/mandos/trunk : revision 24.1.186

1

#!/usr/bin/python

2

# -*- mode: python; coding: utf-8 -*-

3

#

4

# Mandos server - give out binary blobs to connecting clients.

5

#

6

# This program is partly derived from an example program for an Avahi

7

# service publisher, downloaded from

8

# <http://avahi.org/wiki/PythonPublishExample>. This includes the

9

# methods "add", "remove", "server_state_changed",

10

# "entry_group_state_changed", "cleanup", and "activate" in the

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

19

# the Free Software Foundation, either version 3 of the License, or

20

# (at your option) any later version.

21

#

22

# This program is distributed in the hope that it will be useful,

23

# but WITHOUT ANY WARRANTY; without even the implied warranty of

24

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

25

# GNU General Public License for more details.

26

#

27

# You should have received a copy of the GNU General Public License

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

36

37

import SocketServer as socketserver

38

import socket

39

import argparse

40

import datetime

41

import errno

42

import gnutls.crypto

43

import gnutls.connection

44

import gnutls.errors

45

import gnutls.library.functions

46

import gnutls.library.constants

47

import gnutls.library.types

48

import ConfigParser as configparser

49

import sys

50

import re

51

import os

52

import signal

53

import subprocess

54

import atexit

55

import stat

56

import logging

57

import logging.handlers

58

import pwd

59

import contextlib

60

import struct

61

import fcntl

62

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

66

67

import dbus

68

import dbus.service

69

import gobject

70

import avahi

71

from dbus.mainloop.glib import DBusGMainLoop

72

import ctypes

73

import ctypes.util

74

import xml.dom.minidom

75

import inspect

76

77

try:

78

SO_BINDTODEVICE = socket.SO_BINDTODEVICE

79

except AttributeError:

80

try:

81

from IN import SO_BINDTODEVICE

82

except ImportError:

83

SO_BINDTODEVICE = None

84

85

86

version = "1.3.1"

87

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

90

syslogger = (logging.handlers.SysLogHandler

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

92

address = str("/dev/log")))

93

syslogger.setFormatter(logging.Formatter

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

96

logger.addHandler(syslogger)

97

98

console = logging.StreamHandler()

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

102

logger.addHandler(console)

103

104

class AvahiError(Exception):

105

def __init__(self, value, *args, **kwargs):

106

self.value = value

107

super(AvahiError, self).__init__(value, *args, **kwargs)

108

def __unicode__(self):

109

return unicode(repr(self.value))

110

111

class AvahiServiceError(AvahiError):

112

pass

113

114

class AvahiGroupError(AvahiError):

115

pass

116

117

118

class AvahiService(object):

119

"""An Avahi (Zeroconf) service.

120

121

Attributes:

122

interface: integer; avahi.IF_UNSPEC or an interface index.

123

Used to optionally bind to the specified interface.

124

name: string; Example: 'Mandos'

125

type: string; Example: '_mandos._tcp'.

126

See <http://www.dns-sd.org/ServiceTypes.html>

127

port: integer; what port to announce

128

TXT: list of strings; TXT record for the service

129

domain: string; Domain to publish on, default to .local if empty.

130

host: string; Host to publish records for, default is localhost

131

max_renames: integer; maximum number of renames

132

rename_count: integer; counter so we only rename after collisions

133

a sensible number of times

134

group: D-Bus Entry Group

135

server: D-Bus Server

136

bus: dbus.SystemBus()

137

"""

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

139

servicetype = None, port = None, TXT = None,

140

domain = "", host = "", max_renames = 32768,

141

protocol = avahi.PROTO_UNSPEC, bus = None):

142

self.interface = interface

143

self.name = name

144

self.type = servicetype

145

self.port = port

146

self.TXT = TXT if TXT is not None else []

147

self.domain = domain

148

self.host = host

149

self.rename_count = 0

150

self.max_renames = max_renames

151

self.protocol = protocol

152

self.group = None # our entry group

153

self.server = None

154

self.bus = bus

155

self.entry_group_state_changed_match = None

156

def rename(self):

157

"""Derived from the Avahi example code"""

158

if self.rename_count >= self.max_renames:

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

161

self.rename_count)

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

164

logger.info("Changing Zeroconf service name to %r ...",

165

self.name)

166

syslogger.setFormatter(logging.Formatter

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

169

% self.name))

170

self.remove()

171

try:

172

self.add()

173

except dbus.exceptions.DBusException as error:

174

logger.critical("DBusException: %s", error)

175

self.cleanup()

176

os._exit(1)

177

self.rename_count += 1

178

def remove(self):

179

"""Derived from the Avahi example code"""

180

if self.entry_group_state_changed_match is not None:

181

self.entry_group_state_changed_match.remove()

182

self.entry_group_state_changed_match = None

183

if self.group is not None:

184

self.group.Reset()

185

def add(self):

186

"""Derived from the Avahi example code"""

187

self.remove()

188

if self.group is None:

189

self.group = dbus.Interface(

190

self.bus.get_object(avahi.DBUS_NAME,

191

self.server.EntryGroupNew()),

192

avahi.DBUS_INTERFACE_ENTRY_GROUP)

193

self.entry_group_state_changed_match = (

194

self.group.connect_to_signal(

195

'StateChanged', self .entry_group_state_changed))

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

197

self.name, self.type)

198

self.group.AddService(

199

self.interface,

200

self.protocol,

201

dbus.UInt32(0), # flags

202

self.name, self.type,

203

self.domain, self.host,

204

dbus.UInt16(self.port),

205

avahi.string_array_to_txt_array(self.TXT))

206

self.group.Commit()

207

def entry_group_state_changed(self, state, error):

208

"""Derived from the Avahi example code"""

209

logger.debug("Avahi entry group state change: %i", state)

210

211

if state == avahi.ENTRY_GROUP_ESTABLISHED:

212

logger.debug("Zeroconf service established.")

213

elif state == avahi.ENTRY_GROUP_COLLISION:

214

logger.info("Zeroconf service name collision.")

215

self.rename()

216

elif state == avahi.ENTRY_GROUP_FAILURE:

217

logger.critical("Avahi: Error in group state changed %s",

218

unicode(error))

219

raise AvahiGroupError("State changed: %s"

220

% unicode(error))

221

def cleanup(self):

222

"""Derived from the Avahi example code"""

223

if self.group is not None:

224

try:

225

self.group.Free()

226

except (dbus.exceptions.UnknownMethodException,

227

dbus.exceptions.DBusException) as e:

228

pass

229

self.group = None

230

self.remove()

231

def server_state_changed(self, state, error=None):

232

"""Derived from the Avahi example code"""

233

logger.debug("Avahi server state change: %i", state)

234

bad_states = { avahi.SERVER_INVALID:

235

"Zeroconf server invalid",

236

avahi.SERVER_REGISTERING: None,

237

avahi.SERVER_COLLISION:

238

"Zeroconf server name collision",

239

avahi.SERVER_FAILURE:

240

"Zeroconf server failure" }

241

if state in bad_states:

242

if bad_states[state] is not None:

243

if error is None:

244

logger.error(bad_states[state])

245

else:

246

logger.error(bad_states[state] + ": %r", error)

247

self.cleanup()

248

elif state == avahi.SERVER_RUNNING:

249

self.add()

250

else:

251

if error is None:

252

logger.debug("Unknown state: %r", state)

253

else:

254

logger.debug("Unknown state: %r: %r", state, error)

255

def activate(self):

256

"""Derived from the Avahi example code"""

257

if self.server is None:

258

self.server = dbus.Interface(

259

self.bus.get_object(avahi.DBUS_NAME,

260

avahi.DBUS_PATH_SERVER,

261

follow_name_owner_changes=True),

262

avahi.DBUS_INTERFACE_SERVER)

263

self.server.connect_to_signal("StateChanged",

264

self.server_state_changed)

265

self.server_state_changed(self.server.GetState())

266

267

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

274

class Client(object):

275

"""A representation of a client host served by this server.

