/mandos/trunk : revision 24.1.168

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

62

61

import functools

63

62

import cPickle as pickle

64

63

import multiprocessing

65

import types

66

64

67

65

import dbus

68

66

import dbus.service

83

81

SO_BINDTODEVICE = None

84

82

85

83

86

version = "1.3.1"

84

version = "1.2"

87

85

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

90

88

syslogger = (logging.handlers.SysLogHandler

91

89

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

address = str("/dev/log")))

90

address = "/dev/log"))

93

91

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

96

94

logger.addHandler(syslogger)

97

95

98

96

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

102

100

logger.addHandler(console)

103

101

104

102

class AvahiError(Exception):

121

119

Attributes:

122

120

interface: integer; avahi.IF_UNSPEC or an interface index.

123

121

Used to optionally bind to the specified interface.

124

name: string; Example: 'Mandos'

125

type: string; Example: '_mandos._tcp'.

122

name: string; Example: u'Mandos'

123

type: string; Example: u'_mandos._tcp'.

126

124

See <http://www.dns-sd.org/ServiceTypes.html>

127

125

port: integer; what port to announce

128

126

TXT: list of strings; TXT record for the service

137

135

"""

138

136

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

139

137

servicetype = None, port = None, TXT = None,

140

domain = "", host = "", max_renames = 32768,

138

domain = u"", host = u"", max_renames = 32768,

141

139

protocol = avahi.PROTO_UNSPEC, bus = None):

142

140

self.interface = interface

143

141

self.name = name

152

150

self.group = None # our entry group

153

151

self.server = None

154

152

self.bus = bus

155

self.entry_group_state_changed_match = None

156

153

def rename(self):

157

154

"""Derived from the Avahi example code"""

158

155

if self.rename_count >= self.max_renames:

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

161

158

self.rename_count)

162

raise AvahiServiceError("Too many renames")

159

raise AvahiServiceError(u"Too many renames")

163

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

164

logger.info("Changing Zeroconf service name to %r ...",

161

logger.info(u"Changing Zeroconf service name to %r ...",

165

162

self.name)

166

163

syslogger.setFormatter(logging.Formatter

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

169

166

% self.name))

170

167

self.remove()

171

168

try:

172

169

self.add()

173

except dbus.exceptions.DBusException as error:

174

logger.critical("DBusException: %s", error)

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

175

172

self.cleanup()

176

173

os._exit(1)

177

174

self.rename_count += 1

178

175

def remove(self):

179

176

"""Derived from the Avahi example code"""

180

if self.entry_group_state_changed_match is not None:

181

self.entry_group_state_changed_match.remove()

182

self.entry_group_state_changed_match = None

183

177

if self.group is not None:

184

178

self.group.Reset()

185

179

def add(self):

186

180

"""Derived from the Avahi example code"""

187

self.remove()

188

181

if self.group is None:

189

182

self.group = dbus.Interface(

190

183

self.bus.get_object(avahi.DBUS_NAME,

191

184

self.server.EntryGroupNew()),

192

185

avahi.DBUS_INTERFACE_ENTRY_GROUP)

193

self.entry_group_state_changed_match = (

194

self.group.connect_to_signal(

195

'StateChanged', self .entry_group_state_changed))

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

186

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

197

190

self.name, self.type)

198

191

self.group.AddService(

199

192

self.interface,

206

199

self.group.Commit()

207

200

def entry_group_state_changed(self, state, error):

208

201

"""Derived from the Avahi example code"""

209

logger.debug("Avahi entry group state change: %i", state)

202

logger.debug(u"Avahi entry group state change: %i", state)

210

203

211

204

if state == avahi.ENTRY_GROUP_ESTABLISHED:

212

logger.debug("Zeroconf service established.")

205

logger.debug(u"Zeroconf service established.")

213

206

elif state == avahi.ENTRY_GROUP_COLLISION:

214

logger.info("Zeroconf service name collision.")

207

logger.warning(u"Zeroconf service name collision.")

215

208

self.rename()

216

209

elif state == avahi.ENTRY_GROUP_FAILURE:

217

logger.critical("Avahi: Error in group state changed %s",

210

logger.critical(u"Avahi: Error in group state changed %s",

218

211

unicode(error))

219

raise AvahiGroupError("State changed: %s"

212

raise AvahiGroupError(u"State changed: %s"

220

213

% unicode(error))

221

214

def cleanup(self):

222

215

"""Derived from the Avahi example code"""

223

216

if self.group is not None:

224

try:

225

self.group.Free()

226

except (dbus.exceptions.UnknownMethodException,

227

dbus.exceptions.DBusException) as e:

228

pass

217

self.group.Free()

229

218

self.group = None

230

self.remove()

231

def server_state_changed(self, state, error=None):

219

def server_state_changed(self, state):

232

220

"""Derived from the Avahi example code"""

233

logger.debug("Avahi server state change: %i", state)

234

bad_states = { avahi.SERVER_INVALID:

235

"Zeroconf server invalid",

236

avahi.SERVER_REGISTERING: None,

237

avahi.SERVER_COLLISION:

238

"Zeroconf server name collision",

239

avahi.SERVER_FAILURE:

240

"Zeroconf server failure" }

241

if state in bad_states:

242

if bad_states[state] is not None:

243

if error is None:

244

logger.error(bad_states[state])

245

else:

246

logger.error(bad_states[state] + ": %r", error)

247

self.cleanup()

221

logger.debug(u"Avahi server state change: %i", state)

222

if state == avahi.SERVER_COLLISION:

223

logger.error(u"Zeroconf server name collision")

224

self.remove()

248

225

elif state == avahi.SERVER_RUNNING:

249

226

self.add()

250

else:

251

if error is None:

252

logger.debug("Unknown state: %r", state)

253

else:

254

logger.debug("Unknown state: %r: %r", state, error)

255

227

def activate(self):

256

228

"""Derived from the Avahi example code"""

257

229

if self.server is None:

258

230

self.server = dbus.Interface(

259

231

self.bus.get_object(avahi.DBUS_NAME,

260

avahi.DBUS_PATH_SERVER,

261

follow_name_owner_changes=True),

232

avahi.DBUS_PATH_SERVER),

262

233

avahi.DBUS_INTERFACE_SERVER)

263

self.server.connect_to_signal("StateChanged",

234

self.server.connect_to_signal(u"StateChanged",

264

235

self.server_state_changed)

265

236

self.server_state_changed(self.server.GetState())

266

237

267

238

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

274

239

class Client(object):

275

240

"""A representation of a client host served by this server.

276

241

304

269

secret: bytestring; sent verbatim (over TLS) to client

305

270

timeout: datetime.timedelta(); How long from last_checked_ok

306

271

until this client is disabled

307

extended_timeout: extra long timeout when password has been sent

308

272

runtime_expansions: Allowed attributes for runtime expansion.

309

expires: datetime.datetime(); time (UTC) when a client will be

310

disabled, or None

311

273

"""

312

274

313

runtime_expansions = ("approval_delay", "approval_duration",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

316

"last_enabled", "name", "timeout")

275

runtime_expansions = (u"approval_delay", u"approval_duration",

276

u"created", u"enabled", u"fingerprint",

277

u"host", u"interval", u"last_checked_ok",

278

u"last_enabled", u"name", u"timeout")

279

280

@staticmethod

281

def _timedelta_to_milliseconds(td):

282

"Convert a datetime.timedelta() to milliseconds"

283

return ((td.days * 24 * 60 * 60 * 1000)

284

+ (td.seconds * 1000)

285

+ (td.microseconds // 1000))

317

286

318

287

def timeout_milliseconds(self):

319

288

"Return the 'timeout' attribute in milliseconds"

320

return _timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

289

return self._timedelta_to_milliseconds(self.timeout)

325

290

326

291

def interval_milliseconds(self):

327

292

"Return the 'interval' attribute in milliseconds"

328

return _timedelta_to_milliseconds(self.interval)

329

293

return self._timedelta_to_milliseconds(self.interval)

294

330

295

def approval_delay_milliseconds(self):

331

return _timedelta_to_milliseconds(self.approval_delay)

296

return self._timedelta_to_milliseconds(self.approval_delay)

332

297

333

298

def __init__(self, name = None, disable_hook=None, config=None):

334

299

"""Note: the 'checker' key in 'config' sets the

337

302

self.name = name

338

303

if config is None:

339

304

config = {}

340

logger.debug("Creating client %r", self.name)

305

logger.debug(u"Creating client %r", self.name)

341

306

# Uppercase and remove spaces from fingerprint for later

342

307

# comparison purposes with return value from the fingerprint()

343

308

# function

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

309

self.fingerprint = (config[u"fingerprint"].upper()

310

.replace(u" ", u""))

311

logger.debug(u" Fingerprint: %s", self.fingerprint)

312

if u"secret" in config:

313

self.secret = config[u"secret"].decode(u"base64")

314

elif u"secfile" in config:

350

315

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

316

(config[u"secfile"])),

352

317

"rb") as secfile:

353

318

self.secret = secfile.read()

354

319

else:

355

raise TypeError("No secret or secfile for client %s"

320

raise TypeError(u"No secret or secfile for client %s"

356

321

% self.name)

357

self.host = config.get("host", "")

322

self.host = config.get(u"host", u"")

358

323

self.created = datetime.datetime.utcnow()

359

324

self.enabled = False

360

325

self.last_approval_request = None

361

326

self.last_enabled = None

362

327

self.last_checked_ok = None

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

328

self.timeout = string_to_delta(config[u"timeout"])

329

self.interval = string_to_delta(config[u"interval"])

366

330

self.disable_hook = disable_hook

367

331

self.checker = None

368

332

self.checker_initiator_tag = None

369

333

self.disable_initiator_tag = None

370

self.expires = None

371

334

self.checker_callback_tag = None

372

self.checker_command = config["checker"]

335

self.checker_command = config[u"checker"]

373

336

self.current_checker_command = None

374

337

self.last_connect = None

375

338

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

339

self.approved_by_default = config.get(u"approved_by_default",

377

340

True)

378

341

self.approvals_pending = 0

379

342

self.approval_delay = string_to_delta(

380

config["approval_delay"])

343

config[u"approval_delay"])

381

344

self.approval_duration = string_to_delta(

382

config["approval_duration"])

