/mandos/release : revision 237.6.1

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

61

60

import fcntl

62

61

import functools

63

62

import cPickle as pickle

64

import multiprocessing

65

import types

63

import select

66

64

67

65

import dbus

68

66

import dbus.service

83

81

SO_BINDTODEVICE = None

84

82

85

83

86

version = "1.3.1"

84

version = "1.0.14"

87

85

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

86

logger = logging.Logger(u'mandos')

90

87

syslogger = (logging.handlers.SysLogHandler

91

88

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

address = str("/dev/log")))

89

address = "/dev/log"))

93

90

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

91

(u'Mandos [%(process)d]: %(levelname)s:'

92

u' %(message)s'))

96

93

logger.addHandler(syslogger)

97

94

98

95

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

96

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

97

u' %(levelname)s:'

98

u' %(message)s'))

102

99

logger.addHandler(console)

103

100

104

101

class AvahiError(Exception):

121

118

Attributes:

122

119

interface: integer; avahi.IF_UNSPEC or an interface index.

123

120

Used to optionally bind to the specified interface.

124

125

type: string; Example: '_mandos._tcp'.

121

122

type: string; Example: u'_mandos._tcp'.

126

123

See <http://www.dns-sd.org/ServiceTypes.html>

127

124

port: integer; what port to announce

128

125

TXT: list of strings; TXT record for the service

137

134

"""

138

135

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

139

136

servicetype = None, port = None, TXT = None,

140

domain = "", host = "", max_renames = 32768,

137

domain = u"", host = u"", max_renames = 32768,

141

138

protocol = avahi.PROTO_UNSPEC, bus = None):

142

139

self.interface = interface

143

140

self.name = name

152

149

self.group = None # our entry group

153

150

self.server = None

154

151

self.bus = bus

155

self.entry_group_state_changed_match = None

156

152

def rename(self):

157

153

"""Derived from the Avahi example code"""

158

154

if self.rename_count >= self.max_renames:

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

155

logger.critical(u"No suitable Zeroconf service name found"

156

u" after %i retries, exiting.",

161

157

self.rename_count)

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

164

logger.info("Changing Zeroconf service name to %r ...",

165

self.name)

158

raise AvahiServiceError(u"Too many renames")

159

self.name = self.server.GetAlternativeServiceName(self.name)

160

logger.info(u"Changing Zeroconf service name to %r ...",

161

unicode(self.name))

166

162

syslogger.setFormatter(logging.Formatter

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

163

(u'Mandos (%s) [%%(process)d]:'

164

u' %%(levelname)s: %%(message)s'

169

165

% self.name))

170

166

self.remove()

171

try:

172

self.add()

173

except dbus.exceptions.DBusException as error:

174

logger.critical("DBusException: %s", error)

175

self.cleanup()

176

os._exit(1)

167

self.add()

177

168

self.rename_count += 1

178

169

def remove(self):

179

170

"""Derived from the Avahi example code"""

180

if self.entry_group_state_changed_match is not None:

181

self.entry_group_state_changed_match.remove()

182

self.entry_group_state_changed_match = None

183

171

if self.group is not None:

184

172

self.group.Reset()

185

173

def add(self):

186

174

"""Derived from the Avahi example code"""

187

self.remove()

188

175

if self.group is None:

189

176

self.group = dbus.Interface(

190

177

self.bus.get_object(avahi.DBUS_NAME,

191

178

self.server.EntryGroupNew()),

192

179

avahi.DBUS_INTERFACE_ENTRY_GROUP)

193

self.entry_group_state_changed_match = (

194

self.group.connect_to_signal(

195

'StateChanged', self .entry_group_state_changed))

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

180

self.group.connect_to_signal('StateChanged',

181

self

182

.entry_group_state_changed)

183

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

197

184

self.name, self.type)

198

185

self.group.AddService(

199

186

self.interface,

206

193

self.group.Commit()

207

194

def entry_group_state_changed(self, state, error):

208

195

"""Derived from the Avahi example code"""

209

logger.debug("Avahi entry group state change: %i", state)

196

logger.debug(u"Avahi entry group state change: %i", state)

210

197

211

198

if state == avahi.ENTRY_GROUP_ESTABLISHED:

212

logger.debug("Zeroconf service established.")

199

logger.debug(u"Zeroconf service established.")

213

200

elif state == avahi.ENTRY_GROUP_COLLISION:

214

logger.info("Zeroconf service name collision.")

201

logger.warning(u"Zeroconf service name collision.")

215

202

self.rename()

216

203

elif state == avahi.ENTRY_GROUP_FAILURE:

217

logger.critical("Avahi: Error in group state changed %s",

204

logger.critical(u"Avahi: Error in group state changed %s",

218

205

unicode(error))

219

raise AvahiGroupError("State changed: %s"

206

raise AvahiGroupError(u"State changed: %s"

220

207

% unicode(error))

221

208

def cleanup(self):

222

209

"""Derived from the Avahi example code"""

223

210

if self.group is not None:

224

try:

225

self.group.Free()

226

except (dbus.exceptions.UnknownMethodException,

227

dbus.exceptions.DBusException) as e:

228

pass

211

self.group.Free()

229

212

self.group = None

230

self.remove()

231

def server_state_changed(self, state, error=None):

213

def server_state_changed(self, state):

232

214

"""Derived from the Avahi example code"""

233

logger.debug("Avahi server state change: %i", state)

234

bad_states = { avahi.SERVER_INVALID:

235

"Zeroconf server invalid",

236

avahi.SERVER_REGISTERING: None,

237

avahi.SERVER_COLLISION:

238

"Zeroconf server name collision",

239

avahi.SERVER_FAILURE:

240

"Zeroconf server failure" }

241

if state in bad_states:

242

if bad_states[state] is not None:

243

if error is None:

244

logger.error(bad_states[state])

245

else:

246

logger.error(bad_states[state] + ": %r", error)

247

self.cleanup()

215

logger.debug(u"Avahi server state change: %i", state)

216

if state == avahi.SERVER_COLLISION:

217

logger.error(u"Zeroconf server name collision")

218

self.remove()

248

219

elif state == avahi.SERVER_RUNNING:

249

220

self.add()

250

else:

251

if error is None:

252

logger.debug("Unknown state: %r", state)

253

else:

254

logger.debug("Unknown state: %r: %r", state, error)

255

221

def activate(self):

256

222

"""Derived from the Avahi example code"""

257

223

if self.server is None:

258

224

self.server = dbus.Interface(

259

225

self.bus.get_object(avahi.DBUS_NAME,

260

avahi.DBUS_PATH_SERVER,

261

follow_name_owner_changes=True),

226

avahi.DBUS_PATH_SERVER),

262

227

avahi.DBUS_INTERFACE_SERVER)

263

self.server.connect_to_signal("StateChanged",

228

self.server.connect_to_signal(u"StateChanged",

264

229

self.server_state_changed)

265

230

self.server_state_changed(self.server.GetState())

266

231

267

232

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

274

233

class Client(object):

275

234

"""A representation of a client host served by this server.

276

235

277

236

Attributes:

278

_approved: bool(); 'None' if not yet approved/disapproved

279

approval_delay: datetime.timedelta(); Time to wait for approval

280

approval_duration: datetime.timedelta(); Duration of one approval

237

238

D-Bus identifiers

239

fingerprint: string (40 or 32 hexadecimal digits); used to

240

uniquely identify the client

241

secret: bytestring; sent verbatim (over TLS) to client

242

host: string; available for use by the checker command

243

created: datetime.datetime(); (UTC) object creation

244

last_enabled: datetime.datetime(); (UTC)

245

enabled: bool()

246

last_checked_ok: datetime.datetime(); (UTC) or None

247

timeout: datetime.timedelta(); How long from last_checked_ok

248

until this client is disabled

249

interval: datetime.timedelta(); How often to start a new checker

250

disable_hook: If set, called by disable() as disable_hook(self)

281

251

checker: subprocess.Popen(); a running checker process used

282

252

to see if the client lives.

283

253

'None' if no process is running.

284

checker_callback_tag: a gobject event source tag, or None

285

checker_command: string; External command which is run to check

286

if client lives. %() expansions are done at

254

checker_initiator_tag: a gobject event source tag, or None

255

disable_initiator_tag: - '' -

256

checker_callback_tag: - '' -

257

checker_command: string; External command which is run to check if

258

client lives. %() expansions are done at

287

259

runtime with vars(self) as dict, so that for

288

260

instance %(name)s can be used in the command.

289

checker_initiator_tag: a gobject event source tag, or None

290

created: datetime.datetime(); (UTC) object creation

291

261

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

293

disable_initiator_tag: a gobject event source tag, or None

294

enabled: bool()

295

fingerprint: string (40 or 32 hexadecimal digits); used to

296

uniquely identify the client

297

host: string; available for use by the checker command

298

interval: datetime.timedelta(); How often to start a new checker

299

last_approval_request: datetime.datetime(); (UTC) or None

300

last_checked_ok: datetime.datetime(); (UTC) or None

301

last_enabled: datetime.datetime(); (UTC)

302

303

D-Bus identifiers

304

secret: bytestring; sent verbatim (over TLS) to client

305

timeout: datetime.timedelta(); How long from last_checked_ok

306

until this client is disabled

307

extended_timeout: extra long timeout when password has been sent

308

runtime_expansions: Allowed attributes for runtime expansion.

309

expires: datetime.datetime(); time (UTC) when a client will be

310

disabled, or None

311

262

"""

312

263

313

runtime_expansions = ("approval_delay", "approval_duration",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

316

"last_enabled", "name", "timeout")

264

@staticmethod

265

def _timedelta_to_milliseconds(td):

266

"Convert a datetime.timedelta() to milliseconds"

267

return ((td.days * 24 * 60 * 60 * 1000)

268

+ (td.seconds * 1000)

269

+ (td.microseconds // 1000))

317

270

318

271

def timeout_milliseconds(self):

319

272

"Return the 'timeout' attribute in milliseconds"

320

return _timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

273

return self._timedelta_to_milliseconds(self.timeout)

325

274

326

275

def interval_milliseconds(self):

327

276

"Return the 'interval' attribute in milliseconds"

328

return _timedelta_to_milliseconds(self.interval)

329

330

def approval_delay_milliseconds(self):

331

return _timedelta_to_milliseconds(self.approval_delay)

277

return self._timedelta_to_milliseconds(self.interval)

332

278

333

279

def __init__(self, name = None, disable_hook=None, config=None):

334

280

"""Note: the 'checker' key in 'config' sets the

337

283

self.name = name

338

284

if config is None:

339

285

config = {}

340

logger.debug("Creating client %r", self.name)

286

logger.debug(u"Creating client %r", self.name)

341

287

# Uppercase and remove spaces from fingerprint for later

342

288

# comparison purposes with return value from the fingerprint()

343

289

# function

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

290

self.fingerprint = (config[u"fingerprint"].upper()

291

.replace(u" ", u""))

292

logger.debug(u" Fingerprint: %s", self.fingerprint)

293

if u"secret" in config:

294

self.secret = config[u"secret"].decode(u"base64")

295

elif u"secfile" in config:

350

296

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

297

(config[u"secfile"])),

352

298

"rb") as secfile:

353

299

self.secret = secfile.read()

354

300

else:

355

raise TypeError("No secret or secfile for client %s"

