/mandos/release : revision 24.1.159

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

62

61

import functools

63

62

import cPickle as pickle

64

63

import multiprocessing

65

import types

66

64

67

65

import dbus

68

66

import dbus.service

83

81

SO_BINDTODEVICE = None

84

82

85

83

86

version = "1.3.1"

84

version = "1.0.14"

87

85

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

90

88

syslogger = (logging.handlers.SysLogHandler

91

89

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

address = str("/dev/log")))

90

address = "/dev/log"))

93

91

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

96

94

logger.addHandler(syslogger)

97

95

98

96

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

102

100

logger.addHandler(console)

103

101

104

102

class AvahiError(Exception):

121

119

Attributes:

122

120

interface: integer; avahi.IF_UNSPEC or an interface index.

123

121

Used to optionally bind to the specified interface.

124

125

type: string; Example: '_mandos._tcp'.

122

123

type: string; Example: u'_mandos._tcp'.

126

124

See <http://www.dns-sd.org/ServiceTypes.html>

127

125

port: integer; what port to announce

128

126

TXT: list of strings; TXT record for the service

137

135

"""

138

136

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

139

137

servicetype = None, port = None, TXT = None,

140

domain = "", host = "", max_renames = 32768,

138

domain = u"", host = u"", max_renames = 32768,

141

139

protocol = avahi.PROTO_UNSPEC, bus = None):

142

140

self.interface = interface

143

141

self.name = name

152

150

self.group = None # our entry group

153

151

self.server = None

154

152

self.bus = bus

155

self.entry_group_state_changed_match = None

156

153

def rename(self):

157

154

"""Derived from the Avahi example code"""

158

155

if self.rename_count >= self.max_renames:

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

161

158

self.rename_count)

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server

164

.GetAlternativeServiceName(self.name))

165

logger.info("Changing Zeroconf service name to %r ...",

159

raise AvahiServiceError(u"Too many renames")

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

166

162

self.name)

167

163

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

170

166

% self.name))

171

167

self.remove()

172

try:

173

self.add()

174

except dbus.exceptions.DBusException as error:

175

logger.critical("DBusException: %s", error)

176

self.cleanup()

177

os._exit(1)

168

self.add()

178

169

self.rename_count += 1

179

170

def remove(self):

180

171

"""Derived from the Avahi example code"""

181

if self.entry_group_state_changed_match is not None:

182

self.entry_group_state_changed_match.remove()

183

self.entry_group_state_changed_match = None

184

172

if self.group is not None:

185

173

self.group.Reset()

186

174

def add(self):

187

175

"""Derived from the Avahi example code"""

188

self.remove()

189

176

if self.group is None:

190

177

self.group = dbus.Interface(

191

178

self.bus.get_object(avahi.DBUS_NAME,

192

179

self.server.EntryGroupNew()),

193

180

avahi.DBUS_INTERFACE_ENTRY_GROUP)

194

self.entry_group_state_changed_match = (

195

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

181

self.group.connect_to_signal('StateChanged',

182

self

183

.entry_group_state_changed)

184

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

198

185

self.name, self.type)

199

186

self.group.AddService(

200

187

self.interface,

207

194

self.group.Commit()

208

195

def entry_group_state_changed(self, state, error):

209

196

"""Derived from the Avahi example code"""

210

logger.debug("Avahi entry group state change: %i", state)

197

logger.debug(u"Avahi entry group state change: %i", state)

211

198

212

199

if state == avahi.ENTRY_GROUP_ESTABLISHED:

213

logger.debug("Zeroconf service established.")

200

logger.debug(u"Zeroconf service established.")

214

201

elif state == avahi.ENTRY_GROUP_COLLISION:

215

logger.info("Zeroconf service name collision.")

202

logger.warning(u"Zeroconf service name collision.")

216

203

self.rename()

217

204

elif state == avahi.ENTRY_GROUP_FAILURE:

218

logger.critical("Avahi: Error in group state changed %s",

205

logger.critical(u"Avahi: Error in group state changed %s",

219

206

unicode(error))

220

raise AvahiGroupError("State changed: %s"

207

raise AvahiGroupError(u"State changed: %s"

221

208

% unicode(error))

222

209

def cleanup(self):

223

210

"""Derived from the Avahi example code"""

224

211

if self.group is not None:

225

try:

226

self.group.Free()

227

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

229

pass

212

self.group.Free()

230

213

self.group = None

231

self.remove()

232

def server_state_changed(self, state, error=None):

214

def server_state_changed(self, state):

233

215

"""Derived from the Avahi example code"""

234

logger.debug("Avahi server state change: %i", state)

235

bad_states = { avahi.SERVER_INVALID:

236

"Zeroconf server invalid",

237

avahi.SERVER_REGISTERING: None,

238

avahi.SERVER_COLLISION:

239

"Zeroconf server name collision",

240

avahi.SERVER_FAILURE:

241

"Zeroconf server failure" }

242

if state in bad_states:

243

if bad_states[state] is not None:

244

if error is None:

245

logger.error(bad_states[state])

246

else:

247

logger.error(bad_states[state] + ": %r", error)

248

self.cleanup()

216

logger.debug(u"Avahi server state change: %i", state)

217

if state == avahi.SERVER_COLLISION:

218

logger.error(u"Zeroconf server name collision")

219

self.remove()

249

220

elif state == avahi.SERVER_RUNNING:

250

221

self.add()

251

else:

252

if error is None:

253

logger.debug("Unknown state: %r", state)

254

else:

255

logger.debug("Unknown state: %r: %r", state, error)

256

222

def activate(self):

257

223

"""Derived from the Avahi example code"""

258

224

if self.server is None:

259

225

self.server = dbus.Interface(

260

226

self.bus.get_object(avahi.DBUS_NAME,

261

avahi.DBUS_PATH_SERVER,

262

follow_name_owner_changes=True),

227

avahi.DBUS_PATH_SERVER),

263

228

avahi.DBUS_INTERFACE_SERVER)

264

self.server.connect_to_signal("StateChanged",

229

self.server.connect_to_signal(u"StateChanged",

265

230

self.server_state_changed)

266

231

self.server_state_changed(self.server.GetState())

267

232

268

233

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

274

275

234

class Client(object):

276

235

"""A representation of a client host served by this server.

277

236

278

237

Attributes:

279

_approved: bool(); 'None' if not yet approved/disapproved

280

approval_delay: datetime.timedelta(); Time to wait for approval

281

approval_duration: datetime.timedelta(); Duration of one approval

238

239

D-Bus identifiers

240

fingerprint: string (40 or 32 hexadecimal digits); used to

241

uniquely identify the client

242

secret: bytestring; sent verbatim (over TLS) to client

243

host: string; available for use by the checker command

244

created: datetime.datetime(); (UTC) object creation

245

last_enabled: datetime.datetime(); (UTC)

246

enabled: bool()

247

last_checked_ok: datetime.datetime(); (UTC) or None

248

timeout: datetime.timedelta(); How long from last_checked_ok

249

until this client is disabled

250

interval: datetime.timedelta(); How often to start a new checker

251

disable_hook: If set, called by disable() as disable_hook(self)

282

252

checker: subprocess.Popen(); a running checker process used

283

253

to see if the client lives.

284

254

'None' if no process is running.

285

checker_callback_tag: a gobject event source tag, or None

286

checker_command: string; External command which is run to check

287

if client lives. %() expansions are done at

255

checker_initiator_tag: a gobject event source tag, or None

256

disable_initiator_tag: - '' -

257

checker_callback_tag: - '' -

258

checker_command: string; External command which is run to check if

259

client lives. %() expansions are done at

288

260

runtime with vars(self) as dict, so that for

289

261

instance %(name)s can be used in the command.

290

checker_initiator_tag: a gobject event source tag, or None

291

created: datetime.datetime(); (UTC) object creation

292

262

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

294

disable_initiator_tag: a gobject event source tag, or None

295

enabled: bool()

296

fingerprint: string (40 or 32 hexadecimal digits); used to

297

uniquely identify the client

298

host: string; available for use by the checker command

299

interval: datetime.timedelta(); How often to start a new checker

300

last_approval_request: datetime.datetime(); (UTC) or None

301

last_checked_ok: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

303

304

D-Bus identifiers

305

secret: bytestring; sent verbatim (over TLS) to client

306

timeout: datetime.timedelta(); How long from last_checked_ok

307

until this client is disabled

308

extended_timeout: extra long timeout when password has been sent

309

runtime_expansions: Allowed attributes for runtime expansion.

310

expires: datetime.datetime(); time (UTC) when a client will be

311

disabled, or None

263

approved_delay: datetime.timedelta(); Time to wait for approval

264

_approved: bool(); 'None' if not yet approved/disapproved

265

approved_duration: datetime.timedelta(); Duration of one approval

312

266

"""

313

267

314

runtime_expansions = ("approval_delay", "approval_duration",

315

"created", "enabled", "fingerprint",

316

"host", "interval", "last_checked_ok",

317

"last_enabled", "name", "timeout")

268

@staticmethod

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

318

274

319

275

def timeout_milliseconds(self):

320

276

"Return the 'timeout' attribute in milliseconds"

321

return _timedelta_to_milliseconds(self.timeout)

322

323

def extended_timeout_milliseconds(self):

324

"Return the 'extended_timeout' attribute in milliseconds"

325

return _timedelta_to_milliseconds(self.extended_timeout)

277

return self._timedelta_to_milliseconds(self.timeout)

326

278

327

279

def interval_milliseconds(self):

328

280

"Return the 'interval' attribute in milliseconds"

329

return _timedelta_to_milliseconds(self.interval)

330

331

def approval_delay_milliseconds(self):

332

return _timedelta_to_milliseconds(self.approval_delay)

281

return self._timedelta_to_milliseconds(self.interval)

282

283

def approved_delay_milliseconds(self):

284

return self._timedelta_to_milliseconds(self.approved_delay)

333

285

334

286

def __init__(self, name = None, disable_hook=None, config=None):

335

287

"""Note: the 'checker' key in 'config' sets the

338

290

self.name = name

339

291

if config is None:

340

292

config = {}

341

logger.debug("Creating client %r", self.name)

293

logger.debug(u"Creating client %r", self.name)

342

294

# Uppercase and remove spaces from fingerprint for later

343

295

# comparison purposes with return value from the fingerprint()

344

296

# function

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

347

logger.debug(" Fingerprint: %s", self.fingerprint)

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

297

self.fingerprint = (config[u"fingerprint"].upper()

298

.replace(u" ", u""))

299

logger.debug(u" Fingerprint: %s", self.fingerprint)

300

if u"secret" in config:

301

self.secret = config[u"secret"].decode(u"base64")

302

elif u"secfile" in config:

351

303

with open(os.path.expanduser(os.path.expandvars

352

(config["secfile"])),

304

(config[u"secfile"])),

353

305

"rb") as secfile:

354

306

self.secret = secfile.read()

355

307

else:

356

raise TypeError("No secret or secfile for client %s"

308

raise TypeError(u"No secret or secfile for client %s"

357

309

% self.name)

358

self.host = config.get("host", "")

310

self.host = config.get(u"host", u"")

359

311

self.created = datetime.datetime.utcnow()