345

config[u"approval_duration"])

383

346

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

384

347

385

348

def send_changedstate(self):

389

352

390

353

def enable(self):

391

354

"""Start this client's checker and timeout hooks"""

392

if getattr(self, "enabled", False):

355

if getattr(self, u"enabled", False):

393

356

# Already enabled

394

357

return

395

358

self.send_changedstate()

359

self.last_enabled = datetime.datetime.utcnow()

396

360

# Schedule a new checker to be started an 'interval' from now,

397

361

# and every interval from then on.

398

362

self.checker_initiator_tag = (gobject.timeout_add

399

363

(self.interval_milliseconds(),

400

364

self.start_checker))

401

365

# Schedule a disable() when 'timeout' has passed

402

self.expires = datetime.datetime.utcnow() + self.timeout

403

366

self.disable_initiator_tag = (gobject.timeout_add

404

367

(self.timeout_milliseconds(),

405

368

self.disable))

406

369

self.enabled = True

407

self.last_enabled = datetime.datetime.utcnow()

408

370

# Also start a new checker *right now*.

409

371

self.start_checker()

410

372

415

377

if not quiet:

416

378

self.send_changedstate()

417

379

if not quiet:

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

380

logger.info(u"Disabling client %s", self.name)

381

if getattr(self, u"disable_initiator_tag", False):

420

382

gobject.source_remove(self.disable_initiator_tag)

421

383

self.disable_initiator_tag = None

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

384

if getattr(self, u"checker_initiator_tag", False):

424

385

gobject.source_remove(self.checker_initiator_tag)

425

386

self.checker_initiator_tag = None

426

387

self.stop_checker()

441

402

if os.WIFEXITED(condition):

442

403

exitstatus = os.WEXITSTATUS(condition)

443

404

if exitstatus == 0:

444

logger.info("Checker for %(name)s succeeded",

405

logger.info(u"Checker for %(name)s succeeded",

445

406

vars(self))

446

407

self.checked_ok()

447

408

else:

448

logger.info("Checker for %(name)s failed",

409

logger.info(u"Checker for %(name)s failed",

449

410

vars(self))

450

411

else:

451

logger.warning("Checker for %(name)s crashed?",

412

logger.warning(u"Checker for %(name)s crashed?",

452

413

vars(self))

453

414

454

def checked_ok(self, timeout=None):

415

def checked_ok(self):

455

416

"""Bump up the timeout for this client.

456

417

457

418

This should only be called when the client has been seen,

458

419

alive and well.

459

420

"""

460

if timeout is None:

461

timeout = self.timeout

462

421

self.last_checked_ok = datetime.datetime.utcnow()

463

422

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

423

self.disable_initiator_tag = (gobject.timeout_add

466

(_timedelta_to_milliseconds(timeout),

424

(self.timeout_milliseconds(),

467

425

self.disable))

468

426

469

427

def need_approval(self):

486

444

# If a checker exists, make sure it is not a zombie

487

445

try:

488

446

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

489

except (AttributeError, OSError) as error:

447

except (AttributeError, OSError), error:

490

448

if (isinstance(error, OSError)

491

449

and error.errno != errno.ECHILD):

492

450

raise error

493

451

else:

494

452

if pid:

495

logger.warning("Checker was a zombie")

453

logger.warning(u"Checker was a zombie")

496

454

gobject.source_remove(self.checker_callback_tag)

497

455

self.checker_callback(pid, status,

498

456

self.current_checker_command)

505

463

# Escape attributes for the shell

506

464

escaped_attrs = dict(

507

465

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

466

re.escape(unicode(str(getattr(self, attr, u"")),

509

467

errors=

510

'replace')))

468

u'replace')))

511

469

for attr in

512

470

self.runtime_expansions)

513

471

514

472

try:

515

473

command = self.checker_command % escaped_attrs

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

474

except TypeError, error:

475

logger.error(u'Could not format string "%s":'

476

u' %s', self.checker_command, error)

519

477

return True # Try again later

520

478

self.current_checker_command = command

521

479

try:

522

logger.info("Starting checker %r for %s",

480

logger.info(u"Starting checker %r for %s",

523

481

command, self.name)

524

482

# We don't need to redirect stdout and stderr, since

525

483

# in normal mode, that is already done by daemon(),

527

485

# always replaced by /dev/null.)

528

486

self.checker = subprocess.Popen(command,

529

487

close_fds=True,

530

shell=True, cwd="/")

488

shell=True, cwd=u"/")

531

489

self.checker_callback_tag = (gobject.child_watch_add

532

490

(self.checker.pid,

533

491

self.checker_callback,

538

496

if pid:

539

497

gobject.source_remove(self.checker_callback_tag)

540

498

self.checker_callback(pid, status, command)

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

499

except OSError, error:

500

logger.error(u"Failed to start subprocess: %s",

543

501

error)

544

502

# Re-run this periodically if run by gobject.timeout_add

545

503

return True

549

507

if self.checker_callback_tag:

550

508

gobject.source_remove(self.checker_callback_tag)

551

509

self.checker_callback_tag = None

552

if getattr(self, "checker", None) is None:

510

if getattr(self, u"checker", None) is None:

553

511

return

554

logger.debug("Stopping checker for %(name)s", vars(self))

512

logger.debug(u"Stopping checker for %(name)s", vars(self))

555

513

try:

556

514

os.kill(self.checker.pid, signal.SIGTERM)

557

515

#time.sleep(0.5)

558

516

#if self.checker.poll() is None:

559

517

# os.kill(self.checker.pid, signal.SIGKILL)

560

except OSError as error:

518

except OSError, error:

561

519

if error.errno != errno.ESRCH: # No such process

562

520

raise

563

521

self.checker = None

564

522

565

566

def dbus_service_property(dbus_interface, signature="v",

567

access="readwrite", byte_arrays=False):

523

def dbus_service_property(dbus_interface, signature=u"v",

524

access=u"readwrite", byte_arrays=False):

568

525

"""Decorators for marking methods of a DBusObjectWithProperties to

569

526

become properties on the D-Bus.

570

527

577

534

"""

578

535

# Encoding deeply encoded byte arrays is not supported yet by the

579

536

# "Set" method, so we fail early here:

580

if byte_arrays and signature != "ay":

581

raise ValueError("Byte arrays not supported for non-'ay'"

582

" signature %r" % signature)

537

if byte_arrays and signature != u"ay":

538

raise ValueError(u"Byte arrays not supported for non-'ay'"

539

u" signature %r" % signature)

583

540

def decorator(func):

584

541

func._dbus_is_property = True

585

542

func._dbus_interface = dbus_interface

586

543

func._dbus_signature = signature

587

544

func._dbus_access = access

588

545

func._dbus_name = func.__name__

589

if func._dbus_name.endswith("_dbus_property"):

546

if func._dbus_name.endswith(u"_dbus_property"):

590

547

func._dbus_name = func._dbus_name[:-14]

591

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

548

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

592

549

return func

593

550

return decorator

594

551

614

571

615

572

class DBusObjectWithProperties(dbus.service.Object):

616

573

"""A D-Bus object with properties.

617

574

618

575

Classes inheriting from this can use the dbus_service_property

619

576

decorator to expose methods as D-Bus properties. It exposes the

620

577

standard Get(), Set(), and GetAll() methods on the D-Bus.

622

579

623

580

@staticmethod

624

581

def _is_dbus_property(obj):

625

return getattr(obj, "_dbus_is_property", False)

582

return getattr(obj, u"_dbus_is_property", False)

626

583

627

584

def _get_all_dbus_properties(self):

628

585

"""Returns a generator of (name, attribute) pairs

629

586

"""

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

631

for cls in self.__class__.__mro__

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

587

return ((prop._dbus_name, prop)

588

for name, prop in

589

inspect.getmembers(self, self._is_dbus_property))

633

590

634

591

def _get_dbus_property(self, interface_name, property_name):

635

592

"""Returns a bound method if one exists which is a D-Bus

636

593

property with the specified name and interface.

637

594

"""

638

for cls in self.__class__.__mro__:

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

641

return value.__get__(self)

642

595

for name in (property_name,

596

property_name + u"_dbus_property"):

597

prop = getattr(self, name, None)

598

if (prop is None

599

or not self._is_dbus_property(prop)

600

or prop._dbus_name != property_name

601

or (interface_name and prop._dbus_interface

602

and interface_name != prop._dbus_interface)):

603

continue

604

return prop

643

605

# No such property

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

645

+ interface_name + "."

606

raise DBusPropertyNotFound(self.dbus_object_path + u":"

607

+ interface_name + u"."

646

608

+ property_name)

647

609

648

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

649

out_signature="v")

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

611

out_signature=u"v")

650

612

def Get(self, interface_name, property_name):

651

613

"""Standard D-Bus property Get() method, see D-Bus standard.

652

614

"""

653

615

prop = self._get_dbus_property(interface_name, property_name)

654

if prop._dbus_access == "write":

616

if prop._dbus_access == u"write":

655

617

raise DBusPropertyAccessException(property_name)

656

618

value = prop()

657

if not hasattr(value, "variant_level"):

619

if not hasattr(value, u"variant_level"):

658

620

return value

659

621

return type(value)(value, variant_level=value.variant_level+1)

660

622

661

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

623

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

662

624

def Set(self, interface_name, property_name, value):

663

625

"""Standard D-Bus property Set() method, see D-Bus standard.

664

626

"""

665

627

prop = self._get_dbus_property(interface_name, property_name)

666

if prop._dbus_access == "read":

628

if prop._dbus_access == u"read":

667

629

raise DBusPropertyAccessException(property_name)

668

if prop._dbus_get_args_options["byte_arrays"]:

630

if prop._dbus_get_args_options[u"byte_arrays"]:

669

631

# The byte_arrays option is not supported yet on

670

632

# signatures other than "ay".

671

if prop._dbus_signature != "ay":

633

if prop._dbus_signature != u"ay":

672

634

raise ValueError

673

635

value = dbus.ByteArray(''.join(unichr(byte)

674

636

for byte in value))

675

637

prop(value)

676

638

677

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

678

out_signature="a{sv}")

639

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

640

out_signature=u"a{sv}")

679

641

def GetAll(self, interface_name):

680

642

"""Standard D-Bus property GetAll() method, see D-Bus

681

643

standard.

