/mandos/release : revision 24.1.158

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

62

61

import functools

63

62

import cPickle as pickle

64

63

import multiprocessing

65

import types

66

64

67

65

import dbus

68

66

import dbus.service

83

81

SO_BINDTODEVICE = None

84

82

85

83

86

version = "1.4.1"

84

version = "1.0.14"

87

85

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

90

88

syslogger = (logging.handlers.SysLogHandler

91

89

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

address = str("/dev/log")))

90

address = "/dev/log"))

93

91

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

96

94

logger.addHandler(syslogger)

97

95

98

96

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

102

100

logger.addHandler(console)

103

101

104

102

class AvahiError(Exception):

121

119

Attributes:

122

120

interface: integer; avahi.IF_UNSPEC or an interface index.

123

121

Used to optionally bind to the specified interface.

124

125

type: string; Example: '_mandos._tcp'.

122

123

type: string; Example: u'_mandos._tcp'.

126

124

See <http://www.dns-sd.org/ServiceTypes.html>

127

125

port: integer; what port to announce

128

126

TXT: list of strings; TXT record for the service

137

135

"""

138

136

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

139

137

servicetype = None, port = None, TXT = None,

140

domain = "", host = "", max_renames = 32768,

138

domain = u"", host = u"", max_renames = 32768,

141

139

protocol = avahi.PROTO_UNSPEC, bus = None):

142

140

self.interface = interface

143

141

self.name = name

152

150

self.group = None # our entry group

153

151

self.server = None

154

152

self.bus = bus

155

self.entry_group_state_changed_match = None

156

153

def rename(self):

157

154

"""Derived from the Avahi example code"""

158

155

if self.rename_count >= self.max_renames:

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

161

158

self.rename_count)

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server

164

.GetAlternativeServiceName(self.name))

165

logger.info("Changing Zeroconf service name to %r ...",

159

raise AvahiServiceError(u"Too many renames")

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

166

162

self.name)

167

163

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

170

166

% self.name))

171

167

self.remove()

172

try:

173

self.add()

174

except dbus.exceptions.DBusException as error:

175

logger.critical("DBusException: %s", error)

176

self.cleanup()

177

os._exit(1)

168

self.add()

178

169

self.rename_count += 1

179

170

def remove(self):

180

171

"""Derived from the Avahi example code"""

181

if self.entry_group_state_changed_match is not None:

182

self.entry_group_state_changed_match.remove()

183

self.entry_group_state_changed_match = None

184

172

if self.group is not None:

185

173

self.group.Reset()

186

174

def add(self):

187

175

"""Derived from the Avahi example code"""

188

self.remove()

189

176

if self.group is None:

190

177

self.group = dbus.Interface(

191

178

self.bus.get_object(avahi.DBUS_NAME,

192

179

self.server.EntryGroupNew()),

193

180

avahi.DBUS_INTERFACE_ENTRY_GROUP)

194

self.entry_group_state_changed_match = (

195

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

181

self.group.connect_to_signal('StateChanged',

182

self

183

.entry_group_state_changed)

184

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

198

185

self.name, self.type)

199

186

self.group.AddService(

200

187

self.interface,

207

194

self.group.Commit()

208

195

def entry_group_state_changed(self, state, error):

209

196

"""Derived from the Avahi example code"""

210

logger.debug("Avahi entry group state change: %i", state)

197

logger.debug(u"Avahi entry group state change: %i", state)

211

198

212

199

if state == avahi.ENTRY_GROUP_ESTABLISHED:

213

logger.debug("Zeroconf service established.")

200

logger.debug(u"Zeroconf service established.")

214

201

elif state == avahi.ENTRY_GROUP_COLLISION:

215

logger.info("Zeroconf service name collision.")

202

logger.warning(u"Zeroconf service name collision.")

216

203

self.rename()

217

204

elif state == avahi.ENTRY_GROUP_FAILURE:

218

logger.critical("Avahi: Error in group state changed %s",

205

logger.critical(u"Avahi: Error in group state changed %s",

219

206

unicode(error))

220

raise AvahiGroupError("State changed: %s"

207

raise AvahiGroupError(u"State changed: %s"

221

208

% unicode(error))

222

209

def cleanup(self):

223

210

"""Derived from the Avahi example code"""

224

211

if self.group is not None:

225

try:

226

self.group.Free()

227

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

229

pass

212

self.group.Free()

230

213

self.group = None

231

self.remove()

232

def server_state_changed(self, state, error=None):

214

def server_state_changed(self, state):

233

215

"""Derived from the Avahi example code"""

234

logger.debug("Avahi server state change: %i", state)

235

bad_states = { avahi.SERVER_INVALID:

236

"Zeroconf server invalid",

237

avahi.SERVER_REGISTERING: None,

238

avahi.SERVER_COLLISION:

239

"Zeroconf server name collision",

240

avahi.SERVER_FAILURE:

241

"Zeroconf server failure" }

242

if state in bad_states:

243

if bad_states[state] is not None:

244

if error is None:

245

logger.error(bad_states[state])

246

else:

247

logger.error(bad_states[state] + ": %r", error)

248

self.cleanup()

216

logger.debug(u"Avahi server state change: %i", state)

217

if state == avahi.SERVER_COLLISION:

218

logger.error(u"Zeroconf server name collision")

219

self.remove()

249

220

elif state == avahi.SERVER_RUNNING:

250

221

self.add()

251

else:

252

if error is None:

253

logger.debug("Unknown state: %r", state)

254

else:

255

logger.debug("Unknown state: %r: %r", state, error)

256

222

def activate(self):

257

223

"""Derived from the Avahi example code"""

258

224

if self.server is None:

259

225

self.server = dbus.Interface(

260

226

self.bus.get_object(avahi.DBUS_NAME,

261

avahi.DBUS_PATH_SERVER,

262

follow_name_owner_changes=True),

227

avahi.DBUS_PATH_SERVER),

263

228

avahi.DBUS_INTERFACE_SERVER)

264

self.server.connect_to_signal("StateChanged",

229

self.server.connect_to_signal(u"StateChanged",

265

230

self.server_state_changed)

266

231

self.server_state_changed(self.server.GetState())

267

232

268

233

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

274

275

234

class Client(object):

276

235

"""A representation of a client host served by this server.

277

236

278

237

Attributes:

279

_approved: bool(); 'None' if not yet approved/disapproved

280

approval_delay: datetime.timedelta(); Time to wait for approval

281

approval_duration: datetime.timedelta(); Duration of one approval

238

239

D-Bus identifiers

240

fingerprint: string (40 or 32 hexadecimal digits); used to

241

uniquely identify the client

242

secret: bytestring; sent verbatim (over TLS) to client

243

host: string; available for use by the checker command

244

created: datetime.datetime(); (UTC) object creation

245

last_enabled: datetime.datetime(); (UTC)

246

enabled: bool()

247

last_checked_ok: datetime.datetime(); (UTC) or None

248

timeout: datetime.timedelta(); How long from last_checked_ok

249

until this client is disabled

250

interval: datetime.timedelta(); How often to start a new checker

251

disable_hook: If set, called by disable() as disable_hook(self)

282

252

checker: subprocess.Popen(); a running checker process used

283

253

to see if the client lives.

284

254

'None' if no process is running.

285

checker_callback_tag: a gobject event source tag, or None

286

checker_command: string; External command which is run to check

287

if client lives. %() expansions are done at

255

checker_initiator_tag: a gobject event source tag, or None

256

disable_initiator_tag: - '' -

257

checker_callback_tag: - '' -

258

checker_command: string; External command which is run to check if

259

client lives. %() expansions are done at

288

260

runtime with vars(self) as dict, so that for

289

261

instance %(name)s can be used in the command.

290

checker_initiator_tag: a gobject event source tag, or None

291

created: datetime.datetime(); (UTC) object creation

292

262

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

294

disable_initiator_tag: a gobject event source tag, or None

295

enabled: bool()

296

fingerprint: string (40 or 32 hexadecimal digits); used to

297

uniquely identify the client

298

host: string; available for use by the checker command

299

interval: datetime.timedelta(); How often to start a new checker

300

last_approval_request: datetime.datetime(); (UTC) or None

301

last_checked_ok: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

303

304

D-Bus identifiers

305

secret: bytestring; sent verbatim (over TLS) to client

306

timeout: datetime.timedelta(); How long from last_checked_ok

307

until this client is disabled

308

extended_timeout: extra long timeout when password has been sent

309

runtime_expansions: Allowed attributes for runtime expansion.

310

expires: datetime.datetime(); time (UTC) when a client will be

311

disabled, or None

263

approved_delay: datetime.timedelta(); Time to wait for approval

264

_approved: bool(); 'None' if not yet approved/disapproved

265

approved_duration: datetime.timedelta(); Duration of one approval

312

266

"""

313

267

314

runtime_expansions = ("approval_delay", "approval_duration",

315

"created", "enabled", "fingerprint",

316

"host", "interval", "last_checked_ok",

317

"last_enabled", "name", "timeout")

268

@staticmethod

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

318

274

319

275

def timeout_milliseconds(self):

320

276

"Return the 'timeout' attribute in milliseconds"

321

return _timedelta_to_milliseconds(self.timeout)

322

323

def extended_timeout_milliseconds(self):

324

"Return the 'extended_timeout' attribute in milliseconds"

325

return _timedelta_to_milliseconds(self.extended_timeout)

277

return self._timedelta_to_milliseconds(self.timeout)

326

278

327

279

def interval_milliseconds(self):

328

280

"Return the 'interval' attribute in milliseconds"

329

return _timedelta_to_milliseconds(self.interval)

330

331

def approval_delay_milliseconds(self):

332

return _timedelta_to_milliseconds(self.approval_delay)

281

return self._timedelta_to_milliseconds(self.interval)

282

283

def approved_delay_milliseconds(self):

284

return self._timedelta_to_milliseconds(self.approved_delay)

333

285

334

286

def __init__(self, name = None, disable_hook=None, config=None):

335

287

"""Note: the 'checker' key in 'config' sets the

338

290

self.name = name

339

291

if config is None:

340

292

config = {}

341

logger.debug("Creating client %r", self.name)

293

logger.debug(u"Creating client %r", self.name)

342

294

# Uppercase and remove spaces from fingerprint for later

343

295

# comparison purposes with return value from the fingerprint()

344

296

# function

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

347

logger.debug(" Fingerprint: %s", self.fingerprint)

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

297

self.fingerprint = (config[u"fingerprint"].upper()

298

.replace(u" ", u""))

299

logger.debug(u" Fingerprint: %s", self.fingerprint)

300

if u"secret" in config:

301

self.secret = config[u"secret"].decode(u"base64")

302

elif u"secfile" in config:

351

303

with open(os.path.expanduser(os.path.expandvars

352

(config["secfile"])),

304

(config[u"secfile"])),

353

305

"rb") as secfile:

354

306

self.secret = secfile.read()

355

307

else:

356

raise TypeError("No secret or secfile for client %s"

308

raise TypeError(u"No secret or secfile for client %s"

357

309

% self.name)

358

self.host = config.get("host", "")

310

self.host = config.get(u"host", u"")

359

311

self.created = datetime.datetime.utcnow()

360

312

self.enabled = False

361

self.last_approval_request = None

362

313

self.last_enabled = None

363

314

self.last_checked_ok = None

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

315

self.timeout = string_to_delta(config[u"timeout"])

316

self.interval = string_to_delta(config[u"interval"])

