/mandos/release : revision 237.7.47

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

81

82

SO_BINDTODEVICE = None

82

83

84

version = "1.0.14"

85

version = "1.3.1"

85

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

88

89

syslogger = (logging.handlers.SysLogHandler

89

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

90

address = "/dev/log"))

91

address = str("/dev/log")))

91

92

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

94

95

logger.addHandler(syslogger)

95

96

97

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

100

101

logger.addHandler(console)

101

102

103

class AvahiError(Exception):

119

120

Attributes:

120

121

interface: integer; avahi.IF_UNSPEC or an interface index.

121

122

Used to optionally bind to the specified interface.

122

123

type: string; Example: u'_mandos._tcp'.

123

124

type: string; Example: '_mandos._tcp'.

124

125

See <http://www.dns-sd.org/ServiceTypes.html>

125

126

port: integer; what port to announce

126

127

TXT: list of strings; TXT record for the service

135

136

"""

136

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

137

138

servicetype = None, port = None, TXT = None,

138

domain = u"", host = u"", max_renames = 32768,

139

domain = "", host = "", max_renames = 32768,

139

140

protocol = avahi.PROTO_UNSPEC, bus = None):

140

141

self.interface = interface

141

142

self.name = name

150

151

self.group = None # our entry group

151

152

self.server = None

152

153

self.bus = bus

154

self.entry_group_state_changed_match = None

153

155

def rename(self):

154

156

"""Derived from the Avahi example code"""

155

157

if self.rename_count >= self.max_renames:

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

158

logger.critical("No suitable Zeroconf service name found"

159

" after %i retries, exiting.",

158

160

self.rename_count)

159

raise AvahiServiceError(u"Too many renames")

161

raise AvahiServiceError("Too many renames")

160

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

163

logger.info("Changing Zeroconf service name to %r ...",

162

164

self.name)

163

165

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

166

168

% self.name))

167

169

self.remove()

168

170

try:

169

171

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

172

except dbus.exceptions.DBusException as error:

173

logger.critical("DBusException: %s", error)

172

174

self.cleanup()

173

175

os._exit(1)

174

176

self.rename_count += 1

175

177

def remove(self):

176

178

"""Derived from the Avahi example code"""

179

if self.entry_group_state_changed_match is not None:

180

self.entry_group_state_changed_match.remove()

181

self.entry_group_state_changed_match = None

177

182

if self.group is not None:

178

183

self.group.Reset()

179

184

def add(self):

180

185

"""Derived from the Avahi example code"""

186

self.remove()

181

187

if self.group is None:

182

188

self.group = dbus.Interface(

183

189

self.bus.get_object(avahi.DBUS_NAME,

184

190

self.server.EntryGroupNew()),

185

191

avahi.DBUS_INTERFACE_ENTRY_GROUP)

186

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

192

self.entry_group_state_changed_match = (

193

self.group.connect_to_signal(

194

'StateChanged', self .entry_group_state_changed))

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

190

196

self.name, self.type)

191

197

self.group.AddService(

192

198

self.interface,

199

205

self.group.Commit()

200

206

def entry_group_state_changed(self, state, error):

201

207

"""Derived from the Avahi example code"""

202

logger.debug(u"Avahi entry group state change: %i", state)

208

logger.debug("Avahi entry group state change: %i", state)

203

209

204

210

if state == avahi.ENTRY_GROUP_ESTABLISHED:

205

logger.debug(u"Zeroconf service established.")

211

logger.debug("Zeroconf service established.")

206

212

elif state == avahi.ENTRY_GROUP_COLLISION:

207

logger.warning(u"Zeroconf service name collision.")

213

logger.info("Zeroconf service name collision.")

208

214

self.rename()

209

215

elif state == avahi.ENTRY_GROUP_FAILURE:

210

logger.critical(u"Avahi: Error in group state changed %s",

216

logger.critical("Avahi: Error in group state changed %s",

211

217

unicode(error))

212

raise AvahiGroupError(u"State changed: %s"

218

raise AvahiGroupError("State changed: %s"

213

219

% unicode(error))

214

220

def cleanup(self):

215

221

"""Derived from the Avahi example code"""

216

222

if self.group is not None:

217

self.group.Free()

223

try:

224

self.group.Free()

225

except (dbus.exceptions.UnknownMethodException,

226

dbus.exceptions.DBusException) as e:

227

pass

218

228

self.group = None

219

def server_state_changed(self, state):

229

self.remove()

230

def server_state_changed(self, state, error=None):

220

231

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

222

if state == avahi.SERVER_COLLISION:

223

logger.error(u"Zeroconf server name collision")

224

self.remove()

232

logger.debug("Avahi server state change: %i", state)

233

bad_states = { avahi.SERVER_INVALID:

234

"Zeroconf server invalid",

235

avahi.SERVER_REGISTERING: None,

236

avahi.SERVER_COLLISION:

237

"Zeroconf server name collision",

238

avahi.SERVER_FAILURE:

239

"Zeroconf server failure" }

240

if state in bad_states:

241

if bad_states[state] is not None:

242

if error is None:

243

logger.error(bad_states[state])

244

else:

245

logger.error(bad_states[state] + ": %r", error)

246

self.cleanup()

225

247

elif state == avahi.SERVER_RUNNING:

226

248

self.add()

249

else:

250

if error is None:

251

logger.debug("Unknown state: %r", state)

252

else:

253

logger.debug("Unknown state: %r: %r", state, error)

227

254

def activate(self):

228

255

"""Derived from the Avahi example code"""

229

256

if self.server is None:

230

257

self.server = dbus.Interface(

231

258

self.bus.get_object(avahi.DBUS_NAME,

232

avahi.DBUS_PATH_SERVER),

259

avahi.DBUS_PATH_SERVER,

260

follow_name_owner_changes=True),

233

261

avahi.DBUS_INTERFACE_SERVER)

234

self.server.connect_to_signal(u"StateChanged",

262

self.server.connect_to_signal("StateChanged",

235

263

self.server_state_changed)

236

264

self.server_state_changed(self.server.GetState())

237

265

240

268

"""A representation of a client host served by this server.

241

269

242

270

Attributes:

243

244

D-Bus identifiers

271

_approved: bool(); 'None' if not yet approved/disapproved

272

approval_delay: datetime.timedelta(); Time to wait for approval

273

approval_duration: datetime.timedelta(); Duration of one approval

274

checker: subprocess.Popen(); a running checker process used

275

to see if the client lives.

276

'None' if no process is running.

277

checker_callback_tag: a gobject event source tag, or None

278

checker_command: string; External command which is run to check

279

if client lives. %() expansions are done at

280

runtime with vars(self) as dict, so that for

281

instance %(name)s can be used in the command.

282

checker_initiator_tag: a gobject event source tag, or None

283

created: datetime.datetime(); (UTC) object creation

284

current_checker_command: string; current running checker_command

285

disable_hook: If set, called by disable() as disable_hook(self)

286

disable_initiator_tag: a gobject event source tag, or None

287

enabled: bool()

245

288

fingerprint: string (40 or 32 hexadecimal digits); used to

246

289

uniquely identify the client

247

secret: bytestring; sent verbatim (over TLS) to client

248

290

host: string; available for use by the checker command

249

created: datetime.datetime(); (UTC) object creation

291

interval: datetime.timedelta(); How often to start a new checker

292

last_approval_request: datetime.datetime(); (UTC) or None

293

last_checked_ok: datetime.datetime(); (UTC) or None

250

294

last_enabled: datetime.datetime(); (UTC)

251

enabled: bool()

252

last_checked_ok: datetime.datetime(); (UTC) or None

295

296

D-Bus identifiers

297

secret: bytestring; sent verbatim (over TLS) to client

253

298

timeout: datetime.timedelta(); How long from last_checked_ok

254

299

until this client is disabled

255

interval: datetime.timedelta(); How often to start a new checker

256

disable_hook: If set, called by disable() as disable_hook(self)

257

checker: subprocess.Popen(); a running checker process used

258

to see if the client lives.

259

'None' if no process is running.

260

checker_initiator_tag: a gobject event source tag, or None

261

disable_initiator_tag: - '' -

262

checker_callback_tag: - '' -

263

checker_command: string; External command which is run to check if

264

client lives. %() expansions are done at

265

runtime with vars(self) as dict, so that for

266

instance %(name)s can be used in the command.

267

current_checker_command: string; current running checker_command

268

approved_delay: datetime.timedelta(); Time to wait for approval

269

_approved: bool(); 'None' if not yet approved/disapproved

270

approved_duration: datetime.timedelta(); Duration of one approval

300

extended_timeout: extra long timeout when password has been sent

301

runtime_expansions: Allowed attributes for runtime expansion.

