use the appropriate methods on the non-string config options

1803

for option in ("debug", "use_dbus", "use_ipv6"):

1804

server_settings[option] = server_config.getboolean("DEFAULT",

1461

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1462

server_settings[option] = server_config.getboolean(u"DEFAULT",

1805

1463

option)

1806

1464

if server_settings["port"]:

1807

server_settings["port"] = server_config.getint("DEFAULT",

1808

"port")

1465

server_settings["port"] = server_config.getint(u"DEFAULT",

1466

u"port")

1809

1467

del server_config

1810

1468

1811

1469

# Override the settings from the config file with command line

1812

1470

# options, if set.

1813

for option in ("interface", "address", "port", "debug",

1814

"priority", "servicename", "configdir",

1815

"use_dbus", "use_ipv6", "debuglevel"):

1471

for option in (u"interface", u"address", u"port", u"debug",

1472

u"priority", u"servicename", u"configdir",

1473

u"use_dbus", u"use_ipv6"):

1816

1474

value = getattr(options, option)

1817

1475

if value is not None:

1818

1476

server_settings[option] = value

1826

1484

##################################################################

1827

1485

1828

1486

# For convenience

1829

debug = server_settings["debug"]

1830

debuglevel = server_settings["debuglevel"]

1831

use_dbus = server_settings["use_dbus"]

1832

use_ipv6 = server_settings["use_ipv6"]

1833

1834

if server_settings["servicename"] != "Mandos":

1487

debug = server_settings[u"debug"]

1488

use_dbus = server_settings[u"use_dbus"]

1489

use_ipv6 = server_settings[u"use_ipv6"]

1490

1491

if not debug:

1492

syslogger.setLevel(logging.WARNING)

1493

console.setLevel(logging.WARNING)

1494

1495

if server_settings[u"servicename"] != u"Mandos":

1835

1496

syslogger.setFormatter(logging.Formatter

1836

('Mandos (%s) [%%(process)d]:'

1837

' %%(levelname)s: %%(message)s'

1838

% server_settings["servicename"]))

1497

(u'Mandos (%s) [%%(process)d]:'

1498

u' %%(levelname)s: %%(message)s'

1499

% server_settings[u"servicename"]))

1839

1500

1840

1501

# Parse config file with clients

1841

client_defaults = { "timeout": "5m",

1842

"extended_timeout": "15m",

1843

"interval": "2m",

1844

"checker": "fping -q -- %%(host)s",

1845

"host": "",

1846

"approval_delay": "0s",

1847

"approval_duration": "1s",

1502

client_defaults = { u"timeout": u"1h",

1503

u"interval": u"5m",

1504

u"checker": u"fping -q -- %%(host)s",

1505

u"host": u"",

1848

1506

}

1849

1507

client_config = configparser.SafeConfigParser(client_defaults)

1850

client_config.read(os.path.join(server_settings["configdir"],

1851

"clients.conf"))

1508

client_config.read(os.path.join(server_settings[u"configdir"],

1509

u"clients.conf"))

1852

1510

1853

1511

global mandos_dbus_service

1854

1512

mandos_dbus_service = None

1855

1513

1856

tcp_server = MandosServer((server_settings["address"],

1857

server_settings["port"]),

1514

tcp_server = MandosServer((server_settings[u"address"],

1515

server_settings[u"port"]),

1858

1516

ClientHandler,

1859

interface=(server_settings["interface"]

1860

or None),

1517

interface=server_settings[u"interface"],

1861

1518

use_ipv6=use_ipv6,

1862

1519

gnutls_priority=

1863

server_settings["priority"],

1520

server_settings[u"priority"],

1864

1521

use_dbus=use_dbus)

1865

if not debug:

1866

pidfilename = "/var/run/mandos.pid"

1867

try:

1868

pidfile = open(pidfilename, "w")

1869

except IOError:

1870

logger.error("Could not open file %r", pidfilename)

1522

pidfilename = u"/var/run/mandos.pid"

1523

try:

1524

pidfile = open(pidfilename, u"w")

1525

except IOError:

1526

logger.error(u"Could not open file %r", pidfilename)

1871

1527

1872

1528

try:

