/mandos/trunk : revision 24.1.164

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@recompile.se>.

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

62

61

import functools

63

62

import cPickle as pickle

64

63

import multiprocessing

65

import types

66

64

67

65

import dbus

68

66

import dbus.service

83

81

SO_BINDTODEVICE = None

84

82

85

83

86

version = "1.4.1"

84

version = "1.0.14"

87

85

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

90

88

syslogger = (logging.handlers.SysLogHandler

91

89

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

address = str("/dev/log")))

90

address = "/dev/log"))

93

91

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

96

94

logger.addHandler(syslogger)

97

95

98

96

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

102

100

logger.addHandler(console)

103

101

104

102

class AvahiError(Exception):

121

119

Attributes:

122

120

interface: integer; avahi.IF_UNSPEC or an interface index.

123

121

Used to optionally bind to the specified interface.

124

125

type: string; Example: '_mandos._tcp'.

122

123

type: string; Example: u'_mandos._tcp'.

126

124

See <http://www.dns-sd.org/ServiceTypes.html>

127

125

port: integer; what port to announce

128

126

TXT: list of strings; TXT record for the service

137

135

"""

138

136

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

139

137

servicetype = None, port = None, TXT = None,

140

domain = "", host = "", max_renames = 32768,

138

domain = u"", host = u"", max_renames = 32768,

141

139

protocol = avahi.PROTO_UNSPEC, bus = None):

142

140

self.interface = interface

143

141

self.name = name

152

150

self.group = None # our entry group

153

151

self.server = None

154

152

self.bus = bus

155

self.entry_group_state_changed_match = None

156

153

def rename(self):

157

154

"""Derived from the Avahi example code"""

158

155

if self.rename_count >= self.max_renames:

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

161

158

self.rename_count)

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server

164

.GetAlternativeServiceName(self.name))

165

logger.info("Changing Zeroconf service name to %r ...",

159

raise AvahiServiceError(u"Too many renames")

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

166

162

self.name)

167

163

syslogger.setFormatter(logging.Formatter

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

170

166

% self.name))

171

167

self.remove()

172

168

try:

173

169

self.add()

174

except dbus.exceptions.DBusException as error:

175

logger.critical("DBusException: %s", error)

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

176

172

self.cleanup()

177

173

os._exit(1)

178

174

self.rename_count += 1

179

175

def remove(self):

180

176

"""Derived from the Avahi example code"""

181

if self.entry_group_state_changed_match is not None:

182

self.entry_group_state_changed_match.remove()

183

self.entry_group_state_changed_match = None

184

177

if self.group is not None:

185

178

self.group.Reset()

186

179

def add(self):

187

180

"""Derived from the Avahi example code"""

188

self.remove()

189

181

if self.group is None:

190

182

self.group = dbus.Interface(

191

183

self.bus.get_object(avahi.DBUS_NAME,

192

184

self.server.EntryGroupNew()),

193

185

avahi.DBUS_INTERFACE_ENTRY_GROUP)

194

self.entry_group_state_changed_match = (

195

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

186

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

198

190

self.name, self.type)

199

191

self.group.AddService(

200

192

self.interface,

207

199

self.group.Commit()

208

200

def entry_group_state_changed(self, state, error):

209

201

"""Derived from the Avahi example code"""

210

logger.debug("Avahi entry group state change: %i", state)

202

logger.debug(u"Avahi entry group state change: %i", state)

211

203

212

204

if state == avahi.ENTRY_GROUP_ESTABLISHED:

213

logger.debug("Zeroconf service established.")

205

logger.debug(u"Zeroconf service established.")

214

206

elif state == avahi.ENTRY_GROUP_COLLISION:

215

logger.info("Zeroconf service name collision.")

207

logger.warning(u"Zeroconf service name collision.")

216

208

self.rename()

217

209

elif state == avahi.ENTRY_GROUP_FAILURE:

218

logger.critical("Avahi: Error in group state changed %s",

210

logger.critical(u"Avahi: Error in group state changed %s",

219

211

unicode(error))

220

raise AvahiGroupError("State changed: %s"

212

raise AvahiGroupError(u"State changed: %s"

221

213

% unicode(error))

222

214

def cleanup(self):

223

215

"""Derived from the Avahi example code"""

224

216

if self.group is not None:

225

try:

226

self.group.Free()

227

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

229

pass

217

self.group.Free()

230

218

self.group = None

231

self.remove()

232

def server_state_changed(self, state, error=None):

219

def server_state_changed(self, state):

233

220

"""Derived from the Avahi example code"""

234

logger.debug("Avahi server state change: %i", state)

235

bad_states = { avahi.SERVER_INVALID:

236

"Zeroconf server invalid",

237

avahi.SERVER_REGISTERING: None,

238

avahi.SERVER_COLLISION:

239

"Zeroconf server name collision",

240

avahi.SERVER_FAILURE:

241

"Zeroconf server failure" }

242

if state in bad_states:

243

if bad_states[state] is not None:

244

if error is None:

245

logger.error(bad_states[state])

246

else:

247

logger.error(bad_states[state] + ": %r", error)

248

self.cleanup()

221

logger.debug(u"Avahi server state change: %i", state)

222

if state == avahi.SERVER_COLLISION:

223

logger.error(u"Zeroconf server name collision")

224

self.remove()

249

225

elif state == avahi.SERVER_RUNNING:

250

226

self.add()

251

else:

252

if error is None:

253

logger.debug("Unknown state: %r", state)

254

else:

255

logger.debug("Unknown state: %r: %r", state, error)

256

227

def activate(self):

257

228

"""Derived from the Avahi example code"""

258

229

if self.server is None:

259

230

self.server = dbus.Interface(

260

231

self.bus.get_object(avahi.DBUS_NAME,

261

avahi.DBUS_PATH_SERVER,

262

follow_name_owner_changes=True),

232

avahi.DBUS_PATH_SERVER),

263

233

avahi.DBUS_INTERFACE_SERVER)

264

self.server.connect_to_signal("StateChanged",

234

self.server.connect_to_signal(u"StateChanged",

265

235

self.server_state_changed)

266

236

self.server_state_changed(self.server.GetState())

267

237

268

238

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

274

275

239

class Client(object):

276

240

"""A representation of a client host served by this server.

277

241

278

242

Attributes:

279

_approved: bool(); 'None' if not yet approved/disapproved

280

approval_delay: datetime.timedelta(); Time to wait for approval

281

approval_duration: datetime.timedelta(); Duration of one approval

243

244

D-Bus identifiers

245

fingerprint: string (40 or 32 hexadecimal digits); used to

246

uniquely identify the client

247

secret: bytestring; sent verbatim (over TLS) to client

248

host: string; available for use by the checker command

249

created: datetime.datetime(); (UTC) object creation

250

last_enabled: datetime.datetime(); (UTC)

251

enabled: bool()

252

last_checked_ok: datetime.datetime(); (UTC) or None

253

timeout: datetime.timedelta(); How long from last_checked_ok

254

until this client is disabled

255

interval: datetime.timedelta(); How often to start a new checker

256

disable_hook: If set, called by disable() as disable_hook(self)

282

257

checker: subprocess.Popen(); a running checker process used

283

258

to see if the client lives.

284

259

'None' if no process is running.

285

checker_callback_tag: a gobject event source tag, or None

286

checker_command: string; External command which is run to check

287

if client lives. %() expansions are done at

260

checker_initiator_tag: a gobject event source tag, or None

261

disable_initiator_tag: - '' -

262

checker_callback_tag: - '' -

263

checker_command: string; External command which is run to check if

264

client lives. %() expansions are done at

288

265

runtime with vars(self) as dict, so that for

289

266

instance %(name)s can be used in the command.

290

checker_initiator_tag: a gobject event source tag, or None

291

created: datetime.datetime(); (UTC) object creation

292

267

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

294

disable_initiator_tag: a gobject event source tag, or None

295

enabled: bool()

296

fingerprint: string (40 or 32 hexadecimal digits); used to

297

uniquely identify the client

298

host: string; available for use by the checker command

299

interval: datetime.timedelta(); How often to start a new checker

300

last_approval_request: datetime.datetime(); (UTC) or None

301

last_checked_ok: datetime.datetime(); (UTC) or None

302

last_enabled: datetime.datetime(); (UTC)

303

304

D-Bus identifiers

305

secret: bytestring; sent verbatim (over TLS) to client

306

timeout: datetime.timedelta(); How long from last_checked_ok

307

until this client is disabled

308

extended_timeout: extra long timeout when password has been sent

309

runtime_expansions: Allowed attributes for runtime expansion.

310

expires: datetime.datetime(); time (UTC) when a client will be

311

disabled, or None

268

approval_delay: datetime.timedelta(); Time to wait for approval

269

_approved: bool(); 'None' if not yet approved/disapproved

270

approval_duration: datetime.timedelta(); Duration of one approval

312

271

"""

313

272

314

runtime_expansions = ("approval_delay", "approval_duration",

315

"created", "enabled", "fingerprint",

316

"host", "interval", "last_checked_ok",

317

"last_enabled", "name", "timeout")

273

@staticmethod

274

def _timedelta_to_milliseconds(td):

275

"Convert a datetime.timedelta() to milliseconds"

276

return ((td.days * 24 * 60 * 60 * 1000)

277

+ (td.seconds * 1000)

278

+ (td.microseconds // 1000))

318

279

319

280

def timeout_milliseconds(self):

320

281

"Return the 'timeout' attribute in milliseconds"

321

return _timedelta_to_milliseconds(self.timeout)

322

323

def extended_timeout_milliseconds(self):

324

"Return the 'extended_timeout' attribute in milliseconds"

325

return _timedelta_to_milliseconds(self.extended_timeout)

282

return self._timedelta_to_milliseconds(self.timeout)

326

283

327

284

def interval_milliseconds(self):

328

285

"Return the 'interval' attribute in milliseconds"

329

return _timedelta_to_milliseconds(self.interval)

330

286

return self._timedelta_to_milliseconds(self.interval)

287

331

288

def approval_delay_milliseconds(self):

332

return _timedelta_to_milliseconds(self.approval_delay)

289

return self._timedelta_to_milliseconds(self.approval_delay)

333

290

334

291

def __init__(self, name = None, disable_hook=None, config=None):

335

292

"""Note: the 'checker' key in 'config' sets the

338

295

self.name = name

339

296

if config is None:

340

297

config = {}

341

logger.debug("Creating client %r", self.name)

298

logger.debug(u"Creating client %r", self.name)

342

299

# Uppercase and remove spaces from fingerprint for later

343

300

# comparison purposes with return value from the fingerprint()

344

301

# function

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

347

logger.debug(" Fingerprint: %s", self.fingerprint)

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

302

self.fingerprint = (config[u"fingerprint"].upper()

303

.replace(u" ", u""))

304

logger.debug(u" Fingerprint: %s", self.fingerprint)

305

if u"secret" in config:

306

self.secret = config[u"secret"].decode(u"base64")

307

elif u"secfile" in config:

351

308

with open(os.path.expanduser(os.path.expandvars

352

(config["secfile"])),

309

(config[u"secfile"])),

353

310

"rb") as secfile:

354

311

self.secret = secfile.read()

355

312

else:

356

raise TypeError("No secret or secfile for client %s"

313

raise TypeError(u"No secret or secfile for client %s"

357

314

% self.name)

358

self.host = config.get("host", "")

315

self.host = config.get(u"host", u"")

359

316

self.created = datetime.datetime.utcnow()

360

317

self.enabled = False

361

self.last_approval_request = None

362

318

self.last_enabled = None

363

319

self.last_checked_ok = None

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

320

self.timeout = string_to_delta(config[u"timeout"])

321

self.interval = string_to_delta(config[u"interval"])

368

322

self.disable_hook = disable_hook

369

323

self.checker = None

370

324

self.checker_initiator_tag = None

371

325

self.disable_initiator_tag = None

372

self.expires = None

373

326

self.checker_callback_tag = None

374

self.checker_command = config["checker"]

327

self.checker_command = config[u"checker"]

375

328

self.current_checker_command = None

376

329

self.last_connect = None

377

330

self._approved = None

378

self.approved_by_default = config.get("approved_by_default",

331

self.approved_by_default = config.get(u"approved_by_default",

379

332

True)

380

333

self.approvals_pending = 0

381

334

self.approval_delay = string_to_delta(

382

config["approval_delay"])

335

config[u"approval_delay"])

383

336

self.approval_duration = string_to_delta(

384

config["approval_duration"])

385

self.changedstate = (multiprocessing_manager

386

.Condition(multiprocessing_manager

387

.Lock()))

337

config[u"approval_duration"])

338

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

388

339

389

340

def send_changedstate(self):

390

341

self.changedstate.acquire()

391

342

self.changedstate.notify_all()

392

343

self.changedstate.release()

393

344

394

345

def enable(self):

395

346

"""Start this client's checker and timeout hooks"""

396

if getattr(self, "enabled", False):

347

if getattr(self, u"enabled", False):

397

348

# Already enabled

398

349

return

399

350

self.send_changedstate()

351

self.last_enabled = datetime.datetime.utcnow()

400

352

# Schedule a new checker to be started an 'interval' from now,

401

353

# and every interval from then on.

402

354

self.checker_initiator_tag = (gobject.timeout_add

403

355

(self.interval_milliseconds(),

404

356

self.start_checker))

405

357

# Schedule a disable() when 'timeout' has passed

406

self.expires = datetime.datetime.utcnow() + self.timeout

407

358

self.disable_initiator_tag = (gobject.timeout_add

408

359

(self.timeout_milliseconds(),

409

360

self.disable))

410

361

self.enabled = True

411

self.last_enabled = datetime.datetime.utcnow()

412

362

# Also start a new checker *right now*.

413

363

self.start_checker()

414

364

419

369

if not quiet:

420

370

self.send_changedstate()

421

371

if not quiet:

422

logger.info("Disabling client %s", self.name)

423

if getattr(self, "disable_initiator_tag", False):

372

logger.info(u"Disabling client %s", self.name)

373

if getattr(self, u"disable_initiator_tag", False):

424

374

gobject.source_remove(self.disable_initiator_tag)

425

375

self.disable_initiator_tag = None

426

self.expires = None

427

if getattr(self, "checker_initiator_tag", False):

376

if getattr(self, u"checker_initiator_tag", False):

428

377

gobject.source_remove(self.checker_initiator_tag)

429

378

self.checker_initiator_tag = None

430

379

self.stop_checker()

445

394

if os.WIFEXITED(condition):

446

395

exitstatus = os.WEXITSTATUS(condition)

447

396

if exitstatus == 0:

448

logger.info("Checker for %(name)s succeeded",

397

logger.info(u"Checker for %(name)s succeeded",

449

398

vars(self))

450

399

self.checked_ok()

451

400

else:

452

logger.info("Checker for %(name)s failed",

401

logger.info(u"Checker for %(name)s failed",

453

402

vars(self))

454

403

else:

455

logger.warning("Checker for %(name)s crashed?",

404

logger.warning(u"Checker for %(name)s crashed?",

456

405

vars(self))

457

406

458

def checked_ok(self, timeout=None):

407

def checked_ok(self):

459

408

"""Bump up the timeout for this client.

460

409

461

410

This should only be called when the client has been seen,

462

411

alive and well.

463

412

"""

464

if timeout is None:

465

timeout = self.timeout

466

413

self.last_checked_ok = datetime.datetime.utcnow()

467

if self.disable_initiator_tag is not None:

468

gobject.source_remove(self.disable_initiator_tag)

469

if getattr(self, "enabled", False):

470

self.disable_initiator_tag = (gobject.timeout_add

471

(_timedelta_to_milliseconds

472

(timeout), self.disable))

473

self.expires = datetime.datetime.utcnow() + timeout

474

475

def need_approval(self):

476

self.last_approval_request = datetime.datetime.utcnow()

414

gobject.source_remove(self.disable_initiator_tag)

415

self.disable_initiator_tag = (gobject.timeout_add

416

(self.timeout_milliseconds(),

417

self.disable))

477

418

478

419

def start_checker(self):

479

420

"""Start a new checker subprocess if one is not running.

492

433

# If a checker exists, make sure it is not a zombie

493

434

try:

494

435

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

495

except (AttributeError, OSError) as error:

436

except (AttributeError, OSError), error:

496

437

if (isinstance(error, OSError)

497

438

and error.errno != errno.ECHILD):

498

439

raise error

499

440

else:

500

441

if pid:

501

logger.warning("Checker was a zombie")

442

logger.warning(u"Checker was a zombie")

502

443

gobject.source_remove(self.checker_callback_tag)

503

444

self.checker_callback(pid, status,

504

445

self.current_checker_command)

509

450

command = self.checker_command % self.host

510

451

except TypeError:

511

452

# Escape attributes for the shell

512

escaped_attrs = dict(

513

(attr,

514

re.escape(unicode(str(getattr(self, attr, "")),

515

errors=

516

'replace')))

517

for attr in

518

self.runtime_expansions)

519

453

escaped_attrs = dict((key,

454

re.escape(unicode(str(val),

455

errors=

456

u'replace')))

457

for key, val in

458

vars(self).iteritems())

520

459

try:

521

460

command = self.checker_command % escaped_attrs

522

except TypeError as error:

523

logger.error('Could not format string "%s":'

524

' %s', self.checker_command, error)

461

except TypeError, error:

462

logger.error(u'Could not format string "%s":'

463

u' %s', self.checker_command, error)

525

464

return True # Try again later

526

465

self.current_checker_command = command

527

466

try:

528

logger.info("Starting checker %r for %s",

467

logger.info(u"Starting checker %r for %s",

529

468

command, self.name)

530

469

# We don't need to redirect stdout and stderr, since

531

470

# in normal mode, that is already done by daemon(),

533

472

# always replaced by /dev/null.)

534

473

self.checker = subprocess.Popen(command,

535

474

close_fds=True,

536

shell=True, cwd="/")

475

shell=True, cwd=u"/")

537

476

self.checker_callback_tag = (gobject.child_watch_add

538

477

(self.checker.pid,

539

478

self.checker_callback,

544

483

if pid:

545

484

gobject.source_remove(self.checker_callback_tag)

546

485

self.checker_callback(pid, status, command)

547

except OSError as error:

548

logger.error("Failed to start subprocess: %s",

486

except OSError, error:

487

logger.error(u"Failed to start subprocess: %s",

549

488

error)

550

489

# Re-run this periodically if run by gobject.timeout_add

551

490

return True

555

494

if self.checker_callback_tag:

556

495

gobject.source_remove(self.checker_callback_tag)

557

496

self.checker_callback_tag = None

558

if getattr(self, "checker", None) is None:

497

if getattr(self, u"checker", None) is None:

559

498

return

560

logger.debug("Stopping checker for %(name)s", vars(self))

499

logger.debug(u"Stopping checker for %(name)s", vars(self))

561

500

try:

562

501

os.kill(self.checker.pid, signal.SIGTERM)

563

502

#time.sleep(0.5)

564

503

#if self.checker.poll() is None:

565

504

# os.kill(self.checker.pid, signal.SIGKILL)

566

except OSError as error:

505

except OSError, error:

567

506

if error.errno != errno.ESRCH: # No such process

568

507

raise

569

508

self.checker = None

570

509

571

572

def dbus_service_property(dbus_interface, signature="v",

573

access="readwrite", byte_arrays=False):

510

def dbus_service_property(dbus_interface, signature=u"v",

511

access=u"readwrite", byte_arrays=False):

574

512

"""Decorators for marking methods of a DBusObjectWithProperties to

575

513

become properties on the D-Bus.

576

514

583

521

"""

584

522

# Encoding deeply encoded byte arrays is not supported yet by the

585

523

# "Set" method, so we fail early here:

586

if byte_arrays and signature != "ay":

587

raise ValueError("Byte arrays not supported for non-'ay'"

588

" signature %r" % signature)

524

if byte_arrays and signature != u"ay":

525

raise ValueError(u"Byte arrays not supported for non-'ay'"

526

u" signature %r" % signature)

589

527

def decorator(func):

590

528

func._dbus_is_property = True

591

529

func._dbus_interface = dbus_interface

592

530

func._dbus_signature = signature

593

531

func._dbus_access = access

594

532

func._dbus_name = func.__name__

595

if func._dbus_name.endswith("_dbus_property"):

533

if func._dbus_name.endswith(u"_dbus_property"):

596

534

func._dbus_name = func._dbus_name[:-14]

597

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

535

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

598

536

return func

599

537

return decorator

600

538

620

558

621

559

class DBusObjectWithProperties(dbus.service.Object):

622

560

"""A D-Bus object with properties.

623

561

624

562

Classes inheriting from this can use the dbus_service_property

625

563

decorator to expose methods as D-Bus properties. It exposes the

626

564

standard Get(), Set(), and GetAll() methods on the D-Bus.

628

566

629

567

@staticmethod

630

568

def _is_dbus_property(obj):

631

return getattr(obj, "_dbus_is_property", False)

569

return getattr(obj, u"_dbus_is_property", False)

632

570

633

571

def _get_all_dbus_properties(self):

634

572

"""Returns a generator of (name, attribute) pairs

635

573

"""

636

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

637

for cls in self.__class__.__mro__

574

return ((prop._dbus_name, prop)

638

575

for name, prop in

639

inspect.getmembers(cls, self._is_dbus_property))

576

inspect.getmembers(self, self._is_dbus_property))

640

577

641

578

def _get_dbus_property(self, interface_name, property_name):

642

579

"""Returns a bound method if one exists which is a D-Bus

643

580

property with the specified name and interface.

644

581

"""

645

for cls in self.__class__.__mro__:

646

for name, value in (inspect.getmembers

647

(cls, self._is_dbus_property)):

648

if (value._dbus_name == property_name

649

and value._dbus_interface == interface_name):

650

return value.__get__(self)

651

582

for name in (property_name,

583

property_name + u"_dbus_property"):

584

prop = getattr(self, name, None)

585

if (prop is None

586

or not self._is_dbus_property(prop)

587

or prop._dbus_name != property_name

588

or (interface_name and prop._dbus_interface

589

and interface_name != prop._dbus_interface)):

590

continue

591

return prop

652

592

# No such property

653

raise DBusPropertyNotFound(self.dbus_object_path + ":"

654

+ interface_name + "."