682

644

683

645

Note: Will not include properties with access="write".

684

646

"""

685

647

all = {}

689

651

# Interface non-empty but did not match

690

652

continue

691

653

# Ignore write-only properties

692

if prop._dbus_access == "write":

654

if prop._dbus_access == u"write":

693

655

continue

694

656

value = prop()

695

if not hasattr(value, "variant_level"):

657

if not hasattr(value, u"variant_level"):

696

658

all[name] = value

697

659

continue

698

660

all[name] = type(value)(value, variant_level=

699

661

value.variant_level+1)

700

return dbus.Dictionary(all, signature="sv")

662

return dbus.Dictionary(all, signature=u"sv")

701

663

702

664

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

703

out_signature="s",

665

out_signature=u"s",

704

666

path_keyword='object_path',

705

667

connection_keyword='connection')

706

668

def Introspect(self, object_path, connection):

711

673

try:

712

674

document = xml.dom.minidom.parseString(xmlstring)

713

675

def make_tag(document, name, prop):

714

e = document.createElement("property")

715

e.setAttribute("name", name)

716

e.setAttribute("type", prop._dbus_signature)

717

e.setAttribute("access", prop._dbus_access)

676

e = document.createElement(u"property")

677

e.setAttribute(u"name", name)

678

e.setAttribute(u"type", prop._dbus_signature)

679

e.setAttribute(u"access", prop._dbus_access)

718

680

return e

719

for if_tag in document.getElementsByTagName("interface"):

681

for if_tag in document.getElementsByTagName(u"interface"):

720

682

for tag in (make_tag(document, name, prop)

721

683

for name, prop

722

684

in self._get_all_dbus_properties()

723

685

if prop._dbus_interface

724

== if_tag.getAttribute("name")):

686

== if_tag.getAttribute(u"name")):

725

687

if_tag.appendChild(tag)

726

688

# Add the names to the return values for the

727

689

# "org.freedesktop.DBus.Properties" methods

728

if (if_tag.getAttribute("name")

729

== "org.freedesktop.DBus.Properties"):

730

for cn in if_tag.getElementsByTagName("method"):

731

if cn.getAttribute("name") == "Get":

732

for arg in cn.getElementsByTagName("arg"):

733

if (arg.getAttribute("direction")

734

== "out"):

735

arg.setAttribute("name", "value")

736

elif cn.getAttribute("name") == "GetAll":

737

for arg in cn.getElementsByTagName("arg"):

738

if (arg.getAttribute("direction")

739

== "out"):

740

arg.setAttribute("name", "props")

741

xmlstring = document.toxml("utf-8")

690

if (if_tag.getAttribute(u"name")

691

== u"org.freedesktop.DBus.Properties"):

692

for cn in if_tag.getElementsByTagName(u"method"):

693

if cn.getAttribute(u"name") == u"Get":

694

for arg in cn.getElementsByTagName(u"arg"):

695

if (arg.getAttribute(u"direction")

696

== u"out"):

697

arg.setAttribute(u"name", u"value")

698

elif cn.getAttribute(u"name") == u"GetAll":

699

for arg in cn.getElementsByTagName(u"arg"):

700

if (arg.getAttribute(u"direction")

701

== u"out"):

702

arg.setAttribute(u"name", u"props")

703

xmlstring = document.toxml(u"utf-8")

742

704

document.unlink()

743

705

except (AttributeError, xml.dom.DOMException,

744

xml.parsers.expat.ExpatError) as error:

745

logger.error("Failed to override Introspection method",

706

xml.parsers.expat.ExpatError), error:

707

logger.error(u"Failed to override Introspection method",

746

708

error)

747

709

return xmlstring

748

710

749

711

750

def datetime_to_dbus (dt, variant_level=0):

751

"""Convert a UTC datetime.datetime() to a D-Bus type."""

752

if dt is None:

753

return dbus.String("", variant_level = variant_level)

754

return dbus.String(dt.isoformat(),

755

variant_level=variant_level)

756

757

class AlternateDBusNamesMetaclass(DBusObjectWithProperties.__metaclass__):

758

"""Applied to an empty subclass of a D-Bus object, this metaclass

759

will add additional D-Bus attributes matching a certain pattern.

760

"""

761

def __new__(mcs, name, bases, attr):

762

# Go through all the base classes which could have D-Bus

763

# methods, signals, or properties in them

764

for base in (b for b in bases

765

if issubclass(b, dbus.service.Object)):

766

# Go though all attributes of the base class

767

for attrname, attribute in inspect.getmembers(base):

768

# Ignore non-D-Bus attributes, and D-Bus attributes

769

# with the wrong interface name

770

if (not hasattr(attribute, "_dbus_interface")

771

or not attribute._dbus_interface

772

.startswith("se.recompile.Mandos")):

773

continue

774

# Create an alternate D-Bus interface name based on

775

# the current name

776

alt_interface = (attribute._dbus_interface

777

.replace("se.recompile.Mandos",

778

"se.bsnet.fukt.Mandos"))

779

# Is this a D-Bus signal?

780

if getattr(attribute, "_dbus_is_signal", False):

781

# Extract the original non-method function by

782

# black magic

783

nonmethod_func = (dict(

784

zip(attribute.func_code.co_freevars,

785

attribute.__closure__))["func"]

786

.cell_contents)

787

# Create a new, but exactly alike, function

788

# object, and decorate it to be a new D-Bus signal

789

# with the alternate D-Bus interface name

790

new_function = (dbus.service.signal

791

(alt_interface,

792

attribute._dbus_signature)

793

(types.FunctionType(

794

nonmethod_func.func_code,

795

nonmethod_func.func_globals,

796

nonmethod_func.func_name,

797

nonmethod_func.func_defaults,

798

nonmethod_func.func_closure)))

799

# Define a creator of a function to call both the

800

# old and new functions, so both the old and new

801

# signals gets sent when the function is called

802

def fixscope(func1, func2):

803

"""This function is a scope container to pass

804

func1 and func2 to the "call_both" function

805

outside of its arguments"""

806

def call_both(*args, **kwargs):

807

"""This function will emit two D-Bus

808

signals by calling func1 and func2"""

809

func1(*args, **kwargs)

810

func2(*args, **kwargs)

811

return call_both

812

# Create the "call_both" function and add it to

813

# the class

814

attr[attrname] = fixscope(attribute,

815

new_function)

816

# Is this a D-Bus method?

817

elif getattr(attribute, "_dbus_is_method", False):

818

# Create a new, but exactly alike, function

819

# object. Decorate it to be a new D-Bus method

820

# with the alternate D-Bus interface name. Add it

821

# to the class.

822

attr[attrname] = (dbus.service.method

823

(alt_interface,

824

attribute._dbus_in_signature,

825

attribute._dbus_out_signature)

826

(types.FunctionType

827

(attribute.func_code,

828

attribute.func_globals,

829

attribute.func_name,

830

attribute.func_defaults,

831

attribute.func_closure)))

832

# Is this a D-Bus property?

833

elif getattr(attribute, "_dbus_is_property", False):

834

# Create a new, but exactly alike, function

835

# object, and decorate it to be a new D-Bus

836

# property with the alternate D-Bus interface

837

# name. Add it to the class.

838

attr[attrname] = (dbus_service_property

839

(alt_interface,

840

attribute._dbus_signature,

841

attribute._dbus_access,

842

attribute

843

._dbus_get_args_options

844

["byte_arrays"])

845

(types.FunctionType

846

(attribute.func_code,

847

attribute.func_globals,

848

attribute.func_name,

849

attribute.func_defaults,

850

attribute.func_closure)))

851

return type.__new__(mcs, name, bases, attr)

852

853

712

class ClientDBus(Client, DBusObjectWithProperties):

854

713

"""A Client class using D-Bus

855

714

859

718

"""

860

719

861

720

runtime_expansions = (Client.runtime_expansions

862

+ ("dbus_object_path",))

721

+ (u"dbus_object_path",))

863

722

864

723

# dbus.service.Object doesn't use super(), so we can't either.

865

724

870

729

# Only now, when this client is initialized, can it show up on

871

730

# the D-Bus

872

731

client_object_name = unicode(self.name).translate(

873

{ord("."): ord("_"),

874

ord("-"): ord("_")})

732

{ord(u"."): ord(u"_"),

733

ord(u"-"): ord(u"_")})

875

734

self.dbus_object_path = (dbus.ObjectPath

876

("/clients/" + client_object_name))

735

(u"/clients/" + client_object_name))

877

736

DBusObjectWithProperties.__init__(self, self.bus,

878

737

self.dbus_object_path)

879

738

880

def notifychangeproperty(transform_func,

881

dbus_name, type_func=lambda x: x,

882

variant_level=1):

883

""" Modify a variable so that it's a property which announces

884

its changes to DBus.

739

def _get_approvals_pending(self):

740

return self._approvals_pending

741

def _set_approvals_pending(self, value):

742

old_value = self._approvals_pending

743

self._approvals_pending = value

744

bval = bool(value)

745

if (hasattr(self, "dbus_object_path")

746

and bval is not bool(old_value)):

747

dbus_bool = dbus.Boolean(bval, variant_level=1)

748

self.PropertyChanged(dbus.String(u"ApprovalPending"),

749

dbus_bool)

885

750

886

transform_fun: Function that takes a value and transforms it

887

to a D-Bus type.

