/mandos/release : revision 24.1.152

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

62

61

import functools

63

62

import cPickle as pickle

64

63

import multiprocessing

65

import types

66

64

67

65

import dbus

68

66

import dbus.service

83

81

SO_BINDTODEVICE = None

84

82

85

83

86

version = "1.3.1"

84

version = "1.0.14"

87

85

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

86

logger = logging.Logger(u'mandos')

90

87

syslogger = (logging.handlers.SysLogHandler

91

88

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

address = str("/dev/log")))

89

address = "/dev/log"))

93

90

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

91

(u'Mandos [%(process)d]: %(levelname)s:'

92

u' %(message)s'))

96

93

logger.addHandler(syslogger)

97

94

98

95

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

96

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

97

u' %(levelname)s:'

98

u' %(message)s'))

102

99

logger.addHandler(console)

103

100

104

101

class AvahiError(Exception):

121

118

Attributes:

122

119

interface: integer; avahi.IF_UNSPEC or an interface index.

123

120

Used to optionally bind to the specified interface.

124

125

type: string; Example: '_mandos._tcp'.

121

122

type: string; Example: u'_mandos._tcp'.

126

123

See <http://www.dns-sd.org/ServiceTypes.html>

127

124

port: integer; what port to announce

128

125

TXT: list of strings; TXT record for the service

137

134

"""

138

135

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

139

136

servicetype = None, port = None, TXT = None,

140

domain = "", host = "", max_renames = 32768,

137

domain = u"", host = u"", max_renames = 32768,

141

138

protocol = avahi.PROTO_UNSPEC, bus = None):

142

139

self.interface = interface

143

140

self.name = name

152

149

self.group = None # our entry group

153

150

self.server = None

154

151

self.bus = bus

155

self.entry_group_state_changed_match = None

156

152

def rename(self):

157

153

"""Derived from the Avahi example code"""

158

154

if self.rename_count >= self.max_renames:

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

155

logger.critical(u"No suitable Zeroconf service name found"

156

u" after %i retries, exiting.",

161

157

self.rename_count)

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server

164

.GetAlternativeServiceName(self.name))

165

logger.info("Changing Zeroconf service name to %r ...",

166

self.name)

158

raise AvahiServiceError(u"Too many renames")

159

self.name = self.server.GetAlternativeServiceName(self.name)

160

logger.info(u"Changing Zeroconf service name to %r ...",

161

unicode(self.name))

167

162

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

163

(u'Mandos (%s) [%%(process)d]:'

164

u' %%(levelname)s: %%(message)s'

170

165

% self.name))

171

166

self.remove()

172

try:

173

self.add()

174

except dbus.exceptions.DBusException as error:

175

logger.critical("DBusException: %s", error)

176

self.cleanup()

177

os._exit(1)

167

self.add()

178

168

self.rename_count += 1

179

169

def remove(self):

180

170

"""Derived from the Avahi example code"""

181

if self.entry_group_state_changed_match is not None:

182

self.entry_group_state_changed_match.remove()

183

self.entry_group_state_changed_match = None

184

171

if self.group is not None:

185

172

self.group.Reset()

186

173

def add(self):

187

174

"""Derived from the Avahi example code"""

188

self.remove()

189

175

if self.group is None:

190

176

self.group = dbus.Interface(

191

177

self.bus.get_object(avahi.DBUS_NAME,

192

178

self.server.EntryGroupNew()),

193

179

avahi.DBUS_INTERFACE_ENTRY_GROUP)

194

self.entry_group_state_changed_match = (

195

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

180

self.group.connect_to_signal('StateChanged',

181

self

182

.entry_group_state_changed)

183

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

198

184

self.name, self.type)

199

185

self.group.AddService(

200

186

self.interface,

207

193

self.group.Commit()

208

194

def entry_group_state_changed(self, state, error):

209

195

"""Derived from the Avahi example code"""

210

logger.debug("Avahi entry group state change: %i", state)

196

logger.debug(u"Avahi state change: %i", state)

211

197

212

198

if state == avahi.ENTRY_GROUP_ESTABLISHED:

213

logger.debug("Zeroconf service established.")

199

logger.debug(u"Zeroconf service established.")

214

200

elif state == avahi.ENTRY_GROUP_COLLISION:

215

logger.info("Zeroconf service name collision.")

201

logger.warning(u"Zeroconf service name collision.")

216

202

self.rename()

217

203

elif state == avahi.ENTRY_GROUP_FAILURE:

218

logger.critical("Avahi: Error in group state changed %s",

204

logger.critical(u"Avahi: Error in group state changed %s",

219

205

unicode(error))

220

raise AvahiGroupError("State changed: %s"

206

raise AvahiGroupError(u"State changed: %s"

221

207

% unicode(error))

222

208

def cleanup(self):

223

209

"""Derived from the Avahi example code"""

224

210

if self.group is not None:

225

try:

226

self.group.Free()

227

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

229

pass

211

self.group.Free()

230

212

self.group = None

231

self.remove()

232

def server_state_changed(self, state, error=None):

213

def server_state_changed(self, state):

233

214

"""Derived from the Avahi example code"""

234

logger.debug("Avahi server state change: %i", state)

235

bad_states = { avahi.SERVER_INVALID:

236

"Zeroconf server invalid",

237

avahi.SERVER_REGISTERING: None,

238

avahi.SERVER_COLLISION:

239

"Zeroconf server name collision",

240

avahi.SERVER_FAILURE:

241

"Zeroconf server failure" }

242

if state in bad_states:

243

if bad_states[state] is not None:

244

if error is None:

245

logger.error(bad_states[state])

246

else:

247

logger.error(bad_states[state] + ": %r", error)

248

self.cleanup()

215

if state == avahi.SERVER_COLLISION:

216

logger.error(u"Zeroconf server name collision")

217

self.remove()

249

218

elif state == avahi.SERVER_RUNNING:

250

219

self.add()

251

else:

252

if error is None:

253

logger.debug("Unknown state: %r", state)

254

else:

255

logger.debug("Unknown state: %r: %r", state, error)

256

220

def activate(self):

257

221

"""Derived from the Avahi example code"""

258

222

if self.server is None:

259

223

self.server = dbus.Interface(

260

224

self.bus.get_object(avahi.DBUS_NAME,

261

avahi.DBUS_PATH_SERVER,

262

follow_name_owner_changes=True),

225

avahi.DBUS_PATH_SERVER),

263

226

avahi.DBUS_INTERFACE_SERVER)

264

self.server.connect_to_signal("StateChanged",

227

self.server.connect_to_signal(u"StateChanged",

265

228

self.server_state_changed)

266

229

self.server_state_changed(self.server.GetState())

267

230

268

231

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

274

275

232

class Client(object):

276

233

"""A representation of a client host served by this server.

277

234

278

235

Attributes:

279

_approved: bool(); 'None' if not yet approved/disapproved

280

approval_delay: datetime.timedelta(); Time to wait for approval

281

approval_duration: datetime.timedelta(); Duration of one approval

236

237

D-Bus identifiers

238

fingerprint: string (40 or 32 hexadecimal digits); used to

239

uniquely identify the client

240

secret: bytestring; sent verbatim (over TLS) to client

241

host: string; available for use by the checker command

242

created: datetime.datetime(); (UTC) object creation

243

last_enabled: datetime.datetime(); (UTC)

244

enabled: bool()

245

last_checked_ok: datetime.datetime(); (UTC) or None

246

timeout: datetime.timedelta(); How long from last_checked_ok

247

until this client is disabled

248

interval: datetime.timedelta(); How often to start a new checker

249

disable_hook: If set, called by disable() as disable_hook(self)

282

250

checker: subprocess.Popen(); a running checker process used

283

251

to see if the client lives.

284

252

'None' if no process is running.

285

checker_callback_tag: a gobject event source tag, or None

286

checker_command: string; External command which is run to check

287

if client lives. %() expansions are done at

253

checker_initiator_tag: a gobject event source tag, or None

254

disable_initiator_tag: - '' -

255

checker_callback_tag: - '' -

256

checker_command: string; External command which is run to check if

257

client lives. %() expansions are done at

288

258

runtime with vars(self) as dict, so that for

289

259

instance %(name)s can be used in the command.

290

checker_initiator_tag: a gobject event source tag, or None

291

created: datetime.datetime(); (UTC) object creation

292

260

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

294

disable_initiator_tag: a gobject event source tag, or None

295

enabled: bool()

296

fingerprint: string (40 or 32 hexadecimal digits); used to

297

uniquely identify the client

298

host: string; available for use by the checker command

299

interval: datetime.timedelta(); How often to start a new checker

300

last_approval_request: datetime.datetime(); (UTC) or None

301

last_checked_ok: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

303

304

D-Bus identifiers

305

secret: bytestring; sent verbatim (over TLS) to client

306

timeout: datetime.timedelta(); How long from last_checked_ok

307

until this client is disabled

308

extended_timeout: extra long timeout when password has been sent

309

runtime_expansions: Allowed attributes for runtime expansion.

310

expires: datetime.datetime(); time (UTC) when a client will be

311

disabled, or None

261

approved_delay: datetime.timedelta(); Time to wait for approval

262

_approved: bool(); 'None' if not yet approved/disapproved

263

approved_duration: datetime.timedelta(); Duration of one approval

312

264

"""

313

265

314

runtime_expansions = ("approval_delay", "approval_duration",

315

"created", "enabled", "fingerprint",

316

"host", "interval", "last_checked_ok",

317

"last_enabled", "name", "timeout")

266

@staticmethod

267

def _timedelta_to_milliseconds(td):

268

"Convert a datetime.timedelta() to milliseconds"

269

return ((td.days * 24 * 60 * 60 * 1000)

270

+ (td.seconds * 1000)

271

+ (td.microseconds // 1000))

318

272

319

273

def timeout_milliseconds(self):

320

274

"Return the 'timeout' attribute in milliseconds"

321

return _timedelta_to_milliseconds(self.timeout)

322

323

def extended_timeout_milliseconds(self):

324

"Return the 'extended_timeout' attribute in milliseconds"

325

return _timedelta_to_milliseconds(self.extended_timeout)

275

return self._timedelta_to_milliseconds(self.timeout)

326

276

327

277

def interval_milliseconds(self):

328

278

"Return the 'interval' attribute in milliseconds"

329

return _timedelta_to_milliseconds(self.interval)

330

331

def approval_delay_milliseconds(self):

332

return _timedelta_to_milliseconds(self.approval_delay)

279

return self._timedelta_to_milliseconds(self.interval)

280

281

def approved_delay_milliseconds(self):

282

return self._timedelta_to_milliseconds(self.approved_delay)

333

283

334

284

def __init__(self, name = None, disable_hook=None, config=None):

335

285

"""Note: the 'checker' key in 'config' sets the

338

288

self.name = name

339

289

if config is None:

340

290

config = {}

341

logger.debug("Creating client %r", self.name)

291

logger.debug(u"Creating client %r", self.name)

342

292

# Uppercase and remove spaces from fingerprint for later

343

293

# comparison purposes with return value from the fingerprint()

344

294

# function

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

347

logger.debug(" Fingerprint: %s", self.fingerprint)

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

295

self.fingerprint = (config[u"fingerprint"].upper()

296

.replace(u" ", u""))

297

logger.debug(u" Fingerprint: %s", self.fingerprint)

298

if u"secret" in config:

299

self.secret = config[u"secret"].decode(u"base64")

300

elif u"secfile" in config:

351

301

with open(os.path.expanduser(os.path.expandvars

352

(config["secfile"])),

302

(config[u"secfile"])),

353

303

"rb") as secfile:

354

304

self.secret = secfile.read()

355

305

else:

356

raise TypeError("No secret or secfile for client %s"

306

#XXX Need to allow secret on demand!

