/mandos/release : revision 24.1.157

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

62

61

import functools

63

62

import cPickle as pickle

64

63

import multiprocessing

65

import types

66

64

67

65

import dbus

68

66

import dbus.service

83

81

SO_BINDTODEVICE = None

84

82

85

83

86

version = "1.3.1"

84

version = "1.0.14"

87

85

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

90

88

syslogger = (logging.handlers.SysLogHandler

91

89

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

address = str("/dev/log")))

90

address = "/dev/log"))

93

91

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

96

94

logger.addHandler(syslogger)

97

95

98

96

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

102

100

logger.addHandler(console)

103

101

104

102

class AvahiError(Exception):

121

119

Attributes:

122

120

interface: integer; avahi.IF_UNSPEC or an interface index.

123

121

Used to optionally bind to the specified interface.

124

125

type: string; Example: '_mandos._tcp'.

122

123

type: string; Example: u'_mandos._tcp'.

126

124

See <http://www.dns-sd.org/ServiceTypes.html>

127

125

port: integer; what port to announce

128

126

TXT: list of strings; TXT record for the service

137

135

"""

138

136

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

139

137

servicetype = None, port = None, TXT = None,

140

domain = "", host = "", max_renames = 32768,

138

domain = u"", host = u"", max_renames = 32768,

141

139

protocol = avahi.PROTO_UNSPEC, bus = None):

142

140

self.interface = interface

143

141

self.name = name

152

150

self.group = None # our entry group

153

151

self.server = None

154

152

self.bus = bus

155

self.entry_group_state_changed_match = None

156

153

def rename(self):

157

154

"""Derived from the Avahi example code"""

158

155

if self.rename_count >= self.max_renames:

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

161

158

self.rename_count)

162

raise AvahiServiceError("Too many renames")

159

raise AvahiServiceError(u"Too many renames")

163

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

164

logger.info("Changing Zeroconf service name to %r ...",

161

logger.info(u"Changing Zeroconf service name to %r ...",

165

162

self.name)

166

163

syslogger.setFormatter(logging.Formatter

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

169

166

% self.name))

170

167

self.remove()

171

try:

172

self.add()

173

except dbus.exceptions.DBusException as error:

174

logger.critical("DBusException: %s", error)

175

self.cleanup()

176

os._exit(1)

168

self.add()

177

169

self.rename_count += 1

178

170

def remove(self):

179

171

"""Derived from the Avahi example code"""

180

if self.entry_group_state_changed_match is not None:

181

self.entry_group_state_changed_match.remove()

182

self.entry_group_state_changed_match = None

183

172

if self.group is not None:

184

173

self.group.Reset()

185

174

def add(self):

186

175

"""Derived from the Avahi example code"""

187

self.remove()

188

176

if self.group is None:

189

177

self.group = dbus.Interface(

190

178

self.bus.get_object(avahi.DBUS_NAME,

191

179

self.server.EntryGroupNew()),

192

180

avahi.DBUS_INTERFACE_ENTRY_GROUP)

193

self.entry_group_state_changed_match = (

194

self.group.connect_to_signal(

195

'StateChanged', self .entry_group_state_changed))

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

181

self.group.connect_to_signal('StateChanged',

182

self

183

.entry_group_state_changed)

184

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

197

185

self.name, self.type)

198

186

self.group.AddService(

199

187

self.interface,

206

194

self.group.Commit()

207

195

def entry_group_state_changed(self, state, error):

208

196

"""Derived from the Avahi example code"""

209

logger.debug("Avahi entry group state change: %i", state)

197

logger.debug(u"Avahi entry group state change: %i", state)

210

198

211

199

if state == avahi.ENTRY_GROUP_ESTABLISHED:

212

logger.debug("Zeroconf service established.")

200

logger.debug(u"Zeroconf service established.")

213

201

elif state == avahi.ENTRY_GROUP_COLLISION:

214

logger.info("Zeroconf service name collision.")

202

logger.warning(u"Zeroconf service name collision.")

215

203

self.rename()

216

204

elif state == avahi.ENTRY_GROUP_FAILURE:

217

logger.critical("Avahi: Error in group state changed %s",

205

logger.critical(u"Avahi: Error in group state changed %s",

218

206

unicode(error))

219

raise AvahiGroupError("State changed: %s"

207

raise AvahiGroupError(u"State changed: %s"

220

208

% unicode(error))

221

209

def cleanup(self):

222

210

"""Derived from the Avahi example code"""

223

211

if self.group is not None:

224

try:

225

self.group.Free()

226

except (dbus.exceptions.UnknownMethodException,

227

dbus.exceptions.DBusException) as e:

228

pass

212

self.group.Free()

229

213

self.group = None

230

self.remove()

231

def server_state_changed(self, state, error=None):

214

def server_state_changed(self, state):

232

215

"""Derived from the Avahi example code"""

233

logger.debug("Avahi server state change: %i", state)

234

bad_states = { avahi.SERVER_INVALID:

235

"Zeroconf server invalid",

236

avahi.SERVER_REGISTERING: None,

237

avahi.SERVER_COLLISION:

238

"Zeroconf server name collision",

239

avahi.SERVER_FAILURE:

240

"Zeroconf server failure" }

241

if state in bad_states:

242

if bad_states[state] is not None:

243

if error is None:

244

logger.error(bad_states[state])

245

else:

246

logger.error(bad_states[state] + ": %r", error)

247

self.cleanup()

216

logger.debug(u"Avahi server state change: %i", state)

217

if state == avahi.SERVER_COLLISION:

218

logger.error(u"Zeroconf server name collision")

219

self.remove()

248

220

elif state == avahi.SERVER_RUNNING:

249

221

self.add()

250

else:

251

if error is None:

252

logger.debug("Unknown state: %r", state)

253

else:

254

logger.debug("Unknown state: %r: %r", state, error)

255

222

def activate(self):

256

223

"""Derived from the Avahi example code"""

257

224

if self.server is None:

258

225

self.server = dbus.Interface(

259

226

self.bus.get_object(avahi.DBUS_NAME,

260

avahi.DBUS_PATH_SERVER,

261

follow_name_owner_changes=True),

227

avahi.DBUS_PATH_SERVER),

262

228

avahi.DBUS_INTERFACE_SERVER)

263

self.server.connect_to_signal("StateChanged",

229

self.server.connect_to_signal(u"StateChanged",

264

230

self.server_state_changed)

265

231

self.server_state_changed(self.server.GetState())

266

232

267

233

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

274

234

class Client(object):

275

235

"""A representation of a client host served by this server.

276

236

277

237

Attributes:

278

_approved: bool(); 'None' if not yet approved/disapproved

279

approval_delay: datetime.timedelta(); Time to wait for approval

280

approval_duration: datetime.timedelta(); Duration of one approval

238

239

D-Bus identifiers

240

fingerprint: string (40 or 32 hexadecimal digits); used to

241

uniquely identify the client

242

secret: bytestring; sent verbatim (over TLS) to client

243

host: string; available for use by the checker command

244

created: datetime.datetime(); (UTC) object creation

245

last_enabled: datetime.datetime(); (UTC)

246

enabled: bool()

247

last_checked_ok: datetime.datetime(); (UTC) or None

248

timeout: datetime.timedelta(); How long from last_checked_ok

249

until this client is disabled

250

interval: datetime.timedelta(); How often to start a new checker

251

disable_hook: If set, called by disable() as disable_hook(self)

281

252

checker: subprocess.Popen(); a running checker process used

282

253

to see if the client lives.

283

254

'None' if no process is running.

284

checker_callback_tag: a gobject event source tag, or None

285

checker_command: string; External command which is run to check

286

if client lives. %() expansions are done at

255

checker_initiator_tag: a gobject event source tag, or None

256

disable_initiator_tag: - '' -

257

checker_callback_tag: - '' -

258

checker_command: string; External command which is run to check if

259

client lives. %() expansions are done at

287

260

runtime with vars(self) as dict, so that for

288

261

instance %(name)s can be used in the command.

289

checker_initiator_tag: a gobject event source tag, or None

290

created: datetime.datetime(); (UTC) object creation

291

262

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

293

disable_initiator_tag: a gobject event source tag, or None

294

enabled: bool()

295

fingerprint: string (40 or 32 hexadecimal digits); used to

296

uniquely identify the client

297

host: string; available for use by the checker command

298

interval: datetime.timedelta(); How often to start a new checker

299

last_approval_request: datetime.datetime(); (UTC) or None

300

last_checked_ok: datetime.datetime(); (UTC) or None

301

last_enabled: datetime.datetime(); (UTC)

302

303

D-Bus identifiers

304

secret: bytestring; sent verbatim (over TLS) to client

305

timeout: datetime.timedelta(); How long from last_checked_ok

306

until this client is disabled

307

extended_timeout: extra long timeout when password has been sent

308

runtime_expansions: Allowed attributes for runtime expansion.

309

expires: datetime.datetime(); time (UTC) when a client will be

310

disabled, or None

263

approved_delay: datetime.timedelta(); Time to wait for approval

264

_approved: bool(); 'None' if not yet approved/disapproved

265

approved_duration: datetime.timedelta(); Duration of one approval

311

266

"""

312

267

313

runtime_expansions = ("approval_delay", "approval_duration",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

316

"last_enabled", "name", "timeout")

268

@staticmethod

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

317

274

318

275

def timeout_milliseconds(self):

319

276

"Return the 'timeout' attribute in milliseconds"

320

return _timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

277

return self._timedelta_to_milliseconds(self.timeout)

325

278

326

279

def interval_milliseconds(self):

327

280

"Return the 'interval' attribute in milliseconds"

328

return _timedelta_to_milliseconds(self.interval)

329

330

def approval_delay_milliseconds(self):

331

return _timedelta_to_milliseconds(self.approval_delay)

281

return self._timedelta_to_milliseconds(self.interval)

282

283

def approved_delay_milliseconds(self):

284

return self._timedelta_to_milliseconds(self.approved_delay)

332

285

333

286

def __init__(self, name = None, disable_hook=None, config=None):

334

287

"""Note: the 'checker' key in 'config' sets the

337

290

self.name = name

338

291

if config is None:

339

292

config = {}

340

logger.debug("Creating client %r", self.name)

293

logger.debug(u"Creating client %r", self.name)

341

294

# Uppercase and remove spaces from fingerprint for later

342

295

# comparison purposes with return value from the fingerprint()

343

296

# function

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

297

self.fingerprint = (config[u"fingerprint"].upper()

298

.replace(u" ", u""))

299

logger.debug(u" Fingerprint: %s", self.fingerprint)

300

if u"secret" in config:

301

self.secret = config[u"secret"].decode(u"base64")

302

elif u"secfile" in config:

350

303

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

304

(config[u"secfile"])),

352

305

"rb") as secfile:

353

306

self.secret = secfile.read()

354

307

else:

355

raise TypeError("No secret or secfile for client %s"

308

raise TypeError(u"No secret or secfile for client %s"

356

309

% self.name)

357

self.host = config.get("host", "")

310

self.host = config.get(u"host", u"")

358

311

self.created = datetime.datetime.utcnow()

359

312

self.enabled = False

360

self.last_approval_request = None

361

313

self.last_enabled = None

362

314

self.last_checked_ok = None

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

315

self.timeout = string_to_delta(config[u"timeout"])

316

self.interval = string_to_delta(config[u"interval"])

366

317

self.disable_hook = disable_hook

367

318

self.checker = None

368

319

self.checker_initiator_tag = None

369

320

self.disable_initiator_tag = None

370

self.expires = None

371

321

self.checker_callback_tag = None

372

self.checker_command = config["checker"]

322

self.checker_command = config[u"checker"]

373

323

self.current_checker_command = None

374

324

self.last_connect = None

375

325

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

326

self.approved_by_default = config.get(u"approved_by_default",

377

327

True)

378

328

self.approvals_pending = 0

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

329

self.approved_delay = string_to_delta(

330

config[u"approved_delay"])

331

self.approved_duration = string_to_delta(

332

config[u"approved_duration"])

383

333

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

384

334

385

335

def send_changedstate(self):

389

339

390

340

def enable(self):

391

341

"""Start this client's checker and timeout hooks"""

392

if getattr(self, "enabled", False):

342

if getattr(self, u"enabled", False):

393

343

# Already enabled

394

344

return

395

345

self.send_changedstate()

346

self.last_enabled = datetime.datetime.utcnow()

396

347

# Schedule a new checker to be started an 'interval' from now,

397

348

# and every interval from then on.

398

349

self.checker_initiator_tag = (gobject.timeout_add

399

350

(self.interval_milliseconds(),

400

351

self.start_checker))

401

352

# Schedule a disable() when 'timeout' has passed

402

self.expires = datetime.datetime.utcnow() + self.timeout

403

353

self.disable_initiator_tag = (gobject.timeout_add

404

354

(self.timeout_milliseconds(),

405

355

self.disable))

406

356

self.enabled = True

407

self.last_enabled = datetime.datetime.utcnow()

408

357

# Also start a new checker *right now*.

409

358

self.start_checker()

410

359

415

364

if not quiet:

416

365

self.send_changedstate()

417

366

if not quiet:

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

367

logger.info(u"Disabling client %s", self.name)

368

if getattr(self, u"disable_initiator_tag", False):

420

369

gobject.source_remove(self.disable_initiator_tag)

421

370

self.disable_initiator_tag = None

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

371

if getattr(self, u"checker_initiator_tag", False):

424

372

gobject.source_remove(self.checker_initiator_tag)

425

373

self.checker_initiator_tag = None

426

374

self.stop_checker()

441

389

if os.WIFEXITED(condition):

442

390

exitstatus = os.WEXITSTATUS(condition)

443

391

if exitstatus == 0:

444

logger.info("Checker for %(name)s succeeded",

392

logger.info(u"Checker for %(name)s succeeded",

445

393

vars(self))

446

394

self.checked_ok()

447

395

else:

448

logger.info("Checker for %(name)s failed",

396

logger.info(u"Checker for %(name)s failed",

449

397

vars(self))

450

398

else:

451

logger.warning("Checker for %(name)s crashed?",

399

logger.warning(u"Checker for %(name)s crashed?",

452

400

vars(self))

453

401

454

def checked_ok(self, timeout=None):

402

def checked_ok(self):

455

403

"""Bump up the timeout for this client.

456

404

457

405

This should only be called when the client has been seen,

458

406

alive and well.

459

407

"""

460

if timeout is None:

461

timeout = self.timeout

462

408

self.last_checked_ok = datetime.datetime.utcnow()

463

409

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

410

self.disable_initiator_tag = (gobject.timeout_add

466

(_timedelta_to_milliseconds(timeout),

411

(self.timeout_milliseconds(),

467

412

self.disable))

468

413

469

def need_approval(self):

470

self.last_approval_request = datetime.datetime.utcnow()

471

472

414

def start_checker(self):

473

415

"""Start a new checker subprocess if one is not running.

474

416

486

428

# If a checker exists, make sure it is not a zombie

487

429

try:

488

430

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

489

except (AttributeError, OSError) as error:

431

except (AttributeError, OSError), error:

490

432

if (isinstance(error, OSError)

491

433

and error.errno != errno.ECHILD):

492

434

raise error

493

435

else:

494

436

if pid:

495

logger.warning("Checker was a zombie")

437

logger.warning(u"Checker was a zombie")

496

438

gobject.source_remove(self.checker_callback_tag)

497

439

self.checker_callback(pid, status,

498

440

self.current_checker_command)

503

445

command = self.checker_command % self.host

504

446

except TypeError:

505

447

# Escape attributes for the shell

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

448

escaped_attrs = dict((key,

449

re.escape(unicode(str(val),

450

errors=

451

u'replace')))

452

for key, val in

453

vars(self).iteritems())

514

454

try:

515

455

command = self.checker_command % escaped_attrs

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

456

except TypeError, error:

457

logger.error(u'Could not format string "%s":'

458

u' %s', self.checker_command, error)

519

459

return True # Try again later

520

460

self.current_checker_command = command

521

461

try:

522

logger.info("Starting checker %r for %s",

462

logger.info(u"Starting checker %r for %s",

523

463

command, self.name)

524

464

# We don't need to redirect stdout and stderr, since

525

465

# in normal mode, that is already done by daemon(),

527

467

# always replaced by /dev/null.)

528

468

self.checker = subprocess.Popen(command,

529

469

close_fds=True,

530

shell=True, cwd="/")

470

shell=True, cwd=u"/")

531

471

self.checker_callback_tag = (gobject.child_watch_add

532

472

(self.checker.pid,

533

473

self.checker_callback,

538

478

if pid:

539

479

gobject.source_remove(self.checker_callback_tag)

540

480

self.checker_callback(pid, status, command)

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

481

except OSError, error:

482

logger.error(u"Failed to start subprocess: %s",

543

483

error)

544

484

# Re-run this periodically if run by gobject.timeout_add

545

485

return True

549

489

if self.checker_callback_tag:

550

490

gobject.source_remove(self.checker_callback_tag)

551

491

self.checker_callback_tag = None

552

if getattr(self, "checker", None) is None:

492

if getattr(self, u"checker", None) is None:

553

493

return

554

logger.debug("Stopping checker for %(name)s", vars(self))

494

logger.debug(u"Stopping checker for %(name)s", vars(self))

555

495

try:

556

496

os.kill(self.checker.pid, signal.SIGTERM)

557

497

#time.sleep(0.5)

558

498

#if self.checker.poll() is None:

559

499

# os.kill(self.checker.pid, signal.SIGKILL)

560

except OSError as error:

500

except OSError, error:

561

501

if error.errno != errno.ESRCH: # No such process

562

502

raise

563

503

self.checker = None

564

504

565

566

def dbus_service_property(dbus_interface, signature="v",

567

access="readwrite", byte_arrays=False):

505

def dbus_service_property(dbus_interface, signature=u"v",

506

access=u"readwrite", byte_arrays=False):

568

507

"""Decorators for marking methods of a DBusObjectWithProperties to

569

508

become properties on the D-Bus.

570

509

577

516

"""

578

517

# Encoding deeply encoded byte arrays is not supported yet by the

579

518

# "Set" method, so we fail early here:

580

if byte_arrays and signature != "ay":

581

raise ValueError("Byte arrays not supported for non-'ay'"

582

" signature %r" % signature)

519

if byte_arrays and signature != u"ay":

520

raise ValueError(u"Byte arrays not supported for non-'ay'"

521

u" signature %r" % signature)

583

522

def decorator(func):

584

523

func._dbus_is_property = True

585

524

func._dbus_interface = dbus_interface

586

525

func._dbus_signature = signature

587

526

func._dbus_access = access

588

527

func._dbus_name = func.__name__

589

if func._dbus_name.endswith("_dbus_property"):

528

if func._dbus_name.endswith(u"_dbus_property"):

590

529

func._dbus_name = func._dbus_name[:-14]

591

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

530

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

592

531

return func

593

532

return decorator

594

533

614

553

615

554

class DBusObjectWithProperties(dbus.service.Object):

616

555

"""A D-Bus object with properties.

617

556

618

557

Classes inheriting from this can use the dbus_service_property

619

558

decorator to expose methods as D-Bus properties. It exposes the

620

559

standard Get(), Set(), and GetAll() methods on the D-Bus.

622

561

623

562

@staticmethod

624

563

def _is_dbus_property(obj):

625

return getattr(obj, "_dbus_is_property", False)

564

return getattr(obj, u"_dbus_is_property", False)

626

565

627

566

def _get_all_dbus_properties(self):

628

567

"""Returns a generator of (name, attribute) pairs

629

568

"""

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

631

for cls in self.__class__.__mro__

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

569

return ((prop._dbus_name, prop)

570

for name, prop in

571

inspect.getmembers(self, self._is_dbus_property))

633

572

634

573

def _get_dbus_property(self, interface_name, property_name):

635

574

"""Returns a bound method if one exists which is a D-Bus

636

575

property with the specified name and interface.

637

576

"""

638

for cls in self.__class__.__mro__:

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

641

return value.__get__(self)

642

577

for name in (property_name,

578

property_name + u"_dbus_property"):

579

prop = getattr(self, name, None)

580

if (prop is None

581

or not self._is_dbus_property(prop)

582

or prop._dbus_name != property_name

583

or (interface_name and prop._dbus_interface

584

and interface_name != prop._dbus_interface)):

585

continue

586

return prop

643

587

# No such property

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

645

+ interface_name + "."

588

raise DBusPropertyNotFound(self.dbus_object_path + u":"

589

+ interface_name + u"."

646

590

+ property_name)

647

591

648

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

649

out_signature="v")

592

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

593

out_signature=u"v")

650

594

def Get(self, interface_name, property_name):

651

595

"""Standard D-Bus property Get() method, see D-Bus standard.

652

596

"""

653

597

prop = self._get_dbus_property(interface_name, property_name)

654

if prop._dbus_access == "write":

598

if prop._dbus_access == u"write":

655

599

raise DBusPropertyAccessException(property_name)

656

600

value = prop()

657

if not hasattr(value, "variant_level"):

601

if not hasattr(value, u"variant_level"):

658

602

return value

659

603

return type(value)(value, variant_level=value.variant_level+1)

660

604

661

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

605

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

662

606

def Set(self, interface_name, property_name, value):

663

607

"""Standard D-Bus property Set() method, see D-Bus standard.