301

raise TypeError(u"No secret or secfile for client %s"

356

302

% self.name)

357

self.host = config.get("host", "")

303

self.host = config.get(u"host", u"")

358

304

self.created = datetime.datetime.utcnow()

359

305

self.enabled = False

360

self.last_approval_request = None

361

306

self.last_enabled = None

362

307

self.last_checked_ok = None

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

308

self.timeout = string_to_delta(config[u"timeout"])

309

self.interval = string_to_delta(config[u"interval"])

366

310

self.disable_hook = disable_hook

367

311

self.checker = None

368

312

self.checker_initiator_tag = None

369

313

self.disable_initiator_tag = None

370

self.expires = None

371

314

self.checker_callback_tag = None

372

self.checker_command = config["checker"]

315

self.checker_command = config[u"checker"]

373

316

self.current_checker_command = None

374

317

self.last_connect = None

375

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

377

True)

378

self.approvals_pending = 0

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

384

318

385

def send_changedstate(self):

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

390

319

def enable(self):

391

320

"""Start this client's checker and timeout hooks"""

392

if getattr(self, "enabled", False):

321

if getattr(self, u"enabled", False):

393

322

# Already enabled

394

323

return

395

self.send_changedstate()

324

self.last_enabled = datetime.datetime.utcnow()

396

325

# Schedule a new checker to be started an 'interval' from now,

397

326

# and every interval from then on.

398

327

self.checker_initiator_tag = (gobject.timeout_add

399

328

(self.interval_milliseconds(),

400

329

self.start_checker))

401

330

# Schedule a disable() when 'timeout' has passed

402

self.expires = datetime.datetime.utcnow() + self.timeout

403

331

self.disable_initiator_tag = (gobject.timeout_add

404

332

(self.timeout_milliseconds(),

405

333

self.disable))

406

334

self.enabled = True

407

self.last_enabled = datetime.datetime.utcnow()

408

335

# Also start a new checker *right now*.

409

336

self.start_checker()

410

337

413

340

if not getattr(self, "enabled", False):

414

341

return False

415

342

if not quiet:

416

self.send_changedstate()

417

if not quiet:

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

343

logger.info(u"Disabling client %s", self.name)

344

if getattr(self, u"disable_initiator_tag", False):

420

345

gobject.source_remove(self.disable_initiator_tag)

421

346

self.disable_initiator_tag = None

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

347

if getattr(self, u"checker_initiator_tag", False):

424

348

gobject.source_remove(self.checker_initiator_tag)

425

349

self.checker_initiator_tag = None

426

350

self.stop_checker()

441

365

if os.WIFEXITED(condition):

442

366

exitstatus = os.WEXITSTATUS(condition)

443

367

if exitstatus == 0:

444

logger.info("Checker for %(name)s succeeded",

368

logger.info(u"Checker for %(name)s succeeded",

445

369

vars(self))

446

370

self.checked_ok()

447

371

else:

448

logger.info("Checker for %(name)s failed",

372

logger.info(u"Checker for %(name)s failed",

449

373

vars(self))

450

374

else:

451

logger.warning("Checker for %(name)s crashed?",

375

logger.warning(u"Checker for %(name)s crashed?",

452

376

vars(self))

453

377

454

def checked_ok(self, timeout=None):

378

def checked_ok(self):

455

379

"""Bump up the timeout for this client.

456

380

457

381

This should only be called when the client has been seen,

458

382

alive and well.

459

383

"""

460

if timeout is None:

461

timeout = self.timeout

462

384

self.last_checked_ok = datetime.datetime.utcnow()

463

385

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

386

self.disable_initiator_tag = (gobject.timeout_add

466

(_timedelta_to_milliseconds(timeout),

387

(self.timeout_milliseconds(),

467

388

self.disable))

468

389

469

def need_approval(self):

470

self.last_approval_request = datetime.datetime.utcnow()

471

472

390

def start_checker(self):

473

391

"""Start a new checker subprocess if one is not running.

474

392

486

404

# If a checker exists, make sure it is not a zombie

487

405

try:

488

406

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

489

except (AttributeError, OSError) as error:

407

except (AttributeError, OSError), error:

490

408

if (isinstance(error, OSError)

491

409

and error.errno != errno.ECHILD):

492

410

raise error

493

411

else:

494

412

if pid:

495

logger.warning("Checker was a zombie")

413

logger.warning(u"Checker was a zombie")

496

414

gobject.source_remove(self.checker_callback_tag)

497

415

self.checker_callback(pid, status,

498

416

self.current_checker_command)

503

421

command = self.checker_command % self.host

504

422

except TypeError:

505

423

# Escape attributes for the shell

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

424

escaped_attrs = dict((key,

425

re.escape(unicode(str(val),

426

errors=

427

u'replace')))

428

for key, val in

429

vars(self).iteritems())

514

430

try:

515

431

command = self.checker_command % escaped_attrs

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

432

except TypeError, error:

433

logger.error(u'Could not format string "%s":'

434

u' %s', self.checker_command, error)

519

435

return True # Try again later

520

436

self.current_checker_command = command

521

437

try:

522

logger.info("Starting checker %r for %s",

438

logger.info(u"Starting checker %r for %s",

523

439

command, self.name)

524

440

# We don't need to redirect stdout and stderr, since

525

441

# in normal mode, that is already done by daemon(),

527

443

# always replaced by /dev/null.)

528

444

self.checker = subprocess.Popen(command,

529

445

close_fds=True,

530

shell=True, cwd="/")

446

shell=True, cwd=u"/")

531

447

self.checker_callback_tag = (gobject.child_watch_add

532

448

(self.checker.pid,

533

449

self.checker_callback,

538

454

if pid:

539

455

gobject.source_remove(self.checker_callback_tag)

540

456

self.checker_callback(pid, status, command)

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

457

except OSError, error:

458

logger.error(u"Failed to start subprocess: %s",

543

459

error)

544

460

# Re-run this periodically if run by gobject.timeout_add

545

461

return True

549

465

if self.checker_callback_tag:

550

466

gobject.source_remove(self.checker_callback_tag)

551

467

self.checker_callback_tag = None

552

if getattr(self, "checker", None) is None:

468

if getattr(self, u"checker", None) is None:

553

469

return

554

logger.debug("Stopping checker for %(name)s", vars(self))

470

logger.debug(u"Stopping checker for %(name)s", vars(self))

555

471

try:

556

472

os.kill(self.checker.pid, signal.SIGTERM)

557

473

#time.sleep(0.5)

558

474

#if self.checker.poll() is None:

559

475

# os.kill(self.checker.pid, signal.SIGKILL)

560

except OSError as error:

476

except OSError, error:

561

477

if error.errno != errno.ESRCH: # No such process

562

478

raise

563

479

self.checker = None

564

480

565

481

566

def dbus_service_property(dbus_interface, signature="v",

567

access="readwrite", byte_arrays=False):

482

def dbus_service_property(dbus_interface, signature=u"v",

483

access=u"readwrite", byte_arrays=False):

568

484

"""Decorators for marking methods of a DBusObjectWithProperties to

569

485

become properties on the D-Bus.

570

486

577

493

"""

578

494

# Encoding deeply encoded byte arrays is not supported yet by the

579

495

# "Set" method, so we fail early here:

580

if byte_arrays and signature != "ay":

581

raise ValueError("Byte arrays not supported for non-'ay'"

582

" signature %r" % signature)

496

if byte_arrays and signature != u"ay":

497

raise ValueError(u"Byte arrays not supported for non-'ay'"

498

u" signature %r" % signature)

583

499

def decorator(func):

584

500

func._dbus_is_property = True

585

501

func._dbus_interface = dbus_interface

586

502

func._dbus_signature = signature

587

503

func._dbus_access = access

588

504

func._dbus_name = func.__name__

589

if func._dbus_name.endswith("_dbus_property"):

505

if func._dbus_name.endswith(u"_dbus_property"):

590

506

func._dbus_name = func._dbus_name[:-14]

591

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

507

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

592

508

return func

593

509

return decorator

594

510

614

530

615

531

class DBusObjectWithProperties(dbus.service.Object):

616

532

"""A D-Bus object with properties.

617

533

618

534

Classes inheriting from this can use the dbus_service_property

619

535

decorator to expose methods as D-Bus properties. It exposes the

620

536

standard Get(), Set(), and GetAll() methods on the D-Bus.

622

538

623

539

@staticmethod

624

540

def _is_dbus_property(obj):

625

return getattr(obj, "_dbus_is_property", False)

541

return getattr(obj, u"_dbus_is_property", False)

626

542

627

543

def _get_all_dbus_properties(self):

628

544

"""Returns a generator of (name, attribute) pairs

629

545

"""

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

631

for cls in self.__class__.__mro__

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

546

return ((prop._dbus_name, prop)

547

for name, prop in

548

inspect.getmembers(self, self._is_dbus_property))

633

549

634

550

def _get_dbus_property(self, interface_name, property_name):

635

551

"""Returns a bound method if one exists which is a D-Bus

636

552

property with the specified name and interface.

637

553

"""

638

for cls in self.__class__.__mro__:

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

641

return value.__get__(self)

642

554

for name in (property_name,

555

property_name + u"_dbus_property"):

556

prop = getattr(self, name, None)

557

if (prop is None

558

or not self._is_dbus_property(prop)

559

or prop._dbus_name != property_name

560

or (interface_name and prop._dbus_interface

561

and interface_name != prop._dbus_interface)):

562

continue

563

return prop

643

564

# No such property

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

645

+ interface_name + "."

565

raise DBusPropertyNotFound(self.dbus_object_path + u":"

566

+ interface_name + u"."

646

567

+ property_name)

647

568

648

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

649

out_signature="v")

569

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

570

out_signature=u"v")

650

571

def Get(self, interface_name, property_name):

651

572

"""Standard D-Bus property Get() method, see D-Bus standard.

652

573

"""

653

574

prop = self._get_dbus_property(interface_name, property_name)

654

if prop._dbus_access == "write":

575

if prop._dbus_access == u"write":

655

576

raise DBusPropertyAccessException(property_name)

656

577

value = prop()

657

if not hasattr(value, "variant_level"):

578

if not hasattr(value, u"variant_level"):

658

579

return value

659

580

return type(value)(value, variant_level=value.variant_level+1)

660

581

661

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

582

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

662

583

def Set(self, interface_name, property_name, value):

663

584

"""Standard D-Bus property Set() method, see D-Bus standard.

664

585

"""

665

586

prop = self._get_dbus_property(interface_name, property_name)

666

if prop._dbus_access == "read":

587

if prop._dbus_access == u"read":

667

588

raise DBusPropertyAccessException(property_name)

668

if prop._dbus_get_args_options["byte_arrays"]:

589

if prop._dbus_get_args_options[u"byte_arrays"]:

669

590

# The byte_arrays option is not supported yet on

670

591

# signatures other than "ay".

671

if prop._dbus_signature != "ay":

592

if prop._dbus_signature != u"ay":

672

593

raise ValueError

673

594

value = dbus.ByteArray(''.join(unichr(byte)

674

595

for byte in value))

675

596

prop(value)

676

597

677

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

678

out_signature="a{sv}")

598

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

599

out_signature=u"a{sv}")

679

600

def GetAll(self, interface_name):

680

601

"""Standard D-Bus property GetAll() method, see D-Bus

681

602

standard.

