/mandos/release : revision 237.7.48

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

55

56

import logging

56

57

import logging.handlers

57

58

import pwd

58

from contextlib import closing

59

import contextlib

59

60

import struct

60

61

import fcntl

61

62

import functools

63

import cPickle as pickle

64

import multiprocessing

62

65

63

66

import dbus

64

67

import dbus.service

79

82

SO_BINDTODEVICE = None

80

83

81

84

82

version = "1.0.14"

85

version = "1.3.1"

83

86

84

logger = logging.Logger(u'mandos')

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

85

89

syslogger = (logging.handlers.SysLogHandler

86

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

87

address = "/dev/log"))

91

address = str("/dev/log")))

88

92

syslogger.setFormatter(logging.Formatter

89

(u'Mandos [%(process)d]: %(levelname)s:'

90

u' %(message)s'))

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

91

95

logger.addHandler(syslogger)

92

96

93

97

console = logging.StreamHandler()

94

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

95

u' %(levelname)s:'

96

u' %(message)s'))

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

97

101

logger.addHandler(console)

98

102

99

103

class AvahiError(Exception):

116

120

Attributes:

117

121

interface: integer; avahi.IF_UNSPEC or an interface index.

118

122

Used to optionally bind to the specified interface.

119

120

type: string; Example: u'_mandos._tcp'.

123

124

type: string; Example: '_mandos._tcp'.

121

125

See <http://www.dns-sd.org/ServiceTypes.html>

122

126

port: integer; what port to announce

123

127

TXT: list of strings; TXT record for the service

132

136

"""

133

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

134

138

servicetype = None, port = None, TXT = None,

135

domain = u"", host = u"", max_renames = 32768,

139

domain = "", host = "", max_renames = 32768,

136

140

protocol = avahi.PROTO_UNSPEC, bus = None):

137

141

self.interface = interface

138

142

self.name = name

147

151

self.group = None # our entry group

148

152

self.server = None

149

153

self.bus = bus

154

self.entry_group_state_changed_match = None

150

155

def rename(self):

151

156

"""Derived from the Avahi example code"""

152

157

if self.rename_count >= self.max_renames:

153

logger.critical(u"No suitable Zeroconf service name found"

154

u" after %i retries, exiting.",

158

logger.critical("No suitable Zeroconf service name found"

159

" after %i retries, exiting.",

155

160

self.rename_count)

156

raise AvahiServiceError(u"Too many renames")

157

self.name = self.server.GetAlternativeServiceName(self.name)

158

logger.info(u"Changing Zeroconf service name to %r ...",

159

unicode(self.name))

161

raise AvahiServiceError("Too many renames")

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

163

logger.info("Changing Zeroconf service name to %r ...",

164

self.name)

160

165

syslogger.setFormatter(logging.Formatter

161

(u'Mandos (%s) [%%(process)d]:'

162

u' %%(levelname)s: %%(message)s'

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

163

168

% self.name))

164

169

self.remove()

165

self.add()

170

try:

171

self.add()

172

except dbus.exceptions.DBusException as error:

173

logger.critical("DBusException: %s", error)

174

self.cleanup()

175

os._exit(1)

166

176

self.rename_count += 1

167

177

def remove(self):

168

178

"""Derived from the Avahi example code"""

179

if self.entry_group_state_changed_match is not None:

180

self.entry_group_state_changed_match.remove()

181

self.entry_group_state_changed_match = None

169

182

if self.group is not None:

170

183

self.group.Reset()

171

184

def add(self):

172

185

"""Derived from the Avahi example code"""

186

self.remove()

173

187

if self.group is None:

174

188

self.group = dbus.Interface(

175

189

self.bus.get_object(avahi.DBUS_NAME,

176

190

self.server.EntryGroupNew()),

177

191

avahi.DBUS_INTERFACE_ENTRY_GROUP)

178

self.group.connect_to_signal('StateChanged',

179

self

180

.entry_group_state_changed)

181

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

192

self.entry_group_state_changed_match = (

193

self.group.connect_to_signal(

194

'StateChanged', self .entry_group_state_changed))

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

182

196

self.name, self.type)

183

197

self.group.AddService(

184

198

self.interface,

191

205

self.group.Commit()

192

206

def entry_group_state_changed(self, state, error):

193

207

"""Derived from the Avahi example code"""

194

logger.debug(u"Avahi state change: %i", state)

208

logger.debug("Avahi entry group state change: %i", state)

195

209

196

210

if state == avahi.ENTRY_GROUP_ESTABLISHED:

197

logger.debug(u"Zeroconf service established.")

211

logger.debug("Zeroconf service established.")

198

212

elif state == avahi.ENTRY_GROUP_COLLISION:

199

logger.warning(u"Zeroconf service name collision.")

213

logger.info("Zeroconf service name collision.")

200

214

self.rename()

201

215

elif state == avahi.ENTRY_GROUP_FAILURE:

202

logger.critical(u"Avahi: Error in group state changed %s",

216

logger.critical("Avahi: Error in group state changed %s",

203

217

unicode(error))

204

raise AvahiGroupError(u"State changed: %s"

218

raise AvahiGroupError("State changed: %s"

205

219

% unicode(error))

206

220

def cleanup(self):

207

221

"""Derived from the Avahi example code"""

208

222

if self.group is not None:

209

self.group.Free()

223

try:

224

self.group.Free()

225

except (dbus.exceptions.UnknownMethodException,

226

dbus.exceptions.DBusException) as e:

227

pass

210

228

self.group = None

211

def server_state_changed(self, state):

229

self.remove()

230

def server_state_changed(self, state, error=None):

212

231

"""Derived from the Avahi example code"""

213

if state == avahi.SERVER_COLLISION:

214

logger.error(u"Zeroconf server name collision")

215

self.remove()

232

logger.debug("Avahi server state change: %i", state)

233

bad_states = { avahi.SERVER_INVALID:

234

"Zeroconf server invalid",

235

avahi.SERVER_REGISTERING: None,

236

avahi.SERVER_COLLISION:

237

"Zeroconf server name collision",

238

avahi.SERVER_FAILURE:

239

"Zeroconf server failure" }

240

if state in bad_states:

241

if bad_states[state] is not None:

242

if error is None:

243

logger.error(bad_states[state])

244

else:

245

logger.error(bad_states[state] + ": %r", error)

246

self.cleanup()

216

247

elif state == avahi.SERVER_RUNNING:

217

248

self.add()

249

else:

250

if error is None:

251

logger.debug("Unknown state: %r", state)

252

else:

253

logger.debug("Unknown state: %r: %r", state, error)

218

254

def activate(self):

219

255

"""Derived from the Avahi example code"""

220

256

if self.server is None:

221

257

self.server = dbus.Interface(

222

258

self.bus.get_object(avahi.DBUS_NAME,

223

avahi.DBUS_PATH_SERVER),

259

avahi.DBUS_PATH_SERVER,

260

follow_name_owner_changes=True),

224

261

avahi.DBUS_INTERFACE_SERVER)

225

self.server.connect_to_signal(u"StateChanged",

262

self.server.connect_to_signal("StateChanged",

226

263

self.server_state_changed)

227

264

self.server_state_changed(self.server.GetState())

228

265

231

268

"""A representation of a client host served by this server.

232

269

233

270

Attributes:

234

235

D-Bus identifiers

236

fingerprint: string (40 or 32 hexadecimal digits); used to

237

uniquely identify the client

238

secret: bytestring; sent verbatim (over TLS) to client

239

host: string; available for use by the checker command

240

created: datetime.datetime(); (UTC) object creation

241

last_enabled: datetime.datetime(); (UTC)

242

enabled: bool()

243

last_checked_ok: datetime.datetime(); (UTC) or None

244

timeout: datetime.timedelta(); How long from last_checked_ok

245

until this client is invalid

246

interval: datetime.timedelta(); How often to start a new checker

247

disable_hook: If set, called by disable() as disable_hook(self)

271

_approved: bool(); 'None' if not yet approved/disapproved

272

approval_delay: datetime.timedelta(); Time to wait for approval

273

approval_duration: datetime.timedelta(); Duration of one approval

248

274

checker: subprocess.Popen(); a running checker process used

249

275

to see if the client lives.

250

276

'None' if no process is running.

251

checker_initiator_tag: a gobject event source tag, or None

252

disable_initiator_tag: - '' -

253

checker_callback_tag: - '' -

254

checker_command: string; External command which is run to check if

255

client lives. %() expansions are done at

277

checker_callback_tag: a gobject event source tag, or None

278

checker_command: string; External command which is run to check

279

if client lives. %() expansions are done at

256

280

runtime with vars(self) as dict, so that for

257

281

instance %(name)s can be used in the command.

282

checker_initiator_tag: a gobject event source tag, or None

283

created: datetime.datetime(); (UTC) object creation

258

284

current_checker_command: string; current running checker_command

285

disable_hook: If set, called by disable() as disable_hook(self)

286

disable_initiator_tag: a gobject event source tag, or None

287

enabled: bool()

288

fingerprint: string (40 or 32 hexadecimal digits); used to

289

uniquely identify the client

290

host: string; available for use by the checker command

291

interval: datetime.timedelta(); How often to start a new checker

292

last_approval_request: datetime.datetime(); (UTC) or None

293

last_checked_ok: datetime.datetime(); (UTC) or None

294

last_enabled: datetime.datetime(); (UTC)

295

296

D-Bus identifiers

297

secret: bytestring; sent verbatim (over TLS) to client

298

timeout: datetime.timedelta(); How long from last_checked_ok

299

until this client is disabled

300

extended_timeout: extra long timeout when password has been sent

301

runtime_expansions: Allowed attributes for runtime expansion.

