/mandos/release : revision 24.1.181

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

55

56

import logging

56

57

import logging.handlers

57

58

import pwd

58

from contextlib import closing

59

import contextlib

59

60

import struct

60

61

import fcntl

61

62

import functools

63

import cPickle as pickle

64

import multiprocessing

62

65

63

66

import dbus

64

67

import dbus.service

79

82

SO_BINDTODEVICE = None

80

83

81

84

82

version = "1.0.12"

85

version = "1.3.1"

83

86

84

logger = logging.Logger(u'mandos')

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

85

89

syslogger = (logging.handlers.SysLogHandler

86

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

87

address = "/dev/log"))

91

address = str("/dev/log")))

88

92

syslogger.setFormatter(logging.Formatter

89

(u'Mandos [%(process)d]: %(levelname)s:'

90

u' %(message)s'))

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

91

95

logger.addHandler(syslogger)

92

96

93

97

console = logging.StreamHandler()

94

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

95

u' %(levelname)s:'

96

u' %(message)s'))

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

97

101

logger.addHandler(console)

98

102

99

103

class AvahiError(Exception):

116

120

Attributes:

117

121

interface: integer; avahi.IF_UNSPEC or an interface index.

118

122

Used to optionally bind to the specified interface.

119

120

type: string; Example: u'_mandos._tcp'.

123

124

type: string; Example: '_mandos._tcp'.

121

125

See <http://www.dns-sd.org/ServiceTypes.html>

122

126

port: integer; what port to announce

123

127

TXT: list of strings; TXT record for the service

132

136

"""

133

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

134

138

servicetype = None, port = None, TXT = None,

135

domain = u"", host = u"", max_renames = 32768,

139

domain = "", host = "", max_renames = 32768,

136

140

protocol = avahi.PROTO_UNSPEC, bus = None):

137

141

self.interface = interface

138

142

self.name = name

147

151

self.group = None # our entry group

148

152

self.server = None

149

153

self.bus = bus

154

self.entry_group_state_changed_match = None

150

155

def rename(self):

151

156

"""Derived from the Avahi example code"""

152

157

if self.rename_count >= self.max_renames:

153

logger.critical(u"No suitable Zeroconf service name found"

154

u" after %i retries, exiting.",

158

logger.critical("No suitable Zeroconf service name found"

159

" after %i retries, exiting.",

155

160

self.rename_count)

156

raise AvahiServiceError(u"Too many renames")

157

self.name = self.server.GetAlternativeServiceName(self.name)

158

logger.info(u"Changing Zeroconf service name to %r ...",

159

unicode(self.name))

161

raise AvahiServiceError("Too many renames")

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

163

logger.info("Changing Zeroconf service name to %r ...",

164

self.name)

160

165

syslogger.setFormatter(logging.Formatter

161

(u'Mandos (%s) [%%(process)d]:'

162

u' %%(levelname)s: %%(message)s'

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

163

168

% self.name))

164

169

self.remove()

165

self.add()

170

try:

171

self.add()

172

except dbus.exceptions.DBusException as error:

173

logger.critical("DBusException: %s", error)

174

self.cleanup()

175

os._exit(1)

166

176

self.rename_count += 1

167

177

def remove(self):

168

178

"""Derived from the Avahi example code"""

179

if self.entry_group_state_changed_match is not None:

180

self.entry_group_state_changed_match.remove()

181

self.entry_group_state_changed_match = None

169

182

if self.group is not None:

170

183

self.group.Reset()

171

184

def add(self):

172

185

"""Derived from the Avahi example code"""

186

self.remove()

173

187

if self.group is None:

174

188

self.group = dbus.Interface(

175

189

self.bus.get_object(avahi.DBUS_NAME,

176

190

self.server.EntryGroupNew()),

177

191

avahi.DBUS_INTERFACE_ENTRY_GROUP)

178

self.group.connect_to_signal('StateChanged',

179

self

180

.entry_group_state_changed)

181

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

192

self.entry_group_state_changed_match = (

193

self.group.connect_to_signal(

194

'StateChanged', self .entry_group_state_changed))

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

182

196

self.name, self.type)

183

197

self.group.AddService(

184

198

self.interface,

191

205

self.group.Commit()

192

206

def entry_group_state_changed(self, state, error):

193

207

"""Derived from the Avahi example code"""

194

logger.debug(u"Avahi state change: %i", state)

208

logger.debug("Avahi entry group state change: %i", state)

195

209

196

210

if state == avahi.ENTRY_GROUP_ESTABLISHED:

197

logger.debug(u"Zeroconf service established.")

211

logger.debug("Zeroconf service established.")

198

212

elif state == avahi.ENTRY_GROUP_COLLISION:

199

logger.warning(u"Zeroconf service name collision.")

213

logger.info("Zeroconf service name collision.")

200

214

self.rename()

201

215

elif state == avahi.ENTRY_GROUP_FAILURE:

202

logger.critical(u"Avahi: Error in group state changed %s",

216

logger.critical("Avahi: Error in group state changed %s",

203

217

unicode(error))

204

raise AvahiGroupError(u"State changed: %s"

218

raise AvahiGroupError("State changed: %s"

205

219

% unicode(error))

206

220

def cleanup(self):

207

221

"""Derived from the Avahi example code"""

208

222

if self.group is not None:

209

self.group.Free()

223

try:

224

self.group.Free()

225

except (dbus.exceptions.UnknownMethodException,

226

dbus.exceptions.DBusException) as e:

227

pass

210

228

self.group = None

211

def server_state_changed(self, state):

229

self.remove()

230

def server_state_changed(self, state, error=None):

212

231

"""Derived from the Avahi example code"""

213

if state == avahi.SERVER_COLLISION:

214

logger.error(u"Zeroconf server name collision")

215

self.remove()

232

logger.debug("Avahi server state change: %i", state)

233

bad_states = { avahi.SERVER_INVALID:

234

"Zeroconf server invalid",

235

avahi.SERVER_REGISTERING: None,

236

avahi.SERVER_COLLISION:

237

"Zeroconf server name collision",

238

avahi.SERVER_FAILURE:

239

"Zeroconf server failure" }

240

if state in bad_states:

241

if bad_states[state] is not None:

242

if error is None:

243

logger.error(bad_states[state])

244

else:

245

logger.error(bad_states[state] + ": %r", error)

246

self.cleanup()

216

247

elif state == avahi.SERVER_RUNNING:

217

248

self.add()

249

else:

250

if error is None:

251

logger.debug("Unknown state: %r", state)

252

else:

253

logger.debug("Unknown state: %r: %r", state, error)

218

254

def activate(self):

219

255

"""Derived from the Avahi example code"""

220

256

if self.server is None:

221

257

self.server = dbus.Interface(

222

258

self.bus.get_object(avahi.DBUS_NAME,

223

avahi.DBUS_PATH_SERVER),

259

avahi.DBUS_PATH_SERVER,

260

follow_name_owner_changes=True),

224

261

avahi.DBUS_INTERFACE_SERVER)

225

self.server.connect_to_signal(u"StateChanged",

262

self.server.connect_to_signal("StateChanged",

226

263

self.server_state_changed)

227

264

self.server_state_changed(self.server.GetState())

228

265

231

268

"""A representation of a client host served by this server.

232

269

233

270

Attributes:

234

235

D-Bus identifiers

236

fingerprint: string (40 or 32 hexadecimal digits); used to

237

uniquely identify the client

238

secret: bytestring; sent verbatim (over TLS) to client

239

host: string; available for use by the checker command

240

created: datetime.datetime(); (UTC) object creation

241

last_enabled: datetime.datetime(); (UTC)

242

enabled: bool()

243

last_checked_ok: datetime.datetime(); (UTC) or None

244

timeout: datetime.timedelta(); How long from last_checked_ok

245

until this client is invalid

246

interval: datetime.timedelta(); How often to start a new checker

247

disable_hook: If set, called by disable() as disable_hook(self)

271

_approved: bool(); 'None' if not yet approved/disapproved

272

approval_delay: datetime.timedelta(); Time to wait for approval

273

approval_duration: datetime.timedelta(); Duration of one approval

248

274

checker: subprocess.Popen(); a running checker process used

249

275

to see if the client lives.

250

276

'None' if no process is running.

251

checker_initiator_tag: a gobject event source tag, or None

252

disable_initiator_tag: - '' -

253

checker_callback_tag: - '' -

254

checker_command: string; External command which is run to check if

255

client lives. %() expansions are done at

277

checker_callback_tag: a gobject event source tag, or None

278

checker_command: string; External command which is run to check

279

if client lives. %() expansions are done at

256

280

runtime with vars(self) as dict, so that for

257

281

instance %(name)s can be used in the command.

282

checker_initiator_tag: a gobject event source tag, or None

283

created: datetime.datetime(); (UTC) object creation

258

284

current_checker_command: string; current running checker_command

285

disable_hook: If set, called by disable() as disable_hook(self)

286

disable_initiator_tag: a gobject event source tag, or None

287

enabled: bool()

288

fingerprint: string (40 or 32 hexadecimal digits); used to

289

uniquely identify the client

290

host: string; available for use by the checker command

291

interval: datetime.timedelta(); How often to start a new checker

292

last_approval_request: datetime.datetime(); (UTC) or None

293

last_checked_ok: datetime.datetime(); (UTC) or None

294

last_enabled: datetime.datetime(); (UTC)

295

296

D-Bus identifiers

297

secret: bytestring; sent verbatim (over TLS) to client

298

timeout: datetime.timedelta(); How long from last_checked_ok

299

until this client is disabled

300

extended_timeout: extra long timeout when password has been sent

301

runtime_expansions: Allowed attributes for runtime expansion.

