/mandos/release : revision 237.2.215

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

62

61

import functools

63

62

import cPickle as pickle

64

63

import multiprocessing

65

import types

66

64

67

65

import dbus

68

66

import dbus.service

83

81

SO_BINDTODEVICE = None

84

82

85

83

86

version = "1.3.1"

84

version = "1.2"

87

85

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

90

88

syslogger = (logging.handlers.SysLogHandler

91

89

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

address = str("/dev/log")))

90

address = "/dev/log"))

93

91

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

96

94

logger.addHandler(syslogger)

97

95

98

96

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

102

100

logger.addHandler(console)

103

101

104

102

class AvahiError(Exception):

121

119

Attributes:

122

120

interface: integer; avahi.IF_UNSPEC or an interface index.

123

121

Used to optionally bind to the specified interface.

124

name: string; Example: 'Mandos'

125

type: string; Example: '_mandos._tcp'.

122

name: string; Example: u'Mandos'

123

type: string; Example: u'_mandos._tcp'.

126

124

See <http://www.dns-sd.org/ServiceTypes.html>

127

125

port: integer; what port to announce

128

126

TXT: list of strings; TXT record for the service

137

135

"""

138

136

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

139

137

servicetype = None, port = None, TXT = None,

140

domain = "", host = "", max_renames = 32768,

138

domain = u"", host = u"", max_renames = 32768,

141

139

protocol = avahi.PROTO_UNSPEC, bus = None):

142

140

self.interface = interface

143

141

self.name = name

152

150

self.group = None # our entry group

153

151

self.server = None

154

152

self.bus = bus

155

self.entry_group_state_changed_match = None

156

153

def rename(self):

157

154

"""Derived from the Avahi example code"""

158

155

if self.rename_count >= self.max_renames:

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

161

158

self.rename_count)

162

raise AvahiServiceError("Too many renames")

159

raise AvahiServiceError(u"Too many renames")

163

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

164

logger.info("Changing Zeroconf service name to %r ...",

161

logger.info(u"Changing Zeroconf service name to %r ...",

165

162

self.name)

166

163

syslogger.setFormatter(logging.Formatter

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

169

166

% self.name))

170

167

self.remove()

171

168

try:

172

169

self.add()

173

except dbus.exceptions.DBusException as error:

174

logger.critical("DBusException: %s", error)

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

175

172

self.cleanup()

176

173

os._exit(1)

177

174

self.rename_count += 1

178

175

def remove(self):

179

176

"""Derived from the Avahi example code"""

180

if self.entry_group_state_changed_match is not None:

181

self.entry_group_state_changed_match.remove()

182

self.entry_group_state_changed_match = None

183

177

if self.group is not None:

184

178

self.group.Reset()

185

179

def add(self):

186

180

"""Derived from the Avahi example code"""

187

self.remove()

188

181

if self.group is None:

189

182

self.group = dbus.Interface(

190

183

self.bus.get_object(avahi.DBUS_NAME,

191

184

self.server.EntryGroupNew()),

192

185

avahi.DBUS_INTERFACE_ENTRY_GROUP)

193

self.entry_group_state_changed_match = (

194

self.group.connect_to_signal(

195

'StateChanged', self .entry_group_state_changed))

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

186

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

197

190

self.name, self.type)

198

191

self.group.AddService(

199

192

self.interface,

206

199

self.group.Commit()

207

200

def entry_group_state_changed(self, state, error):

208

201

"""Derived from the Avahi example code"""

209

logger.debug("Avahi entry group state change: %i", state)

202

logger.debug(u"Avahi entry group state change: %i", state)

210

203

211

204

if state == avahi.ENTRY_GROUP_ESTABLISHED:

212

logger.debug("Zeroconf service established.")

205

logger.debug(u"Zeroconf service established.")

213

206

elif state == avahi.ENTRY_GROUP_COLLISION:

214

logger.info("Zeroconf service name collision.")

207

logger.warning(u"Zeroconf service name collision.")

215

208

self.rename()

216

209

elif state == avahi.ENTRY_GROUP_FAILURE:

217

logger.critical("Avahi: Error in group state changed %s",

210

logger.critical(u"Avahi: Error in group state changed %s",

218

211

unicode(error))

219

raise AvahiGroupError("State changed: %s"

212

raise AvahiGroupError(u"State changed: %s"

220

213

% unicode(error))

221

214

def cleanup(self):

222

215

"""Derived from the Avahi example code"""

223

216

if self.group is not None:

224

try:

225

self.group.Free()

226

except (dbus.exceptions.UnknownMethodException,

227

dbus.exceptions.DBusException) as e:

228

pass

217

self.group.Free()

229

218

self.group = None

230

self.remove()

231

def server_state_changed(self, state, error=None):

219

def server_state_changed(self, state):

232

220

"""Derived from the Avahi example code"""

233

logger.debug("Avahi server state change: %i", state)

234

bad_states = { avahi.SERVER_INVALID:

235

"Zeroconf server invalid",

236

avahi.SERVER_REGISTERING: None,

237

avahi.SERVER_COLLISION:

238

"Zeroconf server name collision",

239

avahi.SERVER_FAILURE:

240

"Zeroconf server failure" }

241

if state in bad_states:

242

if bad_states[state] is not None:

243

if error is None:

244

logger.error(bad_states[state])

245

else:

246

logger.error(bad_states[state] + ": %r", error)

247

self.cleanup()

221

logger.debug(u"Avahi server state change: %i", state)

222

if state == avahi.SERVER_COLLISION:

223

logger.error(u"Zeroconf server name collision")

224

self.remove()

248

225

elif state == avahi.SERVER_RUNNING:

249

226

self.add()

250

else:

251

if error is None:

252

logger.debug("Unknown state: %r", state)

253

else:

254

logger.debug("Unknown state: %r: %r", state, error)

255

227

def activate(self):

256

228

"""Derived from the Avahi example code"""

257

229

if self.server is None:

258

230

self.server = dbus.Interface(

259

231

self.bus.get_object(avahi.DBUS_NAME,

260

avahi.DBUS_PATH_SERVER,

261

follow_name_owner_changes=True),

232

avahi.DBUS_PATH_SERVER),

262

233

avahi.DBUS_INTERFACE_SERVER)

263

self.server.connect_to_signal("StateChanged",

234

self.server.connect_to_signal(u"StateChanged",

264

235

self.server_state_changed)

265

236

self.server_state_changed(self.server.GetState())

266

237

267

238

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

274

239

class Client(object):

275

240

"""A representation of a client host served by this server.

276

241

304

269

secret: bytestring; sent verbatim (over TLS) to client

305

270

timeout: datetime.timedelta(); How long from last_checked_ok

306

271

until this client is disabled

307

extended_timeout: extra long timeout when password has been sent

308

272

runtime_expansions: Allowed attributes for runtime expansion.

309

expires: datetime.datetime(); time (UTC) when a client will be

310

disabled, or None

311

273

"""

312

274

313

runtime_expansions = ("approval_delay", "approval_duration",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

316

"last_enabled", "name", "timeout")

275

runtime_expansions = (u"approval_delay", u"approval_duration",

276

u"created", u"enabled", u"fingerprint",

277

u"host", u"interval", u"last_checked_ok",

278

u"last_enabled", u"name", u"timeout")

279

280

@staticmethod

281

def _timedelta_to_milliseconds(td):

282

"Convert a datetime.timedelta() to milliseconds"

283

return ((td.days * 24 * 60 * 60 * 1000)

284

+ (td.seconds * 1000)

285

+ (td.microseconds // 1000))

317

286

318

287

def timeout_milliseconds(self):

319

288

"Return the 'timeout' attribute in milliseconds"

320

return _timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

289

return self._timedelta_to_milliseconds(self.timeout)

325

290

326

291

def interval_milliseconds(self):

327

292

"Return the 'interval' attribute in milliseconds"

328

return _timedelta_to_milliseconds(self.interval)

329

293

return self._timedelta_to_milliseconds(self.interval)

294

330

295

def approval_delay_milliseconds(self):

331

return _timedelta_to_milliseconds(self.approval_delay)

296

return self._timedelta_to_milliseconds(self.approval_delay)

332

297

333

298

def __init__(self, name = None, disable_hook=None, config=None):

334

299

"""Note: the 'checker' key in 'config' sets the

337

302

self.name = name

338

303

if config is None:

339

304

config = {}

340

logger.debug("Creating client %r", self.name)

305

logger.debug(u"Creating client %r", self.name)

341

306

# Uppercase and remove spaces from fingerprint for later

342

307

# comparison purposes with return value from the fingerprint()

343

308

# function

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

309

self.fingerprint = (config[u"fingerprint"].upper()

310

.replace(u" ", u""))

311

logger.debug(u" Fingerprint: %s", self.fingerprint)

312

if u"secret" in config:

313

self.secret = config[u"secret"].decode(u"base64")

314

elif u"secfile" in config:

350

315

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

316

(config[u"secfile"])),

352

317

"rb") as secfile:

353

318

self.secret = secfile.read()

354

319

else:

355

raise TypeError("No secret or secfile for client %s"

320

raise TypeError(u"No secret or secfile for client %s"

356

321

% self.name)

357

self.host = config.get("host", "")

322

self.host = config.get(u"host", u"")

358

323

self.created = datetime.datetime.utcnow()

359

324

self.enabled = False

360

325

self.last_approval_request = None

361

326

self.last_enabled = None

362

327

self.last_checked_ok = None

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

328

self.timeout = string_to_delta(config[u"timeout"])

329

self.interval = string_to_delta(config[u"interval"])

366

330

self.disable_hook = disable_hook

367

331

self.checker = None

368

332

self.checker_initiator_tag = None

369

333

self.disable_initiator_tag = None

370

self.expires = None

371

334

self.checker_callback_tag = None

372

self.checker_command = config["checker"]

335

self.checker_command = config[u"checker"]

373

336

self.current_checker_command = None

374

337

self.last_connect = None

375

338

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

339

self.approved_by_default = config.get(u"approved_by_default",

377

340

True)