664

608

"""

665

609

prop = self._get_dbus_property(interface_name, property_name)

666

if prop._dbus_access == "read":

610

if prop._dbus_access == u"read":

667

611

raise DBusPropertyAccessException(property_name)

668

if prop._dbus_get_args_options["byte_arrays"]:

612

if prop._dbus_get_args_options[u"byte_arrays"]:

669

613

# The byte_arrays option is not supported yet on

670

614

# signatures other than "ay".

671

if prop._dbus_signature != "ay":

615

if prop._dbus_signature != u"ay":

672

616

raise ValueError

673

617

value = dbus.ByteArray(''.join(unichr(byte)

674

618

for byte in value))

675

619

prop(value)

676

620

677

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

678

out_signature="a{sv}")

621

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

622

out_signature=u"a{sv}")

679

623

def GetAll(self, interface_name):

680

624

"""Standard D-Bus property GetAll() method, see D-Bus

681

625

standard.

682

626

683

627

Note: Will not include properties with access="write".

684

628

"""

685

629

all = {}

689

633

# Interface non-empty but did not match

690

634

continue

691

635

# Ignore write-only properties

692

if prop._dbus_access == "write":

636

if prop._dbus_access == u"write":

693

637

continue

694

638

value = prop()

695

if not hasattr(value, "variant_level"):

639

if not hasattr(value, u"variant_level"):

696

640

all[name] = value

697

641

continue

698

642

all[name] = type(value)(value, variant_level=

699

643

value.variant_level+1)

700

return dbus.Dictionary(all, signature="sv")

644

return dbus.Dictionary(all, signature=u"sv")

701

645

702

646

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

703

out_signature="s",

647

out_signature=u"s",

704

648

path_keyword='object_path',

705

649

connection_keyword='connection')

706

650

def Introspect(self, object_path, connection):

711

655

try:

712

656

document = xml.dom.minidom.parseString(xmlstring)

713

657

def make_tag(document, name, prop):

714

e = document.createElement("property")

715

e.setAttribute("name", name)

716

e.setAttribute("type", prop._dbus_signature)

717

e.setAttribute("access", prop._dbus_access)

658

e = document.createElement(u"property")

659

e.setAttribute(u"name", name)

660

e.setAttribute(u"type", prop._dbus_signature)

661

e.setAttribute(u"access", prop._dbus_access)

718

662

return e

719

for if_tag in document.getElementsByTagName("interface"):

663

for if_tag in document.getElementsByTagName(u"interface"):

720

664

for tag in (make_tag(document, name, prop)

721

665

for name, prop

722

666

in self._get_all_dbus_properties()

723

667

if prop._dbus_interface

724

== if_tag.getAttribute("name")):

668

== if_tag.getAttribute(u"name")):

725

669

if_tag.appendChild(tag)

726

670

# Add the names to the return values for the

727

671

# "org.freedesktop.DBus.Properties" methods

728

if (if_tag.getAttribute("name")

729

== "org.freedesktop.DBus.Properties"):

730

for cn in if_tag.getElementsByTagName("method"):

731

if cn.getAttribute("name") == "Get":

732

for arg in cn.getElementsByTagName("arg"):

733

if (arg.getAttribute("direction")

734

== "out"):

735

arg.setAttribute("name", "value")

736

elif cn.getAttribute("name") == "GetAll":

737

for arg in cn.getElementsByTagName("arg"):

738

if (arg.getAttribute("direction")

739

== "out"):

740

arg.setAttribute("name", "props")

741

xmlstring = document.toxml("utf-8")

672

if (if_tag.getAttribute(u"name")

673

== u"org.freedesktop.DBus.Properties"):

674

for cn in if_tag.getElementsByTagName(u"method"):

675

if cn.getAttribute(u"name") == u"Get":

676

for arg in cn.getElementsByTagName(u"arg"):

677

if (arg.getAttribute(u"direction")

678

== u"out"):

679

arg.setAttribute(u"name", u"value")

680

elif cn.getAttribute(u"name") == u"GetAll":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"props")

685

xmlstring = document.toxml(u"utf-8")

742

686

document.unlink()

743

687

except (AttributeError, xml.dom.DOMException,

744

xml.parsers.expat.ExpatError) as error:

745

logger.error("Failed to override Introspection method",

688

xml.parsers.expat.ExpatError), error:

689

logger.error(u"Failed to override Introspection method",

746

690

error)

747

691

return xmlstring

748

692

749

693

750

def datetime_to_dbus (dt, variant_level=0):

751

"""Convert a UTC datetime.datetime() to a D-Bus type."""

752

if dt is None:

753

return dbus.String("", variant_level = variant_level)

754

return dbus.String(dt.isoformat(),

755

variant_level=variant_level)

756

757

class AlternateDBusNamesMetaclass(DBusObjectWithProperties.__metaclass__):

758

"""Applied to an empty subclass of a D-Bus object, this metaclass

759

will add additional D-Bus attributes matching a certain pattern.

760

"""

761

def __new__(mcs, name, bases, attr):

762

# Go through all the base classes which could have D-Bus

763

# methods, signals, or properties in them

764

for base in (b for b in bases

765

if issubclass(b, dbus.service.Object)):

766

# Go though all attributes of the base class

767

for attrname, attribute in inspect.getmembers(base):

768

# Ignore non-D-Bus attributes, and D-Bus attributes

769

# with the wrong interface name

770

if (not hasattr(attribute, "_dbus_interface")

771

or not attribute._dbus_interface

772

.startswith("se.recompile.Mandos")):

773

continue

774

# Create an alternate D-Bus interface name based on

775

# the current name

776

alt_interface = (attribute._dbus_interface

777

.replace("se.recompile.Mandos",

778

"se.bsnet.fukt.Mandos"))

779

# Is this a D-Bus signal?

780

if getattr(attribute, "_dbus_is_signal", False):

781

# Extract the original non-method function by

782

# black magic

783

nonmethod_func = (dict(

784

zip(attribute.func_code.co_freevars,

785

attribute.__closure__))["func"]

786

.cell_contents)

787

# Create a new, but exactly alike, function

788

# object, and decorate it to be a new D-Bus signal

789

# with the alternate D-Bus interface name

790

new_function = (dbus.service.signal

791

(alt_interface,

792

attribute._dbus_signature)

793

(types.FunctionType(

794

nonmethod_func.func_code,

795

nonmethod_func.func_globals,

796

nonmethod_func.func_name,

797

nonmethod_func.func_defaults,

798

nonmethod_func.func_closure)))

799

# Define a creator of a function to call both the

800

# old and new functions, so both the old and new

801

# signals gets sent when the function is called

802

def fixscope(func1, func2):

803

"""This function is a scope container to pass

804

func1 and func2 to the "call_both" function

805

outside of its arguments"""

806

def call_both(*args, **kwargs):

807

"""This function will emit two D-Bus

808

signals by calling func1 and func2"""

809

func1(*args, **kwargs)

810

func2(*args, **kwargs)

811

return call_both

812

# Create the "call_both" function and add it to

813

# the class

814

attr[attrname] = fixscope(attribute,

815

new_function)

816

# Is this a D-Bus method?

817

elif getattr(attribute, "_dbus_is_method", False):

818

# Create a new, but exactly alike, function

819

# object. Decorate it to be a new D-Bus method

820

# with the alternate D-Bus interface name. Add it

821

# to the class.

822

attr[attrname] = (dbus.service.method

823

(alt_interface,

824

attribute._dbus_in_signature,

825

attribute._dbus_out_signature)

826

(types.FunctionType

827

(attribute.func_code,

828

attribute.func_globals,

829

attribute.func_name,

830

attribute.func_defaults,

831

attribute.func_closure)))

832

# Is this a D-Bus property?

833

elif getattr(attribute, "_dbus_is_property", False):

834

# Create a new, but exactly alike, function

835

# object, and decorate it to be a new D-Bus

836

# property with the alternate D-Bus interface

837

# name. Add it to the class.

838

attr[attrname] = (dbus_service_property

839

(alt_interface,

840

attribute._dbus_signature,

841

attribute._dbus_access,

842

attribute

843

._dbus_get_args_options

844

["byte_arrays"])

845

(types.FunctionType

846

(attribute.func_code,

847

attribute.func_globals,

848

attribute.func_name,

849

attribute.func_defaults,

850

attribute.func_closure)))

851

return type.__new__(mcs, name, bases, attr)

852

853

694

class ClientDBus(Client, DBusObjectWithProperties):

854

695

"""A Client class using D-Bus

855

696

857

698

dbus_object_path: dbus.ObjectPath

858

699

bus: dbus.SystemBus()

859

700

"""

860

861

runtime_expansions = (Client.runtime_expansions

862

+ ("dbus_object_path",))

863

864

701

# dbus.service.Object doesn't use super(), so we can't either.

865

702

866

703

def __init__(self, bus = None, *args, **kwargs):

869

706

Client.__init__(self, *args, **kwargs)

870

707

# Only now, when this client is initialized, can it show up on

871

708

# the D-Bus

872

client_object_name = unicode(self.name).translate(

873

{ord("."): ord("_"),

874

ord("-"): ord("_")})

875

709

self.dbus_object_path = (dbus.ObjectPath

876

("/clients/" + client_object_name))

710

(u"/clients/"

711

+ self.name.replace(u".", u"_")))

877

712

DBusObjectWithProperties.__init__(self, self.bus,

878

713

self.dbus_object_path)

879

880

def notifychangeproperty(transform_func,

881

dbus_name, type_func=lambda x: x,

882

variant_level=1):

883

""" Modify a variable so that it's a property which announces

884

its changes to DBus.

885

886

transform_fun: Function that takes a value and transforms it

887

to a D-Bus type.