682

603

683

604

Note: Will not include properties with access="write".

684

605

"""

685

606

all = {}

689

610

# Interface non-empty but did not match

690

611

continue

691

612

# Ignore write-only properties

692

if prop._dbus_access == "write":

613

if prop._dbus_access == u"write":

693

614

continue

694

615

value = prop()

695

if not hasattr(value, "variant_level"):

616

if not hasattr(value, u"variant_level"):

696

617

all[name] = value

697

618

continue

698

619

all[name] = type(value)(value, variant_level=

699

620

value.variant_level+1)

700

return dbus.Dictionary(all, signature="sv")

621

return dbus.Dictionary(all, signature=u"sv")

701

622

702

623

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

703

out_signature="s",

624

out_signature=u"s",

704

625

path_keyword='object_path',

705

626

connection_keyword='connection')

706

627

def Introspect(self, object_path, connection):

711

632

try:

712

633

document = xml.dom.minidom.parseString(xmlstring)

713

634

def make_tag(document, name, prop):

714

e = document.createElement("property")

715

e.setAttribute("name", name)

716

e.setAttribute("type", prop._dbus_signature)

717

e.setAttribute("access", prop._dbus_access)

635

e = document.createElement(u"property")

636

e.setAttribute(u"name", name)

637

e.setAttribute(u"type", prop._dbus_signature)

638

e.setAttribute(u"access", prop._dbus_access)

718

639

return e

719

for if_tag in document.getElementsByTagName("interface"):

640

for if_tag in document.getElementsByTagName(u"interface"):

720

641

for tag in (make_tag(document, name, prop)

721

642

for name, prop

722

643

in self._get_all_dbus_properties()

723

644

if prop._dbus_interface

724

== if_tag.getAttribute("name")):

645

== if_tag.getAttribute(u"name")):

725

646

if_tag.appendChild(tag)

726

647

# Add the names to the return values for the

727

648

# "org.freedesktop.DBus.Properties" methods

728

if (if_tag.getAttribute("name")

729

== "org.freedesktop.DBus.Properties"):

730

for cn in if_tag.getElementsByTagName("method"):

731

if cn.getAttribute("name") == "Get":

732

for arg in cn.getElementsByTagName("arg"):

733

if (arg.getAttribute("direction")

734

== "out"):

735

arg.setAttribute("name", "value")

736

elif cn.getAttribute("name") == "GetAll":

737

for arg in cn.getElementsByTagName("arg"):

738

if (arg.getAttribute("direction")

739

== "out"):

740

arg.setAttribute("name", "props")

741

xmlstring = document.toxml("utf-8")

649

if (if_tag.getAttribute(u"name")

650

== u"org.freedesktop.DBus.Properties"):

651

for cn in if_tag.getElementsByTagName(u"method"):

652

if cn.getAttribute(u"name") == u"Get":

653

for arg in cn.getElementsByTagName(u"arg"):

654

if (arg.getAttribute(u"direction")

655

== u"out"):

656

arg.setAttribute(u"name", u"value")

657

elif cn.getAttribute(u"name") == u"GetAll":

658

for arg in cn.getElementsByTagName(u"arg"):

659

if (arg.getAttribute(u"direction")

660

== u"out"):

661

arg.setAttribute(u"name", u"props")

662

xmlstring = document.toxml(u"utf-8")

742

663

document.unlink()

743

664

except (AttributeError, xml.dom.DOMException,

744

xml.parsers.expat.ExpatError) as error:

745

logger.error("Failed to override Introspection method",

665

xml.parsers.expat.ExpatError), error:

666

logger.error(u"Failed to override Introspection method",

746

667

error)

747

668

return xmlstring

748

669

749

670

750

def datetime_to_dbus (dt, variant_level=0):

751

"""Convert a UTC datetime.datetime() to a D-Bus type."""

752

if dt is None:

753

return dbus.String("", variant_level = variant_level)

754

return dbus.String(dt.isoformat(),

755

variant_level=variant_level)

756

757

class AlternateDBusNamesMetaclass(DBusObjectWithProperties.__metaclass__):

758

"""Applied to an empty subclass of a D-Bus object, this metaclass

759

will add additional D-Bus attributes matching a certain pattern.

760

"""

761

def __new__(mcs, name, bases, attr):

762

# Go through all the base classes which could have D-Bus

763

# methods, signals, or properties in them

764

for base in (b for b in bases

765

if issubclass(b, dbus.service.Object)):

766

# Go though all attributes of the base class

767

for attrname, attribute in inspect.getmembers(base):

768

# Ignore non-D-Bus attributes, and D-Bus attributes

769

# with the wrong interface name

770

if (not hasattr(attribute, "_dbus_interface")

771

or not attribute._dbus_interface

772

.startswith("se.recompile.Mandos")):

773

continue

774

# Create an alternate D-Bus interface name based on

775

# the current name

776

alt_interface = (attribute._dbus_interface

777

.replace("se.recompile.Mandos",

778

"se.bsnet.fukt.Mandos"))

779

# Is this a D-Bus signal?

780

if getattr(attribute, "_dbus_is_signal", False):

781

# Extract the original non-method function by

782

# black magic

783

nonmethod_func = (dict(

784

zip(attribute.func_code.co_freevars,

785

attribute.__closure__))["func"]

786

.cell_contents)

787

# Create a new, but exactly alike, function

788

# object, and decorate it to be a new D-Bus signal

789

# with the alternate D-Bus interface name

790

new_function = (dbus.service.signal

791

(alt_interface,

792

attribute._dbus_signature)

793

(types.FunctionType(

794

nonmethod_func.func_code,

795

nonmethod_func.func_globals,

796

nonmethod_func.func_name,

797

nonmethod_func.func_defaults,

798

nonmethod_func.func_closure)))

799

# Define a creator of a function to call both the

800

# old and new functions, so both the old and new

801

# signals gets sent when the function is called

802

def fixscope(func1, func2):

803

"""This function is a scope container to pass

804

func1 and func2 to the "call_both" function

805

outside of its arguments"""

806

def call_both(*args, **kwargs):

807

"""This function will emit two D-Bus

808

signals by calling func1 and func2"""

809

func1(*args, **kwargs)

810

func2(*args, **kwargs)

811

return call_both

812

# Create the "call_both" function and add it to

813

# the class

814

attr[attrname] = fixscope(attribute,

815

new_function)

816

# Is this a D-Bus method?

817

elif getattr(attribute, "_dbus_is_method", False):

818

# Create a new, but exactly alike, function

819

# object. Decorate it to be a new D-Bus method

820

# with the alternate D-Bus interface name. Add it

821

# to the class.

822

attr[attrname] = (dbus.service.method

823

(alt_interface,

824

attribute._dbus_in_signature,

825

attribute._dbus_out_signature)

826

(types.FunctionType

827

(attribute.func_code,

828

attribute.func_globals,

829

attribute.func_name,

830

attribute.func_defaults,

831

attribute.func_closure)))

832

# Is this a D-Bus property?

833

elif getattr(attribute, "_dbus_is_property", False):

834

# Create a new, but exactly alike, function

835

# object, and decorate it to be a new D-Bus

836

# property with the alternate D-Bus interface

837

# name. Add it to the class.

838

attr[attrname] = (dbus_service_property

839

(alt_interface,

840

attribute._dbus_signature,

841

attribute._dbus_access,

842

attribute

843

._dbus_get_args_options

844

["byte_arrays"])

845

(types.FunctionType

846

(attribute.func_code,

847

attribute.func_globals,

848

attribute.func_name,

849

attribute.func_defaults,

850

attribute.func_closure)))

851

return type.__new__(mcs, name, bases, attr)

852

853

671

class ClientDBus(Client, DBusObjectWithProperties):

854

672

"""A Client class using D-Bus

855

673

857

675

dbus_object_path: dbus.ObjectPath

858

676

bus: dbus.SystemBus()

859

677

"""

860

861

runtime_expansions = (Client.runtime_expansions

862

+ ("dbus_object_path",))

863

864

678

# dbus.service.Object doesn't use super(), so we can't either.

865

679

866

680

def __init__(self, bus = None, *args, **kwargs):

867

self._approvals_pending = 0

868

681

self.bus = bus

869

682

Client.__init__(self, *args, **kwargs)

870

683

# Only now, when this client is initialized, can it show up on

871

684

# the D-Bus

872

client_object_name = unicode(self.name).translate(

873

{ord("."): ord("_"),

874

ord("-"): ord("_")})

875

685

self.dbus_object_path = (dbus.ObjectPath

876

("/clients/" + client_object_name))

686

(u"/clients/"

687

+ self.name.replace(u".", u"_")))

877

688

DBusObjectWithProperties.__init__(self, self.bus,

878

689

self.dbus_object_path)

879

880

def notifychangeproperty(transform_func,

881

dbus_name, type_func=lambda x: x,

882

variant_level=1):

883

""" Modify a variable so that it's a property which announces

884

its changes to DBus.

885

886

transform_fun: Function that takes a value and transforms it

887

to a D-Bus type.

888

dbus_name: D-Bus name of the variable

889

type_func: Function that transform the value before sending it

890

to the D-Bus. Default: no transform

891

variant_level: D-Bus variant level. Default: 1

892

"""

893

real_value = [None,]

894

def setter(self, value):

895

old_value = real_value[0]

896

real_value[0] = value

897

if hasattr(self, "dbus_object_path"):

898

if type_func(old_value) != type_func(real_value[0]):

899

dbus_value = transform_func(type_func(real_value[0]),

900

variant_level)

901

self.PropertyChanged(dbus.String(dbus_name),

902

dbus_value)

903

904

return property(lambda self: real_value[0], setter)

905

906

907

expires = notifychangeproperty(datetime_to_dbus, "Expires")

908

approvals_pending = notifychangeproperty(dbus.Boolean,

909

"ApprovalPending",

910

type_func = bool)

911

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

912

last_enabled = notifychangeproperty(datetime_to_dbus,

913

"LastEnabled")

914

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

915

type_func = lambda checker: checker is not None)

916

last_checked_ok = notifychangeproperty(datetime_to_dbus,

917

"LastCheckedOK")

918

last_approval_request = notifychangeproperty(datetime_to_dbus,

919

"LastApprovalRequest")

920

approved_by_default = notifychangeproperty(dbus.Boolean,

921

"ApprovedByDefault")

922

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

923

type_func = _timedelta_to_milliseconds)

924

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

925

type_func = _timedelta_to_milliseconds)

926

host = notifychangeproperty(dbus.String, "Host")

927

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

928

type_func = _timedelta_to_milliseconds)

929

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

930

type_func = _timedelta_to_milliseconds)

931

interval = notifychangeproperty(dbus.UInt16, "Interval",

932

type_func = _timedelta_to_milliseconds)

933

checker_command = notifychangeproperty(dbus.String, "Checker")

934

935

del notifychangeproperty

690

691

@staticmethod

692

def _datetime_to_dbus(dt, variant_level=0):

693

"""Convert a UTC datetime.datetime() to a D-Bus type."""

