/mandos/trunk : revision 24.1.160

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

62

61

import functools

63

62

import cPickle as pickle

64

63

import multiprocessing

65

import types

66

64

67

65

import dbus

68

66

import dbus.service

83

81

SO_BINDTODEVICE = None

84

82

85

83

86

version = "1.3.1"

84

version = "1.0.14"

87

85

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

90

88

syslogger = (logging.handlers.SysLogHandler

91

89

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

address = str("/dev/log")))

90

address = "/dev/log"))

93

91

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

96

94

logger.addHandler(syslogger)

97

95

98

96

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

102

100

logger.addHandler(console)

103

101

104

102

class AvahiError(Exception):

121

119

Attributes:

122

120

interface: integer; avahi.IF_UNSPEC or an interface index.

123

121

Used to optionally bind to the specified interface.

124

125

type: string; Example: '_mandos._tcp'.

122

123

type: string; Example: u'_mandos._tcp'.

126

124

See <http://www.dns-sd.org/ServiceTypes.html>

127

125

port: integer; what port to announce

128

126

TXT: list of strings; TXT record for the service

137

135

"""

138

136

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

139

137

servicetype = None, port = None, TXT = None,

140

domain = "", host = "", max_renames = 32768,

138

domain = u"", host = u"", max_renames = 32768,

141

139

protocol = avahi.PROTO_UNSPEC, bus = None):

142

140

self.interface = interface

143

141

self.name = name

152

150

self.group = None # our entry group

153

151

self.server = None

154

152

self.bus = bus

155

self.entry_group_state_changed_match = None

156

153

def rename(self):

157

154

"""Derived from the Avahi example code"""

158

155

if self.rename_count >= self.max_renames:

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

161

158

self.rename_count)

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server

164

.GetAlternativeServiceName(self.name))

165

logger.info("Changing Zeroconf service name to %r ...",

159

raise AvahiServiceError(u"Too many renames")

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

166

162

self.name)

167

163

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

170

166

% self.name))

171

167

self.remove()

172

168

try:

173

169

self.add()

174

except dbus.exceptions.DBusException as error:

175

logger.critical("DBusException: %s", error)

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

176

172

self.cleanup()

177

173

os._exit(1)

178

174

self.rename_count += 1

179

175

def remove(self):

180

176

"""Derived from the Avahi example code"""

181

if self.entry_group_state_changed_match is not None:

182

self.entry_group_state_changed_match.remove()

183

self.entry_group_state_changed_match = None

184

177

if self.group is not None:

185

178

self.group.Reset()

186

179

def add(self):

187

180

"""Derived from the Avahi example code"""

188

self.remove()

189

181

if self.group is None:

190

182

self.group = dbus.Interface(

191

183

self.bus.get_object(avahi.DBUS_NAME,

192

184

self.server.EntryGroupNew()),

193

185

avahi.DBUS_INTERFACE_ENTRY_GROUP)

194

self.entry_group_state_changed_match = (

195

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

186

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

198

190

self.name, self.type)

199

191

self.group.AddService(

200

192

self.interface,

207

199

self.group.Commit()

208

200

def entry_group_state_changed(self, state, error):

209

201

"""Derived from the Avahi example code"""

210

logger.debug("Avahi entry group state change: %i", state)

202

logger.debug(u"Avahi entry group state change: %i", state)

211

203

212

204

if state == avahi.ENTRY_GROUP_ESTABLISHED:

213

logger.debug("Zeroconf service established.")

205

logger.debug(u"Zeroconf service established.")

214

206

elif state == avahi.ENTRY_GROUP_COLLISION:

215

logger.info("Zeroconf service name collision.")

207

logger.warning(u"Zeroconf service name collision.")

216

208

self.rename()

217

209

elif state == avahi.ENTRY_GROUP_FAILURE:

218

logger.critical("Avahi: Error in group state changed %s",

210

logger.critical(u"Avahi: Error in group state changed %s",

219

211

unicode(error))

220

raise AvahiGroupError("State changed: %s"

212

raise AvahiGroupError(u"State changed: %s"

221

213

% unicode(error))

222

214

def cleanup(self):

223

215

"""Derived from the Avahi example code"""

224

216

if self.group is not None:

225

try:

226

self.group.Free()

227

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

229

pass

217

self.group.Free()

230

218

self.group = None

231

self.remove()

232

def server_state_changed(self, state, error=None):

219

def server_state_changed(self, state):

233

220

"""Derived from the Avahi example code"""

234

logger.debug("Avahi server state change: %i", state)

235

bad_states = { avahi.SERVER_INVALID:

236

"Zeroconf server invalid",

237

avahi.SERVER_REGISTERING: None,

238

avahi.SERVER_COLLISION:

239

"Zeroconf server name collision",

240

avahi.SERVER_FAILURE:

241

"Zeroconf server failure" }

242

if state in bad_states:

243

if bad_states[state] is not None:

244

if error is None:

245

logger.error(bad_states[state])

246

else:

247

logger.error(bad_states[state] + ": %r", error)

248

self.cleanup()

221

logger.debug(u"Avahi server state change: %i", state)

222

if state == avahi.SERVER_COLLISION:

223

logger.error(u"Zeroconf server name collision")

224

self.remove()

249

225

elif state == avahi.SERVER_RUNNING:

250

226

self.add()

251

else:

252

if error is None:

253

logger.debug("Unknown state: %r", state)

254

else:

255

logger.debug("Unknown state: %r: %r", state, error)

256

227

def activate(self):

257

228

"""Derived from the Avahi example code"""

258

229

if self.server is None:

259

230

self.server = dbus.Interface(

260

231

self.bus.get_object(avahi.DBUS_NAME,

261

avahi.DBUS_PATH_SERVER,

262

follow_name_owner_changes=True),

232

avahi.DBUS_PATH_SERVER),

263

233

avahi.DBUS_INTERFACE_SERVER)

264

self.server.connect_to_signal("StateChanged",

234

self.server.connect_to_signal(u"StateChanged",

265

235

self.server_state_changed)

266

236

self.server_state_changed(self.server.GetState())

267

237

268

238

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

274

275

239

class Client(object):

276

240

"""A representation of a client host served by this server.

277

241

278

242

Attributes:

279

_approved: bool(); 'None' if not yet approved/disapproved

280

approval_delay: datetime.timedelta(); Time to wait for approval

281

approval_duration: datetime.timedelta(); Duration of one approval

243

244

D-Bus identifiers

245

fingerprint: string (40 or 32 hexadecimal digits); used to

246

uniquely identify the client

247

secret: bytestring; sent verbatim (over TLS) to client

248

host: string; available for use by the checker command

249

created: datetime.datetime(); (UTC) object creation

250

last_enabled: datetime.datetime(); (UTC)

251

enabled: bool()

252

last_checked_ok: datetime.datetime(); (UTC) or None

253

timeout: datetime.timedelta(); How long from last_checked_ok

254

until this client is disabled

255

interval: datetime.timedelta(); How often to start a new checker

256

disable_hook: If set, called by disable() as disable_hook(self)

282

257

checker: subprocess.Popen(); a running checker process used

283

258

to see if the client lives.

284

259

'None' if no process is running.

285

checker_callback_tag: a gobject event source tag, or None

286

checker_command: string; External command which is run to check

287

if client lives. %() expansions are done at

260

checker_initiator_tag: a gobject event source tag, or None

261

disable_initiator_tag: - '' -

262

checker_callback_tag: - '' -

263

checker_command: string; External command which is run to check if

264

client lives. %() expansions are done at

288

265

runtime with vars(self) as dict, so that for

289

266

instance %(name)s can be used in the command.

290

checker_initiator_tag: a gobject event source tag, or None

291

created: datetime.datetime(); (UTC) object creation

292

267

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

294

disable_initiator_tag: a gobject event source tag, or None

295

enabled: bool()

296

fingerprint: string (40 or 32 hexadecimal digits); used to

297

uniquely identify the client

298

host: string; available for use by the checker command

299

interval: datetime.timedelta(); How often to start a new checker

300

last_approval_request: datetime.datetime(); (UTC) or None

301

last_checked_ok: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

303

304

D-Bus identifiers

305

secret: bytestring; sent verbatim (over TLS) to client

306

timeout: datetime.timedelta(); How long from last_checked_ok

307

until this client is disabled

308

extended_timeout: extra long timeout when password has been sent

309

runtime_expansions: Allowed attributes for runtime expansion.

310

expires: datetime.datetime(); time (UTC) when a client will be

311

disabled, or None

268

approved_delay: datetime.timedelta(); Time to wait for approval

269

_approved: bool(); 'None' if not yet approved/disapproved

270

approved_duration: datetime.timedelta(); Duration of one approval

312

271

"""

313

272

314

runtime_expansions = ("approval_delay", "approval_duration",

315

"created", "enabled", "fingerprint",

316

"host", "interval", "last_checked_ok",

317

"last_enabled", "name", "timeout")

273

@staticmethod

274

def _timedelta_to_milliseconds(td):

275

"Convert a datetime.timedelta() to milliseconds"

276

return ((td.days * 24 * 60 * 60 * 1000)

277

+ (td.seconds * 1000)

278

+ (td.microseconds // 1000))

318

279

319

280

def timeout_milliseconds(self):

320

281

"Return the 'timeout' attribute in milliseconds"

321

return _timedelta_to_milliseconds(self.timeout)

322

323

def extended_timeout_milliseconds(self):

324

"Return the 'extended_timeout' attribute in milliseconds"

325

return _timedelta_to_milliseconds(self.extended_timeout)

282

return self._timedelta_to_milliseconds(self.timeout)

326

283

327

284

def interval_milliseconds(self):

328

285

"Return the 'interval' attribute in milliseconds"

329

return _timedelta_to_milliseconds(self.interval)

330

331

def approval_delay_milliseconds(self):

332

return _timedelta_to_milliseconds(self.approval_delay)

286

return self._timedelta_to_milliseconds(self.interval)

287

288

def approved_delay_milliseconds(self):

289

return self._timedelta_to_milliseconds(self.approved_delay)

333

290

334

291

def __init__(self, name = None, disable_hook=None, config=None):

335

292

"""Note: the 'checker' key in 'config' sets the

338

295

self.name = name

339

296

if config is None:

340

297

config = {}

341

logger.debug("Creating client %r", self.name)

298

logger.debug(u"Creating client %r", self.name)

342

299

# Uppercase and remove spaces from fingerprint for later

343

300

# comparison purposes with return value from the fingerprint()

344

301

# function

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

347

logger.debug(" Fingerprint: %s", self.fingerprint)

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

302

self.fingerprint = (config[u"fingerprint"].upper()

303

.replace(u" ", u""))

304

logger.debug(u" Fingerprint: %s", self.fingerprint)

305

if u"secret" in config:

306

self.secret = config[u"secret"].decode(u"base64")

307

elif u"secfile" in config:

351

308

with open(os.path.expanduser(os.path.expandvars

352

(config["secfile"])),

309

(config[u"secfile"])),

353

310

"rb") as secfile:

354

311

self.secret = secfile.read()

355

312

else:

356

raise TypeError("No secret or secfile for client %s"

313

raise TypeError(u"No secret or secfile for client %s"

357

314

% self.name)

358

self.host = config.get("host", "")

315

self.host = config.get(u"host", u"")