368

317

self.disable_hook = disable_hook

369

318

self.checker = None

370

319

self.checker_initiator_tag = None

371

320

self.disable_initiator_tag = None

372

self.expires = None

373

321

self.checker_callback_tag = None

374

self.checker_command = config["checker"]

322

self.checker_command = config[u"checker"]

375

323

self.current_checker_command = None

376

324

self.last_connect = None

377

325

self._approved = None

378

self.approved_by_default = config.get("approved_by_default",

326

self.approved_by_default = config.get(u"approved_by_default",

379

327

True)

380

328

self.approvals_pending = 0

381

self.approval_delay = string_to_delta(

382

config["approval_delay"])

383

self.approval_duration = string_to_delta(

384

config["approval_duration"])

385

self.changedstate = (multiprocessing_manager

386

.Condition(multiprocessing_manager

387

.Lock()))

329

self.approved_delay = string_to_delta(

330

config[u"approved_delay"])

331

self.approved_duration = string_to_delta(

332

config[u"approved_duration"])

333

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

388

334

389

335

def send_changedstate(self):

390

336

self.changedstate.acquire()

391

337

self.changedstate.notify_all()

392

338

self.changedstate.release()

393

339

394

340

def enable(self):

395

341

"""Start this client's checker and timeout hooks"""

396

if getattr(self, "enabled", False):

342

if getattr(self, u"enabled", False):

397

343

# Already enabled

398

344

return

399

345

self.send_changedstate()

346

self.last_enabled = datetime.datetime.utcnow()

400

347

# Schedule a new checker to be started an 'interval' from now,

401

348

# and every interval from then on.

402

349

self.checker_initiator_tag = (gobject.timeout_add

403

350

(self.interval_milliseconds(),

404

351

self.start_checker))

405

352

# Schedule a disable() when 'timeout' has passed

406

self.expires = datetime.datetime.utcnow() + self.timeout

407

353

self.disable_initiator_tag = (gobject.timeout_add

408

354

(self.timeout_milliseconds(),

409

355

self.disable))

410

356

self.enabled = True

411

self.last_enabled = datetime.datetime.utcnow()

412

357

# Also start a new checker *right now*.

413

358

self.start_checker()

414

359

419

364

if not quiet:

420

365

self.send_changedstate()

421

366

if not quiet:

422

logger.info("Disabling client %s", self.name)

423

if getattr(self, "disable_initiator_tag", False):

367

logger.info(u"Disabling client %s", self.name)

368

if getattr(self, u"disable_initiator_tag", False):

424

369

gobject.source_remove(self.disable_initiator_tag)

425

370

self.disable_initiator_tag = None

426

self.expires = None

427

if getattr(self, "checker_initiator_tag", False):

371

if getattr(self, u"checker_initiator_tag", False):

428

372

gobject.source_remove(self.checker_initiator_tag)

429

373

self.checker_initiator_tag = None

430

374

self.stop_checker()

445

389

if os.WIFEXITED(condition):

446

390

exitstatus = os.WEXITSTATUS(condition)

447

391

if exitstatus == 0:

448

logger.info("Checker for %(name)s succeeded",

392

logger.info(u"Checker for %(name)s succeeded",

449

393

vars(self))

450

394

self.checked_ok()

451

395

else:

452

logger.info("Checker for %(name)s failed",

396

logger.info(u"Checker for %(name)s failed",

453

397

vars(self))

454

398

else:

455

logger.warning("Checker for %(name)s crashed?",

399

logger.warning(u"Checker for %(name)s crashed?",

456

400

vars(self))

457

401

458

def checked_ok(self, timeout=None):

402

def checked_ok(self):

459

403

"""Bump up the timeout for this client.

460

404

461

405

This should only be called when the client has been seen,

462

406

alive and well.

463

407

"""

464

if timeout is None:

465

timeout = self.timeout

466

408

self.last_checked_ok = datetime.datetime.utcnow()

467

if self.disable_initiator_tag is not None:

468

gobject.source_remove(self.disable_initiator_tag)

469

if getattr(self, "enabled", False):

470

self.disable_initiator_tag = (gobject.timeout_add

471

(_timedelta_to_milliseconds

472

(timeout), self.disable))

473

self.expires = datetime.datetime.utcnow() + timeout

474

475

def need_approval(self):

476

self.last_approval_request = datetime.datetime.utcnow()

409

gobject.source_remove(self.disable_initiator_tag)

410

self.disable_initiator_tag = (gobject.timeout_add

411

(self.timeout_milliseconds(),

412

self.disable))

477

413

478

414

def start_checker(self):

479

415

"""Start a new checker subprocess if one is not running.

492

428

# If a checker exists, make sure it is not a zombie

493

429

try:

494

430

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

495

except (AttributeError, OSError) as error:

431

except (AttributeError, OSError), error:

496

432

if (isinstance(error, OSError)

497

433

and error.errno != errno.ECHILD):

498

434

raise error

499

435

else:

500

436

if pid:

501

logger.warning("Checker was a zombie")

437

logger.warning(u"Checker was a zombie")

502

438

gobject.source_remove(self.checker_callback_tag)

503

439

self.checker_callback(pid, status,

504

440

self.current_checker_command)

509

445

command = self.checker_command % self.host

510

446

except TypeError:

511

447

# Escape attributes for the shell

512

escaped_attrs = dict(

513

(attr,

514

re.escape(unicode(str(getattr(self, attr, "")),

515

errors=

516

'replace')))

517

for attr in

518

self.runtime_expansions)

519

448

escaped_attrs = dict((key,

449

re.escape(unicode(str(val),

450

errors=

451

u'replace')))

452

for key, val in

453

vars(self).iteritems())

520

454

try:

521

455

command = self.checker_command % escaped_attrs

522

except TypeError as error:

523

logger.error('Could not format string "%s":'

524

' %s', self.checker_command, error)

456

except TypeError, error:

457

logger.error(u'Could not format string "%s":'

458

u' %s', self.checker_command, error)

525

459

return True # Try again later

526

460

self.current_checker_command = command

527

461

try:

528

logger.info("Starting checker %r for %s",

462

logger.info(u"Starting checker %r for %s",

529

463

command, self.name)

530

464

# We don't need to redirect stdout and stderr, since

531

465

# in normal mode, that is already done by daemon(),

533

467

# always replaced by /dev/null.)

534

468

self.checker = subprocess.Popen(command,

535

469

close_fds=True,

536

shell=True, cwd="/")

470

shell=True, cwd=u"/")

537

471

self.checker_callback_tag = (gobject.child_watch_add

538

472

(self.checker.pid,

539

473

self.checker_callback,

544

478

if pid:

545

479

gobject.source_remove(self.checker_callback_tag)

546

480

self.checker_callback(pid, status, command)

547

except OSError as error:

548

logger.error("Failed to start subprocess: %s",

481

except OSError, error:

482

logger.error(u"Failed to start subprocess: %s",

549

483

error)

550

484

# Re-run this periodically if run by gobject.timeout_add

551

485

return True

555

489

if self.checker_callback_tag:

556

490

gobject.source_remove(self.checker_callback_tag)

557

491

self.checker_callback_tag = None

558

if getattr(self, "checker", None) is None:

492

if getattr(self, u"checker", None) is None:

559

493

return

560

logger.debug("Stopping checker for %(name)s", vars(self))

494

logger.debug(u"Stopping checker for %(name)s", vars(self))

561

495

try:

562

496

os.kill(self.checker.pid, signal.SIGTERM)

563

497

#time.sleep(0.5)

564

498

#if self.checker.poll() is None:

565

499

# os.kill(self.checker.pid, signal.SIGKILL)

566

except OSError as error:

500

except OSError, error:

567

501

if error.errno != errno.ESRCH: # No such process

568

502

raise

569

503

self.checker = None

570

504

571

572

def dbus_service_property(dbus_interface, signature="v",

573

access="readwrite", byte_arrays=False):

505

def dbus_service_property(dbus_interface, signature=u"v",

506

access=u"readwrite", byte_arrays=False):

574

507

"""Decorators for marking methods of a DBusObjectWithProperties to

575

508

become properties on the D-Bus.

576

509

583

516

"""

584

517

# Encoding deeply encoded byte arrays is not supported yet by the

585

518

# "Set" method, so we fail early here:

586

if byte_arrays and signature != "ay":

587

raise ValueError("Byte arrays not supported for non-'ay'"

588

" signature %r" % signature)

519

if byte_arrays and signature != u"ay":

520

raise ValueError(u"Byte arrays not supported for non-'ay'"

521

u" signature %r" % signature)

589

522

def decorator(func):

590

523

func._dbus_is_property = True

591

524

func._dbus_interface = dbus_interface

592

525

func._dbus_signature = signature

593

526

func._dbus_access = access

594

527

func._dbus_name = func.__name__

595

if func._dbus_name.endswith("_dbus_property"):

528

if func._dbus_name.endswith(u"_dbus_property"):

596

529

func._dbus_name = func._dbus_name[:-14]

597

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

530

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

598

531

return func

599

532

return decorator

600

533

620

553

621

554

class DBusObjectWithProperties(dbus.service.Object):

622

555

"""A D-Bus object with properties.

623

556

624

557

Classes inheriting from this can use the dbus_service_property

625

558

decorator to expose methods as D-Bus properties. It exposes the

626

559

standard Get(), Set(), and GetAll() methods on the D-Bus.

628

561

629

562

@staticmethod

630

563

def _is_dbus_property(obj):

631

return getattr(obj, "_dbus_is_property", False)

564

return getattr(obj, u"_dbus_is_property", False)

632

565

633

566

def _get_all_dbus_properties(self):

634

567

"""Returns a generator of (name, attribute) pairs

635

568

"""

636

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

637

for cls in self.__class__.__mro__

569

return ((prop._dbus_name, prop)

638

570

for name, prop in

639

inspect.getmembers(cls, self._is_dbus_property))

571

inspect.getmembers(self, self._is_dbus_property))

640

572

641

573

def _get_dbus_property(self, interface_name, property_name):

642

574

"""Returns a bound method if one exists which is a D-Bus

643

575

property with the specified name and interface.

644

576

"""

645

for cls in self.__class__.__mro__:

646

for name, value in (inspect.getmembers

647

(cls, self._is_dbus_property)):

648

if (value._dbus_name == property_name

649

and value._dbus_interface == interface_name):

650

return value.__get__(self)

651

577

for name in (property_name,

578

property_name + u"_dbus_property"):

579

prop = getattr(self, name, None)

580

if (prop is None

581

or not self._is_dbus_property(prop)

582

or prop._dbus_name != property_name

583

or (interface_name and prop._dbus_interface

584

and interface_name != prop._dbus_interface)):

585

continue

586

return prop

652

587

# No such property

653

raise DBusPropertyNotFound(self.dbus_object_path + ":"

654

+ interface_name + "."

588

raise DBusPropertyNotFound(self.dbus_object_path + u":"

589

+ interface_name + u"."

655

590

+ property_name)

656

591

657

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

658

out_signature="v")

592

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

593

out_signature=u"v")

659

594

def Get(self, interface_name, property_name):

660

595

"""Standard D-Bus property Get() method, see D-Bus standard.

661

596

"""

662

597

prop = self._get_dbus_property(interface_name, property_name)

663

if prop._dbus_access == "write":

598

if prop._dbus_access == u"write":

664

599

raise DBusPropertyAccessException(property_name)

665

600

value = prop()

666

if not hasattr(value, "variant_level"):

601

if not hasattr(value, u"variant_level"):

667

602

return value

668

603

return type(value)(value, variant_level=value.variant_level+1)

669

604

670

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

605

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

671

606

def Set(self, interface_name, property_name, value):

672

607

"""Standard D-Bus property Set() method, see D-Bus standard.