302

expires: datetime.datetime(); time (UTC) when a client will be

303

disabled, or None

259

304

"""

260

305

306

runtime_expansions = ("approval_delay", "approval_duration",

307

"created", "enabled", "fingerprint",

308

"host", "interval", "last_checked_ok",

309

"last_enabled", "name", "timeout")

310

261

311

@staticmethod

262

312

def _timedelta_to_milliseconds(td):

263

313

"Convert a datetime.timedelta() to milliseconds"

268

318

def timeout_milliseconds(self):

269

319

"Return the 'timeout' attribute in milliseconds"

270

320

return self._timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return self._timedelta_to_milliseconds(self.extended_timeout)

271

325

272

326

def interval_milliseconds(self):

273

327

"Return the 'interval' attribute in milliseconds"

274

328

return self._timedelta_to_milliseconds(self.interval)

329

330

def approval_delay_milliseconds(self):

331

return self._timedelta_to_milliseconds(self.approval_delay)

275

332

276

333

def __init__(self, name = None, disable_hook=None, config=None):

277

334

"""Note: the 'checker' key in 'config' sets the

280

337

self.name = name

281

338

if config is None:

282

339

config = {}

283

logger.debug(u"Creating client %r", self.name)

340

logger.debug("Creating client %r", self.name)

284

341

# Uppercase and remove spaces from fingerprint for later

285

342

# comparison purposes with return value from the fingerprint()

286

343

# function

287

self.fingerprint = (config[u"fingerprint"].upper()

288

.replace(u" ", u""))

289

logger.debug(u" Fingerprint: %s", self.fingerprint)

290

if u"secret" in config:

291

self.secret = config[u"secret"].decode(u"base64")

292

elif u"secfile" in config:

293

with closing(open(os.path.expanduser

294

(os.path.expandvars

295

(config[u"secfile"])),

296

"rb")) as secfile:

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

350

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

352

"rb") as secfile:

297

353

self.secret = secfile.read()

298

354

else:

299

raise TypeError(u"No secret or secfile for client %s"

355

raise TypeError("No secret or secfile for client %s"

300

356

% self.name)

301

self.host = config.get(u"host", u"")

357

self.host = config.get("host", "")

302

358

self.created = datetime.datetime.utcnow()

303

359

self.enabled = False

360

self.last_approval_request = None

304

361

self.last_enabled = None

305

362

self.last_checked_ok = None

306

self.timeout = string_to_delta(config[u"timeout"])

307

self.interval = string_to_delta(config[u"interval"])

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

308

366

self.disable_hook = disable_hook

309

367

self.checker = None

310

368

self.checker_initiator_tag = None

311

369

self.disable_initiator_tag = None

370

self.expires = None

312

371

self.checker_callback_tag = None

313

self.checker_command = config[u"checker"]

372

self.checker_command = config["checker"]

314

373

self.current_checker_command = None

315

374

self.last_connect = None

375

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

377

True)

378

self.approvals_pending = 0

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

316

384

385

def send_changedstate(self):

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

317

390

def enable(self):

318

391

"""Start this client's checker and timeout hooks"""

319

if getattr(self, u"enabled", False):

392

if getattr(self, "enabled", False):

320

393

# Already enabled

321

394

return

395

self.send_changedstate()

322

396

self.last_enabled = datetime.datetime.utcnow()

323

397

# Schedule a new checker to be started an 'interval' from now,

324

398

# and every interval from then on.

325

399

self.checker_initiator_tag = (gobject.timeout_add

326

400

(self.interval_milliseconds(),

327

401

self.start_checker))

328

# Also start a new checker *right now*.

329

self.start_checker()

330

402

# Schedule a disable() when 'timeout' has passed

403

self.expires = datetime.datetime.utcnow() + self.timeout

331

404

self.disable_initiator_tag = (gobject.timeout_add

332

405

(self.timeout_milliseconds(),

333

406

self.disable))

334

407

self.enabled = True

408

# Also start a new checker *right now*.

409

self.start_checker()

335

410

336

def disable(self):

411

def disable(self, quiet=True):

337

412

"""Disable this client."""

338

413

if not getattr(self, "enabled", False):

339

414

return False

340

logger.info(u"Disabling client %s", self.name)

341

if getattr(self, u"disable_initiator_tag", False):

415

if not quiet:

416

self.send_changedstate()

417

if not quiet:

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

342

420

gobject.source_remove(self.disable_initiator_tag)

343

421

self.disable_initiator_tag = None

344

if getattr(self, u"checker_initiator_tag", False):

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

345

424

gobject.source_remove(self.checker_initiator_tag)

346

425

self.checker_initiator_tag = None

347

426

self.stop_checker()

362

441

if os.WIFEXITED(condition):

363

442

exitstatus = os.WEXITSTATUS(condition)

364

443

if exitstatus == 0:

365

logger.info(u"Checker for %(name)s succeeded",

444

logger.info("Checker for %(name)s succeeded",

366

445

vars(self))

367

446

self.checked_ok()

368

447

else:

369

logger.info(u"Checker for %(name)s failed",

448

logger.info("Checker for %(name)s failed",

370

449

vars(self))

371

450

else:

372

logger.warning(u"Checker for %(name)s crashed?",

451

logger.warning("Checker for %(name)s crashed?",

373

452

vars(self))

374

453

375

def checked_ok(self):

454

def checked_ok(self, timeout=None):

376

455

"""Bump up the timeout for this client.

377

456

378

457

This should only be called when the client has been seen,

379

458

alive and well.

380

459

"""

460

if timeout is None:

461

timeout = self.timeout

381

462

self.last_checked_ok = datetime.datetime.utcnow()

382

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

383

465

self.disable_initiator_tag = (gobject.timeout_add

384

(self.timeout_milliseconds(),

466

(self._timedelta_to_milliseconds(timeout),

385

467

self.disable))

386

468

469

def need_approval(self):

470

self.last_approval_request = datetime.datetime.utcnow()

471

387

472

def start_checker(self):

388

473

"""Start a new checker subprocess if one is not running.

389

474

395

480

# client would inevitably timeout, since no checker would get

396

481

# a chance to run to completion. If we instead leave running

397

482

# checkers alone, the checker would have to take more time

398

# than 'timeout' for the client to be declared invalid, which

399

# is as it should be.

483

# than 'timeout' for the client to be disabled, which is as it

484

# should be.

400

485

401

486

# If a checker exists, make sure it is not a zombie

402

487

try:

403

488

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

404

except (AttributeError, OSError), error:

489

except (AttributeError, OSError) as error:

405

490

if (isinstance(error, OSError)

406

491

and error.errno != errno.ECHILD):

407

492

raise error

408

493

else:

409

494

if pid:

410

logger.warning(u"Checker was a zombie")

495

logger.warning("Checker was a zombie")

411

496

gobject.source_remove(self.checker_callback_tag)

412

497

self.checker_callback(pid, status,

413

498

self.current_checker_command)

418

503

command = self.checker_command % self.host

419

504

except TypeError:

420

505

# Escape attributes for the shell

421

escaped_attrs = dict((key,

422

re.escape(unicode(str(val),

423

errors=

424

u'replace')))

425

for key, val in

426

vars(self).iteritems())

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

427

514

try:

428

515

command = self.checker_command % escaped_attrs

429

except TypeError, error:

430

logger.error(u'Could not format string "%s":'

431

u' %s', self.checker_command, error)

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

432

519

return True # Try again later

433

520

self.current_checker_command = command

434

521

try:

435

logger.info(u"Starting checker %r for %s",

522

logger.info("Starting checker %r for %s",

436

523

command, self.name)

437

524

# We don't need to redirect stdout and stderr, since

438

525

# in normal mode, that is already done by daemon(),

440

527

# always replaced by /dev/null.)

441

528

self.checker = subprocess.Popen(command,

442

529

close_fds=True,

443

shell=True, cwd=u"/")

530

shell=True, cwd="/")

444

531

self.checker_callback_tag = (gobject.child_watch_add

445

532

(self.checker.pid,

446

533

self.checker_callback,

451

538

if pid:

452

539

gobject.source_remove(self.checker_callback_tag)

453

540

self.checker_callback(pid, status, command)

454

except OSError, error:

455

logger.error(u"Failed to start subprocess: %s",

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

456

543

error)

457

544

# Re-run this periodically if run by gobject.timeout_add

458

545

return True

462

549

if self.checker_callback_tag:

463

550

gobject.source_remove(self.checker_callback_tag)

464

551

self.checker_callback_tag = None

465

if getattr(self, u"checker", None) is None:

552

if getattr(self, "checker", None) is None:

466

553

return

467

logger.debug(u"Stopping checker for %(name)s", vars(self))

554

logger.debug("Stopping checker for %(name)s", vars(self))

468

555

try:

469

556

os.kill(self.checker.pid, signal.SIGTERM)

470

#os.sleep(0.5)

557

#time.sleep(0.5)

471

558

#if self.checker.poll() is None:

472

559

# os.kill(self.checker.pid, signal.SIGKILL)

473

except OSError, error:

560

except OSError as error:

474

561

if error.errno != errno.ESRCH: # No such process

475

562

raise

476

563

self.checker = None

477

478

def still_valid(self):

479

"""Has the timeout not yet passed for this client?"""

480

if not getattr(self, u"enabled", False):

481

return False

482

now = datetime.datetime.utcnow()

483

if self.last_checked_ok is None:

484

return now < (self.created + self.timeout)

485

else:

486

return now < (self.last_checked_ok + self.timeout)

487

488

489

def dbus_service_property(dbus_interface, signature=u"v",

490

access=u"readwrite", byte_arrays=False):

564

565

def dbus_service_property(dbus_interface, signature="v",

566

access="readwrite", byte_arrays=False):

491

567

"""Decorators for marking methods of a DBusObjectWithProperties to

492

568

become properties on the D-Bus.

493

569

498

574

dbus.service.method, except there is only "signature", since the

499

575

type from Get() and the type sent to Set() is the same.

500

576

"""

577

# Encoding deeply encoded byte arrays is not supported yet by the

578

# "Set" method, so we fail early here:

579

if byte_arrays and signature != "ay":

580

raise ValueError("Byte arrays not supported for non-'ay'"

581

" signature %r" % signature)

501

582

def decorator(func):

502

583

func._dbus_is_property = True

503

584

func._dbus_interface = dbus_interface

504

585

func._dbus_signature = signature

505

586

func._dbus_access = access

506

587

func._dbus_name = func.__name__

507

if func._dbus_name.endswith(u"_dbus_property"):

588

if func._dbus_name.endswith("_dbus_property"):

508

589

func._dbus_name = func._dbus_name[:-14]

509

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

590

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

510

591

return func

511

592

return decorator

512

593

540

621

541

622

@staticmethod

542

623

def _is_dbus_property(obj):

543

return getattr(obj, u"_dbus_is_property", False)

624

return getattr(obj, "_dbus_is_property", False)

544

625

545

626

def _get_all_dbus_properties(self):

546

627

"""Returns a generator of (name, attribute) pairs

554

635

property with the specified name and interface.

555

636

"""

556

637

for name in (property_name,

557

property_name + u"_dbus_property"):

638

property_name + "_dbus_property"):

558

639

prop = getattr(self, name, None)

559

640

if (prop is None

560

641

or not self._is_dbus_property(prop)

564

645

continue

565

646

return prop

566

647

# No such property

567

raise DBusPropertyNotFound(self.dbus_object_path + u":"

568

+ interface_name + u"."

648

raise DBusPropertyNotFound(self.dbus_object_path + ":"

649

+ interface_name + "."

569

650

+ property_name)

570

651

571

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

572

out_signature=u"v")

652

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

653

out_signature="v")

573

654

def Get(self, interface_name, property_name):

574

655

"""Standard D-Bus property Get() method, see D-Bus standard.

575

656

"""

576

657

prop = self._get_dbus_property(interface_name, property_name)

577

if prop._dbus_access == u"write":

658

if prop._dbus_access == "write":

578

659

raise DBusPropertyAccessException(property_name)

579

660

value = prop()

580

if not hasattr(value, u"variant_level"):

661

if not hasattr(value, "variant_level"):

581

662

return value

582

663

return type(value)(value, variant_level=value.variant_level+1)

583

664

584

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

665

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

585

666

def Set(self, interface_name, property_name, value):

586

667

"""Standard D-Bus property Set() method, see D-Bus standard.