359

316

self.created = datetime.datetime.utcnow()

360

317

self.enabled = False

361

self.last_approval_request = None

362

318

self.last_enabled = None

363

319

self.last_checked_ok = None

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

320

self.timeout = string_to_delta(config[u"timeout"])

321

self.interval = string_to_delta(config[u"interval"])

368

322

self.disable_hook = disable_hook

369

323

self.checker = None

370

324

self.checker_initiator_tag = None

371

325

self.disable_initiator_tag = None

372

self.expires = None

373

326

self.checker_callback_tag = None

374

self.checker_command = config["checker"]

327

self.checker_command = config[u"checker"]

375

328

self.current_checker_command = None

376

329

self.last_connect = None

377

330

self._approved = None

378

self.approved_by_default = config.get("approved_by_default",

331

self.approved_by_default = config.get(u"approved_by_default",

379

332

True)

380

333

self.approvals_pending = 0

381

self.approval_delay = string_to_delta(

382

config["approval_delay"])

383

self.approval_duration = string_to_delta(

384

config["approval_duration"])

385

self.changedstate = (multiprocessing_manager

386

.Condition(multiprocessing_manager

387

.Lock()))

334

self.approved_delay = string_to_delta(

335

config[u"approved_delay"])

336

self.approved_duration = string_to_delta(

337

config[u"approved_duration"])

338

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

388

339

389

340

def send_changedstate(self):

390

341

self.changedstate.acquire()

391

342

self.changedstate.notify_all()

392

343

self.changedstate.release()

393

344

394

345

def enable(self):

395

346

"""Start this client's checker and timeout hooks"""

396

if getattr(self, "enabled", False):

347

if getattr(self, u"enabled", False):

397

348

# Already enabled

398

349

return

399

350

self.send_changedstate()

351

self.last_enabled = datetime.datetime.utcnow()

400

352

# Schedule a new checker to be started an 'interval' from now,

401

353

# and every interval from then on.

402

354

self.checker_initiator_tag = (gobject.timeout_add

403

355

(self.interval_milliseconds(),

404

356

self.start_checker))

405

357

# Schedule a disable() when 'timeout' has passed

406

self.expires = datetime.datetime.utcnow() + self.timeout

407

358

self.disable_initiator_tag = (gobject.timeout_add

408

359

(self.timeout_milliseconds(),

409

360

self.disable))

410

361

self.enabled = True

411

self.last_enabled = datetime.datetime.utcnow()

412

362

# Also start a new checker *right now*.

413

363

self.start_checker()

414

364

419

369

if not quiet:

420

370

self.send_changedstate()

421

371

if not quiet:

422

logger.info("Disabling client %s", self.name)

423

if getattr(self, "disable_initiator_tag", False):

372

logger.info(u"Disabling client %s", self.name)

373

if getattr(self, u"disable_initiator_tag", False):

424

374

gobject.source_remove(self.disable_initiator_tag)

425

375

self.disable_initiator_tag = None

426

self.expires = None

427

if getattr(self, "checker_initiator_tag", False):

376

if getattr(self, u"checker_initiator_tag", False):

428

377

gobject.source_remove(self.checker_initiator_tag)

429

378

self.checker_initiator_tag = None

430

379

self.stop_checker()

445

394

if os.WIFEXITED(condition):

446

395

exitstatus = os.WEXITSTATUS(condition)

447

396

if exitstatus == 0:

448

logger.info("Checker for %(name)s succeeded",

397

logger.info(u"Checker for %(name)s succeeded",

449

398

vars(self))

450

399

self.checked_ok()

451

400

else:

452

logger.info("Checker for %(name)s failed",

401

logger.info(u"Checker for %(name)s failed",

453

402

vars(self))

454

403

else:

455

logger.warning("Checker for %(name)s crashed?",

404

logger.warning(u"Checker for %(name)s crashed?",

456

405

vars(self))

457

406

458

def checked_ok(self, timeout=None):

407

def checked_ok(self):

459

408

"""Bump up the timeout for this client.

460

409

461

410

This should only be called when the client has been seen,

462

411

alive and well.

463

412

"""

464

if timeout is None:

465

timeout = self.timeout

466

413

self.last_checked_ok = datetime.datetime.utcnow()

467

414

gobject.source_remove(self.disable_initiator_tag)

468

self.expires = datetime.datetime.utcnow() + timeout

469

415

self.disable_initiator_tag = (gobject.timeout_add

470

(_timedelta_to_milliseconds

471

(timeout), self.disable))

472

473

def need_approval(self):

474

self.last_approval_request = datetime.datetime.utcnow()

416

(self.timeout_milliseconds(),

417

self.disable))

475

418

476

419

def start_checker(self):

477

420

"""Start a new checker subprocess if one is not running.

490

433

# If a checker exists, make sure it is not a zombie

491

434

try:

492

435

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

493

except (AttributeError, OSError) as error:

436

except (AttributeError, OSError), error:

494

437

if (isinstance(error, OSError)

495

438

and error.errno != errno.ECHILD):

496

439

raise error

497

440

else:

498

441

if pid:

499

logger.warning("Checker was a zombie")

442

logger.warning(u"Checker was a zombie")

500

443

gobject.source_remove(self.checker_callback_tag)

501

444

self.checker_callback(pid, status,

502

445

self.current_checker_command)

507

450

command = self.checker_command % self.host

508

451

except TypeError:

509

452

# Escape attributes for the shell

510

escaped_attrs = dict(

511

(attr,

512

re.escape(unicode(str(getattr(self, attr, "")),

513

errors=

514

'replace')))

515

for attr in

516

self.runtime_expansions)

517

453

escaped_attrs = dict((key,

454

re.escape(unicode(str(val),

455

errors=

456

u'replace')))

457

for key, val in

458

vars(self).iteritems())

518

459

try:

519

460

command = self.checker_command % escaped_attrs

520

except TypeError as error:

521

logger.error('Could not format string "%s":'

522

' %s', self.checker_command, error)

461

except TypeError, error:

462

logger.error(u'Could not format string "%s":'

463

u' %s', self.checker_command, error)

523

464

return True # Try again later

524

465

self.current_checker_command = command

525

466

try:

526

logger.info("Starting checker %r for %s",

467

logger.info(u"Starting checker %r for %s",

527

468

command, self.name)

528

469

# We don't need to redirect stdout and stderr, since

529

470

# in normal mode, that is already done by daemon(),

531

472

# always replaced by /dev/null.)

532

473

self.checker = subprocess.Popen(command,

533

474

close_fds=True,

534

shell=True, cwd="/")

475

shell=True, cwd=u"/")

535

476

self.checker_callback_tag = (gobject.child_watch_add

536

477

(self.checker.pid,

537

478

self.checker_callback,

542

483

if pid:

543

484

gobject.source_remove(self.checker_callback_tag)

544

485

self.checker_callback(pid, status, command)

545

except OSError as error:

546

logger.error("Failed to start subprocess: %s",

486

except OSError, error:

487

logger.error(u"Failed to start subprocess: %s",

547

488

error)

548

489

# Re-run this periodically if run by gobject.timeout_add

549

490

return True

553

494

if self.checker_callback_tag:

554

495

gobject.source_remove(self.checker_callback_tag)

555

496

self.checker_callback_tag = None

556

if getattr(self, "checker", None) is None:

497

if getattr(self, u"checker", None) is None:

557

498

return

558

logger.debug("Stopping checker for %(name)s", vars(self))

499

logger.debug(u"Stopping checker for %(name)s", vars(self))

559

500

try:

560

501

os.kill(self.checker.pid, signal.SIGTERM)

561

502

#time.sleep(0.5)

562

503

#if self.checker.poll() is None:

563

504

# os.kill(self.checker.pid, signal.SIGKILL)

564

except OSError as error:

505

except OSError, error:

565

506

if error.errno != errno.ESRCH: # No such process

566

507

raise

567

508

self.checker = None

568

509

569

570

def dbus_service_property(dbus_interface, signature="v",

571

access="readwrite", byte_arrays=False):

510

def dbus_service_property(dbus_interface, signature=u"v",

511

access=u"readwrite", byte_arrays=False):

572

512

"""Decorators for marking methods of a DBusObjectWithProperties to

573

513

become properties on the D-Bus.

574

514

581

521

"""

582

522

# Encoding deeply encoded byte arrays is not supported yet by the

583

523

# "Set" method, so we fail early here:

584

if byte_arrays and signature != "ay":

585

raise ValueError("Byte arrays not supported for non-'ay'"

586

" signature %r" % signature)

524

if byte_arrays and signature != u"ay":

525

raise ValueError(u"Byte arrays not supported for non-'ay'"

526

u" signature %r" % signature)

587

527

def decorator(func):

588

528

func._dbus_is_property = True

589

529

func._dbus_interface = dbus_interface

590

530

func._dbus_signature = signature

591

531

func._dbus_access = access

592

532

func._dbus_name = func.__name__

593

if func._dbus_name.endswith("_dbus_property"):

533

if func._dbus_name.endswith(u"_dbus_property"):

594

534

func._dbus_name = func._dbus_name[:-14]

595

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

535

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

596

536

return func

597

537

return decorator

598

538

618

558

619

559

class DBusObjectWithProperties(dbus.service.Object):

620

560

"""A D-Bus object with properties.

621

561

622

562

Classes inheriting from this can use the dbus_service_property

623

563

decorator to expose methods as D-Bus properties. It exposes the

624

564

standard Get(), Set(), and GetAll() methods on the D-Bus.

626

566

627

567

@staticmethod

628

568

def _is_dbus_property(obj):

629

return getattr(obj, "_dbus_is_property", False)

569

return getattr(obj, u"_dbus_is_property", False)

630

570

631

571

def _get_all_dbus_properties(self):

632

572

"""Returns a generator of (name, attribute) pairs

633

573

"""

634

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

635

for cls in self.__class__.__mro__

574

return ((prop._dbus_name, prop)

636

575

for name, prop in

637

inspect.getmembers(cls, self._is_dbus_property))

576

inspect.getmembers(self, self._is_dbus_property))

638

577

639

578

def _get_dbus_property(self, interface_name, property_name):

640

579

"""Returns a bound method if one exists which is a D-Bus

641

580

property with the specified name and interface.

642

581

"""

643

for cls in self.__class__.__mro__:

644

for name, value in (inspect.getmembers

645

(cls, self._is_dbus_property)):

646

if (value._dbus_name == property_name

647

and value._dbus_interface == interface_name):

648

return value.__get__(self)

649

582

for name in (property_name,

583

property_name + u"_dbus_property"):

584

prop = getattr(self, name, None)

585

if (prop is None

586

or not self._is_dbus_property(prop)

587

or prop._dbus_name != property_name

588

or (interface_name and prop._dbus_interface

589

and interface_name != prop._dbus_interface)):

590

continue

591

return prop

650

592

# No such property

651

raise DBusPropertyNotFound(self.dbus_object_path + ":"

652

+ interface_name + "."

593

raise DBusPropertyNotFound(self.dbus_object_path + u":"

594

+ interface_name + u"."

653

595

+ property_name)

654

596

655

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

656

out_signature="v")

597

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

598

out_signature=u"v")

657

599

def Get(self, interface_name, property_name):

658

600

"""Standard D-Bus property Get() method, see D-Bus standard.