673

608

"""

674

609

prop = self._get_dbus_property(interface_name, property_name)

675

if prop._dbus_access == "read":

610

if prop._dbus_access == u"read":

676

611

raise DBusPropertyAccessException(property_name)

677

if prop._dbus_get_args_options["byte_arrays"]:

612

if prop._dbus_get_args_options[u"byte_arrays"]:

678

613

# The byte_arrays option is not supported yet on

679

614

# signatures other than "ay".

680

if prop._dbus_signature != "ay":

615

if prop._dbus_signature != u"ay":

681

616

raise ValueError

682

617

value = dbus.ByteArray(''.join(unichr(byte)

683

618

for byte in value))

684

619

prop(value)

685

620

686

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

687

out_signature="a{sv}")

621

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

622

out_signature=u"a{sv}")

688

623

def GetAll(self, interface_name):

689

624

"""Standard D-Bus property GetAll() method, see D-Bus

690

625

standard.

691

626

692

627

Note: Will not include properties with access="write".

693

628

"""

694

629

all = {}

698

633

# Interface non-empty but did not match

699

634

continue

700

635

# Ignore write-only properties

701

if prop._dbus_access == "write":

636

if prop._dbus_access == u"write":

702

637

continue

703

638

value = prop()

704

if not hasattr(value, "variant_level"):

639

if not hasattr(value, u"variant_level"):

705

640

all[name] = value

706

641

continue

707

642

all[name] = type(value)(value, variant_level=

708

643

value.variant_level+1)

709

return dbus.Dictionary(all, signature="sv")

644

return dbus.Dictionary(all, signature=u"sv")

710

645

711

646

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

712

out_signature="s",

647

out_signature=u"s",

713

648

path_keyword='object_path',

714

649

connection_keyword='connection')

715

650

def Introspect(self, object_path, connection):

720

655

try:

721

656

document = xml.dom.minidom.parseString(xmlstring)

722

657

def make_tag(document, name, prop):

723

e = document.createElement("property")

724

e.setAttribute("name", name)

725

e.setAttribute("type", prop._dbus_signature)

726

e.setAttribute("access", prop._dbus_access)

658

e = document.createElement(u"property")

659

e.setAttribute(u"name", name)

660

e.setAttribute(u"type", prop._dbus_signature)

661

e.setAttribute(u"access", prop._dbus_access)

727

662

return e

728

for if_tag in document.getElementsByTagName("interface"):

663

for if_tag in document.getElementsByTagName(u"interface"):

729

664

for tag in (make_tag(document, name, prop)

730

665

for name, prop

731

666

in self._get_all_dbus_properties()

732

667

if prop._dbus_interface

733

== if_tag.getAttribute("name")):

668

== if_tag.getAttribute(u"name")):

734

669

if_tag.appendChild(tag)

735

670

# Add the names to the return values for the

736

671

# "org.freedesktop.DBus.Properties" methods

737

if (if_tag.getAttribute("name")

738

== "org.freedesktop.DBus.Properties"):

739

for cn in if_tag.getElementsByTagName("method"):

740

if cn.getAttribute("name") == "Get":

741

for arg in cn.getElementsByTagName("arg"):

742

if (arg.getAttribute("direction")

743

== "out"):

744

arg.setAttribute("name", "value")

745

elif cn.getAttribute("name") == "GetAll":

746

for arg in cn.getElementsByTagName("arg"):

747

if (arg.getAttribute("direction")

748

== "out"):

749

arg.setAttribute("name", "props")

750

xmlstring = document.toxml("utf-8")

672

if (if_tag.getAttribute(u"name")

673

== u"org.freedesktop.DBus.Properties"):

674

for cn in if_tag.getElementsByTagName(u"method"):

675

if cn.getAttribute(u"name") == u"Get":

676

for arg in cn.getElementsByTagName(u"arg"):

677

if (arg.getAttribute(u"direction")

678

== u"out"):

679

arg.setAttribute(u"name", u"value")

680

elif cn.getAttribute(u"name") == u"GetAll":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"props")

685

xmlstring = document.toxml(u"utf-8")

751

686

document.unlink()

752

687

except (AttributeError, xml.dom.DOMException,

753

xml.parsers.expat.ExpatError) as error:

754

logger.error("Failed to override Introspection method",

688

xml.parsers.expat.ExpatError), error:

689

logger.error(u"Failed to override Introspection method",

755

690

error)

756

691

return xmlstring

757

692

758

693

759

def datetime_to_dbus (dt, variant_level=0):

760

"""Convert a UTC datetime.datetime() to a D-Bus type."""

761

if dt is None:

762

return dbus.String("", variant_level = variant_level)

763

return dbus.String(dt.isoformat(),

764

variant_level=variant_level)

765

766

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

767

.__metaclass__):

768

"""Applied to an empty subclass of a D-Bus object, this metaclass

769

will add additional D-Bus attributes matching a certain pattern.

770

"""

771

def __new__(mcs, name, bases, attr):

772

# Go through all the base classes which could have D-Bus

773

# methods, signals, or properties in them

774

for base in (b for b in bases

775

if issubclass(b, dbus.service.Object)):

776

# Go though all attributes of the base class

777

for attrname, attribute in inspect.getmembers(base):

778

# Ignore non-D-Bus attributes, and D-Bus attributes

779

# with the wrong interface name

780

if (not hasattr(attribute, "_dbus_interface")

781

or not attribute._dbus_interface

782

.startswith("se.recompile.Mandos")):

783

continue

784

# Create an alternate D-Bus interface name based on

785

# the current name

786

alt_interface = (attribute._dbus_interface

787

.replace("se.recompile.Mandos",

788

"se.bsnet.fukt.Mandos"))

789

# Is this a D-Bus signal?

790

if getattr(attribute, "_dbus_is_signal", False):

791

# Extract the original non-method function by

792

# black magic

793

nonmethod_func = (dict(

794

zip(attribute.func_code.co_freevars,

795

attribute.__closure__))["func"]

796

.cell_contents)

797

# Create a new, but exactly alike, function

798

# object, and decorate it to be a new D-Bus signal

799

# with the alternate D-Bus interface name

800

new_function = (dbus.service.signal

801

(alt_interface,

802

attribute._dbus_signature)

803

(types.FunctionType(

804

nonmethod_func.func_code,

805

nonmethod_func.func_globals,

806

nonmethod_func.func_name,

807

nonmethod_func.func_defaults,

808

nonmethod_func.func_closure)))

809

# Define a creator of a function to call both the

810

# old and new functions, so both the old and new

811

# signals gets sent when the function is called

812

def fixscope(func1, func2):

813

"""This function is a scope container to pass

814

func1 and func2 to the "call_both" function

815

outside of its arguments"""

816

def call_both(*args, **kwargs):

817

"""This function will emit two D-Bus

818

signals by calling func1 and func2"""

819

func1(*args, **kwargs)

820

func2(*args, **kwargs)

821

return call_both

822

# Create the "call_both" function and add it to

823

# the class

824

attr[attrname] = fixscope(attribute,

825

new_function)

826

# Is this a D-Bus method?

827

elif getattr(attribute, "_dbus_is_method", False):

828

# Create a new, but exactly alike, function

829

# object. Decorate it to be a new D-Bus method

830

# with the alternate D-Bus interface name. Add it

831

# to the class.

832

attr[attrname] = (dbus.service.method

833

(alt_interface,

834

attribute._dbus_in_signature,

835

attribute._dbus_out_signature)

836

(types.FunctionType

837

(attribute.func_code,

838

attribute.func_globals,

839

attribute.func_name,

840

attribute.func_defaults,

841

attribute.func_closure)))

842

# Is this a D-Bus property?

843

elif getattr(attribute, "_dbus_is_property", False):

844

# Create a new, but exactly alike, function

845

# object, and decorate it to be a new D-Bus

846

# property with the alternate D-Bus interface

847

# name. Add it to the class.

848

attr[attrname] = (dbus_service_property

849

(alt_interface,

850

attribute._dbus_signature,

851

attribute._dbus_access,

852

attribute

853

._dbus_get_args_options

854

["byte_arrays"])

855

(types.FunctionType

856

(attribute.func_code,

857

attribute.func_globals,

858

attribute.func_name,

859

attribute.func_defaults,

860

attribute.func_closure)))

861

return type.__new__(mcs, name, bases, attr)

862

863

694

class ClientDBus(Client, DBusObjectWithProperties):

864

695

"""A Client class using D-Bus

865

696

867

698

dbus_object_path: dbus.ObjectPath

868

699

bus: dbus.SystemBus()

869

700

"""

870

871

runtime_expansions = (Client.runtime_expansions

872

+ ("dbus_object_path",))

873

874

701

# dbus.service.Object doesn't use super(), so we can't either.

875

702

876

703

def __init__(self, bus = None, *args, **kwargs):

879

706

Client.__init__(self, *args, **kwargs)

880

707

# Only now, when this client is initialized, can it show up on

881

708

# the D-Bus

882

client_object_name = unicode(self.name).translate(

883

{ord("."): ord("_"),

884

ord("-"): ord("_")})

885

709

self.dbus_object_path = (dbus.ObjectPath

886

("/clients/" + client_object_name))

710

(u"/clients/"

711

+ self.name.replace(u".", u"_")))

887

712

DBusObjectWithProperties.__init__(self, self.bus,

888

713

self.dbus_object_path)

889

890

def notifychangeproperty(transform_func,

891

dbus_name, type_func=lambda x: x,

892

variant_level=1):

893

""" Modify a variable so that it's a property which announces

894

its changes to DBus.

895

896

transform_fun: Function that takes a value and a variant_level

897

and transforms it to a D-Bus type.

898

dbus_name: D-Bus name of the variable

899

type_func: Function that transform the value before sending it

900

to the D-Bus. Default: no transform

901

variant_level: D-Bus variant level. Default: 1

902

"""

903

attrname = "_{0}".format(dbus_name)

904

def setter(self, value):

905

if hasattr(self, "dbus_object_path"):

906

if (not hasattr(self, attrname) or

907

type_func(getattr(self, attrname, None))

908

!= type_func(value)):

909

dbus_value = transform_func(type_func(value),

910

variant_level

911

=variant_level)

912

self.PropertyChanged(dbus.String(dbus_name),

913

dbus_value)

914

setattr(self, attrname, value)

915

916

return property(lambda self: getattr(self, attrname), setter)

917

918

919

expires = notifychangeproperty(datetime_to_dbus, "Expires")

920

approvals_pending = notifychangeproperty(dbus.Boolean,

921

"ApprovalPending",

922

type_func = bool)

923

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

924

last_enabled = notifychangeproperty(datetime_to_dbus,

925

"LastEnabled")

926

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

927

type_func = lambda checker:

928

checker is not None)

929

last_checked_ok = notifychangeproperty(datetime_to_dbus,

930

"LastCheckedOK")

931

last_approval_request = notifychangeproperty(

932

datetime_to_dbus, "LastApprovalRequest")

933

approved_by_default = notifychangeproperty(dbus.Boolean,

934

"ApprovedByDefault")

935

approval_delay = notifychangeproperty(dbus.UInt16,

936

"ApprovalDelay",

937

type_func =

938

_timedelta_to_milliseconds)

939

approval_duration = notifychangeproperty(

940

dbus.UInt16, "ApprovalDuration",

941

type_func = _timedelta_to_milliseconds)

942

host = notifychangeproperty(dbus.String, "Host")

943

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

944

type_func =

945

_timedelta_to_milliseconds)

946

extended_timeout = notifychangeproperty(

947

dbus.UInt16, "ExtendedTimeout",

948

type_func = _timedelta_to_milliseconds)

949

interval = notifychangeproperty(dbus.UInt16,

950

"Interval",

951

type_func =

952

_timedelta_to_milliseconds)

953

checker_command = notifychangeproperty(dbus.String, "Checker")

954

955

del notifychangeproperty

714

715

def _get_approvals_pending(self):

716

return self._approvals_pending

717

def _set_approvals_pending(self, value):

718

old_value = self._approvals_pending

719

self._approvals_pending = value

720

bval = bool(value)

721

if (hasattr(self, "dbus_object_path")

722

and bval is not bool(old_value)):

723

dbus_bool = dbus.Boolean(bval, variant_level=1)

724

self.PropertyChanged(dbus.String(u"approved_pending"),

725

dbus_bool)

726

727

approvals_pending = property(_get_approvals_pending,

728

_set_approvals_pending)

729

del _get_approvals_pending, _set_approvals_pending

730

731

@staticmethod

732

def _datetime_to_dbus(dt, variant_level=0):

733

"""Convert a UTC datetime.datetime() to a D-Bus type."""