360

312

self.enabled = False

361

self.last_approval_request = None

362

313

self.last_enabled = None

363

314

self.last_checked_ok = None

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

315

self.timeout = string_to_delta(config[u"timeout"])

316

self.interval = string_to_delta(config[u"interval"])

368

317

self.disable_hook = disable_hook

369

318

self.checker = None

370

319

self.checker_initiator_tag = None

371

320

self.disable_initiator_tag = None

372

self.expires = None

373

321

self.checker_callback_tag = None

374

self.checker_command = config["checker"]

322

self.checker_command = config[u"checker"]

375

323

self.current_checker_command = None

376

324

self.last_connect = None

377

325

self._approved = None

378

self.approved_by_default = config.get("approved_by_default",

326

self.approved_by_default = config.get(u"approved_by_default",

379

327

True)

380

328

self.approvals_pending = 0

381

self.approval_delay = string_to_delta(

382

config["approval_delay"])

383

self.approval_duration = string_to_delta(

384

config["approval_duration"])

385

self.changedstate = (multiprocessing_manager

386

.Condition(multiprocessing_manager

387

.Lock()))

329

self.approved_delay = string_to_delta(

330

config[u"approved_delay"])

331

self.approved_duration = string_to_delta(

332

config[u"approved_duration"])

333

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

388

334

389

335

def send_changedstate(self):

390

336

self.changedstate.acquire()

391

337

self.changedstate.notify_all()

392

338

self.changedstate.release()

393

339

394

340

def enable(self):

395

341

"""Start this client's checker and timeout hooks"""

396

if getattr(self, "enabled", False):

342

if getattr(self, u"enabled", False):

397

343

# Already enabled

398

344

return

399

345

self.send_changedstate()

346

self.last_enabled = datetime.datetime.utcnow()

400

347

# Schedule a new checker to be started an 'interval' from now,

401

348

# and every interval from then on.

402

349

self.checker_initiator_tag = (gobject.timeout_add

403

350

(self.interval_milliseconds(),

404

351

self.start_checker))

405

352

# Schedule a disable() when 'timeout' has passed

406

self.expires = datetime.datetime.utcnow() + self.timeout

407

353

self.disable_initiator_tag = (gobject.timeout_add

408

354

(self.timeout_milliseconds(),

409

355

self.disable))

410

356

self.enabled = True

411

self.last_enabled = datetime.datetime.utcnow()

412

357

# Also start a new checker *right now*.

413

358

self.start_checker()

414

359

419

364

if not quiet:

420

365

self.send_changedstate()

421

366

if not quiet:

422

logger.info("Disabling client %s", self.name)

423

if getattr(self, "disable_initiator_tag", False):

367

logger.info(u"Disabling client %s", self.name)

368

if getattr(self, u"disable_initiator_tag", False):

424

369

gobject.source_remove(self.disable_initiator_tag)

425

370

self.disable_initiator_tag = None

426

self.expires = None

427

if getattr(self, "checker_initiator_tag", False):

371

if getattr(self, u"checker_initiator_tag", False):

428

372

gobject.source_remove(self.checker_initiator_tag)

429

373

self.checker_initiator_tag = None

430

374

self.stop_checker()

445

389

if os.WIFEXITED(condition):

446

390

exitstatus = os.WEXITSTATUS(condition)

447

391

if exitstatus == 0:

448

logger.info("Checker for %(name)s succeeded",

392

logger.info(u"Checker for %(name)s succeeded",

449

393

vars(self))

450

394

self.checked_ok()

451

395

else:

452

logger.info("Checker for %(name)s failed",

396

logger.info(u"Checker for %(name)s failed",

453

397

vars(self))

454

398

else:

455

logger.warning("Checker for %(name)s crashed?",

399

logger.warning(u"Checker for %(name)s crashed?",

456

400

vars(self))

457

401

458

def checked_ok(self, timeout=None):

402

def checked_ok(self):

459

403

"""Bump up the timeout for this client.

460

404

461

405

This should only be called when the client has been seen,

462

406

alive and well.

463

407

"""

464

if timeout is None:

465

timeout = self.timeout

466

408

self.last_checked_ok = datetime.datetime.utcnow()

467

409

gobject.source_remove(self.disable_initiator_tag)

468

self.expires = datetime.datetime.utcnow() + timeout

469

410

self.disable_initiator_tag = (gobject.timeout_add

470

(_timedelta_to_milliseconds

471

(timeout), self.disable))

472

473

def need_approval(self):

474

self.last_approval_request = datetime.datetime.utcnow()

411

(self.timeout_milliseconds(),

412

self.disable))

475

413

476

414

def start_checker(self):

477

415

"""Start a new checker subprocess if one is not running.

490

428

# If a checker exists, make sure it is not a zombie

491

429

try:

492

430

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

493

except (AttributeError, OSError) as error:

431

except (AttributeError, OSError), error:

494

432

if (isinstance(error, OSError)

495

433

and error.errno != errno.ECHILD):

496

434

raise error

497

435

else:

498

436

if pid:

499

logger.warning("Checker was a zombie")

437

logger.warning(u"Checker was a zombie")

500

438

gobject.source_remove(self.checker_callback_tag)

501

439

self.checker_callback(pid, status,

502

440

self.current_checker_command)

507

445

command = self.checker_command % self.host

508

446

except TypeError:

509

447

# Escape attributes for the shell

510

escaped_attrs = dict(

511

(attr,

512

re.escape(unicode(str(getattr(self, attr, "")),

513

errors=

514

'replace')))

515

for attr in

516

self.runtime_expansions)

517

448

escaped_attrs = dict((key,

449

re.escape(unicode(str(val),

450

errors=

451

u'replace')))

452

for key, val in

453

vars(self).iteritems())

518

454

try:

519

455

command = self.checker_command % escaped_attrs

520

except TypeError as error:

521

logger.error('Could not format string "%s":'

522

' %s', self.checker_command, error)

456

except TypeError, error:

457

logger.error(u'Could not format string "%s":'

458

u' %s', self.checker_command, error)

523

459

return True # Try again later

524

460

self.current_checker_command = command

525

461

try:

526

logger.info("Starting checker %r for %s",

462

logger.info(u"Starting checker %r for %s",

527

463

command, self.name)

528

464

# We don't need to redirect stdout and stderr, since

529

465

# in normal mode, that is already done by daemon(),

531

467

# always replaced by /dev/null.)

532

468

self.checker = subprocess.Popen(command,

533

469

close_fds=True,

534

shell=True, cwd="/")

470

shell=True, cwd=u"/")

535

471

self.checker_callback_tag = (gobject.child_watch_add

536

472

(self.checker.pid,

537

473

self.checker_callback,

542

478

if pid:

543

479

gobject.source_remove(self.checker_callback_tag)

544

480

self.checker_callback(pid, status, command)

545

except OSError as error:

546

logger.error("Failed to start subprocess: %s",

481

except OSError, error:

482

logger.error(u"Failed to start subprocess: %s",

547

483

error)

548

484

# Re-run this periodically if run by gobject.timeout_add

549

485

return True

553

489

if self.checker_callback_tag:

554

490

gobject.source_remove(self.checker_callback_tag)

555

491

self.checker_callback_tag = None

556

if getattr(self, "checker", None) is None:

492

if getattr(self, u"checker", None) is None:

557

493

return

558

logger.debug("Stopping checker for %(name)s", vars(self))

494

logger.debug(u"Stopping checker for %(name)s", vars(self))

559

495

try:

560

496

os.kill(self.checker.pid, signal.SIGTERM)

561

497

#time.sleep(0.5)

562

498

#if self.checker.poll() is None:

563

499

# os.kill(self.checker.pid, signal.SIGKILL)

564

except OSError as error:

500

except OSError, error:

565

501

if error.errno != errno.ESRCH: # No such process

566

502

raise

567

503

self.checker = None

568

504

569

570

def dbus_service_property(dbus_interface, signature="v",

571

access="readwrite", byte_arrays=False):

505

def dbus_service_property(dbus_interface, signature=u"v",

506

access=u"readwrite", byte_arrays=False):

572

507

"""Decorators for marking methods of a DBusObjectWithProperties to

573

508

become properties on the D-Bus.

574

509

581

516

"""

582

517

# Encoding deeply encoded byte arrays is not supported yet by the

583

518

# "Set" method, so we fail early here:

584

if byte_arrays and signature != "ay":

585

raise ValueError("Byte arrays not supported for non-'ay'"

586

" signature %r" % signature)

519

if byte_arrays and signature != u"ay":

520

raise ValueError(u"Byte arrays not supported for non-'ay'"

521

u" signature %r" % signature)

587

522

def decorator(func):

588

523

func._dbus_is_property = True

589

524

func._dbus_interface = dbus_interface

590

525

func._dbus_signature = signature

591

526

func._dbus_access = access

592

527

func._dbus_name = func.__name__

593

if func._dbus_name.endswith("_dbus_property"):

528

if func._dbus_name.endswith(u"_dbus_property"):

594

529

func._dbus_name = func._dbus_name[:-14]

595

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

530

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

596

531

return func

597

532

return decorator

598

533

618

553

619

554

class DBusObjectWithProperties(dbus.service.Object):

620

555

"""A D-Bus object with properties.

621

556

622

557

Classes inheriting from this can use the dbus_service_property

623

558

decorator to expose methods as D-Bus properties. It exposes the

624

559

standard Get(), Set(), and GetAll() methods on the D-Bus.

626

561

627

562

@staticmethod

628

563

def _is_dbus_property(obj):

629

return getattr(obj, "_dbus_is_property", False)

564

return getattr(obj, u"_dbus_is_property", False)

630

565

631

566

def _get_all_dbus_properties(self):

632

567

"""Returns a generator of (name, attribute) pairs

633

568

"""

634

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

635

for cls in self.__class__.__mro__

569

return ((prop._dbus_name, prop)

636

570

for name, prop in

637

inspect.getmembers(cls, self._is_dbus_property))

571

inspect.getmembers(self, self._is_dbus_property))

638

572

639

573

def _get_dbus_property(self, interface_name, property_name):

640

574

"""Returns a bound method if one exists which is a D-Bus

641

575

property with the specified name and interface.

642

576

"""

643

for cls in self.__class__.__mro__:

644

for name, value in (inspect.getmembers

645

(cls, self._is_dbus_property)):

646

if (value._dbus_name == property_name

647

and value._dbus_interface == interface_name):

648

return value.__get__(self)

649

577

for name in (property_name,

578

property_name + u"_dbus_property"):

579

prop = getattr(self, name, None)

580

if (prop is None

581

or not self._is_dbus_property(prop)

582

or prop._dbus_name != property_name

583

or (interface_name and prop._dbus_interface

584

and interface_name != prop._dbus_interface)):

585

continue

586

return prop

650

587

# No such property

651

raise DBusPropertyNotFound(self.dbus_object_path + ":"

652

+ interface_name + "."

588

raise DBusPropertyNotFound(self.dbus_object_path + u":"

589

+ interface_name + u"."

653

590

+ property_name)

654

591

655

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

656

out_signature="v")

592

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

593

out_signature=u"v")

657

594

def Get(self, interface_name, property_name):

658

595

"""Standard D-Bus property Get() method, see D-Bus standard.