307

raise TypeError(u"No secret or secfile for client %s"

357

308

% self.name)

358

self.host = config.get("host", "")

309

self.host = config.get(u"host", u"")

359

310

self.created = datetime.datetime.utcnow()

360

311

self.enabled = False

361

self.last_approval_request = None

362

312

self.last_enabled = None

363

313

self.last_checked_ok = None

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

314

self.timeout = string_to_delta(config[u"timeout"])

315

self.interval = string_to_delta(config[u"interval"])

368

316

self.disable_hook = disable_hook

369

317

self.checker = None

370

318

self.checker_initiator_tag = None

371

319

self.disable_initiator_tag = None

372

self.expires = None

373

320

self.checker_callback_tag = None

374

self.checker_command = config["checker"]

321

self.checker_command = config[u"checker"]

375

322

self.current_checker_command = None

376

323

self.last_connect = None

377

self._approved = None

378

self.approved_by_default = config.get("approved_by_default",

379

True)

380

324

self.approvals_pending = 0

381

self.approval_delay = string_to_delta(

382

config["approval_delay"])

383

self.approval_duration = string_to_delta(

384

config["approval_duration"])

385

self.changedstate = (multiprocessing_manager

386

.Condition(multiprocessing_manager

387

.Lock()))

388

325

self._approved = None

326

self.approved_by_default = config.get(u"approved_by_default",

327

False)

328

self.approved_delay = string_to_delta(

329

config[u"approved_delay"])

330

self.approved_duration = string_to_delta(

331

config[u"approved_duration"])

332

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

333

389

334

def send_changedstate(self):

390

335

self.changedstate.acquire()

391

336

self.changedstate.notify_all()

392

337

self.changedstate.release()

393

338

394

339

def enable(self):

395

340

"""Start this client's checker and timeout hooks"""

396

if getattr(self, "enabled", False):

341

if getattr(self, u"enabled", False):

397

342

# Already enabled

398

343

return

399

344

self.send_changedstate()

345

self.last_enabled = datetime.datetime.utcnow()

400

346

# Schedule a new checker to be started an 'interval' from now,

401

347

# and every interval from then on.

402

348

self.checker_initiator_tag = (gobject.timeout_add

403

349

(self.interval_milliseconds(),

404

350

self.start_checker))

405

351

# Schedule a disable() when 'timeout' has passed

406

self.expires = datetime.datetime.utcnow() + self.timeout

407

352

self.disable_initiator_tag = (gobject.timeout_add

408

353

(self.timeout_milliseconds(),

409

354

self.disable))

410

355

self.enabled = True

411

self.last_enabled = datetime.datetime.utcnow()

412

356

# Also start a new checker *right now*.

413

357

self.start_checker()

414

358

419

363

if not quiet:

420

364

self.send_changedstate()

421

365

if not quiet:

422

logger.info("Disabling client %s", self.name)

423

if getattr(self, "disable_initiator_tag", False):

366

logger.info(u"Disabling client %s", self.name)

367

if getattr(self, u"disable_initiator_tag", False):

424

368

gobject.source_remove(self.disable_initiator_tag)

425

369

self.disable_initiator_tag = None

426

self.expires = None

427

if getattr(self, "checker_initiator_tag", False):

370

if getattr(self, u"checker_initiator_tag", False):

428

371

gobject.source_remove(self.checker_initiator_tag)

429

372

self.checker_initiator_tag = None

430

373

self.stop_checker()

445

388

if os.WIFEXITED(condition):

446

389

exitstatus = os.WEXITSTATUS(condition)

447

390

if exitstatus == 0:

448

logger.info("Checker for %(name)s succeeded",

391

logger.info(u"Checker for %(name)s succeeded",

449

392

vars(self))

450

393

self.checked_ok()

451

394

else:

452

logger.info("Checker for %(name)s failed",

395

logger.info(u"Checker for %(name)s failed",

453

396

vars(self))

454

397

else:

455

logger.warning("Checker for %(name)s crashed?",

398

logger.warning(u"Checker for %(name)s crashed?",

456

399

vars(self))

457

400

458

def checked_ok(self, timeout=None):

401

def checked_ok(self):

459

402

"""Bump up the timeout for this client.

460

403

461

404

This should only be called when the client has been seen,

462

405

alive and well.

463

406

"""

464

if timeout is None:

465

timeout = self.timeout

466

407

self.last_checked_ok = datetime.datetime.utcnow()

467

408

gobject.source_remove(self.disable_initiator_tag)

468

self.expires = datetime.datetime.utcnow() + timeout

469

409

self.disable_initiator_tag = (gobject.timeout_add

470

(_timedelta_to_milliseconds

471

(timeout), self.disable))

472

473

def need_approval(self):

474

self.last_approval_request = datetime.datetime.utcnow()

410

(self.timeout_milliseconds(),

411

self.disable))

475

412

476

413

def start_checker(self):

477

414

"""Start a new checker subprocess if one is not running.

490

427

# If a checker exists, make sure it is not a zombie

491

428

try:

492

429

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

493

except (AttributeError, OSError) as error:

430

except (AttributeError, OSError), error:

494

431

if (isinstance(error, OSError)

495

432

and error.errno != errno.ECHILD):

496

433

raise error

497

434

else:

498

435

if pid:

499

logger.warning("Checker was a zombie")

436

logger.warning(u"Checker was a zombie")

500

437

gobject.source_remove(self.checker_callback_tag)

501

438

self.checker_callback(pid, status,

502

439

self.current_checker_command)

507

444

command = self.checker_command % self.host

508

445

except TypeError:

509

446

# Escape attributes for the shell

510

escaped_attrs = dict(

511

(attr,

512

re.escape(unicode(str(getattr(self, attr, "")),

513

errors=

514

'replace')))

515

for attr in

516

self.runtime_expansions)

517

447

escaped_attrs = dict((key,

448

re.escape(unicode(str(val),

449

errors=

450

u'replace')))

451

for key, val in

452

vars(self).iteritems())

518

453

try:

519

454

command = self.checker_command % escaped_attrs

520

except TypeError as error:

521

logger.error('Could not format string "%s":'

522

' %s', self.checker_command, error)

455

except TypeError, error:

456

logger.error(u'Could not format string "%s":'

457

u' %s', self.checker_command, error)

523

458

return True # Try again later

524

459

self.current_checker_command = command

525

460

try:

526

logger.info("Starting checker %r for %s",

461

logger.info(u"Starting checker %r for %s",

527

462

command, self.name)

528

463

# We don't need to redirect stdout and stderr, since

529

464

# in normal mode, that is already done by daemon(),

531

466

# always replaced by /dev/null.)

532

467

self.checker = subprocess.Popen(command,

533

468

close_fds=True,

534

shell=True, cwd="/")

469

shell=True, cwd=u"/")

535

470

self.checker_callback_tag = (gobject.child_watch_add

536

471

(self.checker.pid,

537

472

self.checker_callback,

542

477

if pid:

543

478

gobject.source_remove(self.checker_callback_tag)

544

479

self.checker_callback(pid, status, command)

545

except OSError as error:

546

logger.error("Failed to start subprocess: %s",

480

except OSError, error:

481

logger.error(u"Failed to start subprocess: %s",

547

482

error)

548

483

# Re-run this periodically if run by gobject.timeout_add

549

484

return True

553

488

if self.checker_callback_tag:

554

489

gobject.source_remove(self.checker_callback_tag)

555

490

self.checker_callback_tag = None

556

if getattr(self, "checker", None) is None:

491

if getattr(self, u"checker", None) is None:

557

492

return

558

logger.debug("Stopping checker for %(name)s", vars(self))

493

logger.debug(u"Stopping checker for %(name)s", vars(self))

559

494

try:

560

495

os.kill(self.checker.pid, signal.SIGTERM)

561

496

#time.sleep(0.5)

562

497

#if self.checker.poll() is None:

563

498

# os.kill(self.checker.pid, signal.SIGKILL)

564

except OSError as error:

499

except OSError, error:

565

500

if error.errno != errno.ESRCH: # No such process

566

501

raise

567

502

self.checker = None

568

503

569

570

def dbus_service_property(dbus_interface, signature="v",

571

access="readwrite", byte_arrays=False):

504

def dbus_service_property(dbus_interface, signature=u"v",

505

access=u"readwrite", byte_arrays=False):

572

506

"""Decorators for marking methods of a DBusObjectWithProperties to

573

507

become properties on the D-Bus.

574

508

581

515

"""

582

516

# Encoding deeply encoded byte arrays is not supported yet by the

583

517

# "Set" method, so we fail early here:

584

if byte_arrays and signature != "ay":

585

raise ValueError("Byte arrays not supported for non-'ay'"

586

" signature %r" % signature)

518

if byte_arrays and signature != u"ay":

519

raise ValueError(u"Byte arrays not supported for non-'ay'"

520

u" signature %r" % signature)

587

521

def decorator(func):

588

522

func._dbus_is_property = True

589

523

func._dbus_interface = dbus_interface

590

524

func._dbus_signature = signature

591

525

func._dbus_access = access

592

526

func._dbus_name = func.__name__

593

if func._dbus_name.endswith("_dbus_property"):

527

if func._dbus_name.endswith(u"_dbus_property"):

594

528

func._dbus_name = func._dbus_name[:-14]

595

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

529

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

596

530

return func

597

531

return decorator

598

532

618

552

619

553

class DBusObjectWithProperties(dbus.service.Object):

620

554

"""A D-Bus object with properties.

621

555

622

556

Classes inheriting from this can use the dbus_service_property

623

557

decorator to expose methods as D-Bus properties. It exposes the

624

558

standard Get(), Set(), and GetAll() methods on the D-Bus.

626

560

627

561

@staticmethod

628

562

def _is_dbus_property(obj):

629

return getattr(obj, "_dbus_is_property", False)

563

return getattr(obj, u"_dbus_is_property", False)

630

564

631

565

def _get_all_dbus_properties(self):

632

566

"""Returns a generator of (name, attribute) pairs

633

567

"""

634

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

635

for cls in self.__class__.__mro__

568

return ((prop._dbus_name, prop)

636

569

for name, prop in

637

inspect.getmembers(cls, self._is_dbus_property))

570

inspect.getmembers(self, self._is_dbus_property))

638

571

639

572

def _get_dbus_property(self, interface_name, property_name):

640

573

"""Returns a bound method if one exists which is a D-Bus

641

574

property with the specified name and interface.

642

575

"""

643

for cls in self.__class__.__mro__:

644

for name, value in (inspect.getmembers

645

(cls, self._is_dbus_property)):

646

if (value._dbus_name == property_name

647

and value._dbus_interface == interface_name):

648

return value.__get__(self)

649

576

for name in (property_name,

577

property_name + u"_dbus_property"):

578

prop = getattr(self, name, None)

579

if (prop is None

580

or not self._is_dbus_property(prop)

581

or prop._dbus_name != property_name

582

or (interface_name and prop._dbus_interface

583

and interface_name != prop._dbus_interface)):

584

continue

585

return prop

650

586

# No such property

651

raise DBusPropertyNotFound(self.dbus_object_path + ":"

652

+ interface_name + "."