276

277

Attributes:

278

_approved: bool(); 'None' if not yet approved/disapproved

279

approval_delay: datetime.timedelta(); Time to wait for approval

280

approval_duration: datetime.timedelta(); Duration of one approval

281

checker: subprocess.Popen(); a running checker process used

282

to see if the client lives.

283

'None' if no process is running.

284

checker_callback_tag: a gobject event source tag, or None

285

checker_command: string; External command which is run to check

286

if client lives. %() expansions are done at

287

runtime with vars(self) as dict, so that for

288

instance %(name)s can be used in the command.

289

checker_initiator_tag: a gobject event source tag, or None

290

created: datetime.datetime(); (UTC) object creation

291

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

293

disable_initiator_tag: a gobject event source tag, or None

294

enabled: bool()

295

fingerprint: string (40 or 32 hexadecimal digits); used to

296

uniquely identify the client

297

host: string; available for use by the checker command

298

interval: datetime.timedelta(); How often to start a new checker

299

last_approval_request: datetime.datetime(); (UTC) or None

300

last_checked_ok: datetime.datetime(); (UTC) or None

301

last_enabled: datetime.datetime(); (UTC)

302

name: string; from the config file, used in log messages and

303

D-Bus identifiers

304

secret: bytestring; sent verbatim (over TLS) to client

305

timeout: datetime.timedelta(); How long from last_checked_ok

306

until this client is disabled

307

extended_timeout: extra long timeout when password has been sent

308

runtime_expansions: Allowed attributes for runtime expansion.

309

expires: datetime.datetime(); time (UTC) when a client will be

310

disabled, or None

311

"""

312

313

runtime_expansions = ("approval_delay", "approval_duration",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

316

"last_enabled", "name", "timeout")

317

318

def timeout_milliseconds(self):

319

"Return the 'timeout' attribute in milliseconds"

320

return _timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

325

326

def interval_milliseconds(self):

327

"Return the 'interval' attribute in milliseconds"

328

return _timedelta_to_milliseconds(self.interval)

329

330

def approval_delay_milliseconds(self):

331

return _timedelta_to_milliseconds(self.approval_delay)

332

333

def __init__(self, name = None, disable_hook=None, config=None):

334

"""Note: the 'checker' key in 'config' sets the

335

'checker_command' attribute and *not* the 'checker'

336

attribute."""

337

self.name = name

338

if config is None:

339

config = {}

340

logger.debug("Creating client %r", self.name)

341

# Uppercase and remove spaces from fingerprint for later

342

# comparison purposes with return value from the fingerprint()

343

# function

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

350

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

352

"rb") as secfile:

353

self.secret = secfile.read()

354

else:

355

raise TypeError("No secret or secfile for client %s"

356

% self.name)

357

self.host = config.get("host", "")

358

self.created = datetime.datetime.utcnow()

359

self.enabled = False

360

self.last_approval_request = None

361

self.last_enabled = None

362

self.last_checked_ok = None

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

366

self.disable_hook = disable_hook

367

self.checker = None

368

self.checker_initiator_tag = None

369

self.disable_initiator_tag = None

370

self.expires = None

371

self.checker_callback_tag = None

372

self.checker_command = config["checker"]

373

self.current_checker_command = None

374

self.last_connect = None

375

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

377

True)

378

self.approvals_pending = 0

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

384

385

def send_changedstate(self):

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

390

def enable(self):

391

"""Start this client's checker and timeout hooks"""

392

if getattr(self, "enabled", False):

393

# Already enabled

394

return

395

self.send_changedstate()

396

# Schedule a new checker to be started an 'interval' from now,

397

# and every interval from then on.

398

self.checker_initiator_tag = (gobject.timeout_add

399

(self.interval_milliseconds(),

400

self.start_checker))

401

# Schedule a disable() when 'timeout' has passed

402

self.expires = datetime.datetime.utcnow() + self.timeout

403

self.disable_initiator_tag = (gobject.timeout_add

404

(self.timeout_milliseconds(),

405

self.disable))

406

self.enabled = True

407

self.last_enabled = datetime.datetime.utcnow()

408

# Also start a new checker *right now*.

409

self.start_checker()

410

411

def disable(self, quiet=True):

412

"""Disable this client."""

413

if not getattr(self, "enabled", False):

414

return False

415

if not quiet:

416

self.send_changedstate()

417

if not quiet:

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

420

gobject.source_remove(self.disable_initiator_tag)

421

self.disable_initiator_tag = None

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

424

gobject.source_remove(self.checker_initiator_tag)

425

self.checker_initiator_tag = None

426

self.stop_checker()

427

if self.disable_hook:

428

self.disable_hook(self)

429

self.enabled = False

430

# Do not run this again if called by a gobject.timeout_add

431

return False

432

433

def __del__(self):

434

self.disable_hook = None

435

self.disable()

436

437

def checker_callback(self, pid, condition, command):

438

"""The checker has completed, so take appropriate actions."""

439

self.checker_callback_tag = None

440

self.checker = None

441

if os.WIFEXITED(condition):

442

exitstatus = os.WEXITSTATUS(condition)

443

if exitstatus == 0:

444

logger.info("Checker for %(name)s succeeded",

445

vars(self))

446

self.checked_ok()

447

else:

448

logger.info("Checker for %(name)s failed",

449

vars(self))

450

else:

451

logger.warning("Checker for %(name)s crashed?",

452

vars(self))

453

454

def checked_ok(self, timeout=None):

455

"""Bump up the timeout for this client.

456

457

This should only be called when the client has been seen,

458

alive and well.

459

"""

460

if timeout is None:

461

timeout = self.timeout

462

self.last_checked_ok = datetime.datetime.utcnow()

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

self.disable_initiator_tag = (gobject.timeout_add

466

(_timedelta_to_milliseconds(timeout),

467

self.disable))

468

469

def need_approval(self):

470

self.last_approval_request = datetime.datetime.utcnow()

471

472

def start_checker(self):

473

"""Start a new checker subprocess if one is not running.

474

475

If a checker already exists, leave it running and do

476

nothing."""