659

596

"""

660

597

prop = self._get_dbus_property(interface_name, property_name)

661

if prop._dbus_access == "write":

598

if prop._dbus_access == u"write":

662

599

raise DBusPropertyAccessException(property_name)

663

600

value = prop()

664

if not hasattr(value, "variant_level"):

601

if not hasattr(value, u"variant_level"):

665

602

return value

666

603

return type(value)(value, variant_level=value.variant_level+1)

667

604

668

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

605

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

669

606

def Set(self, interface_name, property_name, value):

670

607

"""Standard D-Bus property Set() method, see D-Bus standard.

671

608

"""

672

609

prop = self._get_dbus_property(interface_name, property_name)

673

if prop._dbus_access == "read":

610

if prop._dbus_access == u"read":

674

611

raise DBusPropertyAccessException(property_name)

675

if prop._dbus_get_args_options["byte_arrays"]:

612

if prop._dbus_get_args_options[u"byte_arrays"]:

676

613

# The byte_arrays option is not supported yet on

677

614

# signatures other than "ay".

678

if prop._dbus_signature != "ay":

615

if prop._dbus_signature != u"ay":

679

616

raise ValueError

680

617

value = dbus.ByteArray(''.join(unichr(byte)

681

618

for byte in value))

682

619

prop(value)

683

620

684

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

685

out_signature="a{sv}")

621

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

622

out_signature=u"a{sv}")

686

623

def GetAll(self, interface_name):

687

624

"""Standard D-Bus property GetAll() method, see D-Bus

688

625

standard.

689

626

690

627

Note: Will not include properties with access="write".

691

628

"""

692

629

all = {}

696

633

# Interface non-empty but did not match

697

634

continue

698

635

# Ignore write-only properties

699

if prop._dbus_access == "write":

636

if prop._dbus_access == u"write":

700

637

continue

701

638

value = prop()

702

if not hasattr(value, "variant_level"):

639

if not hasattr(value, u"variant_level"):

703

640

all[name] = value

704

641

continue

705

642

all[name] = type(value)(value, variant_level=

706

643

value.variant_level+1)

707

return dbus.Dictionary(all, signature="sv")

644

return dbus.Dictionary(all, signature=u"sv")

708

645

709

646

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

710

out_signature="s",

647

out_signature=u"s",

711

648

path_keyword='object_path',

712

649

connection_keyword='connection')

713

650

def Introspect(self, object_path, connection):

718

655

try:

719

656

document = xml.dom.minidom.parseString(xmlstring)

720

657

def make_tag(document, name, prop):

721

e = document.createElement("property")

722

e.setAttribute("name", name)

723

e.setAttribute("type", prop._dbus_signature)

724

e.setAttribute("access", prop._dbus_access)

658

e = document.createElement(u"property")

659

e.setAttribute(u"name", name)

660

e.setAttribute(u"type", prop._dbus_signature)

661

e.setAttribute(u"access", prop._dbus_access)

725

662

return e

726

for if_tag in document.getElementsByTagName("interface"):

663

for if_tag in document.getElementsByTagName(u"interface"):

727

664

for tag in (make_tag(document, name, prop)

728

665

for name, prop

729

666

in self._get_all_dbus_properties()

730

667

if prop._dbus_interface

731

== if_tag.getAttribute("name")):

668

== if_tag.getAttribute(u"name")):

732

669

if_tag.appendChild(tag)

733

670

# Add the names to the return values for the

734

671

# "org.freedesktop.DBus.Properties" methods

735

if (if_tag.getAttribute("name")

736

== "org.freedesktop.DBus.Properties"):

737

for cn in if_tag.getElementsByTagName("method"):

738

if cn.getAttribute("name") == "Get":

739

for arg in cn.getElementsByTagName("arg"):

740

if (arg.getAttribute("direction")

741

== "out"):

742

arg.setAttribute("name", "value")

743

elif cn.getAttribute("name") == "GetAll":

744

for arg in cn.getElementsByTagName("arg"):

745

if (arg.getAttribute("direction")

746

== "out"):

747

arg.setAttribute("name", "props")

748

xmlstring = document.toxml("utf-8")

672

if (if_tag.getAttribute(u"name")

673

== u"org.freedesktop.DBus.Properties"):

674

for cn in if_tag.getElementsByTagName(u"method"):

675

if cn.getAttribute(u"name") == u"Get":

676

for arg in cn.getElementsByTagName(u"arg"):

677

if (arg.getAttribute(u"direction")

678

== u"out"):

679

arg.setAttribute(u"name", u"value")

680

elif cn.getAttribute(u"name") == u"GetAll":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"props")

685

xmlstring = document.toxml(u"utf-8")

749

686

document.unlink()

750

687

except (AttributeError, xml.dom.DOMException,

751

xml.parsers.expat.ExpatError) as error:

752

logger.error("Failed to override Introspection method",

688

xml.parsers.expat.ExpatError), error:

689

logger.error(u"Failed to override Introspection method",

753

690

error)

754

691

return xmlstring

755

692

756

693

757

def datetime_to_dbus (dt, variant_level=0):

758

"""Convert a UTC datetime.datetime() to a D-Bus type."""

759

if dt is None:

760

return dbus.String("", variant_level = variant_level)

761

return dbus.String(dt.isoformat(),

762

variant_level=variant_level)

763

764

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

765

.__metaclass__):

766

"""Applied to an empty subclass of a D-Bus object, this metaclass

767

will add additional D-Bus attributes matching a certain pattern.

768

"""

769

def __new__(mcs, name, bases, attr):

770

# Go through all the base classes which could have D-Bus

771

# methods, signals, or properties in them

772

for base in (b for b in bases

773

if issubclass(b, dbus.service.Object)):

774

# Go though all attributes of the base class

775

for attrname, attribute in inspect.getmembers(base):

776

# Ignore non-D-Bus attributes, and D-Bus attributes

777

# with the wrong interface name

778

if (not hasattr(attribute, "_dbus_interface")

779

or not attribute._dbus_interface

780

.startswith("se.recompile.Mandos")):

781

continue

782

# Create an alternate D-Bus interface name based on

783

# the current name

784

alt_interface = (attribute._dbus_interface

785

.replace("se.recompile.Mandos",

786

"se.bsnet.fukt.Mandos"))

787

# Is this a D-Bus signal?

788

if getattr(attribute, "_dbus_is_signal", False):

789

# Extract the original non-method function by

790

# black magic

791

nonmethod_func = (dict(

792

zip(attribute.func_code.co_freevars,

793

attribute.__closure__))["func"]

794

.cell_contents)

795

# Create a new, but exactly alike, function

796

# object, and decorate it to be a new D-Bus signal

797

# with the alternate D-Bus interface name

798

new_function = (dbus.service.signal

799

(alt_interface,

800

attribute._dbus_signature)

801

(types.FunctionType(

802

nonmethod_func.func_code,

803

nonmethod_func.func_globals,

804

nonmethod_func.func_name,

805

nonmethod_func.func_defaults,

806

nonmethod_func.func_closure)))

807

# Define a creator of a function to call both the

808

# old and new functions, so both the old and new

809

# signals gets sent when the function is called

810

def fixscope(func1, func2):

811

"""This function is a scope container to pass

812

func1 and func2 to the "call_both" function

813

outside of its arguments"""

814

def call_both(*args, **kwargs):

815

"""This function will emit two D-Bus

816

signals by calling func1 and func2"""

817

func1(*args, **kwargs)

818

func2(*args, **kwargs)

819

return call_both

820

# Create the "call_both" function and add it to

821

# the class

822

attr[attrname] = fixscope(attribute,

823

new_function)

824

# Is this a D-Bus method?

825

elif getattr(attribute, "_dbus_is_method", False):

826

# Create a new, but exactly alike, function

827

# object. Decorate it to be a new D-Bus method

828

# with the alternate D-Bus interface name. Add it

829

# to the class.

830

attr[attrname] = (dbus.service.method

831

(alt_interface,

832

attribute._dbus_in_signature,

833

attribute._dbus_out_signature)

834

(types.FunctionType

835

(attribute.func_code,

836

attribute.func_globals,

837

attribute.func_name,

838

attribute.func_defaults,

839

attribute.func_closure)))

840

# Is this a D-Bus property?

841

elif getattr(attribute, "_dbus_is_property", False):

842

# Create a new, but exactly alike, function

843

# object, and decorate it to be a new D-Bus

844

# property with the alternate D-Bus interface

845

# name. Add it to the class.

846

attr[attrname] = (dbus_service_property

847

(alt_interface,

848

attribute._dbus_signature,

849

attribute._dbus_access,

850

attribute

851

._dbus_get_args_options

852

["byte_arrays"])

853

(types.FunctionType

854

(attribute.func_code,

855

attribute.func_globals,

856

attribute.func_name,

857

attribute.func_defaults,

858

attribute.func_closure)))

859

return type.__new__(mcs, name, bases, attr)

860

861

694

class ClientDBus(Client, DBusObjectWithProperties):

862

695

"""A Client class using D-Bus

863

696

865

698

dbus_object_path: dbus.ObjectPath

866

699

bus: dbus.SystemBus()

867

700

"""

868

869

runtime_expansions = (Client.runtime_expansions

870

+ ("dbus_object_path",))

871

872

701

# dbus.service.Object doesn't use super(), so we can't either.

873

702

874

703

def __init__(self, bus = None, *args, **kwargs):

877

706

Client.__init__(self, *args, **kwargs)

878

707

# Only now, when this client is initialized, can it show up on

879

708

# the D-Bus

880

client_object_name = unicode(self.name).translate(

881

{ord("."): ord("_"),

882

ord("-"): ord("_")})

883

709

self.dbus_object_path = (dbus.ObjectPath

884

("/clients/" + client_object_name))

710

(u"/clients/"

711

+ self.name.replace(u".", u"_")))

885

712

DBusObjectWithProperties.__init__(self, self.bus,

886

713

self.dbus_object_path)

887

888

def notifychangeproperty(transform_func,

889

dbus_name, type_func=lambda x: x,

890

variant_level=1):

891

""" Modify a variable so that it's a property which announces

892

its changes to DBus.

893

894

transform_fun: Function that takes a value and transforms it

895

to a D-Bus type.