734

return dbus.String(dt.isoformat(),

735

variant_level=variant_level)

736

737

def enable(self):

738

oldstate = getattr(self, u"enabled", False)

739

r = Client.enable(self)

740

if oldstate != self.enabled:

741

# Emit D-Bus signals

742

self.PropertyChanged(dbus.String(u"enabled"),

743

dbus.Boolean(True, variant_level=1))

744

self.PropertyChanged(

745

dbus.String(u"last_enabled"),

746

self._datetime_to_dbus(self.last_enabled,

747

variant_level=1))

748

return r

749

750

def disable(self, quiet = False):

751

oldstate = getattr(self, u"enabled", False)

752

r = Client.disable(self, quiet=quiet)

753

if not quiet and oldstate != self.enabled:

754

# Emit D-Bus signal

755

self.PropertyChanged(dbus.String(u"enabled"),

756

dbus.Boolean(False, variant_level=1))

757

return r

956

758

957

759

def __del__(self, *args, **kwargs):

958

760

try:

959

761

self.remove_from_connection()

960

762

except LookupError:

961

763

pass

962

if hasattr(DBusObjectWithProperties, "__del__"):

764

if hasattr(DBusObjectWithProperties, u"__del__"):

963

765

DBusObjectWithProperties.__del__(self, *args, **kwargs)

964

766

Client.__del__(self, *args, **kwargs)

965

767

967

769

*args, **kwargs):

968

770

self.checker_callback_tag = None

969

771

self.checker = None

772

# Emit D-Bus signal

773

self.PropertyChanged(dbus.String(u"checker_running"),

774

dbus.Boolean(False, variant_level=1))

970

775

if os.WIFEXITED(condition):

971

776

exitstatus = os.WEXITSTATUS(condition)

972

777

# Emit D-Bus signal

982

787

return Client.checker_callback(self, pid, condition, command,

983

788

*args, **kwargs)

984

789

790

def checked_ok(self, *args, **kwargs):

791

r = Client.checked_ok(self, *args, **kwargs)

792

# Emit D-Bus signal

793

self.PropertyChanged(

794

dbus.String(u"last_checked_ok"),

795

(self._datetime_to_dbus(self.last_checked_ok,

796

variant_level=1)))

797

return r

798

985

799

def start_checker(self, *args, **kwargs):

986

800

old_checker = self.checker

987

801

if self.checker is not None:

994

808

and old_checker_pid != self.checker.pid):

995

809

# Emit D-Bus signal

996

810

self.CheckerStarted(self.current_checker_command)

811

self.PropertyChanged(

812

dbus.String(u"checker_running"),

813

dbus.Boolean(True, variant_level=1))

997

814

return r

998

815

816

def stop_checker(self, *args, **kwargs):

817

old_checker = getattr(self, u"checker", None)

818

r = Client.stop_checker(self, *args, **kwargs)

819

if (old_checker is not None

820

and getattr(self, u"checker", None) is None):

821

self.PropertyChanged(dbus.String(u"checker_running"),

822

dbus.Boolean(False, variant_level=1))

823

return r

824

999

825

def _reset_approved(self):

1000

826

self._approved = None

1001

827

return False

1003

829

def approve(self, value=True):

1004

830

self.send_changedstate()

1005

831

self._approved = value

1006

gobject.timeout_add(_timedelta_to_milliseconds

1007

(self.approval_duration),

832

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),

1008

833

self._reset_approved)

1009

834

1010

835

1011

836

## D-Bus methods, signals & properties

1012

_interface = "se.recompile.Mandos.Client"

837

_interface = u"se.bsnet.fukt.Mandos.Client"

1013

838

1014

839

## Signals

1015

840

1016

841

# CheckerCompleted - signal

1017

@dbus.service.signal(_interface, signature="nxs")

842

@dbus.service.signal(_interface, signature=u"nxs")

1018

843

def CheckerCompleted(self, exitcode, waitstatus, command):

1019

844

"D-Bus signal"

1020

845

pass

1021

846

1022

847

# CheckerStarted - signal

1023

@dbus.service.signal(_interface, signature="s")

848

@dbus.service.signal(_interface, signature=u"s")

1024

849

def CheckerStarted(self, command):

1025

850

"D-Bus signal"

1026

851

pass

1027

852

1028

853

# PropertyChanged - signal

1029

@dbus.service.signal(_interface, signature="sv")

854

@dbus.service.signal(_interface, signature=u"sv")

1030

855

def PropertyChanged(self, property, value):

1031

856

"D-Bus signal"

1032

857

pass

1041

866

pass

1042

867

1043

868

# Rejected - signal

1044

@dbus.service.signal(_interface, signature="s")

869

@dbus.service.signal(_interface, signature=u"s")

1045

870

def Rejected(self, reason):

1046

871

"D-Bus signal"

1047

872

pass

1048

873

1049

874

# NeedApproval - signal

1050

@dbus.service.signal(_interface, signature="tb")

875

@dbus.service.signal(_interface, signature=u"db")

1051

876

def NeedApproval(self, timeout, default):

1052

877

"D-Bus signal"

1053

return self.need_approval()

878

pass

1054

879

1055

880

## Methods

1056

881

1057

882

# Approve - method

1058

@dbus.service.method(_interface, in_signature="b")

883

@dbus.service.method(_interface, in_signature=u"b")

1059

884

def Approve(self, value):

1060

885

self.approve(value)

1061

886

1062

887

# CheckedOK - method

1063

888

@dbus.service.method(_interface)

1064

889

def CheckedOK(self):

1065

self.checked_ok()

890

return self.checked_ok()

1066

891

1067

892

# Enable - method

1068

893

@dbus.service.method(_interface)

1089

914

1090

915

## Properties

1091

916

1092

# ApprovalPending - property

1093

@dbus_service_property(_interface, signature="b", access="read")

1094

def ApprovalPending_dbus_property(self):

917

# approved_pending - property

918

@dbus_service_property(_interface, signature=u"b", access=u"read")

919

def approved_pending_dbus_property(self):

1095

920

return dbus.Boolean(bool(self.approvals_pending))

1096

921

1097

# ApprovedByDefault - property

1098

@dbus_service_property(_interface, signature="b",

1099

access="readwrite")

1100

def ApprovedByDefault_dbus_property(self, value=None):

1101

if value is None: # get

1102

return dbus.Boolean(self.approved_by_default)

1103

self.approved_by_default = bool(value)

1104

1105

# ApprovalDelay - property

1106

@dbus_service_property(_interface, signature="t",

1107

access="readwrite")

1108

def ApprovalDelay_dbus_property(self, value=None):

1109

if value is None: # get

1110

return dbus.UInt64(self.approval_delay_milliseconds())

1111

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1112

1113

# ApprovalDuration - property

1114

@dbus_service_property(_interface, signature="t",

1115

access="readwrite")

1116

def ApprovalDuration_dbus_property(self, value=None):

1117

if value is None: # get

1118

return dbus.UInt64(_timedelta_to_milliseconds(

1119

self.approval_duration))

1120

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1121

1122

# Name - property

1123

@dbus_service_property(_interface, signature="s", access="read")

1124

def Name_dbus_property(self):

922

# approved_by_default - property

923

@dbus_service_property(_interface, signature=u"b",

924

access=u"readwrite")

925

def approved_by_default_dbus_property(self):

926

return dbus.Boolean(self.approved_by_default)

927

928

# approved_delay - property

929

@dbus_service_property(_interface, signature=u"t",

930

access=u"readwrite")

931

def approved_delay_dbus_property(self):

932

return dbus.UInt64(self.approved_delay_milliseconds())

933

934

# approved_duration - property

935

@dbus_service_property(_interface, signature=u"t",

936

access=u"readwrite")

937

def approved_duration_dbus_property(self):

938

return dbus.UInt64(self._timedelta_to_milliseconds(

939

self.approved_duration))

940

941

# name - property

942

@dbus_service_property(_interface, signature=u"s", access=u"read")

943

def name_dbus_property(self):

1125

944

return dbus.String(self.name)

1126

945

1127

# Fingerprint - property

1128

@dbus_service_property(_interface, signature="s", access="read")

1129

def Fingerprint_dbus_property(self):

946

# fingerprint - property

947

@dbus_service_property(_interface, signature=u"s", access=u"read")

948

def fingerprint_dbus_property(self):

1130

949

return dbus.String(self.fingerprint)

1131

950

1132

# Host - property

1133

@dbus_service_property(_interface, signature="s",

1134

access="readwrite")

1135

def Host_dbus_property(self, value=None):

951

# host - property

952

@dbus_service_property(_interface, signature=u"s",

953

access=u"readwrite")

954

def host_dbus_property(self, value=None):

1136

955

if value is None: # get

1137

956

return dbus.String(self.host)

1138

957

self.host = value

1139

1140

# Created - property

1141

@dbus_service_property(_interface, signature="s", access="read")

1142

def Created_dbus_property(self):

1143

return dbus.String(datetime_to_dbus(self.created))

1144

1145

# LastEnabled - property

1146

@dbus_service_property(_interface, signature="s", access="read")

1147

def LastEnabled_dbus_property(self):

1148

return datetime_to_dbus(self.last_enabled)

1149

1150

# Enabled - property

1151

@dbus_service_property(_interface, signature="b",

1152

access="readwrite")

1153

def Enabled_dbus_property(self, value=None):

958

# Emit D-Bus signal

959

self.PropertyChanged(dbus.String(u"host"),

960

dbus.String(value, variant_level=1))

961

962

# created - property

963

@dbus_service_property(_interface, signature=u"s", access=u"read")

964

def created_dbus_property(self):

965

return dbus.String(self._datetime_to_dbus(self.created))

966

967

# last_enabled - property

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

969

def last_enabled_dbus_property(self):

970

if self.last_enabled is None:

971

return dbus.String(u"")

972

return dbus.String(self._datetime_to_dbus(self.last_enabled))

973

974

# enabled - property

975

@dbus_service_property(_interface, signature=u"b",

976

access=u"readwrite")

977

def enabled_dbus_property(self, value=None):

1154

978

if value is None: # get

1155

979

return dbus.Boolean(self.enabled)