378

341

self.approvals_pending = 0

379

342

self.approval_delay = string_to_delta(

380

config["approval_delay"])

343

config[u"approval_delay"])

381

344

self.approval_duration = string_to_delta(

382

config["approval_duration"])

345

config[u"approval_duration"])

383

346

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

384

347

385

348

def send_changedstate(self):

389

352

390

353

def enable(self):

391

354

"""Start this client's checker and timeout hooks"""

392

if getattr(self, "enabled", False):

355

if getattr(self, u"enabled", False):

393

356

# Already enabled

394

357

return

395

358

self.send_changedstate()

359

self.last_enabled = datetime.datetime.utcnow()

396

360

# Schedule a new checker to be started an 'interval' from now,

397

361

# and every interval from then on.

398

362

self.checker_initiator_tag = (gobject.timeout_add

399

363

(self.interval_milliseconds(),

400

364

self.start_checker))

401

365

# Schedule a disable() when 'timeout' has passed

402

self.expires = datetime.datetime.utcnow() + self.timeout

403

366

self.disable_initiator_tag = (gobject.timeout_add

404

367

(self.timeout_milliseconds(),

405

368

self.disable))

406

369

self.enabled = True

407

self.last_enabled = datetime.datetime.utcnow()

408

370

# Also start a new checker *right now*.

409

371

self.start_checker()

410

372

415

377

if not quiet:

416

378

self.send_changedstate()

417

379

if not quiet:

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

380

logger.info(u"Disabling client %s", self.name)

381

if getattr(self, u"disable_initiator_tag", False):

420

382

gobject.source_remove(self.disable_initiator_tag)

421

383

self.disable_initiator_tag = None

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

384

if getattr(self, u"checker_initiator_tag", False):

424

385

gobject.source_remove(self.checker_initiator_tag)

425

386

self.checker_initiator_tag = None

426

387

self.stop_checker()

441

402

if os.WIFEXITED(condition):

442

403

exitstatus = os.WEXITSTATUS(condition)

443

404

if exitstatus == 0:

444

logger.info("Checker for %(name)s succeeded",

405

logger.info(u"Checker for %(name)s succeeded",

445

406

vars(self))

446

407

self.checked_ok()

447

408

else:

448

logger.info("Checker for %(name)s failed",

409

logger.info(u"Checker for %(name)s failed",

449

410

vars(self))

450

411

else:

451

logger.warning("Checker for %(name)s crashed?",

412

logger.warning(u"Checker for %(name)s crashed?",

452

413

vars(self))

453

414

454

def checked_ok(self, timeout=None):

415

def checked_ok(self):

455

416

"""Bump up the timeout for this client.

456

417

457

418

This should only be called when the client has been seen,

458

419

alive and well.

459

420

"""

460

if timeout is None:

461

timeout = self.timeout

462

421

self.last_checked_ok = datetime.datetime.utcnow()

463

422

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

423

self.disable_initiator_tag = (gobject.timeout_add

466

(_timedelta_to_milliseconds(timeout),

424

(self.timeout_milliseconds(),

467

425

self.disable))

468

426

469

427

def need_approval(self):

486

444

# If a checker exists, make sure it is not a zombie

487

445

try:

488

446

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

489

except (AttributeError, OSError) as error:

447

except (AttributeError, OSError), error:

490

448

if (isinstance(error, OSError)

491

449

and error.errno != errno.ECHILD):

492

450

raise error

493

451

else:

494

452

if pid:

495

logger.warning("Checker was a zombie")

453

logger.warning(u"Checker was a zombie")

496

454

gobject.source_remove(self.checker_callback_tag)

497

455

self.checker_callback(pid, status,

498

456

self.current_checker_command)

505

463

# Escape attributes for the shell

506

464

escaped_attrs = dict(

507

465

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

466

re.escape(unicode(str(getattr(self, attr, u"")),

509

467

errors=

510

'replace')))

468

u'replace')))

511

469

for attr in

512

470

self.runtime_expansions)

513

471

514

472

try:

515

473

command = self.checker_command % escaped_attrs

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

474

except TypeError, error:

475

logger.error(u'Could not format string "%s":'

476

u' %s', self.checker_command, error)

519

477

return True # Try again later

520

478

self.current_checker_command = command

521

479

try:

522

logger.info("Starting checker %r for %s",

480

logger.info(u"Starting checker %r for %s",

523

481

command, self.name)

524

482

# We don't need to redirect stdout and stderr, since

525

483

# in normal mode, that is already done by daemon(),

527

485

# always replaced by /dev/null.)

528

486

self.checker = subprocess.Popen(command,

529

487

close_fds=True,

530

shell=True, cwd="/")

488

shell=True, cwd=u"/")

531

489

self.checker_callback_tag = (gobject.child_watch_add

532

490

(self.checker.pid,

533

491

self.checker_callback,

538

496

if pid:

539

497

gobject.source_remove(self.checker_callback_tag)

540

498

self.checker_callback(pid, status, command)

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

499

except OSError, error:

500

logger.error(u"Failed to start subprocess: %s",

543

501

error)

544

502

# Re-run this periodically if run by gobject.timeout_add

545

503

return True

549

507

if self.checker_callback_tag:

550

508

gobject.source_remove(self.checker_callback_tag)

551

509

self.checker_callback_tag = None

552

if getattr(self, "checker", None) is None:

510

if getattr(self, u"checker", None) is None:

553

511

return

554

logger.debug("Stopping checker for %(name)s", vars(self))

512

logger.debug(u"Stopping checker for %(name)s", vars(self))

555

513

try:

556

514

os.kill(self.checker.pid, signal.SIGTERM)

557

515

#time.sleep(0.5)

558

516

#if self.checker.poll() is None:

559

517

# os.kill(self.checker.pid, signal.SIGKILL)

560

except OSError as error:

518

except OSError, error:

561

519

if error.errno != errno.ESRCH: # No such process

562

520

raise

563

521

self.checker = None

564

522

565

566

def dbus_service_property(dbus_interface, signature="v",

567

access="readwrite", byte_arrays=False):

523

def dbus_service_property(dbus_interface, signature=u"v",

524

access=u"readwrite", byte_arrays=False):

568

525

"""Decorators for marking methods of a DBusObjectWithProperties to

569

526

become properties on the D-Bus.

570

527

577

534

"""

578

535

# Encoding deeply encoded byte arrays is not supported yet by the

579

536

# "Set" method, so we fail early here:

580

if byte_arrays and signature != "ay":

581

raise ValueError("Byte arrays not supported for non-'ay'"

582

" signature %r" % signature)

537

if byte_arrays and signature != u"ay":

538

raise ValueError(u"Byte arrays not supported for non-'ay'"

539

u" signature %r" % signature)

583

540

def decorator(func):

584

541

func._dbus_is_property = True

585

542

func._dbus_interface = dbus_interface

586

543

func._dbus_signature = signature

587

544

func._dbus_access = access

588

545

func._dbus_name = func.__name__

589

if func._dbus_name.endswith("_dbus_property"):

546

if func._dbus_name.endswith(u"_dbus_property"):

590

547

func._dbus_name = func._dbus_name[:-14]

591

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

548

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

592

549

return func

593

550

return decorator

594

551

614

571

615

572

class DBusObjectWithProperties(dbus.service.Object):

616

573

"""A D-Bus object with properties.

617

574

618

575

Classes inheriting from this can use the dbus_service_property

619

576

decorator to expose methods as D-Bus properties. It exposes the

620

577

standard Get(), Set(), and GetAll() methods on the D-Bus.

622

579

623

580

@staticmethod

624

581

def _is_dbus_property(obj):

625

return getattr(obj, "_dbus_is_property", False)

582

return getattr(obj, u"_dbus_is_property", False)

626

583

627

584

def _get_all_dbus_properties(self):

628

585

"""Returns a generator of (name, attribute) pairs

631

588

for name, prop in

632

589

inspect.getmembers(self, self._is_dbus_property))

633

590

634

# def _get_dbus_property(self, interface_name, property_name):

635

# """Returns a bound method if one exists which is a D-Bus

636

# property with the specified name and interface.

637

# """

638

# print("get_property({0!r}, {1!r}".format(interface_name, property_name),file=sys.stderr)

639

# print(dir(self), sys.stderr)

640

# for name in (property_name,

641

# property_name + "_dbus_property"):

642

# prop = getattr(self, name, None)

643

# if (prop is None

644

# or not self._is_dbus_property(prop)

645

# or prop._dbus_name != property_name

646

# or (interface_name and prop._dbus_interface

647

# and interface_name != prop._dbus_interface)):

648

# continue

649

# return prop

650

# # No such property

651

# raise DBusPropertyNotFound(self.dbus_object_path + ":"

652

# + interface_name + "."

653

# + property_name)

654

655

591

def _get_dbus_property(self, interface_name, property_name):

656

592

"""Returns a bound method if one exists which is a D-Bus

657

593

property with the specified name and interface.

658

594

"""

659

for name, value in inspect.getmembers(self, self._is_dbus_property):

660

if value._dbus_name == property_name and value._dbus_interface == interface_name:

661

return value

662

595

for name in (property_name,

596

property_name + u"_dbus_property"):

597

prop = getattr(self, name, None)

598

if (prop is None

599

or not self._is_dbus_property(prop)

600

or prop._dbus_name != property_name

601

or (interface_name and prop._dbus_interface

602

and interface_name != prop._dbus_interface)):

603

continue

604

return prop

663

605

# No such property

664

raise DBusPropertyNotFound(self.dbus_object_path + ":"

665

+ interface_name + "."

606

raise DBusPropertyNotFound(self.dbus_object_path + u":"

607

+ interface_name + u"."

666

608

+ property_name)

667

668

609

669

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

670

out_signature="v")

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

611

out_signature=u"v")

671

612

def Get(self, interface_name, property_name):

672

613

"""Standard D-Bus property Get() method, see D-Bus standard.