694

return dbus.String(dt.isoformat(),

695

variant_level=variant_level)

696

697

def enable(self):

698

oldstate = getattr(self, u"enabled", False)

699

r = Client.enable(self)

700

if oldstate != self.enabled:

701

# Emit D-Bus signals

702

self.PropertyChanged(dbus.String(u"enabled"),

703

dbus.Boolean(True, variant_level=1))

704

self.PropertyChanged(

705

dbus.String(u"last_enabled"),

706

self._datetime_to_dbus(self.last_enabled,

707

variant_level=1))

708

return r

709

710

def disable(self, quiet = False):

711

oldstate = getattr(self, u"enabled", False)

712

r = Client.disable(self, quiet=quiet)

713

if not quiet and oldstate != self.enabled:

714

# Emit D-Bus signal

715

self.PropertyChanged(dbus.String(u"enabled"),

716

dbus.Boolean(False, variant_level=1))

717

return r

936

718

937

719

def __del__(self, *args, **kwargs):

938

720

try:

939

721

self.remove_from_connection()

940

722

except LookupError:

941

723

pass

942

if hasattr(DBusObjectWithProperties, "__del__"):

724

if hasattr(DBusObjectWithProperties, u"__del__"):

943

725

DBusObjectWithProperties.__del__(self, *args, **kwargs)

944

726

Client.__del__(self, *args, **kwargs)

945

727

947

729

*args, **kwargs):

948

730

self.checker_callback_tag = None

949

731

self.checker = None

732

# Emit D-Bus signal

733

self.PropertyChanged(dbus.String(u"checker_running"),

734

dbus.Boolean(False, variant_level=1))

950

735

if os.WIFEXITED(condition):

951

736

exitstatus = os.WEXITSTATUS(condition)

952

737

# Emit D-Bus signal

962

747

return Client.checker_callback(self, pid, condition, command,

963

748

*args, **kwargs)

964

749

750

def checked_ok(self, *args, **kwargs):

751

r = Client.checked_ok(self, *args, **kwargs)

752

# Emit D-Bus signal

753

self.PropertyChanged(

754

dbus.String(u"last_checked_ok"),

755

(self._datetime_to_dbus(self.last_checked_ok,

756

variant_level=1)))

757

return r

758

965

759

def start_checker(self, *args, **kwargs):

966

760

old_checker = self.checker

967

761

if self.checker is not None:

974

768

and old_checker_pid != self.checker.pid):

975

769

# Emit D-Bus signal

976

770

self.CheckerStarted(self.current_checker_command)

977

return r

978

979

def _reset_approved(self):

980

self._approved = None

981

return False

982

983

def approve(self, value=True):

984

self.send_changedstate()

985

self._approved = value

986

gobject.timeout_add(_timedelta_to_milliseconds

987

(self.approval_duration),

988

self._reset_approved)

989

771

self.PropertyChanged(

772

dbus.String(u"checker_running"),

773

dbus.Boolean(True, variant_level=1))

774

return r

775

776

def stop_checker(self, *args, **kwargs):

777

old_checker = getattr(self, u"checker", None)

778

r = Client.stop_checker(self, *args, **kwargs)

779

if (old_checker is not None

780

and getattr(self, u"checker", None) is None):

781

self.PropertyChanged(dbus.String(u"checker_running"),

782

dbus.Boolean(False, variant_level=1))

783

return r

990

784

991

785

## D-Bus methods, signals & properties

992

_interface = "se.recompile.Mandos.Client"

786

_interface = u"se.bsnet.fukt.Mandos.Client"

993

787

994

788

## Signals

995

789

996

790

# CheckerCompleted - signal

997

@dbus.service.signal(_interface, signature="nxs")

791

@dbus.service.signal(_interface, signature=u"nxs")

998

792

def CheckerCompleted(self, exitcode, waitstatus, command):

999

793

"D-Bus signal"

1000

794

pass

1001

795

1002

796

# CheckerStarted - signal

1003

@dbus.service.signal(_interface, signature="s")

797

@dbus.service.signal(_interface, signature=u"s")

1004

798

def CheckerStarted(self, command):

1005

799

"D-Bus signal"

1006

800

pass

1007

801

1008

802

# PropertyChanged - signal

1009

@dbus.service.signal(_interface, signature="sv")

803

@dbus.service.signal(_interface, signature=u"sv")

1010

804

def PropertyChanged(self, property, value):

1011

805

"D-Bus signal"

1012

806

pass

1014

808

# GotSecret - signal

1015

809

@dbus.service.signal(_interface)

1016

810

def GotSecret(self):

1017

"""D-Bus signal

1018

Is sent after a successful transfer of secret from the Mandos

1019

server to mandos-client

1020

"""

811

"D-Bus signal"

1021

812

pass

1022

813

1023

814

# Rejected - signal

1024

@dbus.service.signal(_interface, signature="s")

1025

def Rejected(self, reason):

815

@dbus.service.signal(_interface)

816

def Rejected(self):

1026

817

"D-Bus signal"

1027

818

pass

1028

819

1029

# NeedApproval - signal

1030

@dbus.service.signal(_interface, signature="tb")

1031

def NeedApproval(self, timeout, default):

1032

"D-Bus signal"

1033

return self.need_approval()

1034

1035

820

## Methods

1036

821

1037

# Approve - method

1038

@dbus.service.method(_interface, in_signature="b")

1039

def Approve(self, value):

1040

self.approve(value)

1041

1042

822

# CheckedOK - method

1043

823

@dbus.service.method(_interface)

1044

824

def CheckedOK(self):

1045

self.checked_ok()

825

return self.checked_ok()

1046

826

1047

827

# Enable - method

1048

828

@dbus.service.method(_interface)

1069

849

1070

850

## Properties

1071

851

1072

# ApprovalPending - property

1073

@dbus_service_property(_interface, signature="b", access="read")

1074

def ApprovalPending_dbus_property(self):

1075

return dbus.Boolean(bool(self.approvals_pending))

1076

1077

# ApprovedByDefault - property

1078

@dbus_service_property(_interface, signature="b",

1079

access="readwrite")

1080

def ApprovedByDefault_dbus_property(self, value=None):

1081

if value is None: # get

1082

return dbus.Boolean(self.approved_by_default)

1083

self.approved_by_default = bool(value)

1084

1085

# ApprovalDelay - property

1086

@dbus_service_property(_interface, signature="t",

1087

access="readwrite")

1088

def ApprovalDelay_dbus_property(self, value=None):

1089

if value is None: # get

1090

return dbus.UInt64(self.approval_delay_milliseconds())

1091

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1092

1093

# ApprovalDuration - property

1094

@dbus_service_property(_interface, signature="t",

1095

access="readwrite")

1096

def ApprovalDuration_dbus_property(self, value=None):

1097

if value is None: # get

1098

return dbus.UInt64(_timedelta_to_milliseconds(

1099

self.approval_duration))

1100

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1101

1102

# Name - property

1103

@dbus_service_property(_interface, signature="s", access="read")

1104

def Name_dbus_property(self):

852

# name - property

853

@dbus_service_property(_interface, signature=u"s", access=u"read")

854

def name_dbus_property(self):

1105

855

return dbus.String(self.name)

1106

856

1107

# Fingerprint - property

1108

@dbus_service_property(_interface, signature="s", access="read")

1109

def Fingerprint_dbus_property(self):

857

# fingerprint - property

858

@dbus_service_property(_interface, signature=u"s", access=u"read")

859

def fingerprint_dbus_property(self):

1110

860

return dbus.String(self.fingerprint)

1111

861

1112

# Host - property

1113

@dbus_service_property(_interface, signature="s",

1114

access="readwrite")

1115

def Host_dbus_property(self, value=None):

862

# host - property

863

@dbus_service_property(_interface, signature=u"s",

864

access=u"readwrite")

865

def host_dbus_property(self, value=None):

1116

866

if value is None: # get

1117

867

return dbus.String(self.host)

1118

868

self.host = value

1119

1120

# Created - property

1121

@dbus_service_property(_interface, signature="s", access="read")

1122

def Created_dbus_property(self):

1123

return dbus.String(datetime_to_dbus(self.created))

1124

1125

# LastEnabled - property

1126

@dbus_service_property(_interface, signature="s", access="read")

1127

def LastEnabled_dbus_property(self):

1128

return datetime_to_dbus(self.last_enabled)

1129

1130

# Enabled - property

1131

@dbus_service_property(_interface, signature="b",

1132

access="readwrite")

1133

def Enabled_dbus_property(self, value=None):

869

# Emit D-Bus signal

870

self.PropertyChanged(dbus.String(u"host"),

871

dbus.String(value, variant_level=1))

872

873

# created - property

874

@dbus_service_property(_interface, signature=u"s", access=u"read")

875

def created_dbus_property(self):

876

return dbus.String(self._datetime_to_dbus(self.created))

877

878

# last_enabled - property

879

@dbus_service_property(_interface, signature=u"s", access=u"read")

880

def last_enabled_dbus_property(self):

881

if self.last_enabled is None:

882

return dbus.String(u"")

883

return dbus.String(self._datetime_to_dbus(self.last_enabled))

884

885

# enabled - property

886

@dbus_service_property(_interface, signature=u"b",

887

access=u"readwrite")

888

def enabled_dbus_property(self, value=None):

1134

889

if value is None: # get

1135

890

return dbus.Boolean(self.enabled)

1136

891

if value:

1138

893

else:

1139

894

self.disable()

1140

895

1141

# LastCheckedOK - property

1142

@dbus_service_property(_interface, signature="s",

1143

access="readwrite")

1144

def LastCheckedOK_dbus_property(self, value=None):

896

# last_checked_ok - property

897

@dbus_service_property(_interface, signature=u"s",

898

access=u"readwrite")

899

def last_checked_ok_dbus_property(self, value=None):

1145

900

if value is not None:

1146

901

self.checked_ok()

1147

902

return

1148

return datetime_to_dbus(self.last_checked_ok)

1149

1150

# Expires - property

1151

@dbus_service_property(_interface, signature="s", access="read")

1152

def Expires_dbus_property(self):

1153

return datetime_to_dbus(self.expires)

1154

1155

# LastApprovalRequest - property

1156

@dbus_service_property(_interface, signature="s", access="read")

1157

def LastApprovalRequest_dbus_property(self):

1158

return datetime_to_dbus(self.last_approval_request)

1159

1160

# Timeout - property

1161

@dbus_service_property(_interface, signature="t",

1162

access="readwrite")

1163

def Timeout_dbus_property(self, value=None):

903

if self.last_checked_ok is None:

904

return dbus.String(u"")

905

return dbus.String(self._datetime_to_dbus(self

906

.last_checked_ok))

907

908

# timeout - property

909

@dbus_service_property(_interface, signature=u"t",

910

access=u"readwrite")

911

def timeout_dbus_property(self, value=None):

1164

912

if value is None: # get

1165

913

return dbus.UInt64(self.timeout_milliseconds())

1166

914

self.timeout = datetime.timedelta(0, 0, 0, value)

1167

if getattr(self, "disable_initiator_tag", None) is None:

915

# Emit D-Bus signal

916

self.PropertyChanged(dbus.String(u"timeout"),

917

dbus.UInt64(value, variant_level=1))

918

if getattr(self, u"disable_initiator_tag", None) is None:

1168

919

return

1169

920

# Reschedule timeout

1170

921

gobject.source_remove(self.disable_initiator_tag)

1171

922

self.disable_initiator_tag = None

1172

self.expires = None

1173

923

time_to_die = (self.