888

dbus_name: D-Bus name of the variable

889

type_func: Function that transform the value before sending it

890

to the D-Bus. Default: no transform

891

variant_level: D-Bus variant level. Default: 1

892

"""

893

real_value = [None,]

894

def setter(self, value):

895

old_value = real_value[0]

896

real_value[0] = value

897

if hasattr(self, "dbus_object_path"):

898

if type_func(old_value) != type_func(real_value[0]):

899

dbus_value = transform_func(type_func(real_value[0]),

900

variant_level)

901

self.PropertyChanged(dbus.String(dbus_name),

902

dbus_value)

903

904

return property(lambda self: real_value[0], setter)

905

906

907

expires = notifychangeproperty(datetime_to_dbus, "Expires")

908

approvals_pending = notifychangeproperty(dbus.Boolean,

909

"ApprovalPending",

910

type_func = bool)

911

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

912

last_enabled = notifychangeproperty(datetime_to_dbus,

913

"LastEnabled")

914

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

915

type_func = lambda checker: checker is not None)

916

last_checked_ok = notifychangeproperty(datetime_to_dbus,

917

"LastCheckedOK")

918

last_approval_request = notifychangeproperty(datetime_to_dbus,

919

"LastApprovalRequest")

920

approved_by_default = notifychangeproperty(dbus.Boolean,

921

"ApprovedByDefault")

922

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

923

type_func = _timedelta_to_milliseconds)

924

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

925

type_func = _timedelta_to_milliseconds)

926

host = notifychangeproperty(dbus.String, "Host")

927

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

928

type_func = _timedelta_to_milliseconds)

929

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

930

type_func = _timedelta_to_milliseconds)

931

interval = notifychangeproperty(dbus.UInt16, "Interval",

932

type_func = _timedelta_to_milliseconds)

933

checker_command = notifychangeproperty(dbus.String, "Checker")

934

935

del notifychangeproperty

751

approvals_pending = property(_get_approvals_pending,

752

_set_approvals_pending)

753

del _get_approvals_pending, _set_approvals_pending

754

755

@staticmethod

756

def _datetime_to_dbus(dt, variant_level=0):

757

"""Convert a UTC datetime.datetime() to a D-Bus type."""

758

return dbus.String(dt.isoformat(),

759

variant_level=variant_level)

760

761

def enable(self):

762

oldstate = getattr(self, u"enabled", False)

763

r = Client.enable(self)

764

if oldstate != self.enabled:

765

# Emit D-Bus signals

766

self.PropertyChanged(dbus.String(u"Enabled"),

767

dbus.Boolean(True, variant_level=1))

768

self.PropertyChanged(

769

dbus.String(u"LastEnabled"),

770

self._datetime_to_dbus(self.last_enabled,

771

variant_level=1))

772

return r

773

774

def disable(self, quiet = False):

775

oldstate = getattr(self, u"enabled", False)

776

r = Client.disable(self, quiet=quiet)

777

if not quiet and oldstate != self.enabled:

778

# Emit D-Bus signal

779

self.PropertyChanged(dbus.String(u"Enabled"),

780

dbus.Boolean(False, variant_level=1))

781

return r

936

782

937

783

def __del__(self, *args, **kwargs):

938

784

try:

939

785

self.remove_from_connection()

940

786

except LookupError:

941

787

pass

942

if hasattr(DBusObjectWithProperties, "__del__"):

788

if hasattr(DBusObjectWithProperties, u"__del__"):

943

789

DBusObjectWithProperties.__del__(self, *args, **kwargs)

944

790

Client.__del__(self, *args, **kwargs)

945

791

947

793

*args, **kwargs):

948

794

self.checker_callback_tag = None

949

795

self.checker = None

796

# Emit D-Bus signal

797

self.PropertyChanged(dbus.String(u"CheckerRunning"),

798

dbus.Boolean(False, variant_level=1))

950

799

if os.WIFEXITED(condition):

951

800

exitstatus = os.WEXITSTATUS(condition)

952

801

# Emit D-Bus signal

962

811

return Client.checker_callback(self, pid, condition, command,

963

812

*args, **kwargs)

964

813

814

def checked_ok(self, *args, **kwargs):

815

r = Client.checked_ok(self, *args, **kwargs)

816

# Emit D-Bus signal

817

self.PropertyChanged(

818

dbus.String(u"LastCheckedOK"),

819

(self._datetime_to_dbus(self.last_checked_ok,

820

variant_level=1)))

821

return r

822

823

def need_approval(self, *args, **kwargs):

824

r = Client.need_approval(self, *args, **kwargs)

825

# Emit D-Bus signal

826

self.PropertyChanged(

827

dbus.String(u"LastApprovalRequest"),

828

(self._datetime_to_dbus(self.last_approval_request,

829

variant_level=1)))

830

return r

831

965

832

def start_checker(self, *args, **kwargs):

966

833

old_checker = self.checker

967

834

if self.checker is not None:

974

841

and old_checker_pid != self.checker.pid):

975

842

# Emit D-Bus signal

976

843

self.CheckerStarted(self.current_checker_command)

844

self.PropertyChanged(

845

dbus.String(u"CheckerRunning"),

846

dbus.Boolean(True, variant_level=1))

977

847

return r

978

848

849

def stop_checker(self, *args, **kwargs):

850

old_checker = getattr(self, u"checker", None)

851

r = Client.stop_checker(self, *args, **kwargs)

852

if (old_checker is not None

853

and getattr(self, u"checker", None) is None):

854

self.PropertyChanged(dbus.String(u"CheckerRunning"),

855

dbus.Boolean(False, variant_level=1))

856

return r

857

979

858

def _reset_approved(self):

980

859

self._approved = None

981

860

return False

983

862

def approve(self, value=True):

984

863

self.send_changedstate()

985

864

self._approved = value

986

gobject.timeout_add(_timedelta_to_milliseconds

865

gobject.timeout_add(self._timedelta_to_milliseconds

987

866

(self.approval_duration),

988

867

self._reset_approved)

989

868

990

869

991

870

## D-Bus methods, signals & properties

992

_interface = "se.recompile.Mandos.Client"

871

_interface = u"se.bsnet.fukt.Mandos.Client"

993

872

994

873

## Signals

995

874

996

875

# CheckerCompleted - signal

997

@dbus.service.signal(_interface, signature="nxs")

876

@dbus.service.signal(_interface, signature=u"nxs")

998

877

def CheckerCompleted(self, exitcode, waitstatus, command):

999

878

"D-Bus signal"

1000

879

pass

1001

880

1002

881

# CheckerStarted - signal

1003

@dbus.service.signal(_interface, signature="s")

882

@dbus.service.signal(_interface, signature=u"s")

1004

883

def CheckerStarted(self, command):

1005

884

"D-Bus signal"

1006

885

pass

1007

886

1008

887

# PropertyChanged - signal

1009

@dbus.service.signal(_interface, signature="sv")

888

@dbus.service.signal(_interface, signature=u"sv")

1010

889

def PropertyChanged(self, property, value):

1011

890

"D-Bus signal"

1012

891

pass

1021

900

pass

1022

901

1023

902

# Rejected - signal

1024

@dbus.service.signal(_interface, signature="s")

903

@dbus.service.signal(_interface, signature=u"s")

1025

904

def Rejected(self, reason):

1026

905

"D-Bus signal"

1027

906

pass

1028

907

1029

908

# NeedApproval - signal

1030

@dbus.service.signal(_interface, signature="tb")

909

@dbus.service.signal(_interface, signature=u"tb")

1031

910

def NeedApproval(self, timeout, default):

1032

911

"D-Bus signal"

1033

912

return self.need_approval()

1035

914

## Methods

1036

915

1037

916

# Approve - method

1038

@dbus.service.method(_interface, in_signature="b")

917

@dbus.service.method(_interface, in_signature=u"b")

1039

918

def Approve(self, value):

1040

919

self.approve(value)

1041

920

1042

921

# CheckedOK - method

1043

922

@dbus.service.method(_interface)

1044

923

def CheckedOK(self):

1045

self.checked_ok()

924

return self.checked_ok()

1046

925

1047

926

# Enable - method

1048

927

@dbus.service.method(_interface)

1070

949

## Properties

1071

950

1072

951

# ApprovalPending - property

1073

@dbus_service_property(_interface, signature="b", access="read")

952

@dbus_service_property(_interface, signature=u"b", access=u"read")

1074

953

def ApprovalPending_dbus_property(self):

1075

954

return dbus.Boolean(bool(self.approvals_pending))

1076

955

1077

956

# ApprovedByDefault - property

1078

@dbus_service_property(_interface, signature="b",

1079

access="readwrite")

957

@dbus_service_property(_interface, signature=u"b",

958

access=u"readwrite")

1080

959

def ApprovedByDefault_dbus_property(self, value=None):

1081

960

if value is None: # get

1082

961

return dbus.Boolean(self.approved_by_default)

1083

962

self.approved_by_default = bool(value)

963

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

965

dbus.Boolean(value, variant_level=1))

1084

966

1085

967

# ApprovalDelay - property

1086

@dbus_service_property(_interface, signature="t",

1087

access="readwrite")

968

@dbus_service_property(_interface, signature=u"t",

969

access=u"readwrite")

1088

970

def ApprovalDelay_dbus_property(self, value=None):

1089

971

if value is None: # get

1090

972

return dbus.UInt64(self.approval_delay_milliseconds())

1091

973

self.approval_delay = datetime.timedelta(0, 0, 0, value)

974

# Emit D-Bus signal

975

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

976

dbus.UInt64(value, variant_level=1))

1092

977

1093

978

# ApprovalDuration - property

1094

@dbus_service_property(_interface, signature="t",

1095

access="readwrite")

979

@dbus_service_property(_interface, signature=u"t",

980

access=u"readwrite")

1096

981

def ApprovalDuration_dbus_property(self, value=None):

1097

982

if value is None: # get

1098

return dbus.UInt64(_timedelta_to_milliseconds(

983

return dbus.UInt64(self._timedelta_to_milliseconds(

1099

984

self.approval_duration))

1100

985

self.approval_duration = datetime.timedelta(0, 0, 0, value)

986

# Emit D-Bus signal

987

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

988

dbus.UInt64(value, variant_level=1))

1101

989

1102

990

# Name - property

1103

@dbus_service_property(_interface, signature="s", access="read")

991

@dbus_service_property(_interface, signature=u"s", access=u"read")

1104

992

def Name_dbus_property(self):

1105

993

return dbus.String(self.name)

1106

994

1107

995

# Fingerprint - property

1108

@dbus_service_property(_interface, signature="s", access="read")

996

@dbus_service_property(_interface, signature=u"s", access=u"read")

1109

997

def Fingerprint_dbus_property(self):

1110

998

return dbus.String(self.fingerprint)

1111

999

1112

1000

# Host - property

1113

@dbus_service_property(_interface, signature="s",

1114

access="readwrite")

1001

@dbus_service_property(_interface, signature=u"s",

1002

access=u"readwrite")

1115

1003

def Host_dbus_property(self, value=None):