302

expires: datetime.datetime(); time (UTC) when a client will be

303

disabled, or None

259

304

"""

260

305

306

runtime_expansions = ("approval_delay", "approval_duration",

307

"created", "enabled", "fingerprint",

308

"host", "interval", "last_checked_ok",

309

"last_enabled", "name", "timeout")

310

261

311

@staticmethod

262

312

def _timedelta_to_milliseconds(td):

263

313

"Convert a datetime.timedelta() to milliseconds"

268

318

def timeout_milliseconds(self):

269

319

"Return the 'timeout' attribute in milliseconds"

270

320

return self._timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return self._timedelta_to_milliseconds(self.extended_timeout)

271

325

272

326

def interval_milliseconds(self):

273

327

"Return the 'interval' attribute in milliseconds"

274

328

return self._timedelta_to_milliseconds(self.interval)

329

330

def approval_delay_milliseconds(self):

331

return self._timedelta_to_milliseconds(self.approval_delay)

275

332

276

333

def __init__(self, name = None, disable_hook=None, config=None):

277

334

"""Note: the 'checker' key in 'config' sets the

280

337

self.name = name

281

338

if config is None:

282

339

config = {}

283

logger.debug(u"Creating client %r", self.name)

340

logger.debug("Creating client %r", self.name)

284

341

# Uppercase and remove spaces from fingerprint for later

285

342

# comparison purposes with return value from the fingerprint()

286

343

# function

287

self.fingerprint = (config[u"fingerprint"].upper()

288

.replace(u" ", u""))

289

logger.debug(u" Fingerprint: %s", self.fingerprint)

290

if u"secret" in config:

291

self.secret = config[u"secret"].decode(u"base64")

292

elif u"secfile" in config:

293

with closing(open(os.path.expanduser

294

(os.path.expandvars

295

(config[u"secfile"])),

296

"rb")) as secfile:

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

350

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

352

"rb") as secfile:

297

353

self.secret = secfile.read()

298

354

else:

299

raise TypeError(u"No secret or secfile for client %s"

355

raise TypeError("No secret or secfile for client %s"

300

356

% self.name)

301

self.host = config.get(u"host", u"")

357

self.host = config.get("host", "")

302

358

self.created = datetime.datetime.utcnow()

303

359

self.enabled = False

360

self.last_approval_request = None

304

361

self.last_enabled = None

305

362

self.last_checked_ok = None

306

self.timeout = string_to_delta(config[u"timeout"])

307

self.interval = string_to_delta(config[u"interval"])

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

308

366

self.disable_hook = disable_hook

309

367

self.checker = None

310

368

self.checker_initiator_tag = None

311

369

self.disable_initiator_tag = None

370

self.expires = None

312

371

self.checker_callback_tag = None

313

self.checker_command = config[u"checker"]

372

self.checker_command = config["checker"]

314

373

self.current_checker_command = None

315

374

self.last_connect = None

375

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

377

True)

378

self.approvals_pending = 0

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

316

384

385

def send_changedstate(self):

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

317

390

def enable(self):

318

391

"""Start this client's checker and timeout hooks"""

319

if getattr(self, u"enabled", False):

392

if getattr(self, "enabled", False):

320

393

# Already enabled

321

394

return

395

self.send_changedstate()

322

396

self.last_enabled = datetime.datetime.utcnow()

323

397

# Schedule a new checker to be started an 'interval' from now,

324

398

# and every interval from then on.

326

400

(self.interval_milliseconds(),

327

401

self.start_checker))

328

402

# Schedule a disable() when 'timeout' has passed

403

self.expires = datetime.datetime.utcnow() + self.timeout

329

404

self.disable_initiator_tag = (gobject.timeout_add

330

405

(self.timeout_milliseconds(),

331

406

self.disable))

338

413

if not getattr(self, "enabled", False):

339

414

return False

340

415

if not quiet:

341

logger.info(u"Disabling client %s", self.name)

342

if getattr(self, u"disable_initiator_tag", False):

416

self.send_changedstate()

417

if not quiet:

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

343

420

gobject.source_remove(self.disable_initiator_tag)

344

421

self.disable_initiator_tag = None

345

if getattr(self, u"checker_initiator_tag", False):

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

346

424

gobject.source_remove(self.checker_initiator_tag)

347

425

self.checker_initiator_tag = None

348

426

self.stop_checker()

363

441

if os.WIFEXITED(condition):

364

442

exitstatus = os.WEXITSTATUS(condition)

365

443

if exitstatus == 0:

366

logger.info(u"Checker for %(name)s succeeded",

444

logger.info("Checker for %(name)s succeeded",

367

445

vars(self))

368

446

self.checked_ok()

369

447

else:

370

logger.info(u"Checker for %(name)s failed",

448

logger.info("Checker for %(name)s failed",

371

449

vars(self))

372

450

else:

373

logger.warning(u"Checker for %(name)s crashed?",

451

logger.warning("Checker for %(name)s crashed?",

374

452

vars(self))

375

453

376

def checked_ok(self):

454

def checked_ok(self, timeout=None):

377

455

"""Bump up the timeout for this client.

378

456

379

457

This should only be called when the client has been seen,

380

458

alive and well.

381

459

"""

460

if timeout is None:

461

timeout = self.timeout

382

462

self.last_checked_ok = datetime.datetime.utcnow()

383

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

384

465

self.disable_initiator_tag = (gobject.timeout_add

385

(self.timeout_milliseconds(),

466

(self._timedelta_to_milliseconds(timeout),

386

467

self.disable))

387

468

469

def need_approval(self):

470

self.last_approval_request = datetime.datetime.utcnow()

471

388

472

def start_checker(self):

389

473

"""Start a new checker subprocess if one is not running.

390

474

396

480

# client would inevitably timeout, since no checker would get

397

481

# a chance to run to completion. If we instead leave running

398

482

# checkers alone, the checker would have to take more time

399

# than 'timeout' for the client to be declared invalid, which

400

# is as it should be.

483

# than 'timeout' for the client to be disabled, which is as it

484

# should be.

401

485

402

486

# If a checker exists, make sure it is not a zombie

403

487

try:

404

488

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

405

except (AttributeError, OSError), error:

489

except (AttributeError, OSError) as error:

406

490

if (isinstance(error, OSError)

407

491

and error.errno != errno.ECHILD):

408

492

raise error

409

493

else:

410

494

if pid:

411

logger.warning(u"Checker was a zombie")

495

logger.warning("Checker was a zombie")

412

496

gobject.source_remove(self.checker_callback_tag)

413

497

self.checker_callback(pid, status,

414

498

self.current_checker_command)

419

503

command = self.checker_command % self.host

420

504

except TypeError:

421

505

# Escape attributes for the shell

422

escaped_attrs = dict((key,

423

re.escape(unicode(str(val),

424

errors=

425

u'replace')))

426

for key, val in

427

vars(self).iteritems())

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

428

514

try:

429

515

command = self.checker_command % escaped_attrs

430

except TypeError, error:

431

logger.error(u'Could not format string "%s":'

432

u' %s', self.checker_command, error)

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

433

519

return True # Try again later

434

520

self.current_checker_command = command

435

521

try:

436

logger.info(u"Starting checker %r for %s",

522

logger.info("Starting checker %r for %s",

437

523

command, self.name)

438

524

# We don't need to redirect stdout and stderr, since

439

525

# in normal mode, that is already done by daemon(),

441

527

# always replaced by /dev/null.)

442

528

self.checker = subprocess.Popen(command,

443

529

close_fds=True,

444

shell=True, cwd=u"/")

530

shell=True, cwd="/")

445

531

self.checker_callback_tag = (gobject.child_watch_add

446

532

(self.checker.pid,

447

533

self.checker_callback,

452

538

if pid:

453

539

gobject.source_remove(self.checker_callback_tag)

454

540

self.checker_callback(pid, status, command)

455

except OSError, error:

456

logger.error(u"Failed to start subprocess: %s",

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

457

543

error)

458

544

# Re-run this periodically if run by gobject.timeout_add

459

545

return True

463

549

if self.checker_callback_tag:

464

550

gobject.source_remove(self.checker_callback_tag)

465

551

self.checker_callback_tag = None

466

if getattr(self, u"checker", None) is None:

552

if getattr(self, "checker", None) is None:

467

553

return

468

logger.debug(u"Stopping checker for %(name)s", vars(self))

554

logger.debug("Stopping checker for %(name)s", vars(self))

469

555

try:

470

556

os.kill(self.checker.pid, signal.SIGTERM)

471

557

#time.sleep(0.5)

472

558

#if self.checker.poll() is None:

473

559

# os.kill(self.checker.pid, signal.SIGKILL)

474

except OSError, error:

560

except OSError as error:

475

561

if error.errno != errno.ESRCH: # No such process

476

562

raise

477

563

self.checker = None

478

479

def still_valid(self):

480

"""Has the timeout not yet passed for this client?"""

481

if not getattr(self, u"enabled", False):

482

return False

483

now = datetime.datetime.utcnow()

484

if self.last_checked_ok is None:

485

return now < (self.created + self.timeout)

486

else:

487

return now < (self.last_checked_ok + self.timeout)

488

489

490

def dbus_service_property(dbus_interface, signature=u"v",

491

access=u"readwrite", byte_arrays=False):

564

565

def dbus_service_property(dbus_interface, signature="v",

566

access="readwrite", byte_arrays=False):

492

567

"""Decorators for marking methods of a DBusObjectWithProperties to

493

568

become properties on the D-Bus.

494

569

499

574

dbus.service.method, except there is only "signature", since the

500

575

type from Get() and the type sent to Set() is the same.

501

576

"""

577

# Encoding deeply encoded byte arrays is not supported yet by the

578

# "Set" method, so we fail early here:

579

if byte_arrays and signature != "ay":

580

raise ValueError("Byte arrays not supported for non-'ay'"

581

" signature %r" % signature)

502

582

def decorator(func):

503

583

func._dbus_is_property = True

504

584

func._dbus_interface = dbus_interface

505

585

func._dbus_signature = signature

506

586

func._dbus_access = access

507

587

func._dbus_name = func.__name__

508

if func._dbus_name.endswith(u"_dbus_property"):

588

if func._dbus_name.endswith("_dbus_property"):

509

589

func._dbus_name = func._dbus_name[:-14]

510

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

590

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

511

591

return func

512

592

return decorator

513

593

541

621

542

622

@staticmethod

543

623

def _is_dbus_property(obj):

544

return getattr(obj, u"_dbus_is_property", False)

624

return getattr(obj, "_dbus_is_property", False)

545

625

546

626

def _get_all_dbus_properties(self):

547

627

"""Returns a generator of (name, attribute) pairs

555

635

property with the specified name and interface.

556

636

"""

557

637

for name in (property_name,

558

property_name + u"_dbus_property"):

638

property_name + "_dbus_property"):

559

639

prop = getattr(self, name, None)

560

640

if (prop is None

561

641

or not self._is_dbus_property(prop)

565

645

continue

566

646

return prop

567

647

# No such property

568

raise DBusPropertyNotFound(self.dbus_object_path + u":"

569

+ interface_name + u"."

648

raise DBusPropertyNotFound(self.dbus_object_path + ":"

649

+ interface_name + "."

570

650

+ property_name)

571

651

572

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

573

out_signature=u"v")

652

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

653

out_signature="v")

574

654

def Get(self, interface_name, property_name):

575

655

"""Standard D-Bus property Get() method, see D-Bus standard.

576

656

"""

577

657

prop = self._get_dbus_property(interface_name, property_name)

578

if prop._dbus_access == u"write":

658

if prop._dbus_access == "write":

579

659

raise DBusPropertyAccessException(property_name)

580

660

value = prop()

581

if not hasattr(value, u"variant_level"):

661

if not hasattr(value, "variant_level"):

582

662

return value

583

663

return type(value)(value, variant_level=value.variant_level+1)

584

664

585

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

665

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

586

666

def Set(self, interface_name, property_name, value):

587

667

"""Standard D-Bus property Set() method, see D-Bus standard.