1156

980

if value:

1158

982

else:

1159

983

self.disable()

1160

984

1161

# LastCheckedOK - property

1162

@dbus_service_property(_interface, signature="s",

1163

access="readwrite")

1164

def LastCheckedOK_dbus_property(self, value=None):

985

# last_checked_ok - property

986

@dbus_service_property(_interface, signature=u"s",

987

access=u"readwrite")

988

def last_checked_ok_dbus_property(self, value=None):

1165

989

if value is not None:

1166

990

self.checked_ok()

1167

991

return

1168

return datetime_to_dbus(self.last_checked_ok)

1169

1170

# Expires - property

1171

@dbus_service_property(_interface, signature="s", access="read")

1172

def Expires_dbus_property(self):

1173

return datetime_to_dbus(self.expires)

1174

1175

# LastApprovalRequest - property

1176

@dbus_service_property(_interface, signature="s", access="read")

1177

def LastApprovalRequest_dbus_property(self):

1178

return datetime_to_dbus(self.last_approval_request)

1179

1180

# Timeout - property

1181

@dbus_service_property(_interface, signature="t",

1182

access="readwrite")

1183

def Timeout_dbus_property(self, value=None):

992

if self.last_checked_ok is None:

993

return dbus.String(u"")

994

return dbus.String(self._datetime_to_dbus(self

995

.last_checked_ok))

996

997

# timeout - property

998

@dbus_service_property(_interface, signature=u"t",

999

access=u"readwrite")

1000

def timeout_dbus_property(self, value=None):

1184

1001

if value is None: # get

1185

1002

return dbus.UInt64(self.timeout_milliseconds())

1186

1003

self.timeout = datetime.timedelta(0, 0, 0, value)

1187

if getattr(self, "disable_initiator_tag", None) is None:

1004

# Emit D-Bus signal

1005

self.PropertyChanged(dbus.String(u"timeout"),

1006

dbus.UInt64(value, variant_level=1))

1007

if getattr(self, u"disable_initiator_tag", None) is None:

1188

1008

return

1189

1009

# Reschedule timeout

1190

1010

gobject.source_remove(self.disable_initiator_tag)

1191

1011

self.disable_initiator_tag = None

1192

self.expires = None

1193

time_to_die = _timedelta_to_milliseconds((self

1194

.last_checked_ok

1195

+ self.timeout)

1196

- datetime.datetime

1197

.utcnow())

1012

time_to_die = (self.

1013

_timedelta_to_milliseconds((self

1014

.last_checked_ok

1015

+ self.timeout)

1016

- datetime.datetime

1017

.utcnow()))

1198

1018

if time_to_die <= 0:

1199

1019

# The timeout has passed

1200

1020

self.disable()

1201

1021

else:

1202

self.expires = (datetime.datetime.utcnow()

1203

+ datetime.timedelta(milliseconds =

1204

time_to_die))

1205

1022

self.disable_initiator_tag = (gobject.timeout_add

1206

1023

(time_to_die, self.disable))

1207

1024

1208

# ExtendedTimeout - property

1209

@dbus_service_property(_interface, signature="t",

1210

access="readwrite")

1211

def ExtendedTimeout_dbus_property(self, value=None):

1212

if value is None: # get

1213

return dbus.UInt64(self.extended_timeout_milliseconds())

1214

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1215

1216

# Interval - property

1217

@dbus_service_property(_interface, signature="t",

1218

access="readwrite")

1219

def Interval_dbus_property(self, value=None):

1025

# interval - property

1026

@dbus_service_property(_interface, signature=u"t",

1027

access=u"readwrite")

1028

def interval_dbus_property(self, value=None):

1220

1029

if value is None: # get

1221

1030

return dbus.UInt64(self.interval_milliseconds())

1222

1031

self.interval = datetime.timedelta(0, 0, 0, value)

1223

if getattr(self, "checker_initiator_tag", None) is None:

1032

# Emit D-Bus signal

1033

self.PropertyChanged(dbus.String(u"interval"),

1034

dbus.UInt64(value, variant_level=1))

1035

if getattr(self, u"checker_initiator_tag", None) is None:

1224

1036

return

1225

1037

# Reschedule checker run

1226

1038

gobject.source_remove(self.checker_initiator_tag)

1227

1039

self.checker_initiator_tag = (gobject.timeout_add

1228

1040

(value, self.start_checker))

1229

1041

self.start_checker() # Start one now, too

1230

1231

# Checker - property

1232

@dbus_service_property(_interface, signature="s",

1233

access="readwrite")

1234

def Checker_dbus_property(self, value=None):

1042

1043

# checker - property

1044

@dbus_service_property(_interface, signature=u"s",

1045

access=u"readwrite")

1046

def checker_dbus_property(self, value=None):

1235

1047

if value is None: # get

1236

1048

return dbus.String(self.checker_command)

1237

1049

self.checker_command = value

1050

# Emit D-Bus signal

1051

self.PropertyChanged(dbus.String(u"checker"),

1052

dbus.String(self.checker_command,

1053

variant_level=1))

1238

1054

1239

# CheckerRunning - property

1240

@dbus_service_property(_interface, signature="b",

1241

access="readwrite")

1242

def CheckerRunning_dbus_property(self, value=None):

1055

# checker_running - property

1056

@dbus_service_property(_interface, signature=u"b",

1057

access=u"readwrite")

1058

def checker_running_dbus_property(self, value=None):

1243

1059

if value is None: # get

1244

1060

return dbus.Boolean(self.checker is not None)

1245

1061

if value:

1247

1063

else:

1248

1064

self.stop_checker()

1249

1065

1250

# ObjectPath - property

1251

@dbus_service_property(_interface, signature="o", access="read")

1252

def ObjectPath_dbus_property(self):

1066

# object_path - property

1067

@dbus_service_property(_interface, signature=u"o", access=u"read")

1068

def object_path_dbus_property(self):

1253

1069

return self.dbus_object_path # is already a dbus.ObjectPath

1254

1070

1255

# Secret = property

1256

@dbus_service_property(_interface, signature="ay",

1257

access="write", byte_arrays=True)

1258

def Secret_dbus_property(self, value):

1071

# secret = property

1072

@dbus_service_property(_interface, signature=u"ay",

1073

access=u"write", byte_arrays=True)

1074

def secret_dbus_property(self, value):

1259

1075

self.secret = str(value)

1260

1076

1261

1077

del _interface

1267

1083

self._pipe.send(('init', fpr, address))

1268

1084

if not self._pipe.recv():

1269

1085

raise KeyError()

1270

1086

1271

1087

def __getattribute__(self, name):

1272

1088

if(name == '_pipe'):

1273

1089

return super(ProxyClient, self).__getattribute__(name)

1280

1096

self._pipe.send(('funcall', name, args, kwargs))

1281

1097

return self._pipe.recv()[1]

1282

1098

return func

1283

1099

1284

1100

def __setattr__(self, name, value):

1285

1101

if(name == '_pipe'):

1286

1102

return super(ProxyClient, self).__setattr__(name, value)

1287

1103

self._pipe.send(('setattr', name, value))

1288

1104

1289

class ClientDBusTransitional(ClientDBus):

1290

__metaclass__ = AlternateDBusNamesMetaclass

1291

1105

1292

1106

class ClientHandler(socketserver.BaseRequestHandler, object):

1293

1107

"""A class to handle client connections.

1297

1111

1298

1112

def handle(self):

1299

1113

with contextlib.closing(self.server.child_pipe) as child_pipe:

1300

logger.info("TCP connection from: %s",

1114

logger.info(u"TCP connection from: %s",

1301

1115

unicode(self.client_address))

1302

logger.debug("Pipe FD: %d",

1116

logger.debug(u"Pipe FD: %d",

1303

1117

self.server.child_pipe.fileno())

1304

1118

1305

1119

session = (gnutls.connection

1306

1120

.ClientSession(self.request,

1307

1121

gnutls.connection

1308

1122

.X509Credentials()))

1309

1123

1310

1124

# Note: gnutls.connection.X509Credentials is really a

1311

1125

# generic GnuTLS certificate credentials object so long as

1312

1126

# no X.509 keys are added to it. Therefore, we can use it

1313

1127

# here despite using OpenPGP certificates.

1314

1315

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1316

# "+AES-256-CBC", "+SHA1",

1317

# "+COMP-NULL", "+CTYPE-OPENPGP",

1318

# "+DHE-DSS"))

1128

1129

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1130

# u"+AES-256-CBC", u"+SHA1",

1131

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1132

# u"+DHE-DSS"))

1319

1133

# Use a fallback default, since this MUST be set.

1320

1134

priority = self.server.gnutls_priority

1321

1135

if priority is None:

1322

priority = "NORMAL"

1136

priority = u"NORMAL"

1323

1137

(gnutls.library.functions

1324

1138

.gnutls_priority_set_direct(session._c_object,

1325

1139

priority, None))

1326

1140

1327

1141

# Start communication using the Mandos protocol

1328

1142

# Get protocol number

1329

1143

line = self.request.makefile().readline()

1330

logger.debug("Protocol version: %r", line)

1144

logger.debug(u"Protocol version: %r", line)

1331

1145

try:

1332

1146

if int(line.strip().split()[0]) > 1:

1333

1147

raise RuntimeError

1334

except (ValueError, IndexError, RuntimeError) as error:

1335

logger.error("Unknown protocol version: %s", error)

1148

except (ValueError, IndexError, RuntimeError), error:

1149

logger.error(u"Unknown protocol version: %s", error)

1336

1150

return

1337

1151

1338

1152

# Start GnuTLS connection

1339

1153

try:

1340

1154

session.handshake()

1341

except gnutls.errors.GNUTLSError as error:

1342

logger.warning("Handshake failed: %s", error)

1155

except gnutls.errors.GNUTLSError, error:

1156

logger.warning(u"Handshake failed: %s", error)

1343

1157

# Do not run session.bye() here: the session is not

1344

1158

# established. Just abandon the request.

1345

1159

return

1346

logger.debug("Handshake succeeded")

1347

1160

logger.debug(u"Handshake succeeded")

1161

1348

1162

approval_required = False

1349

1163

try:

1350

1164

try:

1351

1165

fpr = self.fingerprint(self.peer_certificate

1352

1166

(session))

1353

except (TypeError,

1354

gnutls.errors.GNUTLSError) as error:

1355

logger.warning("Bad certificate: %s", error)

1167

except (TypeError, gnutls.errors.GNUTLSError), error:

1168

logger.warning(u"Bad certificate: %s", error)

1356

1169

return

1357

logger.debug("Fingerprint: %s", fpr)

1358

1170

logger.debug(u"Fingerprint: %s", fpr)

1171

1359

1172

try:

1360

1173

client = ProxyClient(child_pipe, fpr,

1361

1174

self.client_address)

1362

1175

except KeyError:

1363

1176

return

1364

1177

1365

if client.approval_delay:

1366

delay = client.approval_delay

1178

if client.approved_delay:

1179

delay = client.approved_delay

1367

1180

client.approvals_pending += 1

1368

1181

approval_required = True

1369

1182

1370

1183

while True:

1371

1184

if not client.enabled:

1372

logger.info("Client %s is disabled",

1185

logger.warning(u"Client %s is disabled",

1373

1186

client.name)

1374

1187

if self.server.use_dbus:

1375

1188

# Emit D-Bus signal

1376

client.Rejected("Disabled")

1189

client.Rejected("Disabled")