659

601

"""

660

602

prop = self._get_dbus_property(interface_name, property_name)

661

if prop._dbus_access == "write":

603

if prop._dbus_access == u"write":

662

604

raise DBusPropertyAccessException(property_name)

663

605

value = prop()

664

if not hasattr(value, "variant_level"):

606

if not hasattr(value, u"variant_level"):

665

607

return value

666

608

return type(value)(value, variant_level=value.variant_level+1)

667

609

668

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

669

611

def Set(self, interface_name, property_name, value):

670

612

"""Standard D-Bus property Set() method, see D-Bus standard.

671

613

"""

672

614

prop = self._get_dbus_property(interface_name, property_name)

673

if prop._dbus_access == "read":

615

if prop._dbus_access == u"read":

674

616

raise DBusPropertyAccessException(property_name)

675

if prop._dbus_get_args_options["byte_arrays"]:

617

if prop._dbus_get_args_options[u"byte_arrays"]:

676

618

# The byte_arrays option is not supported yet on

677

619

# signatures other than "ay".

678

if prop._dbus_signature != "ay":

620

if prop._dbus_signature != u"ay":

679

621

raise ValueError

680

622

value = dbus.ByteArray(''.join(unichr(byte)

681

623

for byte in value))

682

624

prop(value)

683

625

684

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

685

out_signature="a{sv}")

626

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

627

out_signature=u"a{sv}")

686

628

def GetAll(self, interface_name):

687

629

"""Standard D-Bus property GetAll() method, see D-Bus

688

630

standard.

689

631

690

632

Note: Will not include properties with access="write".

691

633

"""

692

634

all = {}

696

638

# Interface non-empty but did not match

697

639

continue

698

640

# Ignore write-only properties

699

if prop._dbus_access == "write":

641

if prop._dbus_access == u"write":

700

642

continue

701

643

value = prop()

702

if not hasattr(value, "variant_level"):

644

if not hasattr(value, u"variant_level"):

703

645

all[name] = value

704

646

continue

705

647

all[name] = type(value)(value, variant_level=

706

648

value.variant_level+1)

707

return dbus.Dictionary(all, signature="sv")

649

return dbus.Dictionary(all, signature=u"sv")

708

650

709

651

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

710

out_signature="s",

652

out_signature=u"s",

711

653

path_keyword='object_path',

712

654

connection_keyword='connection')

713

655

def Introspect(self, object_path, connection):

718

660

try:

719

661

document = xml.dom.minidom.parseString(xmlstring)

720

662

def make_tag(document, name, prop):

721

e = document.createElement("property")

722

e.setAttribute("name", name)

723

e.setAttribute("type", prop._dbus_signature)

724

e.setAttribute("access", prop._dbus_access)

663

e = document.createElement(u"property")

664

e.setAttribute(u"name", name)

665

e.setAttribute(u"type", prop._dbus_signature)

666

e.setAttribute(u"access", prop._dbus_access)

725

667

return e

726

for if_tag in document.getElementsByTagName("interface"):

668

for if_tag in document.getElementsByTagName(u"interface"):

727

669

for tag in (make_tag(document, name, prop)

728

670

for name, prop

729

671

in self._get_all_dbus_properties()

730

672

if prop._dbus_interface

731

== if_tag.getAttribute("name")):

673

== if_tag.getAttribute(u"name")):

732

674

if_tag.appendChild(tag)

733

675

# Add the names to the return values for the

734

676

# "org.freedesktop.DBus.Properties" methods

735

if (if_tag.getAttribute("name")

736

== "org.freedesktop.DBus.Properties"):

737

for cn in if_tag.getElementsByTagName("method"):

738

if cn.getAttribute("name") == "Get":

739

for arg in cn.getElementsByTagName("arg"):

740

if (arg.getAttribute("direction")

741

== "out"):

742

arg.setAttribute("name", "value")

743

elif cn.getAttribute("name") == "GetAll":

744

for arg in cn.getElementsByTagName("arg"):

745

if (arg.getAttribute("direction")

746

== "out"):

747

arg.setAttribute("name", "props")

748

xmlstring = document.toxml("utf-8")

677

if (if_tag.getAttribute(u"name")

678

== u"org.freedesktop.DBus.Properties"):

679

for cn in if_tag.getElementsByTagName(u"method"):

680

if cn.getAttribute(u"name") == u"Get":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"value")

685

elif cn.getAttribute(u"name") == u"GetAll":

686

for arg in cn.getElementsByTagName(u"arg"):

687

if (arg.getAttribute(u"direction")

688

== u"out"):

689

arg.setAttribute(u"name", u"props")

690

xmlstring = document.toxml(u"utf-8")

749

691

document.unlink()

750

692

except (AttributeError, xml.dom.DOMException,

751

xml.parsers.expat.ExpatError) as error:

752

logger.error("Failed to override Introspection method",

693

xml.parsers.expat.ExpatError), error:

694

logger.error(u"Failed to override Introspection method",

753

695

error)

754

696

return xmlstring

755

697

756

698

757

def datetime_to_dbus (dt, variant_level=0):

758

"""Convert a UTC datetime.datetime() to a D-Bus type."""

759

if dt is None:

760

return dbus.String("", variant_level = variant_level)

761

return dbus.String(dt.isoformat(),

762

variant_level=variant_level)

763

764

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

765

.__metaclass__):

766

"""Applied to an empty subclass of a D-Bus object, this metaclass

767

will add additional D-Bus attributes matching a certain pattern.

768

"""

769

def __new__(mcs, name, bases, attr):

770

# Go through all the base classes which could have D-Bus

771

# methods, signals, or properties in them

772

for base in (b for b in bases

773

if issubclass(b, dbus.service.Object)):

774

# Go though all attributes of the base class

775

for attrname, attribute in inspect.getmembers(base):

776

# Ignore non-D-Bus attributes, and D-Bus attributes

777

# with the wrong interface name

778

if (not hasattr(attribute, "_dbus_interface")

779

or not attribute._dbus_interface

780

.startswith("se.recompile.Mandos")):

781

continue

782

# Create an alternate D-Bus interface name based on

783

# the current name

784

alt_interface = (attribute._dbus_interface

785

.replace("se.recompile.Mandos",

786

"se.bsnet.fukt.Mandos"))

787

# Is this a D-Bus signal?

788

if getattr(attribute, "_dbus_is_signal", False):

789

# Extract the original non-method function by

790

# black magic

791

nonmethod_func = (dict(

792

zip(attribute.func_code.co_freevars,

793

attribute.__closure__))["func"]

794

.cell_contents)

795

# Create a new, but exactly alike, function

796

# object, and decorate it to be a new D-Bus signal

797

# with the alternate D-Bus interface name

798

new_function = (dbus.service.signal

799

(alt_interface,

800

attribute._dbus_signature)

801

(types.FunctionType(

802

nonmethod_func.func_code,

803

nonmethod_func.func_globals,

804

nonmethod_func.func_name,

805

nonmethod_func.func_defaults,

806

nonmethod_func.func_closure)))

807

# Define a creator of a function to call both the

808

# old and new functions, so both the old and new

809

# signals gets sent when the function is called

810

def fixscope(func1, func2):

811

"""This function is a scope container to pass

812

func1 and func2 to the "call_both" function

813

outside of its arguments"""

814

def call_both(*args, **kwargs):

815

"""This function will emit two D-Bus

816

signals by calling func1 and func2"""

817

func1(*args, **kwargs)

818

func2(*args, **kwargs)

819

return call_both

820

# Create the "call_both" function and add it to

821

# the class

822

attr[attrname] = fixscope(attribute,

823

new_function)

824

# Is this a D-Bus method?

825

elif getattr(attribute, "_dbus_is_method", False):

826

# Create a new, but exactly alike, function

827

# object. Decorate it to be a new D-Bus method

828

# with the alternate D-Bus interface name. Add it

829

# to the class.

830

attr[attrname] = (dbus.service.method

831

(alt_interface,

832

attribute._dbus_in_signature,

833

attribute._dbus_out_signature)

834

(types.FunctionType

835

(attribute.func_code,

836

attribute.func_globals,

837

attribute.func_name,

838

attribute.func_defaults,

839

attribute.func_closure)))

840

# Is this a D-Bus property?

841

elif getattr(attribute, "_dbus_is_property", False):

842

# Create a new, but exactly alike, function

843

# object, and decorate it to be a new D-Bus

844

# property with the alternate D-Bus interface

845

# name. Add it to the class.

846

attr[attrname] = (dbus_service_property

847

(alt_interface,

848

attribute._dbus_signature,

849

attribute._dbus_access,

850

attribute

851

._dbus_get_args_options

852

["byte_arrays"])

853

(types.FunctionType

854

(attribute.func_code,

855

attribute.func_globals,

856

attribute.func_name,

857

attribute.func_defaults,

858

attribute.func_closure)))

859

return type.__new__(mcs, name, bases, attr)

860

861

699

class ClientDBus(Client, DBusObjectWithProperties):

862

700

"""A Client class using D-Bus

863

701

865

703

dbus_object_path: dbus.ObjectPath

866

704

bus: dbus.SystemBus()

867

705

"""

868

869

runtime_expansions = (Client.runtime_expansions

870

+ ("dbus_object_path",))

871

872

706

# dbus.service.Object doesn't use super(), so we can't either.

873

707

874

708

def __init__(self, bus = None, *args, **kwargs):

877

711

Client.__init__(self, *args, **kwargs)

878

712

# Only now, when this client is initialized, can it show up on

879

713

# the D-Bus

880

client_object_name = unicode(self.name).translate(

881

{ord("."): ord("_"),

882

ord("-"): ord("_")})

883

714

self.dbus_object_path = (dbus.ObjectPath

884

("/clients/" + client_object_name))

715

(u"/clients/"

716

+ self.name.replace(u".", u"_")))

885

717

DBusObjectWithProperties.__init__(self, self.bus,

886

718

self.dbus_object_path)

887

888

def notifychangeproperty(transform_func,

889

dbus_name, type_func=lambda x: x,

890

variant_level=1):

891

""" Modify a variable so that it's a property which announces

892

its changes to DBus.

893

894

transform_fun: Function that takes a value and transforms it

895

to a D-Bus type.