1873

uid = pwd.getpwnam("_mandos").pw_uid

1874

gid = pwd.getpwnam("_mandos").pw_gid

1529

uid = pwd.getpwnam(u"_mandos").pw_uid

1530

gid = pwd.getpwnam(u"_mandos").pw_gid

1875

1531

except KeyError:

1876

1532

try:

1877

uid = pwd.getpwnam("mandos").pw_uid

1878

gid = pwd.getpwnam("mandos").pw_gid

1533

uid = pwd.getpwnam(u"mandos").pw_uid

1534

gid = pwd.getpwnam(u"mandos").pw_gid

1879

1535

except KeyError:

1880

1536

try:

1881

uid = pwd.getpwnam("nobody").pw_uid

1882

gid = pwd.getpwnam("nobody").pw_gid

1537

uid = pwd.getpwnam(u"nobody").pw_uid

1538

gid = pwd.getpwnam(u"nobody").pw_gid

1883

1539

except KeyError:

1884

1540

uid = 65534

1885

1541

gid = 65534

1886

1542

try:

1887

1543

os.setgid(gid)

1888

1544

os.setuid(uid)

1889

except OSError as error:

1545

except OSError, error:

1890

1546

if error[0] != errno.EPERM:

1891

1547

raise error

1892

1548

1893

if not debug and not debuglevel:

1894

syslogger.setLevel(logging.WARNING)

1895

console.setLevel(logging.WARNING)

1896

if debuglevel:

1897

level = getattr(logging, debuglevel.upper())

1898

syslogger.setLevel(level)

1899

console.setLevel(level)

1900

1549

# Enable all possible GnuTLS debugging

1901

1550

if debug:

1902

# Enable all possible GnuTLS debugging

1903

1904

1551

# "Use a log level over 10 to enable all debugging options."

1905

1552

# - GnuTLS manual

1906

1553

gnutls.library.functions.gnutls_global_set_log_level(11)

1907

1554

1908

1555

@gnutls.library.types.gnutls_log_func

1909

1556

def debug_gnutls(level, string):

1910

logger.debug("GnuTLS: %s", string[:-1])

1557

logger.debug(u"GnuTLS: %s", string[:-1])

1911

1558

1912

1559

(gnutls.library.functions

1913

1560

.gnutls_global_set_log_function(debug_gnutls))

1914

1915

# Redirect stdin so all checkers get /dev/null

1916

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1917

os.dup2(null, sys.stdin.fileno())

1918

if null > 2:

1919

os.close(null)

1920

else:

1921

# No console logging

1922

logger.removeHandler(console)

1923

1924

# Need to fork before connecting to D-Bus

1925

if not debug:

1926

# Close all input and output, do double fork, etc.

1927

daemon()

1928

1561

1929

1562

global main_loop

1930

1563

# From the Avahi example code

1933

1566

bus = dbus.SystemBus()

1934

1567

# End of Avahi example code

1935

1568

if use_dbus:

1936

try:

1937

bus_name = dbus.service.BusName("se.recompile.Mandos",

1938

bus, do_not_queue=True)

1939

bus_name_transitional = dbus.service.BusName("se.bsnet.fukt.Mandos",

1940

bus, do_not_queue=True)

1941

except dbus.exceptions.NameExistsException as e:

1942

logger.error(unicode(e) + ", disabling D-Bus")

1943

use_dbus = False

1944

server_settings["use_dbus"] = False

1945

tcp_server.use_dbus = False

1569

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1946

1570

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1947

service = AvahiService(name = server_settings["servicename"],

1948

servicetype = "_mandos._tcp",

1571

service = AvahiService(name = server_settings[u"servicename"],

1572

servicetype = u"_mandos._tcp",

1949

1573

protocol = protocol, bus = bus)

1950

1574

if server_settings["interface"]:

1951

1575

service.interface = (if_nametoindex

1952

(str(server_settings["interface"])))

1953

1954

global multiprocessing_manager

1955

multiprocessing_manager = multiprocessing.Manager()

1576

(str(server_settings[u"interface"])))

1956

1577

1957

1578

client_class = Client

1958

1579

if use_dbus:

1959

client_class = functools.partial(ClientDBusTransitional, bus = bus)

1960

def client_config_items(config, section):

1961

special_settings = {

1962

"approved_by_default":