888

dbus_name: D-Bus name of the variable

889

type_func: Function that transform the value before sending it

890

to the D-Bus. Default: no transform

891

variant_level: D-Bus variant level. Default: 1

892

"""

893

real_value = [None,]

894

def setter(self, value):

895

old_value = real_value[0]

896

real_value[0] = value

897

if hasattr(self, "dbus_object_path"):

898

if type_func(old_value) != type_func(real_value[0]):

899

dbus_value = transform_func(type_func(real_value[0]),

900

variant_level)

901

self.PropertyChanged(dbus.String(dbus_name),

902

dbus_value)

903

904

return property(lambda self: real_value[0], setter)

905

906

907

expires = notifychangeproperty(datetime_to_dbus, "Expires")

908

approvals_pending = notifychangeproperty(dbus.Boolean,

909

"ApprovalPending",

910

type_func = bool)

911

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

912

last_enabled = notifychangeproperty(datetime_to_dbus,

913

"LastEnabled")

914

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

915

type_func = lambda checker: checker is not None)

916

last_checked_ok = notifychangeproperty(datetime_to_dbus,

917

"LastCheckedOK")

918

last_approval_request = notifychangeproperty(datetime_to_dbus,

919

"LastApprovalRequest")

920

approved_by_default = notifychangeproperty(dbus.Boolean,

921

"ApprovedByDefault")

922

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

923

type_func = _timedelta_to_milliseconds)

924

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

925

type_func = _timedelta_to_milliseconds)

926

host = notifychangeproperty(dbus.String, "Host")

927

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

928

type_func = _timedelta_to_milliseconds)

929

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

930

type_func = _timedelta_to_milliseconds)

931

interval = notifychangeproperty(dbus.UInt16, "Interval",

932

type_func = _timedelta_to_milliseconds)

933

checker_command = notifychangeproperty(dbus.String, "Checker")

934

935

del notifychangeproperty

714

715

def _get_approvals_pending(self):

716

return self._approvals_pending

717

def _set_approvals_pending(self, value):

718

old_value = self._approvals_pending

719

self._approvals_pending = value

720

bval = bool(value)

721

if (hasattr(self, "dbus_object_path")

722

and bval is not bool(old_value)):

723

dbus_bool = dbus.Boolean(bval, variant_level=1)

724

self.PropertyChanged(dbus.String(u"approved_pending"),

725

dbus_bool)

726

727

approvals_pending = property(_get_approvals_pending,

728

_set_approvals_pending)

729

del _get_approvals_pending, _set_approvals_pending

730

731

@staticmethod

732

def _datetime_to_dbus(dt, variant_level=0):

733

"""Convert a UTC datetime.datetime() to a D-Bus type."""

734

return dbus.String(dt.isoformat(),

735

variant_level=variant_level)

736

737

def enable(self):

738

oldstate = getattr(self, u"enabled", False)

739

r = Client.enable(self)

740

if oldstate != self.enabled:

741

# Emit D-Bus signals

742

self.PropertyChanged(dbus.String(u"enabled"),

743

dbus.Boolean(True, variant_level=1))

744

self.PropertyChanged(

745

dbus.String(u"last_enabled"),

746

self._datetime_to_dbus(self.last_enabled,

747

variant_level=1))

748

return r

749

750

def disable(self, quiet = False):

751

oldstate = getattr(self, u"enabled", False)

752

r = Client.disable(self, quiet=quiet)

753

if not quiet and oldstate != self.enabled:

754

# Emit D-Bus signal

755

self.PropertyChanged(dbus.String(u"enabled"),

756

dbus.Boolean(False, variant_level=1))

757

return r

936

758

937

759

def __del__(self, *args, **kwargs):

938

760

try:

939

761

self.remove_from_connection()

940

762

except LookupError:

941

763

pass

942

if hasattr(DBusObjectWithProperties, "__del__"):

764

if hasattr(DBusObjectWithProperties, u"__del__"):

943

765

DBusObjectWithProperties.__del__(self, *args, **kwargs)

944

766

Client.__del__(self, *args, **kwargs)

945

767

947

769

*args, **kwargs):

948

770

self.checker_callback_tag = None

949

771

self.checker = None

772

# Emit D-Bus signal

773

self.PropertyChanged(dbus.String(u"checker_running"),

774

dbus.Boolean(False, variant_level=1))

950

775

if os.WIFEXITED(condition):

951

776

exitstatus = os.WEXITSTATUS(condition)

952

777

# Emit D-Bus signal

962

787

return Client.checker_callback(self, pid, condition, command,

963

788

*args, **kwargs)

964

789

790

def checked_ok(self, *args, **kwargs):

791

r = Client.checked_ok(self, *args, **kwargs)

792

# Emit D-Bus signal

793

self.PropertyChanged(

794

dbus.String(u"last_checked_ok"),

795

(self._datetime_to_dbus(self.last_checked_ok,

796

variant_level=1)))

797

return r

798

965

799

def start_checker(self, *args, **kwargs):

966

800

old_checker = self.checker

967

801

if self.checker is not None:

974

808

and old_checker_pid != self.checker.pid):

975

809

# Emit D-Bus signal

976

810

self.CheckerStarted(self.current_checker_command)

811

self.PropertyChanged(

812

dbus.String(u"checker_running"),

813

dbus.Boolean(True, variant_level=1))

977

814

return r

978

815

816

def stop_checker(self, *args, **kwargs):

817

old_checker = getattr(self, u"checker", None)

818

r = Client.stop_checker(self, *args, **kwargs)

819

if (old_checker is not None

820

and getattr(self, u"checker", None) is None):

821

self.PropertyChanged(dbus.String(u"checker_running"),

822

dbus.Boolean(False, variant_level=1))

823

return r

824

979

825

def _reset_approved(self):

980

826

self._approved = None

981

827

return False

983

829

def approve(self, value=True):

984

830

self.send_changedstate()

985

831

self._approved = value

986

gobject.timeout_add(_timedelta_to_milliseconds

987

(self.approval_duration),

832

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),

988

833

self._reset_approved)

989

834

990

835

991

836

## D-Bus methods, signals & properties

992

_interface = "se.recompile.Mandos.Client"

837

_interface = u"se.bsnet.fukt.Mandos.Client"

993

838

994

839

## Signals

995

840

996

841

# CheckerCompleted - signal

997

@dbus.service.signal(_interface, signature="nxs")

842

@dbus.service.signal(_interface, signature=u"nxs")

998

843

def CheckerCompleted(self, exitcode, waitstatus, command):

999

844

"D-Bus signal"

1000

845

pass

1001

846

1002

847

# CheckerStarted - signal

1003

@dbus.service.signal(_interface, signature="s")

848

@dbus.service.signal(_interface, signature=u"s")

1004

849

def CheckerStarted(self, command):

1005

850

"D-Bus signal"

1006

851

pass

1007

852

1008

853

# PropertyChanged - signal

1009

@dbus.service.signal(_interface, signature="sv")

854

@dbus.service.signal(_interface, signature=u"sv")

1010

855

def PropertyChanged(self, property, value):

1011

856

"D-Bus signal"

1012

857

pass

1021

866

pass

1022

867

1023

868

# Rejected - signal

1024

@dbus.service.signal(_interface, signature="s")

869

@dbus.service.signal(_interface, signature=u"s")

1025

870

def Rejected(self, reason):

1026

871

"D-Bus signal"

1027

872

pass

1028

873

1029

874

# NeedApproval - signal

1030

@dbus.service.signal(_interface, signature="tb")

875

@dbus.service.signal(_interface, signature=u"db")

1031

876

def NeedApproval(self, timeout, default):

1032

877

"D-Bus signal"

1033

return self.need_approval()

878

pass

1034

879

1035

880

## Methods

1036

881

1037

882

# Approve - method

1038

@dbus.service.method(_interface, in_signature="b")

883

@dbus.service.method(_interface, in_signature=u"b")

1039

884

def Approve(self, value):

1040

885

self.approve(value)

1041

886

1042

887

# CheckedOK - method

1043

888

@dbus.service.method(_interface)

1044

889

def CheckedOK(self):

1045

self.checked_ok()

890

return self.checked_ok()

1046

891

1047

892

# Enable - method

1048

893

@dbus.service.method(_interface)

1069

914

1070

915

## Properties

1071

916

1072

# ApprovalPending - property

1073

@dbus_service_property(_interface, signature="b", access="read")

1074

def ApprovalPending_dbus_property(self):

917

# approved_pending - property

918

@dbus_service_property(_interface, signature=u"b", access=u"read")

919

def approved_pending_dbus_property(self):

1075

920

return dbus.Boolean(bool(self.approvals_pending))

1076

921

1077

# ApprovedByDefault - property

1078

@dbus_service_property(_interface, signature="b",

1079

access="readwrite")

1080

def ApprovedByDefault_dbus_property(self, value=None):

1081

if value is None: # get

1082

return dbus.Boolean(self.approved_by_default)

1083

self.approved_by_default = bool(value)

1084

1085

# ApprovalDelay - property

1086

@dbus_service_property(_interface, signature="t",

1087

access="readwrite")

1088

def ApprovalDelay_dbus_property(self, value=None):

1089

if value is None: # get

1090

return dbus.UInt64(self.approval_delay_milliseconds())

1091

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1092

1093

# ApprovalDuration - property

1094

@dbus_service_property(_interface, signature="t",

1095

access="readwrite")

1096

def ApprovalDuration_dbus_property(self, value=None):

1097

if value is None: # get

1098

return dbus.UInt64(_timedelta_to_milliseconds(

1099

self.approval_duration))

1100

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1101

1102

# Name - property

1103

@dbus_service_property(_interface, signature="s", access="read")

1104

def Name_dbus_property(self):

922

# approved_by_default - property

923

@dbus_service_property(_interface, signature=u"b",

924

access=u"readwrite")

925

def approved_by_default_dbus_property(self):

926

return dbus.Boolean(self.approved_by_default)

927

928

# approved_delay - property

929

@dbus_service_property(_interface, signature=u"t",

930

access=u"readwrite")

931

def approved_delay_dbus_property(self):

932

return dbus.UInt64(self.approved_delay_milliseconds())

933

934

# approved_duration - property

935

@dbus_service_property(_interface, signature=u"t",

936

access=u"readwrite")

937

def approved_duration_dbus_property(self):

938

return dbus.UInt64(self._timedelta_to_milliseconds(

939

self.approved_duration))

940

941

# name - property

942

@dbus_service_property(_interface, signature=u"s", access=u"read")

943

def name_dbus_property(self):

1105

944

return dbus.String(self.name)

1106

945

1107

# Fingerprint - property

1108

@dbus_service_property(_interface, signature="s", access="read")

1109

def Fingerprint_dbus_property(self):

946

# fingerprint - property

947

@dbus_service_property(_interface, signature=u"s", access=u"read")

948

def fingerprint_dbus_property(self):

1110

949

return dbus.String(self.fingerprint)

1111

950

1112

# Host - property

1113

@dbus_service_property(_interface, signature="s",

1114

access="readwrite")

1115

def Host_dbus_property(self, value=None):

951

# host - property

952

@dbus_service_property(_interface, signature=u"s",

953

access=u"readwrite")

954

def host_dbus_property(self, value=None):

1116

955

if value is None: # get

1117

956

return dbus.String(self.host)

1118

957

self.host = value

1119

1120

# Created - property

1121

@dbus_service_property(_interface, signature="s", access="read")

1122

def Created_dbus_property(self):

1123

return dbus.String(datetime_to_dbus(self.created))

1124

1125

# LastEnabled - property

1126

@dbus_service_property(_interface, signature="s", access="read")

1127

def LastEnabled_dbus_property(self):

1128

return datetime_to_dbus(self.last_enabled)

1129

1130

# Enabled - property

1131

@dbus_service_property(_interface, signature="b",

1132

access="readwrite")