1116

1004

if value is None: # get

1117

1005

return dbus.String(self.host)

1118

1006

self.host = value

1007

# Emit D-Bus signal

1008

self.PropertyChanged(dbus.String(u"Host"),

1009

dbus.String(value, variant_level=1))

1119

1010

1120

1011

# Created - property

1121

@dbus_service_property(_interface, signature="s", access="read")

1012

@dbus_service_property(_interface, signature=u"s", access=u"read")

1122

1013

def Created_dbus_property(self):

1123

return dbus.String(datetime_to_dbus(self.created))

1014

return dbus.String(self._datetime_to_dbus(self.created))

1124

1015

1125

1016

# LastEnabled - property

1126

@dbus_service_property(_interface, signature="s", access="read")

1017

@dbus_service_property(_interface, signature=u"s", access=u"read")

1127

1018

def LastEnabled_dbus_property(self):

1128

return datetime_to_dbus(self.last_enabled)

1019

if self.last_enabled is None:

1020

return dbus.String(u"")

1021

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1129

1022

1130

1023

# Enabled - property

1131

@dbus_service_property(_interface, signature="b",

1132

access="readwrite")

1024

@dbus_service_property(_interface, signature=u"b",

1025

access=u"readwrite")

1133

1026

def Enabled_dbus_property(self, value=None):

1134

1027

if value is None: # get

1135

1028

return dbus.Boolean(self.enabled)

1139

1032

self.disable()

1140

1033

1141

1034

# LastCheckedOK - property

1142

@dbus_service_property(_interface, signature="s",

1143

access="readwrite")

1035

@dbus_service_property(_interface, signature=u"s",

1036

access=u"readwrite")

1144

1037

def LastCheckedOK_dbus_property(self, value=None):

1145

1038

if value is not None:

1146

1039

self.checked_ok()

1147

1040

return

1148

return datetime_to_dbus(self.last_checked_ok)

1149

1150

# Expires - property

1151

@dbus_service_property(_interface, signature="s", access="read")

1152

def Expires_dbus_property(self):

1153

return datetime_to_dbus(self.expires)

1041

if self.last_checked_ok is None:

1042

return dbus.String(u"")

1043

return dbus.String(self._datetime_to_dbus(self

1044

.last_checked_ok))

1154

1045

1155

1046

# LastApprovalRequest - property

1156

@dbus_service_property(_interface, signature="s", access="read")

1047

@dbus_service_property(_interface, signature=u"s", access=u"read")

1157

1048

def LastApprovalRequest_dbus_property(self):

1158

return datetime_to_dbus(self.last_approval_request)

1049

if self.last_approval_request is None:

1050

return dbus.String(u"")

1051

return dbus.String(self.

1052

_datetime_to_dbus(self

1053

.last_approval_request))

1159

1054

1160

1055

# Timeout - property

1161

@dbus_service_property(_interface, signature="t",

1162

access="readwrite")

1056

@dbus_service_property(_interface, signature=u"t",

1057

access=u"readwrite")

1163

1058

def Timeout_dbus_property(self, value=None):

1164

1059

if value is None: # get

1165

1060

return dbus.UInt64(self.timeout_milliseconds())

1166

1061

self.timeout = datetime.timedelta(0, 0, 0, value)

1167

if getattr(self, "disable_initiator_tag", None) is None:

1062

# Emit D-Bus signal

1063

self.PropertyChanged(dbus.String(u"Timeout"),

1064

dbus.UInt64(value, variant_level=1))

1065

if getattr(self, u"disable_initiator_tag", None) is None:

1168

1066

return

1169

1067

# Reschedule timeout

1170

1068

gobject.source_remove(self.disable_initiator_tag)

1171

1069

self.disable_initiator_tag = None

1172

self.expires = None

1173

1070

time_to_die = (self.

1174

1071

_timedelta_to_milliseconds((self

1175

1072

.last_checked_ok

1180

1077

# The timeout has passed

1181

1078

self.disable()

1182

1079

else:

1183

self.expires = (datetime.datetime.utcnow()

1184

+ datetime.timedelta(milliseconds = time_to_die))

1185

1080

self.disable_initiator_tag = (gobject.timeout_add

1186

1081

(time_to_die, self.disable))

1187

1082

1188

# ExtendedTimeout - property

1189

@dbus_service_property(_interface, signature="t",

1190

access="readwrite")

1191

def ExtendedTimeout_dbus_property(self, value=None):

1192

if value is None: # get

1193

return dbus.UInt64(self.extended_timeout_milliseconds())

1194

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1195

1196

1083

# Interval - property

1197

@dbus_service_property(_interface, signature="t",

1198

access="readwrite")

1084

@dbus_service_property(_interface, signature=u"t",

1085

access=u"readwrite")

1199

1086

def Interval_dbus_property(self, value=None):

1200

1087

if value is None: # get

1201

1088

return dbus.UInt64(self.interval_milliseconds())

1202

1089

self.interval = datetime.timedelta(0, 0, 0, value)

1203

if getattr(self, "checker_initiator_tag", None) is None:

1090

# Emit D-Bus signal

1091

self.PropertyChanged(dbus.String(u"Interval"),

1092

dbus.UInt64(value, variant_level=1))

1093

if getattr(self, u"checker_initiator_tag", None) is None:

1204

1094

return

1205

1095

# Reschedule checker run

1206

1096

gobject.source_remove(self.checker_initiator_tag)

1207

1097

self.checker_initiator_tag = (gobject.timeout_add

1208

1098

(value, self.start_checker))

1209

1099

self.start_checker() # Start one now, too

1210

1100

1211

1101

# Checker - property

1212

@dbus_service_property(_interface, signature="s",

1213

access="readwrite")

1102

@dbus_service_property(_interface, signature=u"s",

1103

access=u"readwrite")

1214

1104

def Checker_dbus_property(self, value=None):

1215

1105

if value is None: # get

1216

1106

return dbus.String(self.checker_command)

1217

1107

self.checker_command = value

1108

# Emit D-Bus signal

1109

self.PropertyChanged(dbus.String(u"Checker"),

1110

dbus.String(self.checker_command,

1111

variant_level=1))

1218

1112

1219

1113

# CheckerRunning - property

1220

@dbus_service_property(_interface, signature="b",

1221

access="readwrite")

1114

@dbus_service_property(_interface, signature=u"b",

1115

access=u"readwrite")

1222

1116

def CheckerRunning_dbus_property(self, value=None):

1223

1117

if value is None: # get

1224

1118

return dbus.Boolean(self.checker is not None)

1228

1122

self.stop_checker()

1229

1123

1230

1124

# ObjectPath - property

1231

@dbus_service_property(_interface, signature="o", access="read")

1125

@dbus_service_property(_interface, signature=u"o", access=u"read")

1232

1126

def ObjectPath_dbus_property(self):

1233

1127

return self.dbus_object_path # is already a dbus.ObjectPath

1234

1128

1235

1129

# Secret = property

1236

@dbus_service_property(_interface, signature="ay",

1237

access="write", byte_arrays=True)

1130

@dbus_service_property(_interface, signature=u"ay",

1131

access=u"write", byte_arrays=True)

1238

1132

def Secret_dbus_property(self, value):

1239

1133

self.secret = str(value)

1240

1134

1247

1141

self._pipe.send(('init', fpr, address))

1248

1142

if not self._pipe.recv():

1249

1143

raise KeyError()

1250

1144

1251

1145

def __getattribute__(self, name):

1252

1146

if(name == '_pipe'):

1253

1147

return super(ProxyClient, self).__getattribute__(name)

1260

1154

self._pipe.send(('funcall', name, args, kwargs))

1261

1155

return self._pipe.recv()[1]

1262

1156

return func

1263

1157

1264

1158

def __setattr__(self, name, value):

1265

1159

if(name == '_pipe'):

1266

1160

return super(ProxyClient, self).__setattr__(name, value)

1267

1161

self._pipe.send(('setattr', name, value))

1268

1162

1269

class ClientDBusTransitional(ClientDBus):

1270

__metaclass__ = AlternateDBusNamesMetaclass

1271

1163

1272

1164

class ClientHandler(socketserver.BaseRequestHandler, object):

1273

1165

"""A class to handle client connections.

1277

1169

1278

1170

def handle(self):

1279

1171

with contextlib.closing(self.server.child_pipe) as child_pipe:

1280

logger.info("TCP connection from: %s",

1172

logger.info(u"TCP connection from: %s",

1281

1173

unicode(self.client_address))

1282

logger.debug("Pipe FD: %d",

1174

logger.debug(u"Pipe FD: %d",

1283

1175

self.server.child_pipe.fileno())

1284

1176

1285

1177

session = (gnutls.connection

1286

1178

.ClientSession(self.request,

1287

1179

gnutls.connection

1288

1180

.X509Credentials()))

1289

1181

1290

1182

# Note: gnutls.connection.X509Credentials is really a

1291

1183

# generic GnuTLS certificate credentials object so long as

1292

1184

# no X.509 keys are added to it. Therefore, we can use it

1293

1185

# here despite using OpenPGP certificates.

1294

1295

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1296

# "+AES-256-CBC", "+SHA1",

1297

# "+COMP-NULL", "+CTYPE-OPENPGP",

1298

# "+DHE-DSS"))

1186

1187

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1188

# u"+AES-256-CBC", u"+SHA1",

1189

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1190

# u"+DHE-DSS"))

1299

1191

# Use a fallback default, since this MUST be set.

1300

1192

priority = self.server.gnutls_priority

1301

1193

if priority is None:

1302

priority = "NORMAL"

1194

priority = u"NORMAL"

1303

1195

(gnutls.library.functions

1304

1196

.gnutls_priority_set_direct(session._c_object,

1305

1197

priority, None))

1306

1198

1307

1199

# Start communication using the Mandos protocol

1308

1200

# Get protocol number

1309

1201

line = self.request.makefile().readline()

1310

logger.debug("Protocol version: %r", line)

1202

logger.debug(u"Protocol version: %r", line)

1311

1203

try:

1312

1204

if int(line.strip().split()[0]) > 1:

1313

1205

raise RuntimeError

1314

except (ValueError, IndexError, RuntimeError) as error:

1315

logger.error("Unknown protocol version: %s", error)

1206

except (ValueError, IndexError, RuntimeError), error:

1207

logger.error(u"Unknown protocol version: %s", error)

1316

1208

return

1317

1209

1318

1210

# Start GnuTLS connection

1319

1211

try:

1320

1212

session.handshake()

1321

except gnutls.errors.GNUTLSError as error:

1322

logger.warning("Handshake failed: %s", error)

1213

except gnutls.errors.GNUTLSError, error:

1214

logger.warning(u"Handshake failed: %s", error)

1323

1215

# Do not run session.bye() here: the session is not

1324

1216

# established. Just abandon the request.

1325

1217

return

1326

logger.debug("Handshake succeeded")

1327

1218

logger.debug(u"Handshake succeeded")

1219

1328

1220

approval_required = False

1329

1221

try:

1330

1222

try:

1331

1223

fpr = self.fingerprint(self.peer_certificate

1332

1224

(session))

1333

except (TypeError,

1334

gnutls.errors.GNUTLSError) as error:

1335

logger.warning("Bad certificate: %s", error)

1225

except (TypeError, gnutls.errors.GNUTLSError), error:

1226

logger.warning(u"Bad certificate: %s", error)

1336

1227

return

1337

logger.debug("Fingerprint: %s", fpr)

1338

1228

logger.debug(u"Fingerprint: %s", fpr)

1229

1339

1230

try:

1340

1231

client = ProxyClient(child_pipe, fpr,

1341

1232

self.client_address)

1349

1240

1350

1241

while True:

1351

1242

if not client.enabled:

1352

logger.info("Client %s is disabled",

1243

logger.warning(u"Client %s is disabled",

1353

1244

client.name)

1354

1245

if self.server.use_dbus:

1355

1246

# Emit D-Bus signal

1360

1251

#We are approved or approval is disabled

1361

1252

break

1362

1253

elif client._approved is None:

1363

logger.info("Client %s needs approval",

1254

logger.info(u"Client %s needs approval",

1364

1255

client.name)

1365

1256

if self.server.use_dbus:

1366

1257

# Emit D-Bus signal

1368

1259

client.approval_delay_milliseconds(),

1369

1260

client.approved_by_default)

1370

1261

else:

1371

logger.warning("Client %s was not approved",

1262

logger.warning(u"Client %s was not approved",

1372

1263

client.name)

1373

1264

if self.server.use_dbus:

1374

1265

# Emit D-Bus signal

1400

1291

while sent_size < len(client.secret):

1401

1292

try:

1402

1293

sent = session.send(client.secret[sent_size:])

1403

except gnutls.errors.GNUTLSError as error:

1294

except (gnutls.errors.GNUTLSError), error:

1404

1295

logger.warning("gnutls send failed")

1405

1296

return

1406

logger.debug("Sent: %d, remaining: %d",

1297

logger.debug(u"Sent: %d, remaining: %d",

1407

1298

sent, len(client.secret)

1408

1299

- (sent_size + sent))

1409

1300

sent_size += sent

1410

1411

logger.info("Sending secret to %s", client.name)

1301

1302

logger.info(u"Sending secret to %s", client.name)

1412

1303

# bump the timeout as if seen

1413

client.checked_ok(client.extended_timeout)

1304

client.checked_ok()

1414

1305

if self.server.use_dbus:

1415

1306

# Emit D-Bus signal

1416

1307

client.GotSecret()

1420

1311

client.approvals_pending -= 1

1421

1312

try:

1422

1313

session.bye()

1423

except gnutls.errors.GNUTLSError as error:

1314

except (gnutls.errors.GNUTLSError), error:

1424

1315

logger.warning("GnuTLS bye failed")

1425

1316

1426

1317

@staticmethod

1437

1328

.gnutls_certificate_get_peers

1438

1329

(session._c_object, ctypes.byref(list_size)))

1439

1330

if not bool(cert_list) and list_size.value != 0:

1440

raise gnutls.errors.GNUTLSError("error getting peer"

1441

" certificate")

1331

raise gnutls.errors.GNUTLSError(u"error getting peer"

1332

u" certificate")

1442

1333

if list_size.value == 0:

1443

1334

return None

1444

1335

cert = cert_list[0]

1470

1361

if crtverify.value != 0:

1471

1362

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1472

1363

raise (gnutls.errors.CertificateSecurityError

1473

("Verify failed"))

1364

(u"Verify failed"))

1474

1365

# New buffer for the fingerprint

1475

1366

buf = ctypes.create_string_buffer(20)

1476

1367

buf_len = ctypes.c_size_t()

1483

1374

# Convert the buffer to a Python bytestring

1484

1375

fpr = ctypes.string_at(buf, buf_len.value)

1485

1376

# Convert the bytestring to hexadecimal notation

1486

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1377

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1487

1378

return hex_fpr

1488

1379

1489

1380

1501

1392

multiprocessing.Process(target = self.sub_process_main,

1502

1393

args = (request, address)).start()

1503

1394

1504

1505

1395

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1506

1396

""" adds a pipe to the MixIn """

1507

1397

def process_request(self, request, client_address):

1510

1400

This function creates a new pipe in self.pipe

1511

1401

"""

1512

1402

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1513

1403

1514

1404

super(MultiprocessingMixInWithPipe,

1515

1405

self).process_request(request, client_address)

1516

1406

self.child_pipe.close()

1517

1407

self.add_pipe(parent_pipe)

1518

1408

1519

1409

def add_pipe(self, parent_pipe):

1520

1410

"""Dummy function; override as necessary"""

1521

raise NotImplementedError

1522

1411

pass

1523

1412

1524

1413

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1525

1414

socketserver.TCPServer, object):

1543

1432

bind to an address or port if they were not specified."""

1544

1433

if self.interface is not None:

1545

1434

if SO_BINDTODEVICE is None:

1546

logger.error("SO_BINDTODEVICE does not exist;"

1547

" cannot bind to interface %s",

1435

logger.error(u"SO_BINDTODEVICE does not exist;"

1436

u" cannot bind to interface %s",

1548

1437

self.interface)

1549

1438

else:

1550

1439

try:

1551

1440

self.socket.setsockopt(socket.SOL_SOCKET,

1552

1441

SO_BINDTODEVICE,

1553

1442

str(self.interface

1554

+ '\0'))

1555

except socket.error as error:

1443

+ u'\0'))

1444

except socket.error, error:

1556

1445

if error[0] == errno.EPERM:

1557

logger.error("No permission to"

1558

" bind to interface %s",

1446

logger.error(u"No permission to"

1447

u" bind to interface %s",

1559

1448

self.interface)

1560

1449

elif error[0] == errno.ENOPROTOOPT:

1561

logger.error("SO_BINDTODEVICE not available;"

1562

" cannot bind to interface %s",

1450

logger.error(u"SO_BINDTODEVICE not available;"

1451

u" cannot bind to interface %s",

1563

1452

self.interface)

1564

1453

else:

1565

1454

raise

1567

1456

if self.server_address[0] or self.server_address[1]:

1568

1457

if not self.server_address[0]:

1569

1458

if self.address_family == socket.AF_INET6:

1570

any_address = "::" # in6addr_any

1459

any_address = u"::" # in6addr_any

1571

1460

else:

1572

1461

any_address = socket.INADDR_ANY

1573

1462

self.server_address = (any_address,

1622

1511

def handle_ipc(self, source, condition, parent_pipe=None,

1623

1512

client_object=None):

1624

1513

condition_names = {

1625

gobject.IO_IN: "IN", # There is data to read.

1626

gobject.IO_OUT: "OUT", # Data can be written (without

1514

gobject.IO_IN: u"IN", # There is data to read.

1515

gobject.IO_OUT: u"OUT", # Data can be written (without

1627

1516

# blocking).

1628

gobject.IO_PRI: "PRI", # There is urgent data to read.

1629

gobject.IO_ERR: "ERR", # Error condition.

1630

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1517

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1518

gobject.IO_ERR: u"ERR", # Error condition.

1519

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1631

1520

# broken, usually for pipes and

1632

1521

# sockets).

1633

1522

}

1652

1541

client = c

1653

1542

break

1654

1543

else:

1655

logger.info("Client not found for fingerprint: %s, ad"

1656

"dress: %s", fpr, address)

1544

logger.warning(u"Client not found for fingerprint: %s, ad"

1545

u"dress: %s", fpr, address)

1657

1546

if self.use_dbus:

1658

1547

# Emit D-Bus signal

1659

1548

mandos_dbus_service.ClientNotFound(fpr, address[0])

1674

1563

kwargs = request[3]

1675

1564

1676

1565

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1677

1566

1678

1567

if command == 'getattr':

1679

1568

attrname = request[1]

1680

1569

if callable(client_object.__getattribute__(attrname)):

1686

1575

attrname = request[1]

1687

1576

value = request[2]

1688

1577

setattr(client_object, attrname, value)

1689

1578

1690

1579

return True

1691

1580

1692

1581

1693

1582

def string_to_delta(interval):

1694

1583

"""Parse a string and return a datetime.timedelta

1695

1584

1696

>>> string_to_delta('7d')

1585

>>> string_to_delta(u'7d')

1697

1586

datetime.timedelta(7)

1698

>>> string_to_delta('60s')

1587

>>> string_to_delta(u'60s')

1699

1588

datetime.timedelta(0, 60)

1700

>>> string_to_delta('60m')

1589

>>> string_to_delta(u'60m')

1701

1590

datetime.timedelta(0, 3600)

1702

>>> string_to_delta('24h')

1591

>>> string_to_delta(u'24h')

1703

1592

datetime.timedelta(1)

1704

>>> string_to_delta('1w')

1593

>>> string_to_delta(u'1w')

1705

1594

datetime.timedelta(7)

1706

>>> string_to_delta('5m 30s')

1595

>>> string_to_delta(u'5m 30s')

1707

1596

datetime.timedelta(0, 330)

1708

1597

"""

1709

1598

timevalue = datetime.timedelta(0)

1711

1600

try:

1712

1601

suffix = unicode(s[-1])

1713

1602

value = int(s[:-1])

1714

if suffix == "d":

1603

if suffix == u"d":

1715

1604

delta = datetime.timedelta(value)

1716

elif suffix == "s":

1605

elif suffix == u"s":

1717

1606

delta = datetime.timedelta(0, value)