673

614

"""

674

615

prop = self._get_dbus_property(interface_name, property_name)

675

if prop._dbus_access == "write":

616

if prop._dbus_access == u"write":

676

617

raise DBusPropertyAccessException(property_name)

677

618

value = prop()

678

if not hasattr(value, "variant_level"):

619

if not hasattr(value, u"variant_level"):

679

620

return value

680

621

return type(value)(value, variant_level=value.variant_level+1)

681

622

682

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

623

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

683

624

def Set(self, interface_name, property_name, value):

684

625

"""Standard D-Bus property Set() method, see D-Bus standard.

685

626

"""

686

627

prop = self._get_dbus_property(interface_name, property_name)

687

if prop._dbus_access == "read":

628

if prop._dbus_access == u"read":

688

629

raise DBusPropertyAccessException(property_name)

689

if prop._dbus_get_args_options["byte_arrays"]:

630

if prop._dbus_get_args_options[u"byte_arrays"]:

690

631

# The byte_arrays option is not supported yet on

691

632

# signatures other than "ay".

692

if prop._dbus_signature != "ay":

633

if prop._dbus_signature != u"ay":

693

634

raise ValueError

694

635

value = dbus.ByteArray(''.join(unichr(byte)

695

636

for byte in value))

696

637

prop(value)

697

638

698

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

699

out_signature="a{sv}")

639

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

640

out_signature=u"a{sv}")

700

641

def GetAll(self, interface_name):

701

642

"""Standard D-Bus property GetAll() method, see D-Bus

702

643

standard.

703

644

704

645

Note: Will not include properties with access="write".

705

646

"""

706

647

all = {}

710

651

# Interface non-empty but did not match

711

652

continue

712

653

# Ignore write-only properties

713

if prop._dbus_access == "write":

654

if prop._dbus_access == u"write":

714

655

continue

715

656

value = prop()

716

if not hasattr(value, "variant_level"):

657

if not hasattr(value, u"variant_level"):

717

658

all[name] = value

718

659

continue

719

660

all[name] = type(value)(value, variant_level=

720

661

value.variant_level+1)

721

return dbus.Dictionary(all, signature="sv")

662

return dbus.Dictionary(all, signature=u"sv")

722

663

723

664

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

724

out_signature="s",

665

out_signature=u"s",

725

666

path_keyword='object_path',

726

667

connection_keyword='connection')

727

668

def Introspect(self, object_path, connection):

732

673

try:

733

674

document = xml.dom.minidom.parseString(xmlstring)

734

675

def make_tag(document, name, prop):

735

e = document.createElement("property")

736

e.setAttribute("name", name)

737

e.setAttribute("type", prop._dbus_signature)

738

e.setAttribute("access", prop._dbus_access)

676

e = document.createElement(u"property")

677

e.setAttribute(u"name", name)

678

e.setAttribute(u"type", prop._dbus_signature)

679

e.setAttribute(u"access", prop._dbus_access)

739

680

return e

740

for if_tag in document.getElementsByTagName("interface"):

681

for if_tag in document.getElementsByTagName(u"interface"):

741

682

for tag in (make_tag(document, name, prop)

742

683

for name, prop

743

684

in self._get_all_dbus_properties()

744

685

if prop._dbus_interface

745

== if_tag.getAttribute("name")):

686

== if_tag.getAttribute(u"name")):

746

687

if_tag.appendChild(tag)

747

688

# Add the names to the return values for the

748

689

# "org.freedesktop.DBus.Properties" methods

749

if (if_tag.getAttribute("name")

750

== "org.freedesktop.DBus.Properties"):

751

for cn in if_tag.getElementsByTagName("method"):

752

if cn.getAttribute("name") == "Get":

753

for arg in cn.getElementsByTagName("arg"):

754

if (arg.getAttribute("direction")

755

== "out"):

756

arg.setAttribute("name", "value")

757

elif cn.getAttribute("name") == "GetAll":

758

for arg in cn.getElementsByTagName("arg"):

759

if (arg.getAttribute("direction")

760

== "out"):

761

arg.setAttribute("name", "props")

762

xmlstring = document.toxml("utf-8")

690

if (if_tag.getAttribute(u"name")

691

== u"org.freedesktop.DBus.Properties"):

692

for cn in if_tag.getElementsByTagName(u"method"):

693

if cn.getAttribute(u"name") == u"Get":

694

for arg in cn.getElementsByTagName(u"arg"):

695

if (arg.getAttribute(u"direction")

696

== u"out"):

697

arg.setAttribute(u"name", u"value")

698

elif cn.getAttribute(u"name") == u"GetAll":

699

for arg in cn.getElementsByTagName(u"arg"):

700

if (arg.getAttribute(u"direction")

701

== u"out"):

702

arg.setAttribute(u"name", u"props")

703

xmlstring = document.toxml(u"utf-8")

763

704

document.unlink()

764

705

except (AttributeError, xml.dom.DOMException,

765

xml.parsers.expat.ExpatError) as error:

766

logger.error("Failed to override Introspection method",

706

xml.parsers.expat.ExpatError), error:

707

logger.error(u"Failed to override Introspection method",

767

708

error)

768

709

return xmlstring

769

710

770

711

771

def datetime_to_dbus (dt, variant_level=0):

772

"""Convert a UTC datetime.datetime() to a D-Bus type."""

773

if dt is None:

774

return dbus.String("", variant_level = variant_level)

775

return dbus.String(dt.isoformat(),

776

variant_level=variant_level)

777

778

class transitional_clientdbus(DBusObjectWithProperties.__metaclass__):

779

def __new__(mcs, name, bases, attr):

780

for key, old_dbusobj in attr.items():

781

new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")

782

if getattr(old_dbusobj, "_dbus_is_signal", False):

783

unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,

784

old_dbusobj.__closure__))["func"].cell_contents

785

newfunc = types.FunctionType(unwrappedfunc.func_code,

786

unwrappedfunc.func_globals,

787

unwrappedfunc.func_name,

788

unwrappedfunc.func_defaults,

789

unwrappedfunc.func_closure)

790

new_dbusfunc = dbus.service.signal(

791

new_interface, old_dbusobj._dbus_signature)(newfunc)

792

attr["_transitional_{0}_1".format(key)] = new_dbusfunc

793

attr["_transitional_{0}_0".format(key)] = old_dbusobj

794

def fixscope(func1, func2):

795

def newcall(*args, **kwargs):

796

func1(*args, **kwargs)

797

func2(*args, **kwargs)

798

return newcall

799

800

attr[key] = fixscope(

801

old_dbusobj, attr["_transitional_{0}_1".format(key)])

802

803

if getattr(old_dbusobj, "_dbus_is_method", False):

804

new_dbusfunc = (dbus.service.method

805

(new_interface,

806

old_dbusobj._dbus_in_signature,

807

old_dbusobj._dbus_out_signature)

808

(types.FunctionType

809

(old_dbusobj.func_code,

810

old_dbusobj.func_globals,

811

old_dbusobj.func_name,

812

old_dbusobj.func_defaults,

813

old_dbusobj.func_closure)))

814

815

attr["_transitional_{0}".format(key)] = new_dbusfunc

816

if getattr(old_dbusobj, "_dbus_is_property", False):

817

new_dbusfunc = (dbus_service_property

818

(new_interface,

819

old_dbusobj._dbus_signature,

820

old_dbusobj._dbus_access,

821

old_dbusobj._dbus_get_args_options["byte_arrays"])

822

(types.FunctionType

823

(old_dbusobj.func_code,

824

old_dbusobj.func_globals,

825

old_dbusobj.func_name,

826

old_dbusobj.func_defaults,

827

old_dbusobj.func_closure)))

828

829

attr["_transitional_{0}".format(key)] = new_dbusfunc

830

return type.__new__(mcs, name, bases, attr)

831

832

712

class ClientDBus(Client, DBusObjectWithProperties):

833

713

"""A Client class using D-Bus

834

714

838

718

"""

839

719

840

720

runtime_expansions = (Client.runtime_expansions

841

+ ("dbus_object_path",))

842

843

__metaclass__ = transitional_clientdbus

721

+ (u"dbus_object_path",))

844

722

845

723

# dbus.service.Object doesn't use super(), so we can't either.

846

724

851

729

# Only now, when this client is initialized, can it show up on

852

730

# the D-Bus

853

731

client_object_name = unicode(self.name).translate(

854

{ord("."): ord("_"),

855

ord("-"): ord("_")})

732

{ord(u"."): ord(u"_"),

733

ord(u"-"): ord(u"_")})

856

734

self.dbus_object_path = (dbus.ObjectPath

857

("/clients/" + client_object_name))

735

(u"/clients/" + client_object_name))

858

736

DBusObjectWithProperties.__init__(self, self.bus,

859

737

self.dbus_object_path)

860

738

861

def notifychangeproperty(transform_func,

862

dbus_name, type_func=lambda x: x,

863

variant_level=1):

864

""" Modify a variable so that its a property that announce its

865

changes to DBus.

866

transform_fun: Function that takes a value and transform it to

867

DBus type.