302

expires: datetime.datetime(); time (UTC) when a client will be

303

disabled, or None

271

304

"""

272

305

306

runtime_expansions = ("approval_delay", "approval_duration",

307

"created", "enabled", "fingerprint",

308

"host", "interval", "last_checked_ok",

309

"last_enabled", "name", "timeout")

310

273

311

@staticmethod

274

312

def _timedelta_to_milliseconds(td):

275

313

"Convert a datetime.timedelta() to milliseconds"

280

318

def timeout_milliseconds(self):

281

319

"Return the 'timeout' attribute in milliseconds"

282

320

return self._timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return self._timedelta_to_milliseconds(self.extended_timeout)

283

325

284

326

def interval_milliseconds(self):

285

327

"Return the 'interval' attribute in milliseconds"

286

328

return self._timedelta_to_milliseconds(self.interval)

287

329

288

def approved_delay_milliseconds(self):

289

return self._timedelta_to_milliseconds(self.approved_delay)

330

def approval_delay_milliseconds(self):

331

return self._timedelta_to_milliseconds(self.approval_delay)

290

332

291

333

def __init__(self, name = None, disable_hook=None, config=None):

292

334

"""Note: the 'checker' key in 'config' sets the

295

337

self.name = name

296

338

if config is None:

297

339

config = {}

298

logger.debug(u"Creating client %r", self.name)

340

logger.debug("Creating client %r", self.name)

299

341

# Uppercase and remove spaces from fingerprint for later

300

342

# comparison purposes with return value from the fingerprint()

301

343

# function

302

self.fingerprint = (config[u"fingerprint"].upper()

303

.replace(u" ", u""))

304

logger.debug(u" Fingerprint: %s", self.fingerprint)

305

if u"secret" in config:

306

self.secret = config[u"secret"].decode(u"base64")

307

elif u"secfile" in config:

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

308

350

with open(os.path.expanduser(os.path.expandvars

309

(config[u"secfile"])),

351

(config["secfile"])),

310

352

"rb") as secfile:

311

353

self.secret = secfile.read()

312

354

else:

313

raise TypeError(u"No secret or secfile for client %s"

355

raise TypeError("No secret or secfile for client %s"

314

356

% self.name)

315

self.host = config.get(u"host", u"")

357

self.host = config.get("host", "")

316

358

self.created = datetime.datetime.utcnow()

317

359

self.enabled = False

360

self.last_approval_request = None

318

361

self.last_enabled = None

319

362

self.last_checked_ok = None

320

self.timeout = string_to_delta(config[u"timeout"])

321

self.interval = string_to_delta(config[u"interval"])

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

322

366

self.disable_hook = disable_hook

323

367

self.checker = None

324

368

self.checker_initiator_tag = None

325

369

self.disable_initiator_tag = None

370

self.expires = None

326

371

self.checker_callback_tag = None

327

self.checker_command = config[u"checker"]

372

self.checker_command = config["checker"]

328

373

self.current_checker_command = None

329

374

self.last_connect = None

330

375

self._approved = None

331

self.approved_by_default = config.get(u"approved_by_default",

376

self.approved_by_default = config.get("approved_by_default",

332

377

True)

333

378

self.approvals_pending = 0

334

self.approved_delay = string_to_delta(

335

config[u"approved_delay"])

336

self.approved_duration = string_to_delta(

337

config[u"approved_duration"])

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

338

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

339

384

340

385

def send_changedstate(self):

344

389

345

390

def enable(self):

346

391

"""Start this client's checker and timeout hooks"""

347

if getattr(self, u"enabled", False):

392

if getattr(self, "enabled", False):

348

393

# Already enabled

349

394

return

350

395

self.send_changedstate()

355

400

(self.interval_milliseconds(),

356

401

self.start_checker))

357

402

# Schedule a disable() when 'timeout' has passed

403

self.expires = datetime.datetime.utcnow() + self.timeout

358

404

self.disable_initiator_tag = (gobject.timeout_add

359

405

(self.timeout_milliseconds(),

360

406

self.disable))

369

415

if not quiet:

370

416

self.send_changedstate()

371

417

if not quiet:

372

logger.info(u"Disabling client %s", self.name)

373

if getattr(self, u"disable_initiator_tag", False):

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

374

420

gobject.source_remove(self.disable_initiator_tag)

375

421

self.disable_initiator_tag = None

376

if getattr(self, u"checker_initiator_tag", False):

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

377

424

gobject.source_remove(self.checker_initiator_tag)

378

425

self.checker_initiator_tag = None

379

426

self.stop_checker()

394

441

if os.WIFEXITED(condition):

395

442

exitstatus = os.WEXITSTATUS(condition)

396

443

if exitstatus == 0:

397

logger.info(u"Checker for %(name)s succeeded",

444

logger.info("Checker for %(name)s succeeded",

398

445

vars(self))

399

446

self.checked_ok()

400

447

else:

401

logger.info(u"Checker for %(name)s failed",

448

logger.info("Checker for %(name)s failed",

402

449

vars(self))

403

450

else:

404

logger.warning(u"Checker for %(name)s crashed?",

451

logger.warning("Checker for %(name)s crashed?",

405

452

vars(self))

406

453

407

def checked_ok(self):

454

def checked_ok(self, timeout=None):

408

455

"""Bump up the timeout for this client.

409

456

410

457

This should only be called when the client has been seen,

411

458

alive and well.

412

459

"""

460

if timeout is None:

461

timeout = self.timeout

413

462

self.last_checked_ok = datetime.datetime.utcnow()

414

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

415

465

self.disable_initiator_tag = (gobject.timeout_add

416

(self.timeout_milliseconds(),

466

(self._timedelta_to_milliseconds(timeout),

417

467

self.disable))

418

468

469

def need_approval(self):

470

self.last_approval_request = datetime.datetime.utcnow()

471

419

472

def start_checker(self):

420

473

"""Start a new checker subprocess if one is not running.

421

474

433

486

# If a checker exists, make sure it is not a zombie

434

487

try:

435

488

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

436

except (AttributeError, OSError), error:

489

except (AttributeError, OSError) as error:

437

490

if (isinstance(error, OSError)

438

491

and error.errno != errno.ECHILD):

439

492

raise error

440

493

else:

441

494

if pid:

442

logger.warning(u"Checker was a zombie")

495

logger.warning("Checker was a zombie")

443

496

gobject.source_remove(self.checker_callback_tag)

444

497

self.checker_callback(pid, status,

445

498

self.current_checker_command)

450

503

command = self.checker_command % self.host

451

504

except TypeError:

452

505

# Escape attributes for the shell

453

escaped_attrs = dict((key,

454

re.escape(unicode(str(val),

455

errors=

456

u'replace')))

457

for key, val in

458

vars(self).iteritems())

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

459

514

try:

460

515

command = self.checker_command % escaped_attrs

461

except TypeError, error:

462

logger.error(u'Could not format string "%s":'

463

u' %s', self.checker_command, error)

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

464

519

return True # Try again later

465

520

self.current_checker_command = command

466

521

try:

467

logger.info(u"Starting checker %r for %s",

522

logger.info("Starting checker %r for %s",

468

523

command, self.name)

469

524

# We don't need to redirect stdout and stderr, since

470

525

# in normal mode, that is already done by daemon(),

472

527

# always replaced by /dev/null.)

473

528

self.checker = subprocess.Popen(command,

474

529

close_fds=True,

475

shell=True, cwd=u"/")

530

shell=True, cwd="/")

476

531

self.checker_callback_tag = (gobject.child_watch_add

477

532

(self.checker.pid,

478

533

self.checker_callback,

483

538

if pid:

484

539

gobject.source_remove(self.checker_callback_tag)

485

540

self.checker_callback(pid, status, command)

486

except OSError, error:

487

logger.error(u"Failed to start subprocess: %s",

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

488

543

error)

489

544

# Re-run this periodically if run by gobject.timeout_add

490

545

return True

494

549

if self.checker_callback_tag:

495

550

gobject.source_remove(self.checker_callback_tag)

496

551

self.checker_callback_tag = None

497

if getattr(self, u"checker", None) is None:

552

if getattr(self, "checker", None) is None:

498

553

return

499

logger.debug(u"Stopping checker for %(name)s", vars(self))

554

logger.debug("Stopping checker for %(name)s", vars(self))

500

555

try:

501

556

os.kill(self.checker.pid, signal.SIGTERM)

502

557

#time.sleep(0.5)

503

558

#if self.checker.poll() is None:

504

559

# os.kill(self.checker.pid, signal.SIGKILL)

505

except OSError, error:

560

except OSError as error:

506

561

if error.errno != errno.ESRCH: # No such process

507

562

raise

508

563

self.checker = None

509

564

510

def dbus_service_property(dbus_interface, signature=u"v",

511

access=u"readwrite", byte_arrays=False):

565

def dbus_service_property(dbus_interface, signature="v",

566

access="readwrite", byte_arrays=False):

512

567

"""Decorators for marking methods of a DBusObjectWithProperties to

513

568

become properties on the D-Bus.

514

569

521

576

"""

522

577

# Encoding deeply encoded byte arrays is not supported yet by the

523

578

# "Set" method, so we fail early here:

524

if byte_arrays and signature != u"ay":

525

raise ValueError(u"Byte arrays not supported for non-'ay'"

526

u" signature %r" % signature)

579

if byte_arrays and signature != "ay":

580

raise ValueError("Byte arrays not supported for non-'ay'"

581

" signature %r" % signature)

527

582

def decorator(func):

528

583

func._dbus_is_property = True

529

584

func._dbus_interface = dbus_interface

530

585

func._dbus_signature = signature

531

586

func._dbus_access = access

532

587

func._dbus_name = func.__name__

533

if func._dbus_name.endswith(u"_dbus_property"):

588

if func._dbus_name.endswith("_dbus_property"):

534

589

func._dbus_name = func._dbus_name[:-14]

535

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

590

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

536

591

return func

537

592

return decorator

538

593

566

621

567

622

@staticmethod

568

623

def _is_dbus_property(obj):

569

return getattr(obj, u"_dbus_is_property", False)

624

return getattr(obj, "_dbus_is_property", False)

570

625

571

626

def _get_all_dbus_properties(self):

572

627

"""Returns a generator of (name, attribute) pairs

580

635

property with the specified name and interface.

581

636

"""

582

637

for name in (property_name,

583

property_name + u"_dbus_property"):

638

property_name + "_dbus_property"):

584

639

prop = getattr(self, name, None)

585

640

if (prop is None

586

641

or not self._is_dbus_property(prop)

590

645

continue

591

646

return prop

592

647

# No such property

593

raise DBusPropertyNotFound(self.dbus_object_path + u":"

594

+ interface_name + u"."

648

raise DBusPropertyNotFound(self.dbus_object_path + ":"

649

+ interface_name + "."