896

dbus_name: D-Bus name of the variable

897

type_func: Function that transform the value before sending it

898

to the D-Bus. Default: no transform

899

variant_level: D-Bus variant level. Default: 1

900

"""

901

attrname = "_{0}".format(dbus_name)

902

def setter(self, value):

903

if hasattr(self, "dbus_object_path"):

904

if (not hasattr(self, attrname) or

905

type_func(getattr(self, attrname, None))

906

!= type_func(value)):

907

dbus_value = transform_func(type_func(value),

908

variant_level)

909

self.PropertyChanged(dbus.String(dbus_name),

910

dbus_value)

911

setattr(self, attrname, value)

912

913

return property(lambda self: getattr(self, attrname), setter)

914

915

916

expires = notifychangeproperty(datetime_to_dbus, "Expires")

917

approvals_pending = notifychangeproperty(dbus.Boolean,

918

"ApprovalPending",

919

type_func = bool)

920

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

921

last_enabled = notifychangeproperty(datetime_to_dbus,

922

"LastEnabled")

923

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

924

type_func = lambda checker:

925

checker is not None)

926

last_checked_ok = notifychangeproperty(datetime_to_dbus,

927

"LastCheckedOK")

928

last_approval_request = notifychangeproperty(

929

datetime_to_dbus, "LastApprovalRequest")

930

approved_by_default = notifychangeproperty(dbus.Boolean,

931

"ApprovedByDefault")

932

approval_delay = notifychangeproperty(dbus.UInt16,

933

"ApprovalDelay",

934

type_func =

935

_timedelta_to_milliseconds)

936

approval_duration = notifychangeproperty(

937

dbus.UInt16, "ApprovalDuration",

938

type_func = _timedelta_to_milliseconds)

939

host = notifychangeproperty(dbus.String, "Host")

940

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

941

type_func =

942

_timedelta_to_milliseconds)

943

extended_timeout = notifychangeproperty(

944

dbus.UInt16, "ExtendedTimeout",

945

type_func = _timedelta_to_milliseconds)

946

interval = notifychangeproperty(dbus.UInt16,

947

"Interval",

948

type_func =

949

_timedelta_to_milliseconds)

950

checker_command = notifychangeproperty(dbus.String, "Checker")

951

952

del notifychangeproperty

719

720

def _get_approvals_pending(self):

721

return self._approvals_pending

722

def _set_approvals_pending(self, value):

723

old_value = self._approvals_pending

724

self._approvals_pending = value

725

bval = bool(value)

726

if (hasattr(self, "dbus_object_path")

727

and bval is not bool(old_value)):

728

dbus_bool = dbus.Boolean(bval, variant_level=1)

729

self.PropertyChanged(dbus.String(u"approved_pending"),

730

dbus_bool)

731

732

approvals_pending = property(_get_approvals_pending,

733

_set_approvals_pending)

734

del _get_approvals_pending, _set_approvals_pending

735

736

@staticmethod

737

def _datetime_to_dbus(dt, variant_level=0):

738

"""Convert a UTC datetime.datetime() to a D-Bus type."""

739

return dbus.String(dt.isoformat(),

740

variant_level=variant_level)

741

742

def enable(self):

743

oldstate = getattr(self, u"enabled", False)

744

r = Client.enable(self)

745

if oldstate != self.enabled:

746

# Emit D-Bus signals

747

self.PropertyChanged(dbus.String(u"enabled"),

748

dbus.Boolean(True, variant_level=1))

749

self.PropertyChanged(

750

dbus.String(u"last_enabled"),

751

self._datetime_to_dbus(self.last_enabled,

752

variant_level=1))

753

return r

754

755

def disable(self, quiet = False):

756

oldstate = getattr(self, u"enabled", False)

757

r = Client.disable(self, quiet=quiet)

758

if not quiet and oldstate != self.enabled:

759

# Emit D-Bus signal

760

self.PropertyChanged(dbus.String(u"enabled"),

761

dbus.Boolean(False, variant_level=1))

762

return r

953

763

954

764

def __del__(self, *args, **kwargs):

955

765

try:

956

766

self.remove_from_connection()

957

767

except LookupError:

958

768

pass

959

if hasattr(DBusObjectWithProperties, "__del__"):

769

if hasattr(DBusObjectWithProperties, u"__del__"):

960

770

DBusObjectWithProperties.__del__(self, *args, **kwargs)

961

771

Client.__del__(self, *args, **kwargs)

962

772

964

774

*args, **kwargs):

965

775

self.checker_callback_tag = None

966

776

self.checker = None

777

# Emit D-Bus signal

778

self.PropertyChanged(dbus.String(u"checker_running"),

779

dbus.Boolean(False, variant_level=1))

967

780

if os.WIFEXITED(condition):

968

781

exitstatus = os.WEXITSTATUS(condition)

969

782

# Emit D-Bus signal

979

792

return Client.checker_callback(self, pid, condition, command,

980

793

*args, **kwargs)

981

794

795

def checked_ok(self, *args, **kwargs):

796

r = Client.checked_ok(self, *args, **kwargs)

797

# Emit D-Bus signal

798

self.PropertyChanged(

799

dbus.String(u"last_checked_ok"),

800

(self._datetime_to_dbus(self.last_checked_ok,

801

variant_level=1)))

802

return r

803

982

804

def start_checker(self, *args, **kwargs):

983

805

old_checker = self.checker

984

806

if self.checker is not None:

991

813

and old_checker_pid != self.checker.pid):

992

814

# Emit D-Bus signal

993

815

self.CheckerStarted(self.current_checker_command)

816

self.PropertyChanged(

817

dbus.String(u"checker_running"),

818

dbus.Boolean(True, variant_level=1))

994

819

return r

995

820

821

def stop_checker(self, *args, **kwargs):

822

old_checker = getattr(self, u"checker", None)

823

r = Client.stop_checker(self, *args, **kwargs)

824

if (old_checker is not None

825

and getattr(self, u"checker", None) is None):

826

self.PropertyChanged(dbus.String(u"checker_running"),

827

dbus.Boolean(False, variant_level=1))

828

return r

829

996

830

def _reset_approved(self):

997

831

self._approved = None

998

832

return False

1000

834

def approve(self, value=True):

1001

835

self.send_changedstate()

1002

836

self._approved = value

1003

gobject.timeout_add(_timedelta_to_milliseconds

1004

(self.approval_duration),

837

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),

1005

838

self._reset_approved)

1006

839

1007

840

1008

841

## D-Bus methods, signals & properties

1009

_interface = "se.recompile.Mandos.Client"

842

_interface = u"se.bsnet.fukt.Mandos.Client"

1010

843

1011

844

## Signals

1012

845

1013

846

# CheckerCompleted - signal

1014

@dbus.service.signal(_interface, signature="nxs")

847

@dbus.service.signal(_interface, signature=u"nxs")

1015

848

def CheckerCompleted(self, exitcode, waitstatus, command):

1016

849

"D-Bus signal"

1017

850

pass

1018

851

1019

852

# CheckerStarted - signal

1020

@dbus.service.signal(_interface, signature="s")

853

@dbus.service.signal(_interface, signature=u"s")

1021

854

def CheckerStarted(self, command):

1022

855

"D-Bus signal"

1023

856

pass

1024

857

1025

858

# PropertyChanged - signal

1026

@dbus.service.signal(_interface, signature="sv")

859

@dbus.service.signal(_interface, signature=u"sv")

1027

860

def PropertyChanged(self, property, value):

1028

861

"D-Bus signal"

1029

862

pass

1038

871

pass

1039

872

1040

873

# Rejected - signal

1041

@dbus.service.signal(_interface, signature="s")

874

@dbus.service.signal(_interface, signature=u"s")

1042

875

def Rejected(self, reason):

1043

876

"D-Bus signal"

1044

877

pass

1045

878

1046

879

# NeedApproval - signal

1047

@dbus.service.signal(_interface, signature="tb")

880

@dbus.service.signal(_interface, signature=u"db")

1048

881

def NeedApproval(self, timeout, default):

1049

882

"D-Bus signal"

1050

return self.need_approval()

883

pass

1051

884

1052

885

## Methods

1053

886

1054

887

# Approve - method

1055

@dbus.service.method(_interface, in_signature="b")

888

@dbus.service.method(_interface, in_signature=u"b")

1056

889

def Approve(self, value):

1057

890

self.approve(value)

1058

891

1059

892

# CheckedOK - method

1060

893

@dbus.service.method(_interface)

1061

894

def CheckedOK(self):

1062

self.checked_ok()

895

return self.checked_ok()

1063

896

1064

897

# Enable - method

1065

898

@dbus.service.method(_interface)

1086

919

1087

920

## Properties

1088

921

1089

# ApprovalPending - property

1090

@dbus_service_property(_interface, signature="b", access="read")

1091

def ApprovalPending_dbus_property(self):

922

# approved_pending - property

923

@dbus_service_property(_interface, signature=u"b", access=u"read")

924

def approved_pending_dbus_property(self):

1092

925

return dbus.Boolean(bool(self.approvals_pending))

1093

926

1094

# ApprovedByDefault - property

1095

@dbus_service_property(_interface, signature="b",

1096

access="readwrite")

1097

def ApprovedByDefault_dbus_property(self, value=None):

1098

if value is None: # get

1099

return dbus.Boolean(self.approved_by_default)

1100

self.approved_by_default = bool(value)

1101

1102

# ApprovalDelay - property

1103

@dbus_service_property(_interface, signature="t",

1104

access="readwrite")

1105

def ApprovalDelay_dbus_property(self, value=None):

1106

if value is None: # get

1107

return dbus.UInt64(self.approval_delay_milliseconds())

1108

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1109

1110

# ApprovalDuration - property

1111

@dbus_service_property(_interface, signature="t",

1112

access="readwrite")

1113

def ApprovalDuration_dbus_property(self, value=None):

1114

if value is None: # get

1115

return dbus.UInt64(_timedelta_to_milliseconds(

1116

self.approval_duration))

1117

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1118

1119

# Name - property

1120

@dbus_service_property(_interface, signature="s", access="read")

1121

def Name_dbus_property(self):

927

# approved_by_default - property

928

@dbus_service_property(_interface, signature=u"b",

929

access=u"readwrite")

930

def approved_by_default_dbus_property(self):

931

return dbus.Boolean(self.approved_by_default)

932

933

# approved_delay - property

934

@dbus_service_property(_interface, signature=u"t",

935

access=u"readwrite")

936

def approved_delay_dbus_property(self):

937

return dbus.UInt64(self.approved_delay_milliseconds())

938

939

# approved_duration - property

940

@dbus_service_property(_interface, signature=u"t",

941

access=u"readwrite")

942

def approved_duration_dbus_property(self):

943

return dbus.UInt64(self._timedelta_to_milliseconds(

944

self.approved_duration))

945

946

# name - property

947

@dbus_service_property(_interface, signature=u"s", access=u"read")

948

def name_dbus_property(self):

1122

949

return dbus.String(self.name)

1123

950

1124

# Fingerprint - property

1125

@dbus_service_property(_interface, signature="s", access="read")

1126

def Fingerprint_dbus_property(self):

951

# fingerprint - property

952

@dbus_service_property(_interface, signature=u"s", access=u"read")

953

def fingerprint_dbus_property(self):

1127

954

return dbus.String(self.fingerprint)

1128

955

1129

# Host - property

1130

@dbus_service_property(_interface, signature="s",

1131

access="readwrite")

1132

def Host_dbus_property(self, value=None):

956

# host - property

957

@dbus_service_property(_interface, signature=u"s",

958

access=u"readwrite")

959

def host_dbus_property(self, value=None):

1133

960

if value is None: # get

1134

961

return dbus.String(self.host)

1135

962

self.host = value

1136

1137

# Created - property

1138

@dbus_service_property(_interface, signature="s", access="read")

1139

def Created_dbus_property(self):

1140

return dbus.String(datetime_to_dbus(self.created))

1141

1142

# LastEnabled - property

1143

@dbus_service_property(_interface, signature="s", access="read")

1144

def LastEnabled_dbus_property(self):

1145

return datetime_to_dbus(self.last_enabled)

1146

1147

# Enabled - property

1148

@dbus_service_property(_interface, signature="b",

1149

access="readwrite")

1150

def Enabled_dbus_property(self, value=None):

963

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"host"),

965

dbus.String(value, variant_level=1))