1377

1190

return

1378

1191

1379

if client._approved or not client.approval_delay:

1192

if client._approved or not client.approved_delay:

1380

1193

#We are approved or approval is disabled

1381

1194

break

1382

1195

elif client._approved is None:

1383

logger.info("Client %s needs approval",

1196

logger.info(u"Client %s need approval",

1384

1197

client.name)

1385

1198

if self.server.use_dbus:

1386

1199

# Emit D-Bus signal

1387

1200

client.NeedApproval(

1388

client.approval_delay_milliseconds(),

1201

client.approved_delay_milliseconds(),

1389

1202

client.approved_by_default)

1390

1203

else:

1391

logger.warning("Client %s was not approved",

1204

logger.warning(u"Client %s was not approved",

1392

1205

client.name)

1393

1206

if self.server.use_dbus:

1394

1207

# Emit D-Bus signal

1395

client.Rejected("Denied")

1208

client.Rejected("Disapproved")

1396

1209

return

1397

1210

1398

1211

#wait until timeout or approved

1212

#x = float(client._timedelta_to_milliseconds(delay))

1399

1213

time = datetime.datetime.now()

1400

1214

client.changedstate.acquire()

1401

(client.changedstate.wait

1402

(float(client._timedelta_to_milliseconds(delay)

1403

/ 1000)))

1215

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1404

1216

client.changedstate.release()

1405

1217

time2 = datetime.datetime.now()

1406

1218

if (time2 - time) >= delay:

1410

1222

client.name)

1411

1223

if self.server.use_dbus:

1412

1224

# Emit D-Bus signal

1413

client.Rejected("Approval timed out")

1225

client.Rejected("Time out")

1414

1226

return

1415

1227

else:

1416

1228

break

1421

1233

while sent_size < len(client.secret):

1422

1234

try:

1423

1235

sent = session.send(client.secret[sent_size:])

1424

except gnutls.errors.GNUTLSError as error:

1236

except (gnutls.errors.GNUTLSError), error:

1425

1237

logger.warning("gnutls send failed")

1426

1238

return

1427

logger.debug("Sent: %d, remaining: %d",

1239

logger.debug(u"Sent: %d, remaining: %d",

1428

1240

sent, len(client.secret)

1429

1241

- (sent_size + sent))

1430

1242

sent_size += sent

1431

1432

logger.info("Sending secret to %s", client.name)

1433

# bump the timeout using extended_timeout

1434

client.checked_ok(client.extended_timeout)

1243

1244

logger.info(u"Sending secret to %s", client.name)

1245

# bump the timeout as if seen

1246

client.checked_ok()

1435

1247

if self.server.use_dbus:

1436

1248

# Emit D-Bus signal

1437

1249

client.GotSecret()

1441

1253

client.approvals_pending -= 1

1442

1254

try:

1443

1255

session.bye()

1444

except gnutls.errors.GNUTLSError as error:

1445

logger.warning("GnuTLS bye failed")

1256

except (gnutls.errors.GNUTLSError), error:

1257

logger.warning("gnutls bye failed")

1446

1258

1447

1259

@staticmethod

1448

1260

def peer_certificate(session):

1458

1270

.gnutls_certificate_get_peers

1459

1271

(session._c_object, ctypes.byref(list_size)))

1460

1272

if not bool(cert_list) and list_size.value != 0:

1461

raise gnutls.errors.GNUTLSError("error getting peer"

1462

" certificate")

1273

raise gnutls.errors.GNUTLSError(u"error getting peer"

1274

u" certificate")

1463

1275

if list_size.value == 0:

1464

1276

return None

1465

1277

cert = cert_list[0]

1491

1303

if crtverify.value != 0:

1492

1304

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1493

1305

raise (gnutls.errors.CertificateSecurityError

1494

("Verify failed"))

1306

(u"Verify failed"))

1495

1307

# New buffer for the fingerprint

1496

1308

buf = ctypes.create_string_buffer(20)

1497

1309

buf_len = ctypes.c_size_t()

1504

1316

# Convert the buffer to a Python bytestring

1505

1317

fpr = ctypes.string_at(buf, buf_len.value)

1506

1318

# Convert the bytestring to hexadecimal notation

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1319

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1508

1320

return hex_fpr

1509

1321

1510

1322

1516

1328

except:

1517

1329

self.handle_error(request, address)

1518

1330

self.close_request(request)

1519

1331

1520

1332

def process_request(self, request, address):

1521

1333

"""Start a new process to process the request."""

1522

proc = multiprocessing.Process(target = self.sub_process_main,

1523

args = (request,

1524

address))

1525

proc.start()

1526

return proc

1527

1334

multiprocessing.Process(target = self.sub_process_main,

1335

args = (request, address)).start()

1528

1336

1529

1337

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1530

1338

""" adds a pipe to the MixIn """

1534

1342

This function creates a new pipe in self.pipe

1535

1343

"""

1536

1344

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1537

1538

proc = MultiprocessingMixIn.process_request(self, request,

1539

client_address)

1345

1346

super(MultiprocessingMixInWithPipe,

1347

self).process_request(request, client_address)

1540

1348

self.child_pipe.close()

1541

self.add_pipe(parent_pipe, proc)

1542

1543

def add_pipe(self, parent_pipe, proc):

1349

self.add_pipe(parent_pipe)

1350

1351

def add_pipe(self, parent_pipe):

1544

1352

"""Dummy function; override as necessary"""

1545

raise NotImplementedError

1546

1353

pass

1547

1354

1548

1355

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1549

1356

socketserver.TCPServer, object):

1567

1374

bind to an address or port if they were not specified."""

1568

1375

if self.interface is not None:

1569

1376

if SO_BINDTODEVICE is None:

1570

logger.error("SO_BINDTODEVICE does not exist;"

1571

" cannot bind to interface %s",

1377

logger.error(u"SO_BINDTODEVICE does not exist;"

1378

u" cannot bind to interface %s",

1572

1379

self.interface)

1573

1380

else:

1574

1381

try:

1575

1382

self.socket.setsockopt(socket.SOL_SOCKET,

1576

1383

SO_BINDTODEVICE,

1577

1384

str(self.interface

1578

+ '\0'))

1579

except socket.error as error:

1385

+ u'\0'))

1386

except socket.error, error:

1580

1387

if error[0] == errno.EPERM:

1581

logger.error("No permission to"

1582

" bind to interface %s",

1388

logger.error(u"No permission to"

1389

u" bind to interface %s",

1583

1390

self.interface)

1584

1391

elif error[0] == errno.ENOPROTOOPT:

1585

logger.error("SO_BINDTODEVICE not available;"

1586

" cannot bind to interface %s",

1392

logger.error(u"SO_BINDTODEVICE not available;"

1393

u" cannot bind to interface %s",

1587

1394

self.interface)

1588

1395

else:

1589

1396

raise

1591

1398

if self.server_address[0] or self.server_address[1]:

1592

1399

if not self.server_address[0]:

1593

1400

if self.address_family == socket.AF_INET6:

1594

any_address = "::" # in6addr_any

1401

any_address = u"::" # in6addr_any

1595

1402

else:

1596

1403

any_address = socket.INADDR_ANY

1597

1404

self.server_address = (any_address,

1634

1441

def server_activate(self):

1635

1442

if self.enabled:

1636

1443

return socketserver.TCPServer.server_activate(self)

1637

1638

1444

def enable(self):

1639

1445

self.enabled = True

1640

1641

def add_pipe(self, parent_pipe, proc):

1446

def add_pipe(self, parent_pipe):

1642

1447

# Call "handle_ipc" for both data and EOF events

1643

1448

gobject.io_add_watch(parent_pipe.fileno(),

1644

1449

gobject.IO_IN | gobject.IO_HUP,

1645

1450

functools.partial(self.handle_ipc,

1646

parent_pipe =

1647

parent_pipe,

1648

proc = proc))

1649

1451

parent_pipe = parent_pipe))

1452

1650

1453

def handle_ipc(self, source, condition, parent_pipe=None,

1651

proc = None, client_object=None):

1454

client_object=None):

1652

1455

condition_names = {

1653

gobject.IO_IN: "IN", # There is data to read.

1654

gobject.IO_OUT: "OUT", # Data can be written (without

1456

gobject.IO_IN: u"IN", # There is data to read.

1457

gobject.IO_OUT: u"OUT", # Data can be written (without

1655

1458

# blocking).

1656

gobject.IO_PRI: "PRI", # There is urgent data to read.

1657

gobject.IO_ERR: "ERR", # Error condition.

1658

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1459

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1460

gobject.IO_ERR: u"ERR", # Error condition.

1461

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1659

1462

# broken, usually for pipes and

1660

1463

# sockets).

1661

1464

}

1663

1466

for cond, name in

1664

1467

condition_names.iteritems()

1665

1468

if cond & condition)

1666

# error, or the other end of multiprocessing.Pipe has closed

1469

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1470

conditions_string)

1471

1472

# error or the other end of multiprocessing.Pipe has closed

1667

1473

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1668

# Wait for other process to exit

1669

proc.join()

1670

1474

return False

1671

1475

1672

1476

# Read a request from the child

1673

1477

request = parent_pipe.recv()

1478

logger.debug(u"IPC request: %s", repr(request))

1674

1479

command = request[0]

1675

1480

1676

1481

if command == 'init':

1682

1487

client = c

1683

1488

break

1684

1489

else:

1685

logger.info("Client not found for fingerprint: %s, ad"

1686

"dress: %s", fpr, address)

1490

logger.warning(u"Client not found for fingerprint: %s, ad"

1491

u"dress: %s", fpr, address)

1687

1492

if self.use_dbus:

1688

1493

# Emit D-Bus signal

1689

mandos_dbus_service.ClientNotFound(fpr,

1690

address[0])

1494

mandos_dbus_service.ClientNotFound(fpr, address)

1691

1495

parent_pipe.send(False)

1692

1496

return False

1693

1497

1694

1498

gobject.io_add_watch(parent_pipe.fileno(),

1695

1499

gobject.IO_IN | gobject.IO_HUP,

1696

1500

functools.partial(self.handle_ipc,

1697

parent_pipe =

1698

parent_pipe,

1699

proc = proc,

1700

client_object =

1701

client))

1501

parent_pipe = parent_pipe,

1502

client_object = client))

1702

1503

parent_pipe.send(True)

1703

# remove the old hook in favor of the new above hook on

1704

# same fileno

1504

# remove the old hook in favor of the new above hook on same fileno

1705

1505

return False

1706

1506

if command == 'funcall':

1707

1507

funcname = request[1]

1708

1508

args = request[2]

1709

1509

kwargs = request[3]

1710

1510

1711

parent_pipe.send(('data', getattr(client_object,

1712

funcname)(*args,

1713

**kwargs)))

1714

1511

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1512

1715

1513

if command == 'getattr':

1716

1514

attrname = request[1]

1717

1515

if callable(client_object.__getattribute__(attrname)):

1718

1516

parent_pipe.send(('function',))

1719

1517

else:

1720

parent_pipe.send(('data', client_object

1721

.__getattribute__(attrname)))

1518

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1722

1519

1723

1520

if command == 'setattr':

1724

1521

attrname = request[1]

1725

1522

value = request[2]

1726

1523

setattr(client_object, attrname, value)

1727

1524

1728

1525

return True

1729

1526

1730

1527

1731

1528

def string_to_delta(interval):

1732

1529

"""Parse a string and return a datetime.timedelta

1733

1530

1734

>>> string_to_delta('7d')

1531

>>> string_to_delta(u'7d')