587

raise DBusPropertyNotFound(self.dbus_object_path + u":"

588

+ interface_name + u"."

653

589

+ property_name)

654

590

655

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

656

out_signature="v")

591

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

592

out_signature=u"v")

657

593

def Get(self, interface_name, property_name):

658

594

"""Standard D-Bus property Get() method, see D-Bus standard.

659

595

"""

660

596

prop = self._get_dbus_property(interface_name, property_name)

661

if prop._dbus_access == "write":

597

if prop._dbus_access == u"write":

662

598

raise DBusPropertyAccessException(property_name)

663

599

value = prop()

664

if not hasattr(value, "variant_level"):

600

if not hasattr(value, u"variant_level"):

665

601

return value

666

602

return type(value)(value, variant_level=value.variant_level+1)

667

603

668

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

604

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

669

605

def Set(self, interface_name, property_name, value):

670

606

"""Standard D-Bus property Set() method, see D-Bus standard.

671

607

"""

672

608

prop = self._get_dbus_property(interface_name, property_name)

673

if prop._dbus_access == "read":

609

if prop._dbus_access == u"read":

674

610

raise DBusPropertyAccessException(property_name)

675

if prop._dbus_get_args_options["byte_arrays"]:

611

if prop._dbus_get_args_options[u"byte_arrays"]:

676

612

# The byte_arrays option is not supported yet on

677

613

# signatures other than "ay".

678

if prop._dbus_signature != "ay":

614

if prop._dbus_signature != u"ay":

679

615

raise ValueError

680

616

value = dbus.ByteArray(''.join(unichr(byte)

681

617

for byte in value))

682

618

prop(value)

683

619

684

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

685

out_signature="a{sv}")

620

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

621

out_signature=u"a{sv}")

686

622

def GetAll(self, interface_name):

687

623

"""Standard D-Bus property GetAll() method, see D-Bus

688

624

standard.

689

625

690

626

Note: Will not include properties with access="write".

691

627

"""

692

628

all = {}

696

632

# Interface non-empty but did not match

697

633

continue

698

634

# Ignore write-only properties

699

if prop._dbus_access == "write":

635

if prop._dbus_access == u"write":

700

636

continue

701

637

value = prop()

702

if not hasattr(value, "variant_level"):

638

if not hasattr(value, u"variant_level"):

703

639

all[name] = value

704

640

continue

705

641

all[name] = type(value)(value, variant_level=

706

642

value.variant_level+1)

707

return dbus.Dictionary(all, signature="sv")

643

return dbus.Dictionary(all, signature=u"sv")

708

644

709

645

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

710

out_signature="s",

646

out_signature=u"s",

711

647

path_keyword='object_path',

712

648

connection_keyword='connection')

713

649

def Introspect(self, object_path, connection):

718

654

try:

719

655

document = xml.dom.minidom.parseString(xmlstring)

720

656

def make_tag(document, name, prop):

721

e = document.createElement("property")

722

e.setAttribute("name", name)

723

e.setAttribute("type", prop._dbus_signature)

724

e.setAttribute("access", prop._dbus_access)

657

e = document.createElement(u"property")

658

e.setAttribute(u"name", name)

659

e.setAttribute(u"type", prop._dbus_signature)

660

e.setAttribute(u"access", prop._dbus_access)

725

661

return e

726

for if_tag in document.getElementsByTagName("interface"):

662

for if_tag in document.getElementsByTagName(u"interface"):

727

663

for tag in (make_tag(document, name, prop)

728

664

for name, prop

729

665

in self._get_all_dbus_properties()

730

666

if prop._dbus_interface

731

== if_tag.getAttribute("name")):

667

== if_tag.getAttribute(u"name")):

732

668

if_tag.appendChild(tag)

733

669

# Add the names to the return values for the

734

670

# "org.freedesktop.DBus.Properties" methods

735

if (if_tag.getAttribute("name")

736

== "org.freedesktop.DBus.Properties"):

737

for cn in if_tag.getElementsByTagName("method"):

738

if cn.getAttribute("name") == "Get":

739

for arg in cn.getElementsByTagName("arg"):

740

if (arg.getAttribute("direction")

741

== "out"):

742

arg.setAttribute("name", "value")

743

elif cn.getAttribute("name") == "GetAll":

744

for arg in cn.getElementsByTagName("arg"):

745

if (arg.getAttribute("direction")

746

== "out"):

747

arg.setAttribute("name", "props")

748

xmlstring = document.toxml("utf-8")

671

if (if_tag.getAttribute(u"name")

672

== u"org.freedesktop.DBus.Properties"):

673

for cn in if_tag.getElementsByTagName(u"method"):

674

if cn.getAttribute(u"name") == u"Get":

675

for arg in cn.getElementsByTagName(u"arg"):

676

if (arg.getAttribute(u"direction")

677

== u"out"):

678

arg.setAttribute(u"name", u"value")

679

elif cn.getAttribute(u"name") == u"GetAll":

680

for arg in cn.getElementsByTagName(u"arg"):

681

if (arg.getAttribute(u"direction")

682

== u"out"):

683

arg.setAttribute(u"name", u"props")

684

xmlstring = document.toxml(u"utf-8")

749

685

document.unlink()

750

686

except (AttributeError, xml.dom.DOMException,

751

xml.parsers.expat.ExpatError) as error:

752

logger.error("Failed to override Introspection method",

687

xml.parsers.expat.ExpatError), error:

688

logger.error(u"Failed to override Introspection method",

753

689

error)

754

690

return xmlstring

755

691

756

692

757

def datetime_to_dbus (dt, variant_level=0):

758

"""Convert a UTC datetime.datetime() to a D-Bus type."""

759

if dt is None:

760

return dbus.String("", variant_level = variant_level)

761

return dbus.String(dt.isoformat(),

762

variant_level=variant_level)

763

764

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

765

.__metaclass__):

766

"""Applied to an empty subclass of a D-Bus object, this metaclass

767

will add additional D-Bus attributes matching a certain pattern.

768

"""

769

def __new__(mcs, name, bases, attr):

770

# Go through all the base classes which could have D-Bus

771

# methods, signals, or properties in them

772

for base in (b for b in bases

773

if issubclass(b, dbus.service.Object)):

774

# Go though all attributes of the base class

775

for attrname, attribute in inspect.getmembers(base):

776

# Ignore non-D-Bus attributes, and D-Bus attributes

777

# with the wrong interface name

778

if (not hasattr(attribute, "_dbus_interface")

779

or not attribute._dbus_interface

780

.startswith("se.recompile.Mandos")):

781

continue

782

# Create an alternate D-Bus interface name based on

783

# the current name

784

alt_interface = (attribute._dbus_interface

785

.replace("se.recompile.Mandos",

786

"se.bsnet.fukt.Mandos"))

787

# Is this a D-Bus signal?

788

if getattr(attribute, "_dbus_is_signal", False):

789

# Extract the original non-method function by

790

# black magic

791

nonmethod_func = (dict(

792

zip(attribute.func_code.co_freevars,

793

attribute.__closure__))["func"]

794

.cell_contents)

795

# Create a new, but exactly alike, function

796

# object, and decorate it to be a new D-Bus signal

797

# with the alternate D-Bus interface name

798

new_function = (dbus.service.signal

799

(alt_interface,

800

attribute._dbus_signature)

801

(types.FunctionType(

802

nonmethod_func.func_code,

803

nonmethod_func.func_globals,

804

nonmethod_func.func_name,

805

nonmethod_func.func_defaults,

806

nonmethod_func.func_closure)))

807

# Define a creator of a function to call both the

808

# old and new functions, so both the old and new

809

# signals gets sent when the function is called

810

def fixscope(func1, func2):

811

"""This function is a scope container to pass

812

func1 and func2 to the "call_both" function

813

outside of its arguments"""

814

def call_both(*args, **kwargs):

815

"""This function will emit two D-Bus

816

signals by calling func1 and func2"""

817

func1(*args, **kwargs)

818

func2(*args, **kwargs)

819

return call_both

820

# Create the "call_both" function and add it to

821

# the class

822

attr[attrname] = fixscope(attribute,

823

new_function)

824

# Is this a D-Bus method?

825

elif getattr(attribute, "_dbus_is_method", False):

826

# Create a new, but exactly alike, function

827

# object. Decorate it to be a new D-Bus method

828

# with the alternate D-Bus interface name. Add it

829

# to the class.

830

attr[attrname] = (dbus.service.method

831

(alt_interface,

832

attribute._dbus_in_signature,

833

attribute._dbus_out_signature)

834

(types.FunctionType

835

(attribute.func_code,

836

attribute.func_globals,

837

attribute.func_name,

838

attribute.func_defaults,

839

attribute.func_closure)))

840

# Is this a D-Bus property?

841

elif getattr(attribute, "_dbus_is_property", False):

842

# Create a new, but exactly alike, function

843

# object, and decorate it to be a new D-Bus

844

# property with the alternate D-Bus interface

845

# name. Add it to the class.

846

attr[attrname] = (dbus_service_property

847

(alt_interface,

848

attribute._dbus_signature,

849

attribute._dbus_access,

850

attribute

851

._dbus_get_args_options

852

["byte_arrays"])

853

(types.FunctionType

854

(attribute.func_code,

855

attribute.func_globals,

856

attribute.func_name,

857

attribute.func_defaults,

858

attribute.func_closure)))

859

return type.__new__(mcs, name, bases, attr)

860

861

693

class ClientDBus(Client, DBusObjectWithProperties):

862

694

"""A Client class using D-Bus

863

695

865

697

dbus_object_path: dbus.ObjectPath

866

698

bus: dbus.SystemBus()

867

699

"""

868

869

runtime_expansions = (Client.runtime_expansions

870

+ ("dbus_object_path",))

871

872

700

# dbus.service.Object doesn't use super(), so we can't either.

873

701

874

702

def __init__(self, bus = None, *args, **kwargs):

875

self._approvals_pending = 0

876

703

self.bus = bus

877

704

Client.__init__(self, *args, **kwargs)

878

705

# Only now, when this client is initialized, can it show up on

879

706

# the D-Bus

880

client_object_name = unicode(self.name).translate(

881

{ord("."): ord("_"),

882

ord("-"): ord("_")})

883

707

self.dbus_object_path = (dbus.ObjectPath

884

("/clients/" + client_object_name))

708

(u"/clients/"

709

+ self.name.replace(u".", u"_")))

885

710

DBusObjectWithProperties.__init__(self, self.bus,

886

711

self.dbus_object_path)

887

888

def notifychangeproperty(transform_func,

889

dbus_name, type_func=lambda x: x,

890

variant_level=1):

891

""" Modify a variable so that it's a property which announces

892

its changes to DBus.

893

894

transform_fun: Function that takes a value and transforms it

895

to a D-Bus type.