896

dbus_name: D-Bus name of the variable

897

type_func: Function that transform the value before sending it

898

to the D-Bus. Default: no transform

899

variant_level: D-Bus variant level. Default: 1

900

"""

901

attrname = "_{0}".format(dbus_name)

902

def setter(self, value):

903

if hasattr(self, "dbus_object_path"):

904

if (not hasattr(self, attrname) or

905

type_func(getattr(self, attrname, None))

906

!= type_func(value)):

907

dbus_value = transform_func(type_func(value),

908

variant_level)

909

self.PropertyChanged(dbus.String(dbus_name),

910

dbus_value)

911

setattr(self, attrname, value)

912

913

return property(lambda self: getattr(self, attrname), setter)

914

915

916

expires = notifychangeproperty(datetime_to_dbus, "Expires")

917

approvals_pending = notifychangeproperty(dbus.Boolean,

918

"ApprovalPending",

919

type_func = bool)

920

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

921

last_enabled = notifychangeproperty(datetime_to_dbus,

922

"LastEnabled")

923

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

924

type_func = lambda checker:

925

checker is not None)

926

last_checked_ok = notifychangeproperty(datetime_to_dbus,

927

"LastCheckedOK")

928

last_approval_request = notifychangeproperty(

929

datetime_to_dbus, "LastApprovalRequest")

930

approved_by_default = notifychangeproperty(dbus.Boolean,

931

"ApprovedByDefault")

932

approval_delay = notifychangeproperty(dbus.UInt16,

933

"ApprovalDelay",

934

type_func =

935

_timedelta_to_milliseconds)

936

approval_duration = notifychangeproperty(

937

dbus.UInt16, "ApprovalDuration",

938

type_func = _timedelta_to_milliseconds)

939

host = notifychangeproperty(dbus.String, "Host")

940

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

941

type_func =

942

_timedelta_to_milliseconds)

943

extended_timeout = notifychangeproperty(

944

dbus.UInt16, "ExtendedTimeout",

945

type_func = _timedelta_to_milliseconds)

946

interval = notifychangeproperty(dbus.UInt16,

947

"Interval",

948

type_func =

949

_timedelta_to_milliseconds)

950

checker_command = notifychangeproperty(dbus.String, "Checker")

951

952

del notifychangeproperty

714

715

def _get_approvals_pending(self):

716

return self._approvals_pending

717

def _set_approvals_pending(self, value):

718

old_value = self._approvals_pending

719

self._approvals_pending = value

720

bval = bool(value)

721

if (hasattr(self, "dbus_object_path")

722

and bval is not bool(old_value)):

723

dbus_bool = dbus.Boolean(bval, variant_level=1)

724

self.PropertyChanged(dbus.String(u"approved_pending"),

725

dbus_bool)

726

727

approvals_pending = property(_get_approvals_pending,

728

_set_approvals_pending)

729

del _get_approvals_pending, _set_approvals_pending

730

731

@staticmethod

732

def _datetime_to_dbus(dt, variant_level=0):

733

"""Convert a UTC datetime.datetime() to a D-Bus type."""

734

return dbus.String(dt.isoformat(),

735

variant_level=variant_level)

736

737

def enable(self):

738

oldstate = getattr(self, u"enabled", False)

739

r = Client.enable(self)

740

if oldstate != self.enabled:

741

# Emit D-Bus signals

742

self.PropertyChanged(dbus.String(u"enabled"),

743

dbus.Boolean(True, variant_level=1))

744

self.PropertyChanged(

745

dbus.String(u"last_enabled"),

746

self._datetime_to_dbus(self.last_enabled,

747

variant_level=1))

748

return r

749

750

def disable(self, quiet = False):

751

oldstate = getattr(self, u"enabled", False)

752

r = Client.disable(self, quiet=quiet)

753

if not quiet and oldstate != self.enabled:

754

# Emit D-Bus signal

755

self.PropertyChanged(dbus.String(u"enabled"),

756

dbus.Boolean(False, variant_level=1))

757

return r

953

758

954

759

def __del__(self, *args, **kwargs):

955

760

try:

956

761

self.remove_from_connection()

957

762

except LookupError:

958

763

pass

959

if hasattr(DBusObjectWithProperties, "__del__"):

764

if hasattr(DBusObjectWithProperties, u"__del__"):

960

765

DBusObjectWithProperties.__del__(self, *args, **kwargs)

961

766

Client.__del__(self, *args, **kwargs)

962

767

964

769

*args, **kwargs):

965

770

self.checker_callback_tag = None

966

771

self.checker = None

772

# Emit D-Bus signal

773

self.PropertyChanged(dbus.String(u"checker_running"),

774

dbus.Boolean(False, variant_level=1))

967

775

if os.WIFEXITED(condition):

968

776

exitstatus = os.WEXITSTATUS(condition)

969

777

# Emit D-Bus signal

979

787

return Client.checker_callback(self, pid, condition, command,

980

788

*args, **kwargs)

981

789

790

def checked_ok(self, *args, **kwargs):

791

r = Client.checked_ok(self, *args, **kwargs)

792

# Emit D-Bus signal

793

self.PropertyChanged(

794

dbus.String(u"last_checked_ok"),

795

(self._datetime_to_dbus(self.last_checked_ok,

796

variant_level=1)))

797

return r

798

982

799

def start_checker(self, *args, **kwargs):

983

800

old_checker = self.checker

984

801

if self.checker is not None:

991

808

and old_checker_pid != self.checker.pid):

992

809

# Emit D-Bus signal

993

810

self.CheckerStarted(self.current_checker_command)

811

self.PropertyChanged(

812

dbus.String(u"checker_running"),

813

dbus.Boolean(True, variant_level=1))

994

814

return r

995

815

816

def stop_checker(self, *args, **kwargs):

817

old_checker = getattr(self, u"checker", None)

818

r = Client.stop_checker(self, *args, **kwargs)

819

if (old_checker is not None

820

and getattr(self, u"checker", None) is None):

821

self.PropertyChanged(dbus.String(u"checker_running"),

822

dbus.Boolean(False, variant_level=1))

823

return r

824

996

825

def _reset_approved(self):

997

826

self._approved = None

998

827

return False

1000

829

def approve(self, value=True):

1001

830

self.send_changedstate()

1002

831

self._approved = value

1003

gobject.timeout_add(_timedelta_to_milliseconds

1004

(self.approval_duration),

832

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),

1005

833

self._reset_approved)

1006

834

1007

835

1008

836

## D-Bus methods, signals & properties

1009

_interface = "se.recompile.Mandos.Client"

837

_interface = u"se.bsnet.fukt.Mandos.Client"

1010

838

1011

839

## Signals

1012

840

1013

841

# CheckerCompleted - signal

1014

@dbus.service.signal(_interface, signature="nxs")

842

@dbus.service.signal(_interface, signature=u"nxs")

1015

843

def CheckerCompleted(self, exitcode, waitstatus, command):

1016

844

"D-Bus signal"

1017

845

pass

1018

846

1019

847

# CheckerStarted - signal

1020

@dbus.service.signal(_interface, signature="s")

848

@dbus.service.signal(_interface, signature=u"s")

1021

849

def CheckerStarted(self, command):

1022

850

"D-Bus signal"

1023

851

pass

1024

852

1025

853

# PropertyChanged - signal

1026

@dbus.service.signal(_interface, signature="sv")

854

@dbus.service.signal(_interface, signature=u"sv")

1027

855

def PropertyChanged(self, property, value):

1028

856

"D-Bus signal"

1029

857

pass

1038

866

pass

1039

867

1040

868

# Rejected - signal

1041

@dbus.service.signal(_interface, signature="s")

869

@dbus.service.signal(_interface, signature=u"s")

1042

870

def Rejected(self, reason):

1043

871

"D-Bus signal"

1044

872

pass

1045

873

1046

874

# NeedApproval - signal

1047

@dbus.service.signal(_interface, signature="tb")

875

@dbus.service.signal(_interface, signature=u"db")

1048

876

def NeedApproval(self, timeout, default):

1049

877

"D-Bus signal"

1050

return self.need_approval()

878

pass

1051

879

1052

880

## Methods

1053

881

1054

882

# Approve - method

1055

@dbus.service.method(_interface, in_signature="b")

883

@dbus.service.method(_interface, in_signature=u"b")

1056

884

def Approve(self, value):

1057

885

self.approve(value)

1058

886

1059

887

# CheckedOK - method

1060

888

@dbus.service.method(_interface)

1061

889

def CheckedOK(self):

1062

self.checked_ok()

890

return self.checked_ok()

1063

891

1064

892

# Enable - method

1065

893

@dbus.service.method(_interface)

1086

914

1087

915

## Properties

1088

916

1089

# ApprovalPending - property

1090

@dbus_service_property(_interface, signature="b", access="read")

1091

def ApprovalPending_dbus_property(self):

917

# approved_pending - property

918

@dbus_service_property(_interface, signature=u"b", access=u"read")

919

def approved_pending_dbus_property(self):

1092

920

return dbus.Boolean(bool(self.approvals_pending))

1093

921

1094

# ApprovedByDefault - property

1095

@dbus_service_property(_interface, signature="b",

1096

access="readwrite")

1097

def ApprovedByDefault_dbus_property(self, value=None):

1098

if value is None: # get

1099

return dbus.Boolean(self.approved_by_default)

1100

self.approved_by_default = bool(value)

1101

1102

# ApprovalDelay - property

1103

@dbus_service_property(_interface, signature="t",

1104

access="readwrite")

1105

def ApprovalDelay_dbus_property(self, value=None):

1106

if value is None: # get

1107

return dbus.UInt64(self.approval_delay_milliseconds())

1108

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1109

1110

# ApprovalDuration - property

1111

@dbus_service_property(_interface, signature="t",

1112

access="readwrite")

1113

def ApprovalDuration_dbus_property(self, value=None):

1114

if value is None: # get

1115

return dbus.UInt64(_timedelta_to_milliseconds(

1116

self.approval_duration))

1117

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1118

1119

# Name - property

1120

@dbus_service_property(_interface, signature="s", access="read")

1121

def Name_dbus_property(self):

922

# approved_by_default - property

923

@dbus_service_property(_interface, signature=u"b",

924

access=u"readwrite")

925

def approved_by_default_dbus_property(self):

926

return dbus.Boolean(self.approved_by_default)

927

928

# approved_delay - property

929

@dbus_service_property(_interface, signature=u"t",

930

access=u"readwrite")

931

def approved_delay_dbus_property(self):

932

return dbus.UInt64(self.approved_delay_milliseconds())

933

934

# approved_duration - property

935

@dbus_service_property(_interface, signature=u"t",

936

access=u"readwrite")

937

def approved_duration_dbus_property(self):

938

return dbus.UInt64(self._timedelta_to_milliseconds(

939

self.approved_duration))

940

941

# name - property

942

@dbus_service_property(_interface, signature=u"s", access=u"read")

943

def name_dbus_property(self):

1122

944

return dbus.String(self.name)

1123

945

1124

# Fingerprint - property

1125

@dbus_service_property(_interface, signature="s", access="read")

1126

def Fingerprint_dbus_property(self):

946

# fingerprint - property

947

@dbus_service_property(_interface, signature=u"s", access=u"read")

948

def fingerprint_dbus_property(self):

1127

949

return dbus.String(self.fingerprint)

1128

950

1129

# Host - property

1130

@dbus_service_property(_interface, signature="s",

1131

access="readwrite")

1132

def Host_dbus_property(self, value=None):

951

# host - property

952

@dbus_service_property(_interface, signature=u"s",

953

access=u"readwrite")

954

def host_dbus_property(self, value=None):

1133

955

if value is None: # get

1134

956

return dbus.String(self.host)

1135

957

self.host = value

1136

1137

# Created - property

1138

@dbus_service_property(_interface, signature="s", access="read")

1139

def Created_dbus_property(self):

1140

return dbus.String(datetime_to_dbus(self.created))

1141

1142

# LastEnabled - property

1143

@dbus_service_property(_interface, signature="s", access="read")

1144

def LastEnabled_dbus_property(self):

1145

return datetime_to_dbus(self.last_enabled)

1146

1147

# Enabled - property

1148

@dbus_service_property(_interface, signature="b",

1149

access="readwrite")

1150

def Enabled_dbus_property(self, value=None):

958

# Emit D-Bus signal

959

self.PropertyChanged(dbus.String(u"host"),

960

dbus.String(value, variant_level=1))