595

650

+ property_name)

596

651

597

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

598

out_signature=u"v")

652

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

653

out_signature="v")

599

654

def Get(self, interface_name, property_name):

600

655

"""Standard D-Bus property Get() method, see D-Bus standard.

601

656

"""

602

657

prop = self._get_dbus_property(interface_name, property_name)

603

if prop._dbus_access == u"write":

658

if prop._dbus_access == "write":

604

659

raise DBusPropertyAccessException(property_name)

605

660

value = prop()

606

if not hasattr(value, u"variant_level"):

661

if not hasattr(value, "variant_level"):

607

662

return value

608

663

return type(value)(value, variant_level=value.variant_level+1)

609

664

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

665

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

611

666

def Set(self, interface_name, property_name, value):

612

667

"""Standard D-Bus property Set() method, see D-Bus standard.

613

668

"""

614

669

prop = self._get_dbus_property(interface_name, property_name)

615

if prop._dbus_access == u"read":

670

if prop._dbus_access == "read":

616

671

raise DBusPropertyAccessException(property_name)

617

if prop._dbus_get_args_options[u"byte_arrays"]:

672

if prop._dbus_get_args_options["byte_arrays"]:

618

673

# The byte_arrays option is not supported yet on

619

674

# signatures other than "ay".

620

if prop._dbus_signature != u"ay":

675

if prop._dbus_signature != "ay":

621

676

raise ValueError

622

677

value = dbus.ByteArray(''.join(unichr(byte)

623

678

for byte in value))

624

679

prop(value)

625

680

626

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

627

out_signature=u"a{sv}")

681

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

682

out_signature="a{sv}")

628

683

def GetAll(self, interface_name):

629

684

"""Standard D-Bus property GetAll() method, see D-Bus

630

685

standard.

638

693

# Interface non-empty but did not match

639

694

continue

640

695

# Ignore write-only properties

641

if prop._dbus_access == u"write":

696

if prop._dbus_access == "write":

642

697

continue

643

698

value = prop()

644

if not hasattr(value, u"variant_level"):

699

if not hasattr(value, "variant_level"):

645

700

all[name] = value

646

701

continue

647

702

all[name] = type(value)(value, variant_level=

648

703

value.variant_level+1)

649

return dbus.Dictionary(all, signature=u"sv")

704

return dbus.Dictionary(all, signature="sv")

650

705

651

706

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

652

out_signature=u"s",

707

out_signature="s",

653

708

path_keyword='object_path',

654

709

connection_keyword='connection')

655

710

def Introspect(self, object_path, connection):

660

715

try:

661

716

document = xml.dom.minidom.parseString(xmlstring)

662

717

def make_tag(document, name, prop):

663

e = document.createElement(u"property")

664

e.setAttribute(u"name", name)

665

e.setAttribute(u"type", prop._dbus_signature)

666

e.setAttribute(u"access", prop._dbus_access)

718

e = document.createElement("property")

719

e.setAttribute("name", name)

720

e.setAttribute("type", prop._dbus_signature)

721

e.setAttribute("access", prop._dbus_access)

667

722

return e

668

for if_tag in document.getElementsByTagName(u"interface"):

723

for if_tag in document.getElementsByTagName("interface"):

669

724

for tag in (make_tag(document, name, prop)

670

725

for name, prop

671

726

in self._get_all_dbus_properties()

672

727

if prop._dbus_interface

673

== if_tag.getAttribute(u"name")):

728

== if_tag.getAttribute("name")):

674

729

if_tag.appendChild(tag)

675

730

# Add the names to the return values for the

676

731

# "org.freedesktop.DBus.Properties" methods

677

if (if_tag.getAttribute(u"name")

678

== u"org.freedesktop.DBus.Properties"):

679

for cn in if_tag.getElementsByTagName(u"method"):

680

if cn.getAttribute(u"name") == u"Get":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"value")

685

elif cn.getAttribute(u"name") == u"GetAll":

686

for arg in cn.getElementsByTagName(u"arg"):

687

if (arg.getAttribute(u"direction")

688

== u"out"):

689

arg.setAttribute(u"name", u"props")

690

xmlstring = document.toxml(u"utf-8")

732

if (if_tag.getAttribute("name")

733

== "org.freedesktop.DBus.Properties"):

734

for cn in if_tag.getElementsByTagName("method"):

735

if cn.getAttribute("name") == "Get":

736

for arg in cn.getElementsByTagName("arg"):

737

if (arg.getAttribute("direction")

738

== "out"):

739

arg.setAttribute("name", "value")

740

elif cn.getAttribute("name") == "GetAll":

741

for arg in cn.getElementsByTagName("arg"):

742

if (arg.getAttribute("direction")

743

== "out"):

744

arg.setAttribute("name", "props")

745

xmlstring = document.toxml("utf-8")

691

746

document.unlink()

692

747

except (AttributeError, xml.dom.DOMException,

693

xml.parsers.expat.ExpatError), error:

694

logger.error(u"Failed to override Introspection method",

748

xml.parsers.expat.ExpatError) as error:

749

logger.error("Failed to override Introspection method",

695

750

error)

696

751

return xmlstring

697

752

703

758

dbus_object_path: dbus.ObjectPath

704

759

bus: dbus.SystemBus()

705

760

"""

761

762

runtime_expansions = (Client.runtime_expansions

763

+ ("dbus_object_path",))

764

706

765

# dbus.service.Object doesn't use super(), so we can't either.

707

766

708

767

def __init__(self, bus = None, *args, **kwargs):

711

770

Client.__init__(self, *args, **kwargs)

712

771

# Only now, when this client is initialized, can it show up on

713

772

# the D-Bus

773

client_object_name = unicode(self.name).translate(

774

{ord("."): ord("_"),

775

ord("-"): ord("_")})

714

776

self.dbus_object_path = (dbus.ObjectPath

715

(u"/clients/"

716

+ self.name.replace(u".", u"_")))

777

("/clients/" + client_object_name))

717

778

DBusObjectWithProperties.__init__(self, self.bus,

718

779

self.dbus_object_path)

719

780

def _set_expires(self, value):

781

old_value = getattr(self, "_expires", None)

782

self._expires = value

783

if hasattr(self, "dbus_object_path") and old_value != value:

784

dbus_time = (self._datetime_to_dbus(self._expires,

785

variant_level=1))

786

self.PropertyChanged(dbus.String("Expires"),

787

dbus_time)

788

expires = property(lambda self: self._expires, _set_expires)

789

del _set_expires

790

720

791

def _get_approvals_pending(self):

721

792

return self._approvals_pending

722

793

def _set_approvals_pending(self, value):

726

797

if (hasattr(self, "dbus_object_path")

727

798

and bval is not bool(old_value)):

728

799

dbus_bool = dbus.Boolean(bval, variant_level=1)

729

self.PropertyChanged(dbus.String(u"approved_pending"),

800

self.PropertyChanged(dbus.String("ApprovalPending"),

730

801

dbus_bool)

731

802

732

803

approvals_pending = property(_get_approvals_pending,

736

807

@staticmethod

737

808

def _datetime_to_dbus(dt, variant_level=0):

738

809

"""Convert a UTC datetime.datetime() to a D-Bus type."""

810

if dt is None:

811

return dbus.String("", variant_level = variant_level)

739

812

return dbus.String(dt.isoformat(),

740

813

variant_level=variant_level)

741

814

742

815

def enable(self):

743

oldstate = getattr(self, u"enabled", False)

816

oldstate = getattr(self, "enabled", False)

744

817

r = Client.enable(self)

745

818

if oldstate != self.enabled:

746

819

# Emit D-Bus signals

747

self.PropertyChanged(dbus.String(u"enabled"),

820

self.PropertyChanged(dbus.String("Enabled"),

748

821

dbus.Boolean(True, variant_level=1))

749

822

self.PropertyChanged(

750

dbus.String(u"last_enabled"),

823

dbus.String("LastEnabled"),

751

824

self._datetime_to_dbus(self.last_enabled,

752

825

variant_level=1))

753

826

return r

754

827

755

828

def disable(self, quiet = False):

756

oldstate = getattr(self, u"enabled", False)

829

oldstate = getattr(self, "enabled", False)

757

830

r = Client.disable(self, quiet=quiet)

758

831

if not quiet and oldstate != self.enabled:

759

832

# Emit D-Bus signal

760

self.PropertyChanged(dbus.String(u"enabled"),

833

self.PropertyChanged(dbus.String("Enabled"),

761

834

dbus.Boolean(False, variant_level=1))

762

835

return r

763

836

766

839

self.remove_from_connection()

767

840

except LookupError:

768

841

pass

769

if hasattr(DBusObjectWithProperties, u"__del__"):

842

if hasattr(DBusObjectWithProperties, "__del__"):

770

843

DBusObjectWithProperties.__del__(self, *args, **kwargs)

771

844

Client.__del__(self, *args, **kwargs)

772

845

775

848

self.checker_callback_tag = None

776

849

self.checker = None

777

850

# Emit D-Bus signal

778

self.PropertyChanged(dbus.String(u"checker_running"),

851

self.PropertyChanged(dbus.String("CheckerRunning"),

779

852

dbus.Boolean(False, variant_level=1))

780

853

if os.WIFEXITED(condition):

781

854

exitstatus = os.WEXITSTATUS(condition)

793

866

*args, **kwargs)

794

867

795

868

def checked_ok(self, *args, **kwargs):

796

r = Client.checked_ok(self, *args, **kwargs)

869

Client.checked_ok(self, *args, **kwargs)

797

870

# Emit D-Bus signal

798

871

self.PropertyChanged(

799

dbus.String(u"last_checked_ok"),

872

dbus.String("LastCheckedOK"),

800

873

(self._datetime_to_dbus(self.last_checked_ok,

801

874

variant_level=1)))