1718

elif suffix == "m":

1607

elif suffix == u"m":

1719

1608

delta = datetime.timedelta(0, 0, 0, 0, value)

1720

elif suffix == "h":

1609

elif suffix == u"h":

1721

1610

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1722

elif suffix == "w":

1611

elif suffix == u"w":

1723

1612

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1724

1613

else:

1725

raise ValueError("Unknown suffix %r" % suffix)

1726

except (ValueError, IndexError) as e:

1727

raise ValueError(*(e.args))

1614

raise ValueError(u"Unknown suffix %r" % suffix)

1615

except (ValueError, IndexError), e:

1616

raise ValueError(e.message)

1728

1617

timevalue += delta

1729

1618

return timevalue

1730

1619

1736

1625

global if_nametoindex

1737

1626

try:

1738

1627

if_nametoindex = (ctypes.cdll.LoadLibrary

1739

(ctypes.util.find_library("c"))

1628

(ctypes.util.find_library(u"c"))

1740

1629

.if_nametoindex)

1741

1630

except (OSError, AttributeError):

1742

logger.warning("Doing if_nametoindex the hard way")

1631

logger.warning(u"Doing if_nametoindex the hard way")

1743

1632

def if_nametoindex(interface):

1744

1633

"Get an interface index the hard way, i.e. using fcntl()"

1745

1634

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1746

1635

with contextlib.closing(socket.socket()) as s:

1747

1636

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1748

struct.pack(str("16s16x"),

1637

struct.pack(str(u"16s16x"),

1749

1638

interface))

1750

interface_index = struct.unpack(str("I"),

1639

interface_index = struct.unpack(str(u"I"),

1751

1640

ifreq[16:20])[0]

1752

1641

return interface_index

1753

1642

return if_nametoindex(interface)

1761

1650

sys.exit()

1762

1651

os.setsid()

1763

1652

if not nochdir:

1764

os.chdir("/")

1653

os.chdir(u"/")

1765

1654

if os.fork():

1766

1655

sys.exit()

1767

1656

if not noclose:

1769

1658

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1770

1659

if not stat.S_ISCHR(os.fstat(null).st_mode):

1771

1660

raise OSError(errno.ENODEV,

1772

"%s not a character device"

1661

u"%s not a character device"

1773

1662

% os.path.devnull)

1774

1663

os.dup2(null, sys.stdin.fileno())

1775

1664

os.dup2(null, sys.stdout.fileno())

1783

1672

##################################################################

1784

1673

# Parsing of options, both command line and config file

1785

1674

1786

parser = argparse.ArgumentParser()

1787

parser.add_argument("-v", "--version", action="version",

1788

version = "%%(prog)s %s" % version,

1789

help="show version number and exit")

1790

parser.add_argument("-i", "--interface", metavar="IF",

1791

help="Bind to interface IF")

1792

parser.add_argument("-a", "--address",

1793

help="Address to listen for requests on")

1794

parser.add_argument("-p", "--port", type=int,

1795

help="Port number to receive requests on")

1796

parser.add_argument("--check", action="store_true",

1797

help="Run self-test")

1798

parser.add_argument("--debug", action="store_true",

1799

help="Debug mode; run in foreground and log"

1800

" to terminal")

1801

parser.add_argument("--debuglevel", metavar="LEVEL",

1802

help="Debug level for stdout output")

1803

parser.add_argument("--priority", help="GnuTLS"

1804

" priority string (see GnuTLS documentation)")

1805

parser.add_argument("--servicename",

1806

metavar="NAME", help="Zeroconf service name")

1807

parser.add_argument("--configdir",

1808

default="/etc/mandos", metavar="DIR",

1809

help="Directory to search for configuration"

1810

" files")

1811

parser.add_argument("--no-dbus", action="store_false",

1812

dest="use_dbus", help="Do not provide D-Bus"

1813

" system bus interface")

1814

parser.add_argument("--no-ipv6", action="store_false",

1815

dest="use_ipv6", help="Do not use IPv6")

1816

options = parser.parse_args()

1675

parser = optparse.OptionParser(version = "%%prog %s" % version)

1676

parser.add_option("-i", u"--interface", type=u"string",

1677

metavar="IF", help=u"Bind to interface IF")

1678

parser.add_option("-a", u"--address", type=u"string",

1679

help=u"Address to listen for requests on")

1680

parser.add_option("-p", u"--port", type=u"int",

1681

help=u"Port number to receive requests on")

1682

parser.add_option("--check", action=u"store_true",

1683

help=u"Run self-test")

1684

parser.add_option("--debug", action=u"store_true",

1685

help=u"Debug mode; run in foreground and log to"

1686

u" terminal")

1687

parser.add_option("--debuglevel", type=u"string", metavar="LEVEL",

1688

help=u"Debug level for stdout output")

1689

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1690

u" priority string (see GnuTLS documentation)")

1691

parser.add_option("--servicename", type=u"string",

1692

metavar=u"NAME", help=u"Zeroconf service name")

1693

parser.add_option("--configdir", type=u"string",

1694

default=u"/etc/mandos", metavar=u"DIR",

1695

help=u"Directory to search for configuration"

1696

u" files")

1697

parser.add_option("--no-dbus", action=u"store_false",

1698

dest=u"use_dbus", help=u"Do not provide D-Bus"

1699

u" system bus interface")

1700

parser.add_option("--no-ipv6", action=u"store_false",

1701

dest=u"use_ipv6", help=u"Do not use IPv6")

1702

options = parser.parse_args()[0]

1817

1703

1818

1704

if options.check:

1819

1705

import doctest

1821

1707

sys.exit()

1822

1708

1823

1709

# Default values for config file for server-global settings

1824

server_defaults = { "interface": "",

1825

"address": "",

1826

"port": "",

1827

"debug": "False",

1828

"priority":

1829

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1830

"servicename": "Mandos",

1831

"use_dbus": "True",

1832

"use_ipv6": "True",

1833

"debuglevel": "",

1710

server_defaults = { u"interface": u"",

1711

u"address": u"",

1712

u"port": u"",

1713

u"debug": u"False",

1714

u"priority":

1715

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1716

u"servicename": u"Mandos",

1717

u"use_dbus": u"True",

1718

u"use_ipv6": u"True",

1719

u"debuglevel": u"",

1834

1720

}

1835

1721

1836

1722

# Parse config file for server-global settings

1837

1723

server_config = configparser.SafeConfigParser(server_defaults)

1838

1724

del server_defaults

1839

1725

server_config.read(os.path.join(options.configdir,

1840

"mandos.conf"))

1726

u"mandos.conf"))

1841

1727

# Convert the SafeConfigParser object to a dict

1842

1728

server_settings = server_config.defaults()

1843

1729

# Use the appropriate methods on the non-string config options

1844

for option in ("debug", "use_dbus", "use_ipv6"):

1845

server_settings[option] = server_config.getboolean("DEFAULT",

1730

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1731

server_settings[option] = server_config.getboolean(u"DEFAULT",

1846

1732

option)

1847

1733

if server_settings["port"]:

1848

server_settings["port"] = server_config.getint("DEFAULT",

1849

"port")

1734

server_settings["port"] = server_config.getint(u"DEFAULT",

1735

u"port")

1850

1736

del server_config

1851

1737

1852

1738

# Override the settings from the config file with command line

1853

1739

# options, if set.

1854

for option in ("interface", "address", "port", "debug",

1855

"priority", "servicename", "configdir",

1856

"use_dbus", "use_ipv6", "debuglevel"):

1740

for option in (u"interface", u"address", u"port", u"debug",

1741

u"priority", u"servicename", u"configdir",

1742

u"use_dbus", u"use_ipv6", u"debuglevel"):

1857

1743

value = getattr(options, option)

1858

1744

if value is not None:

1859

1745

server_settings[option] = value

1867

1753

##################################################################

1868

1754

1869

1755

# For convenience

1870

debug = server_settings["debug"]

1871

debuglevel = server_settings["debuglevel"]

1872

use_dbus = server_settings["use_dbus"]

1873

use_ipv6 = server_settings["use_ipv6"]

1874

1875

if server_settings["servicename"] != "Mandos":

1756

debug = server_settings[u"debug"]

1757

debuglevel = server_settings[u"debuglevel"]

1758

use_dbus = server_settings[u"use_dbus"]

1759

use_ipv6 = server_settings[u"use_ipv6"]

1760

1761

if server_settings[u"servicename"] != u"Mandos":

1876

1762

syslogger.setFormatter(logging.Formatter

1877

('Mandos (%s) [%%(process)d]:'

1878

' %%(levelname)s: %%(message)s'

1879

% server_settings["servicename"]))

1763

(u'Mandos (%s) [%%(process)d]:'

1764

u' %%(levelname)s: %%(message)s'

1765

% server_settings[u"servicename"]))

1880

1766

1881

1767

# Parse config file with clients

1882

client_defaults = { "timeout": "5m",

1883

"extended_timeout": "15m",

1884

"interval": "2m",

1885

"checker": "fping -q -- %%(host)s",

1886

"host": "",

1887

"approval_delay": "0s",

1888

"approval_duration": "1s",

1768

client_defaults = { u"timeout": u"1h",

1769

u"interval": u"5m",

1770

u"checker": u"fping -q -- %%(host)s",

1771

u"host": u"",

1772

u"approval_delay": u"0s",

1773

u"approval_duration": u"1s",

1889

1774

}

1890

1775

client_config = configparser.SafeConfigParser(client_defaults)

1891

client_config.read(os.path.join(server_settings["configdir"],

1892

"clients.conf"))

1776

client_config.read(os.path.join(server_settings[u"configdir"],

1777

u"clients.conf"))

1893

1778

1894

1779

global mandos_dbus_service

1895

1780

mandos_dbus_service = None

1896

1781

1897

tcp_server = MandosServer((server_settings["address"],

1898

server_settings["port"]),

1782

tcp_server = MandosServer((server_settings[u"address"],

1783

server_settings[u"port"]),

1899

1784

ClientHandler,

1900

interface=(server_settings["interface"]

1785

interface=(server_settings[u"interface"]

1901

1786

or None),

1902

1787

use_ipv6=use_ipv6,

1903

1788

gnutls_priority=

1904

server_settings["priority"],

1789

server_settings[u"priority"],

1905

1790

use_dbus=use_dbus)