477

# The reason for not killing a running checker is that if we

478

# did that, then if a checker (for some reason) started

479

# running slowly and taking more than 'interval' time, the

480

# client would inevitably timeout, since no checker would get

481

# a chance to run to completion. If we instead leave running

482

# checkers alone, the checker would have to take more time

483

# than 'timeout' for the client to be disabled, which is as it

484

# should be.

485

486

# If a checker exists, make sure it is not a zombie

487

try:

488

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

489

except (AttributeError, OSError) as error:

490

if (isinstance(error, OSError)

491

and error.errno != errno.ECHILD):

492

raise error

493

else:

494

if pid:

495

logger.warning("Checker was a zombie")

496

gobject.source_remove(self.checker_callback_tag)

497

self.checker_callback(pid, status,

498

self.current_checker_command)

499

# Start a new checker if needed

500

if self.checker is None:

501

try:

502

# In case checker_command has exactly one % operator

503

command = self.checker_command % self.host

504

except TypeError:

505

# Escape attributes for the shell

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

514

try:

515

command = self.checker_command % escaped_attrs

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

519

return True # Try again later

520

self.current_checker_command = command

521

try:

522

logger.info("Starting checker %r for %s",

523

command, self.name)

524

# We don't need to redirect stdout and stderr, since

525

# in normal mode, that is already done by daemon(),

526

# and in debug mode we don't want to. (Stdin is

527

# always replaced by /dev/null.)

528

self.checker = subprocess.Popen(command,

529

close_fds=True,

530

shell=True, cwd="/")

531

self.checker_callback_tag = (gobject.child_watch_add

532

(self.checker.pid,

533

self.checker_callback,

534

data=command))

535

# The checker may have completed before the gobject

536

# watch was added. Check for this.

537

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

538

if pid:

539

gobject.source_remove(self.checker_callback_tag)

540

self.checker_callback(pid, status, command)

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

543

error)

544

# Re-run this periodically if run by gobject.timeout_add

545

return True

546

547

def stop_checker(self):

548

"""Force the checker process, if any, to stop."""

549

if self.checker_callback_tag:

550

gobject.source_remove(self.checker_callback_tag)

551

self.checker_callback_tag = None

552

if getattr(self, "checker", None) is None:

553

return

554

logger.debug("Stopping checker for %(name)s", vars(self))

555

try:

556

os.kill(self.checker.pid, signal.SIGTERM)

557

#time.sleep(0.5)

558

#if self.checker.poll() is None:

559

# os.kill(self.checker.pid, signal.SIGKILL)

560

except OSError as error:

561

if error.errno != errno.ESRCH: # No such process

562

raise

563

self.checker = None

564

565

566

def dbus_service_property(dbus_interface, signature="v",

567

access="readwrite", byte_arrays=False):

568

"""Decorators for marking methods of a DBusObjectWithProperties to

569

become properties on the D-Bus.

570

571

The decorated method will be called with no arguments by "Get"

572

and with one argument by "Set".

573

574

The parameters, where they are supported, are the same as

575

dbus.service.method, except there is only "signature", since the

576

type from Get() and the type sent to Set() is the same.

577

"""

578

# Encoding deeply encoded byte arrays is not supported yet by the

579

# "Set" method, so we fail early here:

580

if byte_arrays and signature != "ay":

581

raise ValueError("Byte arrays not supported for non-'ay'"

582

" signature %r" % signature)

583

def decorator(func):

584

func._dbus_is_property = True

585

func._dbus_interface = dbus_interface

586

func._dbus_signature = signature

587

func._dbus_access = access

588

func._dbus_name = func.__name__

589

if func._dbus_name.endswith("_dbus_property"):

590

func._dbus_name = func._dbus_name[:-14]

591

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

592

return func

593

return decorator

594

595

596

class DBusPropertyException(dbus.exceptions.DBusException):

597

"""A base class for D-Bus property-related exceptions

598

"""

599

def __unicode__(self):

600

return unicode(str(self))

601

602

603

class DBusPropertyAccessException(DBusPropertyException):

604

"""A property's access permissions disallows an operation.

605

"""

606

pass

607

608

609

class DBusPropertyNotFound(DBusPropertyException):

610

"""An attempt was made to access a non-existing property.

611

"""

612

pass

613

614

615

class DBusObjectWithProperties(dbus.service.Object):

616

"""A D-Bus object with properties.

617

618

Classes inheriting from this can use the dbus_service_property

619

decorator to expose methods as D-Bus properties. It exposes the

620

standard Get(), Set(), and GetAll() methods on the D-Bus.

621

"""

622

623

@staticmethod

624

def _is_dbus_property(obj):

625

return getattr(obj, "_dbus_is_property", False)

626

627

def _get_all_dbus_properties(self):

628

"""Returns a generator of (name, attribute) pairs

629

"""

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

631

for cls in self.__class__.__mro__

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

633

634

def _get_dbus_property(self, interface_name, property_name):

635

"""Returns a bound method if one exists which is a D-Bus

636

property with the specified name and interface.

637

"""

638

for cls in self.__class__.__mro__:

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

641

return value.__get__(self)

642

643

# No such property

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

645

+ interface_name + "."

646

+ property_name)

647

648

649

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

650

out_signature="v")

651

def Get(self, interface_name, property_name):

652

"""Standard D-Bus property Get() method, see D-Bus standard.

653

"""

654

prop = self._get_dbus_property(interface_name, property_name)

655

if prop._dbus_access == "write":

656

raise DBusPropertyAccessException(property_name)

657

value = prop()

658

if not hasattr(value, "variant_level"):

659

return value

660

return type(value)(value, variant_level=value.variant_level+1)

661

662

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

663

def Set(self, interface_name, property_name, value):

664

"""Standard D-Bus property Set() method, see D-Bus standard.

665

"""

666

prop = self._get_dbus_property(interface_name, property_name)

667

if prop._dbus_access == "read":

668

raise DBusPropertyAccessException(property_name)

669

if prop._dbus_get_args_options["byte_arrays"]:

670

# The byte_arrays option is not supported yet on

671

# signatures other than "ay".

672

if prop._dbus_signature != "ay":

673

raise ValueError

674

value = dbus.ByteArray(''.join(unichr(byte)

675

for byte in value))

676

prop(value)

677

678

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

679

out_signature="a{sv}")

680

def GetAll(self, interface_name):

681

"""Standard D-Bus property GetAll() method, see D-Bus

682

standard.

683

684

Note: Will not include properties with access="write".

685

"""

686

all = {}

687

for name, prop in self._get_all_dbus_properties():

688

if (interface_name

689

and interface_name != prop._dbus_interface):

690

# Interface non-empty but did not match

691

continue

692

# Ignore write-only properties

693

if prop._dbus_access == "write":

694

continue

695

value = prop()

696

if not hasattr(value, "variant_level"):

697

all[name] = value

698

continue

699

all[name] = type(value)(value, variant_level=

700

value.variant_level+1)

701

return dbus.Dictionary(all, signature="sv")

702

703

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

704

out_signature="s",

705

path_keyword='object_path',

706

connection_keyword='connection')

707

def Introspect(self, object_path, connection):

708

"""Standard D-Bus method, overloaded to insert property tags.