587

668

"""

588

669

prop = self._get_dbus_property(interface_name, property_name)

589

if prop._dbus_access == u"read":

670

if prop._dbus_access == "read":

590

671

raise DBusPropertyAccessException(property_name)

591

if prop._dbus_get_args_options[u"byte_arrays"]:

672

if prop._dbus_get_args_options["byte_arrays"]:

673

# The byte_arrays option is not supported yet on

674

# signatures other than "ay".

675

if prop._dbus_signature != "ay":

676

raise ValueError

592

677

value = dbus.ByteArray(''.join(unichr(byte)

593

678

for byte in value))

594

679

prop(value)

595

680

596

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

597

out_signature=u"a{sv}")

681

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

682

out_signature="a{sv}")

598

683

def GetAll(self, interface_name):

599

684

"""Standard D-Bus property GetAll() method, see D-Bus

600

685

standard.

608

693

# Interface non-empty but did not match

609

694

continue

610

695

# Ignore write-only properties

611

if prop._dbus_access == u"write":

696

if prop._dbus_access == "write":

612

697

continue

613

698

value = prop()

614

if not hasattr(value, u"variant_level"):

699

if not hasattr(value, "variant_level"):

615

700

all[name] = value

616

701

continue

617

702

all[name] = type(value)(value, variant_level=

618

703

value.variant_level+1)

619

return dbus.Dictionary(all, signature=u"sv")

704

return dbus.Dictionary(all, signature="sv")

620

705

621

706

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

622

out_signature=u"s",

707

out_signature="s",

623

708

path_keyword='object_path',

624

709

connection_keyword='connection')

625

710

def Introspect(self, object_path, connection):

630

715

try:

631

716

document = xml.dom.minidom.parseString(xmlstring)

632

717

def make_tag(document, name, prop):

633

e = document.createElement(u"property")

634

e.setAttribute(u"name", name)

635

e.setAttribute(u"type", prop._dbus_signature)

636

e.setAttribute(u"access", prop._dbus_access)

718

e = document.createElement("property")

719

e.setAttribute("name", name)

720

e.setAttribute("type", prop._dbus_signature)

721

e.setAttribute("access", prop._dbus_access)

637

722

return e

638

for if_tag in document.getElementsByTagName(u"interface"):

723

for if_tag in document.getElementsByTagName("interface"):

639

724

for tag in (make_tag(document, name, prop)

640

725

for name, prop

641

726

in self._get_all_dbus_properties()

642

727

if prop._dbus_interface

643

== if_tag.getAttribute(u"name")):

728

== if_tag.getAttribute("name")):

644

729

if_tag.appendChild(tag)

645

730

# Add the names to the return values for the

646

731

# "org.freedesktop.DBus.Properties" methods

647

if (if_tag.getAttribute(u"name")

648

== u"org.freedesktop.DBus.Properties"):

649

for cn in if_tag.getElementsByTagName(u"method"):

650

if cn.getAttribute(u"name") == u"Get":

651

for arg in cn.getElementsByTagName(u"arg"):

652

if (arg.getAttribute(u"direction")

653

== u"out"):

654

arg.setAttribute(u"name", u"value")

655

elif cn.getAttribute(u"name") == u"GetAll":

656

for arg in cn.getElementsByTagName(u"arg"):

657

if (arg.getAttribute(u"direction")

658

== u"out"):

659

arg.setAttribute(u"name", u"props")

660

xmlstring = document.toxml(u"utf-8")

732

if (if_tag.getAttribute("name")

733

== "org.freedesktop.DBus.Properties"):

734

for cn in if_tag.getElementsByTagName("method"):

735

if cn.getAttribute("name") == "Get":

736

for arg in cn.getElementsByTagName("arg"):

737

if (arg.getAttribute("direction")

738

== "out"):

739

arg.setAttribute("name", "value")

740

elif cn.getAttribute("name") == "GetAll":

741

for arg in cn.getElementsByTagName("arg"):

742

if (arg.getAttribute("direction")

743

== "out"):

744

arg.setAttribute("name", "props")

745

xmlstring = document.toxml("utf-8")

661

746

document.unlink()

662

747

except (AttributeError, xml.dom.DOMException,

663

xml.parsers.expat.ExpatError), error:

664

logger.error(u"Failed to override Introspection method",

748

xml.parsers.expat.ExpatError) as error:

749

logger.error("Failed to override Introspection method",

665

750

error)

666

751

return xmlstring

667

752

673

758

dbus_object_path: dbus.ObjectPath

674

759

bus: dbus.SystemBus()

675

760

"""

761

762

runtime_expansions = (Client.runtime_expansions

763

+ ("dbus_object_path",))

764

676

765

# dbus.service.Object doesn't use super(), so we can't either.

677

766

678

767

def __init__(self, bus = None, *args, **kwargs):

768

self._approvals_pending = 0

679

769

self.bus = bus

680

770

Client.__init__(self, *args, **kwargs)

681

771

# Only now, when this client is initialized, can it show up on

682

772

# the D-Bus

773

client_object_name = unicode(self.name).translate(

774

{ord("."): ord("_"),

775

ord("-"): ord("_")})

683

776

self.dbus_object_path = (dbus.ObjectPath

684

(u"/clients/"

685

+ self.name.replace(u".", u"_")))

777

("/clients/" + client_object_name))

686

778

DBusObjectWithProperties.__init__(self, self.bus,

687

779

self.dbus_object_path)

780

def _set_expires(self, value):

781

old_value = getattr(self, "_expires", None)

782

self._expires = value

783

if hasattr(self, "dbus_object_path") and old_value != value:

784

dbus_time = (self._datetime_to_dbus(self._expires,

785

variant_level=1))

786

self.PropertyChanged(dbus.String("Expires"),

787

dbus_time)

788

expires = property(lambda self: self._expires, _set_expires)

789

del _set_expires

790

791

def _get_approvals_pending(self):

792

return self._approvals_pending

793

def _set_approvals_pending(self, value):

794

old_value = self._approvals_pending

795

self._approvals_pending = value

796

bval = bool(value)

797

if (hasattr(self, "dbus_object_path")

798

and bval is not bool(old_value)):

799

dbus_bool = dbus.Boolean(bval, variant_level=1)

800

self.PropertyChanged(dbus.String("ApprovalPending"),

801

dbus_bool)

802

803

approvals_pending = property(_get_approvals_pending,

804

_set_approvals_pending)

805

del _get_approvals_pending, _set_approvals_pending

688

806

689

807

@staticmethod

690

808

def _datetime_to_dbus(dt, variant_level=0):

691

809

"""Convert a UTC datetime.datetime() to a D-Bus type."""

810

if dt is None:

811

return dbus.String("", variant_level = variant_level)

692

812

return dbus.String(dt.isoformat(),

693

813

variant_level=variant_level)

694

814

695

815

def enable(self):

696

oldstate = getattr(self, u"enabled", False)

816

oldstate = getattr(self, "enabled", False)

697

817

r = Client.enable(self)

698

818

if oldstate != self.enabled:

699

819

# Emit D-Bus signals

700

self.PropertyChanged(dbus.String(u"enabled"),

820

self.PropertyChanged(dbus.String("Enabled"),

701

821

dbus.Boolean(True, variant_level=1))

702

822

self.PropertyChanged(

703

dbus.String(u"last_enabled"),

823

dbus.String("LastEnabled"),

704

824

self._datetime_to_dbus(self.last_enabled,

705

825

variant_level=1))

706

826

return r

707

827

708

def disable(self, signal = True):

709

oldstate = getattr(self, u"enabled", False)

710

r = Client.disable(self)

711

if signal and oldstate != self.enabled:

828

def disable(self, quiet = False):

829

oldstate = getattr(self, "enabled", False)

830

r = Client.disable(self, quiet=quiet)

831

if not quiet and oldstate != self.enabled:

712

832

# Emit D-Bus signal

713

self.PropertyChanged(dbus.String(u"enabled"),

833

self.PropertyChanged(dbus.String("Enabled"),

714

834

dbus.Boolean(False, variant_level=1))

715

835

return r

716

836

719

839

self.remove_from_connection()

720

840

except LookupError:

721

841

pass

722

if hasattr(DBusObjectWithProperties, u"__del__"):

842

if hasattr(DBusObjectWithProperties, "__del__"):

723

843

DBusObjectWithProperties.__del__(self, *args, **kwargs)

724

844

Client.__del__(self, *args, **kwargs)

725

845

728

848

self.checker_callback_tag = None

729

849

self.checker = None

730

850

# Emit D-Bus signal

731

self.PropertyChanged(dbus.String(u"checker_running"),

851

self.PropertyChanged(dbus.String("CheckerRunning"),

732

852

dbus.Boolean(False, variant_level=1))

733

853

if os.WIFEXITED(condition):

734

854

exitstatus = os.WEXITSTATUS(condition)

746

866

*args, **kwargs)

747

867

748

868

def checked_ok(self, *args, **kwargs):

749

r = Client.checked_ok(self, *args, **kwargs)

869

Client.checked_ok(self, *args, **kwargs)

750

870

# Emit D-Bus signal

751

871

self.PropertyChanged(

752

dbus.String(u"last_checked_ok"),

872

dbus.String("LastCheckedOK"),

753

873

(self._datetime_to_dbus(self.last_checked_ok,

754

874

variant_level=1)))

875

876

def need_approval(self, *args, **kwargs):

877

r = Client.need_approval(self, *args, **kwargs)

878

# Emit D-Bus signal

879

self.PropertyChanged(

880

dbus.String("LastApprovalRequest"),

881

(self._datetime_to_dbus(self.last_approval_request,

882

variant_level=1)))

755

883

return r

756

884

757

885

def start_checker(self, *args, **kwargs):

767

895

# Emit D-Bus signal

768

896

self.CheckerStarted(self.current_checker_command)

769

897

self.PropertyChanged(

770

dbus.String(u"checker_running"),

898

dbus.String("CheckerRunning"),

771

899

dbus.Boolean(True, variant_level=1))

772

900

return r

773

901

774

902

def stop_checker(self, *args, **kwargs):

775

old_checker = getattr(self, u"checker", None)

903

old_checker = getattr(self, "checker", None)

776

904

r = Client.stop_checker(self, *args, **kwargs)

777

905

if (old_checker is not None

778

and getattr(self, u"checker", None) is None):

779

self.PropertyChanged(dbus.String(u"checker_running"),

906

and getattr(self, "checker", None) is None):

907

self.PropertyChanged(dbus.String("CheckerRunning"),

780

908

dbus.Boolean(False, variant_level=1))

781

909

return r

782

783

## D-Bus methods & signals

784

_interface = u"se.bsnet.fukt.Mandos.Client"

785

786

# CheckedOK - method

787

@dbus.service.method(_interface)

788

def CheckedOK(self):

789

return self.checked_ok()

910

911

def _reset_approved(self):

912

self._approved = None

913

return False

914

915

def approve(self, value=True):