588

668

"""

589

669

prop = self._get_dbus_property(interface_name, property_name)

590

if prop._dbus_access == u"read":

670

if prop._dbus_access == "read":

591

671

raise DBusPropertyAccessException(property_name)

592

if prop._dbus_get_args_options[u"byte_arrays"]:

672

if prop._dbus_get_args_options["byte_arrays"]:

673

# The byte_arrays option is not supported yet on

674

# signatures other than "ay".

675

if prop._dbus_signature != "ay":

676

raise ValueError

593

677

value = dbus.ByteArray(''.join(unichr(byte)

594

678

for byte in value))

595

679

prop(value)

596

680

597

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

598

out_signature=u"a{sv}")

681

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

682

out_signature="a{sv}")

599

683

def GetAll(self, interface_name):

600

684

"""Standard D-Bus property GetAll() method, see D-Bus

601

685

standard.

609

693

# Interface non-empty but did not match

610

694

continue

611

695

# Ignore write-only properties

612

if prop._dbus_access == u"write":

696

if prop._dbus_access == "write":

613

697

continue

614

698

value = prop()

615

if not hasattr(value, u"variant_level"):

699

if not hasattr(value, "variant_level"):

616

700

all[name] = value

617

701

continue

618

702

all[name] = type(value)(value, variant_level=

619

703

value.variant_level+1)

620

return dbus.Dictionary(all, signature=u"sv")

704

return dbus.Dictionary(all, signature="sv")

621

705

622

706

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

623

out_signature=u"s",

707

out_signature="s",

624

708

path_keyword='object_path',

625

709

connection_keyword='connection')

626

710

def Introspect(self, object_path, connection):

631

715

try:

632

716

document = xml.dom.minidom.parseString(xmlstring)

633

717

def make_tag(document, name, prop):

634

e = document.createElement(u"property")

635

e.setAttribute(u"name", name)

636

e.setAttribute(u"type", prop._dbus_signature)

637

e.setAttribute(u"access", prop._dbus_access)

718

e = document.createElement("property")

719

e.setAttribute("name", name)

720

e.setAttribute("type", prop._dbus_signature)

721

e.setAttribute("access", prop._dbus_access)

638

722

return e

639

for if_tag in document.getElementsByTagName(u"interface"):

723

for if_tag in document.getElementsByTagName("interface"):

640

724

for tag in (make_tag(document, name, prop)

641

725

for name, prop

642

726

in self._get_all_dbus_properties()

643

727

if prop._dbus_interface

644

== if_tag.getAttribute(u"name")):

728

== if_tag.getAttribute("name")):

645

729

if_tag.appendChild(tag)

646

730

# Add the names to the return values for the

647

731

# "org.freedesktop.DBus.Properties" methods

648

if (if_tag.getAttribute(u"name")

649

== u"org.freedesktop.DBus.Properties"):

650

for cn in if_tag.getElementsByTagName(u"method"):

651

if cn.getAttribute(u"name") == u"Get":

652

for arg in cn.getElementsByTagName(u"arg"):

653

if (arg.getAttribute(u"direction")

654

== u"out"):

655

arg.setAttribute(u"name", u"value")

656

elif cn.getAttribute(u"name") == u"GetAll":

657

for arg in cn.getElementsByTagName(u"arg"):

658

if (arg.getAttribute(u"direction")

659

== u"out"):

660

arg.setAttribute(u"name", u"props")

661

xmlstring = document.toxml(u"utf-8")

732

if (if_tag.getAttribute("name")

733

== "org.freedesktop.DBus.Properties"):

734

for cn in if_tag.getElementsByTagName("method"):

735

if cn.getAttribute("name") == "Get":

736

for arg in cn.getElementsByTagName("arg"):

737

if (arg.getAttribute("direction")

738

== "out"):

739

arg.setAttribute("name", "value")

740

elif cn.getAttribute("name") == "GetAll":

741

for arg in cn.getElementsByTagName("arg"):

742

if (arg.getAttribute("direction")

743

== "out"):

744

arg.setAttribute("name", "props")

745

xmlstring = document.toxml("utf-8")

662

746

document.unlink()

663

747

except (AttributeError, xml.dom.DOMException,

664

xml.parsers.expat.ExpatError), error:

665

logger.error(u"Failed to override Introspection method",

748

xml.parsers.expat.ExpatError) as error:

749

logger.error("Failed to override Introspection method",

666

750

error)

667

751

return xmlstring

668

752

674

758

dbus_object_path: dbus.ObjectPath

675

759

bus: dbus.SystemBus()

676

760

"""

761

762

runtime_expansions = (Client.runtime_expansions

763

+ ("dbus_object_path",))

764

677

765

# dbus.service.Object doesn't use super(), so we can't either.

678

766

679

767

def __init__(self, bus = None, *args, **kwargs):

768

self._approvals_pending = 0

680

769

self.bus = bus

681

770

Client.__init__(self, *args, **kwargs)

682

771

# Only now, when this client is initialized, can it show up on

683

772

# the D-Bus

773

client_object_name = unicode(self.name).translate(

774

{ord("."): ord("_"),

775

ord("-"): ord("_")})

684

776

self.dbus_object_path = (dbus.ObjectPath

685

(u"/clients/"

686

+ self.name.replace(u".", u"_")))

777

("/clients/" + client_object_name))

687

778

DBusObjectWithProperties.__init__(self, self.bus,

688

779

self.dbus_object_path)

780

def _set_expires(self, value):

781

old_value = getattr(self, "_expires", None)

782

self._expires = value

783

if hasattr(self, "dbus_object_path") and old_value != value:

784

dbus_time = (self._datetime_to_dbus(self._expires,

785

variant_level=1))

786

self.PropertyChanged(dbus.String("Expires"),

787

dbus_time)

788

expires = property(lambda self: self._expires, _set_expires)

789

del _set_expires

790

791

def _get_approvals_pending(self):

792

return self._approvals_pending

793

def _set_approvals_pending(self, value):

794

old_value = self._approvals_pending

795

self._approvals_pending = value

796

bval = bool(value)

797

if (hasattr(self, "dbus_object_path")

798

and bval is not bool(old_value)):

799

dbus_bool = dbus.Boolean(bval, variant_level=1)

800

self.PropertyChanged(dbus.String("ApprovalPending"),

801

dbus_bool)

802

803

approvals_pending = property(_get_approvals_pending,

804

_set_approvals_pending)

805

del _get_approvals_pending, _set_approvals_pending

689

806

690

807

@staticmethod

691

808

def _datetime_to_dbus(dt, variant_level=0):

692

809

"""Convert a UTC datetime.datetime() to a D-Bus type."""

810

if dt is None:

811

return dbus.String("", variant_level = variant_level)

693

812

return dbus.String(dt.isoformat(),

694

813

variant_level=variant_level)

695

814

696

815

def enable(self):

697

oldstate = getattr(self, u"enabled", False)

816

oldstate = getattr(self, "enabled", False)

698

817

r = Client.enable(self)

699

818

if oldstate != self.enabled:

700

819

# Emit D-Bus signals

701

self.PropertyChanged(dbus.String(u"enabled"),

820

self.PropertyChanged(dbus.String("Enabled"),

702

821

dbus.Boolean(True, variant_level=1))

703

822

self.PropertyChanged(

704

dbus.String(u"last_enabled"),

823

dbus.String("LastEnabled"),

705

824

self._datetime_to_dbus(self.last_enabled,

706

825

variant_level=1))

707

826

return r

708

827

709

828

def disable(self, quiet = False):

710

oldstate = getattr(self, u"enabled", False)

829

oldstate = getattr(self, "enabled", False)

711

830

r = Client.disable(self, quiet=quiet)

712

831

if not quiet and oldstate != self.enabled:

713

832

# Emit D-Bus signal

714

self.PropertyChanged(dbus.String(u"enabled"),

833

self.PropertyChanged(dbus.String("Enabled"),

715

834

dbus.Boolean(False, variant_level=1))

716

835

return r

717

836

720

839

self.remove_from_connection()

721

840

except LookupError:

722

841

pass

723

if hasattr(DBusObjectWithProperties, u"__del__"):

842

if hasattr(DBusObjectWithProperties, "__del__"):

724

843

DBusObjectWithProperties.__del__(self, *args, **kwargs)

725

844

Client.__del__(self, *args, **kwargs)

726

845

729

848

self.checker_callback_tag = None

730

849

self.checker = None

731

850

# Emit D-Bus signal

732

self.PropertyChanged(dbus.String(u"checker_running"),

851

self.PropertyChanged(dbus.String("CheckerRunning"),

733

852

dbus.Boolean(False, variant_level=1))

734

853

if os.WIFEXITED(condition):

735

854

exitstatus = os.WEXITSTATUS(condition)

747

866

*args, **kwargs)

748

867

749

868

def checked_ok(self, *args, **kwargs):

750

r = Client.checked_ok(self, *args, **kwargs)

869

Client.checked_ok(self, *args, **kwargs)

751

870

# Emit D-Bus signal

752

871

self.PropertyChanged(

753

dbus.String(u"last_checked_ok"),

872

dbus.String("LastCheckedOK"),

754

873

(self._datetime_to_dbus(self.last_checked_ok,

755

874

variant_level=1)))

875

876

def need_approval(self, *args, **kwargs):

877

r = Client.need_approval(self, *args, **kwargs)

878

# Emit D-Bus signal

879

self.PropertyChanged(

880

dbus.String("LastApprovalRequest"),

881

(self._datetime_to_dbus(self.last_approval_request,

882

variant_level=1)))

756

883

return r

757

884

758

885

def start_checker(self, *args, **kwargs):

768

895

# Emit D-Bus signal

769

896

self.CheckerStarted(self.current_checker_command)

770

897

self.PropertyChanged(

771

dbus.String(u"checker_running"),

898

dbus.String("CheckerRunning"),

772

899

dbus.Boolean(True, variant_level=1))

773

900

return r

774

901

775

902

def stop_checker(self, *args, **kwargs):

776

old_checker = getattr(self, u"checker", None)

903

old_checker = getattr(self, "checker", None)

777

904

r = Client.stop_checker(self, *args, **kwargs)

778

905

if (old_checker is not None

779

and getattr(self, u"checker", None) is None):

780

self.PropertyChanged(dbus.String(u"checker_running"),

906

and getattr(self, "checker", None) is None):

907

self.PropertyChanged(dbus.String("CheckerRunning"),

781

908

dbus.Boolean(False, variant_level=1))

782

909

return r

783

784

## D-Bus methods & signals

785

_interface = u"se.bsnet.fukt.Mandos.Client"

786

787

# CheckedOK - method

788

@dbus.service.method(_interface)