1133

def Enabled_dbus_property(self, value=None):

958

# Emit D-Bus signal

959

self.PropertyChanged(dbus.String(u"host"),

960

dbus.String(value, variant_level=1))

961

962

# created - property

963

@dbus_service_property(_interface, signature=u"s", access=u"read")

964

def created_dbus_property(self):

965

return dbus.String(self._datetime_to_dbus(self.created))

966

967

# last_enabled - property

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

969

def last_enabled_dbus_property(self):

970

if self.last_enabled is None:

971

return dbus.String(u"")

972

return dbus.String(self._datetime_to_dbus(self.last_enabled))

973

974

# enabled - property

975

@dbus_service_property(_interface, signature=u"b",

976

access=u"readwrite")

977

def enabled_dbus_property(self, value=None):

1134

978

if value is None: # get

1135

979

return dbus.Boolean(self.enabled)

1136

980

if value:

1138

982

else:

1139

983

self.disable()

1140

984

1141

# LastCheckedOK - property

1142

@dbus_service_property(_interface, signature="s",

1143

access="readwrite")

1144

def LastCheckedOK_dbus_property(self, value=None):

985

# last_checked_ok - property

986

@dbus_service_property(_interface, signature=u"s",

987

access=u"readwrite")

988

def last_checked_ok_dbus_property(self, value=None):

1145

989

if value is not None:

1146

990

self.checked_ok()

1147

991

return

1148

return datetime_to_dbus(self.last_checked_ok)

1149

1150

# Expires - property

1151

@dbus_service_property(_interface, signature="s", access="read")

1152

def Expires_dbus_property(self):

1153

return datetime_to_dbus(self.expires)

1154

1155

# LastApprovalRequest - property

1156

@dbus_service_property(_interface, signature="s", access="read")

1157

def LastApprovalRequest_dbus_property(self):

1158

return datetime_to_dbus(self.last_approval_request)

1159

1160

# Timeout - property

1161

@dbus_service_property(_interface, signature="t",

1162

access="readwrite")

1163

def Timeout_dbus_property(self, value=None):

992

if self.last_checked_ok is None:

993

return dbus.String(u"")

994

return dbus.String(self._datetime_to_dbus(self

995

.last_checked_ok))

996

997

# timeout - property

998

@dbus_service_property(_interface, signature=u"t",

999

access=u"readwrite")

1000

def timeout_dbus_property(self, value=None):

1164

1001

if value is None: # get

1165

1002

return dbus.UInt64(self.timeout_milliseconds())

1166

1003

self.timeout = datetime.timedelta(0, 0, 0, value)

1167

if getattr(self, "disable_initiator_tag", None) is None:

1004

# Emit D-Bus signal

1005

self.PropertyChanged(dbus.String(u"timeout"),

1006

dbus.UInt64(value, variant_level=1))

1007

if getattr(self, u"disable_initiator_tag", None) is None:

1168

1008

return

1169

1009

# Reschedule timeout

1170

1010

gobject.source_remove(self.disable_initiator_tag)

1171

1011

self.disable_initiator_tag = None

1172

self.expires = None

1173

1012

time_to_die = (self.

1174

1013

_timedelta_to_milliseconds((self

1175

1014

.last_checked_ok

1180

1019

# The timeout has passed

1181

1020

self.disable()

1182

1021

else:

1183

self.expires = (datetime.datetime.utcnow()

1184

+ datetime.timedelta(milliseconds = time_to_die))

1185

1022

self.disable_initiator_tag = (gobject.timeout_add

1186

1023

(time_to_die, self.disable))

1187

1024

1188

# ExtendedTimeout - property

1189

@dbus_service_property(_interface, signature="t",

1190

access="readwrite")

1191

def ExtendedTimeout_dbus_property(self, value=None):

1192

if value is None: # get

1193

return dbus.UInt64(self.extended_timeout_milliseconds())

1194

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1195

1196

# Interval - property

1197

@dbus_service_property(_interface, signature="t",

1198

access="readwrite")

1199

def Interval_dbus_property(self, value=None):

1025

# interval - property

1026

@dbus_service_property(_interface, signature=u"t",

1027

access=u"readwrite")

1028

def interval_dbus_property(self, value=None):

1200

1029

if value is None: # get

1201

1030

return dbus.UInt64(self.interval_milliseconds())

1202

1031

self.interval = datetime.timedelta(0, 0, 0, value)

1203

if getattr(self, "checker_initiator_tag", None) is None:

1032

# Emit D-Bus signal

1033

self.PropertyChanged(dbus.String(u"interval"),

1034

dbus.UInt64(value, variant_level=1))

1035

if getattr(self, u"checker_initiator_tag", None) is None:

1204

1036

return

1205

1037

# Reschedule checker run

1206

1038

gobject.source_remove(self.checker_initiator_tag)

1207

1039

self.checker_initiator_tag = (gobject.timeout_add

1208

1040

(value, self.start_checker))

1209

1041

self.start_checker() # Start one now, too

1210

1211

# Checker - property

1212

@dbus_service_property(_interface, signature="s",

1213

access="readwrite")

1214

def Checker_dbus_property(self, value=None):

1042

1043

# checker - property

1044

@dbus_service_property(_interface, signature=u"s",

1045

access=u"readwrite")

1046

def checker_dbus_property(self, value=None):

1215

1047

if value is None: # get

1216

1048

return dbus.String(self.checker_command)

1217

1049

self.checker_command = value

1050

# Emit D-Bus signal

1051

self.PropertyChanged(dbus.String(u"checker"),

1052

dbus.String(self.checker_command,

1053

variant_level=1))

1218

1054

1219

# CheckerRunning - property

1220

@dbus_service_property(_interface, signature="b",

1221

access="readwrite")

1222

def CheckerRunning_dbus_property(self, value=None):

1055

# checker_running - property

1056

@dbus_service_property(_interface, signature=u"b",

1057

access=u"readwrite")

1058

def checker_running_dbus_property(self, value=None):

1223

1059

if value is None: # get

1224

1060

return dbus.Boolean(self.checker is not None)

1225

1061

if value:

1227

1063

else:

1228

1064

self.stop_checker()

1229

1065

1230

# ObjectPath - property

1231

@dbus_service_property(_interface, signature="o", access="read")

1232

def ObjectPath_dbus_property(self):

1066

# object_path - property

1067

@dbus_service_property(_interface, signature=u"o", access=u"read")

1068

def object_path_dbus_property(self):

1233

1069

return self.dbus_object_path # is already a dbus.ObjectPath

1234

1070

1235

# Secret = property

1236

@dbus_service_property(_interface, signature="ay",

1237

access="write", byte_arrays=True)

1238

def Secret_dbus_property(self, value):

1071

# secret = property

1072

@dbus_service_property(_interface, signature=u"ay",

1073

access=u"write", byte_arrays=True)

1074

def secret_dbus_property(self, value):

1239

1075

self.secret = str(value)

1240

1076

1241

1077

del _interface

1247

1083

self._pipe.send(('init', fpr, address))

1248

1084

if not self._pipe.recv():

1249

1085

raise KeyError()

1250

1086

1251

1087

def __getattribute__(self, name):

1252

1088

if(name == '_pipe'):

1253

1089

return super(ProxyClient, self).__getattribute__(name)

1260

1096

self._pipe.send(('funcall', name, args, kwargs))

1261

1097

return self._pipe.recv()[1]

1262

1098

return func

1263

1099

1264

1100

def __setattr__(self, name, value):

1265

1101

if(name == '_pipe'):

1266

1102

return super(ProxyClient, self).__setattr__(name, value)

1267

1103

self._pipe.send(('setattr', name, value))

1268

1104

1269

class ClientDBusTransitional(ClientDBus):

1270

__metaclass__ = AlternateDBusNamesMetaclass

1271

1105

1272

1106

class ClientHandler(socketserver.BaseRequestHandler, object):

1273

1107

"""A class to handle client connections.

1277

1111

1278

1112

def handle(self):

1279

1113

with contextlib.closing(self.server.child_pipe) as child_pipe:

1280

logger.info("TCP connection from: %s",

1114

logger.info(u"TCP connection from: %s",

1281

1115

unicode(self.client_address))

1282

logger.debug("Pipe FD: %d",

1116

logger.debug(u"Pipe FD: %d",

1283

1117

self.server.child_pipe.fileno())

1284

1118

1285

1119

session = (gnutls.connection

1286

1120

.ClientSession(self.request,

1287

1121

gnutls.connection

1288

1122

.X509Credentials()))

1289

1123

1290

1124

# Note: gnutls.connection.X509Credentials is really a

1291

1125

# generic GnuTLS certificate credentials object so long as

1292

1126

# no X.509 keys are added to it. Therefore, we can use it

1293

1127

# here despite using OpenPGP certificates.

1294

1295

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1296

# "+AES-256-CBC", "+SHA1",

1297

# "+COMP-NULL", "+CTYPE-OPENPGP",

1298

# "+DHE-DSS"))

1128

1129

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1130

# u"+AES-256-CBC", u"+SHA1",

1131

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1132

# u"+DHE-DSS"))

1299

1133

# Use a fallback default, since this MUST be set.

1300

1134

priority = self.server.gnutls_priority

1301

1135

if priority is None:

1302

priority = "NORMAL"

1136

priority = u"NORMAL"

1303

1137

(gnutls.library.functions

1304

1138

.gnutls_priority_set_direct(session._c_object,

1305

1139

priority, None))

1306

1140

1307

1141

# Start communication using the Mandos protocol

1308

1142

# Get protocol number

1309

1143

line = self.request.makefile().readline()

1310

logger.debug("Protocol version: %r", line)

1144

logger.debug(u"Protocol version: %r", line)

1311

1145

try:

1312

1146

if int(line.strip().split()[0]) > 1:

1313

1147

raise RuntimeError

1314

except (ValueError, IndexError, RuntimeError) as error:

1315

logger.error("Unknown protocol version: %s", error)

1148

except (ValueError, IndexError, RuntimeError), error:

1149

logger.error(u"Unknown protocol version: %s", error)

1316

1150

return

1317

1151

1318

1152

# Start GnuTLS connection

1319

1153

try:

1320

1154

session.handshake()

1321

except gnutls.errors.GNUTLSError as error:

1322

logger.warning("Handshake failed: %s", error)

1155

except gnutls.errors.GNUTLSError, error:

1156

logger.warning(u"Handshake failed: %s", error)

1323

1157

# Do not run session.bye() here: the session is not

1324

1158

# established. Just abandon the request.

1325

1159

return

1326

logger.debug("Handshake succeeded")

1327

1160

logger.debug(u"Handshake succeeded")

1161

1328

1162

approval_required = False

1329

1163

try:

1330

1164

try:

1331

1165

fpr = self.fingerprint(self.peer_certificate

1332

1166

(session))

1333

except (TypeError,

1334

gnutls.errors.GNUTLSError) as error:

1335

logger.warning("Bad certificate: %s", error)

1167

except (TypeError, gnutls.errors.GNUTLSError), error:

1168

logger.warning(u"Bad certificate: %s", error)

1336

1169

return

1337

logger.debug("Fingerprint: %s", fpr)

1338

1170

logger.debug(u"Fingerprint: %s", fpr)

1171

1339

1172

try:

1340

1173

client = ProxyClient(child_pipe, fpr,

1341

1174

self.client_address)

1342

1175

except KeyError:

1343

1176

return

1344

1177

1345

if client.approval_delay:

1346

delay = client.approval_delay

1178

if client.approved_delay:

1179

delay = client.approved_delay

1347

1180

client.approvals_pending += 1

1348

1181

approval_required = True

1349

1182

1350

1183

while True:

1351

1184

if not client.enabled:

1352

logger.info("Client %s is disabled",

1185

logger.warning(u"Client %s is disabled",

1353

1186

client.name)

1354

1187

if self.server.use_dbus:

1355

1188

# Emit D-Bus signal

1356

1189

client.Rejected("Disabled")

1357

1190

return

1358

1191

1359

if client._approved or not client.approval_delay:

1192

if client._approved or not client.approved_delay:

1360

1193

#We are approved or approval is disabled

1361

1194

break

1362

1195

elif client._approved is None:

1363

logger.info("Client %s needs approval",

1196

logger.info(u"Client %s need approval",

1364

1197

client.name)

1365

1198

if self.server.use_dbus:

1366

1199

# Emit D-Bus signal

1367

1200

client.NeedApproval(

1368

client.approval_delay_milliseconds(),

1201

client.approved_delay_milliseconds(),

1369

1202

client.approved_by_default)

1370

1203

else:

1371

logger.warning("Client %s was not approved",

1204

logger.warning(u"Client %s was not approved",

1372

1205

client.name)

1373

1206

if self.server.use_dbus:

1374

1207

# Emit D-Bus signal

1375

client.Rejected("Denied")

1208

client.Rejected("Disapproved")

1376

1209

return

1377

1210

1378

1211

#wait until timeout or approved

1389

1222

client.name)

1390

1223

if self.server.use_dbus:

1391

1224

# Emit D-Bus signal

1392

client.Rejected("Approval timed out")

1225

client.Rejected("Time out")

1393

1226

return

1394

1227

else:

1395

1228

break

1400

1233

while sent_size < len(client.secret):

1401

1234

try:

1402

1235

sent = session.send(client.secret[sent_size:])

1403

except gnutls.errors.GNUTLSError as error:

1236

except (gnutls.errors.GNUTLSError), error:

1404

1237

logger.warning("gnutls send failed")

1405

1238

return

1406

logger.debug("Sent: %d, remaining: %d",

1239

logger.debug(u"Sent: %d, remaining: %d",

1407

1240

sent, len(client.secret)

1408

1241

- (sent_size + sent))

1409

1242

sent_size += sent

1410

1411

logger.info("Sending secret to %s", client.name)

1243

1244

logger.info(u"Sending secret to %s", client.name)

1412

1245

# bump the timeout as if seen

1413

client.checked_ok(client.extended_timeout)

1246

client.checked_ok()

1414

1247

if self.server.use_dbus:

1415

1248

# Emit D-Bus signal

1416

1249

client.GotSecret()

1420

1253

client.approvals_pending -= 1

1421

1254

try:

1422

1255

session.bye()

1423

except gnutls.errors.GNUTLSError as error:

1424

logger.warning("GnuTLS bye failed")

1256

except (gnutls.errors.GNUTLSError), error:

1257

logger.warning("gnutls bye failed")

1425

1258

1426

1259

@staticmethod

1427

1260

def peer_certificate(session):

1437

1270

.gnutls_certificate_get_peers

1438

1271

(session._c_object, ctypes.byref(list_size)))

1439

1272

if not bool(cert_list) and list_size.value != 0:

1440

raise gnutls.errors.GNUTLSError("error getting peer"

1441

" certificate")

1273

raise gnutls.errors.GNUTLSError(u"error getting peer"

1274

u" certificate")

1442

1275

if list_size.value == 0:

1443

1276

return None

1444

1277

cert = cert_list[0]

1470

1303

if crtverify.value != 0:

1471

1304

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1472

1305

raise (gnutls.errors.CertificateSecurityError

1473

("Verify failed"))

1306

(u"Verify failed"))

1474

1307

# New buffer for the fingerprint

1475

1308

buf = ctypes.create_string_buffer(20)

1476

1309

buf_len = ctypes.c_size_t()

1483

1316

# Convert the buffer to a Python bytestring

1484

1317

fpr = ctypes.string_at(buf, buf_len.value)

1485

1318

# Convert the bytestring to hexadecimal notation

1486

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1319

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1487

1320

return hex_fpr

1488

1321

1489

1322

1501

1334

multiprocessing.Process(target = self.sub_process_main,

1502

1335

args = (request, address)).start()

1503

1336

1504

1505

1337

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1506

1338

""" adds a pipe to the MixIn """

1507

1339

def process_request(self, request, client_address):

1510

1342

This function creates a new pipe in self.pipe

1511

1343

"""

1512

1344

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1513

1345

1514

1346

super(MultiprocessingMixInWithPipe,

1515

1347

self).process_request(request, client_address)

1516

1348

self.child_pipe.close()

1517

1349

self.add_pipe(parent_pipe)

1518

1350

1519

1351

def add_pipe(self, parent_pipe):

1520

1352

"""Dummy function; override as necessary"""

1521

raise NotImplementedError

1522

1353

pass

1523

1354

1524

1355

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1525

1356

socketserver.TCPServer, object):

1543

1374

bind to an address or port if they were not specified."""

1544

1375

if self.interface is not None:

1545

1376

if SO_BINDTODEVICE is None:

1546

logger.error("SO_BINDTODEVICE does not exist;"

1547

" cannot bind to interface %s",

1377

logger.error(u"SO_BINDTODEVICE does not exist;"

1378

u" cannot bind to interface %s",

1548

1379

self.interface)

1549

1380

else:

1550

1381

try:

1551

1382

self.socket.setsockopt(socket.SOL_SOCKET,

1552

1383

SO_BINDTODEVICE,

1553

1384

str(self.interface

1554

+ '\0'))

1555

except socket.error as error:

1385

+ u'\0'))

1386

except socket.error, error:

1556

1387

if error[0] == errno.EPERM:

1557

logger.error("No permission to"

1558

" bind to interface %s",

1388

logger.error(u"No permission to"

1389

u" bind to interface %s",

1559

1390

self.interface)

1560

1391

elif error[0] == errno.ENOPROTOOPT:

1561

logger.error("SO_BINDTODEVICE not available;"

1562

" cannot bind to interface %s",

1392

logger.error(u"SO_BINDTODEVICE not available;"

1393

u" cannot bind to interface %s",

1563

1394

self.interface)

1564

1395

else:

1565

1396

raise

1567

1398

if self.server_address[0] or self.server_address[1]:

1568

1399

if not self.server_address[0]:

1569

1400

if self.address_family == socket.AF_INET6:

1570

any_address = "::" # in6addr_any

1401

any_address = u"::" # in6addr_any

1571

1402

else:

1572

1403

any_address = socket.INADDR_ANY

1573

1404

self.server_address = (any_address,

1622

1453

def handle_ipc(self, source, condition, parent_pipe=None,

1623

1454

client_object=None):

1624

1455

condition_names = {

1625

gobject.IO_IN: "IN", # There is data to read.

1626

gobject.IO_OUT: "OUT", # Data can be written (without

1456

gobject.IO_IN: u"IN", # There is data to read.

1457

gobject.IO_OUT: u"OUT", # Data can be written (without

1627

1458

# blocking).

1628

gobject.IO_PRI: "PRI", # There is urgent data to read.

1629

gobject.IO_ERR: "ERR", # Error condition.

1630

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1459

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1460

gobject.IO_ERR: u"ERR", # Error condition.

1461

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1631

1462

# broken, usually for pipes and

1632

1463

# sockets).

1633

1464

}

1635

1466

for cond, name in

1636

1467

condition_names.iteritems()

1637

1468

if cond & condition)

1469

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1470

conditions_string)

1471

1638

1472

# error or the other end of multiprocessing.Pipe has closed

1639

1473

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1640

1474

return False

1641

1475

1642

1476

# Read a request from the child

1643

1477

request = parent_pipe.recv()

1478

logger.debug(u"IPC request: %s", repr(request))

1644

1479

command = request[0]

1645

1480

1646

1481

if command == 'init':

1652

1487

client = c

1653

1488

break

1654

1489

else:

1655

logger.info("Client not found for fingerprint: %s, ad"

1656

"dress: %s", fpr, address)

1490

logger.warning(u"Client not found for fingerprint: %s, ad"

1491

u"dress: %s", fpr, address)

1657

1492

if self.use_dbus:

1658

1493

# Emit D-Bus signal

1659

mandos_dbus_service.ClientNotFound(fpr, address[0])

1494

mandos_dbus_service.ClientNotFound(fpr, address)

1660

1495

parent_pipe.send(False)

1661

1496

return False

1662

1497

1674

1509

kwargs = request[3]

1675

1510

1676

1511

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1677

1512

1678

1513

if command == 'getattr':

1679

1514

attrname = request[1]

1680

1515

if callable(client_object.__getattribute__(attrname)):

1686

1521

attrname = request[1]

1687

1522

value = request[2]

1688

1523

setattr(client_object, attrname, value)

1689

1524

1690

1525

return True

1691

1526

1692

1527

1693

1528

def string_to_delta(interval):

1694

1529

"""Parse a string and return a datetime.timedelta

1695

1530

1696

>>> string_to_delta('7d')

1531

>>> string_to_delta(u'7d')

1697

1532

datetime.timedelta(7)

1698

>>> string_to_delta('60s')

1533

>>> string_to_delta(u'60s')

1699

1534

datetime.timedelta(0, 60)

1700

>>> string_to_delta('60m')

1535

>>> string_to_delta(u'60m')

1701

1536

datetime.timedelta(0, 3600)

1702

>>> string_to_delta('24h')

1537

>>> string_to_delta(u'24h')

1703

1538

datetime.timedelta(1)

1704

>>> string_to_delta('1w')

1539

>>> string_to_delta(u'1w')

1705

1540

datetime.timedelta(7)

1706

>>> string_to_delta('5m 30s')

1541

>>> string_to_delta(u'5m 30s')

1707

1542

datetime.timedelta(0, 330)

1708

1543

"""

1709

1544

timevalue = datetime.timedelta(0)