1735

1532

datetime.timedelta(7)

1736

>>> string_to_delta('60s')

1533

>>> string_to_delta(u'60s')

1737

1534

datetime.timedelta(0, 60)

1738

>>> string_to_delta('60m')

1535

>>> string_to_delta(u'60m')

1739

1536

datetime.timedelta(0, 3600)

1740

>>> string_to_delta('24h')

1537

>>> string_to_delta(u'24h')

1741

1538

datetime.timedelta(1)

1742

>>> string_to_delta('1w')

1539

>>> string_to_delta(u'1w')

1743

1540

datetime.timedelta(7)

1744

>>> string_to_delta('5m 30s')

1541

>>> string_to_delta(u'5m 30s')

1745

1542

datetime.timedelta(0, 330)

1746

1543

"""

1747

1544

timevalue = datetime.timedelta(0)

1749

1546

try:

1750

1547

suffix = unicode(s[-1])

1751

1548

value = int(s[:-1])

1752

if suffix == "d":

1549

if suffix == u"d":

1753

1550

delta = datetime.timedelta(value)

1754

elif suffix == "s":

1551

elif suffix == u"s":

1755

1552

delta = datetime.timedelta(0, value)

1756

elif suffix == "m":

1553

elif suffix == u"m":

1757

1554

delta = datetime.timedelta(0, 0, 0, 0, value)

1758

elif suffix == "h":

1555

elif suffix == u"h":

1759

1556

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1760

elif suffix == "w":

1557

elif suffix == u"w":

1761

1558

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1762

1559

else:

1763

raise ValueError("Unknown suffix %r" % suffix)

1764

except (ValueError, IndexError) as e:

1765

raise ValueError(*(e.args))

1560

raise ValueError(u"Unknown suffix %r" % suffix)

1561

except (ValueError, IndexError), e:

1562

raise ValueError(e.message)

1766

1563

timevalue += delta

1767

1564

return timevalue

1768

1565

1774

1571

global if_nametoindex

1775

1572

try:

1776

1573

if_nametoindex = (ctypes.cdll.LoadLibrary

1777

(ctypes.util.find_library("c"))

1574

(ctypes.util.find_library(u"c"))

1778

1575

.if_nametoindex)

1779

1576

except (OSError, AttributeError):

1780

logger.warning("Doing if_nametoindex the hard way")

1577

logger.warning(u"Doing if_nametoindex the hard way")

1781

1578

def if_nametoindex(interface):

1782

1579

"Get an interface index the hard way, i.e. using fcntl()"

1783

1580

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1784

1581

with contextlib.closing(socket.socket()) as s:

1785

1582

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1786

struct.pack(str("16s16x"),

1583

struct.pack(str(u"16s16x"),

1787

1584

interface))

1788

interface_index = struct.unpack(str("I"),

1585

interface_index = struct.unpack(str(u"I"),

1789

1586

ifreq[16:20])[0]

1790

1587

return interface_index

1791

1588

return if_nametoindex(interface)

1799

1596

sys.exit()

1800

1597

os.setsid()

1801

1598

if not nochdir:

1802

os.chdir("/")

1599

os.chdir(u"/")

1803

1600

if os.fork():

1804

1601

sys.exit()

1805

1602

if not noclose:

1807

1604

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1808

1605

if not stat.S_ISCHR(os.fstat(null).st_mode):

1809

1606

raise OSError(errno.ENODEV,

1810

"%s not a character device"

1607

u"%s not a character device"

1811

1608

% os.path.devnull)

1812

1609

os.dup2(null, sys.stdin.fileno())

1813

1610

os.dup2(null, sys.stdout.fileno())

1821

1618

##################################################################

1822

1619

# Parsing of options, both command line and config file

1823

1620

1824

parser = argparse.ArgumentParser()

1825

parser.add_argument("-v", "--version", action="version",

1826

version = "%%(prog)s %s" % version,

1827

help="show version number and exit")

1828

parser.add_argument("-i", "--interface", metavar="IF",

1829

help="Bind to interface IF")

1830

parser.add_argument("-a", "--address",

1831

help="Address to listen for requests on")

1832

parser.add_argument("-p", "--port", type=int,

1833

help="Port number to receive requests on")

1834

parser.add_argument("--check", action="store_true",

1835

help="Run self-test")

1836

parser.add_argument("--debug", action="store_true",

1837

help="Debug mode; run in foreground and log"

1838

" to terminal")

1839

parser.add_argument("--debuglevel", metavar="LEVEL",

1840

help="Debug level for stdout output")

1841

parser.add_argument("--priority", help="GnuTLS"

1842

" priority string (see GnuTLS documentation)")

1843

parser.add_argument("--servicename",

1844

metavar="NAME", help="Zeroconf service name")

1845

parser.add_argument("--configdir",

1846

default="/etc/mandos", metavar="DIR",

1847

help="Directory to search for configuration"

1848

" files")

1849

parser.add_argument("--no-dbus", action="store_false",

1850

dest="use_dbus", help="Do not provide D-Bus"

1851

" system bus interface")

1852

parser.add_argument("--no-ipv6", action="store_false",

1853

dest="use_ipv6", help="Do not use IPv6")

1854

options = parser.parse_args()

1621

parser = optparse.OptionParser(version = "%%prog %s" % version)

1622

parser.add_option("-i", u"--interface", type=u"string",

1623

metavar="IF", help=u"Bind to interface IF")

1624

parser.add_option("-a", u"--address", type=u"string",

1625

help=u"Address to listen for requests on")

1626

parser.add_option("-p", u"--port", type=u"int",

1627

help=u"Port number to receive requests on")

1628

parser.add_option("--check", action=u"store_true",

1629

help=u"Run self-test")

1630

parser.add_option("--debug", action=u"store_true",

1631

help=u"Debug mode; run in foreground and log to"

1632

u" terminal")

1633

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1634

help=u"Debug level for stdout output")

1635

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1636

u" priority string (see GnuTLS documentation)")

1637

parser.add_option("--servicename", type=u"string",

1638

metavar=u"NAME", help=u"Zeroconf service name")

1639

parser.add_option("--configdir", type=u"string",

1640

default=u"/etc/mandos", metavar=u"DIR",

1641

help=u"Directory to search for configuration"

1642

u" files")

1643

parser.add_option("--no-dbus", action=u"store_false",

1644

dest=u"use_dbus", help=u"Do not provide D-Bus"

1645

u" system bus interface")

1646

parser.add_option("--no-ipv6", action=u"store_false",

1647

dest=u"use_ipv6", help=u"Do not use IPv6")

1648

options = parser.parse_args()[0]

1855

1649

1856

1650

if options.check:

1857

1651

import doctest

1859

1653

sys.exit()

1860

1654

1861

1655

# Default values for config file for server-global settings

1862

server_defaults = { "interface": "",

1863

"address": "",

1864

"port": "",

1865

"debug": "False",

1866

"priority":

1867

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1868

"servicename": "Mandos",

1869

"use_dbus": "True",

1870

"use_ipv6": "True",

1871

"debuglevel": "",

1656

server_defaults = { u"interface": u"",

1657

u"address": u"",

1658

u"port": u"",

1659

u"debug": u"False",

1660

u"priority":

1661

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1662

u"servicename": u"Mandos",

1663

u"use_dbus": u"True",

1664

u"use_ipv6": u"True",

1665

u"debuglevel": u"",

1872

1666

}

1873

1667

1874

1668

# Parse config file for server-global settings

1875

1669

server_config = configparser.SafeConfigParser(server_defaults)

1876

1670

del server_defaults

1877

1671

server_config.read(os.path.join(options.configdir,

1878

"mandos.conf"))

1672

u"mandos.conf"))

1879

1673

# Convert the SafeConfigParser object to a dict

1880

1674

server_settings = server_config.defaults()

1881

1675

# Use the appropriate methods on the non-string config options

1882

for option in ("debug", "use_dbus", "use_ipv6"):

1883

server_settings[option] = server_config.getboolean("DEFAULT",

1676

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1677

server_settings[option] = server_config.getboolean(u"DEFAULT",

1884

1678

option)

1885

1679

if server_settings["port"]:

1886

server_settings["port"] = server_config.getint("DEFAULT",

1887

"port")

1680

server_settings["port"] = server_config.getint(u"DEFAULT",

1681

u"port")

1888

1682

del server_config

1889

1683

1890

1684

# Override the settings from the config file with command line

1891

1685

# options, if set.

1892

for option in ("interface", "address", "port", "debug",

1893

"priority", "servicename", "configdir",

1894

"use_dbus", "use_ipv6", "debuglevel"):

1686

for option in (u"interface", u"address", u"port", u"debug",

1687

u"priority", u"servicename", u"configdir",

1688

u"use_dbus", u"use_ipv6", u"debuglevel"):

1895

1689

value = getattr(options, option)

1896

1690

if value is not None:

1897

1691

server_settings[option] = value

1905

1699

##################################################################

1906

1700

1907

1701

# For convenience

1908

debug = server_settings["debug"]

1909

debuglevel = server_settings["debuglevel"]

1910

use_dbus = server_settings["use_dbus"]

1911

use_ipv6 = server_settings["use_ipv6"]

1912

1913

if server_settings["servicename"] != "Mandos":

1702

debug = server_settings[u"debug"]

1703

debuglevel = server_settings[u"debuglevel"]

1704

use_dbus = server_settings[u"use_dbus"]

1705

use_ipv6 = server_settings[u"use_ipv6"]

1706

1707

if server_settings[u"servicename"] != u"Mandos":

1914

1708

syslogger.setFormatter(logging.Formatter

1915

('Mandos (%s) [%%(process)d]:'

1916

' %%(levelname)s: %%(message)s'

1917

% server_settings["servicename"]))

1709

(u'Mandos (%s) [%%(process)d]:'

1710

u' %%(levelname)s: %%(message)s'

1711

% server_settings[u"servicename"]))

1918

1712

1919

1713

# Parse config file with clients

1920

client_defaults = { "timeout": "5m",

1921

"extended_timeout": "15m",

1922

"interval": "2m",

1923

"checker": "fping -q -- %%(host)s",

1924

"host": "",

1925

"approval_delay": "0s",

1926

"approval_duration": "1s",

1714

client_defaults = { u"timeout": u"1h",

1715

u"interval": u"5m",

1716

u"checker": u"fping -q -- %%(host)s",

1717

u"host": u"",

1718

u"approved_delay": u"0s",

1719

u"approved_duration": u"1s",

1927

1720

}

1928

1721

client_config = configparser.SafeConfigParser(client_defaults)

1929

client_config.read(os.path.join(server_settings["configdir"],

1930

"clients.conf"))

1722

client_config.read(os.path.join(server_settings[u"configdir"],

1723

u"clients.conf"))

1931

1724

1932

1725

global mandos_dbus_service

1933

1726

mandos_dbus_service = None

1934

1727

1935

tcp_server = MandosServer((server_settings["address"],

1936

server_settings["port"]),

1728

tcp_server = MandosServer((server_settings[u"address"],

1729

server_settings[u"port"]),

1937

1730

ClientHandler,

1938

interface=(server_settings["interface"]

1939

or None),

1731

interface=server_settings[u"interface"],

1940

1732

use_ipv6=use_ipv6,

1941

1733

gnutls_priority=

1942

server_settings["priority"],

1734

server_settings[u"priority"],

1943

1735

use_dbus=use_dbus)

1944

if not debug:

1945

pidfilename = "/var/run/mandos.pid"