868

dbus_name: DBus name of the variable

869

type_func: Function that transform the value before sending it

870

to DBus

871

variant_level: DBus variant level. default: 1

872

"""

873

real_value = [None,]

874

def setter(self, value):

875

old_value = real_value[0]

876

real_value[0] = value

877

if hasattr(self, "dbus_object_path"):

878

if type_func(old_value) != type_func(real_value[0]):

879

dbus_value = transform_func(type_func(real_value[0]),

880

variant_level)

881

self.PropertyChanged(dbus.String(dbus_name),

882

dbus_value)

883

884

return property(lambda self: real_value[0], setter)

885

886

887

expires = notifychangeproperty(datetime_to_dbus, "Expires")

888

approvals_pending = notifychangeproperty(dbus.Boolean,

889

"ApprovalPending",

890

type_func = bool)

891

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

892

last_enabled = notifychangeproperty(datetime_to_dbus,

893

"LastEnabled")

894

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

895

type_func = lambda checker: checker is not None)

896

last_checked_ok = notifychangeproperty(datetime_to_dbus,

897

"LastCheckedOK")

898

last_approval_request = notifychangeproperty(datetime_to_dbus,

899

"LastApprovalRequest")

900

approved_by_default = notifychangeproperty(dbus.Boolean,

901

"ApprovedByDefault")

902

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

903

type_func = _timedelta_to_milliseconds)

904

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

905

type_func = _timedelta_to_milliseconds)

906

host = notifychangeproperty(dbus.String, "Host")

907

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

908

type_func = _timedelta_to_milliseconds)

909

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

910

type_func = _timedelta_to_milliseconds)

911

interval = notifychangeproperty(dbus.UInt16, "Interval",

912

type_func = _timedelta_to_milliseconds)

913

checker_command = notifychangeproperty(dbus.String, "Checker")

914

915

del notifychangeproperty

739

def _get_approvals_pending(self):

740

return self._approvals_pending

741

def _set_approvals_pending(self, value):

742

old_value = self._approvals_pending

743

self._approvals_pending = value

744

bval = bool(value)

745

if (hasattr(self, "dbus_object_path")

746

and bval is not bool(old_value)):

747

dbus_bool = dbus.Boolean(bval, variant_level=1)

748

self.PropertyChanged(dbus.String(u"ApprovalPending"),

749

dbus_bool)

750

751

approvals_pending = property(_get_approvals_pending,

752

_set_approvals_pending)

753

del _get_approvals_pending, _set_approvals_pending

754

755

@staticmethod

756

def _datetime_to_dbus(dt, variant_level=0):

757

"""Convert a UTC datetime.datetime() to a D-Bus type."""

758

return dbus.String(dt.isoformat(),

759

variant_level=variant_level)

760

761

def enable(self):

762

oldstate = getattr(self, u"enabled", False)

763

r = Client.enable(self)

764

if oldstate != self.enabled:

765

# Emit D-Bus signals

766

self.PropertyChanged(dbus.String(u"Enabled"),

767

dbus.Boolean(True, variant_level=1))

768

self.PropertyChanged(

769

dbus.String(u"LastEnabled"),

770

self._datetime_to_dbus(self.last_enabled,

771

variant_level=1))

772

return r

773

774

def disable(self, quiet = False):

775

oldstate = getattr(self, u"enabled", False)

776

r = Client.disable(self, quiet=quiet)

777

if not quiet and oldstate != self.enabled:

778

# Emit D-Bus signal

779

self.PropertyChanged(dbus.String(u"Enabled"),

780

dbus.Boolean(False, variant_level=1))

781

return r

916

782

917

783

def __del__(self, *args, **kwargs):

918

784

try:

919

785

self.remove_from_connection()

920

786

except LookupError:

921

787

pass

922

if hasattr(DBusObjectWithProperties, "__del__"):

788

if hasattr(DBusObjectWithProperties, u"__del__"):

923

789

DBusObjectWithProperties.__del__(self, *args, **kwargs)

924

790

Client.__del__(self, *args, **kwargs)

925

791

927

793

*args, **kwargs):

928

794

self.checker_callback_tag = None

929

795

self.checker = None

796

# Emit D-Bus signal

797

self.PropertyChanged(dbus.String(u"CheckerRunning"),

798

dbus.Boolean(False, variant_level=1))

930

799

if os.WIFEXITED(condition):

931

800

exitstatus = os.WEXITSTATUS(condition)

932

801

# Emit D-Bus signal

942

811

return Client.checker_callback(self, pid, condition, command,

943

812

*args, **kwargs)

944

813

814

def checked_ok(self, *args, **kwargs):

815

r = Client.checked_ok(self, *args, **kwargs)

816

# Emit D-Bus signal

817

self.PropertyChanged(

818

dbus.String(u"LastCheckedOK"),

819

(self._datetime_to_dbus(self.last_checked_ok,

820

variant_level=1)))

821

return r

822

823

def need_approval(self, *args, **kwargs):

824

r = Client.need_approval(self, *args, **kwargs)

825

# Emit D-Bus signal

826

self.PropertyChanged(

827

dbus.String(u"LastApprovalRequest"),

828

(self._datetime_to_dbus(self.last_approval_request,

829

variant_level=1)))

830

return r

831

945

832

def start_checker(self, *args, **kwargs):

946

833

old_checker = self.checker

947

834

if self.checker is not None:

954

841

and old_checker_pid != self.checker.pid):

955

842

# Emit D-Bus signal

956

843

self.CheckerStarted(self.current_checker_command)

844

self.PropertyChanged(

845

dbus.String(u"CheckerRunning"),

846

dbus.Boolean(True, variant_level=1))

957

847

return r

958

848

849

def stop_checker(self, *args, **kwargs):

850

old_checker = getattr(self, u"checker", None)

851

r = Client.stop_checker(self, *args, **kwargs)

852

if (old_checker is not None

853

and getattr(self, u"checker", None) is None):

854

self.PropertyChanged(dbus.String(u"CheckerRunning"),

855

dbus.Boolean(False, variant_level=1))

856

return r

857

959

858

def _reset_approved(self):

960

859

self._approved = None

961

860

return False

963

862

def approve(self, value=True):

964

863

self.send_changedstate()

965

864

self._approved = value

966

gobject.timeout_add(_timedelta_to_milliseconds

865

gobject.timeout_add(self._timedelta_to_milliseconds

967

866

(self.approval_duration),

968

867

self._reset_approved)

969

868

970

869

971

870

## D-Bus methods, signals & properties

972

_interface = "se.bsnet.fukt.Mandos.Client"

973

871

_interface = u"se.bsnet.fukt.Mandos.Client"

872

974

873

## Signals

975

874

976

875

# CheckerCompleted - signal

977

@dbus.service.signal(_interface, signature="nxs")

876

@dbus.service.signal(_interface, signature=u"nxs")

978

877

def CheckerCompleted(self, exitcode, waitstatus, command):

979

878

"D-Bus signal"

980

879

pass

981

880

982

881

# CheckerStarted - signal

983

@dbus.service.signal(_interface, signature="s")

882

@dbus.service.signal(_interface, signature=u"s")

984

883

def CheckerStarted(self, command):

985

884

"D-Bus signal"

986

885

pass

987

886

988

887

# PropertyChanged - signal

989

@dbus.service.signal(_interface, signature="sv")

888

@dbus.service.signal(_interface, signature=u"sv")

990

889

def PropertyChanged(self, property, value):

991

890

"D-Bus signal"

992

891

pass

1001

900

pass

1002

901

1003

902

# Rejected - signal

1004

@dbus.service.signal(_interface, signature="s")

903

@dbus.service.signal(_interface, signature=u"s")

1005

904

def Rejected(self, reason):

1006

905

"D-Bus signal"

1007

906

pass

1008

907

1009

908

# NeedApproval - signal

1010

@dbus.service.signal(_interface, signature="tb")

909

@dbus.service.signal(_interface, signature=u"tb")

1011

910

def NeedApproval(self, timeout, default):

1012

911

"D-Bus signal"

1013

912

return self.need_approval()

1015

914

## Methods

1016

915

1017

916

# Approve - method

1018

@dbus.service.method(_interface, in_signature="b")

917

@dbus.service.method(_interface, in_signature=u"b")

1019

918

def Approve(self, value):

1020

919

self.approve(value)

1021

920

1022

921

# CheckedOK - method

1023

922

@dbus.service.method(_interface)

1024

923

def CheckedOK(self):

1025

self.checked_ok()

924

return self.checked_ok()

1026

925

1027

926

# Enable - method

1028

927

@dbus.service.method(_interface)

1050

949

## Properties

1051

950

1052

951

# ApprovalPending - property

1053

@dbus_service_property(_interface, signature="b", access="read")

952

@dbus_service_property(_interface, signature=u"b", access=u"read")

1054

953

def ApprovalPending_dbus_property(self):

1055

954

return dbus.Boolean(bool(self.approvals_pending))

1056

955

1057

956

# ApprovedByDefault - property

1058

@dbus_service_property(_interface, signature="b",

1059

access="readwrite")

957

@dbus_service_property(_interface, signature=u"b",

958

access=u"readwrite")

1060

959

def ApprovedByDefault_dbus_property(self, value=None):

1061

960

if value is None: # get

1062

961

return dbus.Boolean(self.approved_by_default)

1063

962

self.approved_by_default = bool(value)

963

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

965

dbus.Boolean(value, variant_level=1))

1064

966

1065

967

# ApprovalDelay - property

1066

@dbus_service_property(_interface, signature="t",

1067

access="readwrite")

968

@dbus_service_property(_interface, signature=u"t",

969

access=u"readwrite")

1068

970

def ApprovalDelay_dbus_property(self, value=None):

1069

971

if value is None: # get

1070

972

return dbus.UInt64(self.approval_delay_milliseconds())

1071

973

self.approval_delay = datetime.timedelta(0, 0, 0, value)

974

# Emit D-Bus signal

975

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

976

dbus.UInt64(value, variant_level=1))

1072

977

1073

978

# ApprovalDuration - property

1074

@dbus_service_property(_interface, signature="t",

1075

access="readwrite")

979

@dbus_service_property(_interface, signature=u"t",

980

access=u"readwrite")

1076

981

def ApprovalDuration_dbus_property(self, value=None):

1077

982

if value is None: # get

1078

return dbus.UInt64(_timedelta_to_milliseconds(

983

return dbus.UInt64(self._timedelta_to_milliseconds(

1079

984

self.approval_duration))

1080

985

self.approval_duration = datetime.timedelta(0, 0, 0, value)

986

# Emit D-Bus signal

987

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

988

dbus.UInt64(value, variant_level=1))

1081

989

1082

990

# Name - property

1083

@dbus_service_property(_interface, signature="s", access="read")

991

@dbus_service_property(_interface, signature=u"s", access=u"read")

1084

992

def Name_dbus_property(self):

1085

993

return dbus.String(self.name)

1086

994

1087

995

# Fingerprint - property

1088

@dbus_service_property(_interface, signature="s", access="read")

996

@dbus_service_property(_interface, signature=u"s", access=u"read")

1089

997

def Fingerprint_dbus_property(self):

1090

998

return dbus.String(self.fingerprint)