1174

924

_timedelta_to_milliseconds((self

1175

925

.last_checked_ok

1180

930

# The timeout has passed

1181

931

self.disable()

1182

932

else:

1183

self.expires = (datetime.datetime.utcnow()

1184

+ datetime.timedelta(milliseconds = time_to_die))

1185

933

self.disable_initiator_tag = (gobject.timeout_add

1186

934

(time_to_die, self.disable))

1187

935

1188

# ExtendedTimeout - property

1189

@dbus_service_property(_interface, signature="t",

1190

access="readwrite")

1191

def ExtendedTimeout_dbus_property(self, value=None):

1192

if value is None: # get

1193

return dbus.UInt64(self.extended_timeout_milliseconds())

1194

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1195

1196

# Interval - property

1197

@dbus_service_property(_interface, signature="t",

1198

access="readwrite")

1199

def Interval_dbus_property(self, value=None):

936

# interval - property

937

@dbus_service_property(_interface, signature=u"t",

938

access=u"readwrite")

939

def interval_dbus_property(self, value=None):

1200

940

if value is None: # get

1201

941

return dbus.UInt64(self.interval_milliseconds())

1202

942

self.interval = datetime.timedelta(0, 0, 0, value)

1203

if getattr(self, "checker_initiator_tag", None) is None:

943

# Emit D-Bus signal

944

self.PropertyChanged(dbus.String(u"interval"),

945

dbus.UInt64(value, variant_level=1))

946

if getattr(self, u"checker_initiator_tag", None) is None:

1204

947

return

1205

948

# Reschedule checker run

1206

949

gobject.source_remove(self.checker_initiator_tag)

1207

950

self.checker_initiator_tag = (gobject.timeout_add

1208

951

(value, self.start_checker))

1209

952

self.start_checker() # Start one now, too

1210

1211

# Checker - property

1212

@dbus_service_property(_interface, signature="s",

1213

access="readwrite")

1214

def Checker_dbus_property(self, value=None):

953

954

# checker - property

955

@dbus_service_property(_interface, signature=u"s",

956

access=u"readwrite")

957

def checker_dbus_property(self, value=None):

1215

958

if value is None: # get

1216

959

return dbus.String(self.checker_command)

1217

960

self.checker_command = value

961

# Emit D-Bus signal

962

self.PropertyChanged(dbus.String(u"checker"),

963

dbus.String(self.checker_command,

964

variant_level=1))

1218

965

1219

# CheckerRunning - property

1220

@dbus_service_property(_interface, signature="b",

1221

access="readwrite")

1222

def CheckerRunning_dbus_property(self, value=None):

966

# checker_running - property

967

@dbus_service_property(_interface, signature=u"b",

968

access=u"readwrite")

969

def checker_running_dbus_property(self, value=None):

1223

970

if value is None: # get

1224

971

return dbus.Boolean(self.checker is not None)

1225

972

if value:

1227

974

else:

1228

975

self.stop_checker()

1229

976

1230

# ObjectPath - property

1231

@dbus_service_property(_interface, signature="o", access="read")

1232

def ObjectPath_dbus_property(self):

977

# object_path - property

978

@dbus_service_property(_interface, signature=u"o", access=u"read")

979

def object_path_dbus_property(self):

1233

980

return self.dbus_object_path # is already a dbus.ObjectPath

1234

981

1235

# Secret = property

1236

@dbus_service_property(_interface, signature="ay",

1237

access="write", byte_arrays=True)

1238

def Secret_dbus_property(self, value):

982

# secret = property

983

@dbus_service_property(_interface, signature=u"ay",

984

access=u"write", byte_arrays=True)

985

def secret_dbus_property(self, value):

1239

986

self.secret = str(value)

1240

987

1241

988

del _interface

1242

989

1243

990

1244

class ProxyClient(object):

1245

def __init__(self, child_pipe, fpr, address):

1246

self._pipe = child_pipe

1247

self._pipe.send(('init', fpr, address))

1248

if not self._pipe.recv():

1249

raise KeyError()

1250

1251

def __getattribute__(self, name):

1252

if(name == '_pipe'):

1253

return super(ProxyClient, self).__getattribute__(name)

1254

self._pipe.send(('getattr', name))

1255

data = self._pipe.recv()

1256

if data[0] == 'data':

1257

return data[1]

1258

if data[0] == 'function':

1259

def func(*args, **kwargs):

1260

self._pipe.send(('funcall', name, args, kwargs))

1261

return self._pipe.recv()[1]

1262

return func

1263

1264

def __setattr__(self, name, value):

1265

if(name == '_pipe'):

1266

return super(ProxyClient, self).__setattr__(name, value)

1267

self._pipe.send(('setattr', name, value))

1268

1269

class ClientDBusTransitional(ClientDBus):

1270

__metaclass__ = AlternateDBusNamesMetaclass

1271

1272

991

class ClientHandler(socketserver.BaseRequestHandler, object):

1273

992

"""A class to handle client connections.

1274

993

1276

995

Note: This will run in its own forked process."""

1277

996

1278

997

def handle(self):

1279

with contextlib.closing(self.server.child_pipe) as child_pipe:

1280

logger.info("TCP connection from: %s",

1281

unicode(self.client_address))

1282

logger.debug("Pipe FD: %d",

1283

self.server.child_pipe.fileno())

1284

998

logger.info(u"TCP connection from: %s",

999

unicode(self.client_address))

1000

logger.debug(u"IPC Pipe FD: %d",

1001

self.server.child_pipe[1].fileno())

1002

# Open IPC pipe to parent process

1003

with contextlib.nested(self.server.child_pipe[1],

1004

self.server.parent_pipe[0]

1005

) as (ipc, ipc_return):

1285

1006

session = (gnutls.connection

1286

1007

.ClientSession(self.request,

1287

1008

gnutls.connection

1292

1013

# no X.509 keys are added to it. Therefore, we can use it

1293

1014

# here despite using OpenPGP certificates.

1294

1015

1295

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1296

# "+AES-256-CBC", "+SHA1",

1297

# "+COMP-NULL", "+CTYPE-OPENPGP",

1298

# "+DHE-DSS"))

1016

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1017

# u"+AES-256-CBC", u"+SHA1",

1018

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1019

# u"+DHE-DSS"))

1299

1020

# Use a fallback default, since this MUST be set.

1300

1021

priority = self.server.gnutls_priority

1301

1022

if priority is None:

1302

priority = "NORMAL"

1023

priority = u"NORMAL"

1303

1024

(gnutls.library.functions

1304

1025

.gnutls_priority_set_direct(session._c_object,

1305

1026

priority, None))

1307

1028

# Start communication using the Mandos protocol

1308

1029

# Get protocol number

1309

1030

line = self.request.makefile().readline()

1310

logger.debug("Protocol version: %r", line)

1031

logger.debug(u"Protocol version: %r", line)

1311

1032

try:

1312

1033

if int(line.strip().split()[0]) > 1:

1313

1034

raise RuntimeError

1314

except (ValueError, IndexError, RuntimeError) as error:

1315

logger.error("Unknown protocol version: %s", error)

1035

except (ValueError, IndexError, RuntimeError), error:

1036

logger.error(u"Unknown protocol version: %s", error)

1316

1037

return

1317

1038

1318

1039

# Start GnuTLS connection

1319

1040

try:

1320

1041

session.handshake()

1321

except gnutls.errors.GNUTLSError as error:

1322

logger.warning("Handshake failed: %s", error)

1042

except gnutls.errors.GNUTLSError, error:

1043

logger.warning(u"Handshake failed: %s", error)

1323

1044

# Do not run session.bye() here: the session is not

1324

1045

# established. Just abandon the request.

1325

1046

return

1326

logger.debug("Handshake succeeded")

1327

1328

approval_required = False

1047

logger.debug(u"Handshake succeeded")

1329

1048

try:

1330

1049

try:

1331

1050

fpr = self.fingerprint(self.peer_certificate

1332

1051

(session))

1333

except (TypeError,

1334

gnutls.errors.GNUTLSError) as error:

1335

logger.warning("Bad certificate: %s", error)

1336

return

1337

logger.debug("Fingerprint: %s", fpr)

1338

1339

try:

1340

client = ProxyClient(child_pipe, fpr,

1341

self.client_address)

1342

except KeyError:

1343

return

1344

1345

if client.approval_delay:

1346

delay = client.approval_delay

1347

client.approvals_pending += 1

1348

approval_required = True

1349

1350

while True:

1351

if not client.enabled:

1352

logger.info("Client %s is disabled",

1353

client.name)

1354

if self.server.use_dbus:

1355

# Emit D-Bus signal

1356

client.Rejected("Disabled")

1357

return

1358

1359

if client._approved or not client.approval_delay:

1360

#We are approved or approval is disabled

1052

except (TypeError, gnutls.errors.GNUTLSError), error:

1053

logger.warning(u"Bad certificate: %s", error)

1054

return

1055

logger.debug(u"Fingerprint: %s", fpr)

1056

1057

for c in self.server.clients:

1058

if c.fingerprint == fpr:

1059

client = c

1361

1060

break

1362

elif client._approved is None:

1363

logger.info("Client %s needs approval",

1364

client.name)

1365

if self.server.use_dbus:

1366

# Emit D-Bus signal

1367

client.NeedApproval(

1368

client.approval_delay_milliseconds(),

1369

client.approved_by_default)

1370

else:

1371

logger.warning("Client %s was not approved",

1372

client.name)

1373

if self.server.use_dbus:

1374

# Emit D-Bus signal

1375

client.Rejected("Denied")

1376

return

1377

1378

#wait until timeout or approved

1379

#x = float(client._timedelta_to_milliseconds(delay))

1380

time = datetime.datetime.now()

1381

client.changedstate.acquire()

1382

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1383

client.changedstate.release()

1384

time2 = datetime.datetime.now()

1385

if (time2 - time) >= delay:

1386

if not client.approved_by_default:

1387

logger.warning("Client %s timed out while"

1388

" waiting for approval",

1389

client.name)

1390

if self.server.use_dbus:

1391

# Emit D-Bus signal

1392

client.Rejected("Approval timed out")

1393

return

1394

else:

1395

break

1396

else:

1397

delay -= time2 - time

1398

1061

else:

1062

ipc.write(u"NOTFOUND %s %s\n"

1063

% (fpr, unicode(self.client_address)))

1064

return

1065

1066

class ClientProxy(object):

1067

"""Client proxy object. Not for calling methods."""