916

self.send_changedstate()

917

self._approved = value

918

gobject.timeout_add(self._timedelta_to_milliseconds

919

(self.approval_duration),

920

self._reset_approved)

921

922

923

## D-Bus methods, signals & properties

924

_interface = "se.bsnet.fukt.Mandos.Client"

925

926

## Signals

790

927

791

928

# CheckerCompleted - signal

792

@dbus.service.signal(_interface, signature=u"nxs")

929

@dbus.service.signal(_interface, signature="nxs")

793

930

def CheckerCompleted(self, exitcode, waitstatus, command):

794

931

"D-Bus signal"

795

932

pass

796

933

797

934

# CheckerStarted - signal

798

@dbus.service.signal(_interface, signature=u"s")

935

@dbus.service.signal(_interface, signature="s")

799

936

def CheckerStarted(self, command):

800

937

"D-Bus signal"

801

938

pass

802

939

803

940

# PropertyChanged - signal

804

@dbus.service.signal(_interface, signature=u"sv")

941

@dbus.service.signal(_interface, signature="sv")

805

942

def PropertyChanged(self, property, value):

806

943

"D-Bus signal"

807

944

pass

809

946

# GotSecret - signal

810

947

@dbus.service.signal(_interface)

811

948

def GotSecret(self):

812

"D-Bus signal"

949

"""D-Bus signal

950

Is sent after a successful transfer of secret from the Mandos

951

server to mandos-client

952

"""

813

953

pass

814

954

815

955

# Rejected - signal

816

@dbus.service.signal(_interface)

817

def Rejected(self):

956

@dbus.service.signal(_interface, signature="s")

957

def Rejected(self, reason):

818

958

"D-Bus signal"

819

959

pass

820

960

961

# NeedApproval - signal

962

@dbus.service.signal(_interface, signature="tb")

963

def NeedApproval(self, timeout, default):

964

"D-Bus signal"

965

return self.need_approval()

966

967

## Methods

968

969

# Approve - method

970

@dbus.service.method(_interface, in_signature="b")

971

def Approve(self, value):

972

self.approve(value)

973

974

# CheckedOK - method

975

@dbus.service.method(_interface)

976

def CheckedOK(self):

977

self.checked_ok()

978

821

979

# Enable - method

822

980

@dbus.service.method(_interface)

823

981

def Enable(self):

841

999

def StopChecker(self):

842

1000

self.stop_checker()

843

1001

844

# name - property

845

@dbus_service_property(_interface, signature=u"s", access=u"read")

846

def name_dbus_property(self):

1002

## Properties

1003

1004

# ApprovalPending - property

1005

@dbus_service_property(_interface, signature="b", access="read")

1006

def ApprovalPending_dbus_property(self):

1007

return dbus.Boolean(bool(self.approvals_pending))

1008

1009

# ApprovedByDefault - property

1010

@dbus_service_property(_interface, signature="b",

1011

access="readwrite")

1012

def ApprovedByDefault_dbus_property(self, value=None):

1013

if value is None: # get

1014

return dbus.Boolean(self.approved_by_default)

1015

old_value = self.approved_by_default

1016

self.approved_by_default = bool(value)

1017

# Emit D-Bus signal

1018

if old_value != self.approved_by_default:

1019

self.PropertyChanged(dbus.String("ApprovedByDefault"),

1020

dbus.Boolean(value, variant_level=1))

1021

1022

# ApprovalDelay - property

1023

@dbus_service_property(_interface, signature="t",

1024

access="readwrite")

1025

def ApprovalDelay_dbus_property(self, value=None):

1026

if value is None: # get

1027

return dbus.UInt64(self.approval_delay_milliseconds())

1028

old_value = self.approval_delay

1029

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1030

# Emit D-Bus signal

1031

if old_value != self.approval_delay:

1032

self.PropertyChanged(dbus.String("ApprovalDelay"),

1033

dbus.UInt64(value, variant_level=1))

1034

1035

# ApprovalDuration - property

1036

@dbus_service_property(_interface, signature="t",

1037

access="readwrite")

1038

def ApprovalDuration_dbus_property(self, value=None):

1039

if value is None: # get

1040

return dbus.UInt64(self._timedelta_to_milliseconds(

1041

self.approval_duration))

1042

old_value = self.approval_duration

1043

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1044

# Emit D-Bus signal

1045

if old_value != self.approval_duration:

1046

self.PropertyChanged(dbus.String("ApprovalDuration"),

1047

dbus.UInt64(value, variant_level=1))

1048

1049

# Name - property

1050

@dbus_service_property(_interface, signature="s", access="read")

1051

def Name_dbus_property(self):

847

1052

return dbus.String(self.name)

848

1053

849

# fingerprint - property

850

@dbus_service_property(_interface, signature=u"s", access=u"read")

851

def fingerprint_dbus_property(self):

1054

# Fingerprint - property

1055

@dbus_service_property(_interface, signature="s", access="read")

1056

def Fingerprint_dbus_property(self):

852

1057

return dbus.String(self.fingerprint)

853

1058

854

# host - property

855

@dbus_service_property(_interface, signature=u"s",

856

access=u"readwrite")

857

def host_dbus_property(self, value=None):

1059

# Host - property

1060

@dbus_service_property(_interface, signature="s",

1061

access="readwrite")

1062

def Host_dbus_property(self, value=None):

858

1063

if value is None: # get

859

1064

return dbus.String(self.host)

1065

old_value = self.host

860

1066

self.host = value

861

1067

# Emit D-Bus signal

862

self.PropertyChanged(dbus.String(u"host"),

863

dbus.String(value, variant_level=1))

1068

if old_value != self.host:

1069

self.PropertyChanged(dbus.String("Host"),

1070

dbus.String(value, variant_level=1))

864

1071

865

# created - property

866

@dbus_service_property(_interface, signature=u"s", access=u"read")

867

def created_dbus_property(self):

1072

# Created - property

1073

@dbus_service_property(_interface, signature="s", access="read")

1074

def Created_dbus_property(self):

868

1075

return dbus.String(self._datetime_to_dbus(self.created))

869

1076

870

# last_enabled - property

871

@dbus_service_property(_interface, signature=u"s", access=u"read")

872

def last_enabled_dbus_property(self):

873

if self.last_enabled is None:

874

return dbus.String(u"")

875

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1077

# LastEnabled - property

1078

@dbus_service_property(_interface, signature="s", access="read")

1079

def LastEnabled_dbus_property(self):

1080

return self._datetime_to_dbus(self.last_enabled)

876

1081

877

# enabled - property

878

@dbus_service_property(_interface, signature=u"b",

879

access=u"readwrite")

880

def enabled_dbus_property(self, value=None):

1082

# Enabled - property

1083

@dbus_service_property(_interface, signature="b",

1084

access="readwrite")

1085

def Enabled_dbus_property(self, value=None):

881

1086

if value is None: # get

882

1087

return dbus.Boolean(self.enabled)

883

1088

if value:

885

1090

else:

886

1091

self.disable()

887

1092

888

# last_checked_ok - property

889

@dbus_service_property(_interface, signature=u"s",

890

access=u"readwrite")

891

def last_checked_ok_dbus_property(self, value=None):

1093

# LastCheckedOK - property

1094

@dbus_service_property(_interface, signature="s",

1095

access="readwrite")

1096

def LastCheckedOK_dbus_property(self, value=None):

892

1097

if value is not None:

893

1098

self.checked_ok()

894

1099

return

895

if self.last_checked_ok is None:

896

return dbus.String(u"")

897

return dbus.String(self._datetime_to_dbus(self

898

.last_checked_ok))

899

900

# timeout - property

901

@dbus_service_property(_interface, signature=u"t",

902

access=u"readwrite")

903

def timeout_dbus_property(self, value=None):

1100

return self._datetime_to_dbus(self.last_checked_ok)

1101

1102

# Expires - property

1103

@dbus_service_property(_interface, signature="s", access="read")

1104

def Expires_dbus_property(self):

1105

return self._datetime_to_dbus(self.expires)

1106

1107

# LastApprovalRequest - property

1108

@dbus_service_property(_interface, signature="s", access="read")

1109

def LastApprovalRequest_dbus_property(self):

1110

return self._datetime_to_dbus(self.last_approval_request)

1111

1112

# Timeout - property

1113

@dbus_service_property(_interface, signature="t",

1114

access="readwrite")

1115

def Timeout_dbus_property(self, value=None):

904

1116

if value is None: # get

905

1117

return dbus.UInt64(self.timeout_milliseconds())

1118

old_value = self.timeout

906

1119

self.timeout = datetime.timedelta(0, 0, 0, value)

907

1120

# Emit D-Bus signal

908

self.PropertyChanged(dbus.String(u"timeout"),

909

dbus.UInt64(value, variant_level=1))

910

if getattr(self, u"disable_initiator_tag", None) is None:

1121

if old_value != self.timeout:

1122

self.PropertyChanged(dbus.String("Timeout"),

1123

dbus.UInt64(value, variant_level=1))

1124

if getattr(self, "disable_initiator_tag", None) is None:

911

1125

return

912

1126

# Reschedule timeout

913

1127

gobject.source_remove(self.disable_initiator_tag)

914

1128

self.disable_initiator_tag = None

1129

self.expires = None

915

1130

time_to_die = (self.

916

1131

_timedelta_to_milliseconds((self

917

1132

.last_checked_ok

922

1137

# The timeout has passed

923

1138

self.disable()

924

1139

else:

1140

self.expires = (datetime.datetime.utcnow()

1141

+ datetime.timedelta(milliseconds = time_to_die))

925

1142

self.disable_initiator_tag = (gobject.timeout_add

926

1143

(time_to_die, self.disable))

927

928

# interval - property

929

@dbus_service_property(_interface, signature=u"t",

930

access=u"readwrite")

931

def interval_dbus_property(self, value=None):

1144

1145

# ExtendedTimeout - property

1146

@dbus_service_property(_interface, signature="t",

1147

access="readwrite")

1148

def ExtendedTimeout_dbus_property(self, value=None):

1149

if value is None: # get

1150

return dbus.UInt64(self.extended_timeout_milliseconds())

1151

old_value = self.extended_timeout

1152

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1153

# Emit D-Bus signal

1154

if old_value != self.extended_timeout:

1155

self.PropertyChanged(dbus.String("ExtendedTimeout"),

1156

dbus.UInt64(value, variant_level=1))

1157

1158

# Interval - property

1159

@dbus_service_property(_interface, signature="t",

1160

access="readwrite")

1161

def Interval_dbus_property(self, value=None):

932

1162

if value is None: # get

933

1163

return dbus.UInt64(self.interval_milliseconds())

1164

old_value = self.interval

934

1165

self.interval = datetime.timedelta(0, 0, 0, value)

935

1166

# Emit D-Bus signal

936

self.PropertyChanged(dbus.String(u"interval"),

937

dbus.UInt64(value, variant_level=1))

938

if getattr(self, u"checker_initiator_tag", None) is None:

1167

if old_value != self.interval:

1168

self.PropertyChanged(dbus.String("Interval"),

1169

dbus.UInt64(value, variant_level=1))

1170

if getattr(self, "checker_initiator_tag", None) is None:

939

1171

return

940

1172

# Reschedule checker run

941

1173

gobject.source_remove(self.checker_initiator_tag)

943

1175

(value, self.start_checker))

944

1176

self.start_checker() # Start one now, too

945

1177

946

# checker - property

947

@dbus_service_property(_interface, signature=u"s",

948

access=u"readwrite")

949

def checker_dbus_property(self, value=None):

1178

# Checker - property

1179

@dbus_service_property(_interface, signature="s",

1180

access="readwrite")

1181

def Checker_dbus_property(self, value=None):

950

1182

if value is None: # get

951

1183

return dbus.String(self.checker_command)

1184

old_value = self.checker_command

952

1185

self.checker_command = value

953

1186

# Emit D-Bus signal

954

self.PropertyChanged(dbus.String(u"checker"),

955

dbus.String(self.checker_command,

956

variant_level=1))

1187

if old_value != self.checker_command:

1188

self.PropertyChanged(dbus.String("Checker"),

1189

dbus.String(self.checker_command,

1190

variant_level=1))

957

1191

958

# checker_running - property

959

@dbus_service_property(_interface, signature=u"b",

960

access=u"readwrite")

961

def checker_running_dbus_property(self, value=None):

1192

# CheckerRunning - property

1193

@dbus_service_property(_interface, signature="b",

1194

access="readwrite")

1195

def CheckerRunning_dbus_property(self, value=None):

962

1196

if value is None: # get

963

1197

return dbus.Boolean(self.checker is not None)

964

1198

if value:

966

1200

else:

967

1201

self.stop_checker()

968

1202

969

# object_path - property

970

@dbus_service_property(_interface, signature=u"o", access=u"read")

971

def object_path_dbus_property(self):

1203

# ObjectPath - property

1204

@dbus_service_property(_interface, signature="o", access="read")

1205

def ObjectPath_dbus_property(self):

972

1206

return self.dbus_object_path # is already a dbus.ObjectPath

973

1207

974

# secret = property

975

@dbus_service_property(_interface, signature=u"ay",

976

access=u"write", byte_arrays=True)

977

def secret_dbus_property(self, value):

1208

# Secret = property

1209

@dbus_service_property(_interface, signature="ay",

1210

access="write", byte_arrays=True)

1211

def Secret_dbus_property(self, value):

978

1212

self.secret = str(value)

979

1213

980

1214

del _interface

981

1215

982

1216

1217

class ProxyClient(object):

1218

def __init__(self, child_pipe, fpr, address):

1219

self._pipe = child_pipe

1220

self._pipe.send(('init', fpr, address))

1221

if not self._pipe.recv():

1222

raise KeyError()

1223

1224

def __getattribute__(self, name):

1225

if(name == '_pipe'):

1226

return super(ProxyClient, self).__getattribute__(name)

1227

self._pipe.send(('getattr', name))

1228

data = self._pipe.recv()

1229

if data[0] == 'data':

1230

return data[1]

1231

if data[0] == 'function':

1232

def func(*args, **kwargs):

1233

self._pipe.send(('funcall', name, args, kwargs))

1234

return self._pipe.recv()[1]

1235

return func

1236

1237

def __setattr__(self, name, value):

1238

if(name == '_pipe'):

1239

return super(ProxyClient, self).__setattr__(name, value)

1240

self._pipe.send(('setattr', name, value))

1241

1242

983

1243

class ClientHandler(socketserver.BaseRequestHandler, object):

984

1244

"""A class to handle client connections.

985

1245

987

1247

Note: This will run in its own forked process."""

988

1248

989

1249

def handle(self):

990

logger.info(u"TCP connection from: %s",

991

unicode(self.client_address))

992

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

993

# Open IPC pipe to parent process

994

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

1250

with contextlib.closing(self.server.child_pipe) as child_pipe:

1251

logger.info("TCP connection from: %s",

1252

unicode(self.client_address))

1253

logger.debug("Pipe FD: %d",

1254

self.server.child_pipe.fileno())

1255

995

1256

session = (gnutls.connection

996

1257

.ClientSession(self.request,

997

1258

gnutls.connection

998

1259

.X509Credentials()))

999

1000

line = self.request.makefile().readline()

1001

logger.debug(u"Protocol version: %r", line)

1002

try:

1003

if int(line.strip().split()[0]) > 1:

1004

raise RuntimeError

1005

except (ValueError, IndexError, RuntimeError), error:

1006

logger.error(u"Unknown protocol version: %s", error)

1007

return

1008

1260

1009

1261

# Note: gnutls.connection.X509Credentials is really a

1010

1262

# generic GnuTLS certificate credentials object so long as

1011

1263

# no X.509 keys are added to it. Therefore, we can use it

1012

1264

# here despite using OpenPGP certificates.

1013

1014

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1015

# u"+AES-256-CBC", u"+SHA1",

1016

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1017

# u"+DHE-DSS"))

1265

1266

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1267

# "+AES-256-CBC", "+SHA1",

1268

# "+COMP-NULL", "+CTYPE-OPENPGP",

1269

# "+DHE-DSS"))

1018

1270

# Use a fallback default, since this MUST be set.

1019

1271

priority = self.server.gnutls_priority

1020

1272

if priority is None:

1021

priority = u"NORMAL"

1273

priority = "NORMAL"

1022

1274

(gnutls.library.functions

1023

1275

.gnutls_priority_set_direct(session._c_object,

1024

1276

priority, None))

1025

1277

1278

# Start communication using the Mandos protocol

1279

# Get protocol number

1280

line = self.request.makefile().readline()

1281

logger.debug("Protocol version: %r", line)

1282

try:

1283

if int(line.strip().split()[0]) > 1:

1284

raise RuntimeError

1285

except (ValueError, IndexError, RuntimeError) as error:

1286

logger.error("Unknown protocol version: %s", error)

1287

return

1288

1289

# Start GnuTLS connection

1026

1290

try:

1027

1291

session.handshake()

1028

except gnutls.errors.GNUTLSError, error:

1029

logger.warning(u"Handshake failed: %s", error)

1292

except gnutls.errors.GNUTLSError as error:

1293

logger.warning("Handshake failed: %s", error)

1030

1294

# Do not run session.bye() here: the session is not

1031

1295

# established. Just abandon the request.

1032

1296

return

1033

logger.debug(u"Handshake succeeded")

1297

logger.debug("Handshake succeeded")

1298

1299

approval_required = False

1034

1300

try:

1035

fpr = self.fingerprint(self.peer_certificate(session))

1036

except (TypeError, gnutls.errors.GNUTLSError), error:

1037

logger.warning(u"Bad certificate: %s", error)

1038

session.bye()

1039

return

1040

logger.debug(u"Fingerprint: %s", fpr)

1301

try:

1302

fpr = self.fingerprint(self.peer_certificate

1303

(session))

1304

except (TypeError,

1305

gnutls.errors.GNUTLSError) as error:

1306

logger.warning("Bad certificate: %s", error)

1307

return

1308

logger.debug("Fingerprint: %s", fpr)

1309

1310

try:

1311

client = ProxyClient(child_pipe, fpr,

1312

self.client_address)

1313

except KeyError:

1314

return

1315

1316

if client.approval_delay:

1317

delay = client.approval_delay

1318

client.approvals_pending += 1

1319

approval_required = True

1320

1321

while True:

1322

if not client.enabled:

1323

logger.info("Client %s is disabled",

1324

client.name)

1325

if self.server.use_dbus:

1326

# Emit D-Bus signal

1327

client.Rejected("Disabled")

1328

return

1329

1330

if client._approved or not client.approval_delay:

1331

#We are approved or approval is disabled

1332

break

1333

elif client._approved is None:

1334

logger.info("Client %s needs approval",

1335

client.name)

1336

if self.server.use_dbus:

1337

# Emit D-Bus signal

1338

client.NeedApproval(

1339

client.approval_delay_milliseconds(),

1340

client.approved_by_default)

1341

else:

1342

logger.warning("Client %s was not approved",

1343

client.name)

1344

if self.server.use_dbus:

1345

# Emit D-Bus signal

1346

client.Rejected("Denied")

1347

return

1348

1349

#wait until timeout or approved

1350

#x = float(client._timedelta_to_milliseconds(delay))

1351

time = datetime.datetime.now()

1352

client.changedstate.acquire()

1353

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1354

client.changedstate.release()

1355

time2 = datetime.datetime.now()

1356

if (time2 - time) >= delay:

1357

if not client.approved_by_default:

1358

logger.warning("Client %s timed out while"

1359

" waiting for approval",

1360

client.name)

1361

if self.server.use_dbus:

1362

# Emit D-Bus signal

1363

client.Rejected("Approval timed out")

1364

return

1365

else:

1366

break

1367

else:

1368

delay -= time2 - time

1369

1370

sent_size = 0

1371

while sent_size < len(client.secret):

1372

try:

1373

sent = session.send(client.secret[sent_size:])

1374

except gnutls.errors.GNUTLSError as error:

1375

logger.warning("gnutls send failed")

1376

return

1377

logger.debug("Sent: %d, remaining: %d",

1378

sent, len(client.secret)

1379

- (sent_size + sent))

1380

sent_size += sent

1381

1382

logger.info("Sending secret to %s", client.name)

1383

# bump the timeout as if seen

1384

client.checked_ok(client.extended_timeout)

1385

if self.server.use_dbus:

1386

# Emit D-Bus signal

1387

client.GotSecret()

1041

1388

1042

for c in self.server.clients:

1043

if c.fingerprint == fpr:

1044

client = c

1045

break

1046

else:

1047

ipc.write(u"NOTFOUND %s %s\n"

1048

% (fpr, unicode(self.client_address)))

1049

session.bye()

1050

return

1051

# Have to check if client.still_valid(), since it is

1052

# possible that the client timed out while establishing

1053

# the GnuTLS session.

1054

if not client.still_valid():

1055

ipc.write(u"INVALID %s\n" % client.name)

1056

session.bye()

1057

return

1058

ipc.write(u"SENDING %s\n" % client.name)

1059

sent_size = 0

1060

while sent_size < len(client.secret):

1061

sent = session.send(client.secret[sent_size:])

1062

logger.debug(u"Sent: %d, remaining: %d",

1063

sent, len(client.secret)

1064

- (sent_size + sent))

1065

sent_size += sent

1066

session.bye()

1389

finally:

1390

if approval_required:

1391

client.approvals_pending -= 1

1392

try:

1393

session.bye()

1394

except gnutls.errors.GNUTLSError as error:

1395

logger.warning("GnuTLS bye failed")

1067

1396

1068

1397

@staticmethod

1069

1398

def peer_certificate(session):

1079

1408

.gnutls_certificate_get_peers

1080

1409

(session._c_object, ctypes.byref(list_size)))

1081

1410

if not bool(cert_list) and list_size.value != 0:

1082

raise gnutls.errors.GNUTLSError(u"error getting peer"

1083

u" certificate")

1411

raise gnutls.errors.GNUTLSError("error getting peer"

1412

" certificate")

1084

1413

if list_size.value == 0:

1085

1414

return None

1086

1415

cert = cert_list[0]

1112

1441

if crtverify.value != 0:

1113

1442

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1114

1443

raise (gnutls.errors.CertificateSecurityError

1115

(u"Verify failed"))

1444

("Verify failed"))

1116

1445

# New buffer for the fingerprint

1117

1446

buf = ctypes.create_string_buffer(20)

1118

1447

buf_len = ctypes.c_size_t()

1125

1454

# Convert the buffer to a Python bytestring

1126

1455

fpr = ctypes.string_at(buf, buf_len.value)

1127

1456

# Convert the bytestring to hexadecimal notation

1128

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1457

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1129

1458

return hex_fpr

1130

1459

1131

1460

1132

class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):

1133

"""Like socketserver.ForkingMixIn, but also pass a pipe."""