593

raise DBusPropertyNotFound(self.dbus_object_path + u":"

594

+ interface_name + u"."

655

595

+ property_name)

656

596

657

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

658

out_signature="v")

597

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

598

out_signature=u"v")

659

599

def Get(self, interface_name, property_name):

660

600

"""Standard D-Bus property Get() method, see D-Bus standard.

661

601

"""

662

602

prop = self._get_dbus_property(interface_name, property_name)

663

if prop._dbus_access == "write":

603

if prop._dbus_access == u"write":

664

604

raise DBusPropertyAccessException(property_name)

665

605

value = prop()

666

if not hasattr(value, "variant_level"):

606

if not hasattr(value, u"variant_level"):

667

607

return value

668

608

return type(value)(value, variant_level=value.variant_level+1)

669

609

670

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

671

611

def Set(self, interface_name, property_name, value):

672

612

"""Standard D-Bus property Set() method, see D-Bus standard.

673

613

"""

674

614

prop = self._get_dbus_property(interface_name, property_name)

675

if prop._dbus_access == "read":

615

if prop._dbus_access == u"read":

676

616

raise DBusPropertyAccessException(property_name)

677

if prop._dbus_get_args_options["byte_arrays"]:

617

if prop._dbus_get_args_options[u"byte_arrays"]:

678

618

# The byte_arrays option is not supported yet on

679

619

# signatures other than "ay".

680

if prop._dbus_signature != "ay":

620

if prop._dbus_signature != u"ay":

681

621

raise ValueError

682

622

value = dbus.ByteArray(''.join(unichr(byte)

683

623

for byte in value))

684

624

prop(value)

685

625

686

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

687

out_signature="a{sv}")

626

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

627

out_signature=u"a{sv}")

688

628

def GetAll(self, interface_name):

689

629

"""Standard D-Bus property GetAll() method, see D-Bus

690

630

standard.

691

631

692

632

Note: Will not include properties with access="write".

693

633

"""

694

634

all = {}

698

638

# Interface non-empty but did not match

699

639

continue

700

640

# Ignore write-only properties

701

if prop._dbus_access == "write":

641

if prop._dbus_access == u"write":

702

642

continue

703

643

value = prop()

704

if not hasattr(value, "variant_level"):

644

if not hasattr(value, u"variant_level"):

705

645

all[name] = value

706

646

continue

707

647

all[name] = type(value)(value, variant_level=

708

648

value.variant_level+1)

709

return dbus.Dictionary(all, signature="sv")

649

return dbus.Dictionary(all, signature=u"sv")

710

650

711

651

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

712

out_signature="s",

652

out_signature=u"s",

713

653

path_keyword='object_path',

714

654

connection_keyword='connection')

715

655

def Introspect(self, object_path, connection):

720

660

try:

721

661

document = xml.dom.minidom.parseString(xmlstring)

722

662

def make_tag(document, name, prop):

723

e = document.createElement("property")

724

e.setAttribute("name", name)

725

e.setAttribute("type", prop._dbus_signature)

726

e.setAttribute("access", prop._dbus_access)

663

e = document.createElement(u"property")

664

e.setAttribute(u"name", name)

665

e.setAttribute(u"type", prop._dbus_signature)

666

e.setAttribute(u"access", prop._dbus_access)

727

667

return e

728

for if_tag in document.getElementsByTagName("interface"):

668

for if_tag in document.getElementsByTagName(u"interface"):

729

669

for tag in (make_tag(document, name, prop)

730

670

for name, prop

731

671

in self._get_all_dbus_properties()

732

672

if prop._dbus_interface

733

== if_tag.getAttribute("name")):

673

== if_tag.getAttribute(u"name")):

734

674

if_tag.appendChild(tag)

735

675

# Add the names to the return values for the

736

676

# "org.freedesktop.DBus.Properties" methods

737

if (if_tag.getAttribute("name")

738

== "org.freedesktop.DBus.Properties"):

739

for cn in if_tag.getElementsByTagName("method"):

740

if cn.getAttribute("name") == "Get":

741

for arg in cn.getElementsByTagName("arg"):

742

if (arg.getAttribute("direction")

743

== "out"):

744

arg.setAttribute("name", "value")

745

elif cn.getAttribute("name") == "GetAll":

746

for arg in cn.getElementsByTagName("arg"):

747

if (arg.getAttribute("direction")

748

== "out"):

749

arg.setAttribute("name", "props")

750

xmlstring = document.toxml("utf-8")

677

if (if_tag.getAttribute(u"name")

678

== u"org.freedesktop.DBus.Properties"):

679

for cn in if_tag.getElementsByTagName(u"method"):

680

if cn.getAttribute(u"name") == u"Get":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"value")

685

elif cn.getAttribute(u"name") == u"GetAll":

686

for arg in cn.getElementsByTagName(u"arg"):

687

if (arg.getAttribute(u"direction")

688

== u"out"):

689

arg.setAttribute(u"name", u"props")

690

xmlstring = document.toxml(u"utf-8")

751

691

document.unlink()

752

692

except (AttributeError, xml.dom.DOMException,

753

xml.parsers.expat.ExpatError) as error:

754

logger.error("Failed to override Introspection method",

693

xml.parsers.expat.ExpatError), error:

694

logger.error(u"Failed to override Introspection method",

755

695

error)

756

696

return xmlstring

757

697

758

698

759

def datetime_to_dbus (dt, variant_level=0):

760

"""Convert a UTC datetime.datetime() to a D-Bus type."""

761

if dt is None:

762

return dbus.String("", variant_level = variant_level)

763

return dbus.String(dt.isoformat(),

764

variant_level=variant_level)

765

766

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

767

.__metaclass__):

768

"""Applied to an empty subclass of a D-Bus object, this metaclass

769

will add additional D-Bus attributes matching a certain pattern.

770

"""

771

def __new__(mcs, name, bases, attr):

772

# Go through all the base classes which could have D-Bus

773

# methods, signals, or properties in them

774

for base in (b for b in bases

775

if issubclass(b, dbus.service.Object)):

776

# Go though all attributes of the base class

777

for attrname, attribute in inspect.getmembers(base):

778

# Ignore non-D-Bus attributes, and D-Bus attributes

779

# with the wrong interface name

780

if (not hasattr(attribute, "_dbus_interface")

781

or not attribute._dbus_interface

782

.startswith("se.recompile.Mandos")):

783

continue

784

# Create an alternate D-Bus interface name based on

785

# the current name

786

alt_interface = (attribute._dbus_interface

787

.replace("se.recompile.Mandos",

788

"se.bsnet.fukt.Mandos"))

789

# Is this a D-Bus signal?

790

if getattr(attribute, "_dbus_is_signal", False):

791

# Extract the original non-method function by

792

# black magic

793

nonmethod_func = (dict(

794

zip(attribute.func_code.co_freevars,

795

attribute.__closure__))["func"]

796

.cell_contents)

797

# Create a new, but exactly alike, function

798

# object, and decorate it to be a new D-Bus signal

799

# with the alternate D-Bus interface name

800

new_function = (dbus.service.signal

801

(alt_interface,

802

attribute._dbus_signature)

803

(types.FunctionType(

804

nonmethod_func.func_code,

805

nonmethod_func.func_globals,

806

nonmethod_func.func_name,

807

nonmethod_func.func_defaults,

808

nonmethod_func.func_closure)))

809

# Define a creator of a function to call both the

810

# old and new functions, so both the old and new

811

# signals gets sent when the function is called

812

def fixscope(func1, func2):

813

"""This function is a scope container to pass

814

func1 and func2 to the "call_both" function

815

outside of its arguments"""

816

def call_both(*args, **kwargs):

817

"""This function will emit two D-Bus

818

signals by calling func1 and func2"""

819

func1(*args, **kwargs)

820

func2(*args, **kwargs)

821

return call_both

822

# Create the "call_both" function and add it to

823

# the class

824

attr[attrname] = fixscope(attribute,

825

new_function)

826

# Is this a D-Bus method?

827

elif getattr(attribute, "_dbus_is_method", False):

828

# Create a new, but exactly alike, function

829

# object. Decorate it to be a new D-Bus method

830

# with the alternate D-Bus interface name. Add it

831

# to the class.

832

attr[attrname] = (dbus.service.method

833

(alt_interface,

834

attribute._dbus_in_signature,

835

attribute._dbus_out_signature)

836

(types.FunctionType

837

(attribute.func_code,

838

attribute.func_globals,

839

attribute.func_name,

840

attribute.func_defaults,

841

attribute.func_closure)))

842

# Is this a D-Bus property?

843

elif getattr(attribute, "_dbus_is_property", False):

844

# Create a new, but exactly alike, function

845

# object, and decorate it to be a new D-Bus

846

# property with the alternate D-Bus interface

847

# name. Add it to the class.

848

attr[attrname] = (dbus_service_property

849

(alt_interface,

850

attribute._dbus_signature,

851

attribute._dbus_access,

852

attribute

853

._dbus_get_args_options

854

["byte_arrays"])

855

(types.FunctionType

856

(attribute.func_code,

857

attribute.func_globals,

858

attribute.func_name,

859

attribute.func_defaults,

860

attribute.func_closure)))

861

return type.__new__(mcs, name, bases, attr)

862

863

699

class ClientDBus(Client, DBusObjectWithProperties):

864

700

"""A Client class using D-Bus

865

701

867

703

dbus_object_path: dbus.ObjectPath

868

704

bus: dbus.SystemBus()

869

705

"""

870

871

runtime_expansions = (Client.runtime_expansions

872

+ ("dbus_object_path",))

873

874

706

# dbus.service.Object doesn't use super(), so we can't either.

875

707

876

708

def __init__(self, bus = None, *args, **kwargs):

879

711

Client.__init__(self, *args, **kwargs)

880

712

# Only now, when this client is initialized, can it show up on

881

713

# the D-Bus

882

client_object_name = unicode(self.name).translate(

883

{ord("."): ord("_"),

884

ord("-"): ord("_")})

885

714

self.dbus_object_path = (dbus.ObjectPath

886

("/clients/" + client_object_name))

715

(u"/clients/"

716

+ self.name.replace(u".", u"_")))

887

717

DBusObjectWithProperties.__init__(self, self.bus,

888

718

self.dbus_object_path)

889

719

890

def notifychangeproperty(transform_func,

891

dbus_name, type_func=lambda x: x,

892

variant_level=1):

893

""" Modify a variable so that it's a property which announces

894

its changes to DBus.

720

def _get_approvals_pending(self):

721

return self._approvals_pending

722

def _set_approvals_pending(self, value):

723

old_value = self._approvals_pending

724

self._approvals_pending = value

725

bval = bool(value)

726

if (hasattr(self, "dbus_object_path")

727

and bval is not bool(old_value)):

728

dbus_bool = dbus.Boolean(bval, variant_level=1)

729

self.PropertyChanged(dbus.String(u"ApprovalPending"),

730

dbus_bool)

895

731

896

transform_fun: Function that takes a value and a variant_level

897

and transforms it to a D-Bus type.