966

967

# created - property

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

969

def created_dbus_property(self):

970

return dbus.String(self._datetime_to_dbus(self.created))

971

972

# last_enabled - property

973

@dbus_service_property(_interface, signature=u"s", access=u"read")

974

def last_enabled_dbus_property(self):

975

if self.last_enabled is None:

976

return dbus.String(u"")

977

return dbus.String(self._datetime_to_dbus(self.last_enabled))

978

979

# enabled - property

980

@dbus_service_property(_interface, signature=u"b",

981

access=u"readwrite")

982

def enabled_dbus_property(self, value=None):

1151

983

if value is None: # get

1152

984

return dbus.Boolean(self.enabled)

1153

985

if value:

1155

987

else:

1156

988

self.disable()

1157

989

1158

# LastCheckedOK - property

1159

@dbus_service_property(_interface, signature="s",

1160

access="readwrite")

1161

def LastCheckedOK_dbus_property(self, value=None):

990

# last_checked_ok - property

991

@dbus_service_property(_interface, signature=u"s",

992

access=u"readwrite")

993

def last_checked_ok_dbus_property(self, value=None):

1162

994

if value is not None:

1163

995

self.checked_ok()

1164

996

return

1165

return datetime_to_dbus(self.last_checked_ok)

1166

1167

# Expires - property

1168

@dbus_service_property(_interface, signature="s", access="read")

1169

def Expires_dbus_property(self):

1170

return datetime_to_dbus(self.expires)

1171

1172

# LastApprovalRequest - property

1173

@dbus_service_property(_interface, signature="s", access="read")

1174

def LastApprovalRequest_dbus_property(self):

1175

return datetime_to_dbus(self.last_approval_request)

1176

1177

# Timeout - property

1178

@dbus_service_property(_interface, signature="t",

1179

access="readwrite")

1180

def Timeout_dbus_property(self, value=None):

997

if self.last_checked_ok is None:

998

return dbus.String(u"")

999

return dbus.String(self._datetime_to_dbus(self

1000

.last_checked_ok))

1001

1002

# timeout - property

1003

@dbus_service_property(_interface, signature=u"t",

1004

access=u"readwrite")

1005

def timeout_dbus_property(self, value=None):

1181

1006

if value is None: # get

1182

1007

return dbus.UInt64(self.timeout_milliseconds())

1183

1008

self.timeout = datetime.timedelta(0, 0, 0, value)

1184

if getattr(self, "disable_initiator_tag", None) is None:

1009

# Emit D-Bus signal

1010

self.PropertyChanged(dbus.String(u"timeout"),

1011

dbus.UInt64(value, variant_level=1))

1012

if getattr(self, u"disable_initiator_tag", None) is None:

1185

1013

return

1186

1014

# Reschedule timeout

1187

1015

gobject.source_remove(self.disable_initiator_tag)

1188

1016

self.disable_initiator_tag = None

1189

self.expires = None

1190

1017

time_to_die = (self.

1191

1018

_timedelta_to_milliseconds((self

1192

1019

.last_checked_ok

1197

1024

# The timeout has passed

1198

1025

self.disable()

1199

1026

else:

1200

self.expires = (datetime.datetime.utcnow()

1201

+ datetime.timedelta(milliseconds =

1202

time_to_die))

1203

1027

self.disable_initiator_tag = (gobject.timeout_add

1204

1028

(time_to_die, self.disable))

1205

1029

1206

# ExtendedTimeout - property

1207

@dbus_service_property(_interface, signature="t",

1208

access="readwrite")

1209

def ExtendedTimeout_dbus_property(self, value=None):

1210

if value is None: # get

1211

return dbus.UInt64(self.extended_timeout_milliseconds())

1212

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1213

1214

# Interval - property

1215

@dbus_service_property(_interface, signature="t",

1216

access="readwrite")

1217

def Interval_dbus_property(self, value=None):

1030

# interval - property

1031

@dbus_service_property(_interface, signature=u"t",

1032

access=u"readwrite")

1033

def interval_dbus_property(self, value=None):

1218

1034

if value is None: # get

1219

1035

return dbus.UInt64(self.interval_milliseconds())

1220

1036

self.interval = datetime.timedelta(0, 0, 0, value)

1221

if getattr(self, "checker_initiator_tag", None) is None:

1037

# Emit D-Bus signal

1038

self.PropertyChanged(dbus.String(u"interval"),

1039

dbus.UInt64(value, variant_level=1))

1040

if getattr(self, u"checker_initiator_tag", None) is None:

1222

1041

return

1223

1042

# Reschedule checker run

1224

1043

gobject.source_remove(self.checker_initiator_tag)

1225

1044

self.checker_initiator_tag = (gobject.timeout_add

1226

1045

(value, self.start_checker))

1227

1046

self.start_checker() # Start one now, too

1228

1229

# Checker - property

1230

@dbus_service_property(_interface, signature="s",

1231

access="readwrite")

1232

def Checker_dbus_property(self, value=None):

1047

1048

# checker - property

1049

@dbus_service_property(_interface, signature=u"s",

1050

access=u"readwrite")

1051

def checker_dbus_property(self, value=None):

1233

1052

if value is None: # get

1234

1053

return dbus.String(self.checker_command)

1235

1054

self.checker_command = value

1055

# Emit D-Bus signal

1056

self.PropertyChanged(dbus.String(u"checker"),

1057

dbus.String(self.checker_command,

1058

variant_level=1))

1236

1059

1237

# CheckerRunning - property

1238

@dbus_service_property(_interface, signature="b",

1239

access="readwrite")

1240

def CheckerRunning_dbus_property(self, value=None):

1060

# checker_running - property

1061

@dbus_service_property(_interface, signature=u"b",

1062

access=u"readwrite")

1063

def checker_running_dbus_property(self, value=None):

1241

1064

if value is None: # get

1242

1065

return dbus.Boolean(self.checker is not None)

1243

1066

if value:

1245

1068

else:

1246

1069

self.stop_checker()

1247

1070

1248

# ObjectPath - property

1249

@dbus_service_property(_interface, signature="o", access="read")

1250

def ObjectPath_dbus_property(self):

1071

# object_path - property

1072

@dbus_service_property(_interface, signature=u"o", access=u"read")

1073

def object_path_dbus_property(self):

1251

1074

return self.dbus_object_path # is already a dbus.ObjectPath

1252

1075

1253

# Secret = property

1254

@dbus_service_property(_interface, signature="ay",

1255

access="write", byte_arrays=True)

1256

def Secret_dbus_property(self, value):

1076

# secret = property

1077

@dbus_service_property(_interface, signature=u"ay",

1078

access=u"write", byte_arrays=True)

1079

def secret_dbus_property(self, value):

1257

1080

self.secret = str(value)

1258

1081

1259

1082

del _interface

1265

1088

self._pipe.send(('init', fpr, address))

1266

1089

if not self._pipe.recv():

1267

1090

raise KeyError()

1268

1091

1269

1092

def __getattribute__(self, name):

1270

1093

if(name == '_pipe'):

1271

1094

return super(ProxyClient, self).__getattribute__(name)

1278

1101

self._pipe.send(('funcall', name, args, kwargs))

1279

1102

return self._pipe.recv()[1]

1280

1103

return func

1281

1104

1282

1105

def __setattr__(self, name, value):

1283

1106

if(name == '_pipe'):

1284

1107

return super(ProxyClient, self).__setattr__(name, value)

1285

1108

self._pipe.send(('setattr', name, value))

1286

1109

1287

class ClientDBusTransitional(ClientDBus):

1288

__metaclass__ = AlternateDBusNamesMetaclass

1289

1110

1290

1111

class ClientHandler(socketserver.BaseRequestHandler, object):

1291

1112

"""A class to handle client connections.

1295

1116

1296

1117

def handle(self):

1297

1118

with contextlib.closing(self.server.child_pipe) as child_pipe:

1298

logger.info("TCP connection from: %s",

1119

logger.info(u"TCP connection from: %s",

1299

1120

unicode(self.client_address))

1300

logger.debug("Pipe FD: %d",

1121

logger.debug(u"Pipe FD: %d",

1301

1122

self.server.child_pipe.fileno())

1302

1123

1303

1124

session = (gnutls.connection

1304

1125

.ClientSession(self.request,

1305

1126

gnutls.connection

1306

1127

.X509Credentials()))

1307

1128

1308

1129

# Note: gnutls.connection.X509Credentials is really a

1309

1130

# generic GnuTLS certificate credentials object so long as

1310

1131

# no X.509 keys are added to it. Therefore, we can use it

1311

1132

# here despite using OpenPGP certificates.

1312

1313

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1314

# "+AES-256-CBC", "+SHA1",

1315

# "+COMP-NULL", "+CTYPE-OPENPGP",

1316

# "+DHE-DSS"))

1133

1134

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1135

# u"+AES-256-CBC", u"+SHA1",

1136

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1137

# u"+DHE-DSS"))

1317

1138

# Use a fallback default, since this MUST be set.

1318

1139

priority = self.server.gnutls_priority

1319

1140

if priority is None:

1320

priority = "NORMAL"

1141

priority = u"NORMAL"

1321

1142

(gnutls.library.functions

1322

1143

.gnutls_priority_set_direct(session._c_object,

1323

1144

priority, None))

1324

1145

1325

1146

# Start communication using the Mandos protocol

1326

1147

# Get protocol number

1327

1148

line = self.request.makefile().readline()

1328

logger.debug("Protocol version: %r", line)

1149

logger.debug(u"Protocol version: %r", line)

1329

1150

try:

1330

1151

if int(line.strip().split()[0]) > 1:

1331

1152

raise RuntimeError

1332

except (ValueError, IndexError, RuntimeError) as error:

1333

logger.error("Unknown protocol version: %s", error)

1153

except (ValueError, IndexError, RuntimeError), error:

1154

logger.error(u"Unknown protocol version: %s", error)

1334

1155

return

1335

1156

1336

1157

# Start GnuTLS connection

1337

1158

try:

1338

1159

session.handshake()

1339

except gnutls.errors.GNUTLSError as error:

1340

logger.warning("Handshake failed: %s", error)

1160

except gnutls.errors.GNUTLSError, error:

1161

logger.warning(u"Handshake failed: %s", error)

1341

1162

# Do not run session.bye() here: the session is not

1342

1163

# established. Just abandon the request.

1343

1164

return

1344

logger.debug("Handshake succeeded")

1345

1165

logger.debug(u"Handshake succeeded")

1166

1346

1167

approval_required = False

1347

1168

try:

1348

1169

try:

1349

1170

fpr = self.fingerprint(self.peer_certificate

1350

1171

(session))

1351

except (TypeError,

1352

gnutls.errors.GNUTLSError) as error:

1353

logger.warning("Bad certificate: %s", error)

1172

except (TypeError, gnutls.errors.GNUTLSError), error:

1173

logger.warning(u"Bad certificate: %s", error)

1354

1174

return

1355

logger.debug("Fingerprint: %s", fpr)

1356

1175

logger.debug(u"Fingerprint: %s", fpr)

1176

1357

1177

try:

1358

1178

client = ProxyClient(child_pipe, fpr,

1359

1179

self.client_address)

1360

1180

except KeyError:

1361

1181

return

1362

1182

1363

if client.approval_delay:

1364

delay = client.approval_delay

1183

if client.approved_delay:

1184

delay = client.approved_delay

1365

1185

client.approvals_pending += 1

1366

1186

approval_required = True

1367

1187

1368

1188

while True:

1369

1189

if not client.enabled:

1370

logger.info("Client %s is disabled",

1190

logger.warning(u"Client %s is disabled",

1371

1191

client.name)

1372

1192

if self.server.use_dbus:

1373

1193

# Emit D-Bus signal

1374

client.Rejected("Disabled")

1194

client.Rejected("Disabled")

1375

1195

return

1376

1196

1377

if client._approved or not client.approval_delay:

1197

if client._approved or not client.approved_delay:

1378

1198

#We are approved or approval is disabled

1379

1199

break

1380

1200

elif client._approved is None:

1381

logger.info("Client %s needs approval",

1201

logger.info(u"Client %s need approval",

1382

1202

client.name)

1383

1203

if self.server.use_dbus:

1384

1204

# Emit D-Bus signal

1385

1205

client.NeedApproval(

1386

client.approval_delay_milliseconds(),

1206

client.approved_delay_milliseconds(),

1387

1207

client.approved_by_default)

1388

1208

else:

1389

logger.warning("Client %s was not approved",

1209

logger.warning(u"Client %s was not approved",

1390

1210

client.name)

1391

1211

if self.server.use_dbus:

1392

1212

# Emit D-Bus signal

1393

client.Rejected("Denied")

1213

client.Rejected("Disapproved")

1394

1214

return

1395

1215

1396

1216

#wait until timeout or approved

1397

#x = float(client

1398

# ._timedelta_to_milliseconds(delay))

1217

#x = float(client._timedelta_to_milliseconds(delay))

1399

1218

time = datetime.datetime.now()

1400

1219

client.changedstate.acquire()

1401

(client.changedstate.wait

1402

(float(client._timedelta_to_milliseconds(delay)

1403

/ 1000)))

1220

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1404

1221

client.changedstate.release()

1405

1222

time2 = datetime.datetime.now()

1406

1223

if (time2 - time) >= delay:

1410

1227

client.name)

1411

1228

if self.server.use_dbus:

1412

1229

# Emit D-Bus signal

1413

client.Rejected("Approval timed out")

1230

client.Rejected("Time out")

1414

1231

return

1415

1232

else:

1416

1233

break

1421

1238

while sent_size < len(client.secret):

1422

1239

try:

1423

1240

sent = session.send(client.secret[sent_size:])

1424

except gnutls.errors.GNUTLSError as error:

1241

except (gnutls.errors.GNUTLSError), error:

1425

1242

logger.warning("gnutls send failed")

1426

1243

return

1427

logger.debug("Sent: %d, remaining: %d",

1244

logger.debug(u"Sent: %d, remaining: %d",

1428

1245

sent, len(client.secret)

1429

1246

- (sent_size + sent))

1430

1247

sent_size += sent

1431

1432

logger.info("Sending secret to %s", client.name)

1248

1249

logger.info(u"Sending secret to %s", client.name)

1433

1250

# bump the timeout as if seen

1434

client.checked_ok(client.extended_timeout)

1251

client.checked_ok()

1435

1252

if self.server.use_dbus:

1436

1253

# Emit D-Bus signal

1437

1254

client.GotSecret()

1441

1258

client.approvals_pending -= 1

1442

1259

try:

1443

1260

session.bye()

1444

except gnutls.errors.GNUTLSError as error:

1445

logger.warning("GnuTLS bye failed")

1261

except (gnutls.errors.GNUTLSError), error:

1262

logger.warning("gnutls bye failed")

1446

1263

1447

1264

@staticmethod

1448

1265

def peer_certificate(session):

1458

1275

.gnutls_certificate_get_peers

1459

1276

(session._c_object, ctypes.byref(list_size)))

1460

1277

if not bool(cert_list) and list_size.value != 0:

1461

raise gnutls.errors.GNUTLSError("error getting peer"

1462

" certificate")

1278

raise gnutls.errors.GNUTLSError(u"error getting peer"

1279

u" certificate")

1463

1280

if list_size.value == 0:

1464

1281

return None

1465

1282

cert = cert_list[0]

1491

1308

if crtverify.value != 0:

1492

1309

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1493

1310

raise (gnutls.errors.CertificateSecurityError

1494

("Verify failed"))

1311

(u"Verify failed"))

1495

1312

# New buffer for the fingerprint

1496

1313

buf = ctypes.create_string_buffer(20)

1497

1314

buf_len = ctypes.c_size_t()

1504

1321

# Convert the buffer to a Python bytestring

1505

1322

fpr = ctypes.string_at(buf, buf_len.value)

1506

1323

# Convert the bytestring to hexadecimal notation

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1324

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1508

1325

return hex_fpr

1509

1326

1510

1327

1522

1339

multiprocessing.Process(target = self.sub_process_main,

1523

1340

args = (request, address)).start()

1524

1341

1525

1526

1342

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1527

1343

""" adds a pipe to the MixIn """

1528

1344

def process_request(self, request, client_address):

1531

1347

This function creates a new pipe in self.pipe

1532

1348

"""

1533

1349

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1534

1350

1535

1351

super(MultiprocessingMixInWithPipe,

1536

1352

self).process_request(request, client_address)

1537

1353

self.child_pipe.close()

1538

1354

self.add_pipe(parent_pipe)

1539

1355

1540

1356

def add_pipe(self, parent_pipe):

1541

1357

"""Dummy function; override as necessary"""

1542

raise NotImplementedError

1543

1358

pass

1544

1359

1545

1360

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1546

1361

socketserver.TCPServer, object):

1564

1379

bind to an address or port if they were not specified."""

1565

1380

if self.interface is not None:

1566

1381

if SO_BINDTODEVICE is None:

1567

logger.error("SO_BINDTODEVICE does not exist;"

1568

" cannot bind to interface %s",

1382

logger.error(u"SO_BINDTODEVICE does not exist;"

1383

u" cannot bind to interface %s",

1569

1384

self.interface)

1570

1385

else:

1571

1386

try:

1572

1387

self.socket.setsockopt(socket.SOL_SOCKET,

1573

1388

SO_BINDTODEVICE,

1574

1389

str(self.interface

1575

+ '\0'))

1576

except socket.error as error:

1390

+ u'\0'))

1391

except socket.error, error:

1577

1392

if error[0] == errno.EPERM:

1578

logger.error("No permission to"

1579

" bind to interface %s",

1393

logger.error(u"No permission to"

1394

u" bind to interface %s",

1580

1395

self.interface)

1581

1396

elif error[0] == errno.ENOPROTOOPT:

1582

logger.error("SO_BINDTODEVICE not available;"

1583

" cannot bind to interface %s",

1397

logger.error(u"SO_BINDTODEVICE not available;"

1398

u" cannot bind to interface %s",

1584

1399

self.interface)

1585

1400

else:

1586

1401

raise

1588

1403

if self.server_address[0] or self.server_address[1]:

1589

1404

if not self.server_address[0]:

1590

1405

if self.address_family == socket.AF_INET6:

1591

any_address = "::" # in6addr_any

1406

any_address = u"::" # in6addr_any

1592

1407

else:

1593

1408

any_address = socket.INADDR_ANY

1594

1409

self.server_address = (any_address,

1638

1453

gobject.io_add_watch(parent_pipe.fileno(),

1639

1454

gobject.IO_IN | gobject.IO_HUP,

1640

1455

functools.partial(self.handle_ipc,

1641

parent_pipe =

1642

parent_pipe))

1456

parent_pipe = parent_pipe))

1643

1457

1644

1458

def handle_ipc(self, source, condition, parent_pipe=None,

1645

1459

client_object=None):

1646

1460

condition_names = {

1647

gobject.IO_IN: "IN", # There is data to read.

1648

gobject.IO_OUT: "OUT", # Data can be written (without

1461

gobject.IO_IN: u"IN", # There is data to read.

1462

gobject.IO_OUT: u"OUT", # Data can be written (without

1649

1463

# blocking).

1650

gobject.IO_PRI: "PRI", # There is urgent data to read.

1651

gobject.IO_ERR: "ERR", # Error condition.

1652

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1464

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1465

gobject.IO_ERR: u"ERR", # Error condition.

1466

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1653

1467

# broken, usually for pipes and

1654

1468

# sockets).

1655

1469

}

1657

1471

for cond, name in

1658

1472

condition_names.iteritems()

1659

1473

if cond & condition)

1474

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1475

conditions_string)

1476

1660

1477

# error or the other end of multiprocessing.Pipe has closed

1661

1478

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1662

1479

return False

1663

1480

1664

1481

# Read a request from the child

1665

1482

request = parent_pipe.recv()

1483

logger.debug(u"IPC request: %s", repr(request))

1666

1484

command = request[0]

1667

1485

1668

1486

if command == 'init':

1674

1492

client = c

1675

1493

break

1676

1494

else:

1677

logger.info("Client not found for fingerprint: %s, ad"

1678

"dress: %s", fpr, address)

1495

logger.warning(u"Client not found for fingerprint: %s, ad"

1496

u"dress: %s", fpr, address)

1679

1497

if self.use_dbus:

1680

1498

# Emit D-Bus signal

1681

mandos_dbus_service.ClientNotFound(fpr,

1682

address[0])

1499

mandos_dbus_service.ClientNotFound(fpr, address)

1683

1500

parent_pipe.send(False)

1684

1501

return False

1685

1502

1686

1503

gobject.io_add_watch(parent_pipe.fileno(),

1687

1504

gobject.IO_IN | gobject.IO_HUP,

1688

1505

functools.partial(self.handle_ipc,

1689

parent_pipe =

1690

parent_pipe,

1691

client_object =

1692

client))

1506

parent_pipe = parent_pipe,

1507

client_object = client))

1693

1508

parent_pipe.send(True)

1694

# remove the old hook in favor of the new above hook on

1695

# same fileno

1509

# remove the old hook in favor of the new above hook on same fileno

1696

1510

return False

1697

1511

if command == 'funcall':

1698

1512

funcname = request[1]

1699

1513

args = request[2]

1700

1514

kwargs = request[3]

1701

1515

1702

parent_pipe.send(('data', getattr(client_object,

1703

funcname)(*args,

1704

**kwargs)))

1705

1516

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1517

1706

1518

if command == 'getattr':

1707

1519

attrname = request[1]

1708

1520

if callable(client_object.__getattribute__(attrname)):

1709

1521

parent_pipe.send(('function',))

1710

1522

else:

1711

parent_pipe.send(('data', client_object

1712

.__getattribute__(attrname)))

1523

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1713

1524

1714

1525

if command == 'setattr':

1715

1526

attrname = request[1]

1716

1527

value = request[2]

1717

1528

setattr(client_object, attrname, value)

1718

1529

1719

1530

return True

1720

1531

1721

1532

1722

1533

def string_to_delta(interval):

1723

1534

"""Parse a string and return a datetime.timedelta

1724

1535

1725

>>> string_to_delta('7d')

1536

>>> string_to_delta(u'7d')

1726

1537

datetime.timedelta(7)

1727

>>> string_to_delta('60s')

1538

>>> string_to_delta(u'60s')

1728

1539

datetime.timedelta(0, 60)