1963

lambda: config.getboolean(section,

1964

"approved_by_default"),

1965

}

1966

for name, value in config.items(section):

1967

try:

1968

yield (name, special_settings[name]())

1969

except KeyError:

1970

yield (name, value)

1971

1580

client_class = functools.partial(ClientDBus, bus = bus)

1972

1581

tcp_server.clients.update(set(

1973

1582

client_class(name = section,

1974

config= dict(client_config_items(

1975

client_config, section)))

1583

config= dict(client_config.items(section)))

1976

1584

for section in client_config.sections()))

1977

1585

if not tcp_server.clients:

1978

logger.warning("No clients defined")

1586

logger.warning(u"No clients defined")

1587

1588

if debug:

1589

# Redirect stdin so all checkers get /dev/null

1590

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1591

os.dup2(null, sys.stdin.fileno())

1592

if null > 2:

1593

os.close(null)

1594

else:

1595

# No console logging

1596

logger.removeHandler(console)

1597

# Close all input and output, do double fork, etc.

1598

daemon()

1599

1600

try:

1601

with closing(pidfile):

1602

pid = os.getpid()

1603

pidfile.write(str(pid) + "\n")

1604

del pidfile

1605

except IOError:

1606

logger.error(u"Could not write to file %r with PID %d",

1607

pidfilename, pid)

1608

except NameError:

1609

# "pidfile" was never created

1610

pass

1611

del pidfilename

1612

1613

def cleanup():

1614

"Cleanup function; run on exit"

1615

service.cleanup()

1979

1616

1617

while tcp_server.clients:

1618

client = tcp_server.clients.pop()

1619

client.disable_hook = None

1620

client.disable()

1621

1622

atexit.register(cleanup)

1623

1980

1624

if not debug:

1981

try:

1982

with pidfile:

1983

pid = os.getpid()

1984

pidfile.write(str(pid) + "\n".encode("utf-8"))

1985

del pidfile

1986

except IOError:

1987

logger.error("Could not write to file %r with PID %d",

1988

pidfilename, pid)

1989

except NameError:

1990

# "pidfile" was never created

1991

pass

1992

del pidfilename

1993

1994

1625

signal.signal(signal.SIGINT, signal.SIG_IGN)

1995

1996

1626

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1997

1627

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1998

1628

2000

1630

class MandosDBusService(dbus.service.Object):

2001

1631

"""A D-Bus proxy object"""

2002

1632

def __init__(self):

2003

dbus.service.Object.__init__(self, bus, "/")

2004

_interface = "se.bsnet.fukt.Mandos"

2005

2006

@dbus.service.signal(_interface, signature="o")

2007

def ClientAdded(self, objpath):

2008

"D-Bus signal"

2009

pass

2010

2011

@dbus.service.signal(_interface, signature="ss")

2012

def ClientNotFound(self, fingerprint, address):

2013

"D-Bus signal"

2014

pass

2015

2016

@dbus.service.signal(_interface, signature="os")

1633

dbus.service.Object.__init__(self, bus, u"/")

1634

_interface = u"se.bsnet.fukt.Mandos"

1635

1636

@dbus.service.signal(_interface, signature=u"oa{sv}")

1637

def ClientAdded(self, objpath, properties):

1638

"D-Bus signal"

1639

pass

1640

1641

@dbus.service.signal(_interface, signature=u"s")

1642

def ClientNotFound(self, fingerprint):

1643

"D-Bus signal"

1644

pass

1645

1646

@dbus.service.signal(_interface, signature=u"os")

2017

1647

def ClientRemoved(self, objpath, name):

2018

1648

"D-Bus signal"

2019

1649

pass

2020

1650

2021

@dbus.service.method(_interface, out_signature="ao")

1651

@dbus.service.method(_interface, out_signature=u"ao")

2022

1652

def GetAllClients(self):

2023

1653

"D-Bus method"

2024

1654

return dbus.Array(c.dbus_object_path

2025

1655

for c in tcp_server.clients)

2026

1656

2027

1657

@dbus.service.method(_interface,

2028

out_signature="a{oa{sv}}")

1658

out_signature=u"a{oa{sv}}")

2029

1659

def GetAllClientsWithProperties(self):

2030

1660

"D-Bus method"