898

dbus_name: D-Bus name of the variable

899

type_func: Function that transform the value before sending it

900

to the D-Bus. Default: no transform

901

variant_level: D-Bus variant level. Default: 1

902

"""

903

attrname = "_{0}".format(dbus_name)

904

def setter(self, value):

905

if hasattr(self, "dbus_object_path"):

906

if (not hasattr(self, attrname) or

907

type_func(getattr(self, attrname, None))

908

!= type_func(value)):

909

dbus_value = transform_func(type_func(value),

910

variant_level

911

=variant_level)

912

self.PropertyChanged(dbus.String(dbus_name),

913

dbus_value)

914

setattr(self, attrname, value)

915

916

return property(lambda self: getattr(self, attrname), setter)

917

918

919

expires = notifychangeproperty(datetime_to_dbus, "Expires")

920

approvals_pending = notifychangeproperty(dbus.Boolean,

921

"ApprovalPending",

922

type_func = bool)

923

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

924

last_enabled = notifychangeproperty(datetime_to_dbus,

925

"LastEnabled")

926

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

927

type_func = lambda checker:

928

checker is not None)

929

last_checked_ok = notifychangeproperty(datetime_to_dbus,

930

"LastCheckedOK")

931

last_approval_request = notifychangeproperty(

932

datetime_to_dbus, "LastApprovalRequest")

933

approved_by_default = notifychangeproperty(dbus.Boolean,

934

"ApprovedByDefault")

935

approval_delay = notifychangeproperty(dbus.UInt16,

936

"ApprovalDelay",

937

type_func =

938

_timedelta_to_milliseconds)

939

approval_duration = notifychangeproperty(

940

dbus.UInt16, "ApprovalDuration",

941

type_func = _timedelta_to_milliseconds)

942

host = notifychangeproperty(dbus.String, "Host")

943

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

944

type_func =

945

_timedelta_to_milliseconds)

946

extended_timeout = notifychangeproperty(

947

dbus.UInt16, "ExtendedTimeout",

948

type_func = _timedelta_to_milliseconds)

949

interval = notifychangeproperty(dbus.UInt16,

950

"Interval",

951

type_func =

952

_timedelta_to_milliseconds)

953

checker_command = notifychangeproperty(dbus.String, "Checker")

954

955

del notifychangeproperty

732

approvals_pending = property(_get_approvals_pending,

733

_set_approvals_pending)

734

del _get_approvals_pending, _set_approvals_pending

735

736

@staticmethod

737

def _datetime_to_dbus(dt, variant_level=0):

738

"""Convert a UTC datetime.datetime() to a D-Bus type."""

739

return dbus.String(dt.isoformat(),

740

variant_level=variant_level)

741

742

def enable(self):

743

oldstate = getattr(self, u"enabled", False)

744

r = Client.enable(self)

745

if oldstate != self.enabled:

746

# Emit D-Bus signals

747

self.PropertyChanged(dbus.String(u"Enabled"),

748

dbus.Boolean(True, variant_level=1))

749

self.PropertyChanged(

750

dbus.String(u"LastEnabled"),

751

self._datetime_to_dbus(self.last_enabled,

752

variant_level=1))

753

return r

754

755

def disable(self, quiet = False):

756

oldstate = getattr(self, u"enabled", False)

757

r = Client.disable(self, quiet=quiet)

758

if not quiet and oldstate != self.enabled:

759

# Emit D-Bus signal

760

self.PropertyChanged(dbus.String(u"Enabled"),

761

dbus.Boolean(False, variant_level=1))

762

return r

956

763

957

764

def __del__(self, *args, **kwargs):

958

765

try:

959

766

self.remove_from_connection()

960

767

except LookupError:

961

768

pass

962

if hasattr(DBusObjectWithProperties, "__del__"):

769

if hasattr(DBusObjectWithProperties, u"__del__"):

963

770

DBusObjectWithProperties.__del__(self, *args, **kwargs)

964

771

Client.__del__(self, *args, **kwargs)

965

772

967

774

*args, **kwargs):

968

775

self.checker_callback_tag = None

969

776

self.checker = None

777

# Emit D-Bus signal

778

self.PropertyChanged(dbus.String(u"CheckerRunning"),

779

dbus.Boolean(False, variant_level=1))

970

780

if os.WIFEXITED(condition):

971

781

exitstatus = os.WEXITSTATUS(condition)

972

782

# Emit D-Bus signal

982

792

return Client.checker_callback(self, pid, condition, command,

983

793

*args, **kwargs)

984

794

795

def checked_ok(self, *args, **kwargs):

796

r = Client.checked_ok(self, *args, **kwargs)

797

# Emit D-Bus signal

798

self.PropertyChanged(

799

dbus.String(u"LastCheckedOK"),

800

(self._datetime_to_dbus(self.last_checked_ok,

801

variant_level=1)))

802

return r

803

985

804

def start_checker(self, *args, **kwargs):

986

805

old_checker = self.checker

987

806

if self.checker is not None:

994

813

and old_checker_pid != self.checker.pid):

995

814

# Emit D-Bus signal

996

815

self.CheckerStarted(self.current_checker_command)

816

self.PropertyChanged(

817

dbus.String(u"CheckerRunning"),

818

dbus.Boolean(True, variant_level=1))

997

819

return r

998

820

821

def stop_checker(self, *args, **kwargs):

822

old_checker = getattr(self, u"checker", None)

823

r = Client.stop_checker(self, *args, **kwargs)

824

if (old_checker is not None

825

and getattr(self, u"checker", None) is None):

826

self.PropertyChanged(dbus.String(u"CheckerRunning"),

827

dbus.Boolean(False, variant_level=1))

828

return r

829

999

830

def _reset_approved(self):

1000

831

self._approved = None

1001

832

return False

1003

834

def approve(self, value=True):

1004

835

self.send_changedstate()

1005

836

self._approved = value

1006

gobject.timeout_add(_timedelta_to_milliseconds

837

gobject.timeout_add(self._timedelta_to_milliseconds

1007

838

(self.approval_duration),

1008

839

self._reset_approved)

1009

840

1010

841

1011

842

## D-Bus methods, signals & properties

1012

_interface = "se.recompile.Mandos.Client"

843

_interface = u"se.bsnet.fukt.Mandos.Client"

1013

844

1014

845

## Signals

1015

846

1016

847

# CheckerCompleted - signal

1017

@dbus.service.signal(_interface, signature="nxs")

848

@dbus.service.signal(_interface, signature=u"nxs")

1018

849

def CheckerCompleted(self, exitcode, waitstatus, command):

1019

850

"D-Bus signal"

1020

851

pass

1021

852

1022

853

# CheckerStarted - signal

1023

@dbus.service.signal(_interface, signature="s")

854

@dbus.service.signal(_interface, signature=u"s")

1024

855

def CheckerStarted(self, command):

1025

856

"D-Bus signal"

1026

857

pass

1027

858

1028

859

# PropertyChanged - signal

1029

@dbus.service.signal(_interface, signature="sv")

860

@dbus.service.signal(_interface, signature=u"sv")

1030

861

def PropertyChanged(self, property, value):

1031

862

"D-Bus signal"

1032

863

pass

1041

872

pass

1042

873

1043

874

# Rejected - signal

1044

@dbus.service.signal(_interface, signature="s")

875

@dbus.service.signal(_interface, signature=u"s")

1045

876

def Rejected(self, reason):

1046

877

"D-Bus signal"

1047

878

pass

1048

879

1049

880

# NeedApproval - signal

1050

@dbus.service.signal(_interface, signature="tb")

881

@dbus.service.signal(_interface, signature=u"tb")

1051

882

def NeedApproval(self, timeout, default):

1052

883

"D-Bus signal"

1053

return self.need_approval()

884

pass

1054

885

1055

886

## Methods

1056

887

1057

888

# Approve - method

1058

@dbus.service.method(_interface, in_signature="b")

889

@dbus.service.method(_interface, in_signature=u"b")

1059

890

def Approve(self, value):

1060

891

self.approve(value)

1061

892

1062

893

# CheckedOK - method

1063

894

@dbus.service.method(_interface)

1064

895

def CheckedOK(self):

1065

self.checked_ok()

896

return self.checked_ok()

1066

897

1067

898

# Enable - method

1068

899

@dbus.service.method(_interface)

1090

921

## Properties

1091

922

1092

923

# ApprovalPending - property

1093

@dbus_service_property(_interface, signature="b", access="read")

924

@dbus_service_property(_interface, signature=u"b", access=u"read")

1094

925

def ApprovalPending_dbus_property(self):

1095

926

return dbus.Boolean(bool(self.approvals_pending))

1096

927

1097

928

# ApprovedByDefault - property

1098

@dbus_service_property(_interface, signature="b",

1099

access="readwrite")

929

@dbus_service_property(_interface, signature=u"b",

930

access=u"readwrite")

1100

931

def ApprovedByDefault_dbus_property(self, value=None):

1101

932

if value is None: # get

1102

933

return dbus.Boolean(self.approved_by_default)

1103

934

self.approved_by_default = bool(value)

935

# Emit D-Bus signal

936

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

937

dbus.Boolean(value, variant_level=1))

1104

938

1105

939

# ApprovalDelay - property

1106

@dbus_service_property(_interface, signature="t",

1107

access="readwrite")

940

@dbus_service_property(_interface, signature=u"t",

941

access=u"readwrite")

1108

942

def ApprovalDelay_dbus_property(self, value=None):

1109

943

if value is None: # get

1110

944

return dbus.UInt64(self.approval_delay_milliseconds())

1111

945

self.approval_delay = datetime.timedelta(0, 0, 0, value)

946

# Emit D-Bus signal

947

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

948

dbus.UInt64(value, variant_level=1))

1112

949

1113

950

# ApprovalDuration - property

1114

@dbus_service_property(_interface, signature="t",

1115

access="readwrite")

951

@dbus_service_property(_interface, signature=u"t",

952

access=u"readwrite")

1116

953

def ApprovalDuration_dbus_property(self, value=None):

1117

954

if value is None: # get

1118

return dbus.UInt64(_timedelta_to_milliseconds(

955

return dbus.UInt64(self._timedelta_to_milliseconds(

1119

956

self.approval_duration))

1120

957

self.approval_duration = datetime.timedelta(0, 0, 0, value)

958

# Emit D-Bus signal

959

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

960

dbus.UInt64(value, variant_level=1))

1121

961

1122

962

# Name - property

1123

@dbus_service_property(_interface, signature="s", access="read")

963

@dbus_service_property(_interface, signature=u"s", access=u"read")

1124

964

def Name_dbus_property(self):

1125

965

return dbus.String(self.name)

1126

966

1127

967

# Fingerprint - property

1128

@dbus_service_property(_interface, signature="s", access="read")

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

1129

969

def Fingerprint_dbus_property(self):

1130

970

return dbus.String(self.fingerprint)

1131

971

1132

972

# Host - property

1133

@dbus_service_property(_interface, signature="s",

1134

access="readwrite")

973

@dbus_service_property(_interface, signature=u"s",

974

access=u"readwrite")

1135

975

def Host_dbus_property(self, value=None):

1136

976

if value is None: # get

1137

977

return dbus.String(self.host)

1138

978

self.host = value

979

# Emit D-Bus signal

980

self.PropertyChanged(dbus.String(u"Host"),

981

dbus.String(value, variant_level=1))