789

def CheckedOK(self):

790

return self.checked_ok()

910

911

def _reset_approved(self):

912

self._approved = None

913

return False

914

915

def approve(self, value=True):

916

self.send_changedstate()

917

self._approved = value

918

gobject.timeout_add(self._timedelta_to_milliseconds

919

(self.approval_duration),

920

self._reset_approved)

921

922

923

## D-Bus methods, signals & properties

924

_interface = "se.bsnet.fukt.Mandos.Client"

925

926

## Signals

791

927

792

928

# CheckerCompleted - signal

793

@dbus.service.signal(_interface, signature=u"nxs")

929

@dbus.service.signal(_interface, signature="nxs")

794

930

def CheckerCompleted(self, exitcode, waitstatus, command):

795

931

"D-Bus signal"

796

932

pass

797

933

798

934

# CheckerStarted - signal

799

@dbus.service.signal(_interface, signature=u"s")

935

@dbus.service.signal(_interface, signature="s")

800

936

def CheckerStarted(self, command):

801

937

"D-Bus signal"

802

938

pass

803

939

804

940

# PropertyChanged - signal

805

@dbus.service.signal(_interface, signature=u"sv")

941

@dbus.service.signal(_interface, signature="sv")

806

942

def PropertyChanged(self, property, value):

807

943

"D-Bus signal"

808

944

pass

810

946

# GotSecret - signal

811

947

@dbus.service.signal(_interface)

812

948

def GotSecret(self):

813

"D-Bus signal"

949

"""D-Bus signal

950

Is sent after a successful transfer of secret from the Mandos

951

server to mandos-client

952

"""

814

953

pass

815

954

816

955

# Rejected - signal

817

@dbus.service.signal(_interface)

818

def Rejected(self):

956

@dbus.service.signal(_interface, signature="s")

957

def Rejected(self, reason):

819

958

"D-Bus signal"

820

959

pass

821

960

961

# NeedApproval - signal

962

@dbus.service.signal(_interface, signature="tb")

963

def NeedApproval(self, timeout, default):

964

"D-Bus signal"

965

return self.need_approval()

966

967

## Methods

968

969

# Approve - method

970

@dbus.service.method(_interface, in_signature="b")

971

def Approve(self, value):

972

self.approve(value)

973

974

# CheckedOK - method

975

@dbus.service.method(_interface)

976

def CheckedOK(self):

977

self.checked_ok()

978

822

979

# Enable - method

823

980

@dbus.service.method(_interface)

824

981

def Enable(self):

842

999

def StopChecker(self):

843

1000

self.stop_checker()

844

1001

845

# name - property

846

@dbus_service_property(_interface, signature=u"s", access=u"read")

847

def name_dbus_property(self):

1002

## Properties

1003

1004

# ApprovalPending - property

1005

@dbus_service_property(_interface, signature="b", access="read")

1006

def ApprovalPending_dbus_property(self):

1007

return dbus.Boolean(bool(self.approvals_pending))

1008

1009

# ApprovedByDefault - property

1010

@dbus_service_property(_interface, signature="b",

1011

access="readwrite")

1012

def ApprovedByDefault_dbus_property(self, value=None):

1013

if value is None: # get

1014

return dbus.Boolean(self.approved_by_default)

1015

old_value = self.approved_by_default

1016

self.approved_by_default = bool(value)

1017

# Emit D-Bus signal

1018

if old_value != self.approved_by_default:

1019

self.PropertyChanged(dbus.String("ApprovedByDefault"),

1020

dbus.Boolean(value, variant_level=1))

1021

1022

# ApprovalDelay - property

1023

@dbus_service_property(_interface, signature="t",

1024

access="readwrite")

1025

def ApprovalDelay_dbus_property(self, value=None):

1026

if value is None: # get

1027

return dbus.UInt64(self.approval_delay_milliseconds())

1028

old_value = self.approval_delay

1029

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1030

# Emit D-Bus signal

1031

if old_value != self.approval_delay:

1032

self.PropertyChanged(dbus.String("ApprovalDelay"),

1033

dbus.UInt64(value, variant_level=1))

1034

1035

# ApprovalDuration - property

1036

@dbus_service_property(_interface, signature="t",

1037

access="readwrite")

1038

def ApprovalDuration_dbus_property(self, value=None):

1039

if value is None: # get

1040

return dbus.UInt64(self._timedelta_to_milliseconds(

1041

self.approval_duration))

1042

old_value = self.approval_duration

1043

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1044

# Emit D-Bus signal

1045

if old_value != self.approval_duration:

1046

self.PropertyChanged(dbus.String("ApprovalDuration"),

1047

dbus.UInt64(value, variant_level=1))

1048

1049

# Name - property

1050

@dbus_service_property(_interface, signature="s", access="read")

1051

def Name_dbus_property(self):

848

1052

return dbus.String(self.name)

849

1053

850

# fingerprint - property

851

@dbus_service_property(_interface, signature=u"s", access=u"read")

852

def fingerprint_dbus_property(self):

1054

# Fingerprint - property

1055

@dbus_service_property(_interface, signature="s", access="read")

1056

def Fingerprint_dbus_property(self):

853

1057

return dbus.String(self.fingerprint)

854

1058

855

# host - property

856

@dbus_service_property(_interface, signature=u"s",

857

access=u"readwrite")

858

def host_dbus_property(self, value=None):

1059

# Host - property

1060

@dbus_service_property(_interface, signature="s",

1061

access="readwrite")

1062

def Host_dbus_property(self, value=None):

859

1063

if value is None: # get

860

1064

return dbus.String(self.host)

1065

old_value = self.host

861

1066

self.host = value

862

1067

# Emit D-Bus signal

863

self.PropertyChanged(dbus.String(u"host"),

864

dbus.String(value, variant_level=1))

1068

if old_value != self.host:

1069

self.PropertyChanged(dbus.String("Host"),

1070

dbus.String(value, variant_level=1))

865

1071

866

# created - property

867

@dbus_service_property(_interface, signature=u"s", access=u"read")

868

def created_dbus_property(self):

1072

# Created - property

1073

@dbus_service_property(_interface, signature="s", access="read")

1074

def Created_dbus_property(self):

869

1075

return dbus.String(self._datetime_to_dbus(self.created))

870

1076

871

# last_enabled - property

872

@dbus_service_property(_interface, signature=u"s", access=u"read")

873

def last_enabled_dbus_property(self):

874

if self.last_enabled is None:

875

return dbus.String(u"")

876

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1077

# LastEnabled - property

1078

@dbus_service_property(_interface, signature="s", access="read")

1079

def LastEnabled_dbus_property(self):

1080

return self._datetime_to_dbus(self.last_enabled)

877

1081

878

# enabled - property

879

@dbus_service_property(_interface, signature=u"b",

880

access=u"readwrite")

881

def enabled_dbus_property(self, value=None):

1082

# Enabled - property

1083

@dbus_service_property(_interface, signature="b",

1084

access="readwrite")

1085

def Enabled_dbus_property(self, value=None):

882

1086

if value is None: # get

883

1087

return dbus.Boolean(self.enabled)

884

1088

if value:

886

1090

else:

887

1091

self.disable()

888

1092

889

# last_checked_ok - property

890

@dbus_service_property(_interface, signature=u"s",

891

access=u"readwrite")

892

def last_checked_ok_dbus_property(self, value=None):

1093

# LastCheckedOK - property

1094

@dbus_service_property(_interface, signature="s",

1095

access="readwrite")

1096

def LastCheckedOK_dbus_property(self, value=None):

893

1097

if value is not None:

894

1098

self.checked_ok()

895

1099

return

896

if self.last_checked_ok is None:

897

return dbus.String(u"")

898

return dbus.String(self._datetime_to_dbus(self

899

.last_checked_ok))

900

901

# timeout - property

902

@dbus_service_property(_interface, signature=u"t",

903

access=u"readwrite")

904

def timeout_dbus_property(self, value=None):

1100

return self._datetime_to_dbus(self.last_checked_ok)

1101

1102

# Expires - property

1103

@dbus_service_property(_interface, signature="s", access="read")

1104

def Expires_dbus_property(self):

1105

return self._datetime_to_dbus(self.expires)

1106

1107

# LastApprovalRequest - property

1108

@dbus_service_property(_interface, signature="s", access="read")

1109

def LastApprovalRequest_dbus_property(self):

1110

return self._datetime_to_dbus(self.last_approval_request)

1111

1112

# Timeout - property

1113

@dbus_service_property(_interface, signature="t",

1114

access="readwrite")

1115

def Timeout_dbus_property(self, value=None):

905

1116

if value is None: # get

906

1117

return dbus.UInt64(self.timeout_milliseconds())

1118

old_value = self.timeout

907

1119

self.timeout = datetime.timedelta(0, 0, 0, value)

908

1120

# Emit D-Bus signal

909

self.PropertyChanged(dbus.String(u"timeout"),

910

dbus.UInt64(value, variant_level=1))

911

if getattr(self, u"disable_initiator_tag", None) is None:

1121

if old_value != self.timeout:

1122

self.PropertyChanged(dbus.String("Timeout"),

1123

dbus.UInt64(value, variant_level=1))

1124

if getattr(self, "disable_initiator_tag", None) is None:

912

1125

return

913

1126

# Reschedule timeout

914

1127

gobject.source_remove(self.disable_initiator_tag)

915

1128

self.disable_initiator_tag = None

1129

self.expires = None

916

1130

time_to_die = (self.