709

"""

710

xmlstring = dbus.service.Object.Introspect(self, object_path,

711

connection)

712

try:

713

document = xml.dom.minidom.parseString(xmlstring)

714

def make_tag(document, name, prop):

715

e = document.createElement("property")

716

e.setAttribute("name", name)

717

e.setAttribute("type", prop._dbus_signature)

718

e.setAttribute("access", prop._dbus_access)

719

return e

720

for if_tag in document.getElementsByTagName("interface"):

721

for tag in (make_tag(document, name, prop)

722

for name, prop

723

in self._get_all_dbus_properties()

724

if prop._dbus_interface

725

== if_tag.getAttribute("name")):

726

if_tag.appendChild(tag)

727

# Add the names to the return values for the

728

# "org.freedesktop.DBus.Properties" methods

729

if (if_tag.getAttribute("name")

730

== "org.freedesktop.DBus.Properties"):

731

for cn in if_tag.getElementsByTagName("method"):

732

if cn.getAttribute("name") == "Get":

733

for arg in cn.getElementsByTagName("arg"):

734

if (arg.getAttribute("direction")

735

== "out"):

736

arg.setAttribute("name", "value")

737

elif cn.getAttribute("name") == "GetAll":

738

for arg in cn.getElementsByTagName("arg"):

739

if (arg.getAttribute("direction")

740

== "out"):

741

arg.setAttribute("name", "props")

742

xmlstring = document.toxml("utf-8")

743

document.unlink()

744

except (AttributeError, xml.dom.DOMException,

745

xml.parsers.expat.ExpatError) as error:

746

logger.error("Failed to override Introspection method",

747

error)

748

return xmlstring

749

750

751

def datetime_to_dbus (dt, variant_level=0):

752

"""Convert a UTC datetime.datetime() to a D-Bus type."""

753

if dt is None:

754

return dbus.String("", variant_level = variant_level)

755

return dbus.String(dt.isoformat(),

756

variant_level=variant_level)

757

758

class transitional_dbus_metaclass(DBusObjectWithProperties.__metaclass__):

759

def __new__(mcs, name, bases, attr):

760

for attrname, old_dbusobj in inspect.getmembers(bases[0]):

761

new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")

762

if (getattr(old_dbusobj, "_dbus_is_signal", False)

763

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

764

unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,

765

old_dbusobj.__closure__))["func"].cell_contents

766

newfunc = types.FunctionType(unwrappedfunc.func_code,

767

unwrappedfunc.func_globals,

768

unwrappedfunc.func_name,

769

unwrappedfunc.func_defaults,

770

unwrappedfunc.func_closure)

771

new_dbusfunc = dbus.service.signal(

772

new_interface, old_dbusobj._dbus_signature)(newfunc)

773

attr["_transitional_" + attrname] = new_dbusfunc

774

775

def fixscope(func1, func2):

776

def newcall(*args, **kwargs):

777

func1(*args, **kwargs)

778

func2(*args, **kwargs)

779

return newcall

780

781

attr[attrname] = fixscope(old_dbusobj, new_dbusfunc)

782

783

elif (getattr(old_dbusobj, "_dbus_is_method", False)

784

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

785

new_dbusfunc = (dbus.service.method

786

(new_interface,

787

old_dbusobj._dbus_in_signature,

788

old_dbusobj._dbus_out_signature)

789

(types.FunctionType

790

(old_dbusobj.func_code,

791

old_dbusobj.func_globals,

792

old_dbusobj.func_name,

793

old_dbusobj.func_defaults,

794

old_dbusobj.func_closure)))

795

796

attr[attrname] = new_dbusfunc

797

elif (getattr(old_dbusobj, "_dbus_is_property", False)

798

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

799

new_dbusfunc = (dbus_service_property

800

(new_interface,

801

old_dbusobj._dbus_signature,

802

old_dbusobj._dbus_access,

803

old_dbusobj._dbus_get_args_options["byte_arrays"])

804

(types.FunctionType

805

(old_dbusobj.func_code,

806

old_dbusobj.func_globals,

807

old_dbusobj.func_name,

808

old_dbusobj.func_defaults,

809

old_dbusobj.func_closure)))

810

811

attr[attrname] = new_dbusfunc

812

return type.__new__(mcs, name, bases, attr)

813

814

class ClientDBus(Client, DBusObjectWithProperties):

815

"""A Client class using D-Bus

816

817

Attributes:

818

dbus_object_path: dbus.ObjectPath

819

bus: dbus.SystemBus()

820

"""

821

822

runtime_expansions = (Client.runtime_expansions

823

+ ("dbus_object_path",))

824

825

# dbus.service.Object doesn't use super(), so we can't either.

826

827

def __init__(self, bus = None, *args, **kwargs):

828

self._approvals_pending = 0

829

self.bus = bus

830

Client.__init__(self, *args, **kwargs)

831

# Only now, when this client is initialized, can it show up on

832

# the D-Bus

833

client_object_name = unicode(self.name).translate(

834

{ord("."): ord("_"),

835

ord("-"): ord("_")})

836

self.dbus_object_path = (dbus.ObjectPath

837

("/clients/" + client_object_name))

838

DBusObjectWithProperties.__init__(self, self.bus,

839

self.dbus_object_path)

840

841

def notifychangeproperty(transform_func,

842

dbus_name, type_func=lambda x: x,

843

variant_level=1):

844

""" Modify a variable so that its a property that announce its

845

changes to DBus.

846

transform_fun: Function that takes a value and transform it to

847

DBus type.

848

dbus_name: DBus name of the variable

849

type_func: Function that transform the value before sending it

850

to DBus

851

variant_level: DBus variant level. default: 1

852

"""

853

real_value = [None,]

854

def setter(self, value):

855

old_value = real_value[0]

856

real_value[0] = value

857

if hasattr(self, "dbus_object_path"):

858

if type_func(old_value) != type_func(real_value[0]):

859

dbus_value = transform_func(type_func(real_value[0]),

860

variant_level)

861

self.PropertyChanged(dbus.String(dbus_name),

862

dbus_value)

863

864

return property(lambda self: real_value[0], setter)

865

866

867

expires = notifychangeproperty(datetime_to_dbus, "Expires")

868

approvals_pending = notifychangeproperty(dbus.Boolean,

869

"ApprovalPending",

870

type_func = bool)

871

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

872

last_enabled = notifychangeproperty(datetime_to_dbus,

873

"LastEnabled")

874

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

875

type_func = lambda checker: checker is not None)

876

last_checked_ok = notifychangeproperty(datetime_to_dbus,

877

"LastCheckedOK")

878

last_approval_request = notifychangeproperty(datetime_to_dbus,

879

"LastApprovalRequest")

880

approved_by_default = notifychangeproperty(dbus.Boolean,

881

"ApprovedByDefault")

882

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

883

type_func = _timedelta_to_milliseconds)

884

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

885

type_func = _timedelta_to_milliseconds)

886

host = notifychangeproperty(dbus.String, "Host")

887

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

888

type_func = _timedelta_to_milliseconds)

889

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

890

type_func = _timedelta_to_milliseconds)

891

interval = notifychangeproperty(dbus.UInt16, "Interval",

892

type_func = _timedelta_to_milliseconds)

893

checker_command = notifychangeproperty(dbus.String, "Checker")

894

895

del notifychangeproperty

896

897

def __del__(self, *args, **kwargs):

898

try:

899

self.remove_from_connection()

900

except LookupError:

901

pass

902

if hasattr(DBusObjectWithProperties, "__del__"):