961

962

# created - property

963

@dbus_service_property(_interface, signature=u"s", access=u"read")

964

def created_dbus_property(self):

965

return dbus.String(self._datetime_to_dbus(self.created))

966

967

# last_enabled - property

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

969

def last_enabled_dbus_property(self):

970

if self.last_enabled is None:

971

return dbus.String(u"")

972

return dbus.String(self._datetime_to_dbus(self.last_enabled))

973

974

# enabled - property

975

@dbus_service_property(_interface, signature=u"b",

976

access=u"readwrite")

977

def enabled_dbus_property(self, value=None):

1151

978

if value is None: # get

1152

979

return dbus.Boolean(self.enabled)

1153

980

if value:

1155

982

else:

1156

983

self.disable()

1157

984

1158

# LastCheckedOK - property

1159

@dbus_service_property(_interface, signature="s",

1160

access="readwrite")

1161

def LastCheckedOK_dbus_property(self, value=None):

985

# last_checked_ok - property

986

@dbus_service_property(_interface, signature=u"s",

987

access=u"readwrite")

988

def last_checked_ok_dbus_property(self, value=None):

1162

989

if value is not None:

1163

990

self.checked_ok()

1164

991

return

1165

return datetime_to_dbus(self.last_checked_ok)

1166

1167

# Expires - property

1168

@dbus_service_property(_interface, signature="s", access="read")

1169

def Expires_dbus_property(self):

1170

return datetime_to_dbus(self.expires)

1171

1172

# LastApprovalRequest - property

1173

@dbus_service_property(_interface, signature="s", access="read")

1174

def LastApprovalRequest_dbus_property(self):

1175

return datetime_to_dbus(self.last_approval_request)

1176

1177

# Timeout - property

1178

@dbus_service_property(_interface, signature="t",

1179

access="readwrite")

1180

def Timeout_dbus_property(self, value=None):

992

if self.last_checked_ok is None:

993

return dbus.String(u"")

994

return dbus.String(self._datetime_to_dbus(self

995

.last_checked_ok))

996

997

# timeout - property

998

@dbus_service_property(_interface, signature=u"t",

999

access=u"readwrite")

1000

def timeout_dbus_property(self, value=None):

1181

1001

if value is None: # get

1182

1002

return dbus.UInt64(self.timeout_milliseconds())

1183

1003

self.timeout = datetime.timedelta(0, 0, 0, value)

1184

if getattr(self, "disable_initiator_tag", None) is None:

1004

# Emit D-Bus signal

1005

self.PropertyChanged(dbus.String(u"timeout"),

1006

dbus.UInt64(value, variant_level=1))

1007

if getattr(self, u"disable_initiator_tag", None) is None:

1185

1008

return

1186

1009

# Reschedule timeout

1187

1010

gobject.source_remove(self.disable_initiator_tag)

1188

1011

self.disable_initiator_tag = None

1189

self.expires = None

1190

1012

time_to_die = (self.

1191

1013

_timedelta_to_milliseconds((self

1192

1014

.last_checked_ok

1197

1019

# The timeout has passed

1198

1020

self.disable()

1199

1021

else:

1200

self.expires = (datetime.datetime.utcnow()

1201

+ datetime.timedelta(milliseconds =

1202

time_to_die))

1203

1022

self.disable_initiator_tag = (gobject.timeout_add

1204

1023

(time_to_die, self.disable))

1205

1024

1206

# ExtendedTimeout - property

1207

@dbus_service_property(_interface, signature="t",

1208

access="readwrite")

1209

def ExtendedTimeout_dbus_property(self, value=None):

1210

if value is None: # get

1211

return dbus.UInt64(self.extended_timeout_milliseconds())

1212

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1213

1214

# Interval - property

1215

@dbus_service_property(_interface, signature="t",

1216

access="readwrite")

1217

def Interval_dbus_property(self, value=None):

1025

# interval - property

1026

@dbus_service_property(_interface, signature=u"t",

1027

access=u"readwrite")

1028

def interval_dbus_property(self, value=None):

1218

1029

if value is None: # get

1219

1030

return dbus.UInt64(self.interval_milliseconds())

1220

1031

self.interval = datetime.timedelta(0, 0, 0, value)

1221

if getattr(self, "checker_initiator_tag", None) is None:

1032

# Emit D-Bus signal

1033

self.PropertyChanged(dbus.String(u"interval"),

1034

dbus.UInt64(value, variant_level=1))

1035

if getattr(self, u"checker_initiator_tag", None) is None:

1222

1036

return

1223

1037

# Reschedule checker run

1224

1038

gobject.source_remove(self.checker_initiator_tag)

1225

1039

self.checker_initiator_tag = (gobject.timeout_add

1226

1040

(value, self.start_checker))

1227

1041

self.start_checker() # Start one now, too

1228

1229

# Checker - property

1230

@dbus_service_property(_interface, signature="s",

1231

access="readwrite")

1232

def Checker_dbus_property(self, value=None):

1042

1043

# checker - property

1044

@dbus_service_property(_interface, signature=u"s",

1045

access=u"readwrite")

1046

def checker_dbus_property(self, value=None):

1233

1047

if value is None: # get

1234

1048

return dbus.String(self.checker_command)

1235

1049

self.checker_command = value

1050

# Emit D-Bus signal

1051

self.PropertyChanged(dbus.String(u"checker"),

1052

dbus.String(self.checker_command,

1053

variant_level=1))

1236

1054

1237

# CheckerRunning - property

1238

@dbus_service_property(_interface, signature="b",

1239

access="readwrite")

1240

def CheckerRunning_dbus_property(self, value=None):

1055

# checker_running - property

1056

@dbus_service_property(_interface, signature=u"b",

1057

access=u"readwrite")

1058

def checker_running_dbus_property(self, value=None):

1241

1059

if value is None: # get

1242

1060

return dbus.Boolean(self.checker is not None)

1243

1061

if value:

1245

1063

else:

1246

1064

self.stop_checker()

1247

1065

1248

# ObjectPath - property

1249

@dbus_service_property(_interface, signature="o", access="read")

1250

def ObjectPath_dbus_property(self):

1066

# object_path - property

1067

@dbus_service_property(_interface, signature=u"o", access=u"read")

1068

def object_path_dbus_property(self):

1251

1069

return self.dbus_object_path # is already a dbus.ObjectPath

1252

1070

1253

# Secret = property

1254

@dbus_service_property(_interface, signature="ay",

1255

access="write", byte_arrays=True)

1256

def Secret_dbus_property(self, value):

1071

# secret = property

1072

@dbus_service_property(_interface, signature=u"ay",

1073

access=u"write", byte_arrays=True)

1074

def secret_dbus_property(self, value):

1257

1075

self.secret = str(value)

1258

1076

1259

1077

del _interface

1265

1083

self._pipe.send(('init', fpr, address))

1266

1084

if not self._pipe.recv():

1267

1085

raise KeyError()

1268

1086

1269

1087

def __getattribute__(self, name):

1270

1088

if(name == '_pipe'):

1271

1089

return super(ProxyClient, self).__getattribute__(name)

1278

1096

self._pipe.send(('funcall', name, args, kwargs))

1279

1097

return self._pipe.recv()[1]

1280

1098

return func

1281

1099

1282

1100

def __setattr__(self, name, value):

1283

1101

if(name == '_pipe'):

1284

1102

return super(ProxyClient, self).__setattr__(name, value)

1285

1103

self._pipe.send(('setattr', name, value))

1286

1104

1287

class ClientDBusTransitional(ClientDBus):

1288

__metaclass__ = AlternateDBusNamesMetaclass

1289

1105

1290

1106

class ClientHandler(socketserver.BaseRequestHandler, object):

1291

1107

"""A class to handle client connections.

1295

1111

1296

1112

def handle(self):

1297

1113

with contextlib.closing(self.server.child_pipe) as child_pipe:

1298

logger.info("TCP connection from: %s",

1114

logger.info(u"TCP connection from: %s",

1299

1115

unicode(self.client_address))

1300

logger.debug("Pipe FD: %d",

1116

logger.debug(u"Pipe FD: %d",

1301

1117

self.server.child_pipe.fileno())

1302

1118

1303

1119

session = (gnutls.connection

1304

1120

.ClientSession(self.request,

1305

1121

gnutls.connection

1306

1122

.X509Credentials()))

1307

1123

1308

1124

# Note: gnutls.connection.X509Credentials is really a

1309

1125

# generic GnuTLS certificate credentials object so long as

1310

1126

# no X.509 keys are added to it. Therefore, we can use it

1311

1127

# here despite using OpenPGP certificates.

1312

1313

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1314

# "+AES-256-CBC", "+SHA1",

1315

# "+COMP-NULL", "+CTYPE-OPENPGP",

1316

# "+DHE-DSS"))

1128

1129

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1130

# u"+AES-256-CBC", u"+SHA1",

1131

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1132

# u"+DHE-DSS"))

1317

1133

# Use a fallback default, since this MUST be set.

1318

1134

priority = self.server.gnutls_priority

1319

1135

if priority is None:

1320

priority = "NORMAL"

1136

priority = u"NORMAL"

1321

1137

(gnutls.library.functions

1322

1138

.gnutls_priority_set_direct(session._c_object,

1323

1139

priority, None))

1324

1140

1325

1141

# Start communication using the Mandos protocol

1326

1142

# Get protocol number

1327

1143

line = self.request.makefile().readline()

1328

logger.debug("Protocol version: %r", line)

1144

logger.debug(u"Protocol version: %r", line)

1329

1145

try:

1330

1146

if int(line.strip().split()[0]) > 1:

1331

1147

raise RuntimeError

1332

except (ValueError, IndexError, RuntimeError) as error:

1333

logger.error("Unknown protocol version: %s", error)

1148

except (ValueError, IndexError, RuntimeError), error:

1149

logger.error(u"Unknown protocol version: %s", error)

1334

1150

return

1335

1151

1336

1152

# Start GnuTLS connection

1337

1153

try:

1338

1154

session.handshake()

1339

except gnutls.errors.GNUTLSError as error:

1340

logger.warning("Handshake failed: %s", error)

1155

except gnutls.errors.GNUTLSError, error:

1156

logger.warning(u"Handshake failed: %s", error)

1341

1157

# Do not run session.bye() here: the session is not

1342

1158

# established. Just abandon the request.

1343

1159

return

1344

logger.debug("Handshake succeeded")

1345

1160

logger.debug(u"Handshake succeeded")

1161

1346

1162

approval_required = False

1347

1163

try:

1348

1164

try:

1349

1165

fpr = self.fingerprint(self.peer_certificate

1350

1166

(session))

1351

except (TypeError,

1352

gnutls.errors.GNUTLSError) as error:

1353

logger.warning("Bad certificate: %s", error)

1167

except (TypeError, gnutls.errors.GNUTLSError), error:

1168

logger.warning(u"Bad certificate: %s", error)

1354

1169

return

1355

logger.debug("Fingerprint: %s", fpr)

1356

1170

logger.debug(u"Fingerprint: %s", fpr)

1171

1357

1172

try:

1358

1173

client = ProxyClient(child_pipe, fpr,

1359

1174

self.client_address)

1360

1175

except KeyError:

1361

1176

return

1362

1177

1363

if client.approval_delay:

1364

delay = client.approval_delay

1178

if client.approved_delay:

1179

delay = client.approved_delay

1365

1180

client.approvals_pending += 1

1366

1181

approval_required = True

1367

1182

1368

1183

while True:

1369

1184

if not client.enabled:

1370

logger.info("Client %s is disabled",

1185

logger.warning(u"Client %s is disabled",

1371

1186

client.name)

1372

1187

if self.server.use_dbus:

1373

1188

# Emit D-Bus signal

1374

client.Rejected("Disabled")

1189

client.Rejected("Disabled")

1375

1190

return

1376

1191

1377

if client._approved or not client.approval_delay:

1192

if client._approved or not client.approved_delay:

1378

1193

#We are approved or approval is disabled

1379

1194

break

1380

1195

elif client._approved is None:

1381

logger.info("Client %s needs approval",

1196

logger.info(u"Client %s need approval",

1382

1197

client.name)

1383

1198

if self.server.use_dbus:

1384

1199

# Emit D-Bus signal

1385

1200

client.NeedApproval(

1386

client.approval_delay_milliseconds(),

1201

client.approved_delay_milliseconds(),

1387

1202

client.approved_by_default)

1388

1203

else:

1389

logger.warning("Client %s was not approved",

1204

logger.warning(u"Client %s was not approved",

1390

1205

client.name)

1391

1206

if self.server.use_dbus:

1392

1207

# Emit D-Bus signal

1393

client.Rejected("Denied")

1208

client.Rejected("Disapproved")

1394

1209

return

1395

1210

1396

1211

#wait until timeout or approved

1397

#x = float(client

1398

# ._timedelta_to_milliseconds(delay))

1212

#x = float(client._timedelta_to_milliseconds(delay))

1399

1213

time = datetime.datetime.now()

1400

1214

client.changedstate.acquire()

1401

(client.changedstate.wait

1402

(float(client._timedelta_to_milliseconds(delay)

1403

/ 1000)))

1215

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1404

1216

client.changedstate.release()

1405

1217

time2 = datetime.datetime.now()

1406

1218

if (time2 - time) >= delay:

1410

1222

client.name)

1411

1223

if self.server.use_dbus:

1412

1224

# Emit D-Bus signal

1413

client.Rejected("Approval timed out")

1225

client.Rejected("Time out")

1414

1226

return

1415

1227

else:

1416

1228

break

1421

1233

while sent_size < len(client.secret):

1422

1234

try:

1423

1235

sent = session.send(client.secret[sent_size:])

1424

except gnutls.errors.GNUTLSError as error:

1236

except (gnutls.errors.GNUTLSError), error:

1425

1237

logger.warning("gnutls send failed")

1426

1238

return

1427

logger.debug("Sent: %d, remaining: %d",

1239

logger.debug(u"Sent: %d, remaining: %d",

1428

1240

sent, len(client.secret)

1429

1241

- (sent_size + sent))

1430

1242

sent_size += sent

1431

1432

logger.info("Sending secret to %s", client.name)

1243

1244

logger.info(u"Sending secret to %s", client.name)

1433

1245

# bump the timeout as if seen

1434

client.checked_ok(client.extended_timeout)

1246

client.checked_ok()

1435

1247

if self.server.use_dbus:

1436

1248

# Emit D-Bus signal

1437

1249

client.GotSecret()

1441

1253

client.approvals_pending -= 1

1442

1254

try:

1443

1255

session.bye()

1444

except gnutls.errors.GNUTLSError as error:

1445

logger.warning("GnuTLS bye failed")

1256

except (gnutls.errors.GNUTLSError), error:

1257

logger.warning("gnutls bye failed")

1446

1258

1447

1259

@staticmethod

1448

1260

def peer_certificate(session):

1458

1270

.gnutls_certificate_get_peers

1459

1271

(session._c_object, ctypes.byref(list_size)))

1460

1272

if not bool(cert_list) and list_size.value != 0:

1461

raise gnutls.errors.GNUTLSError("error getting peer"

1462

" certificate")

1273

raise gnutls.errors.GNUTLSError(u"error getting peer"

1274

u" certificate")

1463

1275

if list_size.value == 0:

1464

1276

return None

1465

1277

cert = cert_list[0]

1491

1303

if crtverify.value != 0:

1492

1304

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1493

1305

raise (gnutls.errors.CertificateSecurityError

1494

("Verify failed"))

1306

(u"Verify failed"))

1495

1307

# New buffer for the fingerprint

1496

1308

buf = ctypes.create_string_buffer(20)

1497

1309

buf_len = ctypes.c_size_t()

1504

1316

# Convert the buffer to a Python bytestring

1505

1317

fpr = ctypes.string_at(buf, buf_len.value)

1506

1318

# Convert the bytestring to hexadecimal notation

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1319

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1508

1320

return hex_fpr

1509

1321

1510

1322

1522

1334

multiprocessing.Process(target = self.sub_process_main,

1523

1335

args = (request, address)).start()

1524

1336

1525

1526

1337

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1527

1338

""" adds a pipe to the MixIn """

1528

1339

def process_request(self, request, client_address):

1531

1342

This function creates a new pipe in self.pipe

1532

1343

"""

1533

1344

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1534

1345

1535

1346

super(MultiprocessingMixInWithPipe,

1536

1347

self).process_request(request, client_address)

1537

1348

self.child_pipe.close()

1538

1349

self.add_pipe(parent_pipe)

1539

1350

1540

1351

def add_pipe(self, parent_pipe):

1541

1352

"""Dummy function; override as necessary"""

1542

raise NotImplementedError

1543

1353

pass

1544

1354

1545

1355

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1546

1356

socketserver.TCPServer, object):

1564

1374

bind to an address or port if they were not specified."""

1565

1375

if self.interface is not None:

1566

1376

if SO_BINDTODEVICE is None:

1567

logger.error("SO_BINDTODEVICE does not exist;"

1568

" cannot bind to interface %s",

1377

logger.error(u"SO_BINDTODEVICE does not exist;"

1378

u" cannot bind to interface %s",

1569

1379

self.interface)

1570

1380

else:

1571

1381

try:

1572

1382

self.socket.setsockopt(socket.SOL_SOCKET,

1573

1383

SO_BINDTODEVICE,

1574

1384

str(self.interface

1575

+ '\0'))

1576

except socket.error as error:

1385

+ u'\0'))

1386

except socket.error, error:

1577

1387

if error[0] == errno.EPERM:

1578

logger.error("No permission to"

1579

" bind to interface %s",

1388

logger.error(u"No permission to"

1389

u" bind to interface %s",

1580

1390

self.interface)

1581

1391

elif error[0] == errno.ENOPROTOOPT:

1582

logger.error("SO_BINDTODEVICE not available;"

1583

" cannot bind to interface %s",

1392

logger.error(u"SO_BINDTODEVICE not available;"

1393

u" cannot bind to interface %s",

1584

1394

self.interface)

1585

1395

else:

1586

1396

raise

1588

1398

if self.server_address[0] or self.server_address[1]:

1589

1399

if not self.server_address[0]:

1590

1400

if self.address_family == socket.AF_INET6:

1591

any_address = "::" # in6addr_any

1401

any_address = u"::" # in6addr_any

1592

1402

else:

1593

1403

any_address = socket.INADDR_ANY

1594

1404

self.server_address = (any_address,

1638

1448

gobject.io_add_watch(parent_pipe.fileno(),

1639

1449

gobject.IO_IN | gobject.IO_HUP,

1640

1450

functools.partial(self.handle_ipc,

1641

parent_pipe =

1642

parent_pipe))

1451

parent_pipe = parent_pipe))

1643

1452

1644

1453

def handle_ipc(self, source, condition, parent_pipe=None,

1645

1454

client_object=None):

1646

1455

condition_names = {

1647

gobject.IO_IN: "IN", # There is data to read.

1648

gobject.IO_OUT: "OUT", # Data can be written (without

1456

gobject.IO_IN: u"IN", # There is data to read.

1457

gobject.IO_OUT: u"OUT", # Data can be written (without

1649

1458

# blocking).

1650

gobject.IO_PRI: "PRI", # There is urgent data to read.

1651

gobject.IO_ERR: "ERR", # Error condition.

1652

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1459

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1460

gobject.IO_ERR: u"ERR", # Error condition.

1461

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1653

1462

# broken, usually for pipes and

1654

1463

# sockets).

1655

1464

}

1657

1466

for cond, name in

1658

1467

condition_names.iteritems()

1659

1468

if cond & condition)

1469

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1470

conditions_string)

1471

1660

1472

# error or the other end of multiprocessing.Pipe has closed

1661

1473

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1662

1474

return False

1663

1475

1664

1476

# Read a request from the child

1665

1477

request = parent_pipe.recv()

1478

logger.debug(u"IPC request: %s", repr(request))

1666

1479

command = request[0]

1667

1480

1668

1481

if command == 'init':

1674

1487

client = c

1675

1488

break

1676

1489

else:

1677

logger.info("Client not found for fingerprint: %s, ad"

1678

"dress: %s", fpr, address)

1490

logger.warning(u"Client not found for fingerprint: %s, ad"

1491

u"dress: %s", fpr, address)

1679

1492

if self.use_dbus:

1680

1493

# Emit D-Bus signal

1681

mandos_dbus_service.ClientNotFound(fpr,

1682

address[0])

1494

mandos_dbus_service.ClientNotFound(fpr, address)

1683

1495

parent_pipe.send(False)

1684

1496

return False

1685

1497

1686

1498

gobject.io_add_watch(parent_pipe.fileno(),

1687

1499

gobject.IO_IN | gobject.IO_HUP,

1688

1500

functools.partial(self.handle_ipc,

1689

parent_pipe =

1690

parent_pipe,

1691

client_object =

1692

client))

1501

parent_pipe = parent_pipe,

1502

client_object = client))

1693

1503

parent_pipe.send(True)

1694

# remove the old hook in favor of the new above hook on

1695

# same fileno

1504

# remove the old hook in favor of the new above hook on same fileno

1696

1505

return False

1697

1506

if command == 'funcall':

1698

1507

funcname = request[1]

1699

1508

args = request[2]

1700

1509

kwargs = request[3]

1701

1510

1702

parent_pipe.send(('data', getattr(client_object,

1703

funcname)(*args,

1704

**kwargs)))

1705

1511

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1512

1706

1513

if command == 'getattr':

1707

1514

attrname = request[1]

1708

1515

if callable(client_object.__getattribute__(attrname)):

1709

1516

parent_pipe.send(('function',))

1710

1517

else:

1711

parent_pipe.send(('data', client_object

1712

.__getattribute__(attrname)))

1518

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1713

1519

1714

1520

if command == 'setattr':

1715

1521

attrname = request[1]

1716

1522

value = request[2]

1717

1523

setattr(client_object, attrname, value)

1718

1524

1719

1525

return True

1720

1526

1721

1527

1722

1528

def string_to_delta(interval):

1723

1529

"""Parse a string and return a datetime.timedelta

1724

1530

1725

>>> string_to_delta('7d')

1531

>>> string_to_delta(u'7d')

1726

1532

datetime.timedelta(7)

1727

>>> string_to_delta('60s')

1533

>>> string_to_delta(u'60s')

1728

1534

datetime.timedelta(0, 60)