917

1131

_timedelta_to_milliseconds((self

918

1132

.last_checked_ok

923

1137

# The timeout has passed

924

1138

self.disable()

925

1139

else:

1140

self.expires = (datetime.datetime.utcnow()

1141

+ datetime.timedelta(milliseconds = time_to_die))

926

1142

self.disable_initiator_tag = (gobject.timeout_add

927

1143

(time_to_die, self.disable))

928

929

# interval - property

930

@dbus_service_property(_interface, signature=u"t",

931

access=u"readwrite")

932

def interval_dbus_property(self, value=None):

1144

1145

# ExtendedTimeout - property

1146

@dbus_service_property(_interface, signature="t",

1147

access="readwrite")

1148

def ExtendedTimeout_dbus_property(self, value=None):

1149

if value is None: # get

1150

return dbus.UInt64(self.extended_timeout_milliseconds())

1151

old_value = self.extended_timeout

1152

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1153

# Emit D-Bus signal

1154

if old_value != self.extended_timeout:

1155

self.PropertyChanged(dbus.String("ExtendedTimeout"),

1156

dbus.UInt64(value, variant_level=1))

1157

1158

# Interval - property

1159

@dbus_service_property(_interface, signature="t",

1160

access="readwrite")

1161

def Interval_dbus_property(self, value=None):

933

1162

if value is None: # get

934

1163

return dbus.UInt64(self.interval_milliseconds())

1164

old_value = self.interval

935

1165

self.interval = datetime.timedelta(0, 0, 0, value)

936

1166

# Emit D-Bus signal

937

self.PropertyChanged(dbus.String(u"interval"),

938

dbus.UInt64(value, variant_level=1))

939

if getattr(self, u"checker_initiator_tag", None) is None:

1167

if old_value != self.interval:

1168

self.PropertyChanged(dbus.String("Interval"),

1169

dbus.UInt64(value, variant_level=1))

1170

if getattr(self, "checker_initiator_tag", None) is None:

940

1171

return

941

1172

# Reschedule checker run

942

1173

gobject.source_remove(self.checker_initiator_tag)

944

1175

(value, self.start_checker))

945

1176

self.start_checker() # Start one now, too

946

1177

947

# checker - property

948

@dbus_service_property(_interface, signature=u"s",

949

access=u"readwrite")

950

def checker_dbus_property(self, value=None):

1178

# Checker - property

1179

@dbus_service_property(_interface, signature="s",

1180

access="readwrite")

1181

def Checker_dbus_property(self, value=None):

951

1182

if value is None: # get

952

1183

return dbus.String(self.checker_command)

1184

old_value = self.checker_command

953

1185

self.checker_command = value

954

1186

# Emit D-Bus signal

955

self.PropertyChanged(dbus.String(u"checker"),

956

dbus.String(self.checker_command,

957

variant_level=1))

1187

if old_value != self.checker_command:

1188

self.PropertyChanged(dbus.String("Checker"),

1189

dbus.String(self.checker_command,

1190

variant_level=1))

958

1191

959

# checker_running - property

960

@dbus_service_property(_interface, signature=u"b",

961

access=u"readwrite")

962

def checker_running_dbus_property(self, value=None):

1192

# CheckerRunning - property

1193

@dbus_service_property(_interface, signature="b",

1194

access="readwrite")

1195

def CheckerRunning_dbus_property(self, value=None):

963

1196

if value is None: # get

964

1197

return dbus.Boolean(self.checker is not None)

965

1198

if value:

967

1200

else:

968

1201

self.stop_checker()

969

1202

970

# object_path - property

971

@dbus_service_property(_interface, signature=u"o", access=u"read")

972

def object_path_dbus_property(self):

1203

# ObjectPath - property

1204

@dbus_service_property(_interface, signature="o", access="read")

1205

def ObjectPath_dbus_property(self):

973

1206

return self.dbus_object_path # is already a dbus.ObjectPath

974

1207

975

# secret = property

976

@dbus_service_property(_interface, signature=u"ay",

977

access=u"write", byte_arrays=True)

978

def secret_dbus_property(self, value):

1208

# Secret = property

1209

@dbus_service_property(_interface, signature="ay",

1210

access="write", byte_arrays=True)

1211

def Secret_dbus_property(self, value):

979

1212

self.secret = str(value)

980

1213

981

1214

del _interface

982

1215

983

1216

1217

class ProxyClient(object):

1218

def __init__(self, child_pipe, fpr, address):

1219

self._pipe = child_pipe

1220

self._pipe.send(('init', fpr, address))

1221

if not self._pipe.recv():

1222

raise KeyError()

1223

1224

def __getattribute__(self, name):

1225

if(name == '_pipe'):

1226

return super(ProxyClient, self).__getattribute__(name)

1227

self._pipe.send(('getattr', name))

1228

data = self._pipe.recv()

1229

if data[0] == 'data':

1230

return data[1]

1231

if data[0] == 'function':

1232

def func(*args, **kwargs):

1233

self._pipe.send(('funcall', name, args, kwargs))

1234

return self._pipe.recv()[1]

1235

return func

1236

1237

def __setattr__(self, name, value):

1238

if(name == '_pipe'):

1239

return super(ProxyClient, self).__setattr__(name, value)

1240

self._pipe.send(('setattr', name, value))

1241

1242

984

1243

class ClientHandler(socketserver.BaseRequestHandler, object):

985

1244

"""A class to handle client connections.

986

1245

988

1247

Note: This will run in its own forked process."""

989

1248

990

1249

def handle(self):

991

logger.info(u"TCP connection from: %s",

992

unicode(self.client_address))

993

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

994

# Open IPC pipe to parent process

995

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

1250

with contextlib.closing(self.server.child_pipe) as child_pipe:

1251

logger.info("TCP connection from: %s",

1252

unicode(self.client_address))

1253

logger.debug("Pipe FD: %d",

1254

self.server.child_pipe.fileno())

1255

996

1256

session = (gnutls.connection

997

1257

.ClientSession(self.request,

998

1258

gnutls.connection

999

1259

.X509Credentials()))

1000

1001

line = self.request.makefile().readline()

1002

logger.debug(u"Protocol version: %r", line)

1003

try:

1004

if int(line.strip().split()[0]) > 1:

1005

raise RuntimeError

1006

except (ValueError, IndexError, RuntimeError), error:

1007

logger.error(u"Unknown protocol version: %s", error)

1008

return

1009

1260

1010

1261

# Note: gnutls.connection.X509Credentials is really a

1011

1262

# generic GnuTLS certificate credentials object so long as

1012

1263

# no X.509 keys are added to it. Therefore, we can use it

1013

1264

# here despite using OpenPGP certificates.

1014

1015

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1016

# u"+AES-256-CBC", u"+SHA1",

1017

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1018

# u"+DHE-DSS"))

1265

1266

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1267

# "+AES-256-CBC", "+SHA1",

1268

# "+COMP-NULL", "+CTYPE-OPENPGP",

1269

# "+DHE-DSS"))

1019

1270

# Use a fallback default, since this MUST be set.

1020

1271

priority = self.server.gnutls_priority

1021

1272

if priority is None:

1022

priority = u"NORMAL"

1273

priority = "NORMAL"

1023

1274

(gnutls.library.functions

1024

1275

.gnutls_priority_set_direct(session._c_object,

1025

1276

priority, None))

1026

1277

1278

# Start communication using the Mandos protocol

1279

# Get protocol number

1280

line = self.request.makefile().readline()

1281

logger.debug("Protocol version: %r", line)

1282

try:

1283

if int(line.strip().split()[0]) > 1:

1284

raise RuntimeError

1285

except (ValueError, IndexError, RuntimeError) as error:

1286

logger.error("Unknown protocol version: %s", error)

1287

return

1288

1289

# Start GnuTLS connection

1027

1290

try:

1028

1291

session.handshake()

1029

except gnutls.errors.GNUTLSError, error:

1030

logger.warning(u"Handshake failed: %s", error)

1292

except gnutls.errors.GNUTLSError as error:

1293

logger.warning("Handshake failed: %s", error)

1031

1294

# Do not run session.bye() here: the session is not

1032

1295

# established. Just abandon the request.

1033

1296

return

1034

logger.debug(u"Handshake succeeded")

1297

logger.debug("Handshake succeeded")

1298

1299

approval_required = False

1035

1300

try:

1036

fpr = self.fingerprint(self.peer_certificate(session))

1037

except (TypeError, gnutls.errors.GNUTLSError), error:

1038

logger.warning(u"Bad certificate: %s", error)

1039

session.bye()

1040

return

1041

logger.debug(u"Fingerprint: %s", fpr)

1301

try:

1302

fpr = self.fingerprint(self.peer_certificate

1303

(session))

1304

except (TypeError,

1305

gnutls.errors.GNUTLSError) as error:

1306

logger.warning("Bad certificate: %s", error)

1307

return

1308

logger.debug("Fingerprint: %s", fpr)

1309

1310

try:

1311

client = ProxyClient(child_pipe, fpr,

1312

self.client_address)

1313

except KeyError:

1314

return

1315

1316

if client.approval_delay:

1317

delay = client.approval_delay

1318

client.approvals_pending += 1

1319

approval_required = True

1320

1321

while True:

1322

if not client.enabled:

1323

logger.info("Client %s is disabled",

1324

client.name)

1325

if self.server.use_dbus:

1326

# Emit D-Bus signal

1327

client.Rejected("Disabled")

1328

return

1329

1330

if client._approved or not client.approval_delay:

1331

#We are approved or approval is disabled

1332

break

1333

elif client._approved is None:

1334

logger.info("Client %s needs approval",

1335

client.name)

1336

if self.server.use_dbus:

1337

# Emit D-Bus signal

1338

client.NeedApproval(

1339

client.approval_delay_milliseconds(),

1340

client.approved_by_default)

1341

else:

1342

logger.warning("Client %s was not approved",

1343

client.name)

1344

if self.server.use_dbus:

1345

# Emit D-Bus signal

1346

client.Rejected("Denied")

1347

return

1348

1349

#wait until timeout or approved

1350

#x = float(client._timedelta_to_milliseconds(delay))

1351

time = datetime.datetime.now()

1352

client.changedstate.acquire()

1353

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1354

client.changedstate.release()

1355

time2 = datetime.datetime.now()

1356

if (time2 - time) >= delay:

1357

if not client.approved_by_default:

1358

logger.warning("Client %s timed out while"

1359

" waiting for approval",

1360

client.name)

1361

if self.server.use_dbus:

1362

# Emit D-Bus signal

1363

client.Rejected("Approval timed out")

1364

return

1365

else:

1366

break

1367

else:

1368

delay -= time2 - time

1369

1370

sent_size = 0

1371

while sent_size < len(client.secret):

1372

try:

1373

sent = session.send(client.secret[sent_size:])

1374

except gnutls.errors.GNUTLSError as error:

1375

logger.warning("gnutls send failed")

1376

return

1377

logger.debug("Sent: %d, remaining: %d",

1378

sent, len(client.secret)

1379

- (sent_size + sent))

1380

sent_size += sent

1381

1382

logger.info("Sending secret to %s", client.name)

1383

# bump the timeout as if seen

1384

client.checked_ok(client.extended_timeout)

1385

if self.server.use_dbus:

1386

# Emit D-Bus signal

1387

client.GotSecret()

1042

1388

1043

for c in self.server.clients:

1044

if c.fingerprint == fpr:

1045

client = c

1046

break

1047

else:

1048

ipc.write(u"NOTFOUND %s %s\n"

1049

% (fpr, unicode(self.client_address)))

1050

session.bye()

1051

return

1052

# Have to check if client.still_valid(), since it is

1053

# possible that the client timed out while establishing

1054

# the GnuTLS session.

1055

if not client.still_valid():

1056

ipc.write(u"INVALID %s\n" % client.name)

1057

session.bye()

1058

return

1059

ipc.write(u"SENDING %s\n" % client.name)

1060

sent_size = 0

1061

while sent_size < len(client.secret):

1062

sent = session.send(client.secret[sent_size:])

1063

logger.debug(u"Sent: %d, remaining: %d",

1064

sent, len(client.secret)