875

876

def need_approval(self, *args, **kwargs):

877

r = Client.need_approval(self, *args, **kwargs)

878

# Emit D-Bus signal

879

self.PropertyChanged(

880

dbus.String("LastApprovalRequest"),

881

(self._datetime_to_dbus(self.last_approval_request,

882

variant_level=1)))

802

883

return r

803

884

804

885

def start_checker(self, *args, **kwargs):

814

895

# Emit D-Bus signal

815

896

self.CheckerStarted(self.current_checker_command)

816

897

self.PropertyChanged(

817

dbus.String(u"checker_running"),

898

dbus.String("CheckerRunning"),

818

899

dbus.Boolean(True, variant_level=1))

819

900

return r

820

901

821

902

def stop_checker(self, *args, **kwargs):

822

old_checker = getattr(self, u"checker", None)

903

old_checker = getattr(self, "checker", None)

823

904

r = Client.stop_checker(self, *args, **kwargs)

824

905

if (old_checker is not None

825

and getattr(self, u"checker", None) is None):

826

self.PropertyChanged(dbus.String(u"checker_running"),

906

and getattr(self, "checker", None) is None):

907

self.PropertyChanged(dbus.String("CheckerRunning"),

827

908

dbus.Boolean(False, variant_level=1))

828

909

return r

829

910

834

915

def approve(self, value=True):

835

916

self.send_changedstate()

836

917

self._approved = value

837

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),

918

gobject.timeout_add(self._timedelta_to_milliseconds

919

(self.approval_duration),

838

920

self._reset_approved)

839

921

840

922

841

923

## D-Bus methods, signals & properties

842

_interface = u"se.bsnet.fukt.Mandos.Client"

924

_interface = "se.bsnet.fukt.Mandos.Client"

843

925

844

926

## Signals

845

927

846

928

# CheckerCompleted - signal

847

@dbus.service.signal(_interface, signature=u"nxs")

929

@dbus.service.signal(_interface, signature="nxs")

848

930

def CheckerCompleted(self, exitcode, waitstatus, command):

849

931

"D-Bus signal"

850

932

pass

851

933

852

934

# CheckerStarted - signal

853

@dbus.service.signal(_interface, signature=u"s")

935

@dbus.service.signal(_interface, signature="s")

854

936

def CheckerStarted(self, command):

855

937

"D-Bus signal"

856

938

pass

857

939

858

940

# PropertyChanged - signal

859

@dbus.service.signal(_interface, signature=u"sv")

941

@dbus.service.signal(_interface, signature="sv")

860

942

def PropertyChanged(self, property, value):

861

943

"D-Bus signal"

862

944

pass

871

953

pass

872

954

873

955

# Rejected - signal

874

@dbus.service.signal(_interface, signature=u"s")

956

@dbus.service.signal(_interface, signature="s")

875

957

def Rejected(self, reason):

876

958

"D-Bus signal"

877

959

pass

878

960

879

961

# NeedApproval - signal

880

@dbus.service.signal(_interface, signature=u"db")

962

@dbus.service.signal(_interface, signature="tb")

881

963

def NeedApproval(self, timeout, default):

882

964

"D-Bus signal"

883

pass

965

return self.need_approval()

884

966

885

967

## Methods

886

968

887

969

# Approve - method

888

@dbus.service.method(_interface, in_signature=u"b")

970

@dbus.service.method(_interface, in_signature="b")

889

971

def Approve(self, value):

890

972

self.approve(value)

891

973

892

974

# CheckedOK - method

893

975

@dbus.service.method(_interface)

894

976

def CheckedOK(self):

895

return self.checked_ok()

977

self.checked_ok()

896

978

897

979

# Enable - method

898

980

@dbus.service.method(_interface)

919

1001

920

1002

## Properties

921

1003

922

# approved_pending - property

923

@dbus_service_property(_interface, signature=u"b", access=u"read")

924

def approved_pending_dbus_property(self):

1004

# ApprovalPending - property

1005

@dbus_service_property(_interface, signature="b", access="read")

1006

def ApprovalPending_dbus_property(self):

925

1007

return dbus.Boolean(bool(self.approvals_pending))

926

1008

927

# approved_by_default - property

928

@dbus_service_property(_interface, signature=u"b",

929

access=u"readwrite")

930

def approved_by_default_dbus_property(self):

931

return dbus.Boolean(self.approved_by_default)

932

933

# approved_delay - property

934

@dbus_service_property(_interface, signature=u"t",

935

access=u"readwrite")

936

def approved_delay_dbus_property(self):

937

return dbus.UInt64(self.approved_delay_milliseconds())

938

939

# approved_duration - property

940

@dbus_service_property(_interface, signature=u"t",

941

access=u"readwrite")

942

def approved_duration_dbus_property(self):

943

return dbus.UInt64(self._timedelta_to_milliseconds(

944

self.approved_duration))

945

946

# name - property

947

@dbus_service_property(_interface, signature=u"s", access=u"read")

948

def name_dbus_property(self):

1009

# ApprovedByDefault - property

1010

@dbus_service_property(_interface, signature="b",

1011

access="readwrite")

1012

def ApprovedByDefault_dbus_property(self, value=None):

1013

if value is None: # get

1014

return dbus.Boolean(self.approved_by_default)

1015

old_value = self.approved_by_default

1016

self.approved_by_default = bool(value)

1017

# Emit D-Bus signal

1018

if old_value != self.approved_by_default:

1019

self.PropertyChanged(dbus.String("ApprovedByDefault"),

1020

dbus.Boolean(value, variant_level=1))

1021

1022

# ApprovalDelay - property

1023

@dbus_service_property(_interface, signature="t",

1024

access="readwrite")

1025

def ApprovalDelay_dbus_property(self, value=None):

1026

if value is None: # get

1027

return dbus.UInt64(self.approval_delay_milliseconds())

1028

old_value = self.approval_delay

1029

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1030

# Emit D-Bus signal

1031

if old_value != self.approval_delay:

1032

self.PropertyChanged(dbus.String("ApprovalDelay"),

1033

dbus.UInt64(value, variant_level=1))

1034

1035

# ApprovalDuration - property

1036

@dbus_service_property(_interface, signature="t",

1037

access="readwrite")

1038

def ApprovalDuration_dbus_property(self, value=None):

1039

if value is None: # get

1040

return dbus.UInt64(self._timedelta_to_milliseconds(

1041

self.approval_duration))

1042

old_value = self.approval_duration

1043

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1044

# Emit D-Bus signal

1045

if old_value != self.approval_duration:

1046

self.PropertyChanged(dbus.String("ApprovalDuration"),

1047

dbus.UInt64(value, variant_level=1))

1048

1049

# Name - property

1050

@dbus_service_property(_interface, signature="s", access="read")

1051

def Name_dbus_property(self):

949

1052

return dbus.String(self.name)

950

1053

951

# fingerprint - property

952

@dbus_service_property(_interface, signature=u"s", access=u"read")

953

def fingerprint_dbus_property(self):

1054

# Fingerprint - property

1055

@dbus_service_property(_interface, signature="s", access="read")

1056

def Fingerprint_dbus_property(self):

954

1057

return dbus.String(self.fingerprint)

955

1058

956

# host - property

957

@dbus_service_property(_interface, signature=u"s",

958

access=u"readwrite")

959

def host_dbus_property(self, value=None):

1059

# Host - property

1060

@dbus_service_property(_interface, signature="s",

1061

access="readwrite")

1062

def Host_dbus_property(self, value=None):

960

1063

if value is None: # get

961

1064

return dbus.String(self.host)

1065

old_value = self.host

962

1066

self.host = value

963

1067

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"host"),

965

dbus.String(value, variant_level=1))

1068

if old_value != self.host:

1069

self.PropertyChanged(dbus.String("Host"),

1070

dbus.String(value, variant_level=1))

966

1071

967

# created - property

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

969

def created_dbus_property(self):

1072

# Created - property

1073

@dbus_service_property(_interface, signature="s", access="read")

1074

def Created_dbus_property(self):

970

1075

return dbus.String(self._datetime_to_dbus(self.created))

971

1076

972

# last_enabled - property

973

@dbus_service_property(_interface, signature=u"s", access=u"read")

974

def last_enabled_dbus_property(self):

975

if self.last_enabled is None:

976

return dbus.String(u"")

977

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1077

# LastEnabled - property

1078

@dbus_service_property(_interface, signature="s", access="read")

1079

def LastEnabled_dbus_property(self):

1080

return self._datetime_to_dbus(self.last_enabled)

978

1081

979

# enabled - property

980

@dbus_service_property(_interface, signature=u"b",

981

access=u"readwrite")

982

def enabled_dbus_property(self, value=None):

1082

# Enabled - property

1083

@dbus_service_property(_interface, signature="b",

1084

access="readwrite")

1085

def Enabled_dbus_property(self, value=None):

983

1086

if value is None: # get

984

1087

return dbus.Boolean(self.enabled)

985

1088

if value:

987

1090

else:

988

1091

self.disable()

989

1092

990

# last_checked_ok - property

991

@dbus_service_property(_interface, signature=u"s",

992

access=u"readwrite")

993

def last_checked_ok_dbus_property(self, value=None):

1093

# LastCheckedOK - property

1094

@dbus_service_property(_interface, signature="s",

1095

access="readwrite")

1096

def LastCheckedOK_dbus_property(self, value=None):

994

1097

if value is not None:

995

1098

self.checked_ok()

996

1099

return

997

if self.last_checked_ok is None:

998

return dbus.String(u"")

999

return dbus.String(self._datetime_to_dbus(self

1000

.last_checked_ok))

1001

1002

# timeout - property

1003

@dbus_service_property(_interface, signature=u"t",

1004

access=u"readwrite")