1729

>>> string_to_delta('60m')

1540

>>> string_to_delta(u'60m')

1730

1541

datetime.timedelta(0, 3600)

1731

>>> string_to_delta('24h')

1542

>>> string_to_delta(u'24h')

1732

1543

datetime.timedelta(1)

1733

>>> string_to_delta('1w')

1544

>>> string_to_delta(u'1w')

1734

1545

datetime.timedelta(7)

1735

>>> string_to_delta('5m 30s')

1546

>>> string_to_delta(u'5m 30s')

1736

1547

datetime.timedelta(0, 330)

1737

1548

"""

1738

1549

timevalue = datetime.timedelta(0)

1740

1551

try:

1741

1552

suffix = unicode(s[-1])

1742

1553

value = int(s[:-1])

1743

if suffix == "d":

1554

if suffix == u"d":

1744

1555

delta = datetime.timedelta(value)

1745

elif suffix == "s":

1556

elif suffix == u"s":

1746

1557

delta = datetime.timedelta(0, value)

1747

elif suffix == "m":

1558

elif suffix == u"m":

1748

1559

delta = datetime.timedelta(0, 0, 0, 0, value)

1749

elif suffix == "h":

1560

elif suffix == u"h":

1750

1561

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1751

elif suffix == "w":

1562

elif suffix == u"w":

1752

1563

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1753

1564

else:

1754

raise ValueError("Unknown suffix %r" % suffix)

1755

except (ValueError, IndexError) as e:

1756

raise ValueError(*(e.args))

1565

raise ValueError(u"Unknown suffix %r" % suffix)

1566

except (ValueError, IndexError), e:

1567

raise ValueError(e.message)

1757

1568

timevalue += delta

1758

1569

return timevalue

1759

1570

1765

1576

global if_nametoindex

1766

1577

try:

1767

1578

if_nametoindex = (ctypes.cdll.LoadLibrary

1768

(ctypes.util.find_library("c"))

1579

(ctypes.util.find_library(u"c"))

1769

1580

.if_nametoindex)

1770

1581

except (OSError, AttributeError):

1771

logger.warning("Doing if_nametoindex the hard way")

1582

logger.warning(u"Doing if_nametoindex the hard way")

1772

1583

def if_nametoindex(interface):

1773

1584

"Get an interface index the hard way, i.e. using fcntl()"

1774

1585

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1775

1586

with contextlib.closing(socket.socket()) as s:

1776

1587

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1777

struct.pack(str("16s16x"),

1588

struct.pack(str(u"16s16x"),

1778

1589

interface))

1779

interface_index = struct.unpack(str("I"),

1590

interface_index = struct.unpack(str(u"I"),

1780

1591

ifreq[16:20])[0]

1781

1592

return interface_index

1782

1593

return if_nametoindex(interface)

1790

1601

sys.exit()

1791

1602

os.setsid()

1792

1603

if not nochdir:

1793

os.chdir("/")

1604

os.chdir(u"/")

1794

1605

if os.fork():

1795

1606

sys.exit()

1796

1607

if not noclose:

1798

1609

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1799

1610

if not stat.S_ISCHR(os.fstat(null).st_mode):

1800

1611

raise OSError(errno.ENODEV,

1801

"%s not a character device"

1612

u"%s not a character device"

1802

1613

% os.path.devnull)

1803

1614

os.dup2(null, sys.stdin.fileno())

1804

1615

os.dup2(null, sys.stdout.fileno())

1812

1623

##################################################################

1813

1624

# Parsing of options, both command line and config file

1814

1625

1815

parser = argparse.ArgumentParser()

1816

parser.add_argument("-v", "--version", action="version",

1817

version = "%%(prog)s %s" % version,

1818

help="show version number and exit")

1819

parser.add_argument("-i", "--interface", metavar="IF",

1820

help="Bind to interface IF")

1821

parser.add_argument("-a", "--address",

1822

help="Address to listen for requests on")

1823

parser.add_argument("-p", "--port", type=int,

1824

help="Port number to receive requests on")

1825

parser.add_argument("--check", action="store_true",

1826

help="Run self-test")

1827

parser.add_argument("--debug", action="store_true",

1828

help="Debug mode; run in foreground and log"

1829

" to terminal")

1830

parser.add_argument("--debuglevel", metavar="LEVEL",

1831

help="Debug level for stdout output")

1832

parser.add_argument("--priority", help="GnuTLS"

1833

" priority string (see GnuTLS documentation)")

1834

parser.add_argument("--servicename",

1835

metavar="NAME", help="Zeroconf service name")

1836

parser.add_argument("--configdir",

1837

default="/etc/mandos", metavar="DIR",

1838

help="Directory to search for configuration"

1839

" files")

1840

parser.add_argument("--no-dbus", action="store_false",

1841

dest="use_dbus", help="Do not provide D-Bus"

1842

" system bus interface")

1843

parser.add_argument("--no-ipv6", action="store_false",

1844

dest="use_ipv6", help="Do not use IPv6")

1845

options = parser.parse_args()

1626

parser = optparse.OptionParser(version = "%%prog %s" % version)

1627

parser.add_option("-i", u"--interface", type=u"string",

1628

metavar="IF", help=u"Bind to interface IF")

1629

parser.add_option("-a", u"--address", type=u"string",

1630

help=u"Address to listen for requests on")

1631

parser.add_option("-p", u"--port", type=u"int",

1632

help=u"Port number to receive requests on")

1633

parser.add_option("--check", action=u"store_true",

1634

help=u"Run self-test")

1635

parser.add_option("--debug", action=u"store_true",

1636

help=u"Debug mode; run in foreground and log to"

1637

u" terminal")

1638

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1639

help=u"Debug level for stdout output")

1640

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1641

u" priority string (see GnuTLS documentation)")

1642

parser.add_option("--servicename", type=u"string",

1643

metavar=u"NAME", help=u"Zeroconf service name")

1644

parser.add_option("--configdir", type=u"string",

1645

default=u"/etc/mandos", metavar=u"DIR",

1646

help=u"Directory to search for configuration"

1647

u" files")

1648

parser.add_option("--no-dbus", action=u"store_false",

1649

dest=u"use_dbus", help=u"Do not provide D-Bus"

1650

u" system bus interface")

1651

parser.add_option("--no-ipv6", action=u"store_false",

1652

dest=u"use_ipv6", help=u"Do not use IPv6")

1653

options = parser.parse_args()[0]

1846

1654

1847

1655

if options.check:

1848

1656

import doctest

1850

1658

sys.exit()

1851

1659

1852

1660

# Default values for config file for server-global settings

1853

server_defaults = { "interface": "",

1854

"address": "",

1855

"port": "",

1856

"debug": "False",

1857

"priority":

1858

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1859

"servicename": "Mandos",

1860

"use_dbus": "True",

1861

"use_ipv6": "True",

1862

"debuglevel": "",

1661

server_defaults = { u"interface": u"",

1662

u"address": u"",

1663

u"port": u"",

1664

u"debug": u"False",

1665

u"priority":

1666

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1667

u"servicename": u"Mandos",

1668

u"use_dbus": u"True",

1669

u"use_ipv6": u"True",

1670

u"debuglevel": u"",

1863

1671

}

1864

1672

1865

1673

# Parse config file for server-global settings

1866

1674

server_config = configparser.SafeConfigParser(server_defaults)

1867

1675

del server_defaults

1868

1676

server_config.read(os.path.join(options.configdir,

1869

"mandos.conf"))

1677

u"mandos.conf"))

1870

1678

# Convert the SafeConfigParser object to a dict

1871

1679

server_settings = server_config.defaults()

1872

1680

# Use the appropriate methods on the non-string config options

1873

for option in ("debug", "use_dbus", "use_ipv6"):

1874

server_settings[option] = server_config.getboolean("DEFAULT",

1681

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1682

server_settings[option] = server_config.getboolean(u"DEFAULT",

1875

1683

option)

1876

1684

if server_settings["port"]:

1877

server_settings["port"] = server_config.getint("DEFAULT",

1878

"port")

1685

server_settings["port"] = server_config.getint(u"DEFAULT",

1686

u"port")

1879

1687

del server_config

1880

1688

1881

1689

# Override the settings from the config file with command line

1882

1690

# options, if set.

1883

for option in ("interface", "address", "port", "debug",

1884

"priority", "servicename", "configdir",

1885

"use_dbus", "use_ipv6", "debuglevel"):

1691

for option in (u"interface", u"address", u"port", u"debug",

1692

u"priority", u"servicename", u"configdir",

1693

u"use_dbus", u"use_ipv6", u"debuglevel"):

1886

1694

value = getattr(options, option)

1887

1695

if value is not None:

1888

1696

server_settings[option] = value

1896

1704

##################################################################

1897

1705

1898

1706

# For convenience

1899

debug = server_settings["debug"]

1900

debuglevel = server_settings["debuglevel"]

1901

use_dbus = server_settings["use_dbus"]

1902

use_ipv6 = server_settings["use_ipv6"]

1903

1904

if server_settings["servicename"] != "Mandos":

1707

debug = server_settings[u"debug"]

1708

debuglevel = server_settings[u"debuglevel"]

1709

use_dbus = server_settings[u"use_dbus"]

1710

use_ipv6 = server_settings[u"use_ipv6"]

1711

1712

if server_settings[u"servicename"] != u"Mandos":

1905

1713

syslogger.setFormatter(logging.Formatter

1906

('Mandos (%s) [%%(process)d]:'

1907

' %%(levelname)s: %%(message)s'

1908

% server_settings["servicename"]))

1714

(u'Mandos (%s) [%%(process)d]:'

1715

u' %%(levelname)s: %%(message)s'

1716

% server_settings[u"servicename"]))

1909

1717

1910

1718

# Parse config file with clients

1911

client_defaults = { "timeout": "5m",

1912

"extended_timeout": "15m",

1913

"interval": "2m",

1914

"checker": "fping -q -- %%(host)s",

1915

"host": "",

1916

"approval_delay": "0s",

1917

"approval_duration": "1s",

1719

client_defaults = { u"timeout": u"1h",

1720

u"interval": u"5m",

1721

u"checker": u"fping -q -- %%(host)s",

1722

u"host": u"",

1723

u"approved_delay": u"0s",

1724

u"approved_duration": u"1s",

1918

1725

}

1919

1726

client_config = configparser.SafeConfigParser(client_defaults)

1920

client_config.read(os.path.join(server_settings["configdir"],

1921

"clients.conf"))

1727

client_config.read(os.path.join(server_settings[u"configdir"],

1728

u"clients.conf"))

1922

1729

1923

1730

global mandos_dbus_service

1924

1731

mandos_dbus_service = None

1925

1732

1926

tcp_server = MandosServer((server_settings["address"],

1927

server_settings["port"]),

1733

tcp_server = MandosServer((server_settings[u"address"],

1734

server_settings[u"port"]),

1928

1735

ClientHandler,

1929

interface=(server_settings["interface"]

1930

or None),

1736

interface=server_settings[u"interface"],

1931

1737

use_ipv6=use_ipv6,

1932

1738

gnutls_priority=

1933

server_settings["priority"],

1739

server_settings[u"priority"],

1934

1740

use_dbus=use_dbus)

1935

if not debug:

1936

pidfilename = "/var/run/mandos.pid"