903

DBusObjectWithProperties.__del__(self, *args, **kwargs)

904

Client.__del__(self, *args, **kwargs)

905

906

def checker_callback(self, pid, condition, command,

907

*args, **kwargs):

908

self.checker_callback_tag = None

909

self.checker = None

910

if os.WIFEXITED(condition):

911

exitstatus = os.WEXITSTATUS(condition)

912

# Emit D-Bus signal

913

self.CheckerCompleted(dbus.Int16(exitstatus),

914

dbus.Int64(condition),

915

dbus.String(command))

916

else:

917

# Emit D-Bus signal

918

self.CheckerCompleted(dbus.Int16(-1),

919

dbus.Int64(condition),

920

dbus.String(command))

921

922

return Client.checker_callback(self, pid, condition, command,

923

*args, **kwargs)

924

925

def start_checker(self, *args, **kwargs):

926

old_checker = self.checker

927

if self.checker is not None:

928

old_checker_pid = self.checker.pid

929

else:

930

old_checker_pid = None

931

r = Client.start_checker(self, *args, **kwargs)

932

# Only if new checker process was started

933

if (self.checker is not None

934

and old_checker_pid != self.checker.pid):

935

# Emit D-Bus signal

936

self.CheckerStarted(self.current_checker_command)

937

return r

938

939

def _reset_approved(self):

940

self._approved = None

941

return False

942

943

def approve(self, value=True):

944

self.send_changedstate()

945

self._approved = value

946

gobject.timeout_add(_timedelta_to_milliseconds

947

(self.approval_duration),

948

self._reset_approved)

949

950

951

## D-Bus methods, signals & properties

952

_interface = "se.bsnet.fukt.Mandos.Client"

953

954

## Signals

955

956

# CheckerCompleted - signal

957

@dbus.service.signal(_interface, signature="nxs")

958

def CheckerCompleted(self, exitcode, waitstatus, command):

959

"D-Bus signal"

960

pass

961

962

# CheckerStarted - signal

963

@dbus.service.signal(_interface, signature="s")

964

def CheckerStarted(self, command):

965

"D-Bus signal"

966

pass

967

968

# PropertyChanged - signal

969

@dbus.service.signal(_interface, signature="sv")

970

def PropertyChanged(self, property, value):

971

"D-Bus signal"

972

pass

973

974

# GotSecret - signal

975

@dbus.service.signal(_interface)

976

def GotSecret(self):

977

"""D-Bus signal

978

Is sent after a successful transfer of secret from the Mandos

979

server to mandos-client

980

"""

981

pass

982

983

# Rejected - signal

984

@dbus.service.signal(_interface, signature="s")

985

def Rejected(self, reason):

986

"D-Bus signal"

987

pass

988

989

# NeedApproval - signal

990

@dbus.service.signal(_interface, signature="tb")

991

def NeedApproval(self, timeout, default):

992

"D-Bus signal"

993

return self.need_approval()

994

995

## Methods

996

997

# Approve - method

998

@dbus.service.method(_interface, in_signature="b")

999

def Approve(self, value):

1000

self.approve(value)

1001

1002

# CheckedOK - method

1003

@dbus.service.method(_interface)

1004

def CheckedOK(self):

1005

self.checked_ok()

1006

1007

# Enable - method

1008

@dbus.service.method(_interface)

1009

def Enable(self):

1010

"D-Bus method"

1011

self.enable()

1012

1013

# StartChecker - method

1014

@dbus.service.method(_interface)

1015

def StartChecker(self):

1016

"D-Bus method"

1017

self.start_checker()

1018

1019

# Disable - method

1020

@dbus.service.method(_interface)

1021

def Disable(self):

1022

"D-Bus method"

1023

self.disable()

1024

1025

# StopChecker - method

1026

@dbus.service.method(_interface)

1027

def StopChecker(self):

1028

self.stop_checker()

1029

1030

## Properties

1031

1032

# ApprovalPending - property

1033

@dbus_service_property(_interface, signature="b", access="read")

1034

def ApprovalPending_dbus_property(self):

1035

return dbus.Boolean(bool(self.approvals_pending))

1036

1037

# ApprovedByDefault - property

1038

@dbus_service_property(_interface, signature="b",

1039

access="readwrite")

1040

def ApprovedByDefault_dbus_property(self, value=None):

1041

if value is None: # get

1042

return dbus.Boolean(self.approved_by_default)

1043

self.approved_by_default = bool(value)

1044

1045

# ApprovalDelay - property

1046

@dbus_service_property(_interface, signature="t",

1047

access="readwrite")

1048

def ApprovalDelay_dbus_property(self, value=None):

1049

if value is None: # get

1050

return dbus.UInt64(self.approval_delay_milliseconds())

1051

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1052

1053

# ApprovalDuration - property

1054

@dbus_service_property(_interface, signature="t",

1055

access="readwrite")

1056

def ApprovalDuration_dbus_property(self, value=None):

1057

if value is None: # get

1058

return dbus.UInt64(_timedelta_to_milliseconds(

1059

self.approval_duration))

1060

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1061

1062

# Name - property

1063

@dbus_service_property(_interface, signature="s", access="read")

1064

def Name_dbus_property(self):

1065

return dbus.String(self.name)

1066

1067

# Fingerprint - property

1068

@dbus_service_property(_interface, signature="s", access="read")

1069

def Fingerprint_dbus_property(self):

1070

return dbus.String(self.fingerprint)

1071

1072

# Host - property

1073

@dbus_service_property(_interface, signature="s",

1074

access="readwrite")

1075

def Host_dbus_property(self, value=None):

1076

if value is None: # get

1077

return dbus.String(self.host)

1078

self.host = value

1079

1080

# Created - property

1081

@dbus_service_property(_interface, signature="s", access="read")

1082

def Created_dbus_property(self):

1083

return dbus.String(datetime_to_dbus(self.created))

1084

1085

# LastEnabled - property

1086

@dbus_service_property(_interface, signature="s", access="read")

1087

def LastEnabled_dbus_property(self):

1088

return datetime_to_dbus(self.last_enabled)

1089

1090

# Enabled - property

1091

@dbus_service_property(_interface, signature="b",

1092

access="readwrite")

1093

def Enabled_dbus_property(self, value=None):

1094

if value is None: # get

1095

return dbus.Boolean(self.enabled)

1096

if value:

1097

self.enable()

1098

else:

1099

self.disable()

1100

1101

# LastCheckedOK - property

1102

@dbus_service_property(_interface, signature="s",

1103

access="readwrite")

1104

def LastCheckedOK_dbus_property(self, value=None):

1105

if value is not None:

1106

self.checked_ok()

1107

return

1108

return datetime_to_dbus(self.last_checked_ok)

1109

1110

# Expires - property

1111

@dbus_service_property(_interface, signature="s", access="read")

1112

def Expires_dbus_property(self):

1113

return datetime_to_dbus(self.expires)

1114

1115

# LastApprovalRequest - property

1116

@dbus_service_property(_interface, signature="s", access="read")

1117

def LastApprovalRequest_dbus_property(self):

1118

return datetime_to_dbus(self.last_approval_request)

1119

1120

# Timeout - property

1121

@dbus_service_property(_interface, signature="t",

1122

access="readwrite")

1123

def Timeout_dbus_property(self, value=None):

1124

if value is None: # get

1125

return dbus.UInt64(self.timeout_milliseconds())

1126

self.timeout = datetime.timedelta(0, 0, 0, value)

1127

if getattr(self, "disable_initiator_tag", None) is None:

1128

return

1129

# Reschedule timeout

1130

gobject.source_remove(self.disable_initiator_tag)

1131

self.disable_initiator_tag = None

1132

self.expires = None

1133

time_to_die = (self.