1091

999

1092

1000

# Host - property

1093

@dbus_service_property(_interface, signature="s",

1094

access="readwrite")

1001

@dbus_service_property(_interface, signature=u"s",

1002

access=u"readwrite")

1095

1003

def Host_dbus_property(self, value=None):

1096

1004

if value is None: # get

1097

1005

return dbus.String(self.host)

1098

1006

self.host = value

1007

# Emit D-Bus signal

1008

self.PropertyChanged(dbus.String(u"Host"),

1009

dbus.String(value, variant_level=1))

1099

1010

1100

1011

# Created - property

1101

@dbus_service_property(_interface, signature="s", access="read")

1012

@dbus_service_property(_interface, signature=u"s", access=u"read")

1102

1013

def Created_dbus_property(self):

1103

return dbus.String(datetime_to_dbus(self.created))

1014

return dbus.String(self._datetime_to_dbus(self.created))

1104

1015

1105

1016

# LastEnabled - property

1106

@dbus_service_property(_interface, signature="s", access="read")

1017

@dbus_service_property(_interface, signature=u"s", access=u"read")

1107

1018

def LastEnabled_dbus_property(self):

1108

return datetime_to_dbus(self.last_enabled)

1019

if self.last_enabled is None:

1020

return dbus.String(u"")

1021

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1109

1022

1110

1023

# Enabled - property

1111

@dbus_service_property(_interface, signature="b",

1112

access="readwrite")

1024

@dbus_service_property(_interface, signature=u"b",

1025

access=u"readwrite")

1113

1026

def Enabled_dbus_property(self, value=None):

1114

1027

if value is None: # get

1115

1028

return dbus.Boolean(self.enabled)

1119

1032

self.disable()

1120

1033

1121

1034

# LastCheckedOK - property

1122

@dbus_service_property(_interface, signature="s",

1123

access="readwrite")

1035

@dbus_service_property(_interface, signature=u"s",

1036

access=u"readwrite")

1124

1037

def LastCheckedOK_dbus_property(self, value=None):

1125

1038

if value is not None:

1126

1039

self.checked_ok()

1127

1040

return

1128

return datetime_to_dbus(self.last_checked_ok)

1129

1130

# Expires - property

1131

@dbus_service_property(_interface, signature="s", access="read")

1132

def Expires_dbus_property(self):

1133

return datetime_to_dbus(self.expires)

1041

if self.last_checked_ok is None:

1042

return dbus.String(u"")

1043

return dbus.String(self._datetime_to_dbus(self

1044

.last_checked_ok))

1134

1045

1135

1046

# LastApprovalRequest - property

1136

@dbus_service_property(_interface, signature="s", access="read")

1047

@dbus_service_property(_interface, signature=u"s", access=u"read")

1137

1048

def LastApprovalRequest_dbus_property(self):

1138

return datetime_to_dbus(self.last_approval_request)

1049

if self.last_approval_request is None:

1050

return dbus.String(u"")

1051

return dbus.String(self.

1052

_datetime_to_dbus(self

1053

.last_approval_request))

1139

1054

1140

1055

# Timeout - property

1141

@dbus_service_property(_interface, signature="t",

1142

access="readwrite")

1056

@dbus_service_property(_interface, signature=u"t",

1057

access=u"readwrite")

1143

1058

def Timeout_dbus_property(self, value=None):

1144

1059

if value is None: # get

1145

1060

return dbus.UInt64(self.timeout_milliseconds())

1146

1061

self.timeout = datetime.timedelta(0, 0, 0, value)

1147

if getattr(self, "disable_initiator_tag", None) is None:

1062

# Emit D-Bus signal

1063

self.PropertyChanged(dbus.String(u"Timeout"),

1064

dbus.UInt64(value, variant_level=1))

1065

if getattr(self, u"disable_initiator_tag", None) is None:

1148

1066

return

1149

1067

# Reschedule timeout

1150

1068

gobject.source_remove(self.disable_initiator_tag)

1151

1069

self.disable_initiator_tag = None

1152

self.expires = None

1153

1070

time_to_die = (self.

1154

1071

_timedelta_to_milliseconds((self

1155

1072

.last_checked_ok

1160

1077

# The timeout has passed

1161

1078

self.disable()

1162

1079

else:

1163

self.expires = (datetime.datetime.utcnow()

1164

+ datetime.timedelta(milliseconds = time_to_die))

1165

1080

self.disable_initiator_tag = (gobject.timeout_add

1166

1081

(time_to_die, self.disable))

1167

1082

1168

# ExtendedTimeout - property

1169

@dbus_service_property(_interface, signature="t",

1170

access="readwrite")

1171

def ExtendedTimeout_dbus_property(self, value=None):

1172

if value is None: # get

1173

return dbus.UInt64(self.extended_timeout_milliseconds())

1174

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1175

1176

1083

# Interval - property

1177

@dbus_service_property(_interface, signature="t",

1178

access="readwrite")

1084

@dbus_service_property(_interface, signature=u"t",

1085

access=u"readwrite")

1179

1086

def Interval_dbus_property(self, value=None):

1180

1087

if value is None: # get

1181

1088

return dbus.UInt64(self.interval_milliseconds())

1182

1089

self.interval = datetime.timedelta(0, 0, 0, value)

1183

if getattr(self, "checker_initiator_tag", None) is None:

1090

# Emit D-Bus signal

1091

self.PropertyChanged(dbus.String(u"Interval"),

1092

dbus.UInt64(value, variant_level=1))

1093

if getattr(self, u"checker_initiator_tag", None) is None:

1184

1094

return

1185

1095

# Reschedule checker run

1186

1096

gobject.source_remove(self.checker_initiator_tag)

1187

1097

self.checker_initiator_tag = (gobject.timeout_add

1188

1098

(value, self.start_checker))

1189

1099

self.start_checker() # Start one now, too

1190

1100

1191

1101

# Checker - property

1192

@dbus_service_property(_interface, signature="s",

1193

access="readwrite")

1102

@dbus_service_property(_interface, signature=u"s",

1103

access=u"readwrite")

1194

1104

def Checker_dbus_property(self, value=None):

1195

1105

if value is None: # get

1196

1106

return dbus.String(self.checker_command)

1197

1107

self.checker_command = value

1108

# Emit D-Bus signal

1109

self.PropertyChanged(dbus.String(u"Checker"),

1110

dbus.String(self.checker_command,

1111

variant_level=1))

1198

1112

1199

1113

# CheckerRunning - property

1200

@dbus_service_property(_interface, signature="b",

1201

access="readwrite")

1114

@dbus_service_property(_interface, signature=u"b",

1115

access=u"readwrite")

1202

1116

def CheckerRunning_dbus_property(self, value=None):

1203

1117

if value is None: # get

1204

1118

return dbus.Boolean(self.checker is not None)

1208

1122

self.stop_checker()

1209

1123

1210

1124

# ObjectPath - property

1211

@dbus_service_property(_interface, signature="o", access="read")

1125

@dbus_service_property(_interface, signature=u"o", access=u"read")

1212

1126

def ObjectPath_dbus_property(self):

1213

1127

return self.dbus_object_path # is already a dbus.ObjectPath

1214

1128

1215

1129

# Secret = property

1216

@dbus_service_property(_interface, signature="ay",

1217

access="write", byte_arrays=True)

1130

@dbus_service_property(_interface, signature=u"ay",

1131

access=u"write", byte_arrays=True)

1218

1132

def Secret_dbus_property(self, value):

1219

1133

self.secret = str(value)

1220

1134

1227

1141

self._pipe.send(('init', fpr, address))

1228

1142

if not self._pipe.recv():

1229

1143

raise KeyError()

1230

1144

1231

1145

def __getattribute__(self, name):

1232

1146

if(name == '_pipe'):

1233

1147

return super(ProxyClient, self).__getattribute__(name)

1240

1154

self._pipe.send(('funcall', name, args, kwargs))

1241

1155

return self._pipe.recv()[1]

1242

1156

return func

1243

1157

1244

1158

def __setattr__(self, name, value):

1245

1159

if(name == '_pipe'):

1246

1160

return super(ProxyClient, self).__setattr__(name, value)

1255

1169

1256

1170

def handle(self):

1257

1171

with contextlib.closing(self.server.child_pipe) as child_pipe:

1258

logger.info("TCP connection from: %s",

1172

logger.info(u"TCP connection from: %s",

1259

1173

unicode(self.client_address))

1260

logger.debug("Pipe FD: %d",

1174

logger.debug(u"Pipe FD: %d",

1261

1175

self.server.child_pipe.fileno())

1262

1176

1263

1177

session = (gnutls.connection

1264

1178

.ClientSession(self.request,

1265

1179

gnutls.connection

1266

1180

.X509Credentials()))

1267

1181

1268

1182

# Note: gnutls.connection.X509Credentials is really a

1269

1183

# generic GnuTLS certificate credentials object so long as

1270

1184

# no X.509 keys are added to it. Therefore, we can use it

1271

1185

# here despite using OpenPGP certificates.

1272

1273

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1274

# "+AES-256-CBC", "+SHA1",

1275

# "+COMP-NULL", "+CTYPE-OPENPGP",

1276

# "+DHE-DSS"))

1186

1187

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1188

# u"+AES-256-CBC", u"+SHA1",

1189

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1190

# u"+DHE-DSS"))

1277

1191

# Use a fallback default, since this MUST be set.

1278

1192

priority = self.server.gnutls_priority

1279

1193

if priority is None:

1280

priority = "NORMAL"

1194

priority = u"NORMAL"

1281

1195

(gnutls.library.functions

1282

1196

.gnutls_priority_set_direct(session._c_object,

1283

1197

priority, None))

1284

1198

1285

1199

# Start communication using the Mandos protocol

1286

1200

# Get protocol number

1287

1201

line = self.request.makefile().readline()

1288

logger.debug("Protocol version: %r", line)

1202

logger.debug(u"Protocol version: %r", line)

1289

1203

try:

1290

1204

if int(line.strip().split()[0]) > 1:

1291

1205

raise RuntimeError

1292

except (ValueError, IndexError, RuntimeError) as error:

1293

logger.error("Unknown protocol version: %s", error)

1206

except (ValueError, IndexError, RuntimeError), error:

1207

logger.error(u"Unknown protocol version: %s", error)

1294

1208

return

1295

1209

1296

1210

# Start GnuTLS connection

1297

1211

try:

1298

1212

session.handshake()

1299

except gnutls.errors.GNUTLSError as error:

1300

logger.warning("Handshake failed: %s", error)

1213

except gnutls.errors.GNUTLSError, error:

1214

logger.warning(u"Handshake failed: %s", error)

1301

1215

# Do not run session.bye() here: the session is not

1302

1216

# established. Just abandon the request.

1303

1217

return

1304

logger.debug("Handshake succeeded")

1305

1218

logger.debug(u"Handshake succeeded")

1219

1306

1220

approval_required = False

1307

1221

try:

1308

1222

try:

1309

1223

fpr = self.fingerprint(self.peer_certificate

1310

1224

(session))

1311

except (TypeError,

1312

gnutls.errors.GNUTLSError) as error:

1313

logger.warning("Bad certificate: %s", error)

1225

except (TypeError, gnutls.errors.GNUTLSError), error:

1226

logger.warning(u"Bad certificate: %s", error)

1314

1227

return

1315

logger.debug("Fingerprint: %s", fpr)

1316

1228

logger.debug(u"Fingerprint: %s", fpr)

1229

1317

1230

try:

1318

1231

client = ProxyClient(child_pipe, fpr,

1319

1232

self.client_address)

1327

1240

1328

1241

while True:

1329

1242

if not client.enabled:

1330

logger.info("Client %s is disabled",

1243

logger.warning(u"Client %s is disabled",

1331

1244

client.name)

1332

1245

if self.server.use_dbus:

1333

1246

# Emit D-Bus signal

1338

1251

#We are approved or approval is disabled

1339

1252

break

1340

1253

elif client._approved is None:

1341

logger.info("Client %s needs approval",

1254

logger.info(u"Client %s needs approval",

1342

1255

client.name)

1343

1256

if self.server.use_dbus:

1344

1257

# Emit D-Bus signal

1346

1259

client.approval_delay_milliseconds(),

1347

1260

client.approved_by_default)

1348

1261

else:

1349

logger.warning("Client %s was not approved",

1262

logger.warning(u"Client %s was not approved",

1350

1263

client.name)

1351

1264

if self.server.use_dbus:

1352

1265

# Emit D-Bus signal

1378

1291

while sent_size < len(client.secret):

1379

1292

try:

1380

1293

sent = session.send(client.secret[sent_size:])

1381

except gnutls.errors.GNUTLSError as error:

1294

except (gnutls.errors.GNUTLSError), error:

1382

1295

logger.warning("gnutls send failed")

1383

1296

return

1384

logger.debug("Sent: %d, remaining: %d",

1297

logger.debug(u"Sent: %d, remaining: %d",

1385

1298

sent, len(client.secret)

1386

1299

- (sent_size + sent))

1387

1300

sent_size += sent

1388

1389

logger.info("Sending secret to %s", client.name)

1301

1302

logger.info(u"Sending secret to %s", client.name)

1390

1303

# bump the timeout as if seen

1391

client.checked_ok(client.extended_timeout)

1304

client.checked_ok()

1392

1305

if self.server.use_dbus:

1393

1306

# Emit D-Bus signal

1394

1307

client.GotSecret()

1398

1311

client.approvals_pending -= 1

1399

1312

try:

1400

1313

session.bye()

1401

except gnutls.errors.GNUTLSError as error:

1314

except (gnutls.errors.GNUTLSError), error:

1402

1315

logger.warning("GnuTLS bye failed")

1403

1316

1404

1317

@staticmethod

1415

1328

.gnutls_certificate_get_peers

1416

1329

(session._c_object, ctypes.byref(list_size)))

1417

1330

if not bool(cert_list) and list_size.value != 0:

1418

raise gnutls.errors.GNUTLSError("error getting peer"

1419

" certificate")

1331

raise gnutls.errors.GNUTLSError(u"error getting peer"

1332

u" certificate")

1420

1333

if list_size.value == 0:

1421

1334

return None

1422

1335

cert = cert_list[0]

1448

1361

if crtverify.value != 0:

1449

1362

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1450

1363

raise (gnutls.errors.CertificateSecurityError

1451

("Verify failed"))

1364

(u"Verify failed"))

1452

1365

# New buffer for the fingerprint

1453

1366

buf = ctypes.create_string_buffer(20)

1454

1367

buf_len = ctypes.c_size_t()

1461

1374

# Convert the buffer to a Python bytestring

1462

1375

fpr = ctypes.string_at(buf, buf_len.value)

1463

1376

# Convert the bytestring to hexadecimal notation

1464

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1377

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1465

1378

return hex_fpr

1466

1379

1467

1380

1479

1392

multiprocessing.Process(target = self.sub_process_main,

1480

1393

args = (request, address)).start()

1481

1394

1482

1483

1395

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1484

1396

""" adds a pipe to the MixIn """

1485

1397

def process_request(self, request, client_address):

1488

1400

This function creates a new pipe in self.pipe

1489

1401

"""

1490

1402

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1491

1403

1492

1404

super(MultiprocessingMixInWithPipe,

1493

1405

self).process_request(request, client_address)

1494

1406

self.child_pipe.close()

1495

1407

self.add_pipe(parent_pipe)

1496

1408

1497

1409

def add_pipe(self, parent_pipe):

1498

1410

"""Dummy function; override as necessary"""

1499

raise NotImplementedError

1500

1411

pass

1501

1412

1502

1413

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1503

1414

socketserver.TCPServer, object):

1521

1432

bind to an address or port if they were not specified."""

1522

1433

if self.interface is not None:

1523

1434

if SO_BINDTODEVICE is None:

1524

logger.error("SO_BINDTODEVICE does not exist;"

1525

" cannot bind to interface %s",

1435

logger.error(u"SO_BINDTODEVICE does not exist;"

1436

u" cannot bind to interface %s",

1526

1437

self.interface)

1527

1438

else:

1528

1439

try:

1529

1440

self.socket.setsockopt(socket.SOL_SOCKET,

1530

1441

SO_BINDTODEVICE,

1531

1442

str(self.interface

1532

+ '\0'))

1533

except socket.error as error:

1443

+ u'\0'))

1444

except socket.error, error:

1534

1445

if error[0] == errno.EPERM:

1535

logger.error("No permission to"

1536

" bind to interface %s",

1446

logger.error(u"No permission to"

1447

u" bind to interface %s",

1537

1448

self.interface)

1538

1449

elif error[0] == errno.ENOPROTOOPT:

1539

logger.error("SO_BINDTODEVICE not available;"

1540

" cannot bind to interface %s",

1450

logger.error(u"SO_BINDTODEVICE not available;"

1451

u" cannot bind to interface %s",

1541

1452

self.interface)

1542

1453

else:

1543

1454

raise

1545

1456

if self.server_address[0] or self.server_address[1]:

1546

1457

if not self.server_address[0]:

1547

1458

if self.address_family == socket.AF_INET6:

1548

any_address = "::" # in6addr_any

1459

any_address = u"::" # in6addr_any

1549

1460

else:

1550

1461

any_address = socket.INADDR_ANY

1551

1462

self.server_address = (any_address,

1600

1511

def handle_ipc(self, source, condition, parent_pipe=None,

1601

1512

client_object=None):

1602

1513

condition_names = {

1603

gobject.IO_IN: "IN", # There is data to read.

1604

gobject.IO_OUT: "OUT", # Data can be written (without

1514

gobject.IO_IN: u"IN", # There is data to read.

1515

gobject.IO_OUT: u"OUT", # Data can be written (without

1605

1516

# blocking).

1606

gobject.IO_PRI: "PRI", # There is urgent data to read.

1607

gobject.IO_ERR: "ERR", # Error condition.

1608

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1517

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1518

gobject.IO_ERR: u"ERR", # Error condition.

1519

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1609

1520

# broken, usually for pipes and

1610

1521

# sockets).

1611

1522

}

1630

1541

client = c

1631

1542

break

1632

1543

else:

1633

logger.info("Client not found for fingerprint: %s, ad"

1634

"dress: %s", fpr, address)

1544

logger.warning(u"Client not found for fingerprint: %s, ad"

1545

u"dress: %s", fpr, address)

1635

1546

if self.use_dbus:

1636

1547

# Emit D-Bus signal

1637

1548

mandos_dbus_service.ClientNotFound(fpr, address[0])

1652

1563

kwargs = request[3]

1653

1564

1654

1565

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1655

1566

1656

1567

if command == 'getattr':

1657

1568

attrname = request[1]

1658

1569

if callable(client_object.__getattribute__(attrname)):

1664

1575

attrname = request[1]

1665

1576

value = request[2]

1666

1577

setattr(client_object, attrname, value)

1667

1578

1668

1579

return True

1669

1580

1670

1581

1671

1582

def string_to_delta(interval):

1672

1583

"""Parse a string and return a datetime.timedelta

1673

1584

1674

>>> string_to_delta('7d')

1585

>>> string_to_delta(u'7d')

1675

1586

datetime.timedelta(7)

1676

>>> string_to_delta('60s')

1587

>>> string_to_delta(u'60s')

1677

1588

datetime.timedelta(0, 60)

1678

>>> string_to_delta('60m')

1589

>>> string_to_delta(u'60m')

1679

1590

datetime.timedelta(0, 3600)

1680

>>> string_to_delta('24h')

1591

>>> string_to_delta(u'24h')

1681

1592

datetime.timedelta(1)

1682

>>> string_to_delta('1w')

1593

>>> string_to_delta(u'1w')

1683

1594

datetime.timedelta(7)

1684

>>> string_to_delta('5m 30s')

1595

>>> string_to_delta(u'5m 30s')

1685

1596

datetime.timedelta(0, 330)

1686

1597

"""

1687

1598

timevalue = datetime.timedelta(0)