1139

982

1140

983

# Created - property

1141

@dbus_service_property(_interface, signature="s", access="read")

984

@dbus_service_property(_interface, signature=u"s", access=u"read")

1142

985

def Created_dbus_property(self):

1143

return dbus.String(datetime_to_dbus(self.created))

986

return dbus.String(self._datetime_to_dbus(self.created))

1144

987

1145

988

# LastEnabled - property

1146

@dbus_service_property(_interface, signature="s", access="read")

989

@dbus_service_property(_interface, signature=u"s", access=u"read")

1147

990

def LastEnabled_dbus_property(self):

1148

return datetime_to_dbus(self.last_enabled)

991

if self.last_enabled is None:

992

return dbus.String(u"")

993

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1149

994

1150

995

# Enabled - property

1151

@dbus_service_property(_interface, signature="b",

1152

access="readwrite")

996

@dbus_service_property(_interface, signature=u"b",

997

access=u"readwrite")

1153

998

def Enabled_dbus_property(self, value=None):

1154

999

if value is None: # get

1155

1000

return dbus.Boolean(self.enabled)

1159

1004

self.disable()

1160

1005

1161

1006

# LastCheckedOK - property

1162

@dbus_service_property(_interface, signature="s",

1163

access="readwrite")

1007

@dbus_service_property(_interface, signature=u"s",

1008

access=u"readwrite")

1164

1009

def LastCheckedOK_dbus_property(self, value=None):

1165

1010

if value is not None:

1166

1011

self.checked_ok()

1167

1012

return

1168

return datetime_to_dbus(self.last_checked_ok)

1169

1170

# Expires - property

1171

@dbus_service_property(_interface, signature="s", access="read")

1172

def Expires_dbus_property(self):

1173

return datetime_to_dbus(self.expires)

1174

1175

# LastApprovalRequest - property

1176

@dbus_service_property(_interface, signature="s", access="read")

1177

def LastApprovalRequest_dbus_property(self):

1178

return datetime_to_dbus(self.last_approval_request)

1013

if self.last_checked_ok is None:

1014

return dbus.String(u"")

1015

return dbus.String(self._datetime_to_dbus(self

1016

.last_checked_ok))

1179

1017

1180

1018

# Timeout - property

1181

@dbus_service_property(_interface, signature="t",

1182

access="readwrite")

1019

@dbus_service_property(_interface, signature=u"t",

1020

access=u"readwrite")

1183

1021

def Timeout_dbus_property(self, value=None):

1184

1022

if value is None: # get

1185

1023

return dbus.UInt64(self.timeout_milliseconds())

1186

1024

self.timeout = datetime.timedelta(0, 0, 0, value)

1187

if getattr(self, "disable_initiator_tag", None) is None:

1025

# Emit D-Bus signal

1026

self.PropertyChanged(dbus.String(u"Timeout"),

1027

dbus.UInt64(value, variant_level=1))

1028

if getattr(self, u"disable_initiator_tag", None) is None:

1188

1029

return

1189

1030

# Reschedule timeout

1190

1031

gobject.source_remove(self.disable_initiator_tag)

1191

1032

self.disable_initiator_tag = None

1192

self.expires = None

1193

time_to_die = _timedelta_to_milliseconds((self

1194

.last_checked_ok

1195

+ self.timeout)

1196

- datetime.datetime

1197

.utcnow())

1033

time_to_die = (self.

1034

_timedelta_to_milliseconds((self

1035

.last_checked_ok

1036

+ self.timeout)

1037

- datetime.datetime

1038

.utcnow()))

1198

1039

if time_to_die <= 0:

1199

1040

# The timeout has passed

1200

1041

self.disable()

1201

1042

else:

1202

self.expires = (datetime.datetime.utcnow()

1203

+ datetime.timedelta(milliseconds =

1204

time_to_die))

1205

1043

self.disable_initiator_tag = (gobject.timeout_add

1206

1044

(time_to_die, self.disable))

1207

1045

1208

# ExtendedTimeout - property

1209

@dbus_service_property(_interface, signature="t",

1210

access="readwrite")

1211

def ExtendedTimeout_dbus_property(self, value=None):

1212

if value is None: # get

1213

return dbus.UInt64(self.extended_timeout_milliseconds())

1214

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1215

1216

1046

# Interval - property

1217

@dbus_service_property(_interface, signature="t",

1218

access="readwrite")

1047

@dbus_service_property(_interface, signature=u"t",

1048

access=u"readwrite")

1219

1049

def Interval_dbus_property(self, value=None):

1220

1050

if value is None: # get

1221

1051

return dbus.UInt64(self.interval_milliseconds())

1222

1052

self.interval = datetime.timedelta(0, 0, 0, value)

1223

if getattr(self, "checker_initiator_tag", None) is None:

1053

# Emit D-Bus signal

1054

self.PropertyChanged(dbus.String(u"Interval"),

1055

dbus.UInt64(value, variant_level=1))

1056

if getattr(self, u"checker_initiator_tag", None) is None:

1224

1057

return

1225

1058

# Reschedule checker run

1226

1059

gobject.source_remove(self.checker_initiator_tag)

1227

1060

self.checker_initiator_tag = (gobject.timeout_add

1228

1061

(value, self.start_checker))

1229

1062

self.start_checker() # Start one now, too

1230

1063

1231

1064

# Checker - property

1232

@dbus_service_property(_interface, signature="s",

1233

access="readwrite")

1065

@dbus_service_property(_interface, signature=u"s",

1066

access=u"readwrite")

1234

1067

def Checker_dbus_property(self, value=None):

1235

1068

if value is None: # get

1236

1069

return dbus.String(self.checker_command)

1237

1070

self.checker_command = value

1071

# Emit D-Bus signal

1072

self.PropertyChanged(dbus.String(u"Checker"),

1073

dbus.String(self.checker_command,

1074

variant_level=1))

1238

1075

1239

1076

# CheckerRunning - property

1240

@dbus_service_property(_interface, signature="b",

1241

access="readwrite")

1077

@dbus_service_property(_interface, signature=u"b",

1078

access=u"readwrite")

1242

1079

def CheckerRunning_dbus_property(self, value=None):

1243

1080

if value is None: # get

1244

1081

return dbus.Boolean(self.checker is not None)

1248

1085

self.stop_checker()

1249

1086

1250

1087

# ObjectPath - property

1251

@dbus_service_property(_interface, signature="o", access="read")

1088

@dbus_service_property(_interface, signature=u"o", access=u"read")

1252

1089

def ObjectPath_dbus_property(self):

1253

1090

return self.dbus_object_path # is already a dbus.ObjectPath

1254

1091

1255

1092

# Secret = property

1256

@dbus_service_property(_interface, signature="ay",

1257

access="write", byte_arrays=True)

1093

@dbus_service_property(_interface, signature=u"ay",

1094

access=u"write", byte_arrays=True)

1258

1095

def Secret_dbus_property(self, value):

1259

1096

self.secret = str(value)

1260

1097

1267

1104

self._pipe.send(('init', fpr, address))

1268

1105

if not self._pipe.recv():

1269

1106

raise KeyError()

1270

1107

1271

1108

def __getattribute__(self, name):

1272

1109

if(name == '_pipe'):

1273

1110

return super(ProxyClient, self).__getattribute__(name)

1280

1117

self._pipe.send(('funcall', name, args, kwargs))

1281

1118

return self._pipe.recv()[1]

1282

1119

return func

1283

1120

1284

1121

def __setattr__(self, name, value):

1285

1122

if(name == '_pipe'):

1286

1123

return super(ProxyClient, self).__setattr__(name, value)

1287

1124

self._pipe.send(('setattr', name, value))

1288

1125

1289

class ClientDBusTransitional(ClientDBus):

1290

__metaclass__ = AlternateDBusNamesMetaclass

1291

1126

1292

1127

class ClientHandler(socketserver.BaseRequestHandler, object):

1293

1128

"""A class to handle client connections.

1297

1132

1298

1133

def handle(self):

1299

1134

with contextlib.closing(self.server.child_pipe) as child_pipe:

1300

logger.info("TCP connection from: %s",

1135

logger.info(u"TCP connection from: %s",

1301

1136

unicode(self.client_address))

1302

logger.debug("Pipe FD: %d",

1137

logger.debug(u"Pipe FD: %d",

1303

1138

self.server.child_pipe.fileno())

1304

1139

1305

1140

session = (gnutls.connection

1306

1141

.ClientSession(self.request,

1307

1142

gnutls.connection

1308

1143

.X509Credentials()))

1309

1144

1310

1145

# Note: gnutls.connection.X509Credentials is really a

1311

1146

# generic GnuTLS certificate credentials object so long as

1312

1147

# no X.509 keys are added to it. Therefore, we can use it

1313

1148

# here despite using OpenPGP certificates.

1314

1315

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1316

# "+AES-256-CBC", "+SHA1",

1317

# "+COMP-NULL", "+CTYPE-OPENPGP",

1318

# "+DHE-DSS"))

1149

1150

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1151

# u"+AES-256-CBC", u"+SHA1",

1152

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1153

# u"+DHE-DSS"))

1319

1154

# Use a fallback default, since this MUST be set.

1320

1155

priority = self.server.gnutls_priority

1321

1156

if priority is None:

1322

priority = "NORMAL"

1157

priority = u"NORMAL"

1323

1158

(gnutls.library.functions

1324

1159

.gnutls_priority_set_direct(session._c_object,

1325

1160

priority, None))

1326

1161

1327

1162

# Start communication using the Mandos protocol

1328

1163

# Get protocol number

1329

1164

line = self.request.makefile().readline()

1330

logger.debug("Protocol version: %r", line)

1165

logger.debug(u"Protocol version: %r", line)

1331

1166

try:

1332

1167

if int(line.strip().split()[0]) > 1:

1333

1168

raise RuntimeError

1334

except (ValueError, IndexError, RuntimeError) as error:

1335

logger.error("Unknown protocol version: %s", error)

1169

except (ValueError, IndexError, RuntimeError), error:

1170

logger.error(u"Unknown protocol version: %s", error)

1336

1171

return

1337

1172

1338

1173

# Start GnuTLS connection

1339

1174

try:

1340

1175

session.handshake()

1341

except gnutls.errors.GNUTLSError as error:

1342

logger.warning("Handshake failed: %s", error)

1176

except gnutls.errors.GNUTLSError, error:

1177

logger.warning(u"Handshake failed: %s", error)

1343

1178

# Do not run session.bye() here: the session is not

1344

1179

# established. Just abandon the request.

1345

1180

return

1346

logger.debug("Handshake succeeded")

1347

1181

logger.debug(u"Handshake succeeded")

1182

1348

1183

approval_required = False

1349

1184

try:

1350

1185

try:

1351

1186

fpr = self.fingerprint(self.peer_certificate

1352

1187

(session))

1353

except (TypeError,

1354

gnutls.errors.GNUTLSError) as error:

1355

logger.warning("Bad certificate: %s", error)

1188

except (TypeError, gnutls.errors.GNUTLSError), error:

1189

logger.warning(u"Bad certificate: %s", error)

1356

1190

return

1357

logger.debug("Fingerprint: %s", fpr)

1358

1191

logger.debug(u"Fingerprint: %s", fpr)