1134

_timedelta_to_milliseconds((self

1135

.last_checked_ok

1136

+ self.timeout)

1137

- datetime.datetime

1138

.utcnow()))

1139

if time_to_die <= 0:

1140

# The timeout has passed

1141

self.disable()

1142

else:

1143

self.expires = (datetime.datetime.utcnow()

1144

+ datetime.timedelta(milliseconds = time_to_die))

1145

self.disable_initiator_tag = (gobject.timeout_add

1146

(time_to_die, self.disable))

1147

1148

# ExtendedTimeout - property

1149

@dbus_service_property(_interface, signature="t",

1150

access="readwrite")

1151

def ExtendedTimeout_dbus_property(self, value=None):

1152

if value is None: # get

1153

return dbus.UInt64(self.extended_timeout_milliseconds())

1154

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1155

1156

# Interval - property

1157

@dbus_service_property(_interface, signature="t",

1158

access="readwrite")

1159

def Interval_dbus_property(self, value=None):

1160

if value is None: # get

1161

return dbus.UInt64(self.interval_milliseconds())

1162

self.interval = datetime.timedelta(0, 0, 0, value)

1163

if getattr(self, "checker_initiator_tag", None) is None:

1164

return

1165

# Reschedule checker run

1166

gobject.source_remove(self.checker_initiator_tag)

1167

self.checker_initiator_tag = (gobject.timeout_add

1168

(value, self.start_checker))

1169

self.start_checker() # Start one now, too

1170

1171

# Checker - property

1172

@dbus_service_property(_interface, signature="s",

1173

access="readwrite")

1174

def Checker_dbus_property(self, value=None):

1175

if value is None: # get

1176

return dbus.String(self.checker_command)

1177

self.checker_command = value

1178

1179

# CheckerRunning - property

1180

@dbus_service_property(_interface, signature="b",

1181

access="readwrite")

1182

def CheckerRunning_dbus_property(self, value=None):

1183

if value is None: # get

1184

return dbus.Boolean(self.checker is not None)

1185

if value:

1186

self.start_checker()

1187

else:

1188

self.stop_checker()

1189

1190

# ObjectPath - property

1191

@dbus_service_property(_interface, signature="o", access="read")

1192

def ObjectPath_dbus_property(self):

1193

return self.dbus_object_path # is already a dbus.ObjectPath

1194

1195

# Secret = property

1196

@dbus_service_property(_interface, signature="ay",

1197

access="write", byte_arrays=True)

1198

def Secret_dbus_property(self, value):

1199

self.secret = str(value)

1200

1201

del _interface

1202

1203

1204

class ProxyClient(object):

1205

def __init__(self, child_pipe, fpr, address):

1206

self._pipe = child_pipe

1207

self._pipe.send(('init', fpr, address))

1208

if not self._pipe.recv():

1209

raise KeyError()

1210

1211

def __getattribute__(self, name):

1212

if(name == '_pipe'):

1213

return super(ProxyClient, self).__getattribute__(name)

1214

self._pipe.send(('getattr', name))

1215

data = self._pipe.recv()

1216

if data[0] == 'data':

1217

return data[1]

1218

if data[0] == 'function':

1219

def func(*args, **kwargs):

1220

self._pipe.send(('funcall', name, args, kwargs))

1221

return self._pipe.recv()[1]

1222

return func

1223

1224

def __setattr__(self, name, value):

1225

if(name == '_pipe'):

1226

return super(ProxyClient, self).__setattr__(name, value)

1227

self._pipe.send(('setattr', name, value))

1228

1229

class ClientDBusTransitional(ClientDBus):

1230

__metaclass__ = transitional_dbus_metaclass

1231

1232

class ClientHandler(socketserver.BaseRequestHandler, object):

1233

"""A class to handle client connections.

1234

1235

Instantiated once for each connection to handle it.

1236

Note: This will run in its own forked process."""

1237

1238

def handle(self):

1239

with contextlib.closing(self.server.child_pipe) as child_pipe:

1240

logger.info("TCP connection from: %s",

1241

unicode(self.client_address))

1242

logger.debug("Pipe FD: %d",

1243

self.server.child_pipe.fileno())

1244

1245

session = (gnutls.connection

1246

.ClientSession(self.request,

1247

gnutls.connection

1248

.X509Credentials()))

1249

1250

# Note: gnutls.connection.X509Credentials is really a

1251

# generic GnuTLS certificate credentials object so long as

1252

# no X.509 keys are added to it. Therefore, we can use it

1253

# here despite using OpenPGP certificates.

1254

1255

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1256

# "+AES-256-CBC", "+SHA1",

1257

# "+COMP-NULL", "+CTYPE-OPENPGP",

1258

# "+DHE-DSS"))

1259

# Use a fallback default, since this MUST be set.

1260

priority = self.server.gnutls_priority

1261

if priority is None:

1262

priority = "NORMAL"

1263

(gnutls.library.functions

1264

.gnutls_priority_set_direct(session._c_object,

1265

priority, None))

1266

1267

# Start communication using the Mandos protocol

1268

# Get protocol number

1269

line = self.request.makefile().readline()

1270

logger.debug("Protocol version: %r", line)

1271

try:

1272

if int(line.strip().split()[0]) > 1:

1273

raise RuntimeError

1274

except (ValueError, IndexError, RuntimeError) as error:

1275

logger.error("Unknown protocol version: %s", error)

1276

return

1277

1278

# Start GnuTLS connection

1279

try:

1280

session.handshake()

1281

except gnutls.errors.GNUTLSError as error:

1282

logger.warning("Handshake failed: %s", error)

1283

# Do not run session.bye() here: the session is not

1284

# established. Just abandon the request.

1285

return

1286

logger.debug("Handshake succeeded")

1287

1288

approval_required = False

1289

try:

1290

try:

1291

fpr = self.fingerprint(self.peer_certificate

1292

(session))

1293

except (TypeError,

1294

gnutls.errors.GNUTLSError) as error:

1295

logger.warning("Bad certificate: %s", error)

1296

return

1297

logger.debug("Fingerprint: %s", fpr)

1298

1299

try:

1300

client = ProxyClient(child_pipe, fpr,

1301

self.client_address)

1302

except KeyError:

1303

return

1304

1305

if client.approval_delay:

1306

delay = client.approval_delay

1307

client.approvals_pending += 1

1308

approval_required = True

1309

1310

while True:

1311

if not client.enabled:

1312

logger.info("Client %s is disabled",

1313

client.name)

1314

if self.server.use_dbus:

1315

# Emit D-Bus signal

1316

client.Rejected("Disabled")

1317

return

1318

1319

if client._approved or not client.approval_delay:

1320

#We are approved or approval is disabled

1321

break

1322

elif client._approved is None:

1323

logger.info("Client %s needs approval",

1324

client.name)

1325

if self.server.use_dbus:

1326

# Emit D-Bus signal

1327

client.NeedApproval(

1328

client.approval_delay_milliseconds(),

1329

client.approved_by_default)

1330

else:

1331

logger.warning("Client %s was not approved",

1332

client.name)

1333

if self.server.use_dbus:

1334

# Emit D-Bus signal

1335

client.Rejected("Denied")

1336

return

1337

1338

#wait until timeout or approved

1339

#x = float(client._timedelta_to_milliseconds(delay))

1340

time = datetime.datetime.now()

1341

client.changedstate.acquire()

1342

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1343

client.changedstate.release()

1344

time2 = datetime.datetime.now()

1345

if (time2 - time) >= delay:

1346

if not client.approved_by_default:

1347

logger.warning("Client %s timed out while"

1348

" waiting for approval",

1349

client.name)

1350

if self.server.use_dbus:

1351

# Emit D-Bus signal

1352

client.Rejected("Approval timed out")

1353

return

1354

else:

1355

break

1356

else:

1357

delay -= time2 - time

1358

1359

sent_size = 0

1360

while sent_size < len(client.secret):

1361

try:

1362

sent = session.send(client.secret[sent_size:])

1363

except gnutls.errors.GNUTLSError as error:

1364

logger.warning("gnutls send failed")

1365

return

1366

logger.debug("Sent: %d, remaining: %d",

1367

sent, len(client.secret)

1368

- (sent_size + sent))

1369

sent_size += sent

1370

1371

logger.info("Sending secret to %s", client.name)

1372

# bump the timeout as if seen

1373

client.checked_ok(client.extended_timeout)

1374

if self.server.use_dbus:

1375

# Emit D-Bus signal

1376

client.GotSecret()

1377

1378

finally:

1379

if approval_required:

1380

client.approvals_pending -= 1

1381

try:

1382

session.bye()

1383

except gnutls.errors.GNUTLSError as error:

1384

logger.warning("GnuTLS bye failed")

1385

1386

@staticmethod

1387

def peer_certificate(session):

1388

"Return the peer's OpenPGP certificate as a bytestring"

1389

# If not an OpenPGP certificate...

1390

if (gnutls.library.functions

1391

.gnutls_certificate_type_get(session._c_object)

1392

!= gnutls.library.constants.GNUTLS_CRT_OPENPGP):

1393

# ...do the normal thing

1394

return session.peer_certificate

1395

list_size = ctypes.c_uint(1)

1396

cert_list = (gnutls.library.functions

1397

.gnutls_certificate_get_peers

1398

(session._c_object, ctypes.byref(list_size)))

1399

if not bool(cert_list) and list_size.value != 0:

1400

raise gnutls.errors.GNUTLSError("error getting peer"

1401

" certificate")

1402

if list_size.value == 0:

1403

return None

1404

cert = cert_list[0]

1405

return ctypes.string_at(cert.data, cert.size)

1406

1407

@staticmethod

1408

def fingerprint(openpgp):

1409

"Convert an OpenPGP bytestring to a hexdigit fingerprint"

1410

# New GnuTLS "datum" with the OpenPGP public key

1411

datum = (gnutls.library.types

1412

.gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),

1413

ctypes.POINTER

1414

(ctypes.c_ubyte)),

1415

ctypes.c_uint(len(openpgp))))

1416

# New empty GnuTLS certificate

1417

crt = gnutls.library.types.gnutls_openpgp_crt_t()

1418

(gnutls.library.functions

1419

.gnutls_openpgp_crt_init(ctypes.byref(crt)))

1420

# Import the OpenPGP public key into the certificate

1421

(gnutls.library.functions

1422

.gnutls_openpgp_crt_import(crt, ctypes.byref(datum),

1423

gnutls.library.constants

1424

.GNUTLS_OPENPGP_FMT_RAW))

1425

# Verify the self signature in the key

1426

crtverify = ctypes.c_uint()

1427

(gnutls.library.functions

1428

.gnutls_openpgp_crt_verify_self(crt, 0,

1429

ctypes.byref(crtverify)))

1430

if crtverify.value != 0:

1431

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1432

raise (gnutls.errors.CertificateSecurityError

1433

("Verify failed"))

1434

# New buffer for the fingerprint

1435

buf = ctypes.create_string_buffer(20)

1436

buf_len = ctypes.c_size_t()

1437

# Get the fingerprint from the certificate into the buffer

1438

(gnutls.library.functions

1439

.gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),

1440

ctypes.byref(buf_len)))

1441

# Deinit the certificate

1442

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1443

# Convert the buffer to a Python bytestring

1444

fpr = ctypes.string_at(buf, buf_len.value)

1445

# Convert the bytestring to hexadecimal notation

1446

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1447

return hex_fpr

1448

1449

1450

class MultiprocessingMixIn(object):

1451

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1452

def sub_process_main(self, request, address):

1453

try:

1454

self.finish_request(request, address)

1455

except:

1456

self.handle_error(request, address)

1457

self.close_request(request)

1458

1459

def process_request(self, request, address):

1460

"""Start a new process to process the request."""

1461

multiprocessing.Process(target = self.sub_process_main,

1462

args = (request, address)).start()

1463

1464

1465

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1466

""" adds a pipe to the MixIn """

1467

def process_request(self, request, client_address):

1468

"""Overrides and wraps the original process_request().

1469

1470

This function creates a new pipe in self.pipe

1471

"""

1472

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1473

1474

super(MultiprocessingMixInWithPipe,

1475

self).process_request(request, client_address)

1476

self.child_pipe.close()

1477

self.add_pipe(parent_pipe)

1478

1479

def add_pipe(self, parent_pipe):

1480

"""Dummy function; override as necessary"""

1481

raise NotImplementedError

1482

1483

1484

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1485

socketserver.TCPServer, object):

1486

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1487

1488

Attributes:

1489

enabled: Boolean; whether this server is activated yet

1490

interface: None or a network interface name (string)

1491

use_ipv6: Boolean; to use IPv6 or not

1492

"""

1493

def __init__(self, server_address, RequestHandlerClass,

1494

interface=None, use_ipv6=True):

1495

self.interface = interface

1496

if use_ipv6:

1497

self.address_family = socket.AF_INET6

1498

socketserver.TCPServer.__init__(self, server_address,

1499

RequestHandlerClass)

1500

def server_bind(self):

1501

"""This overrides the normal server_bind() function

1502

to bind to an interface if one was specified, and also NOT to

1503

bind to an address or port if they were not specified."""