1689

1600

try:

1690

1601

suffix = unicode(s[-1])

1691

1602

value = int(s[:-1])

1692

if suffix == "d":

1603

if suffix == u"d":

1693

1604

delta = datetime.timedelta(value)

1694

elif suffix == "s":

1605

elif suffix == u"s":

1695

1606

delta = datetime.timedelta(0, value)

1696

elif suffix == "m":

1607

elif suffix == u"m":

1697

1608

delta = datetime.timedelta(0, 0, 0, 0, value)

1698

elif suffix == "h":

1609

elif suffix == u"h":

1699

1610

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1700

elif suffix == "w":

1611

elif suffix == u"w":

1701

1612

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1702

1613

else:

1703

raise ValueError("Unknown suffix %r" % suffix)

1704

except (ValueError, IndexError) as e:

1705

raise ValueError(*(e.args))

1614

raise ValueError(u"Unknown suffix %r" % suffix)

1615

except (ValueError, IndexError), e:

1616

raise ValueError(e.message)

1706

1617

timevalue += delta

1707

1618

return timevalue

1708

1619

1714

1625

global if_nametoindex

1715

1626

try:

1716

1627

if_nametoindex = (ctypes.cdll.LoadLibrary

1717

(ctypes.util.find_library("c"))

1628

(ctypes.util.find_library(u"c"))

1718

1629

.if_nametoindex)

1719

1630

except (OSError, AttributeError):

1720

logger.warning("Doing if_nametoindex the hard way")

1631

logger.warning(u"Doing if_nametoindex the hard way")

1721

1632

def if_nametoindex(interface):

1722

1633

"Get an interface index the hard way, i.e. using fcntl()"

1723

1634

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1724

1635

with contextlib.closing(socket.socket()) as s:

1725

1636

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1726

struct.pack(str("16s16x"),

1637

struct.pack(str(u"16s16x"),

1727

1638

interface))

1728

interface_index = struct.unpack(str("I"),

1639

interface_index = struct.unpack(str(u"I"),

1729

1640

ifreq[16:20])[0]

1730

1641

return interface_index

1731

1642

return if_nametoindex(interface)

1739

1650

sys.exit()

1740

1651

os.setsid()

1741

1652

if not nochdir:

1742

os.chdir("/")

1653

os.chdir(u"/")

1743

1654

if os.fork():

1744

1655

sys.exit()

1745

1656

if not noclose:

1747

1658

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1748

1659

if not stat.S_ISCHR(os.fstat(null).st_mode):

1749

1660

raise OSError(errno.ENODEV,

1750

"%s not a character device"

1661

u"%s not a character device"

1751

1662

% os.path.devnull)

1752

1663

os.dup2(null, sys.stdin.fileno())

1753

1664

os.dup2(null, sys.stdout.fileno())

1761

1672

##################################################################

1762

1673

# Parsing of options, both command line and config file

1763

1674

1764

parser = argparse.ArgumentParser()

1765

parser.add_argument("-v", "--version", action="version",

1766

version = "%%(prog)s %s" % version,

1767

help="show version number and exit")

1768

parser.add_argument("-i", "--interface", metavar="IF",

1769

help="Bind to interface IF")

1770

parser.add_argument("-a", "--address",

1771

help="Address to listen for requests on")

1772

parser.add_argument("-p", "--port", type=int,

1773

help="Port number to receive requests on")

1774

parser.add_argument("--check", action="store_true",

1775

help="Run self-test")

1776

parser.add_argument("--debug", action="store_true",

1777

help="Debug mode; run in foreground and log"

1778

" to terminal")

1779

parser.add_argument("--debuglevel", metavar="LEVEL",

1780

help="Debug level for stdout output")

1781

parser.add_argument("--priority", help="GnuTLS"

1782

" priority string (see GnuTLS documentation)")

1783

parser.add_argument("--servicename",

1784

metavar="NAME", help="Zeroconf service name")

1785

parser.add_argument("--configdir",

1786

default="/etc/mandos", metavar="DIR",

1787

help="Directory to search for configuration"

1788

" files")

1789

parser.add_argument("--no-dbus", action="store_false",

1790

dest="use_dbus", help="Do not provide D-Bus"

1791

" system bus interface")

1792

parser.add_argument("--no-ipv6", action="store_false",

1793

dest="use_ipv6", help="Do not use IPv6")

1794

options = parser.parse_args()

1675

parser = optparse.OptionParser(version = "%%prog %s" % version)

1676

parser.add_option("-i", u"--interface", type=u"string",

1677

metavar="IF", help=u"Bind to interface IF")

1678

parser.add_option("-a", u"--address", type=u"string",

1679

help=u"Address to listen for requests on")

1680

parser.add_option("-p", u"--port", type=u"int",

1681

help=u"Port number to receive requests on")

1682

parser.add_option("--check", action=u"store_true",

1683

help=u"Run self-test")

1684

parser.add_option("--debug", action=u"store_true",

1685

help=u"Debug mode; run in foreground and log to"

1686

u" terminal")

1687

parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",

1688

help=u"Debug level for stdout output")

1689

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1690

u" priority string (see GnuTLS documentation)")

1691

parser.add_option("--servicename", type=u"string",

1692

metavar=u"NAME", help=u"Zeroconf service name")

1693

parser.add_option("--configdir", type=u"string",

1694

default=u"/etc/mandos", metavar=u"DIR",

1695

help=u"Directory to search for configuration"

1696

u" files")

1697

parser.add_option("--no-dbus", action=u"store_false",

1698

dest=u"use_dbus", help=u"Do not provide D-Bus"

1699

u" system bus interface")

1700

parser.add_option("--no-ipv6", action=u"store_false",

1701

dest=u"use_ipv6", help=u"Do not use IPv6")

1702

options = parser.parse_args()[0]

1795

1703

1796

1704

if options.check:

1797

1705

import doctest

1799

1707

sys.exit()

1800

1708

1801

1709

# Default values for config file for server-global settings

1802

server_defaults = { "interface": "",

1803

"address": "",

1804

"port": "",

1805

"debug": "False",

1806

"priority":

1807

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1808

"servicename": "Mandos",

1809

"use_dbus": "True",

1810

"use_ipv6": "True",

1811

"debuglevel": "",

1710

server_defaults = { u"interface": u"",

1711

u"address": u"",

1712

u"port": u"",

1713

u"debug": u"False",

1714

u"priority":

1715

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1716

u"servicename": u"Mandos",

1717

u"use_dbus": u"True",

1718

u"use_ipv6": u"True",

1719

u"debuglevel": u"",

1812

1720

}

1813

1721

1814

1722

# Parse config file for server-global settings

1815

1723

server_config = configparser.SafeConfigParser(server_defaults)

1816

1724

del server_defaults

1817

1725

server_config.read(os.path.join(options.configdir,

1818

"mandos.conf"))

1726

u"mandos.conf"))

1819

1727

# Convert the SafeConfigParser object to a dict

1820

1728

server_settings = server_config.defaults()

1821

1729

# Use the appropriate methods on the non-string config options

1822

for option in ("debug", "use_dbus", "use_ipv6"):

1823

server_settings[option] = server_config.getboolean("DEFAULT",

1730

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1731

server_settings[option] = server_config.getboolean(u"DEFAULT",

1824

1732

option)

1825

1733

if server_settings["port"]:

1826

server_settings["port"] = server_config.getint("DEFAULT",

1827

"port")

1734

server_settings["port"] = server_config.getint(u"DEFAULT",

1735

u"port")

1828

1736

del server_config

1829

1737

1830

1738

# Override the settings from the config file with command line

1831

1739

# options, if set.

1832

for option in ("interface", "address", "port", "debug",

1833

"priority", "servicename", "configdir",

1834

"use_dbus", "use_ipv6", "debuglevel"):

1740

for option in (u"interface", u"address", u"port", u"debug",

1741

u"priority", u"servicename", u"configdir",

1742

u"use_dbus", u"use_ipv6", u"debuglevel"):

1835

1743

value = getattr(options, option)

1836

1744

if value is not None:

1837

1745

server_settings[option] = value

1845

1753

##################################################################

1846

1754

1847

1755

# For convenience

1848

debug = server_settings["debug"]

1849

debuglevel = server_settings["debuglevel"]

1850

use_dbus = server_settings["use_dbus"]

1851

use_ipv6 = server_settings["use_ipv6"]

1852

1853

if server_settings["servicename"] != "Mandos":

1756

debug = server_settings[u"debug"]

1757

debuglevel = server_settings[u"debuglevel"]

1758

use_dbus = server_settings[u"use_dbus"]

1759

use_ipv6 = server_settings[u"use_ipv6"]

1760

1761

if server_settings[u"servicename"] != u"Mandos":

1854

1762

syslogger.setFormatter(logging.Formatter

1855

('Mandos (%s) [%%(process)d]:'

1856

' %%(levelname)s: %%(message)s'

1857

% server_settings["servicename"]))

1763

(u'Mandos (%s) [%%(process)d]:'

1764

u' %%(levelname)s: %%(message)s'

1765

% server_settings[u"servicename"]))

1858

1766

1859

1767

# Parse config file with clients

1860

client_defaults = { "timeout": "5m",

1861

"extended_timeout": "15m",

1862

"interval": "2m",

1863

"checker": "fping -q -- %%(host)s",

1864

"host": "",

1865

"approval_delay": "0s",

1866

"approval_duration": "1s",

1768

client_defaults = { u"timeout": u"1h",

1769

u"interval": u"5m",

1770

u"checker": u"fping -q -- %%(host)s",

1771

u"host": u"",

1772

u"approval_delay": u"0s",

1773

u"approval_duration": u"1s",

1867

1774

}

1868

1775

client_config = configparser.SafeConfigParser(client_defaults)

1869

client_config.read(os.path.join(server_settings["configdir"],

1870

"clients.conf"))

1776

client_config.read(os.path.join(server_settings[u"configdir"],

1777

u"clients.conf"))