1729

>>> string_to_delta('60m')

1535

>>> string_to_delta(u'60m')

1730

1536

datetime.timedelta(0, 3600)

1731

>>> string_to_delta('24h')

1537

>>> string_to_delta(u'24h')

1732

1538

datetime.timedelta(1)

1733

>>> string_to_delta('1w')

1539

>>> string_to_delta(u'1w')

1734

1540

datetime.timedelta(7)

1735

>>> string_to_delta('5m 30s')

1541

>>> string_to_delta(u'5m 30s')

1736

1542

datetime.timedelta(0, 330)

1737

1543

"""

1738

1544

timevalue = datetime.timedelta(0)

1740

1546

try:

1741

1547

suffix = unicode(s[-1])

1742

1548

value = int(s[:-1])

1743

if suffix == "d":

1549

if suffix == u"d":

1744

1550

delta = datetime.timedelta(value)

1745

elif suffix == "s":

1551

elif suffix == u"s":

1746

1552

delta = datetime.timedelta(0, value)

1747

elif suffix == "m":

1553

elif suffix == u"m":

1748

1554

delta = datetime.timedelta(0, 0, 0, 0, value)

1749

elif suffix == "h":

1555

elif suffix == u"h":

1750

1556

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1751

elif suffix == "w":

1557

elif suffix == u"w":

1752

1558

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1753

1559

else:

1754

raise ValueError("Unknown suffix %r" % suffix)

1755

except (ValueError, IndexError) as e:

1756

raise ValueError(*(e.args))

1560

raise ValueError(u"Unknown suffix %r" % suffix)

1561

except (ValueError, IndexError), e:

1562

raise ValueError(e.message)

1757

1563

timevalue += delta

1758

1564

return timevalue

1759

1565

1765

1571

global if_nametoindex

1766

1572

try:

1767

1573

if_nametoindex = (ctypes.cdll.LoadLibrary

1768

(ctypes.util.find_library("c"))

1574

(ctypes.util.find_library(u"c"))

1769

1575

.if_nametoindex)

1770

1576

except (OSError, AttributeError):

1771

logger.warning("Doing if_nametoindex the hard way")

1577

logger.warning(u"Doing if_nametoindex the hard way")

1772

1578

def if_nametoindex(interface):

1773

1579

"Get an interface index the hard way, i.e. using fcntl()"

1774

1580

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1775

1581

with contextlib.closing(socket.socket()) as s:

1776

1582

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1777

struct.pack(str("16s16x"),

1583

struct.pack(str(u"16s16x"),

1778

1584

interface))

1779

interface_index = struct.unpack(str("I"),

1585

interface_index = struct.unpack(str(u"I"),

1780

1586

ifreq[16:20])[0]

1781

1587

return interface_index

1782

1588

return if_nametoindex(interface)

1790

1596

sys.exit()

1791

1597

os.setsid()

1792

1598

if not nochdir:

1793

os.chdir("/")

1599

os.chdir(u"/")

1794

1600

if os.fork():

1795

1601

sys.exit()

1796

1602

if not noclose:

1798

1604

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1799

1605

if not stat.S_ISCHR(os.fstat(null).st_mode):

1800

1606

raise OSError(errno.ENODEV,

1801

"%s not a character device"

1607

u"%s not a character device"

1802

1608

% os.path.devnull)

1803

1609

os.dup2(null, sys.stdin.fileno())

1804

1610

os.dup2(null, sys.stdout.fileno())

1812

1618

##################################################################

1813

1619

# Parsing of options, both command line and config file

1814

1620

1815

parser = argparse.ArgumentParser()

1816

parser.add_argument("-v", "--version", action="version",

1817

version = "%%(prog)s %s" % version,

1818

help="show version number and exit")

1819

parser.add_argument("-i", "--interface", metavar="IF",

1820

help="Bind to interface IF")

1821

parser.add_argument("-a", "--address",

1822

help="Address to listen for requests on")

1823

parser.add_argument("-p", "--port", type=int,

1824

help="Port number to receive requests on")

1825

parser.add_argument("--check", action="store_true",

1826

help="Run self-test")

1827

parser.add_argument("--debug", action="store_true",

1828

help="Debug mode; run in foreground and log"

1829

" to terminal")

1830

parser.add_argument("--debuglevel", metavar="LEVEL",

1831

help="Debug level for stdout output")

1832

parser.add_argument("--priority", help="GnuTLS"

1833

" priority string (see GnuTLS documentation)")

1834

parser.add_argument("--servicename",

1835

metavar="NAME", help="Zeroconf service name")

1836

parser.add_argument("--configdir",

1837

default="/etc/mandos", metavar="DIR",

1838

help="Directory to search for configuration"

1839

" files")

1840

parser.add_argument("--no-dbus", action="store_false",

1841

dest="use_dbus", help="Do not provide D-Bus"

1842

" system bus interface")

1843

parser.add_argument("--no-ipv6", action="store_false",

1844

dest="use_ipv6", help="Do not use IPv6")

1845

options = parser.parse_args()

1621

parser = optparse.OptionParser(version = "%%prog %s" % version)

1622

parser.add_option("-i", u"--interface", type=u"string",

1623

metavar="IF", help=u"Bind to interface IF")

1624

parser.add_option("-a", u"--address", type=u"string",

1625

help=u"Address to listen for requests on")

1626

parser.add_option("-p", u"--port", type=u"int",

1627

help=u"Port number to receive requests on")

1628

parser.add_option("--check", action=u"store_true",

1629

help=u"Run self-test")

1630

parser.add_option("--debug", action=u"store_true",

1631

help=u"Debug mode; run in foreground and log to"

1632

u" terminal")

1633

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1634

help=u"Debug level for stdout output")

1635

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1636

u" priority string (see GnuTLS documentation)")

1637

parser.add_option("--servicename", type=u"string",

1638

metavar=u"NAME", help=u"Zeroconf service name")

1639

parser.add_option("--configdir", type=u"string",

1640

default=u"/etc/mandos", metavar=u"DIR",

1641

help=u"Directory to search for configuration"

1642

u" files")

1643

parser.add_option("--no-dbus", action=u"store_false",

1644

dest=u"use_dbus", help=u"Do not provide D-Bus"

1645

u" system bus interface")

1646

parser.add_option("--no-ipv6", action=u"store_false",

1647

dest=u"use_ipv6", help=u"Do not use IPv6")

1648

options = parser.parse_args()[0]

1846

1649

1847

1650

if options.check:

1848

1651

import doctest

1850

1653

sys.exit()

1851

1654

1852

1655

# Default values for config file for server-global settings

1853

server_defaults = { "interface": "",

1854

"address": "",

1855

"port": "",

1856

"debug": "False",

1857

"priority":

1858

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1859

"servicename": "Mandos",

1860

"use_dbus": "True",

1861

"use_ipv6": "True",

1862

"debuglevel": "",

1656

server_defaults = { u"interface": u"",

1657

u"address": u"",

1658

u"port": u"",

1659

u"debug": u"False",

1660

u"priority":

1661

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1662

u"servicename": u"Mandos",

1663

u"use_dbus": u"True",

1664

u"use_ipv6": u"True",

1665

u"debuglevel": u"",

1863

1666

}

1864

1667

1865

1668

# Parse config file for server-global settings

1866

1669

server_config = configparser.SafeConfigParser(server_defaults)

1867

1670

del server_defaults

1868

1671

server_config.read(os.path.join(options.configdir,

1869

"mandos.conf"))

1672

u"mandos.conf"))

1870

1673

# Convert the SafeConfigParser object to a dict

1871

1674

server_settings = server_config.defaults()

1872

1675

# Use the appropriate methods on the non-string config options

1873

for option in ("debug", "use_dbus", "use_ipv6"):

1874

server_settings[option] = server_config.getboolean("DEFAULT",

1676

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1677

server_settings[option] = server_config.getboolean(u"DEFAULT",

1875

1678

option)

1876

1679

if server_settings["port"]:

1877

server_settings["port"] = server_config.getint("DEFAULT",

1878

"port")

1680

server_settings["port"] = server_config.getint(u"DEFAULT",

1681

u"port")

1879

1682

del server_config

1880

1683

1881

1684

# Override the settings from the config file with command line

1882

1685

# options, if set.

1883

for option in ("interface", "address", "port", "debug",

1884

"priority", "servicename", "configdir",

1885

"use_dbus", "use_ipv6", "debuglevel"):

1686

for option in (u"interface", u"address", u"port", u"debug",

1687

u"priority", u"servicename", u"configdir",

1688

u"use_dbus", u"use_ipv6", u"debuglevel"):

1886

1689

value = getattr(options, option)

1887

1690

if value is not None:

1888

1691

server_settings[option] = value

1896

1699

##################################################################

1897

1700

1898

1701

# For convenience

1899

debug = server_settings["debug"]

1900

debuglevel = server_settings["debuglevel"]

1901

use_dbus = server_settings["use_dbus"]

1902

use_ipv6 = server_settings["use_ipv6"]

1903

1904

if server_settings["servicename"] != "Mandos":

1702

debug = server_settings[u"debug"]

1703

debuglevel = server_settings[u"debuglevel"]

1704

use_dbus = server_settings[u"use_dbus"]

1705

use_ipv6 = server_settings[u"use_ipv6"]

1706

1707

if server_settings[u"servicename"] != u"Mandos":

1905

1708

syslogger.setFormatter(logging.Formatter

1906

('Mandos (%s) [%%(process)d]:'

1907

' %%(levelname)s: %%(message)s'

1908

% server_settings["servicename"]))

1709

(u'Mandos (%s) [%%(process)d]:'

1710

u' %%(levelname)s: %%(message)s'

1711

% server_settings[u"servicename"]))

1909

1712

1910

1713

# Parse config file with clients

1911

client_defaults = { "timeout": "5m",

1912

"extended_timeout": "15m",

1913

"interval": "2m",

1914

"checker": "fping -q -- %%(host)s",

1915

"host": "",

1916

"approval_delay": "0s",

1917

"approval_duration": "1s",

1714

client_defaults = { u"timeout": u"1h",

1715

u"interval": u"5m",

1716

u"checker": u"fping -q -- %%(host)s",

1717

u"host": u"",

1718

u"approved_delay": u"0s",

1719

u"approved_duration": u"1s",

1918

1720

}

1919

1721

client_config = configparser.SafeConfigParser(client_defaults)

1920

client_config.read(os.path.join(server_settings["configdir"],

1921

"clients.conf"))

1722

client_config.read(os.path.join(server_settings[u"configdir"],

1723

u"clients.conf"))

1922

1724

1923

1725

global mandos_dbus_service

1924

1726

mandos_dbus_service = None

1925

1727

1926

tcp_server = MandosServer((server_settings["address"],

1927

server_settings["port"]),

1728

tcp_server = MandosServer((server_settings[u"address"],

1729

server_settings[u"port"]),

1928

1730

ClientHandler,

1929

interface=(server_settings["interface"]

1930

or None),

1731

interface=server_settings[u"interface"],

1931

1732

use_ipv6=use_ipv6,

1932

1733

gnutls_priority=

1933

server_settings["priority"],

1734

server_settings[u"priority"],

1934

1735

use_dbus=use_dbus)

1935

if not debug:

1936

pidfilename = "/var/run/mandos.pid"