1192

1359

1193

try:

1360

1194

client = ProxyClient(child_pipe, fpr,

1361

1195

self.client_address)

1369

1203

1370

1204

while True:

1371

1205

if not client.enabled:

1372

logger.info("Client %s is disabled",

1206

logger.warning(u"Client %s is disabled",

1373

1207

client.name)

1374

1208

if self.server.use_dbus:

1375

1209

# Emit D-Bus signal

1376

client.Rejected("Disabled")

1210

client.Rejected("Disabled")

1377

1211

return

1378

1212

1379

1213

if client._approved or not client.approval_delay:

1380

1214

#We are approved or approval is disabled

1381

1215

break

1382

1216

elif client._approved is None:

1383

logger.info("Client %s needs approval",

1217

logger.info(u"Client %s needs approval",

1384

1218

client.name)

1385

1219

if self.server.use_dbus:

1386

1220

# Emit D-Bus signal

1388

1222

client.approval_delay_milliseconds(),

1389

1223

client.approved_by_default)

1390

1224

else:

1391

logger.warning("Client %s was not approved",

1225

logger.warning(u"Client %s was not approved",

1392

1226

client.name)

1393

1227

if self.server.use_dbus:

1394

1228

# Emit D-Bus signal

1396

1230

return

1397

1231

1398

1232

#wait until timeout or approved

1233

#x = float(client._timedelta_to_milliseconds(delay))

1399

1234

time = datetime.datetime.now()

1400

1235

client.changedstate.acquire()

1401

(client.changedstate.wait

1402

(float(client._timedelta_to_milliseconds(delay)

1403

/ 1000)))

1236

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1404

1237

client.changedstate.release()

1405

1238

time2 = datetime.datetime.now()

1406

1239

if (time2 - time) >= delay:

1421

1254

while sent_size < len(client.secret):

1422

1255

try:

1423

1256

sent = session.send(client.secret[sent_size:])

1424

except gnutls.errors.GNUTLSError as error:

1257

except (gnutls.errors.GNUTLSError), error:

1425

1258

logger.warning("gnutls send failed")

1426

1259

return

1427

logger.debug("Sent: %d, remaining: %d",

1260

logger.debug(u"Sent: %d, remaining: %d",

1428

1261

sent, len(client.secret)

1429

1262

- (sent_size + sent))

1430

1263

sent_size += sent

1431

1432

logger.info("Sending secret to %s", client.name)

1433

# bump the timeout using extended_timeout

1434

client.checked_ok(client.extended_timeout)

1264

1265

logger.info(u"Sending secret to %s", client.name)

1266

# bump the timeout as if seen

1267

client.checked_ok()

1435

1268

if self.server.use_dbus:

1436

1269

# Emit D-Bus signal

1437

1270

client.GotSecret()

1441

1274

client.approvals_pending -= 1

1442

1275

try:

1443

1276

session.bye()

1444

except gnutls.errors.GNUTLSError as error:

1277

except (gnutls.errors.GNUTLSError), error:

1445

1278

logger.warning("GnuTLS bye failed")

1446

1279

1447

1280

@staticmethod

1458

1291

.gnutls_certificate_get_peers

1459

1292

(session._c_object, ctypes.byref(list_size)))

1460

1293

if not bool(cert_list) and list_size.value != 0:

1461

raise gnutls.errors.GNUTLSError("error getting peer"

1462

" certificate")

1294

raise gnutls.errors.GNUTLSError(u"error getting peer"

1295

u" certificate")

1463

1296

if list_size.value == 0:

1464

1297

return None

1465

1298

cert = cert_list[0]

1491

1324

if crtverify.value != 0:

1492

1325

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1493

1326

raise (gnutls.errors.CertificateSecurityError

1494

("Verify failed"))

1327

(u"Verify failed"))

1495

1328

# New buffer for the fingerprint

1496

1329

buf = ctypes.create_string_buffer(20)

1497

1330

buf_len = ctypes.c_size_t()

1504

1337

# Convert the buffer to a Python bytestring

1505

1338

fpr = ctypes.string_at(buf, buf_len.value)

1506

1339

# Convert the bytestring to hexadecimal notation

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1340

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1508

1341

return hex_fpr

1509

1342

1510

1343

1516

1349

except:

1517

1350

self.handle_error(request, address)

1518

1351

self.close_request(request)

1519

1352

1520

1353

def process_request(self, request, address):

1521

1354

"""Start a new process to process the request."""

1522

proc = multiprocessing.Process(target = self.sub_process_main,

1523

args = (request,

1524

address))

1525

proc.start()

1526

return proc

1527

1355

multiprocessing.Process(target = self.sub_process_main,

1356

args = (request, address)).start()

1528

1357

1529

1358

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1530

1359

""" adds a pipe to the MixIn """

1534

1363

This function creates a new pipe in self.pipe

1535

1364

"""

1536

1365

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1537

1538

proc = MultiprocessingMixIn.process_request(self, request,

1539

client_address)

1366

1367

super(MultiprocessingMixInWithPipe,

1368

self).process_request(request, client_address)

1540

1369

self.child_pipe.close()

1541

self.add_pipe(parent_pipe, proc)

1542

1543

def add_pipe(self, parent_pipe, proc):

1370

self.add_pipe(parent_pipe)

1371

1372

def add_pipe(self, parent_pipe):

1544

1373

"""Dummy function; override as necessary"""

1545

raise NotImplementedError

1546

1374

pass

1547

1375

1548

1376

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1549

1377

socketserver.TCPServer, object):

1567

1395

bind to an address or port if they were not specified."""

1568

1396

if self.interface is not None:

1569

1397

if SO_BINDTODEVICE is None:

1570

logger.error("SO_BINDTODEVICE does not exist;"

1571

" cannot bind to interface %s",

1398

logger.error(u"SO_BINDTODEVICE does not exist;"

1399

u" cannot bind to interface %s",

1572

1400

self.interface)

1573

1401

else:

1574

1402

try:

1575

1403

self.socket.setsockopt(socket.SOL_SOCKET,

1576

1404

SO_BINDTODEVICE,

1577

1405

str(self.interface

1578

+ '\0'))

1579

except socket.error as error:

1406

+ u'\0'))

1407

except socket.error, error:

1580

1408

if error[0] == errno.EPERM:

1581

logger.error("No permission to"

1582

" bind to interface %s",

1409

logger.error(u"No permission to"

1410

u" bind to interface %s",

1583

1411

self.interface)

1584

1412

elif error[0] == errno.ENOPROTOOPT:

1585

logger.error("SO_BINDTODEVICE not available;"

1586

" cannot bind to interface %s",

1413

logger.error(u"SO_BINDTODEVICE not available;"

1414

u" cannot bind to interface %s",

1587

1415

self.interface)

1588

1416

else:

1589

1417

raise

1591

1419

if self.server_address[0] or self.server_address[1]:

1592

1420

if not self.server_address[0]:

1593

1421

if self.address_family == socket.AF_INET6:

1594

any_address = "::" # in6addr_any

1422

any_address = u"::" # in6addr_any

1595

1423

else:

1596

1424

any_address = socket.INADDR_ANY

1597

1425

self.server_address = (any_address,

1634

1462

def server_activate(self):

1635

1463

if self.enabled:

1636

1464

return socketserver.TCPServer.server_activate(self)

1637

1638

1465

def enable(self):

1639

1466

self.enabled = True

1640

1641

def add_pipe(self, parent_pipe, proc):

1467

def add_pipe(self, parent_pipe):

1642

1468

# Call "handle_ipc" for both data and EOF events

1643

1469

gobject.io_add_watch(parent_pipe.fileno(),

1644

1470

gobject.IO_IN | gobject.IO_HUP,

1645

1471

functools.partial(self.handle_ipc,

1646

parent_pipe =

1647

parent_pipe,

1648

proc = proc))

1649

1472

parent_pipe = parent_pipe))

1473

1650

1474

def handle_ipc(self, source, condition, parent_pipe=None,

1651

proc = None, client_object=None):

1475

client_object=None):

1652

1476

condition_names = {

1653

gobject.IO_IN: "IN", # There is data to read.

1654

gobject.IO_OUT: "OUT", # Data can be written (without

1477

gobject.IO_IN: u"IN", # There is data to read.

1478

gobject.IO_OUT: u"OUT", # Data can be written (without

1655

1479

# blocking).

1656

gobject.IO_PRI: "PRI", # There is urgent data to read.

1657

gobject.IO_ERR: "ERR", # Error condition.

1658

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1480

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1481

gobject.IO_ERR: u"ERR", # Error condition.

1482

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1659

1483

# broken, usually for pipes and

1660

1484

# sockets).

1661

1485

}

1663

1487

for cond, name in

1664

1488

condition_names.iteritems()

1665

1489

if cond & condition)

1666

# error, or the other end of multiprocessing.Pipe has closed

1490

# error or the other end of multiprocessing.Pipe has closed

1667

1491

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1668

# Wait for other process to exit

1669

proc.join()

1670

1492

return False

1671

1493

1672

1494

# Read a request from the child

1682

1504

client = c

1683

1505

break

1684

1506

else:

1685

logger.info("Client not found for fingerprint: %s, ad"

1686

"dress: %s", fpr, address)

1507

logger.warning(u"Client not found for fingerprint: %s, ad"

1508

u"dress: %s", fpr, address)

1687

1509

if self.use_dbus:

1688

1510

# Emit D-Bus signal

1689

mandos_dbus_service.ClientNotFound(fpr,

1690

address[0])

1511

mandos_dbus_service.ClientNotFound(fpr, address)

1691

1512

parent_pipe.send(False)

1692

1513

return False

1693

1514

1694

1515

gobject.io_add_watch(parent_pipe.fileno(),

1695

1516

gobject.IO_IN | gobject.IO_HUP,

1696

1517

functools.partial(self.handle_ipc,

1697

parent_pipe =

1698

parent_pipe,

1699

proc = proc,

1700

client_object =

1701

client))

1518

parent_pipe = parent_pipe,

1519

client_object = client))

1702

1520

parent_pipe.send(True)

1703

# remove the old hook in favor of the new above hook on

1704

# same fileno

1521

# remove the old hook in favor of the new above hook on same fileno

1705

1522

return False

1706

1523

if command == 'funcall':

1707

1524

funcname = request[1]

1708

1525

args = request[2]

1709

1526

kwargs = request[3]

1710

1527

1711

parent_pipe.send(('data', getattr(client_object,

1712

funcname)(*args,

1713

**kwargs)))

1714

1528

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1529

1715

1530

if command == 'getattr':

1716

1531

attrname = request[1]

1717

1532

if callable(client_object.__getattribute__(attrname)):

1718

1533

parent_pipe.send(('function',))

1719

1534

else:

1720

parent_pipe.send(('data', client_object

1721

.__getattribute__(attrname)))

1535

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1722

1536

1723

1537

if command == 'setattr':

1724

1538

attrname = request[1]

1725

1539

value = request[2]

1726

1540

setattr(client_object, attrname, value)

1727

1541

1728

1542

return True

1729

1543

1730

1544

1731

1545

def string_to_delta(interval):

1732

1546

"""Parse a string and return a datetime.timedelta

1733

1547

1734

>>> string_to_delta('7d')