896

dbus_name: D-Bus name of the variable

897

type_func: Function that transform the value before sending it

898

to the D-Bus. Default: no transform

899

variant_level: D-Bus variant level. Default: 1

900

"""

901

attrname = "_{0}".format(dbus_name)

902

def setter(self, value):

903

if hasattr(self, "dbus_object_path"):

904

if (not hasattr(self, attrname) or

905

type_func(getattr(self, attrname, None))

906

!= type_func(value)):

907

dbus_value = transform_func(type_func(value),

908

variant_level)

909

self.PropertyChanged(dbus.String(dbus_name),

910

dbus_value)

911

setattr(self, attrname, value)

912

913

return property(lambda self: getattr(self, attrname), setter)

914

915

916

expires = notifychangeproperty(datetime_to_dbus, "Expires")

917

approvals_pending = notifychangeproperty(dbus.Boolean,

918

"ApprovalPending",

919

type_func = bool)

920

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

921

last_enabled = notifychangeproperty(datetime_to_dbus,

922

"LastEnabled")

923

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

924

type_func = lambda checker:

925

checker is not None)

926

last_checked_ok = notifychangeproperty(datetime_to_dbus,

927

"LastCheckedOK")

928

last_approval_request = notifychangeproperty(

929

datetime_to_dbus, "LastApprovalRequest")

930

approved_by_default = notifychangeproperty(dbus.Boolean,

931

"ApprovedByDefault")

932

approval_delay = notifychangeproperty(dbus.UInt16,

933

"ApprovalDelay",

934

type_func =

935

_timedelta_to_milliseconds)

936

approval_duration = notifychangeproperty(

937

dbus.UInt16, "ApprovalDuration",

938

type_func = _timedelta_to_milliseconds)

939

host = notifychangeproperty(dbus.String, "Host")

940

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

941

type_func =

942

_timedelta_to_milliseconds)

943

extended_timeout = notifychangeproperty(

944

dbus.UInt16, "ExtendedTimeout",

945

type_func = _timedelta_to_milliseconds)

946

interval = notifychangeproperty(dbus.UInt16,

947

"Interval",

948

type_func =

949

_timedelta_to_milliseconds)

950

checker_command = notifychangeproperty(dbus.String, "Checker")

951

952

del notifychangeproperty

712

713

@staticmethod

714

def _datetime_to_dbus(dt, variant_level=0):

715

"""Convert a UTC datetime.datetime() to a D-Bus type."""

716

return dbus.String(dt.isoformat(),

717

variant_level=variant_level)

718

719

def enable(self):

720

oldstate = getattr(self, u"enabled", False)

721

r = Client.enable(self)

722

if oldstate != self.enabled:

723

# Emit D-Bus signals

724

self.PropertyChanged(dbus.String(u"enabled"),

725

dbus.Boolean(True, variant_level=1))

726

self.PropertyChanged(

727

dbus.String(u"last_enabled"),

728

self._datetime_to_dbus(self.last_enabled,

729

variant_level=1))

730

return r

731

732

def disable(self, quiet = False):

733

oldstate = getattr(self, u"enabled", False)

734

r = Client.disable(self, quiet=quiet)

735

if not quiet and oldstate != self.enabled:

736

# Emit D-Bus signal

737

self.PropertyChanged(dbus.String(u"enabled"),

738

dbus.Boolean(False, variant_level=1))

739

return r

953

740

954

741

def __del__(self, *args, **kwargs):

955

742

try:

956

743

self.remove_from_connection()

957

744

except LookupError:

958

745

pass

959

if hasattr(DBusObjectWithProperties, "__del__"):

746

if hasattr(DBusObjectWithProperties, u"__del__"):

960

747

DBusObjectWithProperties.__del__(self, *args, **kwargs)

961

748

Client.__del__(self, *args, **kwargs)

962

749

964

751

*args, **kwargs):

965

752

self.checker_callback_tag = None

966

753

self.checker = None

754

# Emit D-Bus signal

755

self.PropertyChanged(dbus.String(u"checker_running"),

756

dbus.Boolean(False, variant_level=1))

967

757

if os.WIFEXITED(condition):

968

758

exitstatus = os.WEXITSTATUS(condition)

969

759

# Emit D-Bus signal

979

769

return Client.checker_callback(self, pid, condition, command,

980

770

*args, **kwargs)

981

771

772

def checked_ok(self, *args, **kwargs):

773

r = Client.checked_ok(self, *args, **kwargs)

774

# Emit D-Bus signal

775

self.PropertyChanged(

776

dbus.String(u"last_checked_ok"),

777

(self._datetime_to_dbus(self.last_checked_ok,

778

variant_level=1)))

779

return r

780

982

781

def start_checker(self, *args, **kwargs):

983

782

old_checker = self.checker

984

783

if self.checker is not None:

991

790

and old_checker_pid != self.checker.pid):

992

791

# Emit D-Bus signal

993

792

self.CheckerStarted(self.current_checker_command)

793

self.PropertyChanged(

794

dbus.String(u"checker_running"),

795

dbus.Boolean(True, variant_level=1))

994

796

return r

995

797

798

def stop_checker(self, *args, **kwargs):

799

old_checker = getattr(self, u"checker", None)

800

r = Client.stop_checker(self, *args, **kwargs)

801

if (old_checker is not None

802

and getattr(self, u"checker", None) is None):

803

self.PropertyChanged(dbus.String(u"checker_running"),

804

dbus.Boolean(False, variant_level=1))

805

return r

806

996

807

def _reset_approved(self):

997

808

self._approved = None

998

809

return False

999

810

1000

811

def approve(self, value=True):

1001

self.send_changedstate()

1002

812

self._approved = value

1003

gobject.timeout_add(_timedelta_to_milliseconds

1004

(self.approval_duration),

1005

self._reset_approved)

1006

813

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))

814

815

def approved_pending(self):

816

return self.approvals_pending > 0

817

1007

818

1008

819

## D-Bus methods, signals & properties

1009

_interface = "se.recompile.Mandos.Client"

820

_interface = u"se.bsnet.fukt.Mandos.Client"

1010

821

1011

822

## Signals

1012

823

1013

824

# CheckerCompleted - signal

1014

@dbus.service.signal(_interface, signature="nxs")

825

@dbus.service.signal(_interface, signature=u"nxs")

1015

826

def CheckerCompleted(self, exitcode, waitstatus, command):

1016

827

"D-Bus signal"

1017

828

pass

1018

829

1019

830

# CheckerStarted - signal

1020

@dbus.service.signal(_interface, signature="s")

831

@dbus.service.signal(_interface, signature=u"s")

1021

832

def CheckerStarted(self, command):

1022

833

"D-Bus signal"

1023

834

pass

1024

835

1025

836

# PropertyChanged - signal

1026

@dbus.service.signal(_interface, signature="sv")

837

@dbus.service.signal(_interface, signature=u"sv")

1027

838

def PropertyChanged(self, property, value):

1028

839

"D-Bus signal"

1029

840

pass

1031

842

# GotSecret - signal

1032

843

@dbus.service.signal(_interface)

1033

844

def GotSecret(self):

1034

"""D-Bus signal

1035

Is sent after a successful transfer of secret from the Mandos

1036

server to mandos-client

1037

"""

845

"D-Bus signal"

1038

846

pass

1039

847

1040

848

# Rejected - signal

1041

@dbus.service.signal(_interface, signature="s")

849

@dbus.service.signal(_interface, signature=u"s")

1042

850

def Rejected(self, reason):

1043

851

"D-Bus signal"

1044

852

pass

1045

853

1046

854

# NeedApproval - signal

1047

@dbus.service.signal(_interface, signature="tb")

855

@dbus.service.signal(_interface, signature=u"db")

1048

856

def NeedApproval(self, timeout, default):

1049

857

"D-Bus signal"

1050

return self.need_approval()

858

pass

1051

859

1052

860

## Methods

1053

861

1054

862

# Approve - method

1055

@dbus.service.method(_interface, in_signature="b")

863

@dbus.service.method(_interface, in_signature=u"b")

1056

864

def Approve(self, value):

1057

865

self.approve(value)

1058

866

1059

867

# CheckedOK - method

1060

868

@dbus.service.method(_interface)

1061

869

def CheckedOK(self):

1062

self.checked_ok()

870

return self.checked_ok()

1063

871

1064

872

# Enable - method

1065

873

@dbus.service.method(_interface)

1086

894

1087

895

## Properties

1088

896

1089

# ApprovalPending - property

1090

@dbus_service_property(_interface, signature="b", access="read")

1091

def ApprovalPending_dbus_property(self):

1092

return dbus.Boolean(bool(self.approvals_pending))

1093

1094

# ApprovedByDefault - property

1095

@dbus_service_property(_interface, signature="b",

1096

access="readwrite")

1097

def ApprovedByDefault_dbus_property(self, value=None):

1098

if value is None: # get

1099

return dbus.Boolean(self.approved_by_default)

1100

self.approved_by_default = bool(value)

1101

1102

# ApprovalDelay - property

1103

@dbus_service_property(_interface, signature="t",

1104

access="readwrite")

1105

def ApprovalDelay_dbus_property(self, value=None):

1106

if value is None: # get

1107

return dbus.UInt64(self.approval_delay_milliseconds())

1108

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1109

1110

# ApprovalDuration - property

1111

@dbus_service_property(_interface, signature="t",

1112

access="readwrite")

1113

def ApprovalDuration_dbus_property(self, value=None):

1114

if value is None: # get

1115

return dbus.UInt64(_timedelta_to_milliseconds(

1116

self.approval_duration))

1117

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1118

1119

# Name - property

1120

@dbus_service_property(_interface, signature="s", access="read")

1121

def Name_dbus_property(self):

897

# approved_pending - property

898

@dbus_service_property(_interface, signature=u"b", access=u"read")

899

def approved_pending_dbus_property(self):

900

return dbus.Boolean(self.approved_pending())

901

902

# approved_by_default - property

903

@dbus_service_property(_interface, signature=u"b",

904

access=u"readwrite")

905

def approved_by_default_dbus_property(self):

906

return dbus.Boolean(self.approved_by_default)

907

908

# approved_delay - property

909

@dbus_service_property(_interface, signature=u"t",

910

access=u"readwrite")

911

def approved_delay_dbus_property(self):

912

return dbus.UInt64(self.approved_delay_milliseconds())

913

914

# approved_duration - property

915

@dbus_service_property(_interface, signature=u"t",

916

access=u"readwrite")

917

def approved_duration_dbus_property(self):

918

return dbus.UInt64(self._timedelta_to_milliseconds(

919

self.approved_duration))

920

921

# name - property

922

@dbus_service_property(_interface, signature=u"s", access=u"read")

923

def name_dbus_property(self):

1122

924

return dbus.String(self.name)

1123

925

1124

# Fingerprint - property

1125

@dbus_service_property(_interface, signature="s", access="read")

1126

def Fingerprint_dbus_property(self):

926

# fingerprint - property

927

@dbus_service_property(_interface, signature=u"s", access=u"read")

928

def fingerprint_dbus_property(self):

1127

929

return dbus.String(self.fingerprint)

1128

930

1129

# Host - property

1130

@dbus_service_property(_interface, signature="s",

1131

access="readwrite")

1132

def Host_dbus_property(self, value=None):

931

# host - property

932

@dbus_service_property(_interface, signature=u"s",

933

access=u"readwrite")

934

def host_dbus_property(self, value=None):

1133

935

if value is None: # get

1134

936

return dbus.String(self.host)

1135

937

self.host = value

1136

1137

# Created - property

1138

@dbus_service_property(_interface, signature="s", access="read")

1139

def Created_dbus_property(self):

1140

return dbus.String(datetime_to_dbus(self.created))

1141

1142

# LastEnabled - property

1143

@dbus_service_property(_interface, signature="s", access="read")

1144

def LastEnabled_dbus_property(self):

1145

return datetime_to_dbus(self.last_enabled)