1065

- (sent_size + sent))

1066

sent_size += sent

1067

session.bye()

1389

finally:

1390

if approval_required:

1391

client.approvals_pending -= 1

1392

try:

1393

session.bye()

1394

except gnutls.errors.GNUTLSError as error:

1395

logger.warning("GnuTLS bye failed")

1068

1396

1069

1397

@staticmethod

1070

1398

def peer_certificate(session):

1080

1408

.gnutls_certificate_get_peers

1081

1409

(session._c_object, ctypes.byref(list_size)))

1082

1410

if not bool(cert_list) and list_size.value != 0:

1083

raise gnutls.errors.GNUTLSError(u"error getting peer"

1084

u" certificate")

1411

raise gnutls.errors.GNUTLSError("error getting peer"

1412

" certificate")

1085

1413

if list_size.value == 0:

1086

1414

return None

1087

1415

cert = cert_list[0]

1113

1441

if crtverify.value != 0:

1114

1442

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1115

1443

raise (gnutls.errors.CertificateSecurityError

1116

(u"Verify failed"))

1444

("Verify failed"))

1117

1445

# New buffer for the fingerprint

1118

1446

buf = ctypes.create_string_buffer(20)

1119

1447

buf_len = ctypes.c_size_t()

1126

1454

# Convert the buffer to a Python bytestring

1127

1455

fpr = ctypes.string_at(buf, buf_len.value)

1128

1456

# Convert the bytestring to hexadecimal notation

1129

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1457

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1130

1458

return hex_fpr

1131

1459

1132

1460

1133

class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):

1134

"""Like socketserver.ForkingMixIn, but also pass a pipe."""

1461

class MultiprocessingMixIn(object):

1462

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1463

def sub_process_main(self, request, address):

1464

try:

1465

self.finish_request(request, address)

1466

except:

1467

self.handle_error(request, address)

1468

self.close_request(request)

1469

1470

def process_request(self, request, address):

1471

"""Start a new process to process the request."""

1472

multiprocessing.Process(target = self.sub_process_main,

1473

args = (request, address)).start()

1474

1475

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1476

""" adds a pipe to the MixIn """

1135

1477

def process_request(self, request, client_address):

1136

1478

"""Overrides and wraps the original process_request().

1137

1479

1138

1480

This function creates a new pipe in self.pipe

1139

1481

"""

1140

self.pipe = os.pipe()

1141

super(ForkingMixInWithPipe,

1482

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1483

1484

super(MultiprocessingMixInWithPipe,

1142

1485

self).process_request(request, client_address)

1143

os.close(self.pipe[1]) # close write end

1144

self.add_pipe(self.pipe[0])

1145

def add_pipe(self, pipe):

1486

self.child_pipe.close()

1487

self.add_pipe(parent_pipe)

1488

1489

def add_pipe(self, parent_pipe):

1146

1490

"""Dummy function; override as necessary"""

1147

os.close(pipe)

1148

1149

1150

class IPv6_TCPServer(ForkingMixInWithPipe,

1491

raise NotImplementedError

1492

1493

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1151

1494

socketserver.TCPServer, object):

1152

1495

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1153

1496

1169

1512

bind to an address or port if they were not specified."""

1170

1513

if self.interface is not None:

1171

1514

if SO_BINDTODEVICE is None:

1172

logger.error(u"SO_BINDTODEVICE does not exist;"

1173

u" cannot bind to interface %s",

1515

logger.error("SO_BINDTODEVICE does not exist;"

1516

" cannot bind to interface %s",

1174

1517

self.interface)

1175

1518

else:

1176

1519

try:

1177

1520

self.socket.setsockopt(socket.SOL_SOCKET,

1178

1521

SO_BINDTODEVICE,

1179

1522

str(self.interface

1180

+ u'\0'))

1181

except socket.error, error:

1523

+ '\0'))

1524

except socket.error as error:

1182

1525

if error[0] == errno.EPERM:

1183

logger.error(u"No permission to"

1184

u" bind to interface %s",

1526

logger.error("No permission to"

1527

" bind to interface %s",

1185

1528

self.interface)

1186

1529

elif error[0] == errno.ENOPROTOOPT:

1187

logger.error(u"SO_BINDTODEVICE not available;"

1188

u" cannot bind to interface %s",

1530

logger.error("SO_BINDTODEVICE not available;"

1531

" cannot bind to interface %s",

1189

1532

self.interface)

1190

1533

else:

1191

1534

raise

1193

1536

if self.server_address[0] or self.server_address[1]:

1194

1537

if not self.server_address[0]:

1195

1538

if self.address_family == socket.AF_INET6:

1196

any_address = u"::" # in6addr_any

1539

any_address = "::" # in6addr_any

1197

1540

else:

1198

1541

any_address = socket.INADDR_ANY

1199

1542

self.server_address = (any_address,

1238

1581

return socketserver.TCPServer.server_activate(self)

1239

1582

def enable(self):

1240

1583

self.enabled = True

1241

def add_pipe(self, pipe):

1584

def add_pipe(self, parent_pipe):

1242

1585

# Call "handle_ipc" for both data and EOF events

1243

gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,

1244

self.handle_ipc)

1245

def handle_ipc(self, source, condition, file_objects={}):

1586

gobject.io_add_watch(parent_pipe.fileno(),

1587

gobject.IO_IN | gobject.IO_HUP,

1588

functools.partial(self.handle_ipc,

1589

parent_pipe = parent_pipe))

1590

1591

def handle_ipc(self, source, condition, parent_pipe=None,

1592

client_object=None):

1246

1593

condition_names = {

1247

gobject.IO_IN: u"IN", # There is data to read.

1248

gobject.IO_OUT: u"OUT", # Data can be written (without

1594

gobject.IO_IN: "IN", # There is data to read.

1595

gobject.IO_OUT: "OUT", # Data can be written (without

1249

1596

# blocking).

1250

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1251

gobject.IO_ERR: u"ERR", # Error condition.

1252

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1597

gobject.IO_PRI: "PRI", # There is urgent data to read.

1598

gobject.IO_ERR: "ERR", # Error condition.

1599

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1253

1600

# broken, usually for pipes and

1254

1601

# sockets).

1255

1602

}

1257

1604

for cond, name in

1258

1605

condition_names.iteritems()

1259

1606

if cond & condition)

1260

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1261

conditions_string)

1262

1263

# Turn the pipe file descriptor into a Python file object

1264

if source not in file_objects:

1265

file_objects[source] = os.fdopen(source, u"r", 1)

1266

1267

# Read a line from the file object

1268

cmdline = file_objects[source].readline()

1269

if not cmdline: # Empty line means end of file

1270

# close the IPC pipe

1271

file_objects[source].close()

1272

del file_objects[source]

1273

1274

# Stop calling this function

1275

return False

1276

1277

logger.debug(u"IPC command: %r", cmdline)

1278

1279

# Parse and act on command

1280

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1281

1282

if cmd == u"NOTFOUND":

1283

fpr, address = args.split(None, 1)

1284

logger.warning(u"Client not found for fingerprint: %s, ad"

1285

u"dress: %s", fpr, address)

1286

if self.use_dbus:

1287

# Emit D-Bus signal

1288

mandos_dbus_service.ClientNotFound(fpr, address)

1289

elif cmd == u"INVALID":

1290

for client in self.clients:

1291

if client.name == args:

1292

logger.warning(u"Client %s is invalid", args)

1293

if self.use_dbus:

1294

# Emit D-Bus signal

1295

client.Rejected()

1296

break

1297

else:

1298

logger.error(u"Unknown client %s is invalid", args)

1299

elif cmd == u"SENDING":

1300

for client in self.clients:

1301

if client.name == args:

1302

logger.info(u"Sending secret to %s", client.name)

1303

client.checked_ok()

1304

if self.use_dbus:

1305

# Emit D-Bus signal

1306

client.GotSecret()

1307

break

1308

else:

1309

logger.error(u"Sending secret to unknown client %s",

1310

args)

1311

else:

1312

logger.error(u"Unknown IPC command: %r", cmdline)

1313

1314

# Keep calling this function

1607

# error or the other end of multiprocessing.Pipe has closed

1608

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1609

return False

1610

1611

# Read a request from the child

1612

request = parent_pipe.recv()

1613

command = request[0]

1614

1615

if command == 'init':

1616

fpr = request[1]

1617

address = request[2]

1618

1619

for c in self.clients:

1620

if c.fingerprint == fpr:

1621

client = c

1622

break

1623

else:

1624

logger.info("Client not found for fingerprint: %s, ad"

1625

"dress: %s", fpr, address)

1626

if self.use_dbus:

1627

# Emit D-Bus signal

1628

mandos_dbus_service.ClientNotFound(fpr, address[0])

1629

parent_pipe.send(False)

1630

return False

1631

1632

gobject.io_add_watch(parent_pipe.fileno(),

1633

gobject.IO_IN | gobject.IO_HUP,

1634

functools.partial(self.handle_ipc,

1635

parent_pipe = parent_pipe,

1636

client_object = client))

1637

parent_pipe.send(True)

1638

# remove the old hook in favor of the new above hook on same fileno

1639

return False

1640

if command == 'funcall':

1641

funcname = request[1]

1642

args = request[2]

1643

kwargs = request[3]

1644

1645

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1646

1647

if command == 'getattr':

1648

attrname = request[1]

1649

if callable(client_object.__getattribute__(attrname)):

1650

parent_pipe.send(('function',))

1651

else:

1652

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1653

1654

if command == 'setattr':

1655

attrname = request[1]

1656

value = request[2]

1657

setattr(client_object, attrname, value)

1658

1315

1659

return True

1316

1660

1317

1661

1318

1662

def string_to_delta(interval):

1319

1663

"""Parse a string and return a datetime.timedelta

1320

1664

1321

>>> string_to_delta(u'7d')

1665

>>> string_to_delta('7d')

1322

1666

datetime.timedelta(7)

1323

>>> string_to_delta(u'60s')

1667

>>> string_to_delta('60s')

1324

1668

datetime.timedelta(0, 60)

1325

>>> string_to_delta(u'60m')

1669

>>> string_to_delta('60m')

1326

1670

datetime.timedelta(0, 3600)

1327

>>> string_to_delta(u'24h')

1671

>>> string_to_delta('24h')

1328

1672

datetime.timedelta(1)

1329

>>> string_to_delta(u'1w')

1673

>>> string_to_delta('1w')

1330

1674

datetime.timedelta(7)

1331

>>> string_to_delta(u'5m 30s')

1675

>>> string_to_delta('5m 30s')

1332

1676

datetime.timedelta(0, 330)

1333

1677

"""

1334

1678

timevalue = datetime.timedelta(0)

1336

1680

try:

1337

1681

suffix = unicode(s[-1])