1005

def timeout_dbus_property(self, value=None):

1100

return self._datetime_to_dbus(self.last_checked_ok)

1101

1102

# Expires - property

1103

@dbus_service_property(_interface, signature="s", access="read")

1104

def Expires_dbus_property(self):

1105

return self._datetime_to_dbus(self.expires)

1106

1107

# LastApprovalRequest - property

1108

@dbus_service_property(_interface, signature="s", access="read")

1109

def LastApprovalRequest_dbus_property(self):

1110

return self._datetime_to_dbus(self.last_approval_request)

1111

1112

# Timeout - property

1113

@dbus_service_property(_interface, signature="t",

1114

access="readwrite")

1115

def Timeout_dbus_property(self, value=None):

1006

1116

if value is None: # get

1007

1117

return dbus.UInt64(self.timeout_milliseconds())

1118

old_value = self.timeout

1008

1119

self.timeout = datetime.timedelta(0, 0, 0, value)

1009

1120

# Emit D-Bus signal

1010

self.PropertyChanged(dbus.String(u"timeout"),

1011

dbus.UInt64(value, variant_level=1))

1012

if getattr(self, u"disable_initiator_tag", None) is None:

1121

if old_value != self.timeout:

1122

self.PropertyChanged(dbus.String("Timeout"),

1123

dbus.UInt64(value, variant_level=1))

1124

if getattr(self, "disable_initiator_tag", None) is None:

1013

1125

return

1014

1126

# Reschedule timeout

1015

1127

gobject.source_remove(self.disable_initiator_tag)

1016

1128

self.disable_initiator_tag = None

1129

self.expires = None

1017

1130

time_to_die = (self.

1018

1131

_timedelta_to_milliseconds((self

1019

1132

.last_checked_ok

1024

1137

# The timeout has passed

1025

1138

self.disable()

1026

1139

else:

1140

self.expires = (datetime.datetime.utcnow()

1141

+ datetime.timedelta(milliseconds = time_to_die))

1027

1142

self.disable_initiator_tag = (gobject.timeout_add

1028

1143

(time_to_die, self.disable))

1029

1030

# interval - property

1031

@dbus_service_property(_interface, signature=u"t",

1032

access=u"readwrite")

1033

def interval_dbus_property(self, value=None):

1144

1145

# ExtendedTimeout - property

1146

@dbus_service_property(_interface, signature="t",

1147

access="readwrite")

1148

def ExtendedTimeout_dbus_property(self, value=None):

1149

if value is None: # get

1150

return dbus.UInt64(self.extended_timeout_milliseconds())

1151

old_value = self.extended_timeout

1152

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1153

# Emit D-Bus signal

1154

if old_value != self.extended_timeout:

1155

self.PropertyChanged(dbus.String("ExtendedTimeout"),

1156

dbus.UInt64(value, variant_level=1))

1157

1158

# Interval - property

1159

@dbus_service_property(_interface, signature="t",

1160

access="readwrite")

1161

def Interval_dbus_property(self, value=None):

1034

1162

if value is None: # get

1035

1163

return dbus.UInt64(self.interval_milliseconds())

1164

old_value = self.interval

1036

1165

self.interval = datetime.timedelta(0, 0, 0, value)

1037

1166

# Emit D-Bus signal

1038

self.PropertyChanged(dbus.String(u"interval"),

1039

dbus.UInt64(value, variant_level=1))

1040

if getattr(self, u"checker_initiator_tag", None) is None:

1167

if old_value != self.interval:

1168

self.PropertyChanged(dbus.String("Interval"),

1169

dbus.UInt64(value, variant_level=1))

1170

if getattr(self, "checker_initiator_tag", None) is None:

1041

1171

return

1042

1172

# Reschedule checker run

1043

1173

gobject.source_remove(self.checker_initiator_tag)

1045

1175

(value, self.start_checker))

1046

1176

self.start_checker() # Start one now, too

1047

1177

1048

# checker - property

1049

@dbus_service_property(_interface, signature=u"s",

1050

access=u"readwrite")

1051

def checker_dbus_property(self, value=None):

1178

# Checker - property

1179

@dbus_service_property(_interface, signature="s",

1180

access="readwrite")

1181

def Checker_dbus_property(self, value=None):

1052

1182

if value is None: # get

1053

1183

return dbus.String(self.checker_command)

1184

old_value = self.checker_command

1054

1185

self.checker_command = value

1055

1186

# Emit D-Bus signal

1056

self.PropertyChanged(dbus.String(u"checker"),

1057

dbus.String(self.checker_command,

1058

variant_level=1))

1187

if old_value != self.checker_command:

1188

self.PropertyChanged(dbus.String("Checker"),

1189

dbus.String(self.checker_command,

1190

variant_level=1))

1059

1191

1060

# checker_running - property

1061

@dbus_service_property(_interface, signature=u"b",

1062

access=u"readwrite")

1063

def checker_running_dbus_property(self, value=None):

1192

# CheckerRunning - property

1193

@dbus_service_property(_interface, signature="b",

1194

access="readwrite")

1195

def CheckerRunning_dbus_property(self, value=None):

1064

1196

if value is None: # get

1065

1197

return dbus.Boolean(self.checker is not None)

1066

1198

if value:

1068

1200

else:

1069

1201

self.stop_checker()

1070

1202

1071

# object_path - property

1072

@dbus_service_property(_interface, signature=u"o", access=u"read")

1073

def object_path_dbus_property(self):

1203

# ObjectPath - property

1204

@dbus_service_property(_interface, signature="o", access="read")

1205

def ObjectPath_dbus_property(self):

1074

1206

return self.dbus_object_path # is already a dbus.ObjectPath

1075

1207

1076

# secret = property

1077

@dbus_service_property(_interface, signature=u"ay",

1078

access=u"write", byte_arrays=True)

1079

def secret_dbus_property(self, value):

1208

# Secret = property

1209

@dbus_service_property(_interface, signature="ay",

1210

access="write", byte_arrays=True)

1211

def Secret_dbus_property(self, value):

1080

1212

self.secret = str(value)

1081

1213

1082

1214

del _interface

1116

1248

1117

1249

def handle(self):

1118

1250

with contextlib.closing(self.server.child_pipe) as child_pipe:

1119

logger.info(u"TCP connection from: %s",

1251

logger.info("TCP connection from: %s",

1120

1252

unicode(self.client_address))

1121

logger.debug(u"Pipe FD: %d",

1253

logger.debug("Pipe FD: %d",

1122

1254

self.server.child_pipe.fileno())

1123

1255

1124

1256

session = (gnutls.connection

1131

1263

# no X.509 keys are added to it. Therefore, we can use it

1132

1264

# here despite using OpenPGP certificates.

1133

1265

1134

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1135

# u"+AES-256-CBC", u"+SHA1",

1136

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1137

# u"+DHE-DSS"))

1266

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1267

# "+AES-256-CBC", "+SHA1",

1268

# "+COMP-NULL", "+CTYPE-OPENPGP",

1269

# "+DHE-DSS"))

1138

1270

# Use a fallback default, since this MUST be set.

1139

1271

priority = self.server.gnutls_priority

1140

1272

if priority is None:

1141

priority = u"NORMAL"

1273

priority = "NORMAL"

1142

1274

(gnutls.library.functions

1143

1275

.gnutls_priority_set_direct(session._c_object,

1144

1276

priority, None))

1146

1278

# Start communication using the Mandos protocol

1147

1279

# Get protocol number

1148

1280

line = self.request.makefile().readline()

1149

logger.debug(u"Protocol version: %r", line)

1281

logger.debug("Protocol version: %r", line)

1150

1282

try:

1151

1283

if int(line.strip().split()[0]) > 1:

1152

1284

raise RuntimeError

1153

except (ValueError, IndexError, RuntimeError), error:

1154

logger.error(u"Unknown protocol version: %s", error)

1285

except (ValueError, IndexError, RuntimeError) as error:

1286

logger.error("Unknown protocol version: %s", error)

1155

1287

return

1156

1288

1157

1289

# Start GnuTLS connection

1158

1290

try:

1159

1291

session.handshake()

1160

except gnutls.errors.GNUTLSError, error:

1161

logger.warning(u"Handshake failed: %s", error)

1292

except gnutls.errors.GNUTLSError as error:

1293

logger.warning("Handshake failed: %s", error)

1162

1294

# Do not run session.bye() here: the session is not

1163

1295

# established. Just abandon the request.

1164

1296

return

1165

logger.debug(u"Handshake succeeded")

1297

logger.debug("Handshake succeeded")

1166

1298

1167

1299

approval_required = False

1168

1300

try:

1169

1301

try:

1170

1302

fpr = self.fingerprint(self.peer_certificate

1171

1303

(session))

1172

except (TypeError, gnutls.errors.GNUTLSError), error:

1173

logger.warning(u"Bad certificate: %s", error)

1304

except (TypeError,

1305

gnutls.errors.GNUTLSError) as error:

1306

logger.warning("Bad certificate: %s", error)

1174

1307

return

1175

logger.debug(u"Fingerprint: %s", fpr)

1308

logger.debug("Fingerprint: %s", fpr)

1176

1309

1177

1310

try:

1178

1311

client = ProxyClient(child_pipe, fpr,

1180

1313

except KeyError:

1181

1314

return

1182

1315

1183

if client.approved_delay:

1184

delay = client.approved_delay

1316

if client.approval_delay:

1317

delay = client.approval_delay

1185

1318

client.approvals_pending += 1

1186

1319

approval_required = True

1187

1320

1188

1321

while True:

1189

1322

if not client.enabled:

1190

logger.warning(u"Client %s is disabled",

1323

logger.info("Client %s is disabled",

1191

1324

client.name)