1937

try:

1938

pidfile = open(pidfilename, "w")

1939

except IOError:

1940

logger.error("Could not open file %r", pidfilename)

1736

pidfilename = u"/var/run/mandos.pid"

1737

try:

1738

pidfile = open(pidfilename, u"w")

1739

except IOError:

1740

logger.error(u"Could not open file %r", pidfilename)

1941

1741

1942

1742

try:

1943

uid = pwd.getpwnam("_mandos").pw_uid

1944

gid = pwd.getpwnam("_mandos").pw_gid

1743

uid = pwd.getpwnam(u"_mandos").pw_uid

1744

gid = pwd.getpwnam(u"_mandos").pw_gid

1945

1745

except KeyError:

1946

1746

try:

1947

uid = pwd.getpwnam("mandos").pw_uid

1948

gid = pwd.getpwnam("mandos").pw_gid

1747

uid = pwd.getpwnam(u"mandos").pw_uid

1748

gid = pwd.getpwnam(u"mandos").pw_gid

1949

1749

except KeyError:

1950

1750

try:

1951

uid = pwd.getpwnam("nobody").pw_uid

1952

gid = pwd.getpwnam("nobody").pw_gid

1751

uid = pwd.getpwnam(u"nobody").pw_uid

1752

gid = pwd.getpwnam(u"nobody").pw_gid

1953

1753

except KeyError:

1954

1754

uid = 65534

1955

1755

gid = 65534

1956

1756

try:

1957

1757

os.setgid(gid)

1958

1758

os.setuid(uid)

1959

except OSError as error:

1759

except OSError, error:

1960

1760

if error[0] != errno.EPERM:

1961

1761

raise error

1962

1762

1763

# Enable all possible GnuTLS debugging

1764

1765

1963

1766

if not debug and not debuglevel:

1964

1767

syslogger.setLevel(logging.WARNING)

1965

1768

console.setLevel(logging.WARNING)

1967

1770

level = getattr(logging, debuglevel.upper())

1968

1771

syslogger.setLevel(level)

1969

1772

console.setLevel(level)

1970

1773

1971

1774

if debug:

1972

# Enable all possible GnuTLS debugging

1973

1974

1775

# "Use a log level over 10 to enable all debugging options."

1975

1776

# - GnuTLS manual

1976

1777

gnutls.library.functions.gnutls_global_set_log_level(11)

1977

1778

1978

1779

@gnutls.library.types.gnutls_log_func

1979

1780

def debug_gnutls(level, string):

1980

logger.debug("GnuTLS: %s", string[:-1])

1781

logger.debug(u"GnuTLS: %s", string[:-1])

1981

1782

1982

1783

(gnutls.library.functions

1983

1784

.gnutls_global_set_log_function(debug_gnutls))

1984

1785

1985

1786

# Redirect stdin so all checkers get /dev/null

1986

1787

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1987

1788

os.dup2(null, sys.stdin.fileno())

1990

1791

else:

1991

1792

# No console logging

1992

1793

logger.removeHandler(console)

1993

1994

# Need to fork before connecting to D-Bus

1995

if not debug:

1996

# Close all input and output, do double fork, etc.

1997

daemon()

1794

1998

1795

1999

1796

global main_loop

2000

1797

# From the Avahi example code

2004

1801

# End of Avahi example code

2005

1802

if use_dbus:

2006

1803

try:

2007

bus_name = dbus.service.BusName("se.recompile.Mandos",

1804

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2008

1805

bus, do_not_queue=True)

2009

old_bus_name = (dbus.service.BusName

2010

("se.bsnet.fukt.Mandos", bus,

2011

do_not_queue=True))

2012

except dbus.exceptions.NameExistsException as e:

2013

logger.error(unicode(e) + ", disabling D-Bus")

1806

except dbus.exceptions.NameExistsException, e:

1807

logger.error(unicode(e) + u", disabling D-Bus")

2014

1808

use_dbus = False

2015

server_settings["use_dbus"] = False

1809

server_settings[u"use_dbus"] = False

2016

1810

tcp_server.use_dbus = False

2017

1811

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2018

service = AvahiService(name = server_settings["servicename"],

2019

servicetype = "_mandos._tcp",

1812

service = AvahiService(name = server_settings[u"servicename"],

1813

servicetype = u"_mandos._tcp",

2020

1814

protocol = protocol, bus = bus)

2021

1815

if server_settings["interface"]:

2022

1816

service.interface = (if_nametoindex

2023

(str(server_settings["interface"])))

2024

1817

(str(server_settings[u"interface"])))

1818

1819

if not debug:

1820

# Close all input and output, do double fork, etc.

1821

daemon()

1822

2025

1823

global multiprocessing_manager

2026

1824

multiprocessing_manager = multiprocessing.Manager()

2027

1825

2028

1826

client_class = Client

2029

1827

if use_dbus:

2030

client_class = functools.partial(ClientDBusTransitional,

2031

bus = bus)

1828

client_class = functools.partial(ClientDBus, bus = bus)

2032

1829

def client_config_items(config, section):

2033

1830

special_settings = {

2034

1831

"approved_by_default":

2047

1844

client_config, section)))

2048

1845

for section in client_config.sections()))

2049

1846

if not tcp_server.clients:

2050

logger.warning("No clients defined")

1847

logger.warning(u"No clients defined")

2051

1848

1849

try:

1850

with pidfile:

1851

pid = os.getpid()

1852

pidfile.write(str(pid) + "\n")

1853

del pidfile

1854

except IOError:

1855

logger.error(u"Could not write to file %r with PID %d",

1856

pidfilename, pid)

1857

except NameError:

1858

# "pidfile" was never created

1859

pass

1860

del pidfilename

1861

2052

1862

if not debug:

2053

try:

2054

with pidfile:

2055

pid = os.getpid()

2056

pidfile.write(str(pid) + "\n".encode("utf-8"))

2057

del pidfile

2058

except IOError:

2059

logger.error("Could not write to file %r with PID %d",

2060

pidfilename, pid)

2061

except NameError:

2062

# "pidfile" was never created

2063

pass

2064

del pidfilename

2065

2066

1863

signal.signal(signal.SIGINT, signal.SIG_IGN)

2067

2068

1864

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2069

1865

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2070

1866

2072

1868

class MandosDBusService(dbus.service.Object):

2073

1869

"""A D-Bus proxy object"""

2074

1870

def __init__(self):

2075

dbus.service.Object.__init__(self, bus, "/")

2076

_interface = "se.recompile.Mandos"

1871

dbus.service.Object.__init__(self, bus, u"/")

1872

_interface = u"se.bsnet.fukt.Mandos"

2077

1873

2078

@dbus.service.signal(_interface, signature="o")

1874

@dbus.service.signal(_interface, signature=u"o")

2079

1875

def ClientAdded(self, objpath):

2080

1876

"D-Bus signal"

2081

1877

pass

2082

1878

2083

@dbus.service.signal(_interface, signature="ss")

1879

@dbus.service.signal(_interface, signature=u"ss")

2084

1880

def ClientNotFound(self, fingerprint, address):

2085

1881

"D-Bus signal"

2086

1882

pass

2087

1883

2088

@dbus.service.signal(_interface, signature="os")

1884

@dbus.service.signal(_interface, signature=u"os")

2089

1885

def ClientRemoved(self, objpath, name):

2090

1886

"D-Bus signal"

2091

1887

pass

2092

1888

2093

@dbus.service.method(_interface, out_signature="ao")

1889

@dbus.service.method(_interface, out_signature=u"ao")

2094

1890

def GetAllClients(self):

2095

1891

"D-Bus method"

2096

1892

return dbus.Array(c.dbus_object_path

2097

1893

for c in tcp_server.clients)

2098

1894

2099

1895

@dbus.service.method(_interface,

2100

out_signature="a{oa{sv}}")

1896

out_signature=u"a{oa{sv}}")

2101

1897

def GetAllClientsWithProperties(self):

2102

1898

"D-Bus method"

2103

1899

return dbus.Dictionary(

2104

((c.dbus_object_path, c.GetAll(""))

1900

((c.dbus_object_path, c.GetAll(u""))

2105

1901

for c in tcp_server.clients),

2106

signature="oa{sv}")

1902

signature=u"oa{sv}")

2107

1903

2108

@dbus.service.method(_interface, in_signature="o")

1904

@dbus.service.method(_interface, in_signature=u"o")

2109

1905

def RemoveClient(self, object_path):

2110

1906

"D-Bus method"

2111

1907

for c in tcp_server.clients:

2121

1917

2122

1918

del _interface

2123

1919

2124

class MandosDBusServiceTransitional(MandosDBusService):

2125

__metaclass__ = AlternateDBusNamesMetaclass

2126

mandos_dbus_service = MandosDBusServiceTransitional()

1920

mandos_dbus_service = MandosDBusService()

2127

1921

2128

1922

def cleanup():

2129

1923

"Cleanup function; run on exit"

2138

1932

client.disable(quiet=True)

2139

1933

if use_dbus:

2140

1934

# Emit D-Bus signal

2141

mandos_dbus_service.ClientRemoved(client

2142

.dbus_object_path,

1935

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2143

1936

client.name)

2144

1937

2145

1938

atexit.register(cleanup)

2156

1949

# Find out what port we got

2157

1950

service.port = tcp_server.socket.getsockname()[1]

2158

1951

if use_ipv6:

2159

logger.info("Now listening on address %r, port %d,"

1952

logger.info(u"Now listening on address %r, port %d,"

2160

1953

" flowinfo %d, scope_id %d"

2161

1954

% tcp_server.socket.getsockname())

2162

1955

else: # IPv4

2163

logger.info("Now listening on address %r, port %d"

1956

logger.info(u"Now listening on address %r, port %d"

2164

1957

% tcp_server.socket.getsockname())

2165

1958

2166

1959

#service.interface = tcp_server.socket.getsockname()[3]

2169

1962

# From the Avahi example code

2170

1963

try:

2171

1964

service.activate()

2172

except dbus.exceptions.DBusException as error:

2173

logger.critical("DBusException: %s", error)

1965

except dbus.exceptions.DBusException, error:

1966

logger.critical(u"DBusException: %s", error)

2174

1967

cleanup()

2175

1968

sys.exit(1)

2176

1969

# End of Avahi example code

2180

1973

(tcp_server.handle_request

2181

1974

(*args[2:], **kwargs) or True))

2182

1975

2183

logger.debug("Starting main loop")

1976

logger.debug(u"Starting main loop")

2184

1977

main_loop.run()

2185

except AvahiError as error:

2186

logger.critical("AvahiError: %s", error)

1978

except AvahiError, error:

1979

logger.critical(u"AvahiError: %s", error)

2187

1980

cleanup()

2188

1981

sys.exit(1)

2189

1982

except KeyboardInterrupt:

2190

1983

if debug:

2191

print("", file=sys.stderr)

2192

logger.debug("Server received KeyboardInterrupt")

2193

logger.debug("Server exiting")

1984

print >> sys.stderr

1985

logger.debug(u"Server received KeyboardInterrupt")

1986

logger.debug(u"Server exiting")

2194

1987

# Must run before the D-Bus bus name gets deregistered

2195

1988

cleanup()

2196

1989

2197

2198

1990

if __name__ == '__main__':

2199

1991

main()