1338

1682

value = int(s[:-1])

1339

if suffix == u"d":

1683

if suffix == "d":

1340

1684

delta = datetime.timedelta(value)

1341

elif suffix == u"s":

1685

elif suffix == "s":

1342

1686

delta = datetime.timedelta(0, value)

1343

elif suffix == u"m":

1687

elif suffix == "m":

1344

1688

delta = datetime.timedelta(0, 0, 0, 0, value)

1345

elif suffix == u"h":

1689

elif suffix == "h":

1346

1690

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1347

elif suffix == u"w":

1691

elif suffix == "w":

1348

1692

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1349

1693

else:

1350

raise ValueError(u"Unknown suffix %r" % suffix)

1351

except (ValueError, IndexError), e:

1352

raise ValueError(e.message)

1694

raise ValueError("Unknown suffix %r" % suffix)

1695

except (ValueError, IndexError) as e:

1696

raise ValueError(*(e.args))

1353

1697

timevalue += delta

1354

1698

return timevalue

1355

1699

1361

1705

global if_nametoindex

1362

1706

try:

1363

1707

if_nametoindex = (ctypes.cdll.LoadLibrary

1364

(ctypes.util.find_library(u"c"))

1708

(ctypes.util.find_library("c"))

1365

1709

.if_nametoindex)

1366

1710

except (OSError, AttributeError):

1367

logger.warning(u"Doing if_nametoindex the hard way")

1711

logger.warning("Doing if_nametoindex the hard way")

1368

1712

def if_nametoindex(interface):

1369

1713

"Get an interface index the hard way, i.e. using fcntl()"

1370

1714

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1371

with closing(socket.socket()) as s:

1715

with contextlib.closing(socket.socket()) as s:

1372

1716

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1373

struct.pack(str(u"16s16x"),

1717

struct.pack(str("16s16x"),

1374

1718

interface))

1375

interface_index = struct.unpack(str(u"I"),

1719

interface_index = struct.unpack(str("I"),

1376

1720

ifreq[16:20])[0]

1377

1721

return interface_index

1378

1722

return if_nametoindex(interface)

1386

1730

sys.exit()

1387

1731

os.setsid()

1388

1732

if not nochdir:

1389

os.chdir(u"/")

1733

os.chdir("/")

1390

1734

if os.fork():

1391

1735

sys.exit()

1392

1736

if not noclose:

1394

1738

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1395

1739

if not stat.S_ISCHR(os.fstat(null).st_mode):

1396

1740

raise OSError(errno.ENODEV,

1397

u"%s not a character device"

1741

"%s not a character device"

1398

1742

% os.path.devnull)

1399

1743

os.dup2(null, sys.stdin.fileno())

1400

1744

os.dup2(null, sys.stdout.fileno())

1408

1752

##################################################################

1409

1753

# Parsing of options, both command line and config file

1410

1754

1411

parser = optparse.OptionParser(version = "%%prog %s" % version)

1412

parser.add_option("-i", u"--interface", type=u"string",

1413

metavar="IF", help=u"Bind to interface IF")

1414

parser.add_option("-a", u"--address", type=u"string",

1415

help=u"Address to listen for requests on")

1416

parser.add_option("-p", u"--port", type=u"int",

1417

help=u"Port number to receive requests on")

1418

parser.add_option("--check", action=u"store_true",

1419

help=u"Run self-test")

1420

parser.add_option("--debug", action=u"store_true",

1421

help=u"Debug mode; run in foreground and log to"

1422

u" terminal")

1423

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1424

u" priority string (see GnuTLS documentation)")

1425

parser.add_option("--servicename", type=u"string",

1426

metavar=u"NAME", help=u"Zeroconf service name")

1427

parser.add_option("--configdir", type=u"string",

1428

default=u"/etc/mandos", metavar=u"DIR",

1429

help=u"Directory to search for configuration"

1430

u" files")

1431

parser.add_option("--no-dbus", action=u"store_false",

1432

dest=u"use_dbus", help=u"Do not provide D-Bus"

1433

u" system bus interface")

1434

parser.add_option("--no-ipv6", action=u"store_false",

1435

dest=u"use_ipv6", help=u"Do not use IPv6")

1436

options = parser.parse_args()[0]

1755

parser = argparse.ArgumentParser()

1756

parser.add_argument("-v", "--version", action="version",

1757

version = "%%(prog)s %s" % version,

1758

help="show version number and exit")

1759

parser.add_argument("-i", "--interface", metavar="IF",

1760

help="Bind to interface IF")

1761

parser.add_argument("-a", "--address",

1762

help="Address to listen for requests on")

1763

parser.add_argument("-p", "--port", type=int,

1764

help="Port number to receive requests on")

1765

parser.add_argument("--check", action="store_true",

1766

help="Run self-test")

1767

parser.add_argument("--debug", action="store_true",

1768

help="Debug mode; run in foreground and log"

1769

" to terminal")

1770

parser.add_argument("--debuglevel", metavar="LEVEL",

1771

help="Debug level for stdout output")

1772

parser.add_argument("--priority", help="GnuTLS"

1773

" priority string (see GnuTLS documentation)")

1774

parser.add_argument("--servicename",

1775

metavar="NAME", help="Zeroconf service name")

1776

parser.add_argument("--configdir",

1777

default="/etc/mandos", metavar="DIR",

1778

help="Directory to search for configuration"

1779

" files")

1780

parser.add_argument("--no-dbus", action="store_false",

1781

dest="use_dbus", help="Do not provide D-Bus"

1782

" system bus interface")

1783

parser.add_argument("--no-ipv6", action="store_false",

1784

dest="use_ipv6", help="Do not use IPv6")

1785

options = parser.parse_args()

1437

1786

1438

1787

if options.check:

1439

1788

import doctest

1441

1790

sys.exit()

1442

1791

1443

1792

# Default values for config file for server-global settings

1444

server_defaults = { u"interface": u"",

1445

u"address": u"",

1446

u"port": u"",

1447

u"debug": u"False",

1448

u"priority":

1449

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1450

u"servicename": u"Mandos",

1451

u"use_dbus": u"True",

1452

u"use_ipv6": u"True",

1793

server_defaults = { "interface": "",

1794

"address": "",

1795

"port": "",

1796

"debug": "False",

1797

"priority":

1798

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1799

"servicename": "Mandos",

1800

"use_dbus": "True",

1801

"use_ipv6": "True",

1802

"debuglevel": "",

1453

1803

}

1454

1804

1455

1805

# Parse config file for server-global settings

1456

1806

server_config = configparser.SafeConfigParser(server_defaults)

1457

1807

del server_defaults

1458

1808

server_config.read(os.path.join(options.configdir,

1459

u"mandos.conf"))

1809

"mandos.conf"))

1460

1810

# Convert the SafeConfigParser object to a dict

1461

1811

server_settings = server_config.defaults()

1462

1812

# Use the appropriate methods on the non-string config options

1463

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1464

server_settings[option] = server_config.getboolean(u"DEFAULT",

1813

for option in ("debug", "use_dbus", "use_ipv6"):

1814

server_settings[option] = server_config.getboolean("DEFAULT",

1465

1815

option)

1466

1816

if server_settings["port"]:

1467

server_settings["port"] = server_config.getint(u"DEFAULT",

1468

u"port")

1817

server_settings["port"] = server_config.getint("DEFAULT",

1818

"port")

1469

1819

del server_config

1470

1820

1471

1821

# Override the settings from the config file with command line

1472

1822

# options, if set.

1473

for option in (u"interface", u"address", u"port", u"debug",

1474

u"priority", u"servicename", u"configdir",

1475

u"use_dbus", u"use_ipv6"):

1823

for option in ("interface", "address", "port", "debug",

1824

"priority", "servicename", "configdir",

1825

"use_dbus", "use_ipv6", "debuglevel"):

1476

1826

value = getattr(options, option)

1477

1827

if value is not None:

1478

1828

server_settings[option] = value

1486

1836

##################################################################

1487

1837

1488

1838

# For convenience

1489

debug = server_settings[u"debug"]

1490

use_dbus = server_settings[u"use_dbus"]

1491

use_ipv6 = server_settings[u"use_ipv6"]

1492

1493

if not debug:

1494

syslogger.setLevel(logging.WARNING)

1495

console.setLevel(logging.WARNING)

1496

1497

if server_settings[u"servicename"] != u"Mandos":

1839

debug = server_settings["debug"]

1840

debuglevel = server_settings["debuglevel"]

1841

use_dbus = server_settings["use_dbus"]

1842

use_ipv6 = server_settings["use_ipv6"]

1843

1844

if server_settings["servicename"] != "Mandos":

1498

1845

syslogger.setFormatter(logging.Formatter

1499

(u'Mandos (%s) [%%(process)d]:'

1500

u' %%(levelname)s: %%(message)s'

1501

% server_settings[u"servicename"]))

1846

('Mandos (%s) [%%(process)d]:'

1847

' %%(levelname)s: %%(message)s'

1848

% server_settings["servicename"]))

1502

1849

1503

1850

# Parse config file with clients

1504

client_defaults = { u"timeout": u"1h",

1505

u"interval": u"5m",

1506

u"checker": u"fping -q -- %%(host)s",

1507

u"host": u"",

1851

client_defaults = { "timeout": "5m",

1852

"extended_timeout": "15m",

1853

"interval": "2m",

1854

"checker": "fping -q -- %%(host)s",

1855

"host": "",

1856

"approval_delay": "0s",

1857

"approval_duration": "1s",

1508

1858

}

1509

1859

client_config = configparser.SafeConfigParser(client_defaults)

1510

client_config.read(os.path.join(server_settings[u"configdir"],

1511

u"clients.conf"))

1860

client_config.read(os.path.join(server_settings["configdir"],

1861

"clients.conf"))

1512

1862

1513

1863

global mandos_dbus_service

1514

1864

mandos_dbus_service = None

1515

1865

1516

tcp_server = MandosServer((server_settings[u"address"],

1517

server_settings[u"port"]),

1866

tcp_server = MandosServer((server_settings["address"],

1867

server_settings["port"]),

1518

1868

ClientHandler,

1519

interface=server_settings[u"interface"],

1869

interface=(server_settings["interface"]

1870

or None),

1520

1871

use_ipv6=use_ipv6,

1521

1872

gnutls_priority=

1522

server_settings[u"priority"],

1873

server_settings["priority"],

1523

1874

use_dbus=use_dbus)

1524

pidfilename = u"/var/run/mandos.pid"

1525

try:

1526

pidfile = open(pidfilename, u"w")

1527

except IOError:

1528

logger.error(u"Could not open file %r", pidfilename)

1875

if not debug:

1876

pidfilename = "/var/run/mandos.pid"

1877

try:

1878

pidfile = open(pidfilename, "w")

1879

except IOError:

1880

logger.error("Could not open file %r", pidfilename)

1529

1881

1530

1882

try:

1531

uid = pwd.getpwnam(u"_mandos").pw_uid

1532

gid = pwd.getpwnam(u"_mandos").pw_gid

1883

uid = pwd.getpwnam("_mandos").pw_uid

1884

gid = pwd.getpwnam("_mandos").pw_gid

1533

1885

except KeyError:

1534

1886

try:

1535

uid = pwd.getpwnam(u"mandos").pw_uid

1536

gid = pwd.getpwnam(u"mandos").pw_gid

1887

uid = pwd.getpwnam("mandos").pw_uid

1888

gid = pwd.getpwnam("mandos").pw_gid

1537

1889

except KeyError:

1538

1890

try:

1539

uid = pwd.getpwnam(u"nobody").pw_uid

1540

gid = pwd.getpwnam(u"nobody").pw_gid

1891

uid = pwd.getpwnam("nobody").pw_uid

1892

gid = pwd.getpwnam("nobody").pw_gid

1541

1893

except KeyError:

1542

1894

uid = 65534

1543

1895

gid = 65534

1544

1896

try:

1545

1897

os.setgid(gid)

1546

1898

os.setuid(uid)

1547

except OSError, error:

1899

except OSError as error:

1548

1900

if error[0] != errno.EPERM:

1549

1901

raise error

1550

1902

1551

# Enable all possible GnuTLS debugging

1903

if not debug and not debuglevel:

1904

syslogger.setLevel(logging.WARNING)

1905

console.setLevel(logging.WARNING)

1906

if debuglevel:

1907

level = getattr(logging, debuglevel.upper())

1908

syslogger.setLevel(level)

1909

console.setLevel(level)

1910

1552

1911

if debug:

1912

# Enable all possible GnuTLS debugging

1913

1553

1914

# "Use a log level over 10 to enable all debugging options."

1554

1915

# - GnuTLS manual

1555

1916

gnutls.library.functions.gnutls_global_set_log_level(11)

1556

1917

1557

1918

@gnutls.library.types.gnutls_log_func

1558

1919

def debug_gnutls(level, string):

1559

logger.debug(u"GnuTLS: %s", string[:-1])

1920

logger.debug("GnuTLS: %s", string[:-1])

1560

1921

1561

1922

(gnutls.library.functions

1562

1923

.gnutls_global_set_log_function(debug_gnutls))

1924

1925

# Redirect stdin so all checkers get /dev/null

1926

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1927

os.dup2(null, sys.stdin.fileno())

1928

if null > 2:

1929

os.close(null)

1930

else:

1931

# No console logging

1932

logger.removeHandler(console)

1933

1934

# Need to fork before connecting to D-Bus

1935

if not debug:

1936

# Close all input and output, do double fork, etc.

1937

daemon()

1563

1938

1564

1939

global main_loop

1565

1940

# From the Avahi example code

1569

1944

# End of Avahi example code

1570

1945

if use_dbus:

1571

1946

try:

1572

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1947

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1573

1948

bus, do_not_queue=True)

1574

except dbus.exceptions.NameExistsException, e:

1575

logger.error(unicode(e) + u", disabling D-Bus")

1949

except dbus.exceptions.NameExistsException as e:

1950

logger.error(unicode(e) + ", disabling D-Bus")

1576

1951

use_dbus = False

1577

server_settings[u"use_dbus"] = False

1952

server_settings["use_dbus"] = False

1578

1953

tcp_server.use_dbus = False

1579

1954

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1580

service = AvahiService(name = server_settings[u"servicename"],

1581

servicetype = u"_mandos._tcp",

1955

service = AvahiService(name = server_settings["servicename"],

1956

servicetype = "_mandos._tcp",

1582

1957

protocol = protocol, bus = bus)

1583

1958

if server_settings["interface"]:

1584

1959

service.interface = (if_nametoindex

1585

(str(server_settings[u"interface"])))

1960

(str(server_settings["interface"])))

1961

1962

global multiprocessing_manager

1963

multiprocessing_manager = multiprocessing.Manager()

1586

1964

1587

1965

client_class = Client

1588

1966

if use_dbus:

1589

1967

client_class = functools.partial(ClientDBus, bus = bus)

1968

def client_config_items(config, section):

1969

special_settings = {

1970

"approved_by_default":

1971

lambda: config.getboolean(section,

1972

"approved_by_default"),

1973

}

1974

for name, value in config.items(section):

1975

try:

1976

yield (name, special_settings[name]())

1977

except KeyError:

1978

yield (name, value)

1979

1590

1980

tcp_server.clients.update(set(

1591

1981

client_class(name = section,

1592

config= dict(client_config.items(section)))

1982

config= dict(client_config_items(

1983

client_config, section)))

1593

1984

for section in client_config.sections()))

1594

1985

if not tcp_server.clients:

1595

logger.warning(u"No clients defined")

1596

1597

if debug:

1598

# Redirect stdin so all checkers get /dev/null

1599

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1600

os.dup2(null, sys.stdin.fileno())

1601

if null > 2:

1602

os.close(null)

1603

else:

1604

# No console logging

1605

logger.removeHandler(console)

1606

# Close all input and output, do double fork, etc.

1607

daemon()

1608

1609

try:

1610

with closing(pidfile):

1611

pid = os.getpid()

1612

pidfile.write(str(pid) + "\n")

1613

del pidfile

1614

except IOError:

1615

logger.error(u"Could not write to file %r with PID %d",

1616

pidfilename, pid)

1617

except NameError:

1618

# "pidfile" was never created

1619

pass

1620

del pidfilename

1621

1986

logger.warning("No clients defined")

1987

1622

1988

if not debug:

1989

try:

1990

with pidfile:

1991

pid = os.getpid()

1992

pidfile.write(str(pid) + "\n".encode("utf-8"))

1993

del pidfile

1994

except IOError:

1995

logger.error("Could not write to file %r with PID %d",

1996

pidfilename, pid)

1997

except NameError:

1998

# "pidfile" was never created

1999

pass

2000

del pidfilename

2001

1623

2002

signal.signal(signal.SIGINT, signal.SIG_IGN)

2003

1624

2004

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1625

2005

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1626

2006

1628

2008

class MandosDBusService(dbus.service.Object):

1629

2009

"""A D-Bus proxy object"""

1630

2010

def __init__(self):

1631

dbus.service.Object.__init__(self, bus, u"/")

1632

_interface = u"se.bsnet.fukt.Mandos"

2011

dbus.service.Object.__init__(self, bus, "/")

2012

_interface = "se.bsnet.fukt.Mandos"

1633

2013

1634

@dbus.service.signal(_interface, signature=u"oa{sv}")

1635

def ClientAdded(self, objpath, properties):

2014

@dbus.service.signal(_interface, signature="o")

2015

def ClientAdded(self, objpath):

1636

2016

"D-Bus signal"

1637

2017

pass

1638

2018

1639

@dbus.service.signal(_interface, signature=u"ss")

2019

@dbus.service.signal(_interface, signature="ss")

1640

2020

def ClientNotFound(self, fingerprint, address):

1641

2021

"D-Bus signal"

1642

2022

pass

1643

2023

1644

@dbus.service.signal(_interface, signature=u"os")

2024

@dbus.service.signal(_interface, signature="os")

1645

2025

def ClientRemoved(self, objpath, name):

1646

2026

"D-Bus signal"

1647

2027

pass

1648

2028

1649

@dbus.service.method(_interface, out_signature=u"ao")

2029

@dbus.service.method(_interface, out_signature="ao")

1650

2030

def GetAllClients(self):

1651

2031

"D-Bus method"

1652

2032

return dbus.Array(c.dbus_object_path

1653

2033

for c in tcp_server.clients)

1654

2034

1655

2035

@dbus.service.method(_interface,

1656

out_signature=u"a{oa{sv}}")

2036

out_signature="a{oa{sv}}")

1657

2037

def GetAllClientsWithProperties(self):

1658

2038

"D-Bus method"

1659

2039

return dbus.Dictionary(

1660

((c.dbus_object_path, c.GetAll(u""))

2040

((c.dbus_object_path, c.GetAll(""))

1661

2041

for c in tcp_server.clients),

1662

signature=u"oa{sv}")

2042

signature="oa{sv}")

1663

2043

1664

@dbus.service.method(_interface, in_signature=u"o")

2044

@dbus.service.method(_interface, in_signature="o")

1665

2045

def RemoveClient(self, object_path):

1666

2046

"D-Bus method"

1667

2047

for c in tcp_server.clients:

1700

2080

for client in tcp_server.clients:

1701

2081

if use_dbus:

1702

2082

# Emit D-Bus signal

1703

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1704

client.GetAll(u""))

2083

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1705

2084

client.enable()

1706

2085

1707

2086

tcp_server.enable()

1710

2089

# Find out what port we got

1711

2090

service.port = tcp_server.socket.getsockname()[1]

1712

2091

if use_ipv6:

1713

logger.info(u"Now listening on address %r, port %d,"

2092

logger.info("Now listening on address %r, port %d,"

1714

2093

" flowinfo %d, scope_id %d"

1715

2094

% tcp_server.socket.getsockname())

1716

2095

else: # IPv4

1717

logger.info(u"Now listening on address %r, port %d"

2096

logger.info("Now listening on address %r, port %d"

1718

2097

% tcp_server.socket.getsockname())

1719

2098

1720

2099

#service.interface = tcp_server.socket.getsockname()[3]

1723

2102

# From the Avahi example code

1724

2103

try:

1725

2104

service.activate()

1726

except dbus.exceptions.DBusException, error:

1727

logger.critical(u"DBusException: %s", error)

2105

except dbus.exceptions.DBusException as error:

2106

logger.critical("DBusException: %s", error)

1728

2107

cleanup()

1729

2108

sys.exit(1)

1730

2109

# End of Avahi example code

1734

2113

(tcp_server.handle_request

1735

2114

(*args[2:], **kwargs) or True))

1736

2115

1737

logger.debug(u"Starting main loop")

2116

logger.debug("Starting main loop")

1738

2117

main_loop.run()

1739

except AvahiError, error:

1740

logger.critical(u"AvahiError: %s", error)

2118

except AvahiError as error:

2119

logger.critical("AvahiError: %s", error)

1741

2120

cleanup()

1742

2121

sys.exit(1)

1743

2122

except KeyboardInterrupt:

1744

2123

if debug:

1745

print >> sys.stderr

1746

logger.debug(u"Server received KeyboardInterrupt")

1747

logger.debug(u"Server exiting")

2124

print("", file=sys.stderr)

2125

logger.debug("Server received KeyboardInterrupt")

2126

logger.debug("Server exiting")

1748

2127

# Must run before the D-Bus bus name gets deregistered

1749

2128

cleanup()

1750

2129