2031

1661

return dbus.Dictionary(

2032

((c.dbus_object_path, c.GetAll(""))

1662

((c.dbus_object_path, c.GetAll(u""))

2033

1663

for c in tcp_server.clients),

2034

signature="oa{sv}")

1664

signature=u"oa{sv}")

2035

1665

2036

@dbus.service.method(_interface, in_signature="o")

1666

@dbus.service.method(_interface, in_signature=u"o")

2037

1667

def RemoveClient(self, object_path):

2038

1668

"D-Bus method"

2039

1669

for c in tcp_server.clients:

2041

1671

tcp_server.clients.remove(c)

2042

1672

c.remove_from_connection()

2043

1673

# Don't signal anything except ClientRemoved

2044

c.disable(quiet=True)

1674

c.disable(signal=False)

2045

1675

# Emit D-Bus signal

2046

1676

self.ClientRemoved(object_path, c.name)

2047

1677

return

2048

raise KeyError(object_path)

1678

raise KeyError

2049

1679

2050

1680

del _interface

2051

1681

2052

class MandosDBusServiceTransitional(MandosDBusService):

2053

__metaclass__ = transitional_dbus_metaclass

2054

mandos_dbus_service = MandosDBusServiceTransitional()

2055

2056

def cleanup():

2057

"Cleanup function; run on exit"

2058

service.cleanup()

2059

2060

while tcp_server.clients:

2061

client = tcp_server.clients.pop()

2062

if use_dbus:

2063

client.remove_from_connection()

2064

client.disable_hook = None

2065

# Don't signal anything except ClientRemoved

2066

client.disable(quiet=True)

2067

if use_dbus:

2068

# Emit D-Bus signal

2069

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2070

client.name)

2071

2072

atexit.register(cleanup)

1682

mandos_dbus_service = MandosDBusService()

2073

1683

2074

1684

for client in tcp_server.clients:

2075

1685

if use_dbus:

2076

1686

# Emit D-Bus signal

2077

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1687

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1688

client.GetAll(u""))

2078

1689

client.enable()

2079

1690

2080

1691

tcp_server.enable()

2083

1694

# Find out what port we got

2084

1695

service.port = tcp_server.socket.getsockname()[1]

2085

1696

if use_ipv6:

2086

logger.info("Now listening on address %r, port %d,"

1697

logger.info(u"Now listening on address %r, port %d,"

2087

1698

" flowinfo %d, scope_id %d"

2088

1699

% tcp_server.socket.getsockname())

2089

1700

else: # IPv4

2090

logger.info("Now listening on address %r, port %d"

1701

logger.info(u"Now listening on address %r, port %d"

2091

1702

% tcp_server.socket.getsockname())

2092

1703

2093

1704

#service.interface = tcp_server.socket.getsockname()[3]

2096

1707

# From the Avahi example code

2097

1708

try:

2098

1709

service.activate()

2099

except dbus.exceptions.DBusException as error:

2100

logger.critical("DBusException: %s", error)

2101

cleanup()

1710

except dbus.exceptions.DBusException, error:

1711

logger.critical(u"DBusException: %s", error)

2102

1712

sys.exit(1)

2103

1713

# End of Avahi example code

2104

1714

2107

1717

(tcp_server.handle_request

2108

1718

(*args[2:], **kwargs) or True))

2109

1719

2110

logger.debug("Starting main loop")

1720

logger.debug(u"Starting main loop")

2111

1721

main_loop.run()

2112

except AvahiError as error:

2113

logger.critical("AvahiError: %s", error)

2114

cleanup()

1722

except AvahiError, error:

1723

logger.critical(u"AvahiError: %s", error)

2115

1724

sys.exit(1)

2116

1725

except KeyboardInterrupt:

2117

1726

if debug:

2118

print("", file=sys.stderr)

2119

logger.debug("Server received KeyboardInterrupt")

2120

logger.debug("Server exiting")

2121

# Must run before the D-Bus bus name gets deregistered

2122

cleanup()

2123

1727

print >> sys.stderr

1728

logger.debug(u"Server received KeyboardInterrupt")

1729

logger.debug(u"Server exiting")

2124

1730

2125

1731

if __name__ == '__main__':

2126

1732

main()