1906

1791

if not debug:

1907

pidfilename = "/var/run/mandos.pid"

1792

pidfilename = u"/var/run/mandos.pid"

1908

1793

try:

1909

pidfile = open(pidfilename, "w")

1794

pidfile = open(pidfilename, u"w")

1910

1795

except IOError:

1911

logger.error("Could not open file %r", pidfilename)

1796

logger.error(u"Could not open file %r", pidfilename)

1912

1797

1913

1798

try:

1914

uid = pwd.getpwnam("_mandos").pw_uid

1915

gid = pwd.getpwnam("_mandos").pw_gid

1799

uid = pwd.getpwnam(u"_mandos").pw_uid

1800

gid = pwd.getpwnam(u"_mandos").pw_gid

1916

1801

except KeyError:

1917

1802

try:

1918

uid = pwd.getpwnam("mandos").pw_uid

1919

gid = pwd.getpwnam("mandos").pw_gid

1803

uid = pwd.getpwnam(u"mandos").pw_uid

1804

gid = pwd.getpwnam(u"mandos").pw_gid

1920

1805

except KeyError:

1921

1806

try:

1922

uid = pwd.getpwnam("nobody").pw_uid

1923

gid = pwd.getpwnam("nobody").pw_gid

1807

uid = pwd.getpwnam(u"nobody").pw_uid

1808

gid = pwd.getpwnam(u"nobody").pw_gid

1924

1809

except KeyError:

1925

1810

uid = 65534

1926

1811

gid = 65534

1927

1812

try:

1928

1813

os.setgid(gid)

1929

1814

os.setuid(uid)

1930

except OSError as error:

1815

except OSError, error:

1931

1816

if error[0] != errno.EPERM:

1932

1817

raise error

1933

1818

1938

1823

level = getattr(logging, debuglevel.upper())

1939

1824

syslogger.setLevel(level)

1940

1825

console.setLevel(level)

1941

1826

1942

1827

if debug:

1943

1828

# Enable all possible GnuTLS debugging

1944

1829

1948

1833

1949

1834

@gnutls.library.types.gnutls_log_func

1950

1835

def debug_gnutls(level, string):

1951

logger.debug("GnuTLS: %s", string[:-1])

1836

logger.debug(u"GnuTLS: %s", string[:-1])

1952

1837

1953

1838

(gnutls.library.functions

1954

1839

.gnutls_global_set_log_function(debug_gnutls))

1962

1847

# No console logging

1963

1848

logger.removeHandler(console)

1964

1849

1965

# Need to fork before connecting to D-Bus

1966

if not debug:

1967

# Close all input and output, do double fork, etc.

1968

daemon()

1969

1850

1970

1851

global main_loop

1971

1852

# From the Avahi example code

1975

1856

# End of Avahi example code

1976

1857

if use_dbus:

1977

1858

try:

1978

bus_name = dbus.service.BusName("se.recompile.Mandos",

1859

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1979

1860

bus, do_not_queue=True)

1980

old_bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1981

bus, do_not_queue=True)

1982

except dbus.exceptions.NameExistsException as e:

1983

logger.error(unicode(e) + ", disabling D-Bus")

1861

except dbus.exceptions.NameExistsException, e:

1862

logger.error(unicode(e) + u", disabling D-Bus")

1984

1863

use_dbus = False

1985

server_settings["use_dbus"] = False

1864

server_settings[u"use_dbus"] = False

1986

1865

tcp_server.use_dbus = False

1987

1866

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1988

service = AvahiService(name = server_settings["servicename"],

1989

servicetype = "_mandos._tcp",

1867

service = AvahiService(name = server_settings[u"servicename"],

1868

servicetype = u"_mandos._tcp",

1990

1869

protocol = protocol, bus = bus)

1991

1870

if server_settings["interface"]:

1992

1871

service.interface = (if_nametoindex

1993

(str(server_settings["interface"])))

1994

1872

(str(server_settings[u"interface"])))

1873

1874

if not debug:

1875

# Close all input and output, do double fork, etc.

1876

daemon()

1877

1995

1878

global multiprocessing_manager

1996

1879

multiprocessing_manager = multiprocessing.Manager()

1997

1880

1998

1881

client_class = Client

1999

1882

if use_dbus:

2000

client_class = functools.partial(ClientDBusTransitional, bus = bus)

1883

client_class = functools.partial(ClientDBus, bus = bus)

2001

1884

def client_config_items(config, section):

2002

1885

special_settings = {

2003

1886

"approved_by_default":

2016

1899

client_config, section)))

2017

1900

for section in client_config.sections()))

2018

1901

if not tcp_server.clients:

2019

logger.warning("No clients defined")

1902

logger.warning(u"No clients defined")

2020

1903

2021

1904

if not debug:

2022

1905

try:

2023

1906

with pidfile:

2024

1907

pid = os.getpid()

2025

pidfile.write(str(pid) + "\n".encode("utf-8"))

1908

pidfile.write(str(pid) + "\n")

2026

1909

del pidfile

2027

1910

except IOError:

2028

logger.error("Could not write to file %r with PID %d",

1911

logger.error(u"Could not write to file %r with PID %d",

2029

1912

pidfilename, pid)

2030

1913

except NameError:

2031

1914

# "pidfile" was never created

2033

1916

del pidfilename

2034

1917

2035

1918

signal.signal(signal.SIGINT, signal.SIG_IGN)

2036

1919

2037

1920

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2038

1921

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2039

1922

2041

1924

class MandosDBusService(dbus.service.Object):

2042

1925

"""A D-Bus proxy object"""

2043

1926

def __init__(self):

2044

dbus.service.Object.__init__(self, bus, "/")

2045

_interface = "se.recompile.Mandos"

1927

dbus.service.Object.__init__(self, bus, u"/")

1928

_interface = u"se.bsnet.fukt.Mandos"

2046

1929

2047

@dbus.service.signal(_interface, signature="o")

1930

@dbus.service.signal(_interface, signature=u"o")

2048

1931

def ClientAdded(self, objpath):

2049

1932

"D-Bus signal"

2050

1933

pass

2051

1934

2052

@dbus.service.signal(_interface, signature="ss")

1935

@dbus.service.signal(_interface, signature=u"ss")

2053

1936

def ClientNotFound(self, fingerprint, address):

2054

1937

"D-Bus signal"

2055

1938

pass

2056

1939

2057

@dbus.service.signal(_interface, signature="os")

1940

@dbus.service.signal(_interface, signature=u"os")

2058

1941

def ClientRemoved(self, objpath, name):

2059

1942

"D-Bus signal"

2060

1943

pass

2061

1944

2062

@dbus.service.method(_interface, out_signature="ao")

1945

@dbus.service.method(_interface, out_signature=u"ao")

2063

1946

def GetAllClients(self):

2064

1947

"D-Bus method"

2065

1948

return dbus.Array(c.dbus_object_path

2066

1949

for c in tcp_server.clients)

2067

1950

2068

1951

@dbus.service.method(_interface,

2069

out_signature="a{oa{sv}}")

1952

out_signature=u"a{oa{sv}}")

2070

1953

def GetAllClientsWithProperties(self):

2071

1954

"D-Bus method"

2072

1955

return dbus.Dictionary(

2073

((c.dbus_object_path, c.GetAll(""))

1956

((c.dbus_object_path, c.GetAll(u""))

2074

1957

for c in tcp_server.clients),

2075

signature="oa{sv}")

1958

signature=u"oa{sv}")

2076

1959

2077

@dbus.service.method(_interface, in_signature="o")

1960

@dbus.service.method(_interface, in_signature=u"o")

2078

1961

def RemoveClient(self, object_path):

2079

1962

"D-Bus method"

2080

1963

for c in tcp_server.clients:

2090

1973

2091

1974

del _interface

2092

1975

2093

class MandosDBusServiceTransitional(MandosDBusService):

2094

__metaclass__ = AlternateDBusNamesMetaclass

2095

mandos_dbus_service = MandosDBusServiceTransitional()

1976

mandos_dbus_service = MandosDBusService()

2096

1977

2097

1978

def cleanup():

2098

1979

"Cleanup function; run on exit"

2124

2005

# Find out what port we got

2125

2006

service.port = tcp_server.socket.getsockname()[1]

2126

2007

if use_ipv6:

2127

logger.info("Now listening on address %r, port %d,"

2008

logger.info(u"Now listening on address %r, port %d,"

2128

2009

" flowinfo %d, scope_id %d"

2129

2010

% tcp_server.socket.getsockname())

2130

2011

else: # IPv4

2131

logger.info("Now listening on address %r, port %d"

2012

logger.info(u"Now listening on address %r, port %d"

2132

2013

% tcp_server.socket.getsockname())

2133

2014

2134

2015

#service.interface = tcp_server.socket.getsockname()[3]

2137

2018

# From the Avahi example code

2138

2019

try:

2139

2020

service.activate()

2140

except dbus.exceptions.DBusException as error:

2141

logger.critical("DBusException: %s", error)

2021

except dbus.exceptions.DBusException, error:

2022

logger.critical(u"DBusException: %s", error)

2142

2023

cleanup()

2143

2024

sys.exit(1)

2144

2025

# End of Avahi example code

2148

2029

(tcp_server.handle_request

2149

2030

(*args[2:], **kwargs) or True))

2150

2031

2151

logger.debug("Starting main loop")

2032

logger.debug(u"Starting main loop")

2152

2033

main_loop.run()

2153

except AvahiError as error:

2154

logger.critical("AvahiError: %s", error)

2034

except AvahiError, error:

2035

logger.critical(u"AvahiError: %s", error)

2155

2036

cleanup()

2156

2037

sys.exit(1)

2157

2038

except KeyboardInterrupt:

2158

2039

if debug:

2159

print("", file=sys.stderr)

2160

logger.debug("Server received KeyboardInterrupt")

2161

logger.debug("Server exiting")

2040

print >> sys.stderr

2041

logger.debug(u"Server received KeyboardInterrupt")

2042

logger.debug(u"Server exiting")

2162

2043

# Must run before the D-Bus bus name gets deregistered

2163

2044

cleanup()

2164

2045

2165

2166

2046

if __name__ == '__main__':

2167

2047

main()