1192

1325

if self.server.use_dbus:

1193

1326

# Emit D-Bus signal

1194

1327

client.Rejected("Disabled")

1195

1328

return

1196

1329

1197

if client._approved or not client.approved_delay:

1330

if client._approved or not client.approval_delay:

1198

1331

#We are approved or approval is disabled

1199

1332

break

1200

1333

elif client._approved is None:

1201

logger.info(u"Client %s need approval",

1334

logger.info("Client %s needs approval",

1202

1335

client.name)

1203

1336

if self.server.use_dbus:

1204

1337

# Emit D-Bus signal

1205

1338

client.NeedApproval(

1206

client.approved_delay_milliseconds(),

1339

client.approval_delay_milliseconds(),

1207

1340

client.approved_by_default)

1208

1341

else:

1209

logger.warning(u"Client %s was not approved",

1342

logger.warning("Client %s was not approved",

1210

1343

client.name)

1211

1344

if self.server.use_dbus:

1212

1345

# Emit D-Bus signal

1213

client.Rejected("Disapproved")

1346

client.Rejected("Denied")

1214

1347

return

1215

1348

1216

1349

#wait until timeout or approved

1227

1360

client.name)

1228

1361

if self.server.use_dbus:

1229

1362

# Emit D-Bus signal

1230

client.Rejected("Time out")

1363

client.Rejected("Approval timed out")

1231

1364

return

1232

1365

else:

1233

1366

break

1238

1371

while sent_size < len(client.secret):

1239

1372

try:

1240

1373

sent = session.send(client.secret[sent_size:])

1241

except (gnutls.errors.GNUTLSError), error:

1374

except gnutls.errors.GNUTLSError as error:

1242

1375

logger.warning("gnutls send failed")

1243

1376

return

1244

logger.debug(u"Sent: %d, remaining: %d",

1377

logger.debug("Sent: %d, remaining: %d",

1245

1378

sent, len(client.secret)

1246

1379

- (sent_size + sent))

1247

1380

sent_size += sent

1248

1381

1249

logger.info(u"Sending secret to %s", client.name)

1382

logger.info("Sending secret to %s", client.name)

1250

1383

# bump the timeout as if seen

1251

client.checked_ok()

1384

client.checked_ok(client.extended_timeout)

1252

1385

if self.server.use_dbus:

1253

1386

# Emit D-Bus signal

1254

1387

client.GotSecret()

1258

1391

client.approvals_pending -= 1

1259

1392

try:

1260

1393

session.bye()

1261

except (gnutls.errors.GNUTLSError), error:

1262

logger.warning("gnutls bye failed")

1394

except gnutls.errors.GNUTLSError as error:

1395

logger.warning("GnuTLS bye failed")

1263

1396

1264

1397

@staticmethod

1265

1398

def peer_certificate(session):

1275

1408

.gnutls_certificate_get_peers

1276

1409

(session._c_object, ctypes.byref(list_size)))

1277

1410

if not bool(cert_list) and list_size.value != 0:

1278

raise gnutls.errors.GNUTLSError(u"error getting peer"

1279

u" certificate")

1411

raise gnutls.errors.GNUTLSError("error getting peer"

1412

" certificate")

1280

1413

if list_size.value == 0:

1281

1414

return None

1282

1415

cert = cert_list[0]

1308

1441

if crtverify.value != 0:

1309

1442

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1310

1443

raise (gnutls.errors.CertificateSecurityError

1311

(u"Verify failed"))

1444

("Verify failed"))

1312

1445

# New buffer for the fingerprint

1313

1446

buf = ctypes.create_string_buffer(20)

1314

1447

buf_len = ctypes.c_size_t()

1321

1454

# Convert the buffer to a Python bytestring

1322

1455

fpr = ctypes.string_at(buf, buf_len.value)

1323

1456

# Convert the bytestring to hexadecimal notation

1324

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1457

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1325

1458

return hex_fpr

1326

1459

1327

1460

1355

1488

1356

1489

def add_pipe(self, parent_pipe):

1357

1490

"""Dummy function; override as necessary"""

1358

pass

1491

raise NotImplementedError

1359

1492

1360

1493

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1361

1494

socketserver.TCPServer, object):

1379

1512

bind to an address or port if they were not specified."""

1380

1513

if self.interface is not None:

1381

1514

if SO_BINDTODEVICE is None:

1382

logger.error(u"SO_BINDTODEVICE does not exist;"

1383

u" cannot bind to interface %s",

1515

logger.error("SO_BINDTODEVICE does not exist;"

1516

" cannot bind to interface %s",

1384

1517

self.interface)

1385

1518

else:

1386

1519

try:

1387

1520

self.socket.setsockopt(socket.SOL_SOCKET,

1388

1521

SO_BINDTODEVICE,

1389

1522

str(self.interface

1390

+ u'\0'))

1391

except socket.error, error:

1523

+ '\0'))

1524

except socket.error as error:

1392

1525

if error[0] == errno.EPERM:

1393

logger.error(u"No permission to"

1394

u" bind to interface %s",

1526

logger.error("No permission to"

1527

" bind to interface %s",

1395

1528

self.interface)

1396

1529

elif error[0] == errno.ENOPROTOOPT:

1397

logger.error(u"SO_BINDTODEVICE not available;"

1398

u" cannot bind to interface %s",

1530

logger.error("SO_BINDTODEVICE not available;"

1531

" cannot bind to interface %s",

1399

1532

self.interface)

1400

1533

else:

1401

1534

raise

1403

1536

if self.server_address[0] or self.server_address[1]:

1404

1537

if not self.server_address[0]:

1405

1538

if self.address_family == socket.AF_INET6:

1406

any_address = u"::" # in6addr_any

1539

any_address = "::" # in6addr_any

1407

1540

else:

1408

1541

any_address = socket.INADDR_ANY

1409

1542

self.server_address = (any_address,

1458

1591

def handle_ipc(self, source, condition, parent_pipe=None,

1459

1592

client_object=None):

1460

1593

condition_names = {

1461

gobject.IO_IN: u"IN", # There is data to read.

1462

gobject.IO_OUT: u"OUT", # Data can be written (without

1594

gobject.IO_IN: "IN", # There is data to read.

1595

gobject.IO_OUT: "OUT", # Data can be written (without

1463

1596

# blocking).

1464

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1465

gobject.IO_ERR: u"ERR", # Error condition.

1466

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1597

gobject.IO_PRI: "PRI", # There is urgent data to read.

1598

gobject.IO_ERR: "ERR", # Error condition.

1599

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1467

1600

# broken, usually for pipes and

1468

1601

# sockets).

1469

1602

}

1471

1604

for cond, name in

1472

1605

condition_names.iteritems()

1473

1606

if cond & condition)

1474

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1475

conditions_string)

1476

1477

1607

# error or the other end of multiprocessing.Pipe has closed

1478

1608

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1479

1609

return False

1480

1610

1481

1611

# Read a request from the child

1482

1612

request = parent_pipe.recv()

1483

logger.debug(u"IPC request: %s", repr(request))

1484

1613

command = request[0]

1485

1614

1486

1615

if command == 'init':

1492

1621

client = c

1493

1622

break

1494

1623

else:

1495

logger.warning(u"Client not found for fingerprint: %s, ad"

1496

u"dress: %s", fpr, address)

1624

logger.info("Client not found for fingerprint: %s, ad"

1625

"dress: %s", fpr, address)

1497

1626

if self.use_dbus:

1498

1627

# Emit D-Bus signal

1499

mandos_dbus_service.ClientNotFound(fpr, address)

1628

mandos_dbus_service.ClientNotFound(fpr, address[0])

1500

1629

parent_pipe.send(False)

1501

1630

return False

1502

1631

1533

1662

def string_to_delta(interval):

1534

1663

"""Parse a string and return a datetime.timedelta

1535

1664

1536

>>> string_to_delta(u'7d')

1665

>>> string_to_delta('7d')

1537

1666

datetime.timedelta(7)

1538

>>> string_to_delta(u'60s')

1667

>>> string_to_delta('60s')

1539

1668

datetime.timedelta(0, 60)

1540

>>> string_to_delta(u'60m')

1669

>>> string_to_delta('60m')

1541

1670

datetime.timedelta(0, 3600)

1542

>>> string_to_delta(u'24h')

1671

>>> string_to_delta('24h')

1543

1672

datetime.timedelta(1)

1544

>>> string_to_delta(u'1w')

1673

>>> string_to_delta('1w')

1545

1674

datetime.timedelta(7)

1546

>>> string_to_delta(u'5m 30s')

1675

>>> string_to_delta('5m 30s')

1547

1676

datetime.timedelta(0, 330)

1548

1677

"""

1549

1678

timevalue = datetime.timedelta(0)

1551

1680

try:

1552

1681

suffix = unicode(s[-1])

1553

1682

value = int(s[:-1])

1554

if suffix == u"d":

1683

if suffix == "d":

1555

1684

delta = datetime.timedelta(value)

1556

elif suffix == u"s":

1685

elif suffix == "s":

1557

1686

delta = datetime.timedelta(0, value)

1558

elif suffix == u"m":

1687

elif suffix == "m":

1559

1688

delta = datetime.timedelta(0, 0, 0, 0, value)

1560

elif suffix == u"h":

1689

elif suffix == "h":

1561

1690

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1562

elif suffix == u"w":

1691

elif suffix == "w":

1563

1692

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1564

1693

else:

1565

raise ValueError(u"Unknown suffix %r" % suffix)

1566

except (ValueError, IndexError), e:

1567

raise ValueError(e.message)

1694

raise ValueError("Unknown suffix %r" % suffix)

1695

except (ValueError, IndexError) as e:

1696

raise ValueError(*(e.args))