1068

def __init__(self, client):

1069

self.client = client

1070

def __getattr__(self, name):

1071

if name.startswith("ipc_"):

1072

def tempfunc():

1073

ipc.write("%s %s\n" % (name[4:].upper(),

1074

self.client.name))

1075

return tempfunc

1076

if not hasattr(self.client, name):

1077

raise AttributeError

1078

ipc.write(u"GETATTR %s %s\n"

1079

% (name, self.client.fingerprint))

1080

return pickle.load(ipc_return)

1081

clientproxy = ClientProxy(client)

1082

# Have to check if client.enabled, since it is

1083

# possible that the client was disabled since the

1084

# GnuTLS session was established.

1085

if not clientproxy.enabled:

1086

clientproxy.ipc_disabled()

1087

return

1088

1089

clientproxy.ipc_sending()

1399

1090

sent_size = 0

1400

1091

while sent_size < len(client.secret):

1401

try:

1402

sent = session.send(client.secret[sent_size:])

1403

except gnutls.errors.GNUTLSError as error:

1404

logger.warning("gnutls send failed")

1405

return

1406

logger.debug("Sent: %d, remaining: %d",

1092

sent = session.send(client.secret[sent_size:])

1093

logger.debug(u"Sent: %d, remaining: %d",

1407

1094

sent, len(client.secret)

1408

1095

- (sent_size + sent))

1409

1096

sent_size += sent

1410

1411

logger.info("Sending secret to %s", client.name)

1412

# bump the timeout as if seen

1413

client.checked_ok(client.extended_timeout)

1414

if self.server.use_dbus:

1415

# Emit D-Bus signal

1416

client.GotSecret()

1417

1418

1097

finally:

1419

if approval_required:

1420

client.approvals_pending -= 1

1421

try:

1422

session.bye()

1423

except gnutls.errors.GNUTLSError as error:

1424

logger.warning("GnuTLS bye failed")

1098

session.bye()

1425

1099

1426

1100

@staticmethod

1427

1101

def peer_certificate(session):

1437

1111

.gnutls_certificate_get_peers

1438

1112

(session._c_object, ctypes.byref(list_size)))

1439

1113

if not bool(cert_list) and list_size.value != 0:

1440

raise gnutls.errors.GNUTLSError("error getting peer"

1441

" certificate")

1114

raise gnutls.errors.GNUTLSError(u"error getting peer"

1115

u" certificate")

1442

1116

if list_size.value == 0:

1443

1117

return None

1444

1118

cert = cert_list[0]

1470

1144

if crtverify.value != 0:

1471

1145

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1472

1146

raise (gnutls.errors.CertificateSecurityError

1473

("Verify failed"))

1147

(u"Verify failed"))

1474

1148

# New buffer for the fingerprint

1475

1149

buf = ctypes.create_string_buffer(20)

1476

1150

buf_len = ctypes.c_size_t()

1483

1157

# Convert the buffer to a Python bytestring

1484

1158

fpr = ctypes.string_at(buf, buf_len.value)

1485

1159

# Convert the bytestring to hexadecimal notation

1486

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1160

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1487

1161

return hex_fpr

1488

1162

1489

1163

1490

class MultiprocessingMixIn(object):

1491

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1492

def sub_process_main(self, request, address):

1493

try:

1494

self.finish_request(request, address)

1495

except:

1496

self.handle_error(request, address)

1497

self.close_request(request)

1498

1499

def process_request(self, request, address):

1500

"""Start a new process to process the request."""

1501

multiprocessing.Process(target = self.sub_process_main,

1502

args = (request, address)).start()

1503

1504

1505

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1506

""" adds a pipe to the MixIn """

1164

class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):

1165

"""Like socketserver.ForkingMixIn, but also pass a pipe pair."""

1507

1166

def process_request(self, request, client_address):

1508

1167

"""Overrides and wraps the original process_request().

1509

1168

1510

1169

This function creates a new pipe in self.pipe

1511

1170

"""

1512

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1513

1514

super(MultiprocessingMixInWithPipe,

1171

# Child writes to child_pipe

1172

self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))

1173

# Parent writes to parent_pipe

1174

self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))

1175

super(ForkingMixInWithPipes,

1515

1176

self).process_request(request, client_address)

1516

self.child_pipe.close()

1517

self.add_pipe(parent_pipe)

1518

1519

def add_pipe(self, parent_pipe):

1177

# Close unused ends for parent

1178

self.parent_pipe[0].close() # close read end

1179

self.child_pipe[1].close() # close write end

1180

self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])

1181

def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):

1520

1182

"""Dummy function; override as necessary"""

1521

raise NotImplementedError

1522

1523

1524

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1183

child_pipe_fd.close()

1184

parent_pipe_fd.close()

1185

1186

1187

class IPv6_TCPServer(ForkingMixInWithPipes,

1525

1188

socketserver.TCPServer, object):

1526

1189

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1527

1190

1543

1206

bind to an address or port if they were not specified."""

1544

1207

if self.interface is not None:

1545

1208

if SO_BINDTODEVICE is None:

1546

logger.error("SO_BINDTODEVICE does not exist;"

1547

" cannot bind to interface %s",

1209

logger.error(u"SO_BINDTODEVICE does not exist;"

1210

u" cannot bind to interface %s",

1548

1211

self.interface)

1549

1212

else:

1550

1213

try:

1551

1214

self.socket.setsockopt(socket.SOL_SOCKET,

1552

1215

SO_BINDTODEVICE,

1553

1216

str(self.interface

1554

+ '\0'))

1555

except socket.error as error:

1217

+ u'\0'))

1218

except socket.error, error:

1556

1219

if error[0] == errno.EPERM:

1557

logger.error("No permission to"

1558

" bind to interface %s",

1220

logger.error(u"No permission to"

1221

u" bind to interface %s",

1559

1222

self.interface)

1560

1223

elif error[0] == errno.ENOPROTOOPT:

1561

logger.error("SO_BINDTODEVICE not available;"

1562

" cannot bind to interface %s",

1224

logger.error(u"SO_BINDTODEVICE not available;"

1225

u" cannot bind to interface %s",

1563

1226

self.interface)

1564

1227

else:

1565

1228

raise

1567

1230

if self.server_address[0] or self.server_address[1]:

1568

1231

if not self.server_address[0]:

1569

1232

if self.address_family == socket.AF_INET6:

1570

any_address = "::" # in6addr_any

1233

any_address = u"::" # in6addr_any

1571

1234

else:

1572

1235

any_address = socket.INADDR_ANY

1573

1236

self.server_address = (any_address,

1612

1275

return socketserver.TCPServer.server_activate(self)

1613

1276

def enable(self):

1614

1277

self.enabled = True

1615

def add_pipe(self, parent_pipe):

1278

def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):

1616

1279

# Call "handle_ipc" for both data and EOF events

1617

gobject.io_add_watch(parent_pipe.fileno(),

1280

gobject.io_add_watch(child_pipe_fd.fileno(),

1618

1281

gobject.IO_IN | gobject.IO_HUP,

1619

1282

functools.partial(self.handle_ipc,

1620

parent_pipe = parent_pipe))

1621

1622

def handle_ipc(self, source, condition, parent_pipe=None,

1623

client_object=None):

1283

reply = parent_pipe_fd,

1284

sender= child_pipe_fd))

1285

def handle_ipc(self, source, condition, reply=None, sender=None):

1624

1286

condition_names = {

1625

gobject.IO_IN: "IN", # There is data to read.

1626

gobject.IO_OUT: "OUT", # Data can be written (without

1287

gobject.IO_IN: u"IN", # There is data to read.

1288

gobject.IO_OUT: u"OUT", # Data can be written (without

1627

1289

# blocking).

1628

gobject.IO_PRI: "PRI", # There is urgent data to read.

1629

gobject.IO_ERR: "ERR", # Error condition.

1630

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1290

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1291

gobject.IO_ERR: u"ERR", # Error condition.

1292

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1631

1293

# broken, usually for pipes and

1632

1294

# sockets).

1633

1295

}

1635

1297

for cond, name in

1636

1298

condition_names.iteritems()

1637

1299

if cond & condition)

1638

# error or the other end of multiprocessing.Pipe has closed

1639

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1640

return False

1641

1642

# Read a request from the child

1643

request = parent_pipe.recv()

1644

command = request[0]

1645

1646

if command == 'init':

1647

fpr = request[1]

1648

address = request[2]

1649

1650

for c in self.clients:

1651

if c.fingerprint == fpr:

1652

client = c

1653

break

1654

else:

1655

logger.info("Client not found for fingerprint: %s, ad"

1656

"dress: %s", fpr, address)

1657

if self.use_dbus:

1658

# Emit D-Bus signal

1659

mandos_dbus_service.ClientNotFound(fpr, address[0])

1660

parent_pipe.send(False)

1661

return False

1662

1663

gobject.io_add_watch(parent_pipe.fileno(),

1664

gobject.IO_IN | gobject.IO_HUP,

1665

functools.partial(self.handle_ipc,

1666

parent_pipe = parent_pipe,

1667

client_object = client))

1668

parent_pipe.send(True)

1669

# remove the old hook in favor of the new above hook on same fileno

1670

return False

1671

if command == 'funcall':

1672

funcname = request[1]

1673

args = request[2]

1674

kwargs = request[3]

1675

1676

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1677

1678

if command == 'getattr':

1679

attrname = request[1]

1680

if callable(client_object.__getattribute__(attrname)):

1681

parent_pipe.send(('function',))

1682

else:

1683

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1684

1685

if command == 'setattr':

1686

attrname = request[1]

1687

value = request[2]

1688

setattr(client_object, attrname, value)

1689

1300

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1301

conditions_string)

1302

1303

# Read a line from the file object

1304

cmdline = sender.readline()

1305

if not cmdline: # Empty line means end of file

1306

# close the IPC pipes

1307

sender.close()

1308

reply.close()

1309

1310

# Stop calling this function

1311

return False

1312

1313

logger.debug(u"IPC command: %r", cmdline)

1314

1315

# Parse and act on command

1316

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1317

1318

if cmd == u"NOTFOUND":

1319

fpr, address = args.split(None, 1)

1320

logger.warning(u"Client not found for fingerprint: %s, ad"

1321

u"dress: %s", fpr, address)

1322

if self.use_dbus:

1323

# Emit D-Bus signal

1324

mandos_dbus_service.ClientNotFound(fpr, address)

1325

elif cmd == u"DISABLED":

1326

for client in self.clients:

1327

if client.name == args:

1328

logger.warning(u"Client %s is disabled", args)

1329

if self.use_dbus:

1330

# Emit D-Bus signal

1331

client.Rejected()

1332

break

1333

else:

1334

logger.error(u"Unknown client %s is disabled", args)

1335

elif cmd == u"SENDING":

1336

for client in self.clients:

1337

if client.name == args:

1338

logger.info(u"Sending secret to %s", client.name)

1339

client.checked_ok()

1340

if self.use_dbus:

1341

# Emit D-Bus signal

1342

client.GotSecret()

1343

break

1344

else:

1345

logger.error(u"Sending secret to unknown client %s",

1346

args)

1347

elif cmd == u"GETATTR":

1348

attr_name, fpr = args.split(None, 1)

1349

for client in self.clients:

1350

if client.fingerprint == fpr:

1351

attr_value = getattr(client, attr_name, None)

1352

logger.debug("IPC reply: %r", attr_value)

1353

pickle.dump(attr_value, reply)

1354

break

1355

else:

1356

logger.error(u"Client %s on address %s requesting "

1357

u"attribute %s not found", fpr, address,

1358

attr_name)

1359

pickle.dump(None, reply)

1360

else:

1361

logger.error(u"Unknown IPC command: %r", cmdline)

1362

1363

# Keep calling this function

1690

1364

return True

1691

1365

1692

1366

1693

1367

def string_to_delta(interval):

1694

1368

"""Parse a string and return a datetime.timedelta

1695

1369

1696

>>> string_to_delta('7d')

1370

>>> string_to_delta(u'7d')

1697

1371

datetime.timedelta(7)

1698

>>> string_to_delta('60s')

1372

>>> string_to_delta(u'60s')

1699

1373

datetime.timedelta(0, 60)