1946

try:

1947

pidfile = open(pidfilename, "w")

1948

except IOError:

1949

logger.error("Could not open file %r", pidfilename)

1736

pidfilename = u"/var/run/mandos.pid"

1737

try:

1738

pidfile = open(pidfilename, u"w")

1739

except IOError:

1740

logger.error(u"Could not open file %r", pidfilename)

1950

1741

1951

1742

try:

1952

uid = pwd.getpwnam("_mandos").pw_uid

1953

gid = pwd.getpwnam("_mandos").pw_gid

1743

uid = pwd.getpwnam(u"_mandos").pw_uid

1744

gid = pwd.getpwnam(u"_mandos").pw_gid

1954

1745

except KeyError:

1955

1746

try:

1956

uid = pwd.getpwnam("mandos").pw_uid

1957

gid = pwd.getpwnam("mandos").pw_gid

1747

uid = pwd.getpwnam(u"mandos").pw_uid

1748

gid = pwd.getpwnam(u"mandos").pw_gid

1958

1749

except KeyError:

1959

1750

try:

1960

uid = pwd.getpwnam("nobody").pw_uid

1961

gid = pwd.getpwnam("nobody").pw_gid

1751

uid = pwd.getpwnam(u"nobody").pw_uid

1752

gid = pwd.getpwnam(u"nobody").pw_gid

1962

1753

except KeyError:

1963

1754

uid = 65534

1964

1755

gid = 65534

1965

1756

try:

1966

1757

os.setgid(gid)

1967

1758

os.setuid(uid)

1968

except OSError as error:

1759

except OSError, error:

1969

1760

if error[0] != errno.EPERM:

1970

1761

raise error

1971

1762

1763

# Enable all possible GnuTLS debugging

1764

1765

1972

1766

if not debug and not debuglevel:

1973

1767

syslogger.setLevel(logging.WARNING)

1974

1768

console.setLevel(logging.WARNING)

1976

1770

level = getattr(logging, debuglevel.upper())

1977

1771

syslogger.setLevel(level)

1978

1772

console.setLevel(level)

1979

1773

1980

1774

if debug:

1981

# Enable all possible GnuTLS debugging

1982

1983

1775

# "Use a log level over 10 to enable all debugging options."

1984

1776

# - GnuTLS manual

1985

1777

gnutls.library.functions.gnutls_global_set_log_level(11)

1986

1778

1987

1779

@gnutls.library.types.gnutls_log_func

1988

1780

def debug_gnutls(level, string):

1989

logger.debug("GnuTLS: %s", string[:-1])

1781

logger.debug(u"GnuTLS: %s", string[:-1])

1990

1782

1991

1783

(gnutls.library.functions

1992

1784

.gnutls_global_set_log_function(debug_gnutls))

1993

1785

1994

1786

# Redirect stdin so all checkers get /dev/null

1995

1787

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1996

1788

os.dup2(null, sys.stdin.fileno())

1999

1791

else:

2000

1792

# No console logging

2001

1793

logger.removeHandler(console)

2002

2003

# Need to fork before connecting to D-Bus

2004

if not debug:

2005

# Close all input and output, do double fork, etc.

2006

daemon()

1794

2007

1795

2008

1796

global main_loop

2009

1797

# From the Avahi example code

2013

1801

# End of Avahi example code

2014

1802

if use_dbus:

2015

1803

try:

2016

bus_name = dbus.service.BusName("se.recompile.Mandos",

1804

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2017

1805

bus, do_not_queue=True)

2018

old_bus_name = (dbus.service.BusName

2019

("se.bsnet.fukt.Mandos", bus,

2020

do_not_queue=True))

2021

except dbus.exceptions.NameExistsException as e:

2022

logger.error(unicode(e) + ", disabling D-Bus")

1806

except dbus.exceptions.NameExistsException, e:

1807

logger.error(unicode(e) + u", disabling D-Bus")

2023

1808

use_dbus = False

2024

server_settings["use_dbus"] = False

1809

server_settings[u"use_dbus"] = False

2025

1810

tcp_server.use_dbus = False

2026

1811

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2027

service = AvahiService(name = server_settings["servicename"],

2028

servicetype = "_mandos._tcp",

1812

service = AvahiService(name = server_settings[u"servicename"],

1813

servicetype = u"_mandos._tcp",

2029

1814

protocol = protocol, bus = bus)

2030

1815

if server_settings["interface"]:

2031

1816

service.interface = (if_nametoindex

2032

(str(server_settings["interface"])))

2033

1817

(str(server_settings[u"interface"])))

1818

1819

if not debug:

1820

# Close all input and output, do double fork, etc.

1821

daemon()

1822

2034

1823

global multiprocessing_manager

2035

1824

multiprocessing_manager = multiprocessing.Manager()

2036

1825

2037

1826

client_class = Client

2038

1827

if use_dbus:

2039

client_class = functools.partial(ClientDBusTransitional,

2040

bus = bus)

1828

client_class = functools.partial(ClientDBus, bus = bus)

2041

1829

def client_config_items(config, section):

2042

1830

special_settings = {

2043

1831

"approved_by_default":

2056

1844

client_config, section)))

2057

1845

for section in client_config.sections()))

2058

1846

if not tcp_server.clients:

2059

logger.warning("No clients defined")

1847

logger.warning(u"No clients defined")

2060

1848

1849

try:

1850

with pidfile:

1851

pid = os.getpid()

1852

pidfile.write(str(pid) + "\n")

1853

del pidfile

1854

except IOError:

1855

logger.error(u"Could not write to file %r with PID %d",

1856

pidfilename, pid)

1857

except NameError:

1858

# "pidfile" was never created

1859

pass

1860

del pidfilename

1861

2061

1862

if not debug:

2062

try:

2063

with pidfile:

2064

pid = os.getpid()

2065

pidfile.write(str(pid) + "\n".encode("utf-8"))

2066

del pidfile

2067

except IOError:

2068

logger.error("Could not write to file %r with PID %d",

2069

pidfilename, pid)

2070

except NameError:

2071

# "pidfile" was never created

2072

pass

2073

del pidfilename

2074

2075

1863

signal.signal(signal.SIGINT, signal.SIG_IGN)

2076

2077

1864

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2078

1865

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2079

1866

2081

1868

class MandosDBusService(dbus.service.Object):

2082

1869

"""A D-Bus proxy object"""

2083

1870

def __init__(self):

2084

dbus.service.Object.__init__(self, bus, "/")

2085

_interface = "se.recompile.Mandos"

1871

dbus.service.Object.__init__(self, bus, u"/")

1872

_interface = u"se.bsnet.fukt.Mandos"

2086

1873

2087

@dbus.service.signal(_interface, signature="o")

1874

@dbus.service.signal(_interface, signature=u"o")

2088

1875

def ClientAdded(self, objpath):

2089

1876

"D-Bus signal"

2090

1877

pass

2091

1878

2092

@dbus.service.signal(_interface, signature="ss")

1879

@dbus.service.signal(_interface, signature=u"ss")

2093

1880

def ClientNotFound(self, fingerprint, address):

2094

1881

"D-Bus signal"

2095

1882

pass

2096

1883

2097

@dbus.service.signal(_interface, signature="os")

1884

@dbus.service.signal(_interface, signature=u"os")

2098

1885

def ClientRemoved(self, objpath, name):

2099

1886

"D-Bus signal"

2100

1887

pass

2101

1888

2102

@dbus.service.method(_interface, out_signature="ao")

1889

@dbus.service.method(_interface, out_signature=u"ao")

2103

1890

def GetAllClients(self):

2104

1891

"D-Bus method"

2105

1892

return dbus.Array(c.dbus_object_path

2106

1893

for c in tcp_server.clients)

2107

1894

2108

1895

@dbus.service.method(_interface,

2109

out_signature="a{oa{sv}}")

1896

out_signature=u"a{oa{sv}}")

2110

1897

def GetAllClientsWithProperties(self):

2111

1898

"D-Bus method"

2112

1899

return dbus.Dictionary(

2113

((c.dbus_object_path, c.GetAll(""))

1900

((c.dbus_object_path, c.GetAll(u""))

2114

1901

for c in tcp_server.clients),

2115

signature="oa{sv}")

1902

signature=u"oa{sv}")

2116

1903

2117

@dbus.service.method(_interface, in_signature="o")

1904

@dbus.service.method(_interface, in_signature=u"o")

2118

1905

def RemoveClient(self, object_path):

2119

1906

"D-Bus method"

2120

1907

for c in tcp_server.clients:

2130

1917

2131

1918

del _interface

2132

1919

2133

class MandosDBusServiceTransitional(MandosDBusService):

2134

__metaclass__ = AlternateDBusNamesMetaclass

2135

mandos_dbus_service = MandosDBusServiceTransitional()

1920

mandos_dbus_service = MandosDBusService()

2136

1921

2137

1922

def cleanup():

2138

1923

"Cleanup function; run on exit"

2139

1924

service.cleanup()

2140

1925

2141

multiprocessing.active_children()

2142

1926

while tcp_server.clients:

2143

1927

client = tcp_server.clients.pop()

2144

1928

if use_dbus:

2148

1932

client.disable(quiet=True)

2149

1933

if use_dbus:

2150

1934

# Emit D-Bus signal

2151

mandos_dbus_service.ClientRemoved(client

2152

.dbus_object_path,

1935

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2153

1936

client.name)

2154

1937

2155

1938

atexit.register(cleanup)

2166

1949

# Find out what port we got

2167

1950

service.port = tcp_server.socket.getsockname()[1]

2168

1951

if use_ipv6:

2169

logger.info("Now listening on address %r, port %d,"

1952

logger.info(u"Now listening on address %r, port %d,"

2170

1953

" flowinfo %d, scope_id %d"

2171

1954

% tcp_server.socket.getsockname())

2172

1955

else: # IPv4

2173

logger.info("Now listening on address %r, port %d"

1956

logger.info(u"Now listening on address %r, port %d"

2174

1957

% tcp_server.socket.getsockname())

2175

1958

2176

1959

#service.interface = tcp_server.socket.getsockname()[3]

2179

1962

# From the Avahi example code

2180

1963

try:

2181

1964

service.activate()

2182

except dbus.exceptions.DBusException as error:

2183

logger.critical("DBusException: %s", error)

1965

except dbus.exceptions.DBusException, error:

1966

logger.critical(u"DBusException: %s", error)

2184

1967

cleanup()

2185

1968

sys.exit(1)

2186

1969

# End of Avahi example code

2190

1973

(tcp_server.handle_request

2191

1974

(*args[2:], **kwargs) or True))

2192

1975

2193

logger.debug("Starting main loop")

1976

logger.debug(u"Starting main loop")

2194

1977

main_loop.run()

2195

except AvahiError as error:

2196

logger.critical("AvahiError: %s", error)

1978

except AvahiError, error:

1979

logger.critical(u"AvahiError: %s", error)

2197

1980

cleanup()

2198

1981

sys.exit(1)

2199

1982

except KeyboardInterrupt:

2200

1983

if debug:

2201

print("", file=sys.stderr)

2202

logger.debug("Server received KeyboardInterrupt")

2203

logger.debug("Server exiting")

1984

print >> sys.stderr

1985

logger.debug(u"Server received KeyboardInterrupt")

1986

logger.debug(u"Server exiting")

2204

1987

# Must run before the D-Bus bus name gets deregistered

2205

1988

cleanup()

2206

1989

2207

2208

1990

if __name__ == '__main__':

2209

1991

main()