1568

1697

timevalue += delta

1569

1698

return timevalue

1570

1699

1576

1705

global if_nametoindex

1577

1706

try:

1578

1707

if_nametoindex = (ctypes.cdll.LoadLibrary

1579

(ctypes.util.find_library(u"c"))

1708

(ctypes.util.find_library("c"))

1580

1709

.if_nametoindex)

1581

1710

except (OSError, AttributeError):

1582

logger.warning(u"Doing if_nametoindex the hard way")

1711

logger.warning("Doing if_nametoindex the hard way")

1583

1712

def if_nametoindex(interface):

1584

1713

"Get an interface index the hard way, i.e. using fcntl()"

1585

1714

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1586

1715

with contextlib.closing(socket.socket()) as s:

1587

1716

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1588

struct.pack(str(u"16s16x"),

1717

struct.pack(str("16s16x"),

1589

1718

interface))

1590

interface_index = struct.unpack(str(u"I"),

1719

interface_index = struct.unpack(str("I"),

1591

1720

ifreq[16:20])[0]

1592

1721

return interface_index

1593

1722

return if_nametoindex(interface)

1601

1730

sys.exit()

1602

1731

os.setsid()

1603

1732

if not nochdir:

1604

os.chdir(u"/")

1733

os.chdir("/")

1605

1734

if os.fork():

1606

1735

sys.exit()

1607

1736

if not noclose:

1609

1738

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1610

1739

if not stat.S_ISCHR(os.fstat(null).st_mode):

1611

1740

raise OSError(errno.ENODEV,

1612

u"%s not a character device"

1741

"%s not a character device"

1613

1742

% os.path.devnull)

1614

1743

os.dup2(null, sys.stdin.fileno())

1615

1744

os.dup2(null, sys.stdout.fileno())

1623

1752

##################################################################

1624

1753

# Parsing of options, both command line and config file

1625

1754

1626

parser = optparse.OptionParser(version = "%%prog %s" % version)

1627

parser.add_option("-i", u"--interface", type=u"string",

1628

metavar="IF", help=u"Bind to interface IF")

1629

parser.add_option("-a", u"--address", type=u"string",

1630

help=u"Address to listen for requests on")

1631

parser.add_option("-p", u"--port", type=u"int",

1632

help=u"Port number to receive requests on")

1633

parser.add_option("--check", action=u"store_true",

1634

help=u"Run self-test")

1635

parser.add_option("--debug", action=u"store_true",

1636

help=u"Debug mode; run in foreground and log to"

1637

u" terminal")

1638

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1639

help=u"Debug level for stdout output")

1640

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1641

u" priority string (see GnuTLS documentation)")

1642

parser.add_option("--servicename", type=u"string",

1643

metavar=u"NAME", help=u"Zeroconf service name")

1644

parser.add_option("--configdir", type=u"string",

1645

default=u"/etc/mandos", metavar=u"DIR",

1646

help=u"Directory to search for configuration"

1647

u" files")

1648

parser.add_option("--no-dbus", action=u"store_false",

1649

dest=u"use_dbus", help=u"Do not provide D-Bus"

1650

u" system bus interface")

1651

parser.add_option("--no-ipv6", action=u"store_false",

1652

dest=u"use_ipv6", help=u"Do not use IPv6")

1653

options = parser.parse_args()[0]

1755

parser = argparse.ArgumentParser()

1756

parser.add_argument("-v", "--version", action="version",

1757

version = "%%(prog)s %s" % version,

1758

help="show version number and exit")

1759

parser.add_argument("-i", "--interface", metavar="IF",

1760

help="Bind to interface IF")

1761

parser.add_argument("-a", "--address",

1762

help="Address to listen for requests on")

1763

parser.add_argument("-p", "--port", type=int,

1764

help="Port number to receive requests on")

1765

parser.add_argument("--check", action="store_true",

1766

help="Run self-test")

1767

parser.add_argument("--debug", action="store_true",

1768

help="Debug mode; run in foreground and log"

1769

" to terminal")

1770

parser.add_argument("--debuglevel", metavar="LEVEL",

1771

help="Debug level for stdout output")

1772

parser.add_argument("--priority", help="GnuTLS"

1773

" priority string (see GnuTLS documentation)")

1774

parser.add_argument("--servicename",

1775

metavar="NAME", help="Zeroconf service name")

1776

parser.add_argument("--configdir",

1777

default="/etc/mandos", metavar="DIR",

1778

help="Directory to search for configuration"

1779

" files")

1780

parser.add_argument("--no-dbus", action="store_false",

1781

dest="use_dbus", help="Do not provide D-Bus"

1782

" system bus interface")

1783

parser.add_argument("--no-ipv6", action="store_false",

1784

dest="use_ipv6", help="Do not use IPv6")

1785

options = parser.parse_args()

1654

1786

1655

1787

if options.check:

1656

1788

import doctest

1658

1790

sys.exit()

1659

1791

1660

1792

# Default values for config file for server-global settings

1661

server_defaults = { u"interface": u"",

1662

u"address": u"",

1663

u"port": u"",

1664

u"debug": u"False",

1665

u"priority":

1666

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1667

u"servicename": u"Mandos",

1668

u"use_dbus": u"True",

1669

u"use_ipv6": u"True",

1670

u"debuglevel": u"",

1793

server_defaults = { "interface": "",

1794

"address": "",

1795

"port": "",

1796

"debug": "False",

1797

"priority":

1798

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1799

"servicename": "Mandos",

1800

"use_dbus": "True",

1801

"use_ipv6": "True",

1802

"debuglevel": "",

1671

1803

}

1672

1804

1673

1805

# Parse config file for server-global settings

1674

1806

server_config = configparser.SafeConfigParser(server_defaults)

1675

1807

del server_defaults

1676

1808

server_config.read(os.path.join(options.configdir,

1677

u"mandos.conf"))

1809

"mandos.conf"))

1678

1810

# Convert the SafeConfigParser object to a dict

1679

1811

server_settings = server_config.defaults()

1680

1812

# Use the appropriate methods on the non-string config options

1681

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1682

server_settings[option] = server_config.getboolean(u"DEFAULT",

1813

for option in ("debug", "use_dbus", "use_ipv6"):

1814

server_settings[option] = server_config.getboolean("DEFAULT",

1683

1815

option)

1684

1816

if server_settings["port"]:

1685

server_settings["port"] = server_config.getint(u"DEFAULT",

1686

u"port")

1817

server_settings["port"] = server_config.getint("DEFAULT",

1818

"port")

1687

1819

del server_config

1688

1820

1689

1821

# Override the settings from the config file with command line

1690

1822

# options, if set.

1691

for option in (u"interface", u"address", u"port", u"debug",

1692

u"priority", u"servicename", u"configdir",

1693

u"use_dbus", u"use_ipv6", u"debuglevel"):

1823

for option in ("interface", "address", "port", "debug",

1824

"priority", "servicename", "configdir",

1825

"use_dbus", "use_ipv6", "debuglevel"):

1694

1826

value = getattr(options, option)

1695

1827

if value is not None:

1696

1828

server_settings[option] = value

1704

1836

##################################################################

1705

1837

1706

1838

# For convenience

1707

debug = server_settings[u"debug"]

1708

debuglevel = server_settings[u"debuglevel"]

1709

use_dbus = server_settings[u"use_dbus"]

1710

use_ipv6 = server_settings[u"use_ipv6"]

1839

debug = server_settings["debug"]

1840

debuglevel = server_settings["debuglevel"]

1841

use_dbus = server_settings["use_dbus"]

1842

use_ipv6 = server_settings["use_ipv6"]

1711

1843

1712

if server_settings[u"servicename"] != u"Mandos":

1844

if server_settings["servicename"] != "Mandos":

1713

1845

syslogger.setFormatter(logging.Formatter

1714

(u'Mandos (%s) [%%(process)d]:'

1715

u' %%(levelname)s: %%(message)s'

1716

% server_settings[u"servicename"]))

1846

('Mandos (%s) [%%(process)d]:'

1847

' %%(levelname)s: %%(message)s'

1848

% server_settings["servicename"]))

1717

1849

1718

1850

# Parse config file with clients

1719

client_defaults = { u"timeout": u"1h",

1720

u"interval": u"5m",

1721

u"checker": u"fping -q -- %%(host)s",

1722

u"host": u"",

1723

u"approved_delay": u"0s",

1724

u"approved_duration": u"1s",

1851

client_defaults = { "timeout": "5m",

1852

"extended_timeout": "15m",

1853

"interval": "2m",

1854

"checker": "fping -q -- %%(host)s",

1855

"host": "",

1856

"approval_delay": "0s",

1857

"approval_duration": "1s",

1725

1858

}

1726

1859

client_config = configparser.SafeConfigParser(client_defaults)

1727

client_config.read(os.path.join(server_settings[u"configdir"],

1728

u"clients.conf"))

1860

client_config.read(os.path.join(server_settings["configdir"],

1861

"clients.conf"))

1729

1862

1730

1863

global mandos_dbus_service

1731

1864

mandos_dbus_service = None

1732

1865

1733

tcp_server = MandosServer((server_settings[u"address"],

1734

server_settings[u"port"]),

1866

tcp_server = MandosServer((server_settings["address"],

1867

server_settings["port"]),

1735

1868

ClientHandler,

1736

interface=server_settings[u"interface"],

1869

interface=(server_settings["interface"]

1870

or None),

1737

1871

use_ipv6=use_ipv6,

1738

1872

gnutls_priority=

1739

server_settings[u"priority"],

1873

server_settings["priority"],

1740

1874

use_dbus=use_dbus)

1741

pidfilename = u"/var/run/mandos.pid"

1742

try:

1743

pidfile = open(pidfilename, u"w")

1744

except IOError:

1745

logger.error(u"Could not open file %r", pidfilename)