1700

>>> string_to_delta('60m')

1374

>>> string_to_delta(u'60m')

1701

1375

datetime.timedelta(0, 3600)

1702

>>> string_to_delta('24h')

1376

>>> string_to_delta(u'24h')

1703

1377

datetime.timedelta(1)

1704

>>> string_to_delta('1w')

1378

>>> string_to_delta(u'1w')

1705

1379

datetime.timedelta(7)

1706

>>> string_to_delta('5m 30s')

1380

>>> string_to_delta(u'5m 30s')

1707

1381

datetime.timedelta(0, 330)

1708

1382

"""

1709

1383

timevalue = datetime.timedelta(0)

1711

1385

try:

1712

1386

suffix = unicode(s[-1])

1713

1387

value = int(s[:-1])

1714

if suffix == "d":

1388

if suffix == u"d":

1715

1389

delta = datetime.timedelta(value)

1716

elif suffix == "s":

1390

elif suffix == u"s":

1717

1391

delta = datetime.timedelta(0, value)

1718

elif suffix == "m":

1392

elif suffix == u"m":

1719

1393

delta = datetime.timedelta(0, 0, 0, 0, value)

1720

elif suffix == "h":

1394

elif suffix == u"h":

1721

1395

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1722

elif suffix == "w":

1396

elif suffix == u"w":

1723

1397

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1724

1398

else:

1725

raise ValueError("Unknown suffix %r" % suffix)

1726

except (ValueError, IndexError) as e:

1727

raise ValueError(*(e.args))

1399

raise ValueError(u"Unknown suffix %r" % suffix)

1400

except (ValueError, IndexError), e:

1401

raise ValueError(e.message)

1728

1402

timevalue += delta

1729

1403

return timevalue

1730

1404

1736

1410

global if_nametoindex

1737

1411

try:

1738

1412

if_nametoindex = (ctypes.cdll.LoadLibrary

1739

(ctypes.util.find_library("c"))

1413

(ctypes.util.find_library(u"c"))

1740

1414

.if_nametoindex)

1741

1415

except (OSError, AttributeError):

1742

logger.warning("Doing if_nametoindex the hard way")

1416

logger.warning(u"Doing if_nametoindex the hard way")

1743

1417

def if_nametoindex(interface):

1744

1418

"Get an interface index the hard way, i.e. using fcntl()"

1745

1419

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1746

1420

with contextlib.closing(socket.socket()) as s:

1747

1421

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1748

struct.pack(str("16s16x"),

1422

struct.pack(str(u"16s16x"),

1749

1423

interface))

1750

interface_index = struct.unpack(str("I"),

1424

interface_index = struct.unpack(str(u"I"),

1751

1425

ifreq[16:20])[0]

1752

1426

return interface_index

1753

1427

return if_nametoindex(interface)

1761

1435

sys.exit()

1762

1436

os.setsid()

1763

1437

if not nochdir:

1764

os.chdir("/")

1438

os.chdir(u"/")

1765

1439

if os.fork():

1766

1440

sys.exit()

1767

1441

if not noclose:

1769

1443

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1770

1444

if not stat.S_ISCHR(os.fstat(null).st_mode):

1771

1445

raise OSError(errno.ENODEV,

1772

"%s not a character device"

1446

u"%s not a character device"

1773

1447

% os.path.devnull)

1774

1448

os.dup2(null, sys.stdin.fileno())

1775

1449

os.dup2(null, sys.stdout.fileno())

1783

1457

##################################################################

1784

1458

# Parsing of options, both command line and config file

1785

1459

1786

parser = argparse.ArgumentParser()

1787

parser.add_argument("-v", "--version", action="version",

1788

version = "%%(prog)s %s" % version,

1789

help="show version number and exit")

1790

parser.add_argument("-i", "--interface", metavar="IF",

1791

help="Bind to interface IF")

1792

parser.add_argument("-a", "--address",

1793

help="Address to listen for requests on")

1794

parser.add_argument("-p", "--port", type=int,

1795

help="Port number to receive requests on")

1796

parser.add_argument("--check", action="store_true",

1797

help="Run self-test")

1798

parser.add_argument("--debug", action="store_true",

1799

help="Debug mode; run in foreground and log"

1800

" to terminal")

1801

parser.add_argument("--debuglevel", metavar="LEVEL",

1802

help="Debug level for stdout output")

1803

parser.add_argument("--priority", help="GnuTLS"

1804

" priority string (see GnuTLS documentation)")

1805

parser.add_argument("--servicename",

1806

metavar="NAME", help="Zeroconf service name")

1807

parser.add_argument("--configdir",

1808

default="/etc/mandos", metavar="DIR",

1809

help="Directory to search for configuration"

1810

" files")

1811

parser.add_argument("--no-dbus", action="store_false",

1812

dest="use_dbus", help="Do not provide D-Bus"

1813

" system bus interface")

1814

parser.add_argument("--no-ipv6", action="store_false",

1815

dest="use_ipv6", help="Do not use IPv6")

1816

options = parser.parse_args()

1460

parser = optparse.OptionParser(version = "%%prog %s" % version)

1461

parser.add_option("-i", u"--interface", type=u"string",

1462

metavar="IF", help=u"Bind to interface IF")

1463

parser.add_option("-a", u"--address", type=u"string",

1464

help=u"Address to listen for requests on")

1465

parser.add_option("-p", u"--port", type=u"int",

1466

help=u"Port number to receive requests on")

1467

parser.add_option("--check", action=u"store_true",

1468

help=u"Run self-test")

1469

parser.add_option("--debug", action=u"store_true",

1470

help=u"Debug mode; run in foreground and log to"

1471

u" terminal")

1472

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1473

u" priority string (see GnuTLS documentation)")

1474

parser.add_option("--servicename", type=u"string",

1475

metavar=u"NAME", help=u"Zeroconf service name")

1476

parser.add_option("--configdir", type=u"string",

1477

default=u"/etc/mandos", metavar=u"DIR",

1478

help=u"Directory to search for configuration"

1479

u" files")

1480

parser.add_option("--no-dbus", action=u"store_false",

1481

dest=u"use_dbus", help=u"Do not provide D-Bus"

1482

u" system bus interface")

1483

parser.add_option("--no-ipv6", action=u"store_false",

1484

dest=u"use_ipv6", help=u"Do not use IPv6")

1485

options = parser.parse_args()[0]

1817

1486

1818

1487

if options.check:

1819

1488

import doctest

1821

1490

sys.exit()

1822

1491

1823

1492

# Default values for config file for server-global settings

1824

server_defaults = { "interface": "",

1825

"address": "",

1826

"port": "",

1827

"debug": "False",

1828

"priority":

1829

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1830

"servicename": "Mandos",

1831

"use_dbus": "True",

1832

"use_ipv6": "True",

1833

"debuglevel": "",

1493

server_defaults = { u"interface": u"",

1494

u"address": u"",

1495

u"port": u"",

1496

u"debug": u"False",

1497

u"priority":

1498

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1499

u"servicename": u"Mandos",

1500

u"use_dbus": u"True",

1501

u"use_ipv6": u"True",

1834

1502

}

1835

1503

1836

1504

# Parse config file for server-global settings

1837

1505

server_config = configparser.SafeConfigParser(server_defaults)

1838

1506

del server_defaults

1839

1507

server_config.read(os.path.join(options.configdir,

1840

"mandos.conf"))

1508

u"mandos.conf"))

1841

1509

# Convert the SafeConfigParser object to a dict

1842

1510

server_settings = server_config.defaults()

1843

1511

# Use the appropriate methods on the non-string config options

1844

for option in ("debug", "use_dbus", "use_ipv6"):

1845

server_settings[option] = server_config.getboolean("DEFAULT",

1512

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1513

server_settings[option] = server_config.getboolean(u"DEFAULT",

1846

1514

option)

1847

1515

if server_settings["port"]:

1848

server_settings["port"] = server_config.getint("DEFAULT",

1849

"port")

1516

server_settings["port"] = server_config.getint(u"DEFAULT",

1517

u"port")

1850

1518

del server_config

1851

1519

1852

1520

# Override the settings from the config file with command line

1853

1521

# options, if set.

1854

for option in ("interface", "address", "port", "debug",

1855

"priority", "servicename", "configdir",

1856

"use_dbus", "use_ipv6", "debuglevel"):

1522

for option in (u"interface", u"address", u"port", u"debug",

1523

u"priority", u"servicename", u"configdir",

1524

u"use_dbus", u"use_ipv6"):

1857

1525

value = getattr(options, option)

1858

1526

if value is not None:

1859

1527

server_settings[option] = value

1867

1535

##################################################################

1868

1536

1869

1537

# For convenience

1870

debug = server_settings["debug"]

1871

debuglevel = server_settings["debuglevel"]

1872

use_dbus = server_settings["use_dbus"]

1873

use_ipv6 = server_settings["use_ipv6"]

1874

1875

if server_settings["servicename"] != "Mandos":

1538

debug = server_settings[u"debug"]

1539

use_dbus = server_settings[u"use_dbus"]

1540

use_ipv6 = server_settings[u"use_ipv6"]

1541

1542

if not debug:

1543

syslogger.setLevel(logging.WARNING)

1544

console.setLevel(logging.WARNING)

1545

1546

if server_settings[u"servicename"] != u"Mandos":

1876

1547

syslogger.setFormatter(logging.Formatter

1877

('Mandos (%s) [%%(process)d]:'

1878

' %%(levelname)s: %%(message)s'

1879

% server_settings["servicename"]))

1548

(u'Mandos (%s) [%%(process)d]:'

1549

u' %%(levelname)s: %%(message)s'

1550

% server_settings[u"servicename"]))

1880

1551

1881

1552

# Parse config file with clients

1882

client_defaults = { "timeout": "5m",

1883

"extended_timeout": "15m",

1884

"interval": "2m",

1885

"checker": "fping -q -- %%(host)s",

1886

"host": "",

1887

"approval_delay": "0s",

1888

"approval_duration": "1s",

1553

client_defaults = { u"timeout": u"1h",

1554

u"interval": u"5m",

1555

u"checker": u"fping -q -- %%(host)s",

1556

u"host": u"",

1889

1557

}

1890

1558

client_config = configparser.SafeConfigParser(client_defaults)

1891

client_config.read(os.path.join(server_settings["configdir"],

1892

"clients.conf"))

1559

client_config.read(os.path.join(server_settings[u"configdir"],

1560

u"clients.conf"))

1893

1561

1894

1562

global mandos_dbus_service

1895

1563

mandos_dbus_service = None

1896

1564

1897

tcp_server = MandosServer((server_settings["address"],

1898

server_settings["port"]),

1565

tcp_server = MandosServer((server_settings[u"address"],

1566

server_settings[u"port"]),

1899

1567

ClientHandler,

1900

interface=(server_settings["interface"]

1568

interface=(server_settings[u"interface"]

1901

1569

or None),

1902

1570

use_ipv6=use_ipv6,

1903

1571

gnutls_priority=

1904

server_settings["priority"],

1572

server_settings[u"priority"],

1905

1573

use_dbus=use_dbus)

1906

if not debug:

1907

pidfilename = "/var/run/mandos.pid"

1908

try:

1909

pidfile = open(pidfilename, "w")

1910

except IOError:

1911

logger.error("Could not open file %r", pidfilename)

1574

pidfilename = u"/var/run/mandos.pid"

1575

try:

1576

pidfile = open(pidfilename, u"w")

1577

except IOError:

1578

logger.error(u"Could not open file %r", pidfilename)

1912

1579

1913

1580

try:

1914

uid = pwd.getpwnam("_mandos").pw_uid

1915

gid = pwd.getpwnam("_mandos").pw_gid

1581

uid = pwd.getpwnam(u"_mandos").pw_uid

1582

gid = pwd.getpwnam(u"_mandos").pw_gid

1916

1583

except KeyError:

1917

1584

try:

1918

uid = pwd.getpwnam("mandos").pw_uid

1919

gid = pwd.getpwnam("mandos").pw_gid

1585

uid = pwd.getpwnam(u"mandos").pw_uid

1586

gid = pwd.getpwnam(u"mandos").pw_gid

1920

1587

except KeyError:

1921

1588

try:

1922

uid = pwd.getpwnam("nobody").pw_uid

1923

gid = pwd.getpwnam("nobody").pw_gid

1589

uid = pwd.getpwnam(u"nobody").pw_uid

1590

gid = pwd.getpwnam(u"nobody").pw_gid

1924

1591

except KeyError:

1925

1592

uid = 65534

1926

1593

gid = 65534

1927

1594

try:

1928

1595

os.setgid(gid)

1929

1596

os.setuid(uid)

1930

except OSError as error:

1597

except OSError, error:

1931

1598

if error[0] != errno.EPERM:

1932

1599

raise error

1933

1600

1934

if not debug and not debuglevel:

1935

syslogger.setLevel(logging.WARNING)

1936

console.setLevel(logging.WARNING)

1937

if debuglevel:

1938

level = getattr(logging, debuglevel.upper())

1939

syslogger.setLevel(level)

1940

console.setLevel(level)

1941

1601

# Enable all possible GnuTLS debugging

1942

1602

if debug:

1943

# Enable all possible GnuTLS debugging

1944

1945

1603

# "Use a log level over 10 to enable all debugging options."

1946

1604

# - GnuTLS manual

1947

1605

gnutls.library.functions.gnutls_global_set_log_level(11)

1948

1606

1949

1607

@gnutls.library.types.gnutls_log_func

1950

1608

def debug_gnutls(level, string):

1951

logger.debug("GnuTLS: %s", string[:-1])

1609

logger.debug(u"GnuTLS: %s", string[:-1])

1952

1610

1953

1611

(gnutls.library.functions

1954

1612

.gnutls_global_set_log_function(debug_gnutls))

1955

1956

# Redirect stdin so all checkers get /dev/null

1957

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1958

os.dup2(null, sys.stdin.fileno())

1959

if null > 2:

1960

os.close(null)

1961

else:

1962

# No console logging

1963

logger.removeHandler(console)

1964

1965

# Need to fork before connecting to D-Bus

1966

if not debug:

1967

# Close all input and output, do double fork, etc.

1968

daemon()

1969

1613

1970

1614

global main_loop

1971

1615

# From the Avahi example code

1975

1619

# End of Avahi example code

1976

1620

if use_dbus:

1977

1621

try:

1978

bus_name = dbus.service.BusName("se.recompile.Mandos",

1622

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1979

1623

bus, do_not_queue=True)

1980

old_bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1981

bus, do_not_queue=True)

1982

except dbus.exceptions.NameExistsException as e:

1983

logger.error(unicode(e) + ", disabling D-Bus")

1624

except dbus.exceptions.NameExistsException, e:

1625

logger.error(unicode(e) + u", disabling D-Bus")

1984

1626

use_dbus = False

1985

server_settings["use_dbus"] = False

1627

server_settings[u"use_dbus"] = False

1986

1628

tcp_server.use_dbus = False

1987

1629

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1988

service = AvahiService(name = server_settings["servicename"],

1989

servicetype = "_mandos._tcp",

1630

service = AvahiService(name = server_settings[u"servicename"],

1631

servicetype = u"_mandos._tcp",

1990

1632

protocol = protocol, bus = bus)

1991

1633

if server_settings["interface"]:

1992

1634

service.interface = (if_nametoindex

1993

(str(server_settings["interface"])))

1994

1995

global multiprocessing_manager

1996

multiprocessing_manager = multiprocessing.Manager()

1635

(str(server_settings[u"interface"])))

1997

1636

1998

1637

client_class = Client

1999

1638

if use_dbus:

2000

client_class = functools.partial(ClientDBusTransitional, bus = bus)

2001

def client_config_items(config, section):

2002

special_settings = {

2003

"approved_by_default":

2004

lambda: config.getboolean(section,

2005

"approved_by_default"),

2006

}

2007

for name, value in config.items(section):

2008

try:

2009

yield (name, special_settings[name]())

2010

except KeyError:

2011

yield (name, value)

2012

1639

client_class = functools.partial(ClientDBus, bus = bus)

2013

1640

tcp_server.clients.update(set(

2014

1641

client_class(name = section,

2015

config= dict(client_config_items(

2016

client_config, section)))

1642

config= dict(client_config.items(section)))

2017

1643

for section in client_config.sections()))

2018

1644

if not tcp_server.clients:

2019

logger.warning("No clients defined")

2020

1645

logger.warning(u"No clients defined")

1646

1647

if debug:

1648

# Redirect stdin so all checkers get /dev/null

1649

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1650

os.dup2(null, sys.stdin.fileno())

1651

if null > 2:

1652

os.close(null)

1653

else:

1654

# No console logging

1655

logger.removeHandler(console)

1656

# Close all input and output, do double fork, etc.

1657

daemon()

1658

1659

try:

1660

with pidfile:

1661

pid = os.getpid()

1662

pidfile.write(str(pid) + "\n")

1663

del pidfile

1664

except IOError:

1665

logger.error(u"Could not write to file %r with PID %d",

1666

pidfilename, pid)

1667

except NameError:

1668

# "pidfile" was never created

1669

pass

1670

del pidfilename

1671

2021

1672

if not debug:

2022

try:

2023

with pidfile:

2024

pid = os.getpid()

2025

pidfile.write(str(pid) + "\n".encode("utf-8"))

2026

del pidfile

2027

except IOError:

2028

logger.error("Could not write to file %r with PID %d",

2029

pidfilename, pid)

2030

except NameError:

2031

# "pidfile" was never created

2032

pass

2033

del pidfilename

2034

2035

1673

signal.signal(signal.SIGINT, signal.SIG_IGN)

2036

2037

1674

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2038

1675

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2039

1676

2041

1678

class MandosDBusService(dbus.service.Object):

2042

1679

"""A D-Bus proxy object"""

2043

1680

def __init__(self):

2044

dbus.service.Object.__init__(self, bus, "/")

2045

_interface = "se.recompile.Mandos"

1681

dbus.service.Object.__init__(self, bus, u"/")

1682

_interface = u"se.bsnet.fukt.Mandos"

2046

1683

2047

@dbus.service.signal(_interface, signature="o")

1684

@dbus.service.signal(_interface, signature=u"o")

2048

1685

def ClientAdded(self, objpath):

2049

1686

"D-Bus signal"

2050

1687

pass

2051

1688

2052

@dbus.service.signal(_interface, signature="ss")

1689

@dbus.service.signal(_interface, signature=u"ss")

2053

1690

def ClientNotFound(self, fingerprint, address):

2054

1691

"D-Bus signal"

2055

1692

pass

2056

1693

2057

@dbus.service.signal(_interface, signature="os")

1694

@dbus.service.signal(_interface, signature=u"os")

2058

1695

def ClientRemoved(self, objpath, name):

2059

1696

"D-Bus signal"

2060

1697

pass

2061

1698

2062

@dbus.service.method(_interface, out_signature="ao")

1699

@dbus.service.method(_interface, out_signature=u"ao")

2063

1700

def GetAllClients(self):

2064

1701

"D-Bus method"

2065

1702

return dbus.Array(c.dbus_object_path

2066

1703

for c in tcp_server.clients)

2067

1704

2068

1705

@dbus.service.method(_interface,

2069

out_signature="a{oa{sv}}")

1706

out_signature=u"a{oa{sv}}")

2070

1707

def GetAllClientsWithProperties(self):

2071

1708

"D-Bus method"

2072

1709

return dbus.Dictionary(

2073

((c.dbus_object_path, c.GetAll(""))

1710

((c.dbus_object_path, c.GetAll(u""))

2074

1711

for c in tcp_server.clients),

2075

signature="oa{sv}")

1712

signature=u"oa{sv}")

2076

1713

2077

@dbus.service.method(_interface, in_signature="o")

1714

@dbus.service.method(_interface, in_signature=u"o")

2078

1715

def RemoveClient(self, object_path):

2079

1716

"D-Bus method"

2080

1717

for c in tcp_server.clients:

2090

1727

2091

1728

del _interface

2092

1729

2093

class MandosDBusServiceTransitional(MandosDBusService):

2094

__metaclass__ = AlternateDBusNamesMetaclass

2095

mandos_dbus_service = MandosDBusServiceTransitional()

1730

mandos_dbus_service = MandosDBusService()

2096

1731

2097

1732

def cleanup():

2098

1733

"Cleanup function; run on exit"

2124

1759

# Find out what port we got

2125

1760

service.port = tcp_server.socket.getsockname()[1]

2126

1761

if use_ipv6:

2127

logger.info("Now listening on address %r, port %d,"

1762

logger.info(u"Now listening on address %r, port %d,"

2128

1763

" flowinfo %d, scope_id %d"

2129

1764

% tcp_server.socket.getsockname())

2130

1765

else: # IPv4

2131

logger.info("Now listening on address %r, port %d"

1766

logger.info(u"Now listening on address %r, port %d"

2132

1767

% tcp_server.socket.getsockname())

2133

1768

2134

1769

#service.interface = tcp_server.socket.getsockname()[3]

2137

1772

# From the Avahi example code

2138

1773

try:

2139

1774

service.activate()

2140

except dbus.exceptions.DBusException as error:

2141

logger.critical("DBusException: %s", error)

1775

except dbus.exceptions.DBusException, error:

1776

logger.critical(u"DBusException: %s", error)

2142

1777

cleanup()

2143

1778

sys.exit(1)

2144

1779

# End of Avahi example code

2148

1783

(tcp_server.handle_request

2149

1784

(*args[2:], **kwargs) or True))

2150

1785

2151

logger.debug("Starting main loop")

1786

logger.debug(u"Starting main loop")

2152

1787

main_loop.run()

2153

except AvahiError as error:

2154

logger.critical("AvahiError: %s", error)

1788

except AvahiError, error:

1789

logger.critical(u"AvahiError: %s", error)

2155

1790

cleanup()

2156

1791

sys.exit(1)

2157

1792

except KeyboardInterrupt:

2158

1793

if debug:

2159

print("", file=sys.stderr)

2160

logger.debug("Server received KeyboardInterrupt")

2161

logger.debug("Server exiting")

1794

print >> sys.stderr

1795

logger.debug(u"Server received KeyboardInterrupt")

1796

logger.debug(u"Server exiting")

2162

1797

# Must run before the D-Bus bus name gets deregistered

2163

1798

cleanup()

2164

1799

2165

2166

1800

if __name__ == '__main__':

2167

1801

main()