1937

try:

1938

pidfile = open(pidfilename, "w")

1939

except IOError:

1940

logger.error("Could not open file %r", pidfilename)

1741

pidfilename = u"/var/run/mandos.pid"

1742

try:

1743

pidfile = open(pidfilename, u"w")

1744

except IOError:

1745

logger.error(u"Could not open file %r", pidfilename)

1941

1746

1942

1747

try:

1943

uid = pwd.getpwnam("_mandos").pw_uid

1944

gid = pwd.getpwnam("_mandos").pw_gid

1748

uid = pwd.getpwnam(u"_mandos").pw_uid

1749

gid = pwd.getpwnam(u"_mandos").pw_gid

1945

1750

except KeyError:

1946

1751

try:

1947

uid = pwd.getpwnam("mandos").pw_uid

1948

gid = pwd.getpwnam("mandos").pw_gid

1752

uid = pwd.getpwnam(u"mandos").pw_uid

1753

gid = pwd.getpwnam(u"mandos").pw_gid

1949

1754

except KeyError:

1950

1755

try:

1951

uid = pwd.getpwnam("nobody").pw_uid

1952

gid = pwd.getpwnam("nobody").pw_gid

1756

uid = pwd.getpwnam(u"nobody").pw_uid

1757

gid = pwd.getpwnam(u"nobody").pw_gid

1953

1758

except KeyError:

1954

1759

uid = 65534

1955

1760

gid = 65534

1956

1761

try:

1957

1762

os.setgid(gid)

1958

1763

os.setuid(uid)

1959

except OSError as error:

1764

except OSError, error:

1960

1765

if error[0] != errno.EPERM:

1961

1766

raise error

1962

1767

1768

# Enable all possible GnuTLS debugging

1769

1770

1963

1771

if not debug and not debuglevel:

1964

1772

syslogger.setLevel(logging.WARNING)

1965

1773

console.setLevel(logging.WARNING)

1967

1775

level = getattr(logging, debuglevel.upper())

1968

1776

syslogger.setLevel(level)

1969

1777

console.setLevel(level)

1970

1778

1971

1779

if debug:

1972

# Enable all possible GnuTLS debugging

1973

1974

1780

# "Use a log level over 10 to enable all debugging options."

1975

1781

# - GnuTLS manual

1976

1782

gnutls.library.functions.gnutls_global_set_log_level(11)

1977

1783

1978

1784

@gnutls.library.types.gnutls_log_func

1979

1785

def debug_gnutls(level, string):

1980

logger.debug("GnuTLS: %s", string[:-1])

1786

logger.debug(u"GnuTLS: %s", string[:-1])

1981

1787

1982

1788

(gnutls.library.functions

1983

1789

.gnutls_global_set_log_function(debug_gnutls))

1984

1790

1985

1791

# Redirect stdin so all checkers get /dev/null

1986

1792

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1987

1793

os.dup2(null, sys.stdin.fileno())

1990

1796

else:

1991

1797

# No console logging

1992

1798

logger.removeHandler(console)

1993

1994

# Need to fork before connecting to D-Bus

1995

if not debug:

1996

# Close all input and output, do double fork, etc.

1997

daemon()

1799

1998

1800

1999

1801

global main_loop

2000

1802

# From the Avahi example code

2004

1806

# End of Avahi example code

2005

1807

if use_dbus:

2006

1808

try:

2007

bus_name = dbus.service.BusName("se.recompile.Mandos",

1809

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2008

1810

bus, do_not_queue=True)

2009

old_bus_name = (dbus.service.BusName

2010

("se.bsnet.fukt.Mandos", bus,

2011

do_not_queue=True))

2012

except dbus.exceptions.NameExistsException as e:

2013

logger.error(unicode(e) + ", disabling D-Bus")

1811

except dbus.exceptions.NameExistsException, e:

1812

logger.error(unicode(e) + u", disabling D-Bus")

2014

1813

use_dbus = False

2015

server_settings["use_dbus"] = False

1814

server_settings[u"use_dbus"] = False

2016

1815

tcp_server.use_dbus = False

2017

1816

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2018

service = AvahiService(name = server_settings["servicename"],

2019

servicetype = "_mandos._tcp",

1817

service = AvahiService(name = server_settings[u"servicename"],

1818

servicetype = u"_mandos._tcp",

2020

1819

protocol = protocol, bus = bus)

2021

1820

if server_settings["interface"]:

2022

1821

service.interface = (if_nametoindex

2023

(str(server_settings["interface"])))

2024

1822

(str(server_settings[u"interface"])))

1823

1824

if not debug:

1825

# Close all input and output, do double fork, etc.

1826

daemon()

1827

2025

1828

global multiprocessing_manager

2026

1829

multiprocessing_manager = multiprocessing.Manager()

2027

1830

2028

1831

client_class = Client

2029

1832

if use_dbus:

2030

client_class = functools.partial(ClientDBusTransitional,

2031

bus = bus)

1833

client_class = functools.partial(ClientDBus, bus = bus)

2032

1834

def client_config_items(config, section):

2033

1835

special_settings = {

2034

1836

"approved_by_default":

2047

1849

client_config, section)))

2048

1850

for section in client_config.sections()))

2049

1851

if not tcp_server.clients:

2050

logger.warning("No clients defined")

1852

logger.warning(u"No clients defined")

2051

1853

1854

try:

1855

with pidfile:

1856

pid = os.getpid()

1857

pidfile.write(str(pid) + "\n")

1858

del pidfile

1859

except IOError:

1860

logger.error(u"Could not write to file %r with PID %d",

1861

pidfilename, pid)

1862

except NameError:

1863

# "pidfile" was never created

1864

pass

1865

del pidfilename

1866

2052

1867

if not debug:

2053

try:

2054

with pidfile:

2055

pid = os.getpid()

2056

pidfile.write(str(pid) + "\n".encode("utf-8"))

2057

del pidfile

2058

except IOError:

2059

logger.error("Could not write to file %r with PID %d",

2060

pidfilename, pid)

2061

except NameError:

2062

# "pidfile" was never created

2063

pass

2064

del pidfilename

2065

2066

1868

signal.signal(signal.SIGINT, signal.SIG_IGN)

2067

2068

1869

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2069

1870

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2070

1871

2072

1873

class MandosDBusService(dbus.service.Object):

2073

1874

"""A D-Bus proxy object"""

2074

1875

def __init__(self):

2075

dbus.service.Object.__init__(self, bus, "/")

2076

_interface = "se.recompile.Mandos"

1876

dbus.service.Object.__init__(self, bus, u"/")

1877

_interface = u"se.bsnet.fukt.Mandos"

2077

1878

2078

@dbus.service.signal(_interface, signature="o")

1879

@dbus.service.signal(_interface, signature=u"o")

2079

1880

def ClientAdded(self, objpath):

2080

1881

"D-Bus signal"

2081

1882

pass

2082

1883

2083

@dbus.service.signal(_interface, signature="ss")

1884

@dbus.service.signal(_interface, signature=u"ss")

2084

1885

def ClientNotFound(self, fingerprint, address):

2085

1886

"D-Bus signal"

2086

1887

pass

2087

1888

2088

@dbus.service.signal(_interface, signature="os")

1889

@dbus.service.signal(_interface, signature=u"os")

2089

1890

def ClientRemoved(self, objpath, name):

2090

1891

"D-Bus signal"

2091

1892

pass

2092

1893

2093

@dbus.service.method(_interface, out_signature="ao")

1894

@dbus.service.method(_interface, out_signature=u"ao")

2094

1895

def GetAllClients(self):

2095

1896

"D-Bus method"

2096

1897

return dbus.Array(c.dbus_object_path

2097

1898

for c in tcp_server.clients)

2098

1899

2099

1900

@dbus.service.method(_interface,

2100

out_signature="a{oa{sv}}")

1901

out_signature=u"a{oa{sv}}")

2101

1902

def GetAllClientsWithProperties(self):

2102

1903

"D-Bus method"

2103

1904

return dbus.Dictionary(

2104

((c.dbus_object_path, c.GetAll(""))

1905

((c.dbus_object_path, c.GetAll(u""))

2105

1906

for c in tcp_server.clients),

2106

signature="oa{sv}")

1907

signature=u"oa{sv}")

2107

1908

2108

@dbus.service.method(_interface, in_signature="o")

1909

@dbus.service.method(_interface, in_signature=u"o")

2109

1910

def RemoveClient(self, object_path):

2110

1911

"D-Bus method"

2111

1912

for c in tcp_server.clients:

2121

1922

2122

1923

del _interface

2123

1924

2124

class MandosDBusServiceTransitional(MandosDBusService):

2125

__metaclass__ = AlternateDBusNamesMetaclass

2126

mandos_dbus_service = MandosDBusServiceTransitional()

1925

mandos_dbus_service = MandosDBusService()

2127

1926

2128

1927

def cleanup():

2129

1928

"Cleanup function; run on exit"

2138

1937

client.disable(quiet=True)

2139

1938

if use_dbus:

2140

1939

# Emit D-Bus signal

2141

mandos_dbus_service.ClientRemoved(client

2142

.dbus_object_path,

1940

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2143

1941

client.name)

2144

1942

2145

1943

atexit.register(cleanup)

2156

1954

# Find out what port we got

2157

1955

service.port = tcp_server.socket.getsockname()[1]

2158

1956

if use_ipv6:

2159

logger.info("Now listening on address %r, port %d,"

1957

logger.info(u"Now listening on address %r, port %d,"

2160

1958

" flowinfo %d, scope_id %d"

2161

1959

% tcp_server.socket.getsockname())

2162

1960

else: # IPv4

2163

logger.info("Now listening on address %r, port %d"

1961

logger.info(u"Now listening on address %r, port %d"

2164

1962

% tcp_server.socket.getsockname())

2165

1963

2166

1964

#service.interface = tcp_server.socket.getsockname()[3]

2169

1967

# From the Avahi example code

2170

1968

try:

2171

1969

service.activate()

2172

except dbus.exceptions.DBusException as error:

2173

logger.critical("DBusException: %s", error)

1970

except dbus.exceptions.DBusException, error:

1971

logger.critical(u"DBusException: %s", error)

2174

1972

cleanup()

2175

1973

sys.exit(1)

2176

1974

# End of Avahi example code

2180

1978

(tcp_server.handle_request

2181

1979

(*args[2:], **kwargs) or True))

2182

1980

2183

logger.debug("Starting main loop")

1981

logger.debug(u"Starting main loop")

2184

1982

main_loop.run()

2185

except AvahiError as error:

2186

logger.critical("AvahiError: %s", error)

1983

except AvahiError, error:

1984

logger.critical(u"AvahiError: %s", error)

2187

1985

cleanup()

2188

1986

sys.exit(1)

2189

1987

except KeyboardInterrupt:

2190

1988

if debug:

2191

print("", file=sys.stderr)

2192

logger.debug("Server received KeyboardInterrupt")

2193

logger.debug("Server exiting")

1989

print >> sys.stderr

1990

logger.debug(u"Server received KeyboardInterrupt")

1991

logger.debug(u"Server exiting")

2194

1992

# Must run before the D-Bus bus name gets deregistered

2195

1993

cleanup()

2196

1994

2197

2198

1995

if __name__ == '__main__':

2199

1996

main()