1146

1147

# Enabled - property

1148

@dbus_service_property(_interface, signature="b",

1149

access="readwrite")

1150

def Enabled_dbus_property(self, value=None):

938

# Emit D-Bus signal

939

self.PropertyChanged(dbus.String(u"host"),

940

dbus.String(value, variant_level=1))

941

942

# created - property

943

@dbus_service_property(_interface, signature=u"s", access=u"read")

944

def created_dbus_property(self):

945

return dbus.String(self._datetime_to_dbus(self.created))

946

947

# last_enabled - property

948

@dbus_service_property(_interface, signature=u"s", access=u"read")

949

def last_enabled_dbus_property(self):

950

if self.last_enabled is None:

951

return dbus.String(u"")

952

return dbus.String(self._datetime_to_dbus(self.last_enabled))

953

954

# enabled - property

955

@dbus_service_property(_interface, signature=u"b",

956

access=u"readwrite")

957

def enabled_dbus_property(self, value=None):

1151

958

if value is None: # get

1152

959

return dbus.Boolean(self.enabled)

1153

960

if value:

1155

962

else:

1156

963

self.disable()

1157

964

1158

# LastCheckedOK - property

1159

@dbus_service_property(_interface, signature="s",

1160

access="readwrite")

1161

def LastCheckedOK_dbus_property(self, value=None):

965

# last_checked_ok - property

966

@dbus_service_property(_interface, signature=u"s",

967

access=u"readwrite")

968

def last_checked_ok_dbus_property(self, value=None):

1162

969

if value is not None:

1163

970

self.checked_ok()

1164

971

return

1165

return datetime_to_dbus(self.last_checked_ok)

1166

1167

# Expires - property

1168

@dbus_service_property(_interface, signature="s", access="read")

1169

def Expires_dbus_property(self):

1170

return datetime_to_dbus(self.expires)

1171

1172

# LastApprovalRequest - property

1173

@dbus_service_property(_interface, signature="s", access="read")

1174

def LastApprovalRequest_dbus_property(self):

1175

return datetime_to_dbus(self.last_approval_request)

1176

1177

# Timeout - property

1178

@dbus_service_property(_interface, signature="t",

1179

access="readwrite")

1180

def Timeout_dbus_property(self, value=None):

972

if self.last_checked_ok is None:

973

return dbus.String(u"")

974

return dbus.String(self._datetime_to_dbus(self

975

.last_checked_ok))

976

977

# timeout - property

978

@dbus_service_property(_interface, signature=u"t",

979

access=u"readwrite")

980

def timeout_dbus_property(self, value=None):

1181

981

if value is None: # get

1182

982

return dbus.UInt64(self.timeout_milliseconds())

1183

983

self.timeout = datetime.timedelta(0, 0, 0, value)

1184

if getattr(self, "disable_initiator_tag", None) is None:

984

# Emit D-Bus signal

985

self.PropertyChanged(dbus.String(u"timeout"),

986

dbus.UInt64(value, variant_level=1))

987

if getattr(self, u"disable_initiator_tag", None) is None:

1185

988

return

1186

989

# Reschedule timeout

1187

990

gobject.source_remove(self.disable_initiator_tag)

1188

991

self.disable_initiator_tag = None

1189

self.expires = None

1190

992

time_to_die = (self.

1191

993

_timedelta_to_milliseconds((self

1192

994

.last_checked_ok

1197

999

# The timeout has passed

1198

1000

self.disable()

1199

1001

else:

1200

self.expires = (datetime.datetime.utcnow()

1201

+ datetime.timedelta(milliseconds =

1202

time_to_die))

1203

1002

self.disable_initiator_tag = (gobject.timeout_add

1204

1003

(time_to_die, self.disable))

1205

1004

1206

# ExtendedTimeout - property

1207

@dbus_service_property(_interface, signature="t",

1208

access="readwrite")

1209

def ExtendedTimeout_dbus_property(self, value=None):

1210

if value is None: # get

1211

return dbus.UInt64(self.extended_timeout_milliseconds())

1212

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1213

1214

# Interval - property

1215

@dbus_service_property(_interface, signature="t",

1216

access="readwrite")

1217

def Interval_dbus_property(self, value=None):

1005

# interval - property

1006

@dbus_service_property(_interface, signature=u"t",

1007

access=u"readwrite")

1008

def interval_dbus_property(self, value=None):

1218

1009

if value is None: # get

1219

1010

return dbus.UInt64(self.interval_milliseconds())

1220

1011

self.interval = datetime.timedelta(0, 0, 0, value)

1221

if getattr(self, "checker_initiator_tag", None) is None:

1012

# Emit D-Bus signal

1013

self.PropertyChanged(dbus.String(u"interval"),

1014

dbus.UInt64(value, variant_level=1))

1015

if getattr(self, u"checker_initiator_tag", None) is None:

1222

1016

return

1223

1017

# Reschedule checker run

1224

1018

gobject.source_remove(self.checker_initiator_tag)

1225

1019

self.checker_initiator_tag = (gobject.timeout_add

1226

1020

(value, self.start_checker))

1227

1021

self.start_checker() # Start one now, too

1228

1229

# Checker - property

1230

@dbus_service_property(_interface, signature="s",

1231

access="readwrite")

1232

def Checker_dbus_property(self, value=None):

1022

1023

# checker - property

1024

@dbus_service_property(_interface, signature=u"s",

1025

access=u"readwrite")

1026

def checker_dbus_property(self, value=None):

1233

1027

if value is None: # get

1234

1028

return dbus.String(self.checker_command)

1235

1029

self.checker_command = value

1030

# Emit D-Bus signal

1031

self.PropertyChanged(dbus.String(u"checker"),

1032

dbus.String(self.checker_command,

1033

variant_level=1))

1236

1034

1237

# CheckerRunning - property

1238

@dbus_service_property(_interface, signature="b",

1239

access="readwrite")

1240

def CheckerRunning_dbus_property(self, value=None):

1035

# checker_running - property

1036

@dbus_service_property(_interface, signature=u"b",

1037

access=u"readwrite")

1038

def checker_running_dbus_property(self, value=None):

1241

1039

if value is None: # get

1242

1040

return dbus.Boolean(self.checker is not None)

1243

1041

if value:

1245

1043

else:

1246

1044

self.stop_checker()

1247

1045

1248

# ObjectPath - property

1249

@dbus_service_property(_interface, signature="o", access="read")

1250

def ObjectPath_dbus_property(self):

1046

# object_path - property

1047

@dbus_service_property(_interface, signature=u"o", access=u"read")

1048

def object_path_dbus_property(self):

1251

1049

return self.dbus_object_path # is already a dbus.ObjectPath

1252

1050

1253

# Secret = property

1254

@dbus_service_property(_interface, signature="ay",

1255

access="write", byte_arrays=True)

1256

def Secret_dbus_property(self, value):

1051

# secret = property

1052

@dbus_service_property(_interface, signature=u"ay",

1053

access=u"write", byte_arrays=True)

1054

def secret_dbus_property(self, value):

1257

1055

self.secret = str(value)

1258

1056

1259

1057

del _interface

1265

1063

self._pipe.send(('init', fpr, address))

1266

1064

if not self._pipe.recv():

1267

1065

raise KeyError()

1268

1066

1269

1067

def __getattribute__(self, name):

1270

1068

if(name == '_pipe'):

1271

1069

return super(ProxyClient, self).__getattribute__(name)

1278

1076

self._pipe.send(('funcall', name, args, kwargs))

1279

1077

return self._pipe.recv()[1]

1280

1078

return func

1281

1079

1282

1080

def __setattr__(self, name, value):

1283

1081

if(name == '_pipe'):

1284

1082

return super(ProxyClient, self).__setattr__(name, value)

1285

1083

self._pipe.send(('setattr', name, value))

1286

1084

1287

class ClientDBusTransitional(ClientDBus):

1288

__metaclass__ = AlternateDBusNamesMetaclass

1289

1085

1290

1086

class ClientHandler(socketserver.BaseRequestHandler, object):

1291

1087

"""A class to handle client connections.

1295

1091

1296

1092

def handle(self):

1297

1093

with contextlib.closing(self.server.child_pipe) as child_pipe:

1298

logger.info("TCP connection from: %s",

1094

logger.info(u"TCP connection from: %s",

1299

1095

unicode(self.client_address))

1300

logger.debug("Pipe FD: %d",

1096

logger.debug(u"Pipe FD: %d",

1301

1097

self.server.child_pipe.fileno())

1302

1098

1303

1099

session = (gnutls.connection

1304

1100

.ClientSession(self.request,

1305

1101

gnutls.connection

1306

1102

.X509Credentials()))

1307

1103

1308

1104

# Note: gnutls.connection.X509Credentials is really a

1309

1105

# generic GnuTLS certificate credentials object so long as

1310

1106

# no X.509 keys are added to it. Therefore, we can use it

1311

1107

# here despite using OpenPGP certificates.

1312

1313

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1314

# "+AES-256-CBC", "+SHA1",

1315

# "+COMP-NULL", "+CTYPE-OPENPGP",

1316

# "+DHE-DSS"))

1108

1109

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1110

# u"+AES-256-CBC", u"+SHA1",

1111

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1112

# u"+DHE-DSS"))

1317

1113

# Use a fallback default, since this MUST be set.

1318

1114

priority = self.server.gnutls_priority

1319

1115

if priority is None:

1320

priority = "NORMAL"

1116

priority = u"NORMAL"

1321

1117

(gnutls.library.functions

1322

1118

.gnutls_priority_set_direct(session._c_object,

1323

1119

priority, None))

1324

1120

1325

1121

# Start communication using the Mandos protocol

1326

1122

# Get protocol number

1327

1123

line = self.request.makefile().readline()

1328

logger.debug("Protocol version: %r", line)

1124

logger.debug(u"Protocol version: %r", line)

1329

1125

try:

1330

1126

if int(line.strip().split()[0]) > 1:

1331

1127

raise RuntimeError

1332

except (ValueError, IndexError, RuntimeError) as error:

1333

logger.error("Unknown protocol version: %s", error)

1128

except (ValueError, IndexError, RuntimeError), error:

1129

logger.error(u"Unknown protocol version: %s", error)

1334

1130

return

1335

1131

1336

1132

# Start GnuTLS connection

1337

1133

try:

1338

1134

session.handshake()

1339

except gnutls.errors.GNUTLSError as error:

1340

logger.warning("Handshake failed: %s", error)

1135

except gnutls.errors.GNUTLSError, error:

1136

logger.warning(u"Handshake failed: %s", error)

1341

1137

# Do not run session.bye() here: the session is not

1342

1138

# established. Just abandon the request.

1343

1139

return

1344

logger.debug("Handshake succeeded")

1345

1140

logger.debug(u"Handshake succeeded")

1141

1346

1142

approval_required = False

1347

1143

try:

1348

1144

try:

1349

1145

fpr = self.fingerprint(self.peer_certificate

1350

1146

(session))

1351

except (TypeError,

1352

gnutls.errors.GNUTLSError) as error:

1353

logger.warning("Bad certificate: %s", error)

1147

except (TypeError, gnutls.errors.GNUTLSError), error:

1148

logger.warning(u"Bad certificate: %s", error)

1354

1149

return

1355

logger.debug("Fingerprint: %s", fpr)

1356

1150

logger.debug(u"Fingerprint: %s", fpr)

1151

1357

1152

try:

1358

1153

client = ProxyClient(child_pipe, fpr,

1359

1154

self.client_address)

1360

1155

except KeyError:

1361

1156

return

1362

1157

1363

if client.approval_delay:

1364

delay = client.approval_delay

1158

if client.approved_delay:

1159

delay = client.approved_delay

1365

1160

client.approvals_pending += 1

1366

1161

approval_required = True

1367

1162

1368

1163

while True:

1369

1164

if not client.enabled:

1370

logger.info("Client %s is disabled",

1165

logger.warning(u"Client %s is disabled",

1371

1166

client.name)

1372

1167

if self.server.use_dbus:

1373

1168

# Emit D-Bus signal

1374

client.Rejected("Disabled")

1169

client.Rejected("Disabled")

1375

1170

return

1376

1171

1377

if client._approved or not client.approval_delay:

1172

if client._approved or not client.approved_delay:

1378

1173

#We are approved or approval is disabled

1379

1174

break

1380

1175

elif client._approved is None:

1381

logger.info("Client %s needs approval",

1176

logger.info(u"Client %s need approval",

1382

1177

client.name)

1383

1178

if self.server.use_dbus:

1384

1179

# Emit D-Bus signal

1385

1180

client.NeedApproval(

1386

client.approval_delay_milliseconds(),

1181

client.approved_delay_milliseconds(),

1387

1182

client.approved_by_default)

1388

1183

else:

1389

logger.warning("Client %s was not approved",

1184

logger.warning(u"Client %s was not approved",

1390

1185

client.name)

1391

1186

if self.server.use_dbus:

1392

1187

# Emit D-Bus signal

1393

client.Rejected("Denied")

1188

client.Rejected("Disapproved")

1394

1189

return

1395

1190

1396

1191

#wait until timeout or approved

1397

#x = float(client

1398

# ._timedelta_to_milliseconds(delay))

1192

#x = float(client._timedelta_to_milliseconds(delay))

1399

1193

time = datetime.datetime.now()

1400

1194

client.changedstate.acquire()

1401

(client.changedstate.wait

1402

(float(client._timedelta_to_milliseconds(delay)

1403

/ 1000)))

1195

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1404

1196

client.changedstate.release()

1405

1197

time2 = datetime.datetime.now()

1406

1198

if (time2 - time) >= delay:

1410

1202

client.name)

1411

1203

if self.server.use_dbus:

1412

1204

# Emit D-Bus signal

1413

client.Rejected("Approval timed out")

1205

client.Rejected("Time out")

1414

1206

return

1415

1207

else:

1416

1208

break

1419

1211

1420

1212

sent_size = 0

1421

1213

while sent_size < len(client.secret):

1422

try:

1423

sent = session.send(client.secret[sent_size:])

1424

except gnutls.errors.GNUTLSError as error:

1425

logger.warning("gnutls send failed")

1426

return

1427

logger.debug("Sent: %d, remaining: %d",

1214

# XXX handle session exception

1215

sent = session.send(client.secret[sent_size:])

1216

logger.debug(u"Sent: %d, remaining: %d",

1428

1217

sent, len(client.secret)

1429

1218

- (sent_size + sent))

1430

1219

sent_size += sent

1431

1432

logger.info("Sending secret to %s", client.name)

1220

1221

logger.info(u"Sending secret to %s", client.name)

1433

1222

# bump the timeout as if seen

1434

client.checked_ok(client.extended_timeout)

1223

client.checked_ok()

1435

1224

if self.server.use_dbus:

1436

1225

# Emit D-Bus signal

1437

1226

client.GotSecret()

1439

1228

finally:

1440

1229

if approval_required:

1441

1230

client.approvals_pending -= 1

1442

try:

1443

session.bye()

1444

except gnutls.errors.GNUTLSError as error:

1445

logger.warning("GnuTLS bye failed")

1231

session.bye()

1446

1232

1447

1233

@staticmethod

1448

1234

def peer_certificate(session):

1458

1244

.gnutls_certificate_get_peers

1459

1245

(session._c_object, ctypes.byref(list_size)))

1460

1246

if not bool(cert_list) and list_size.value != 0:

1461

raise gnutls.errors.GNUTLSError("error getting peer"

1462

" certificate")

1247

raise gnutls.errors.GNUTLSError(u"error getting peer"

1248

u" certificate")

1463

1249

if list_size.value == 0:

1464

1250

return None

1465

1251

cert = cert_list[0]

1491

1277

if crtverify.value != 0:

1492

1278

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1493

1279

raise (gnutls.errors.CertificateSecurityError

1494

("Verify failed"))

1280

(u"Verify failed"))

1495

1281

# New buffer for the fingerprint

1496

1282

buf = ctypes.create_string_buffer(20)

1497

1283

buf_len = ctypes.c_size_t()

1504

1290

# Convert the buffer to a Python bytestring

1505

1291

fpr = ctypes.string_at(buf, buf_len.value)

1506

1292

# Convert the bytestring to hexadecimal notation

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1293

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1508

1294

return hex_fpr

1509

1295

1510

1296

1522

1308

multiprocessing.Process(target = self.sub_process_main,

1523

1309

args = (request, address)).start()

1524

1310

1525

1526

1311

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1527

1312

""" adds a pipe to the MixIn """

1528

1313

def process_request(self, request, client_address):

1531

1316

This function creates a new pipe in self.pipe

1532

1317

"""

1533

1318

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1534

1319

1535

1320

super(MultiprocessingMixInWithPipe,

1536

1321

self).process_request(request, client_address)

1537

1322

self.child_pipe.close()

1538

1323

self.add_pipe(parent_pipe)

1539

1324

1540

1325

def add_pipe(self, parent_pipe):

1541

1326

"""Dummy function; override as necessary"""

1542

raise NotImplementedError

1543

1327

pass

1544

1328

1545

1329

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1546

1330

socketserver.TCPServer, object):

1564

1348

bind to an address or port if they were not specified."""

1565

1349

if self.interface is not None:

1566

1350

if SO_BINDTODEVICE is None:

1567

logger.error("SO_BINDTODEVICE does not exist;"

1568

" cannot bind to interface %s",

1351

logger.error(u"SO_BINDTODEVICE does not exist;"

1352

u" cannot bind to interface %s",

1569

1353

self.interface)

1570

1354

else:

1571

1355

try:

1572

1356

self.socket.setsockopt(socket.SOL_SOCKET,

1573

1357

SO_BINDTODEVICE,

1574

1358

str(self.interface

1575

+ '\0'))

1576

except socket.error as error:

1359

+ u'\0'))

1360

except socket.error, error:

1577

1361

if error[0] == errno.EPERM:

1578

logger.error("No permission to"

1579

" bind to interface %s",

1362

logger.error(u"No permission to"

1363

u" bind to interface %s",

1580

1364

self.interface)

1581

1365

elif error[0] == errno.ENOPROTOOPT:

1582

logger.error("SO_BINDTODEVICE not available;"

1583

" cannot bind to interface %s",

1366

logger.error(u"SO_BINDTODEVICE not available;"

1367

u" cannot bind to interface %s",

1584

1368

self.interface)

1585

1369

else:

1586

1370

raise

1588

1372

if self.server_address[0] or self.server_address[1]:

1589

1373

if not self.server_address[0]:

1590

1374

if self.address_family == socket.AF_INET6:

1591

any_address = "::" # in6addr_any

1375

any_address = u"::" # in6addr_any

1592

1376

else:

1593

1377

any_address = socket.INADDR_ANY

1594

1378

self.server_address = (any_address,

1638

1422

gobject.io_add_watch(parent_pipe.fileno(),

1639

1423

gobject.IO_IN | gobject.IO_HUP,

1640

1424

functools.partial(self.handle_ipc,

1641

parent_pipe =

1642

parent_pipe))

1425

parent_pipe = parent_pipe))

1643

1426

1644

1427

def handle_ipc(self, source, condition, parent_pipe=None,

1645

1428

client_object=None):

1646

1429

condition_names = {

1647

gobject.IO_IN: "IN", # There is data to read.

1648

gobject.IO_OUT: "OUT", # Data can be written (without

1430

gobject.IO_IN: u"IN", # There is data to read.

1431

gobject.IO_OUT: u"OUT", # Data can be written (without

1649

1432

# blocking).

1650

gobject.IO_PRI: "PRI", # There is urgent data to read.

1651

gobject.IO_ERR: "ERR", # Error condition.

1652

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1433

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1434

gobject.IO_ERR: u"ERR", # Error condition.

1435

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1653

1436

# broken, usually for pipes and

1654

1437

# sockets).

1655

1438

}

1657

1440

for cond, name in

1658

1441

condition_names.iteritems()

1659

1442

if cond & condition)

1443

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1444

conditions_string)

1445

1660

1446

# error or the other end of multiprocessing.Pipe has closed

1661

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1447

if condition & gobject.IO_HUP or condition & gobject.IO_ERR:

1662

1448

return False

1663

1449

1664

1450

# Read a request from the child

1665

1451

request = parent_pipe.recv()

1452

logger.debug(u"IPC request: %s", repr(request))

1666

1453

command = request[0]

1667

1454

1668

1455

if command == 'init':

1674

1461

client = c

1675

1462

break

1676

1463

else:

1677

logger.info("Client not found for fingerprint: %s, ad"

1678

"dress: %s", fpr, address)

1464

logger.warning(u"Client not found for fingerprint: %s, ad"

1465

u"dress: %s", fpr, address)

1679

1466

if self.use_dbus:

1680

1467

# Emit D-Bus signal

1681

mandos_dbus_service.ClientNotFound(fpr,

1682

address[0])

1468

mandos_dbus_service.ClientNotFound(fpr, address)

1683

1469

parent_pipe.send(False)

1684

1470

return False

1685

1471

1686

1472

gobject.io_add_watch(parent_pipe.fileno(),

1687

1473

gobject.IO_IN | gobject.IO_HUP,

1688

1474

functools.partial(self.handle_ipc,

1689

parent_pipe =

1690

parent_pipe,

1691

client_object =

1692

client))

1475

parent_pipe = parent_pipe,

1476

client_object = client))

1693

1477

parent_pipe.send(True)

1694

# remove the old hook in favor of the new above hook on

1695

# same fileno

1478

# remove the old hook in favor of the new above hook on same fileno

1696

1479

return False

1697

1480

if command == 'funcall':

1698

1481

funcname = request[1]

1699

1482

args = request[2]

1700

1483

kwargs = request[3]

1701

1484

1702

parent_pipe.send(('data', getattr(client_object,

1703

funcname)(*args,

1704

**kwargs)))

1705

1485

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1486

1706

1487

if command == 'getattr':

1707

1488

attrname = request[1]

1708

1489

if callable(client_object.__getattribute__(attrname)):

1709

1490

parent_pipe.send(('function',))

1710

1491

else:

1711

parent_pipe.send(('data', client_object

1712

.__getattribute__(attrname)))

1713

1492

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1493

1714

1494

if command == 'setattr':

1715

1495

attrname = request[1]

1716

1496

value = request[2]

1717

1497

setattr(client_object, attrname, value)

1718

1498

1719

1499

return True

1720

1500

1721

1501

1722

1502

def string_to_delta(interval):

1723

1503

"""Parse a string and return a datetime.timedelta

1724

1504

1725

>>> string_to_delta('7d')

1505

>>> string_to_delta(u'7d')

1726

1506

datetime.timedelta(7)

1727

>>> string_to_delta('60s')