1871

1778

1872

1779

global mandos_dbus_service

1873

1780

mandos_dbus_service = None

1874

1781

1875

tcp_server = MandosServer((server_settings["address"],

1876

server_settings["port"]),

1782

tcp_server = MandosServer((server_settings[u"address"],

1783

server_settings[u"port"]),

1877

1784

ClientHandler,

1878

interface=(server_settings["interface"]

1785

interface=(server_settings[u"interface"]

1879

1786

or None),

1880

1787

use_ipv6=use_ipv6,

1881

1788

gnutls_priority=

1882

server_settings["priority"],

1789

server_settings[u"priority"],

1883

1790

use_dbus=use_dbus)

1884

1791

if not debug:

1885

pidfilename = "/var/run/mandos.pid"

1792

pidfilename = u"/var/run/mandos.pid"

1886

1793

try:

1887

pidfile = open(pidfilename, "w")

1794

pidfile = open(pidfilename, u"w")

1888

1795

except IOError:

1889

logger.error("Could not open file %r", pidfilename)

1796

logger.error(u"Could not open file %r", pidfilename)

1890

1797

1891

1798

try:

1892

uid = pwd.getpwnam("_mandos").pw_uid

1893

gid = pwd.getpwnam("_mandos").pw_gid

1799

uid = pwd.getpwnam(u"_mandos").pw_uid

1800

gid = pwd.getpwnam(u"_mandos").pw_gid

1894

1801

except KeyError:

1895

1802

try:

1896

uid = pwd.getpwnam("mandos").pw_uid

1897

gid = pwd.getpwnam("mandos").pw_gid

1803

uid = pwd.getpwnam(u"mandos").pw_uid

1804

gid = pwd.getpwnam(u"mandos").pw_gid

1898

1805

except KeyError:

1899

1806

try:

1900

uid = pwd.getpwnam("nobody").pw_uid

1901

gid = pwd.getpwnam("nobody").pw_gid

1807

uid = pwd.getpwnam(u"nobody").pw_uid

1808

gid = pwd.getpwnam(u"nobody").pw_gid

1902

1809

except KeyError:

1903

1810

uid = 65534

1904

1811

gid = 65534

1905

1812

try:

1906

1813

os.setgid(gid)

1907

1814

os.setuid(uid)

1908

except OSError as error:

1815

except OSError, error:

1909

1816

if error[0] != errno.EPERM:

1910

1817

raise error

1911

1818

1916

1823

level = getattr(logging, debuglevel.upper())

1917

1824

syslogger.setLevel(level)

1918

1825

console.setLevel(level)

1919

1826

1920

1827

if debug:

1921

1828

# Enable all possible GnuTLS debugging

1922

1829

1926

1833

1927

1834

@gnutls.library.types.gnutls_log_func

1928

1835

def debug_gnutls(level, string):

1929

logger.debug("GnuTLS: %s", string[:-1])

1836

logger.debug(u"GnuTLS: %s", string[:-1])

1930

1837

1931

1838

(gnutls.library.functions

1932

1839

.gnutls_global_set_log_function(debug_gnutls))

1940

1847

# No console logging

1941

1848

logger.removeHandler(console)

1942

1849

1943

# Need to fork before connecting to D-Bus

1944

if not debug:

1945

# Close all input and output, do double fork, etc.

1946

daemon()

1947

1850

1948

1851

global main_loop

1949

1852

# From the Avahi example code

1953

1856

# End of Avahi example code

1954

1857

if use_dbus:

1955

1858

try:

1956

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1957

bus, do_not_queue=True)

1958

bus_name2 = dbus.service.BusName("se.recompile.Mandos",

1959

bus, do_not_queue=True)

1960

except dbus.exceptions.NameExistsException as e:

1961

logger.error(unicode(e) + ", disabling D-Bus")

1859

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1860

bus, do_not_queue=True)

1861

except dbus.exceptions.NameExistsException, e:

1862

logger.error(unicode(e) + u", disabling D-Bus")

1962

1863

use_dbus = False

1963

server_settings["use_dbus"] = False

1864

server_settings[u"use_dbus"] = False

1964

1865

tcp_server.use_dbus = False

1965

1866

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1966

service = AvahiService(name = server_settings["servicename"],

1967

servicetype = "_mandos._tcp",

1867

service = AvahiService(name = server_settings[u"servicename"],

1868

servicetype = u"_mandos._tcp",

1968

1869

protocol = protocol, bus = bus)

1969

1870

if server_settings["interface"]:

1970

1871

service.interface = (if_nametoindex

1971

(str(server_settings["interface"])))

1972

1872

(str(server_settings[u"interface"])))

1873

1874

if not debug:

1875

# Close all input and output, do double fork, etc.

1876

daemon()

1877

1973

1878

global multiprocessing_manager

1974

1879

multiprocessing_manager = multiprocessing.Manager()

1975

1880

1994

1899

client_config, section)))

1995

1900

for section in client_config.sections()))

1996

1901

if not tcp_server.clients:

1997

logger.warning("No clients defined")

1902

logger.warning(u"No clients defined")

1998

1903

1999

1904

if not debug:

2000

1905

try:

2001

1906

with pidfile:

2002

1907

pid = os.getpid()

2003

pidfile.write(str(pid) + "\n".encode("utf-8"))

1908

pidfile.write(str(pid) + "\n")

2004

1909

del pidfile

2005

1910

except IOError:

2006

logger.error("Could not write to file %r with PID %d",

1911

logger.error(u"Could not write to file %r with PID %d",

2007

1912

pidfilename, pid)

2008

1913

except NameError:

2009

1914

# "pidfile" was never created

2011

1916

del pidfilename

2012

1917

2013

1918

signal.signal(signal.SIGINT, signal.SIG_IGN)

2014

1919

2015

1920

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2016

1921

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2017

1922

2019

1924

class MandosDBusService(dbus.service.Object):

2020

1925

"""A D-Bus proxy object"""

2021

1926

def __init__(self):

2022

dbus.service.Object.__init__(self, bus, "/")

2023

_interface = "se.bsnet.fukt.Mandos"

1927

dbus.service.Object.__init__(self, bus, u"/")

1928

_interface = u"se.bsnet.fukt.Mandos"

2024

1929

2025

@dbus.service.signal(_interface, signature="o")

1930

@dbus.service.signal(_interface, signature=u"o")

2026

1931

def ClientAdded(self, objpath):

2027

1932

"D-Bus signal"

2028

1933

pass

2029

1934

2030

@dbus.service.signal(_interface, signature="ss")

1935

@dbus.service.signal(_interface, signature=u"ss")

2031

1936

def ClientNotFound(self, fingerprint, address):

2032

1937

"D-Bus signal"

2033

1938

pass

2034

1939

2035

@dbus.service.signal(_interface, signature="os")

1940

@dbus.service.signal(_interface, signature=u"os")

2036

1941

def ClientRemoved(self, objpath, name):

2037

1942

"D-Bus signal"

2038

1943

pass

2039

1944

2040

@dbus.service.method(_interface, out_signature="ao")

1945

@dbus.service.method(_interface, out_signature=u"ao")

2041

1946

def GetAllClients(self):

2042

1947

"D-Bus method"

2043

1948

return dbus.Array(c.dbus_object_path

2044

1949

for c in tcp_server.clients)

2045

1950

2046

1951

@dbus.service.method(_interface,

2047

out_signature="a{oa{sv}}")

1952

out_signature=u"a{oa{sv}}")

2048

1953

def GetAllClientsWithProperties(self):

2049

1954

"D-Bus method"

2050

1955

return dbus.Dictionary(

2051

((c.dbus_object_path, c.GetAll(""))

1956

((c.dbus_object_path, c.GetAll(u""))

2052

1957

for c in tcp_server.clients),

2053

signature="oa{sv}")

1958

signature=u"oa{sv}")

2054

1959

2055

@dbus.service.method(_interface, in_signature="o")

1960

@dbus.service.method(_interface, in_signature=u"o")

2056

1961

def RemoveClient(self, object_path):

2057

1962

"D-Bus method"

2058

1963

for c in tcp_server.clients:

2100

2005

# Find out what port we got

2101

2006

service.port = tcp_server.socket.getsockname()[1]

2102

2007

if use_ipv6:

2103

logger.info("Now listening on address %r, port %d,"

2008

logger.info(u"Now listening on address %r, port %d,"

2104

2009

" flowinfo %d, scope_id %d"

2105

2010

% tcp_server.socket.getsockname())

2106

2011

else: # IPv4

2107

logger.info("Now listening on address %r, port %d"

2012

logger.info(u"Now listening on address %r, port %d"

2108

2013

% tcp_server.socket.getsockname())

2109

2014

2110

2015

#service.interface = tcp_server.socket.getsockname()[3]

2113

2018

# From the Avahi example code

2114

2019

try:

2115

2020

service.activate()

2116

except dbus.exceptions.DBusException as error:

2117

logger.critical("DBusException: %s", error)

2021

except dbus.exceptions.DBusException, error:

2022

logger.critical(u"DBusException: %s", error)

2118

2023

cleanup()

2119

2024

sys.exit(1)

2120

2025

# End of Avahi example code

2124

2029

(tcp_server.handle_request

2125

2030

(*args[2:], **kwargs) or True))

2126

2031

2127

logger.debug("Starting main loop")

2032

logger.debug(u"Starting main loop")

2128

2033

main_loop.run()

2129

except AvahiError as error:

2130

logger.critical("AvahiError: %s", error)

2034

except AvahiError, error:

2035

logger.critical(u"AvahiError: %s", error)

2131

2036

cleanup()

2132

2037

sys.exit(1)

2133

2038

except KeyboardInterrupt:

2134

2039

if debug:

2135

print("", file=sys.stderr)

2136

logger.debug("Server received KeyboardInterrupt")

2137

logger.debug("Server exiting")

2040

print >> sys.stderr

2041

logger.debug(u"Server received KeyboardInterrupt")

2042

logger.debug(u"Server exiting")

2138

2043

# Must run before the D-Bus bus name gets deregistered

2139

2044

cleanup()

2140

2045

2141

2142

2046

if __name__ == '__main__':

2143

2047

main()