1548

>>> string_to_delta(u'7d')

1735

1549

datetime.timedelta(7)

1736

>>> string_to_delta('60s')

1550

>>> string_to_delta(u'60s')

1737

1551

datetime.timedelta(0, 60)

1738

>>> string_to_delta('60m')

1552

>>> string_to_delta(u'60m')

1739

1553

datetime.timedelta(0, 3600)

1740

>>> string_to_delta('24h')

1554

>>> string_to_delta(u'24h')

1741

1555

datetime.timedelta(1)

1742

>>> string_to_delta('1w')

1556

>>> string_to_delta(u'1w')

1743

1557

datetime.timedelta(7)

1744

>>> string_to_delta('5m 30s')

1558

>>> string_to_delta(u'5m 30s')

1745

1559

datetime.timedelta(0, 330)

1746

1560

"""

1747

1561

timevalue = datetime.timedelta(0)

1749

1563

try:

1750

1564

suffix = unicode(s[-1])

1751

1565

value = int(s[:-1])

1752

if suffix == "d":

1566

if suffix == u"d":

1753

1567

delta = datetime.timedelta(value)

1754

elif suffix == "s":

1568

elif suffix == u"s":

1755

1569

delta = datetime.timedelta(0, value)

1756

elif suffix == "m":

1570

elif suffix == u"m":

1757

1571

delta = datetime.timedelta(0, 0, 0, 0, value)

1758

elif suffix == "h":

1572

elif suffix == u"h":

1759

1573

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1760

elif suffix == "w":

1574

elif suffix == u"w":

1761

1575

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1762

1576

else:

1763

raise ValueError("Unknown suffix %r" % suffix)

1764

except (ValueError, IndexError) as e:

1765

raise ValueError(*(e.args))

1577

raise ValueError(u"Unknown suffix %r" % suffix)

1578

except (ValueError, IndexError), e:

1579

raise ValueError(e.message)

1766

1580

timevalue += delta

1767

1581

return timevalue

1768

1582

1774

1588

global if_nametoindex

1775

1589

try:

1776

1590

if_nametoindex = (ctypes.cdll.LoadLibrary

1777

(ctypes.util.find_library("c"))

1591

(ctypes.util.find_library(u"c"))

1778

1592

.if_nametoindex)

1779

1593

except (OSError, AttributeError):

1780

logger.warning("Doing if_nametoindex the hard way")

1594

logger.warning(u"Doing if_nametoindex the hard way")

1781

1595

def if_nametoindex(interface):

1782

1596

"Get an interface index the hard way, i.e. using fcntl()"

1783

1597

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1784

1598

with contextlib.closing(socket.socket()) as s:

1785

1599

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1786

struct.pack(str("16s16x"),

1600

struct.pack(str(u"16s16x"),

1787

1601

interface))

1788

interface_index = struct.unpack(str("I"),

1602

interface_index = struct.unpack(str(u"I"),

1789

1603

ifreq[16:20])[0]

1790

1604

return interface_index

1791

1605

return if_nametoindex(interface)

1799

1613

sys.exit()

1800

1614

os.setsid()

1801

1615

if not nochdir:

1802

os.chdir("/")

1616

os.chdir(u"/")

1803

1617

if os.fork():

1804

1618

sys.exit()

1805

1619

if not noclose:

1807

1621

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1808

1622

if not stat.S_ISCHR(os.fstat(null).st_mode):

1809

1623

raise OSError(errno.ENODEV,

1810

"%s not a character device"

1624

u"%s not a character device"

1811

1625

% os.path.devnull)

1812

1626

os.dup2(null, sys.stdin.fileno())

1813

1627

os.dup2(null, sys.stdout.fileno())

1821

1635

##################################################################

1822

1636

# Parsing of options, both command line and config file

1823

1637

1824

parser = argparse.ArgumentParser()

1825

parser.add_argument("-v", "--version", action="version",

1826

version = "%%(prog)s %s" % version,

1827

help="show version number and exit")

1828

parser.add_argument("-i", "--interface", metavar="IF",

1829

help="Bind to interface IF")

1830

parser.add_argument("-a", "--address",

1831

help="Address to listen for requests on")

1832

parser.add_argument("-p", "--port", type=int,

1833

help="Port number to receive requests on")

1834

parser.add_argument("--check", action="store_true",

1835

help="Run self-test")

1836

parser.add_argument("--debug", action="store_true",

1837

help="Debug mode; run in foreground and log"

1838

" to terminal")

1839

parser.add_argument("--debuglevel", metavar="LEVEL",

1840

help="Debug level for stdout output")

1841

parser.add_argument("--priority", help="GnuTLS"

1842

" priority string (see GnuTLS documentation)")

1843

parser.add_argument("--servicename",

1844

metavar="NAME", help="Zeroconf service name")

1845

parser.add_argument("--configdir",

1846

default="/etc/mandos", metavar="DIR",

1847

help="Directory to search for configuration"

1848

" files")

1849

parser.add_argument("--no-dbus", action="store_false",

1850

dest="use_dbus", help="Do not provide D-Bus"

1851

" system bus interface")

1852

parser.add_argument("--no-ipv6", action="store_false",

1853

dest="use_ipv6", help="Do not use IPv6")

1854

options = parser.parse_args()

1638

parser = optparse.OptionParser(version = "%%prog %s" % version)

1639

parser.add_option("-i", u"--interface", type=u"string",

1640

metavar="IF", help=u"Bind to interface IF")

1641

parser.add_option("-a", u"--address", type=u"string",

1642

help=u"Address to listen for requests on")

1643

parser.add_option("-p", u"--port", type=u"int",

1644

help=u"Port number to receive requests on")

1645

parser.add_option("--check", action=u"store_true",

1646

help=u"Run self-test")

1647

parser.add_option("--debug", action=u"store_true",

1648

help=u"Debug mode; run in foreground and log to"

1649

u" terminal")

1650

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1651

help=u"Debug level for stdout output")

1652

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1653

u" priority string (see GnuTLS documentation)")

1654

parser.add_option("--servicename", type=u"string",

1655

metavar=u"NAME", help=u"Zeroconf service name")

1656

parser.add_option("--configdir", type=u"string",

1657

default=u"/etc/mandos", metavar=u"DIR",

1658

help=u"Directory to search for configuration"

1659

u" files")

1660

parser.add_option("--no-dbus", action=u"store_false",

1661

dest=u"use_dbus", help=u"Do not provide D-Bus"

1662

u" system bus interface")

1663

parser.add_option("--no-ipv6", action=u"store_false",

1664

dest=u"use_ipv6", help=u"Do not use IPv6")

1665

options = parser.parse_args()[0]

1855

1666

1856

1667

if options.check:

1857

1668

import doctest

1859

1670

sys.exit()

1860

1671

1861

1672

# Default values for config file for server-global settings

1862

server_defaults = { "interface": "",

1863

"address": "",

1864

"port": "",

1865

"debug": "False",

1866

"priority":

1867

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1868

"servicename": "Mandos",

1869

"use_dbus": "True",

1870

"use_ipv6": "True",

1871

"debuglevel": "",

1673

server_defaults = { u"interface": u"",

1674

u"address": u"",

1675

u"port": u"",

1676

u"debug": u"False",

1677

u"priority":

1678

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1679

u"servicename": u"Mandos",

1680

u"use_dbus": u"True",

1681

u"use_ipv6": u"True",

1682

u"debuglevel": u"",

1872

1683

}

1873

1684

1874

1685

# Parse config file for server-global settings

1875

1686

server_config = configparser.SafeConfigParser(server_defaults)

1876

1687

del server_defaults

1877

1688

server_config.read(os.path.join(options.configdir,

1878

"mandos.conf"))

1689

u"mandos.conf"))

1879

1690

# Convert the SafeConfigParser object to a dict

1880

1691

server_settings = server_config.defaults()

1881

1692

# Use the appropriate methods on the non-string config options

1882

for option in ("debug", "use_dbus", "use_ipv6"):

1883

server_settings[option] = server_config.getboolean("DEFAULT",

1693

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1694

server_settings[option] = server_config.getboolean(u"DEFAULT",

1884

1695

option)

1885

1696

if server_settings["port"]:

1886

server_settings["port"] = server_config.getint("DEFAULT",

1887

"port")

1697

server_settings["port"] = server_config.getint(u"DEFAULT",

1698

u"port")

1888

1699

del server_config

1889

1700

1890

1701

# Override the settings from the config file with command line

1891

1702

# options, if set.

1892

for option in ("interface", "address", "port", "debug",

1893

"priority", "servicename", "configdir",

1894

"use_dbus", "use_ipv6", "debuglevel"):

1703

for option in (u"interface", u"address", u"port", u"debug",

1704

u"priority", u"servicename", u"configdir",

1705

u"use_dbus", u"use_ipv6", u"debuglevel"):

1895

1706

value = getattr(options, option)

1896

1707

if value is not None:

1897

1708

server_settings[option] = value

1905

1716

##################################################################

1906

1717

1907

1718

# For convenience

1908

debug = server_settings["debug"]

1909

debuglevel = server_settings["debuglevel"]

1910

use_dbus = server_settings["use_dbus"]

1911

use_ipv6 = server_settings["use_ipv6"]

1912

1913

if server_settings["servicename"] != "Mandos":

1719

debug = server_settings[u"debug"]

1720

debuglevel = server_settings[u"debuglevel"]

1721

use_dbus = server_settings[u"use_dbus"]

1722

use_ipv6 = server_settings[u"use_ipv6"]

1723

1724

if server_settings[u"servicename"] != u"Mandos":

1914

1725

syslogger.setFormatter(logging.Formatter

1915

('Mandos (%s) [%%(process)d]:'

1916

' %%(levelname)s: %%(message)s'

1917

% server_settings["servicename"]))

1726

(u'Mandos (%s) [%%(process)d]:'

1727

u' %%(levelname)s: %%(message)s'

1728

% server_settings[u"servicename"]))

1918

1729

1919

1730

# Parse config file with clients

1920

client_defaults = { "timeout": "5m",

1921

"extended_timeout": "15m",

1922

"interval": "2m",

1923

"checker": "fping -q -- %%(host)s",

1924

"host": "",

1925

"approval_delay": "0s",

1926

"approval_duration": "1s",

1731

client_defaults = { u"timeout": u"1h",

1732

u"interval": u"5m",

1733

u"checker": u"fping -q -- %%(host)s",

1734

u"host": u"",

1735

u"approval_delay": u"0s",

1736

u"approval_duration": u"1s",

1927

1737

}

1928

1738

client_config = configparser.SafeConfigParser(client_defaults)

1929

client_config.read(os.path.join(server_settings["configdir"],

1930

"clients.conf"))

1739

client_config.read(os.path.join(server_settings[u"configdir"],

1740

u"clients.conf"))

1931

1741

1932

1742

global mandos_dbus_service

1933

1743

mandos_dbus_service = None

1934

1744

1935

tcp_server = MandosServer((server_settings["address"],

1936

server_settings["port"]),

1745

tcp_server = MandosServer((server_settings[u"address"],

1746

server_settings[u"port"]),

1937

1747

ClientHandler,

1938

interface=(server_settings["interface"]

1748

interface=(server_settings[u"interface"]