1507

>>> string_to_delta(u'60s')

1728

1508

datetime.timedelta(0, 60)

1729

>>> string_to_delta('60m')

1509

>>> string_to_delta(u'60m')

1730

1510

datetime.timedelta(0, 3600)

1731

>>> string_to_delta('24h')

1511

>>> string_to_delta(u'24h')

1732

1512

datetime.timedelta(1)

1733

>>> string_to_delta('1w')

1513

>>> string_to_delta(u'1w')

1734

1514

datetime.timedelta(7)

1735

>>> string_to_delta('5m 30s')

1515

>>> string_to_delta(u'5m 30s')

1736

1516

datetime.timedelta(0, 330)

1737

1517

"""

1738

1518

timevalue = datetime.timedelta(0)

1740

1520

try:

1741

1521

suffix = unicode(s[-1])

1742

1522

value = int(s[:-1])

1743

if suffix == "d":

1523

if suffix == u"d":

1744

1524

delta = datetime.timedelta(value)

1745

elif suffix == "s":

1525

elif suffix == u"s":

1746

1526

delta = datetime.timedelta(0, value)

1747

elif suffix == "m":

1527

elif suffix == u"m":

1748

1528

delta = datetime.timedelta(0, 0, 0, 0, value)

1749

elif suffix == "h":

1529

elif suffix == u"h":

1750

1530

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1751

elif suffix == "w":

1531

elif suffix == u"w":

1752

1532

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1753

1533

else:

1754

raise ValueError("Unknown suffix %r" % suffix)

1755

except (ValueError, IndexError) as e:

1756

raise ValueError(*(e.args))

1534

raise ValueError(u"Unknown suffix %r" % suffix)

1535

except (ValueError, IndexError), e:

1536

raise ValueError(e.message)

1757

1537

timevalue += delta

1758

1538

return timevalue

1759

1539

1765

1545

global if_nametoindex

1766

1546

try:

1767

1547

if_nametoindex = (ctypes.cdll.LoadLibrary

1768

(ctypes.util.find_library("c"))

1548

(ctypes.util.find_library(u"c"))

1769

1549

.if_nametoindex)

1770

1550

except (OSError, AttributeError):

1771

logger.warning("Doing if_nametoindex the hard way")

1551

logger.warning(u"Doing if_nametoindex the hard way")

1772

1552

def if_nametoindex(interface):

1773

1553

"Get an interface index the hard way, i.e. using fcntl()"

1774

1554

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1775

1555

with contextlib.closing(socket.socket()) as s:

1776

1556

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1777

struct.pack(str("16s16x"),

1557

struct.pack(str(u"16s16x"),

1778

1558

interface))

1779

interface_index = struct.unpack(str("I"),

1559

interface_index = struct.unpack(str(u"I"),

1780

1560

ifreq[16:20])[0]

1781

1561

return interface_index

1782

1562

return if_nametoindex(interface)

1790

1570

sys.exit()

1791

1571

os.setsid()

1792

1572

if not nochdir:

1793

os.chdir("/")

1573

os.chdir(u"/")

1794

1574

if os.fork():

1795

1575

sys.exit()

1796

1576

if not noclose:

1798

1578

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1799

1579

if not stat.S_ISCHR(os.fstat(null).st_mode):

1800

1580

raise OSError(errno.ENODEV,

1801

"%s not a character device"

1581

u"%s not a character device"

1802

1582

% os.path.devnull)

1803

1583

os.dup2(null, sys.stdin.fileno())

1804

1584

os.dup2(null, sys.stdout.fileno())

1812

1592

##################################################################

1813

1593

# Parsing of options, both command line and config file

1814

1594

1815

parser = argparse.ArgumentParser()

1816

parser.add_argument("-v", "--version", action="version",

1817

version = "%%(prog)s %s" % version,

1818

help="show version number and exit")

1819

parser.add_argument("-i", "--interface", metavar="IF",

1820

help="Bind to interface IF")

1821

parser.add_argument("-a", "--address",

1822

help="Address to listen for requests on")

1823

parser.add_argument("-p", "--port", type=int,

1824

help="Port number to receive requests on")

1825

parser.add_argument("--check", action="store_true",

1826

help="Run self-test")

1827

parser.add_argument("--debug", action="store_true",

1828

help="Debug mode; run in foreground and log"

1829

" to terminal")

1830

parser.add_argument("--debuglevel", metavar="LEVEL",

1831

help="Debug level for stdout output")

1832

parser.add_argument("--priority", help="GnuTLS"

1833

" priority string (see GnuTLS documentation)")

1834

parser.add_argument("--servicename",

1835

metavar="NAME", help="Zeroconf service name")

1836

parser.add_argument("--configdir",

1837

default="/etc/mandos", metavar="DIR",

1838

help="Directory to search for configuration"

1839

" files")

1840

parser.add_argument("--no-dbus", action="store_false",

1841

dest="use_dbus", help="Do not provide D-Bus"

1842

" system bus interface")

1843

parser.add_argument("--no-ipv6", action="store_false",

1844

dest="use_ipv6", help="Do not use IPv6")

1845

options = parser.parse_args()

1595

parser = optparse.OptionParser(version = "%%prog %s" % version)

1596

parser.add_option("-i", u"--interface", type=u"string",

1597

metavar="IF", help=u"Bind to interface IF")

1598

parser.add_option("-a", u"--address", type=u"string",

1599

help=u"Address to listen for requests on")

1600

parser.add_option("-p", u"--port", type=u"int",

1601

help=u"Port number to receive requests on")

1602

parser.add_option("--check", action=u"store_true",

1603

help=u"Run self-test")

1604

parser.add_option("--debug", action=u"store_true",

1605

help=u"Debug mode; run in foreground and log to"

1606

u" terminal")

1607

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1608

u" priority string (see GnuTLS documentation)")

1609

parser.add_option("--servicename", type=u"string",

1610

metavar=u"NAME", help=u"Zeroconf service name")

1611

parser.add_option("--configdir", type=u"string",

1612

default=u"/etc/mandos", metavar=u"DIR",

1613

help=u"Directory to search for configuration"

1614

u" files")

1615

parser.add_option("--no-dbus", action=u"store_false",

1616

dest=u"use_dbus", help=u"Do not provide D-Bus"

1617

u" system bus interface")

1618

parser.add_option("--no-ipv6", action=u"store_false",

1619

dest=u"use_ipv6", help=u"Do not use IPv6")

1620

options = parser.parse_args()[0]

1846

1621

1847

1622

if options.check:

1848

1623

import doctest

1850

1625

sys.exit()

1851

1626

1852

1627

# Default values for config file for server-global settings

1853

server_defaults = { "interface": "",

1854

"address": "",

1855

"port": "",

1856

"debug": "False",

1857

"priority":

1858

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1859

"servicename": "Mandos",

1860

"use_dbus": "True",

1861

"use_ipv6": "True",

1862

"debuglevel": "",

1628

server_defaults = { u"interface": u"",

1629

u"address": u"",

1630

u"port": u"",

1631

u"debug": u"False",

1632

u"priority":

1633

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1634

u"servicename": u"Mandos",

1635

u"use_dbus": u"True",

1636

u"use_ipv6": u"True",

1863

1637

}

1864

1638

1865

1639

# Parse config file for server-global settings

1866

1640

server_config = configparser.SafeConfigParser(server_defaults)

1867

1641

del server_defaults

1868

1642

server_config.read(os.path.join(options.configdir,

1869

"mandos.conf"))

1643

u"mandos.conf"))

1870

1644

# Convert the SafeConfigParser object to a dict

1871

1645

server_settings = server_config.defaults()

1872

1646

# Use the appropriate methods on the non-string config options

1873

for option in ("debug", "use_dbus", "use_ipv6"):

1874

server_settings[option] = server_config.getboolean("DEFAULT",

1647

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1648

server_settings[option] = server_config.getboolean(u"DEFAULT",

1875

1649

option)

1876

1650

if server_settings["port"]:

1877

server_settings["port"] = server_config.getint("DEFAULT",

1878

"port")

1651

server_settings["port"] = server_config.getint(u"DEFAULT",

1652

u"port")

1879

1653

del server_config

1880

1654

1881

1655

# Override the settings from the config file with command line

1882

1656

# options, if set.

1883

for option in ("interface", "address", "port", "debug",

1884

"priority", "servicename", "configdir",

1885

"use_dbus", "use_ipv6", "debuglevel"):

1657

for option in (u"interface", u"address", u"port", u"debug",

1658

u"priority", u"servicename", u"configdir",

1659

u"use_dbus", u"use_ipv6"):

1886

1660

value = getattr(options, option)

1887

1661

if value is not None:

1888

1662

server_settings[option] = value

1896

1670

##################################################################

1897

1671

1898

1672

# For convenience

1899

debug = server_settings["debug"]

1900

debuglevel = server_settings["debuglevel"]

1901

use_dbus = server_settings["use_dbus"]

1902

use_ipv6 = server_settings["use_ipv6"]

1903

1904

if server_settings["servicename"] != "Mandos":

1673

debug = server_settings[u"debug"]

1674

use_dbus = server_settings[u"use_dbus"]

1675

use_ipv6 = server_settings[u"use_ipv6"]

1676

1677

if not debug:

1678

syslogger.setLevel(logging.WARNING)

1679

console.setLevel(logging.WARNING)

1680

1681

if server_settings[u"servicename"] != u"Mandos":

1905

1682

syslogger.setFormatter(logging.Formatter

1906

('Mandos (%s) [%%(process)d]:'

1907

' %%(levelname)s: %%(message)s'

1908

% server_settings["servicename"]))

1683

(u'Mandos (%s) [%%(process)d]:'

1684

u' %%(levelname)s: %%(message)s'

1685

% server_settings[u"servicename"]))

1909

1686

1910

1687

# Parse config file with clients

1911

client_defaults = { "timeout": "5m",

1912

"extended_timeout": "15m",

1913

"interval": "2m",

1914

"checker": "fping -q -- %%(host)s",

1915

"host": "",

1916

"approval_delay": "0s",

1917

"approval_duration": "1s",

1688

client_defaults = { u"timeout": u"1h",

1689

u"interval": u"5m",

1690

u"checker": u"fping -q -- %%(host)s",

1691

u"host": u"",

1692

u"approved_delay": u"5m",

1693

u"approved_duration": u"1s",

1918

1694

}

1919

1695

client_config = configparser.SafeConfigParser(client_defaults)

1920

client_config.read(os.path.join(server_settings["configdir"],

1921

"clients.conf"))

1696

client_config.read(os.path.join(server_settings[u"configdir"],

1697

u"clients.conf"))

1922

1698

1923

1699

global mandos_dbus_service

1924

1700

mandos_dbus_service = None

1925

1701

1926

tcp_server = MandosServer((server_settings["address"],

1927

server_settings["port"]),

1702

tcp_server = MandosServer((server_settings[u"address"],

1703

server_settings[u"port"]),

1928

1704

ClientHandler,

1929

interface=(server_settings["interface"]

1930

or None),

1705

interface=server_settings[u"interface"],

1931

1706

use_ipv6=use_ipv6,

1932

1707

gnutls_priority=

1933

server_settings["priority"],

1708

server_settings[u"priority"],

1934

1709

use_dbus=use_dbus)

1935

if not debug:

1936

pidfilename = "/var/run/mandos.pid"

1937

try:

1938

pidfile = open(pidfilename, "w")