1461

class MultiprocessingMixIn(object):

1462

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1463

def sub_process_main(self, request, address):

1464

try:

1465

self.finish_request(request, address)

1466

except:

1467

self.handle_error(request, address)

1468

self.close_request(request)

1469

1470

def process_request(self, request, address):

1471

"""Start a new process to process the request."""

1472

multiprocessing.Process(target = self.sub_process_main,

1473

args = (request, address)).start()

1474

1475

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1476

""" adds a pipe to the MixIn """

1134

1477

def process_request(self, request, client_address):

1135

1478

"""Overrides and wraps the original process_request().

1136

1479

1137

1480

This function creates a new pipe in self.pipe

1138

1481

"""

1139

self.pipe = os.pipe()

1140

super(ForkingMixInWithPipe,

1482

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1483

1484

super(MultiprocessingMixInWithPipe,

1141

1485

self).process_request(request, client_address)

1142

os.close(self.pipe[1]) # close write end

1143

self.add_pipe(self.pipe[0])

1144

def add_pipe(self, pipe):

1486

self.child_pipe.close()

1487

self.add_pipe(parent_pipe)

1488

1489

def add_pipe(self, parent_pipe):

1145

1490

"""Dummy function; override as necessary"""

1146

os.close(pipe)

1147

1148

1149

class IPv6_TCPServer(ForkingMixInWithPipe,

1491

raise NotImplementedError

1492

1493

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1150

1494

socketserver.TCPServer, object):

1151

1495

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1152

1496

1168

1512

bind to an address or port if they were not specified."""

1169

1513

if self.interface is not None:

1170

1514

if SO_BINDTODEVICE is None:

1171

logger.error(u"SO_BINDTODEVICE does not exist;"

1172

u" cannot bind to interface %s",

1515

logger.error("SO_BINDTODEVICE does not exist;"

1516

" cannot bind to interface %s",

1173

1517

self.interface)

1174

1518

else:

1175

1519

try:

1176

1520

self.socket.setsockopt(socket.SOL_SOCKET,

1177

1521

SO_BINDTODEVICE,

1178

1522

str(self.interface

1179

+ u'\0'))

1180

except socket.error, error:

1523

+ '\0'))

1524

except socket.error as error:

1181

1525

if error[0] == errno.EPERM:

1182

logger.error(u"No permission to"

1183

u" bind to interface %s",

1526

logger.error("No permission to"

1527

" bind to interface %s",

1184

1528

self.interface)

1185

1529

elif error[0] == errno.ENOPROTOOPT:

1186

logger.error(u"SO_BINDTODEVICE not available;"

1187

u" cannot bind to interface %s",

1530

logger.error("SO_BINDTODEVICE not available;"

1531

" cannot bind to interface %s",

1188

1532

self.interface)

1189

1533

else:

1190

1534

raise

1192

1536

if self.server_address[0] or self.server_address[1]:

1193

1537

if not self.server_address[0]:

1194

1538

if self.address_family == socket.AF_INET6:

1195

any_address = u"::" # in6addr_any

1539

any_address = "::" # in6addr_any

1196

1540

else:

1197

1541

any_address = socket.INADDR_ANY

1198

1542

self.server_address = (any_address,

1237

1581

return socketserver.TCPServer.server_activate(self)

1238

1582

def enable(self):

1239

1583

self.enabled = True

1240

def add_pipe(self, pipe):

1584

def add_pipe(self, parent_pipe):

1241

1585

# Call "handle_ipc" for both data and EOF events

1242

gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,

1243

self.handle_ipc)

1244

def handle_ipc(self, source, condition, file_objects={}):

1586

gobject.io_add_watch(parent_pipe.fileno(),

1587

gobject.IO_IN | gobject.IO_HUP,

1588

functools.partial(self.handle_ipc,

1589

parent_pipe = parent_pipe))

1590

1591

def handle_ipc(self, source, condition, parent_pipe=None,

1592

client_object=None):

1245

1593

condition_names = {

1246

gobject.IO_IN: u"IN", # There is data to read.

1247

gobject.IO_OUT: u"OUT", # Data can be written (without

1594

gobject.IO_IN: "IN", # There is data to read.

1595

gobject.IO_OUT: "OUT", # Data can be written (without

1248

1596

# blocking).

1249

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1250

gobject.IO_ERR: u"ERR", # Error condition.

1251

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1597

gobject.IO_PRI: "PRI", # There is urgent data to read.

1598

gobject.IO_ERR: "ERR", # Error condition.

1599

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1252

1600

# broken, usually for pipes and

1253

1601

# sockets).

1254

1602

}

1256

1604

for cond, name in

1257

1605

condition_names.iteritems()

1258

1606

if cond & condition)

1259

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1260

conditions_string)

1261

1262

# Turn the pipe file descriptor into a Python file object

1263

if source not in file_objects:

1264

file_objects[source] = os.fdopen(source, u"r", 1)

1265

1266

# Read a line from the file object

1267

cmdline = file_objects[source].readline()

1268

if not cmdline: # Empty line means end of file

1269

# close the IPC pipe

1270

file_objects[source].close()

1271

del file_objects[source]

1272

1273

# Stop calling this function

1274

return False

1275

1276

logger.debug(u"IPC command: %r", cmdline)

1277

1278

# Parse and act on command

1279

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1280

1281

if cmd == u"NOTFOUND":

1282

logger.warning(u"Client not found for fingerprint: %s",

1283

args)

1284

if self.use_dbus:

1285

# Emit D-Bus signal

1286

mandos_dbus_service.ClientNotFound(args)

1287

elif cmd == u"INVALID":

1288

for client in self.clients:

1289

if client.name == args:

1290

logger.warning(u"Client %s is invalid", args)

1291

if self.use_dbus:

1292

# Emit D-Bus signal

1293

client.Rejected()

1294

break

1295

else:

1296

logger.error(u"Unknown client %s is invalid", args)

1297

elif cmd == u"SENDING":

1298

for client in self.clients:

1299

if client.name == args:

1300

logger.info(u"Sending secret to %s", client.name)

1301

client.checked_ok()

1302

if self.use_dbus:

1303

# Emit D-Bus signal

1304

client.GotSecret()

1305

break

1306

else:

1307

logger.error(u"Sending secret to unknown client %s",

1308

args)

1309

else:

1310

logger.error(u"Unknown IPC command: %r", cmdline)

1311

1312

# Keep calling this function

1607

# error or the other end of multiprocessing.Pipe has closed

1608

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1609

return False

1610

1611

# Read a request from the child

1612

request = parent_pipe.recv()

1613

command = request[0]

1614

1615

if command == 'init':

1616

fpr = request[1]

1617

address = request[2]

1618

1619

for c in self.clients:

1620

if c.fingerprint == fpr:

1621

client = c

1622

break

1623

else:

1624

logger.info("Client not found for fingerprint: %s, ad"

1625

"dress: %s", fpr, address)

1626

if self.use_dbus:

1627

# Emit D-Bus signal

1628

mandos_dbus_service.ClientNotFound(fpr, address[0])

1629

parent_pipe.send(False)

1630

return False

1631

1632

gobject.io_add_watch(parent_pipe.fileno(),

1633

gobject.IO_IN | gobject.IO_HUP,

1634

functools.partial(self.handle_ipc,

1635

parent_pipe = parent_pipe,

1636

client_object = client))

1637

parent_pipe.send(True)

1638

# remove the old hook in favor of the new above hook on same fileno

1639

return False

1640

if command == 'funcall':

1641

funcname = request[1]

1642

args = request[2]

1643

kwargs = request[3]

1644

1645

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1646

1647

if command == 'getattr':

1648

attrname = request[1]

1649

if callable(client_object.__getattribute__(attrname)):

1650

parent_pipe.send(('function',))

1651

else:

1652

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1653

1654

if command == 'setattr':

1655

attrname = request[1]

1656

value = request[2]

1657

setattr(client_object, attrname, value)

1658

1313

1659

return True

1314

1660

1315

1661

1316

1662

def string_to_delta(interval):

1317

1663

"""Parse a string and return a datetime.timedelta

1318

1664

1319

>>> string_to_delta(u'7d')

1665

>>> string_to_delta('7d')

1320

1666

datetime.timedelta(7)

1321

>>> string_to_delta(u'60s')

1667

>>> string_to_delta('60s')

1322

1668

datetime.timedelta(0, 60)

1323

>>> string_to_delta(u'60m')

1669

>>> string_to_delta('60m')

1324

1670

datetime.timedelta(0, 3600)

1325

>>> string_to_delta(u'24h')

1671

>>> string_to_delta('24h')

1326

1672

datetime.timedelta(1)

1327

>>> string_to_delta(u'1w')

1673

>>> string_to_delta('1w')

1328

1674

datetime.timedelta(7)

1329

>>> string_to_delta(u'5m 30s')

1675

>>> string_to_delta('5m 30s')

1330

1676

datetime.timedelta(0, 330)

1331

1677

"""

1332

1678

timevalue = datetime.timedelta(0)

1334

1680

try:

1335

1681

suffix = unicode(s[-1])

1336

1682

value = int(s[:-1])

1337

if suffix == u"d":

1683

if suffix == "d":

1338

1684

delta = datetime.timedelta(value)

1339

elif suffix == u"s":

1685

elif suffix == "s":

1340

1686

delta = datetime.timedelta(0, value)

1341

elif suffix == u"m":

1687

elif suffix == "m":

1342

1688

delta = datetime.timedelta(0, 0, 0, 0, value)

1343

elif suffix == u"h":

1689

elif suffix == "h":

1344

1690

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1345

elif suffix == u"w":

1691

elif suffix == "w":

1346

1692

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1347

1693

else:

1348

raise ValueError

1349

except (ValueError, IndexError):

1350

raise ValueError

1694

raise ValueError("Unknown suffix %r" % suffix)

1695

except (ValueError, IndexError) as e:

1696

raise ValueError(*(e.args))