1939

1749

or None),

1940

1750

use_ipv6=use_ipv6,

1941

1751

gnutls_priority=

1942

server_settings["priority"],

1752

server_settings[u"priority"],

1943

1753

use_dbus=use_dbus)

1944

if not debug:

1945

pidfilename = "/var/run/mandos.pid"

1946

try:

1947

pidfile = open(pidfilename, "w")

1948

except IOError:

1949

logger.error("Could not open file %r", pidfilename)

1754

pidfilename = u"/var/run/mandos.pid"

1755

try:

1756

pidfile = open(pidfilename, u"w")

1757

except IOError:

1758

logger.error(u"Could not open file %r", pidfilename)

1950

1759

1951

1760

try:

1952

uid = pwd.getpwnam("_mandos").pw_uid

1953

gid = pwd.getpwnam("_mandos").pw_gid

1761

uid = pwd.getpwnam(u"_mandos").pw_uid

1762

gid = pwd.getpwnam(u"_mandos").pw_gid

1954

1763

except KeyError:

1955

1764

try:

1956

uid = pwd.getpwnam("mandos").pw_uid

1957

gid = pwd.getpwnam("mandos").pw_gid

1765

uid = pwd.getpwnam(u"mandos").pw_uid

1766

gid = pwd.getpwnam(u"mandos").pw_gid

1958

1767

except KeyError:

1959

1768

try:

1960

uid = pwd.getpwnam("nobody").pw_uid

1961

gid = pwd.getpwnam("nobody").pw_gid

1769

uid = pwd.getpwnam(u"nobody").pw_uid

1770

gid = pwd.getpwnam(u"nobody").pw_gid

1962

1771

except KeyError:

1963

1772

uid = 65534

1964

1773

gid = 65534

1965

1774

try:

1966

1775

os.setgid(gid)

1967

1776

os.setuid(uid)

1968

except OSError as error:

1777

except OSError, error:

1969

1778

if error[0] != errno.EPERM:

1970

1779

raise error

1971

1780

1976

1785

level = getattr(logging, debuglevel.upper())

1977

1786

syslogger.setLevel(level)

1978

1787

console.setLevel(level)

1979

1788

1980

1789

if debug:

1981

1790

# Enable all possible GnuTLS debugging

1982

1791

1986

1795

1987

1796

@gnutls.library.types.gnutls_log_func

1988

1797

def debug_gnutls(level, string):

1989

logger.debug("GnuTLS: %s", string[:-1])

1798

logger.debug(u"GnuTLS: %s", string[:-1])

1990

1799

1991

1800

(gnutls.library.functions

1992

1801

.gnutls_global_set_log_function(debug_gnutls))

2000

1809

# No console logging

2001

1810

logger.removeHandler(console)

2002

1811

2003

# Need to fork before connecting to D-Bus

2004

if not debug:

2005

# Close all input and output, do double fork, etc.

2006

daemon()

2007

1812

2008

1813

global main_loop

2009

1814

# From the Avahi example code

2013

1818

# End of Avahi example code

2014

1819

if use_dbus:

2015

1820

try:

2016

bus_name = dbus.service.BusName("se.recompile.Mandos",

1821

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2017

1822

bus, do_not_queue=True)

2018

old_bus_name = (dbus.service.BusName

2019

("se.bsnet.fukt.Mandos", bus,

2020

do_not_queue=True))

2021

except dbus.exceptions.NameExistsException as e:

2022

logger.error(unicode(e) + ", disabling D-Bus")

1823

except dbus.exceptions.NameExistsException, e:

1824

logger.error(unicode(e) + u", disabling D-Bus")

2023

1825

use_dbus = False

2024

server_settings["use_dbus"] = False

1826

server_settings[u"use_dbus"] = False

2025

1827

tcp_server.use_dbus = False

2026

1828

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

2027

service = AvahiService(name = server_settings["servicename"],

2028

servicetype = "_mandos._tcp",

1829

service = AvahiService(name = server_settings[u"servicename"],

1830

servicetype = u"_mandos._tcp",

2029

1831

protocol = protocol, bus = bus)

2030

1832

if server_settings["interface"]:

2031

1833

service.interface = (if_nametoindex

2032

(str(server_settings["interface"])))

2033

1834

(str(server_settings[u"interface"])))

1835

1836

if not debug:

1837

# Close all input and output, do double fork, etc.

1838

daemon()

1839

2034

1840

global multiprocessing_manager

2035

1841

multiprocessing_manager = multiprocessing.Manager()

2036

1842

2037

1843

client_class = Client

2038

1844

if use_dbus:

2039

client_class = functools.partial(ClientDBusTransitional,

2040

bus = bus)

1845

client_class = functools.partial(ClientDBus, bus = bus)

2041

1846

def client_config_items(config, section):

2042

1847

special_settings = {

2043

1848

"approved_by_default":

2056

1861

client_config, section)))

2057

1862

for section in client_config.sections()))

2058

1863

if not tcp_server.clients:

2059

logger.warning("No clients defined")

1864

logger.warning(u"No clients defined")

2060

1865

1866

try:

1867

with pidfile:

1868

pid = os.getpid()

1869

pidfile.write(str(pid) + "\n")

1870

del pidfile

1871

except IOError:

1872

logger.error(u"Could not write to file %r with PID %d",

1873

pidfilename, pid)

1874

except NameError:

1875

# "pidfile" was never created

1876

pass

1877

del pidfilename

1878

2061

1879

if not debug:

2062

try:

2063

with pidfile:

2064

pid = os.getpid()

2065

pidfile.write(str(pid) + "\n".encode("utf-8"))

2066

del pidfile

2067

except IOError:

2068

logger.error("Could not write to file %r with PID %d",

2069

pidfilename, pid)

2070

except NameError:

2071

# "pidfile" was never created

2072

pass

2073

del pidfilename

2074

2075

1880

signal.signal(signal.SIGINT, signal.SIG_IGN)

2076

2077

1881

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2078

1882

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2079

1883

2081

1885

class MandosDBusService(dbus.service.Object):

2082

1886

"""A D-Bus proxy object"""

2083

1887

def __init__(self):

2084

dbus.service.Object.__init__(self, bus, "/")

2085

_interface = "se.recompile.Mandos"

1888

dbus.service.Object.__init__(self, bus, u"/")

1889

_interface = u"se.bsnet.fukt.Mandos"

2086

1890

2087

@dbus.service.signal(_interface, signature="o")

1891

@dbus.service.signal(_interface, signature=u"o")

2088

1892

def ClientAdded(self, objpath):

2089

1893

"D-Bus signal"

2090

1894

pass

2091

1895

2092

@dbus.service.signal(_interface, signature="ss")

1896

@dbus.service.signal(_interface, signature=u"ss")

2093

1897

def ClientNotFound(self, fingerprint, address):

2094

1898

"D-Bus signal"

2095

1899

pass

2096

1900

2097

@dbus.service.signal(_interface, signature="os")

1901

@dbus.service.signal(_interface, signature=u"os")

2098

1902

def ClientRemoved(self, objpath, name):

2099

1903

"D-Bus signal"

2100

1904

pass

2101

1905

2102

@dbus.service.method(_interface, out_signature="ao")

1906

@dbus.service.method(_interface, out_signature=u"ao")

2103

1907

def GetAllClients(self):

2104

1908

"D-Bus method"

2105

1909

return dbus.Array(c.dbus_object_path

2106

1910

for c in tcp_server.clients)

2107

1911

2108

1912

@dbus.service.method(_interface,

2109

out_signature="a{oa{sv}}")

1913

out_signature=u"a{oa{sv}}")

2110

1914

def GetAllClientsWithProperties(self):

2111

1915

"D-Bus method"

2112

1916

return dbus.Dictionary(

2113

((c.dbus_object_path, c.GetAll(""))

1917

((c.dbus_object_path, c.GetAll(u""))

2114

1918

for c in tcp_server.clients),

2115

signature="oa{sv}")

1919

signature=u"oa{sv}")

2116

1920

2117

@dbus.service.method(_interface, in_signature="o")

1921

@dbus.service.method(_interface, in_signature=u"o")

2118

1922

def RemoveClient(self, object_path):

2119

1923

"D-Bus method"

2120

1924

for c in tcp_server.clients:

2130

1934

2131

1935

del _interface

2132

1936

2133

class MandosDBusServiceTransitional(MandosDBusService):

2134

__metaclass__ = AlternateDBusNamesMetaclass

2135

mandos_dbus_service = MandosDBusServiceTransitional()

1937

mandos_dbus_service = MandosDBusService()

2136

1938

2137

1939

def cleanup():

2138

1940

"Cleanup function; run on exit"

2139

1941

service.cleanup()

2140

1942

2141

multiprocessing.active_children()

2142

1943

while tcp_server.clients:

2143

1944

client = tcp_server.clients.pop()

2144

1945

if use_dbus:

2148

1949

client.disable(quiet=True)

2149

1950

if use_dbus:

2150

1951

# Emit D-Bus signal

2151

mandos_dbus_service.ClientRemoved(client

2152

.dbus_object_path,

1952

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2153

1953

client.name)

2154

1954

2155

1955

atexit.register(cleanup)

2166

1966

# Find out what port we got

2167

1967

service.port = tcp_server.socket.getsockname()[1]

2168

1968

if use_ipv6:

2169

logger.info("Now listening on address %r, port %d,"

1969

logger.info(u"Now listening on address %r, port %d,"

2170

1970

" flowinfo %d, scope_id %d"

2171

1971

% tcp_server.socket.getsockname())

2172

1972

else: # IPv4

2173

logger.info("Now listening on address %r, port %d"

1973

logger.info(u"Now listening on address %r, port %d"

2174

1974

% tcp_server.socket.getsockname())

2175

1975

2176

1976

#service.interface = tcp_server.socket.getsockname()[3]

2179

1979

# From the Avahi example code

2180

1980

try:

2181

1981

service.activate()

2182

except dbus.exceptions.DBusException as error:

2183

logger.critical("DBusException: %s", error)

1982

except dbus.exceptions.DBusException, error:

1983

logger.critical(u"DBusException: %s", error)

2184

1984

cleanup()

2185

1985

sys.exit(1)

2186

1986

# End of Avahi example code

2190

1990

(tcp_server.handle_request

2191

1991

(*args[2:], **kwargs) or True))

2192

1992

2193

logger.debug("Starting main loop")

1993

logger.debug(u"Starting main loop")

2194

1994

main_loop.run()

2195

except AvahiError as error:

2196

logger.critical("AvahiError: %s", error)

1995

except AvahiError, error:

1996

logger.critical(u"AvahiError: %s", error)

2197

1997

cleanup()

2198

1998

sys.exit(1)

2199

1999

except KeyboardInterrupt:

2200

2000

if debug:

2201

print("", file=sys.stderr)

2202

logger.debug("Server received KeyboardInterrupt")

2203

logger.debug("Server exiting")

2001

print >> sys.stderr

2002

logger.debug(u"Server received KeyboardInterrupt")

2003

logger.debug(u"Server exiting")

2204

2004

# Must run before the D-Bus bus name gets deregistered

2205

2005

cleanup()

2206

2006

2207

2208

2007

if __name__ == '__main__':

2209

2008

main()