1711

1546

try:

1712

1547

suffix = unicode(s[-1])

1713

1548

value = int(s[:-1])

1714

if suffix == "d":

1549

if suffix == u"d":

1715

1550

delta = datetime.timedelta(value)

1716

elif suffix == "s":

1551

elif suffix == u"s":

1717

1552

delta = datetime.timedelta(0, value)

1718

elif suffix == "m":

1553

elif suffix == u"m":

1719

1554

delta = datetime.timedelta(0, 0, 0, 0, value)

1720

elif suffix == "h":

1555

elif suffix == u"h":

1721

1556

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1722

elif suffix == "w":

1557

elif suffix == u"w":

1723

1558

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1724

1559

else:

1725

raise ValueError("Unknown suffix %r" % suffix)

1726

except (ValueError, IndexError) as e:

1727

raise ValueError(*(e.args))

1560

raise ValueError(u"Unknown suffix %r" % suffix)

1561

except (ValueError, IndexError), e:

1562

raise ValueError(e.message)

1728

1563

timevalue += delta

1729

1564

return timevalue

1730

1565

1736

1571

global if_nametoindex

1737

1572

try:

1738

1573

if_nametoindex = (ctypes.cdll.LoadLibrary

1739

(ctypes.util.find_library("c"))

1574

(ctypes.util.find_library(u"c"))

1740

1575

.if_nametoindex)

1741

1576

except (OSError, AttributeError):

1742

logger.warning("Doing if_nametoindex the hard way")

1577

logger.warning(u"Doing if_nametoindex the hard way")

1743

1578

def if_nametoindex(interface):

1744

1579

"Get an interface index the hard way, i.e. using fcntl()"

1745

1580

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1746

1581

with contextlib.closing(socket.socket()) as s:

1747

1582

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1748

struct.pack(str("16s16x"),

1583

struct.pack(str(u"16s16x"),

1749

1584

interface))

1750

interface_index = struct.unpack(str("I"),

1585

interface_index = struct.unpack(str(u"I"),

1751

1586

ifreq[16:20])[0]

1752

1587

return interface_index

1753

1588

return if_nametoindex(interface)

1761

1596

sys.exit()

1762

1597

os.setsid()

1763

1598

if not nochdir:

1764

os.chdir("/")

1599

os.chdir(u"/")

1765

1600

if os.fork():

1766

1601

sys.exit()

1767

1602

if not noclose:

1769

1604

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1770

1605

if not stat.S_ISCHR(os.fstat(null).st_mode):

1771

1606

raise OSError(errno.ENODEV,

1772

"%s not a character device"

1607

u"%s not a character device"

1773

1608

% os.path.devnull)

1774

1609

os.dup2(null, sys.stdin.fileno())

1775

1610

os.dup2(null, sys.stdout.fileno())

1783

1618

##################################################################

1784

1619

# Parsing of options, both command line and config file

1785

1620

1786

parser = argparse.ArgumentParser()

1787

parser.add_argument("-v", "--version", action="version",

1788

version = "%%(prog)s %s" % version,

1789

help="show version number and exit")

1790

parser.add_argument("-i", "--interface", metavar="IF",

1791

help="Bind to interface IF")

1792

parser.add_argument("-a", "--address",

1793

help="Address to listen for requests on")

1794

parser.add_argument("-p", "--port", type=int,

1795

help="Port number to receive requests on")

1796

parser.add_argument("--check", action="store_true",

1797

help="Run self-test")

1798

parser.add_argument("--debug", action="store_true",

1799

help="Debug mode; run in foreground and log"

1800

" to terminal")

1801

parser.add_argument("--debuglevel", metavar="LEVEL",

1802

help="Debug level for stdout output")

1803

parser.add_argument("--priority", help="GnuTLS"

1804

" priority string (see GnuTLS documentation)")

1805

parser.add_argument("--servicename",

1806

metavar="NAME", help="Zeroconf service name")

1807

parser.add_argument("--configdir",

1808

default="/etc/mandos", metavar="DIR",

1809

help="Directory to search for configuration"

1810

" files")

1811

parser.add_argument("--no-dbus", action="store_false",

1812

dest="use_dbus", help="Do not provide D-Bus"

1813

" system bus interface")

1814

parser.add_argument("--no-ipv6", action="store_false",

1815

dest="use_ipv6", help="Do not use IPv6")

1816

options = parser.parse_args()

1621

parser = optparse.OptionParser(version = "%%prog %s" % version)

1622

parser.add_option("-i", u"--interface", type=u"string",

1623

metavar="IF", help=u"Bind to interface IF")

1624

parser.add_option("-a", u"--address", type=u"string",

1625

help=u"Address to listen for requests on")

1626

parser.add_option("-p", u"--port", type=u"int",

1627

help=u"Port number to receive requests on")

1628

parser.add_option("--check", action=u"store_true",

1629

help=u"Run self-test")

1630

parser.add_option("--debug", action=u"store_true",

1631

help=u"Debug mode; run in foreground and log to"

1632

u" terminal")

1633

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1634

help=u"Debug level for stdout output")

1635

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1636

u" priority string (see GnuTLS documentation)")

1637

parser.add_option("--servicename", type=u"string",

1638

metavar=u"NAME", help=u"Zeroconf service name")

1639

parser.add_option("--configdir", type=u"string",

1640

default=u"/etc/mandos", metavar=u"DIR",

1641

help=u"Directory to search for configuration"

1642

u" files")

1643

parser.add_option("--no-dbus", action=u"store_false",

1644

dest=u"use_dbus", help=u"Do not provide D-Bus"

1645

u" system bus interface")

1646

parser.add_option("--no-ipv6", action=u"store_false",

1647

dest=u"use_ipv6", help=u"Do not use IPv6")

1648

options = parser.parse_args()[0]

1817

1649

1818

1650

if options.check:

1819

1651

import doctest

1821

1653

sys.exit()

1822

1654

1823

1655

# Default values for config file for server-global settings

1824

server_defaults = { "interface": "",

1825

"address": "",

1826

"port": "",

1827

"debug": "False",

1828

"priority":

1829

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1830

"servicename": "Mandos",

1831

"use_dbus": "True",

1832

"use_ipv6": "True",

1833

"debuglevel": "",

1656

server_defaults = { u"interface": u"",

1657

u"address": u"",

1658

u"port": u"",

1659

u"debug": u"False",

1660

u"priority":

1661

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1662

u"servicename": u"Mandos",

1663

u"use_dbus": u"True",

1664

u"use_ipv6": u"True",

1665

u"debuglevel": u"",

1834

1666

}

1835

1667

1836

1668

# Parse config file for server-global settings

1837

1669

server_config = configparser.SafeConfigParser(server_defaults)

1838

1670

del server_defaults

1839

1671

server_config.read(os.path.join(options.configdir,

1840

"mandos.conf"))

1672

u"mandos.conf"))

1841

1673

# Convert the SafeConfigParser object to a dict

1842

1674

server_settings = server_config.defaults()

1843

1675

# Use the appropriate methods on the non-string config options

1844

for option in ("debug", "use_dbus", "use_ipv6"):

1845

server_settings[option] = server_config.getboolean("DEFAULT",

1676

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1677

server_settings[option] = server_config.getboolean(u"DEFAULT",

1846

1678

option)

1847

1679

if server_settings["port"]:

1848

server_settings["port"] = server_config.getint("DEFAULT",

1849

"port")

1680

server_settings["port"] = server_config.getint(u"DEFAULT",

1681

u"port")

1850

1682

del server_config

1851

1683

1852

1684

# Override the settings from the config file with command line

1853

1685

# options, if set.

1854

for option in ("interface", "address", "port", "debug",

1855

"priority", "servicename", "configdir",

1856

"use_dbus", "use_ipv6", "debuglevel"):

1686

for option in (u"interface", u"address", u"port", u"debug",

1687

u"priority", u"servicename", u"configdir",

1688

u"use_dbus", u"use_ipv6", u"debuglevel"):

1857

1689

value = getattr(options, option)

1858

1690

if value is not None:

1859

1691

server_settings[option] = value

1867

1699

##################################################################

1868

1700

1869

1701

# For convenience

1870

debug = server_settings["debug"]

1871

debuglevel = server_settings["debuglevel"]

1872

use_dbus = server_settings["use_dbus"]

1873

use_ipv6 = server_settings["use_ipv6"]

1874

1875

if server_settings["servicename"] != "Mandos":

1702

debug = server_settings[u"debug"]

1703

debuglevel = server_settings[u"debuglevel"]

1704

use_dbus = server_settings[u"use_dbus"]

1705

use_ipv6 = server_settings[u"use_ipv6"]

1706

1707

if server_settings[u"servicename"] != u"Mandos":

1876

1708

syslogger.setFormatter(logging.Formatter

1877

('Mandos (%s) [%%(process)d]:'

1878

' %%(levelname)s: %%(message)s'

1879

% server_settings["servicename"]))

1709

(u'Mandos (%s) [%%(process)d]:'

1710

u' %%(levelname)s: %%(message)s'

1711

% server_settings[u"servicename"]))

1880

1712

1881

1713

# Parse config file with clients

1882

client_defaults = { "timeout": "5m",

1883

"extended_timeout": "15m",

1884

"interval": "2m",

1885

"checker": "fping -q -- %%(host)s",

1886

"host": "",

1887

"approval_delay": "0s",

1888

"approval_duration": "1s",

1714

client_defaults = { u"timeout": u"1h",

1715

u"interval": u"5m",

1716

u"checker": u"fping -q -- %%(host)s",

1717

u"host": u"",

1718

u"approved_delay": u"0s",

1719

u"approved_duration": u"1s",

1889

1720

}

1890

1721

client_config = configparser.SafeConfigParser(client_defaults)

1891

client_config.read(os.path.join(server_settings["configdir"],

1892

"clients.conf"))

1722

client_config.read(os.path.join(server_settings[u"configdir"],

1723

u"clients.conf"))

1893

1724

1894

1725

global mandos_dbus_service

1895

1726

mandos_dbus_service = None

1896

1727

1897

tcp_server = MandosServer((server_settings["address"],

1898

server_settings["port"]),

1728

tcp_server = MandosServer((server_settings[u"address"],

1729

server_settings[u"port"]),

1899

1730

ClientHandler,

1900

interface=(server_settings["interface"]

1901

or None),

1731

interface=server_settings[u"interface"],

1902

1732

use_ipv6=use_ipv6,

1903

1733

gnutls_priority=

1904

server_settings["priority"],

1734

server_settings[u"priority"],

1905

1735

use_dbus=use_dbus)

1906

if not debug:

1907

pidfilename = "/var/run/mandos.pid"

1908

try:

1909

pidfile = open(pidfilename, "w")

1910

except IOError:

1911

logger.error("Could not open file %r", pidfilename)

1736

pidfilename = u"/var/run/mandos.pid"

1737

try:

1738

pidfile = open(pidfilename, u"w")

1739

except IOError:

1740

logger.error(u"Could not open file %r", pidfilename)

1912

1741

1913

1742

try:

1914

uid = pwd.getpwnam("_mandos").pw_uid

1915

gid = pwd.getpwnam("_mandos").pw_gid

1743

uid = pwd.getpwnam(u"_mandos").pw_uid

1744

gid = pwd.getpwnam(u"_mandos").pw_gid

1916

1745

except KeyError:

1917

1746

try:

1918

uid = pwd.getpwnam("mandos").pw_uid

1919

gid = pwd.getpwnam("mandos").pw_gid

1747

uid = pwd.getpwnam(u"mandos").pw_uid

1748

gid = pwd.getpwnam(u"mandos").pw_gid

1920

1749

except KeyError:

1921

1750

try:

1922

uid = pwd.getpwnam("nobody").pw_uid

1923

gid = pwd.getpwnam("nobody").pw_gid

1751

uid = pwd.getpwnam(u"nobody").pw_uid

1752

gid = pwd.getpwnam(u"nobody").pw_gid

1924

1753

except KeyError:

1925

1754

uid = 65534

1926

1755

gid = 65534

1927

1756

try:

1928

1757

os.setgid(gid)

1929

1758

os.setuid(uid)

1930

except OSError as error:

1759

except OSError, error:

1931

1760

if error[0] != errno.EPERM:

1932

1761

raise error

1933

1762

1763

# Enable all possible GnuTLS debugging

1764

1765

1934

1766

if not debug and not debuglevel:

1935

1767

syslogger.setLevel(logging.WARNING)

1936

1768

console.setLevel(logging.WARNING)

1938

1770

level = getattr(logging, debuglevel.upper())

1939

1771

syslogger.setLevel(level)

1940

1772

console.setLevel(level)

1941

1773

1942

1774

if debug:

1943

# Enable all possible GnuTLS debugging

1944

1945

1775

# "Use a log level over 10 to enable all debugging options."

1946

1776

# - GnuTLS manual

1947

1777

gnutls.library.functions.gnutls_global_set_log_level(11)

1948

1778

1949

1779

@gnutls.library.types.gnutls_log_func

1950

1780

def debug_gnutls(level, string):

1951

logger.debug("GnuTLS: %s", string[:-1])

1781

logger.debug(u"GnuTLS: %s", string[:-1])

1952

1782

1953

1783

(gnutls.library.functions

1954

1784

.gnutls_global_set_log_function(debug_gnutls))

1955

1785

1956

1786

# Redirect stdin so all checkers get /dev/null

1957

1787

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1958

1788

os.dup2(null, sys.stdin.fileno())

1961

1791

else:

1962

1792

# No console logging

1963

1793

logger.removeHandler(console)

1964

1965

# Need to fork before connecting to D-Bus

1966

if not debug:

1967

# Close all input and output, do double fork, etc.

1968

daemon()

1794

1969

1795

1970

1796

global main_loop

1971

1797

# From the Avahi example code

1975

1801

# End of Avahi example code

1976

1802

if use_dbus:

1977

1803

try:

1978

bus_name = dbus.service.BusName("se.recompile.Mandos",

1804

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1979

1805

bus, do_not_queue=True)

1980

old_bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1981

bus, do_not_queue=True)

1982

except dbus.exceptions.NameExistsException as e:

1983

logger.error(unicode(e) + ", disabling D-Bus")

1806

except dbus.exceptions.NameExistsException, e:

1807

logger.error(unicode(e) + u", disabling D-Bus")

1984

1808

use_dbus = False

1985

server_settings["use_dbus"] = False

1809

server_settings[u"use_dbus"] = False

1986

1810

tcp_server.use_dbus = False

1987

1811

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1988

service = AvahiService(name = server_settings["servicename"],

1989

servicetype = "_mandos._tcp",

1812

service = AvahiService(name = server_settings[u"servicename"],

1813

servicetype = u"_mandos._tcp",

1990

1814

protocol = protocol, bus = bus)

1991

1815

if server_settings["interface"]:

1992

1816

service.interface = (if_nametoindex

1993

(str(server_settings["interface"])))

1994

1817

(str(server_settings[u"interface"])))

1818

1819

if not debug:

1820

# Close all input and output, do double fork, etc.

1821

daemon()

1822

1995

1823

global multiprocessing_manager

1996

1824

multiprocessing_manager = multiprocessing.Manager()

1997

1825

1998

1826

client_class = Client

1999

1827

if use_dbus:

2000

client_class = functools.partial(ClientDBusTransitional, bus = bus)

1828

client_class = functools.partial(ClientDBus, bus = bus)

2001

1829

def client_config_items(config, section):

2002

1830

special_settings = {

2003

1831

"approved_by_default":

2016

1844

client_config, section)))

2017

1845

for section in client_config.sections()))

2018

1846

if not tcp_server.clients:

2019

logger.warning("No clients defined")

1847

logger.warning(u"No clients defined")

2020

1848

1849

try:

1850

with pidfile:

1851

pid = os.getpid()

1852

pidfile.write(str(pid) + "\n")

1853

del pidfile

1854

except IOError:

1855

logger.error(u"Could not write to file %r with PID %d",

1856

pidfilename, pid)

1857

except NameError:

1858

# "pidfile" was never created

1859

pass

1860

del pidfilename

1861

2021

1862

if not debug:

2022

try:

2023

with pidfile:

2024

pid = os.getpid()

2025

pidfile.write(str(pid) + "\n".encode("utf-8"))

2026

del pidfile

2027

except IOError:

2028

logger.error("Could not write to file %r with PID %d",

2029

pidfilename, pid)

2030

except NameError:

2031

# "pidfile" was never created

2032

pass

2033

del pidfilename

2034

2035

1863

signal.signal(signal.SIGINT, signal.SIG_IGN)

2036

2037

1864

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2038

1865

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2039

1866

2041

1868

class MandosDBusService(dbus.service.Object):

2042

1869

"""A D-Bus proxy object"""

2043

1870

def __init__(self):

2044

dbus.service.Object.__init__(self, bus, "/")

2045

_interface = "se.recompile.Mandos"

1871

dbus.service.Object.__init__(self, bus, u"/")

1872

_interface = u"se.bsnet.fukt.Mandos"

2046

1873

2047

@dbus.service.signal(_interface, signature="o")

1874

@dbus.service.signal(_interface, signature=u"o")

2048

1875

def ClientAdded(self, objpath):

2049

1876

"D-Bus signal"

2050

1877

pass

2051

1878

2052

@dbus.service.signal(_interface, signature="ss")

1879

@dbus.service.signal(_interface, signature=u"ss")

2053

1880

def ClientNotFound(self, fingerprint, address):

2054

1881

"D-Bus signal"

2055

1882

pass

2056

1883

2057

@dbus.service.signal(_interface, signature="os")

1884

@dbus.service.signal(_interface, signature=u"os")

2058

1885

def ClientRemoved(self, objpath, name):

2059

1886

"D-Bus signal"

2060

1887

pass

2061

1888

2062

@dbus.service.method(_interface, out_signature="ao")

1889

@dbus.service.method(_interface, out_signature=u"ao")

2063

1890

def GetAllClients(self):

2064

1891

"D-Bus method"

2065

1892

return dbus.Array(c.dbus_object_path

2066

1893

for c in tcp_server.clients)

2067

1894

2068

1895

@dbus.service.method(_interface,

2069

out_signature="a{oa{sv}}")

1896

out_signature=u"a{oa{sv}}")

2070

1897

def GetAllClientsWithProperties(self):

2071

1898

"D-Bus method"

2072

1899

return dbus.Dictionary(

2073

((c.dbus_object_path, c.GetAll(""))

1900

((c.dbus_object_path, c.GetAll(u""))

2074

1901

for c in tcp_server.clients),

2075

signature="oa{sv}")

1902

signature=u"oa{sv}")

2076

1903

2077

@dbus.service.method(_interface, in_signature="o")

1904

@dbus.service.method(_interface, in_signature=u"o")

2078

1905

def RemoveClient(self, object_path):

2079

1906

"D-Bus method"

2080

1907

for c in tcp_server.clients:

2090

1917

2091

1918

del _interface

2092

1919

2093

class MandosDBusServiceTransitional(MandosDBusService):

2094

__metaclass__ = AlternateDBusNamesMetaclass

2095

mandos_dbus_service = MandosDBusServiceTransitional()

1920

mandos_dbus_service = MandosDBusService()

2096

1921

2097

1922

def cleanup():

2098

1923

"Cleanup function; run on exit"

2124

1949

# Find out what port we got

2125

1950

service.port = tcp_server.socket.getsockname()[1]

2126

1951

if use_ipv6:

2127

logger.info("Now listening on address %r, port %d,"

1952

logger.info(u"Now listening on address %r, port %d,"

2128

1953

" flowinfo %d, scope_id %d"

2129

1954

% tcp_server.socket.getsockname())

2130

1955

else: # IPv4

2131

logger.info("Now listening on address %r, port %d"

1956

logger.info(u"Now listening on address %r, port %d"

2132

1957

% tcp_server.socket.getsockname())

2133

1958

2134

1959

#service.interface = tcp_server.socket.getsockname()[3]

2137

1962

# From the Avahi example code

2138

1963

try:

2139

1964

service.activate()

2140

except dbus.exceptions.DBusException as error:

2141

logger.critical("DBusException: %s", error)

1965

except dbus.exceptions.DBusException, error:

1966

logger.critical(u"DBusException: %s", error)

2142

1967

cleanup()

2143

1968

sys.exit(1)

2144

1969

# End of Avahi example code

2148

1973

(tcp_server.handle_request

2149

1974

(*args[2:], **kwargs) or True))

2150

1975

2151

logger.debug("Starting main loop")

1976

logger.debug(u"Starting main loop")

2152

1977

main_loop.run()

2153

except AvahiError as error:

2154

logger.critical("AvahiError: %s", error)

1978

except AvahiError, error:

1979

logger.critical(u"AvahiError: %s", error)

2155

1980

cleanup()

2156

1981

sys.exit(1)

2157

1982

except KeyboardInterrupt:

2158

1983

if debug:

2159

print("", file=sys.stderr)

2160

logger.debug("Server received KeyboardInterrupt")

2161

logger.debug("Server exiting")

1984

print >> sys.stderr

1985

logger.debug(u"Server received KeyboardInterrupt")

1986

logger.debug(u"Server exiting")

2162

1987

# Must run before the D-Bus bus name gets deregistered

2163

1988

cleanup()

2164

1989

2165

2166

1990

if __name__ == '__main__':

2167

1991

main()