1939

except IOError:

1940

logger.error("Could not open file %r", pidfilename)

1710

pidfilename = u"/var/run/mandos.pid"

1711

try:

1712

pidfile = open(pidfilename, u"w")

1713

except IOError:

1714

logger.error(u"Could not open file %r", pidfilename)

1941

1715

1942

1716

try:

1943

uid = pwd.getpwnam("_mandos").pw_uid

1944

gid = pwd.getpwnam("_mandos").pw_gid

1717

uid = pwd.getpwnam(u"_mandos").pw_uid

1718

gid = pwd.getpwnam(u"_mandos").pw_gid

1945

1719

except KeyError:

1946

1720

try:

1947

uid = pwd.getpwnam("mandos").pw_uid

1948

gid = pwd.getpwnam("mandos").pw_gid

1721

uid = pwd.getpwnam(u"mandos").pw_uid

1722

gid = pwd.getpwnam(u"mandos").pw_gid

1949

1723

except KeyError:

1950

1724

try:

1951

uid = pwd.getpwnam("nobody").pw_uid

1952

gid = pwd.getpwnam("nobody").pw_gid

1725

uid = pwd.getpwnam(u"nobody").pw_uid

1726

gid = pwd.getpwnam(u"nobody").pw_gid

1953

1727

except KeyError:

1954

1728

uid = 65534

1955

1729

gid = 65534

1956

1730

try:

1957

1731

os.setgid(gid)

1958

1732

os.setuid(uid)

1959

except OSError as error:

1733

except OSError, error:

1960

1734

if error[0] != errno.EPERM:

1961

1735

raise error

1962

1736

1963

if not debug and not debuglevel:

1964

syslogger.setLevel(logging.WARNING)

1965

console.setLevel(logging.WARNING)

1966

if debuglevel:

1967

level = getattr(logging, debuglevel.upper())

1968

syslogger.setLevel(level)

1969

console.setLevel(level)

1970

1737

# Enable all possible GnuTLS debugging

1971

1738

if debug:

1972

# Enable all possible GnuTLS debugging

1973

1974

1739

# "Use a log level over 10 to enable all debugging options."

1975

1740

# - GnuTLS manual

1976

1741

gnutls.library.functions.gnutls_global_set_log_level(11)

1977

1742

1978

1743

@gnutls.library.types.gnutls_log_func

1979

1744

def debug_gnutls(level, string):

1980

logger.debug("GnuTLS: %s", string[:-1])

1745

logger.debug(u"GnuTLS: %s", string[:-1])

1981

1746

1982

1747

(gnutls.library.functions

1983

1748

.gnutls_global_set_log_function(debug_gnutls))

1984

1985

# Redirect stdin so all checkers get /dev/null

1986

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1987

os.dup2(null, sys.stdin.fileno())

1988

if null > 2:

1989

os.close(null)

1990

else:

1991

# No console logging

1992

logger.removeHandler(console)

1993

1994

# Need to fork before connecting to D-Bus

1995

if not debug:

1996

# Close all input and output, do double fork, etc.

1997

daemon()

1998

1749

1999

1750

global main_loop

2000

1751

# From the Avahi example code

2004

1755

# End of Avahi example code

2005

1756

if use_dbus:

2006

1757

try:

2007

bus_name = dbus.service.BusName("se.recompile.Mandos",

1758

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2008

1759

bus, do_not_queue=True)

2009

old_bus_name = (dbus.service.BusName

2010

("se.bsnet.fukt.Mandos", bus,

2011

do_not_queue=True))

2012

except dbus.exceptions.NameExistsException as e:

2013

logger.error(unicode(e) + ", disabling D-Bus")

1760

except dbus.exceptions.NameExistsException, e:

1761

logger.error(unicode(e) + u", disabling D-Bus")

2014

1762

use_dbus = False

2015

server_settings["use_dbus"] = False

1763

server_settings[u"use_dbus"] = False

2016

1764

tcp_server.use_dbus = False

2017

1765

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2018

service = AvahiService(name = server_settings["servicename"],

2019

servicetype = "_mandos._tcp",

1766

service = AvahiService(name = server_settings[u"servicename"],

1767

servicetype = u"_mandos._tcp",

2020

1768

protocol = protocol, bus = bus)

2021

1769

if server_settings["interface"]:

2022

1770

service.interface = (if_nametoindex

2023

(str(server_settings["interface"])))

2024

1771

(str(server_settings[u"interface"])))

1772

2025

1773

global multiprocessing_manager

2026

1774

multiprocessing_manager = multiprocessing.Manager()

2027

1775

2028

1776

client_class = Client

2029

1777

if use_dbus:

2030

client_class = functools.partial(ClientDBusTransitional,

2031

bus = bus)

1778

client_class = functools.partial(ClientDBus, bus = bus)

2032

1779

def client_config_items(config, section):

2033

1780

special_settings = {

2034

1781

"approved_by_default":

2047

1794

client_config, section)))

2048

1795

for section in client_config.sections()))

2049

1796

if not tcp_server.clients:

2050

logger.warning("No clients defined")

2051

1797

logger.warning(u"No clients defined")

1798

1799

if debug:

1800

# Redirect stdin so all checkers get /dev/null

1801

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1802

os.dup2(null, sys.stdin.fileno())

1803

if null > 2:

1804

os.close(null)

1805

else:

1806

# No console logging

1807

logger.removeHandler(console)

1808

# Close all input and output, do double fork, etc.

1809

daemon()

1810

1811

try:

1812

with pidfile:

1813

pid = os.getpid()

1814

pidfile.write(str(pid) + "\n")

1815

del pidfile

1816

except IOError:

1817

logger.error(u"Could not write to file %r with PID %d",

1818

pidfilename, pid)

1819

except NameError:

1820

# "pidfile" was never created

1821

pass

1822

del pidfilename

1823

2052

1824

if not debug:

2053

try:

2054

with pidfile:

2055

pid = os.getpid()

2056

pidfile.write(str(pid) + "\n".encode("utf-8"))

2057

del pidfile

2058

except IOError:

2059

logger.error("Could not write to file %r with PID %d",

2060

pidfilename, pid)

2061

except NameError:

2062

# "pidfile" was never created

2063

pass

2064

del pidfilename

2065

2066

1825

signal.signal(signal.SIGINT, signal.SIG_IGN)

2067

2068

1826

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2069

1827

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2070

1828

2072

1830

class MandosDBusService(dbus.service.Object):

2073

1831

"""A D-Bus proxy object"""

2074

1832

def __init__(self):

2075

dbus.service.Object.__init__(self, bus, "/")

2076

_interface = "se.recompile.Mandos"

1833

dbus.service.Object.__init__(self, bus, u"/")

1834

_interface = u"se.bsnet.fukt.Mandos"

2077

1835

2078

@dbus.service.signal(_interface, signature="o")

1836

@dbus.service.signal(_interface, signature=u"o")

2079

1837

def ClientAdded(self, objpath):

2080

1838

"D-Bus signal"

2081

1839

pass

2082

1840

2083

@dbus.service.signal(_interface, signature="ss")

1841

@dbus.service.signal(_interface, signature=u"ss")

2084

1842

def ClientNotFound(self, fingerprint, address):

2085

1843

"D-Bus signal"

2086

1844

pass

2087

1845

2088

@dbus.service.signal(_interface, signature="os")

1846

@dbus.service.signal(_interface, signature=u"os")

2089

1847

def ClientRemoved(self, objpath, name):

2090

1848

"D-Bus signal"

2091

1849

pass

2092

1850

2093

@dbus.service.method(_interface, out_signature="ao")

1851

@dbus.service.method(_interface, out_signature=u"ao")

2094

1852

def GetAllClients(self):

2095

1853

"D-Bus method"

2096

1854

return dbus.Array(c.dbus_object_path

2097

1855

for c in tcp_server.clients)

2098

1856

2099

1857

@dbus.service.method(_interface,

2100

out_signature="a{oa{sv}}")

1858

out_signature=u"a{oa{sv}}")

2101

1859

def GetAllClientsWithProperties(self):

2102

1860

"D-Bus method"

2103

1861

return dbus.Dictionary(

2104

((c.dbus_object_path, c.GetAll(""))

1862

((c.dbus_object_path, c.GetAll(u""))

2105

1863

for c in tcp_server.clients),

2106

signature="oa{sv}")

1864

signature=u"oa{sv}")

2107

1865

2108

@dbus.service.method(_interface, in_signature="o")

1866

@dbus.service.method(_interface, in_signature=u"o")

2109

1867

def RemoveClient(self, object_path):

2110

1868

"D-Bus method"

2111

1869

for c in tcp_server.clients:

2121

1879

2122

1880

del _interface

2123

1881

2124

class MandosDBusServiceTransitional(MandosDBusService):

2125

__metaclass__ = AlternateDBusNamesMetaclass

2126

mandos_dbus_service = MandosDBusServiceTransitional()

1882

mandos_dbus_service = MandosDBusService()

2127

1883

2128

1884

def cleanup():

2129

1885

"Cleanup function; run on exit"

2138

1894

client.disable(quiet=True)

2139

1895

if use_dbus:

2140

1896

# Emit D-Bus signal

2141

mandos_dbus_service.ClientRemoved(client

2142

.dbus_object_path,

1897

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2143

1898

client.name)

2144

1899

2145

1900

atexit.register(cleanup)

2156

1911

# Find out what port we got

2157

1912

service.port = tcp_server.socket.getsockname()[1]

2158

1913

if use_ipv6:

2159

logger.info("Now listening on address %r, port %d,"

1914

logger.info(u"Now listening on address %r, port %d,"

2160

1915

" flowinfo %d, scope_id %d"

2161

1916

% tcp_server.socket.getsockname())

2162

1917

else: # IPv4

2163

logger.info("Now listening on address %r, port %d"

1918

logger.info(u"Now listening on address %r, port %d"

2164

1919

% tcp_server.socket.getsockname())

2165

1920

2166

1921

#service.interface = tcp_server.socket.getsockname()[3]

2169

1924

# From the Avahi example code

2170

1925

try:

2171

1926

service.activate()

2172

except dbus.exceptions.DBusException as error:

2173

logger.critical("DBusException: %s", error)

1927

except dbus.exceptions.DBusException, error:

1928

logger.critical(u"DBusException: %s", error)

2174

1929

cleanup()

2175

1930

sys.exit(1)

2176

1931

# End of Avahi example code

2180

1935

(tcp_server.handle_request

2181

1936

(*args[2:], **kwargs) or True))

2182

1937

2183

logger.debug("Starting main loop")

1938

logger.debug(u"Starting main loop")

2184

1939

main_loop.run()

2185

except AvahiError as error:

2186

logger.critical("AvahiError: %s", error)

1940

except AvahiError, error:

1941

logger.critical(u"AvahiError: %s", error)

2187

1942

cleanup()

2188

1943

sys.exit(1)

2189

1944

except KeyboardInterrupt:

2190

1945

if debug:

2191

print("", file=sys.stderr)

2192

logger.debug("Server received KeyboardInterrupt")

2193

logger.debug("Server exiting")

1946

print >> sys.stderr

1947

logger.debug(u"Server received KeyboardInterrupt")

1948

logger.debug(u"Server exiting")

2194

1949

# Must run before the D-Bus bus name gets deregistered

2195

1950

cleanup()

2196

1951

2197

2198

1952

if __name__ == '__main__':

2199

1953

main()