1351

1697

timevalue += delta

1352

1698

return timevalue

1353

1699

1359

1705

global if_nametoindex

1360

1706

try:

1361

1707

if_nametoindex = (ctypes.cdll.LoadLibrary

1362

(ctypes.util.find_library(u"c"))

1708

(ctypes.util.find_library("c"))

1363

1709

.if_nametoindex)

1364

1710

except (OSError, AttributeError):

1365

logger.warning(u"Doing if_nametoindex the hard way")

1711

logger.warning("Doing if_nametoindex the hard way")

1366

1712

def if_nametoindex(interface):

1367

1713

"Get an interface index the hard way, i.e. using fcntl()"

1368

1714

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1369

with closing(socket.socket()) as s:

1715

with contextlib.closing(socket.socket()) as s:

1370

1716

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1371

struct.pack(str(u"16s16x"),

1717

struct.pack(str("16s16x"),

1372

1718

interface))

1373

interface_index = struct.unpack(str(u"I"),

1719

interface_index = struct.unpack(str("I"),

1374

1720

ifreq[16:20])[0]

1375

1721

return interface_index

1376

1722

return if_nametoindex(interface)

1384

1730

sys.exit()

1385

1731

os.setsid()

1386

1732

if not nochdir:

1387

os.chdir(u"/")

1733

os.chdir("/")

1388

1734

if os.fork():

1389

1735

sys.exit()

1390

1736

if not noclose:

1392

1738

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1393

1739

if not stat.S_ISCHR(os.fstat(null).st_mode):

1394

1740

raise OSError(errno.ENODEV,

1395

u"%s not a character device"

1741

"%s not a character device"

1396

1742

% os.path.devnull)

1397

1743

os.dup2(null, sys.stdin.fileno())

1398

1744

os.dup2(null, sys.stdout.fileno())

1406

1752

##################################################################

1407

1753

# Parsing of options, both command line and config file

1408

1754

1409

parser = optparse.OptionParser(version = "%%prog %s" % version)

1410

parser.add_option("-i", u"--interface", type=u"string",

1411

metavar="IF", help=u"Bind to interface IF")

1412

parser.add_option("-a", u"--address", type=u"string",

1413

help=u"Address to listen for requests on")

1414

parser.add_option("-p", u"--port", type=u"int",

1415

help=u"Port number to receive requests on")

1416

parser.add_option("--check", action=u"store_true",

1417

help=u"Run self-test")

1418

parser.add_option("--debug", action=u"store_true",

1419

help=u"Debug mode; run in foreground and log to"

1420

u" terminal")

1421

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1422

u" priority string (see GnuTLS documentation)")

1423

parser.add_option("--servicename", type=u"string",

1424

metavar=u"NAME", help=u"Zeroconf service name")

1425

parser.add_option("--configdir", type=u"string",

1426

default=u"/etc/mandos", metavar=u"DIR",

1427

help=u"Directory to search for configuration"

1428

u" files")

1429

parser.add_option("--no-dbus", action=u"store_false",

1430

dest=u"use_dbus", help=u"Do not provide D-Bus"

1431

u" system bus interface")

1432

parser.add_option("--no-ipv6", action=u"store_false",

1433

dest=u"use_ipv6", help=u"Do not use IPv6")

1434

options = parser.parse_args()[0]

1755

parser = argparse.ArgumentParser()

1756

parser.add_argument("-v", "--version", action="version",

1757

version = "%%(prog)s %s" % version,

1758

help="show version number and exit")

1759

parser.add_argument("-i", "--interface", metavar="IF",

1760

help="Bind to interface IF")

1761

parser.add_argument("-a", "--address",

1762

help="Address to listen for requests on")

1763

parser.add_argument("-p", "--port", type=int,

1764

help="Port number to receive requests on")

1765

parser.add_argument("--check", action="store_true",

1766

help="Run self-test")

1767

parser.add_argument("--debug", action="store_true",

1768

help="Debug mode; run in foreground and log"

1769

" to terminal")

1770

parser.add_argument("--debuglevel", metavar="LEVEL",

1771

help="Debug level for stdout output")

1772

parser.add_argument("--priority", help="GnuTLS"

1773

" priority string (see GnuTLS documentation)")

1774

parser.add_argument("--servicename",

1775

metavar="NAME", help="Zeroconf service name")

1776

parser.add_argument("--configdir",

1777

default="/etc/mandos", metavar="DIR",

1778

help="Directory to search for configuration"

1779

" files")

1780

parser.add_argument("--no-dbus", action="store_false",

1781

dest="use_dbus", help="Do not provide D-Bus"

1782

" system bus interface")

1783

parser.add_argument("--no-ipv6", action="store_false",

1784

dest="use_ipv6", help="Do not use IPv6")

1785

options = parser.parse_args()

1435

1786

1436

1787

if options.check:

1437

1788

import doctest

1439

1790

sys.exit()

1440

1791

1441

1792

# Default values for config file for server-global settings

1442

server_defaults = { u"interface": u"",

1443

u"address": u"",

1444

u"port": u"",

1445

u"debug": u"False",

1446

u"priority":

1447

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1448

u"servicename": u"Mandos",

1449

u"use_dbus": u"True",

1450

u"use_ipv6": u"True",

1793

server_defaults = { "interface": "",

1794

"address": "",

1795

"port": "",

1796

"debug": "False",

1797

"priority":

1798

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1799

"servicename": "Mandos",

1800

"use_dbus": "True",

1801

"use_ipv6": "True",

1802

"debuglevel": "",

1451

1803

}

1452

1804

1453

1805

# Parse config file for server-global settings

1454

1806

server_config = configparser.SafeConfigParser(server_defaults)

1455

1807

del server_defaults

1456

1808

server_config.read(os.path.join(options.configdir,

1457

u"mandos.conf"))

1809

"mandos.conf"))

1458

1810

# Convert the SafeConfigParser object to a dict

1459

1811

server_settings = server_config.defaults()

1460

1812

# Use the appropriate methods on the non-string config options

1461

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1462

server_settings[option] = server_config.getboolean(u"DEFAULT",

1813

for option in ("debug", "use_dbus", "use_ipv6"):

1814

server_settings[option] = server_config.getboolean("DEFAULT",

1463

1815

option)

1464

1816

if server_settings["port"]:

1465

server_settings["port"] = server_config.getint(u"DEFAULT",

1466

u"port")

1817

server_settings["port"] = server_config.getint("DEFAULT",

1818

"port")

1467

1819

del server_config

1468

1820

1469

1821

# Override the settings from the config file with command line

1470

1822

# options, if set.

1471

for option in (u"interface", u"address", u"port", u"debug",

1472

u"priority", u"servicename", u"configdir",

1473

u"use_dbus", u"use_ipv6"):

1823

for option in ("interface", "address", "port", "debug",

1824

"priority", "servicename", "configdir",

1825

"use_dbus", "use_ipv6", "debuglevel"):

1474

1826

value = getattr(options, option)

1475

1827

if value is not None:

1476

1828

server_settings[option] = value

1484

1836

##################################################################

1485

1837

1486

1838

# For convenience

1487

debug = server_settings[u"debug"]

1488

use_dbus = server_settings[u"use_dbus"]

1489

use_ipv6 = server_settings[u"use_ipv6"]

1490

1491

if not debug:

1492

syslogger.setLevel(logging.WARNING)

1493

console.setLevel(logging.WARNING)

1494

1495

if server_settings[u"servicename"] != u"Mandos":

1839

debug = server_settings["debug"]

1840

debuglevel = server_settings["debuglevel"]

1841

use_dbus = server_settings["use_dbus"]

1842

use_ipv6 = server_settings["use_ipv6"]

1843

1844

if server_settings["servicename"] != "Mandos":

1496

1845

syslogger.setFormatter(logging.Formatter

1497

(u'Mandos (%s) [%%(process)d]:'

1498

u' %%(levelname)s: %%(message)s'

1499

% server_settings[u"servicename"]))

1846

('Mandos (%s) [%%(process)d]:'

1847

' %%(levelname)s: %%(message)s'

1848

% server_settings["servicename"]))

1500

1849

1501

1850

# Parse config file with clients

1502

client_defaults = { u"timeout": u"1h",

1503

u"interval": u"5m",

1504

u"checker": u"fping -q -- %%(host)s",

1505

u"host": u"",

1851

client_defaults = { "timeout": "5m",

1852

"extended_timeout": "15m",

1853

"interval": "2m",

1854

"checker": "fping -q -- %%(host)s",

1855

"host": "",

1856

"approval_delay": "0s",

1857

"approval_duration": "1s",

1506

1858

}

1507

1859

client_config = configparser.SafeConfigParser(client_defaults)

1508

client_config.read(os.path.join(server_settings[u"configdir"],

1509

u"clients.conf"))

1860

client_config.read(os.path.join(server_settings["configdir"],

1861

"clients.conf"))

1510

1862

1511

1863

global mandos_dbus_service

1512

1864

mandos_dbus_service = None

1513

1865

1514

tcp_server = MandosServer((server_settings[u"address"],

1515

server_settings[u"port"]),

1866

tcp_server = MandosServer((server_settings["address"],

1867

server_settings["port"]),

1516

1868

ClientHandler,

1517

interface=server_settings[u"interface"],

1869

interface=(server_settings["interface"]

1870

or None),

1518

1871

use_ipv6=use_ipv6,

1519

1872

gnutls_priority=

1520

server_settings[u"priority"],

1873

server_settings["priority"],

1521

1874

use_dbus=use_dbus)

1522

pidfilename = u"/var/run/mandos.pid"

1523

try:

1524

pidfile = open(pidfilename, u"w")

1525

except IOError:

1526

logger.error(u"Could not open file %r", pidfilename)

1875

if not debug:

1876

pidfilename = "/var/run/mandos.pid"

1877

try:

1878

pidfile = open(pidfilename, "w")

1879

except IOError:

1880

logger.error("Could not open file %r", pidfilename)

1527

1881

1528

1882

try:

1529

uid = pwd.getpwnam(u"_mandos").pw_uid

1530

gid = pwd.getpwnam(u"_mandos").pw_gid

1883

uid = pwd.getpwnam("_mandos").pw_uid

1884

gid = pwd.getpwnam("_mandos").pw_gid

1531

1885

except KeyError:

1532

1886

try:

1533

uid = pwd.getpwnam(u"mandos").pw_uid

1534

gid = pwd.getpwnam(u"mandos").pw_gid

1887

uid = pwd.getpwnam("mandos").pw_uid

1888

gid = pwd.getpwnam("mandos").pw_gid

1535

1889

except KeyError:

1536

1890

try:

1537

uid = pwd.getpwnam(u"nobody").pw_uid

1538

gid = pwd.getpwnam(u"nobody").pw_gid

1891

uid = pwd.getpwnam("nobody").pw_uid

1892

gid = pwd.getpwnam("nobody").pw_gid

1539

1893

except KeyError:

1540

1894

uid = 65534

1541

1895

gid = 65534

1542

1896

try:

1543

1897

os.setgid(gid)

1544

1898

os.setuid(uid)

1545

except OSError, error:

1899

except OSError as error:

1546

1900

if error[0] != errno.EPERM:

1547

1901

raise error

1548

1902

1549

# Enable all possible GnuTLS debugging

1903

if not debug and not debuglevel:

1904

syslogger.setLevel(logging.WARNING)

1905

console.setLevel(logging.WARNING)

1906

if debuglevel:

1907

level = getattr(logging, debuglevel.upper())

1908

syslogger.setLevel(level)

1909

console.setLevel(level)

1910

1550

1911

if debug:

1912

# Enable all possible GnuTLS debugging

1913

1551

1914

# "Use a log level over 10 to enable all debugging options."

1552

1915

# - GnuTLS manual

1553

1916

gnutls.library.functions.gnutls_global_set_log_level(11)

1554

1917

1555

1918

@gnutls.library.types.gnutls_log_func

1556

1919

def debug_gnutls(level, string):

1557

logger.debug(u"GnuTLS: %s", string[:-1])

1920

logger.debug("GnuTLS: %s", string[:-1])

1558

1921

1559

1922

(gnutls.library.functions

1560

1923

.gnutls_global_set_log_function(debug_gnutls))

1924

1925

# Redirect stdin so all checkers get /dev/null

1926

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1927

os.dup2(null, sys.stdin.fileno())

1928

if null > 2:

1929

os.close(null)

1930

else:

1931

# No console logging

1932

logger.removeHandler(console)

1933

1934

# Need to fork before connecting to D-Bus

1935

if not debug:

1936

# Close all input and output, do double fork, etc.

1937

daemon()

1561

1938

1562

1939

global main_loop

1563

1940

# From the Avahi example code

1566

1943

bus = dbus.SystemBus()

1567

1944

# End of Avahi example code

1568

1945

if use_dbus:

1569

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1946

try:

1947

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1948

bus, do_not_queue=True)

1949

except dbus.exceptions.NameExistsException as e:

1950

logger.error(unicode(e) + ", disabling D-Bus")

1951

use_dbus = False

1952

server_settings["use_dbus"] = False

1953

tcp_server.use_dbus = False

1570

1954

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1571

service = AvahiService(name = server_settings[u"servicename"],

1572

servicetype = u"_mandos._tcp",

1955

service = AvahiService(name = server_settings["servicename"],

1956

servicetype = "_mandos._tcp",

1573

1957

protocol = protocol, bus = bus)

1574

1958

if server_settings["interface"]:

1575

1959

service.interface = (if_nametoindex

1576

(str(server_settings[u"interface"])))

1960

(str(server_settings["interface"])))

1961

1962

global multiprocessing_manager

1963

multiprocessing_manager = multiprocessing.Manager()

1577

1964

1578

1965

client_class = Client

1579

1966

if use_dbus:

1580

1967

client_class = functools.partial(ClientDBus, bus = bus)

1968

def client_config_items(config, section):

1969

special_settings = {

1970

"approved_by_default":

1971

lambda: config.getboolean(section,

1972

"approved_by_default"),

1973

}

1974

for name, value in config.items(section):

1975

try:

1976

yield (name, special_settings[name]())

1977

except KeyError:

1978

yield (name, value)

1979

1581

1980

tcp_server.clients.update(set(

1582

1981

client_class(name = section,

1583

config= dict(client_config.items(section)))

1982

config= dict(client_config_items(

1983

client_config, section)))

1584

1984

for section in client_config.sections()))

1585

1985

if not tcp_server.clients:

1586

logger.warning(u"No clients defined")

1587

1588

if debug:

1589

# Redirect stdin so all checkers get /dev/null

1590

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1591

os.dup2(null, sys.stdin.fileno())

1592

if null > 2:

1593

os.close(null)

1594

else:

1595

# No console logging

1596

logger.removeHandler(console)

1597

# Close all input and output, do double fork, etc.

1598

daemon()

1599

1600

try:

1601

with closing(pidfile):

1602

pid = os.getpid()

1603

pidfile.write(str(pid) + "\n")

1604

del pidfile

1605

except IOError:

1606

logger.error(u"Could not write to file %r with PID %d",

1607

pidfilename, pid)

1608

except NameError:

1609

# "pidfile" was never created

1610

pass

1611

del pidfilename

1612

1613

def cleanup():

1614

"Cleanup function; run on exit"

1615

service.cleanup()

1986

logger.warning("No clients defined")

1616

1987

1617

while tcp_server.clients:

1618

client = tcp_server.clients.pop()

1619

client.disable_hook = None

1620

client.disable()

1621

1622

atexit.register(cleanup)

1623

1624

1988

if not debug:

1989

try:

1990

with pidfile:

1991

pid = os.getpid()

1992

pidfile.write(str(pid) + "\n".encode("utf-8"))

1993

del pidfile

1994

except IOError:

1995

logger.error("Could not write to file %r with PID %d",

1996

pidfilename, pid)

1997

except NameError:

1998

# "pidfile" was never created

1999

pass

2000

del pidfilename

2001

1625

2002

signal.signal(signal.SIGINT, signal.SIG_IGN)

2003

1626

2004

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1627

2005

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1628

2006

1630

2008

class MandosDBusService(dbus.service.Object):

1631

2009

"""A D-Bus proxy object"""

1632

2010

def __init__(self):

1633

dbus.service.Object.__init__(self, bus, u"/")

1634

_interface = u"se.bsnet.fukt.Mandos"

1635

1636

@dbus.service.signal(_interface, signature=u"oa{sv}")

1637

def ClientAdded(self, objpath, properties):

1638

"D-Bus signal"

1639

pass

1640

1641

@dbus.service.signal(_interface, signature=u"s")

1642

def ClientNotFound(self, fingerprint):

1643

"D-Bus signal"

1644

pass

1645

1646

@dbus.service.signal(_interface, signature=u"os")

2011

dbus.service.Object.__init__(self, bus, "/")

2012

_interface = "se.bsnet.fukt.Mandos"

2013

2014

@dbus.service.signal(_interface, signature="o")

2015

def ClientAdded(self, objpath):

2016

"D-Bus signal"

2017

pass

2018

2019

@dbus.service.signal(_interface, signature="ss")

2020

def ClientNotFound(self, fingerprint, address):

2021

"D-Bus signal"

2022

pass

2023

2024

@dbus.service.signal(_interface, signature="os")

1647

2025

def ClientRemoved(self, objpath, name):

1648

2026

"D-Bus signal"

1649

2027

pass

1650

2028

1651

@dbus.service.method(_interface, out_signature=u"ao")

2029

@dbus.service.method(_interface, out_signature="ao")

1652

2030

def GetAllClients(self):

1653

2031

"D-Bus method"

1654

2032

return dbus.Array(c.dbus_object_path

1655

2033

for c in tcp_server.clients)

1656

2034

1657

2035

@dbus.service.method(_interface,

1658

out_signature=u"a{oa{sv}}")

2036

out_signature="a{oa{sv}}")

1659

2037

def GetAllClientsWithProperties(self):

1660

2038

"D-Bus method"

1661

2039

return dbus.Dictionary(

1662

((c.dbus_object_path, c.GetAll(u""))

2040

((c.dbus_object_path, c.GetAll(""))

1663

2041

for c in tcp_server.clients),

1664

signature=u"oa{sv}")

2042

signature="oa{sv}")

1665

2043

1666

@dbus.service.method(_interface, in_signature=u"o")

2044

@dbus.service.method(_interface, in_signature="o")

1667

2045

def RemoveClient(self, object_path):

1668

2046

"D-Bus method"

1669

2047

for c in tcp_server.clients:

1671

2049

tcp_server.clients.remove(c)

1672

2050

c.remove_from_connection()

1673

2051

# Don't signal anything except ClientRemoved

1674

c.disable(signal=False)

2052

c.disable(quiet=True)

1675

2053

# Emit D-Bus signal

1676

2054

self.ClientRemoved(object_path, c.name)

1677

2055

return

1678

raise KeyError

2056

raise KeyError(object_path)

1679

2057

1680

2058

del _interface

1681

2059

1682

2060

mandos_dbus_service = MandosDBusService()

1683

2061

2062

def cleanup():

2063

"Cleanup function; run on exit"

2064

service.cleanup()

2065

2066

while tcp_server.clients:

2067

client = tcp_server.clients.pop()

2068

if use_dbus:

2069

client.remove_from_connection()

2070

client.disable_hook = None

2071

# Don't signal anything except ClientRemoved

2072

client.disable(quiet=True)

2073

if use_dbus:

2074

# Emit D-Bus signal

2075

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2076

client.name)

2077

2078

atexit.register(cleanup)

2079

1684

2080

for client in tcp_server.clients:

1685

2081

if use_dbus:

1686

2082

# Emit D-Bus signal

1687

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1688

client.GetAll(u""))

2083

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1689

2084

client.enable()

1690

2085

1691

2086

tcp_server.enable()

1694

2089

# Find out what port we got

1695

2090

service.port = tcp_server.socket.getsockname()[1]

1696

2091

if use_ipv6:

1697

logger.info(u"Now listening on address %r, port %d,"

2092

logger.info("Now listening on address %r, port %d,"

1698

2093

" flowinfo %d, scope_id %d"

1699

2094

% tcp_server.socket.getsockname())

1700

2095

else: # IPv4

1701

logger.info(u"Now listening on address %r, port %d"

2096

logger.info("Now listening on address %r, port %d"

1702

2097

% tcp_server.socket.getsockname())

1703

2098

1704

2099

#service.interface = tcp_server.socket.getsockname()[3]

1707

2102

# From the Avahi example code

1708

2103

try:

1709

2104

service.activate()

1710

except dbus.exceptions.DBusException, error:

1711

logger.critical(u"DBusException: %s", error)

2105

except dbus.exceptions.DBusException as error:

2106

logger.critical("DBusException: %s", error)

2107

cleanup()

1712

2108

sys.exit(1)

1713

2109

# End of Avahi example code

1714

2110

1717

2113

(tcp_server.handle_request

1718

2114

(*args[2:], **kwargs) or True))

1719

2115

1720

logger.debug(u"Starting main loop")

2116

logger.debug("Starting main loop")

1721

2117

main_loop.run()

1722

except AvahiError, error:

1723

logger.critical(u"AvahiError: %s", error)

2118

except AvahiError as error:

2119

logger.critical("AvahiError: %s", error)

2120

cleanup()

1724

2121

sys.exit(1)

1725

2122

except KeyboardInterrupt:

1726

2123

if debug:

1727

print >> sys.stderr

1728

logger.debug(u"Server received KeyboardInterrupt")

1729

logger.debug(u"Server exiting")

2124

print("", file=sys.stderr)

2125

logger.debug("Server received KeyboardInterrupt")

2126

logger.debug("Server exiting")

2127

# Must run before the D-Bus bus name gets deregistered

2128

cleanup()

1730

2129

1731

2130

if __name__ == '__main__':

1732

2131

main()