1875

if not debug:

1876

pidfilename = "/var/run/mandos.pid"

1877

try:

1878

pidfile = open(pidfilename, "w")

1879

except IOError:

1880

logger.error("Could not open file %r", pidfilename)

1746

1881

1747

1882

try:

1748

uid = pwd.getpwnam(u"_mandos").pw_uid

1749

gid = pwd.getpwnam(u"_mandos").pw_gid

1883

uid = pwd.getpwnam("_mandos").pw_uid

1884

gid = pwd.getpwnam("_mandos").pw_gid

1750

1885

except KeyError:

1751

1886

try:

1752

uid = pwd.getpwnam(u"mandos").pw_uid

1753

gid = pwd.getpwnam(u"mandos").pw_gid

1887

uid = pwd.getpwnam("mandos").pw_uid

1888

gid = pwd.getpwnam("mandos").pw_gid

1754

1889

except KeyError:

1755

1890

try:

1756

uid = pwd.getpwnam(u"nobody").pw_uid

1757

gid = pwd.getpwnam(u"nobody").pw_gid

1891

uid = pwd.getpwnam("nobody").pw_uid

1892

gid = pwd.getpwnam("nobody").pw_gid

1758

1893

except KeyError:

1759

1894

uid = 65534

1760

1895

gid = 65534

1761

1896

try:

1762

1897

os.setgid(gid)

1763

1898

os.setuid(uid)

1764

except OSError, error:

1899

except OSError as error:

1765

1900

if error[0] != errno.EPERM:

1766

1901

raise error

1767

1902

1768

# Enable all possible GnuTLS debugging

1769

1770

1771

1903

if not debug and not debuglevel:

1772

1904

syslogger.setLevel(logging.WARNING)

1773

1905

console.setLevel(logging.WARNING)

1777

1909

console.setLevel(level)

1778

1910

1779

1911

if debug:

1912

# Enable all possible GnuTLS debugging

1913

1780

1914

# "Use a log level over 10 to enable all debugging options."

1781

1915

# - GnuTLS manual

1782

1916

gnutls.library.functions.gnutls_global_set_log_level(11)

1783

1917

1784

1918

@gnutls.library.types.gnutls_log_func

1785

1919

def debug_gnutls(level, string):

1786

logger.debug(u"GnuTLS: %s", string[:-1])

1920

logger.debug("GnuTLS: %s", string[:-1])

1787

1921

1788

1922

(gnutls.library.functions

1789

1923

.gnutls_global_set_log_function(debug_gnutls))

1790

1924

1791

1925

# Redirect stdin so all checkers get /dev/null

1792

1926

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1793

1927

os.dup2(null, sys.stdin.fileno())

1796

1930

else:

1797

1931

# No console logging

1798

1932

logger.removeHandler(console)

1799

1933

1934

# Need to fork before connecting to D-Bus

1935

if not debug:

1936

# Close all input and output, do double fork, etc.

1937

daemon()

1800

1938

1801

1939

global main_loop

1802

1940

# From the Avahi example code

1806

1944

# End of Avahi example code

1807

1945

if use_dbus:

1808

1946

try:

1809

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1947

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1810

1948

bus, do_not_queue=True)

1811

except dbus.exceptions.NameExistsException, e:

1812

logger.error(unicode(e) + u", disabling D-Bus")

1949

except dbus.exceptions.NameExistsException as e:

1950

logger.error(unicode(e) + ", disabling D-Bus")

1813

1951

use_dbus = False

1814

server_settings[u"use_dbus"] = False

1952

server_settings["use_dbus"] = False

1815

1953

tcp_server.use_dbus = False

1816

1954

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1817

service = AvahiService(name = server_settings[u"servicename"],

1818

servicetype = u"_mandos._tcp",

1955

service = AvahiService(name = server_settings["servicename"],

1956

servicetype = "_mandos._tcp",

1819

1957

protocol = protocol, bus = bus)

1820

1958

if server_settings["interface"]:

1821

1959

service.interface = (if_nametoindex

1822

(str(server_settings[u"interface"])))

1823

1824

if not debug:

1825

# Close all input and output, do double fork, etc.

1826

daemon()

1827

1960

(str(server_settings["interface"])))

1961

1828

1962

global multiprocessing_manager

1829

1963

multiprocessing_manager = multiprocessing.Manager()

1830

1964

1849

1983

client_config, section)))

1850

1984

for section in client_config.sections()))

1851

1985

if not tcp_server.clients:

1852

logger.warning(u"No clients defined")

1986

logger.warning("No clients defined")

1853

1987

1854

try:

1855

with pidfile:

1856

pid = os.getpid()

1857

pidfile.write(str(pid) + "\n")

1858

del pidfile

1859

except IOError:

1860

logger.error(u"Could not write to file %r with PID %d",

1861

pidfilename, pid)

1862

except NameError:

1863

# "pidfile" was never created

1864

pass

1865

del pidfilename

1866

1867

1988

if not debug:

1989

try:

1990

with pidfile:

1991

pid = os.getpid()

1992

pidfile.write(str(pid) + "\n".encode("utf-8"))

1993

del pidfile

1994

except IOError:

1995

logger.error("Could not write to file %r with PID %d",

1996

pidfilename, pid)

1997

except NameError:

1998

# "pidfile" was never created

1999

pass

2000

del pidfilename

2001

1868

2002

signal.signal(signal.SIGINT, signal.SIG_IGN)

2003

1869

2004

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1870

2005

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1871

2006

1873

2008

class MandosDBusService(dbus.service.Object):

1874

2009

"""A D-Bus proxy object"""

1875

2010

def __init__(self):

1876

dbus.service.Object.__init__(self, bus, u"/")

1877

_interface = u"se.bsnet.fukt.Mandos"

2011

dbus.service.Object.__init__(self, bus, "/")

2012

_interface = "se.bsnet.fukt.Mandos"

1878

2013

1879

@dbus.service.signal(_interface, signature=u"o")

2014

@dbus.service.signal(_interface, signature="o")

1880

2015

def ClientAdded(self, objpath):

1881

2016

"D-Bus signal"

1882

2017

pass

1883

2018

1884

@dbus.service.signal(_interface, signature=u"ss")

2019

@dbus.service.signal(_interface, signature="ss")

1885

2020

def ClientNotFound(self, fingerprint, address):

1886

2021

"D-Bus signal"

1887

2022

pass

1888

2023

1889

@dbus.service.signal(_interface, signature=u"os")

2024

@dbus.service.signal(_interface, signature="os")

1890

2025

def ClientRemoved(self, objpath, name):

1891

2026

"D-Bus signal"

1892

2027

pass

1893

2028

1894

@dbus.service.method(_interface, out_signature=u"ao")

2029

@dbus.service.method(_interface, out_signature="ao")

1895

2030

def GetAllClients(self):

1896

2031

"D-Bus method"

1897

2032

return dbus.Array(c.dbus_object_path

1898

2033

for c in tcp_server.clients)

1899

2034

1900

2035

@dbus.service.method(_interface,

1901

out_signature=u"a{oa{sv}}")

2036

out_signature="a{oa{sv}}")

1902

2037

def GetAllClientsWithProperties(self):

1903

2038

"D-Bus method"

1904

2039

return dbus.Dictionary(

1905

((c.dbus_object_path, c.GetAll(u""))

2040

((c.dbus_object_path, c.GetAll(""))

1906

2041

for c in tcp_server.clients),

1907

signature=u"oa{sv}")

2042

signature="oa{sv}")

1908

2043

1909

@dbus.service.method(_interface, in_signature=u"o")

2044

@dbus.service.method(_interface, in_signature="o")

1910

2045

def RemoveClient(self, object_path):

1911

2046

"D-Bus method"

1912

2047

for c in tcp_server.clients:

1954

2089

# Find out what port we got

1955

2090

service.port = tcp_server.socket.getsockname()[1]

1956

2091

if use_ipv6:

1957

logger.info(u"Now listening on address %r, port %d,"

2092

logger.info("Now listening on address %r, port %d,"

1958

2093

" flowinfo %d, scope_id %d"

1959

2094

% tcp_server.socket.getsockname())

1960

2095

else: # IPv4

1961

logger.info(u"Now listening on address %r, port %d"

2096

logger.info("Now listening on address %r, port %d"

1962

2097

% tcp_server.socket.getsockname())

1963

2098

1964

2099

#service.interface = tcp_server.socket.getsockname()[3]

1967

2102

# From the Avahi example code

1968

2103

try:

1969

2104

service.activate()

1970

except dbus.exceptions.DBusException, error:

1971

logger.critical(u"DBusException: %s", error)

2105

except dbus.exceptions.DBusException as error:

2106

logger.critical("DBusException: %s", error)

1972

2107

cleanup()

1973

2108

sys.exit(1)

1974

2109

# End of Avahi example code

1978

2113

(tcp_server.handle_request

1979

2114

(*args[2:], **kwargs) or True))

1980

2115

1981

logger.debug(u"Starting main loop")

2116

logger.debug("Starting main loop")

1982

2117

main_loop.run()

1983

except AvahiError, error:

1984

logger.critical(u"AvahiError: %s", error)

2118

except AvahiError as error:

2119

logger.critical("AvahiError: %s", error)

1985

2120

cleanup()

1986

2121

sys.exit(1)

1987

2122

except KeyboardInterrupt:

1988

2123

if debug:

1989

print >> sys.stderr

1990

logger.debug(u"Server received KeyboardInterrupt")

1991

logger.debug(u"Server exiting")

2124

print("", file=sys.stderr)

2125

logger.debug("Server received KeyboardInterrupt")

2126

logger.debug("Server exiting")

1992

2127

# Must run before the D-Bus bus name gets deregistered

1993

2128

cleanup()

1994

2129