1504

if self.interface is not None:

1505

if SO_BINDTODEVICE is None:

1506

logger.error("SO_BINDTODEVICE does not exist;"

1507

" cannot bind to interface %s",

1508

self.interface)

1509

else:

1510

try:

1511

self.socket.setsockopt(socket.SOL_SOCKET,

1512

SO_BINDTODEVICE,

1513

str(self.interface

1514

+ '\0'))

1515

except socket.error as error:

1516

if error[0] == errno.EPERM:

1517

logger.error("No permission to"

1518

" bind to interface %s",

1519

self.interface)

1520

elif error[0] == errno.ENOPROTOOPT:

1521

logger.error("SO_BINDTODEVICE not available;"

1522

" cannot bind to interface %s",

1523

self.interface)

1524

else:

1525

raise

1526

# Only bind(2) the socket if we really need to.

1527

if self.server_address[0] or self.server_address[1]:

1528

if not self.server_address[0]:

1529

if self.address_family == socket.AF_INET6:

1530

any_address = "::" # in6addr_any

1531

else:

1532

any_address = socket.INADDR_ANY

1533

self.server_address = (any_address,

1534

self.server_address[1])

1535

elif not self.server_address[1]:

1536

self.server_address = (self.server_address[0],

1537

0)

1538

# if self.interface:

1539

# self.server_address = (self.server_address[0],

1540

# 0, # port

1541

# 0, # flowinfo

1542

# if_nametoindex

1543

# (self.interface))

1544

return socketserver.TCPServer.server_bind(self)

1545

1546

1547

class MandosServer(IPv6_TCPServer):

1548

"""Mandos server.

1549

1550

Attributes:

1551

clients: set of Client objects

1552

gnutls_priority GnuTLS priority string

1553

use_dbus: Boolean; to emit D-Bus signals or not

1554

1555

Assumes a gobject.MainLoop event loop.

1556

"""

1557

def __init__(self, server_address, RequestHandlerClass,

1558

interface=None, use_ipv6=True, clients=None,

1559

gnutls_priority=None, use_dbus=True):

1560

self.enabled = False

1561

self.clients = clients

1562

if self.clients is None:

1563

self.clients = set()

1564

self.use_dbus = use_dbus

1565

self.gnutls_priority = gnutls_priority

1566

IPv6_TCPServer.__init__(self, server_address,

1567

RequestHandlerClass,

1568

interface = interface,

1569

use_ipv6 = use_ipv6)

1570

def server_activate(self):

1571

if self.enabled:

1572

return socketserver.TCPServer.server_activate(self)

1573

def enable(self):

1574

self.enabled = True

1575

def add_pipe(self, parent_pipe):

1576

# Call "handle_ipc" for both data and EOF events

1577

gobject.io_add_watch(parent_pipe.fileno(),

1578

gobject.IO_IN | gobject.IO_HUP,

1579

functools.partial(self.handle_ipc,

1580

parent_pipe = parent_pipe))

1581

1582

def handle_ipc(self, source, condition, parent_pipe=None,

1583

client_object=None):

1584

condition_names = {

1585

gobject.IO_IN: "IN", # There is data to read.

1586

gobject.IO_OUT: "OUT", # Data can be written (without

1587

# blocking).

1588

gobject.IO_PRI: "PRI", # There is urgent data to read.

1589

gobject.IO_ERR: "ERR", # Error condition.

1590

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1591

# broken, usually for pipes and

1592

# sockets).

1593

}

1594

conditions_string = ' | '.join(name

1595

for cond, name in

1596

condition_names.iteritems()

1597

if cond & condition)

1598

# error or the other end of multiprocessing.Pipe has closed

1599

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1600

return False

1601

1602

# Read a request from the child

1603

request = parent_pipe.recv()

1604

command = request[0]

1605

1606

if command == 'init':

1607

fpr = request[1]

1608

address = request[2]

1609

1610

for c in self.clients:

1611

if c.fingerprint == fpr:

1612

client = c

1613

break

1614

else:

1615

logger.info("Client not found for fingerprint: %s, ad"

1616

"dress: %s", fpr, address)

1617

if self.use_dbus:

1618

# Emit D-Bus signal

1619

mandos_dbus_service.ClientNotFound(fpr, address[0])

1620

parent_pipe.send(False)

1621

return False

1622

1623

gobject.io_add_watch(parent_pipe.fileno(),

1624

gobject.IO_IN | gobject.IO_HUP,

1625

functools.partial(self.handle_ipc,

1626

parent_pipe = parent_pipe,

1627

client_object = client))

1628

parent_pipe.send(True)

1629

# remove the old hook in favor of the new above hook on same fileno

1630

return False

1631

if command == 'funcall':

1632

funcname = request[1]

1633

args = request[2]

1634

kwargs = request[3]

1635

1636

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1637

1638

if command == 'getattr':

1639

attrname = request[1]

1640

if callable(client_object.__getattribute__(attrname)):

1641

parent_pipe.send(('function',))

1642

else:

1643

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1644

1645

if command == 'setattr':

1646

attrname = request[1]

1647

value = request[2]

1648

setattr(client_object, attrname, value)

1649

1650

return True

1651

1652

1653

def string_to_delta(interval):

1654

"""Parse a string and return a datetime.timedelta

1655

1656

>>> string_to_delta('7d')

1657

datetime.timedelta(7)

1658

>>> string_to_delta('60s')

1659

datetime.timedelta(0, 60)

1660

>>> string_to_delta('60m')

1661

datetime.timedelta(0, 3600)

1662

>>> string_to_delta('24h')

1663

datetime.timedelta(1)

1664

>>> string_to_delta('1w')

1665

datetime.timedelta(7)

1666

>>> string_to_delta('5m 30s')

1667

datetime.timedelta(0, 330)

1668

"""

1669

timevalue = datetime.timedelta(0)

1670

for s in interval.split():

1671

try:

1672

suffix = unicode(s[-1])

1673

value = int(s[:-1])

1674

if suffix == "d":

1675

delta = datetime.timedelta(value)

1676

elif suffix == "s":

1677

delta = datetime.timedelta(0, value)

1678

elif suffix == "m":

1679

delta = datetime.timedelta(0, 0, 0, 0, value)

1680

elif suffix == "h":

1681

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1682

elif suffix == "w":

1683

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1684

else:

1685

raise ValueError("Unknown suffix %r" % suffix)

1686

except (ValueError, IndexError) as e:

1687

raise ValueError(*(e.args))

1688

timevalue += delta

1689

return timevalue

1690

1691

1692

def if_nametoindex(interface):

1693

"""Call the C function if_nametoindex(), or equivalent

1694

1695

Note: This function cannot accept a unicode string."""

1696

global if_nametoindex

1697

try:

1698

if_nametoindex = (ctypes.cdll.LoadLibrary

1699

(ctypes.util.find_library("c"))

1700

.if_nametoindex)

1701

except (OSError, AttributeError):

1702

logger.warning("Doing if_nametoindex the hard way")

1703

def if_nametoindex(interface):

1704

"Get an interface index the hard way, i.e. using fcntl()"

1705

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1706

with contextlib.closing(socket.socket()) as s:

1707

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1708

struct.pack(str("16s16x"),

1709

interface))

1710

interface_index = struct.unpack(str("I"),

1711

ifreq[16:20])[0]

1712

return interface_index

1713

return if_nametoindex(interface)

1714

1715

1716

def daemon(nochdir = False, noclose = False):

1717

"""See daemon(3). Standard BSD Unix function.

1718

1719

This should really exist as os.daemon, but it doesn't (yet)."""

1720

if os.fork():

1721

sys.exit()

1722

os.setsid()

1723

if not nochdir:

1724

os.chdir("/")

1725

if os.fork():

1726

sys.exit()

1727

if not noclose:

1728

# Close all standard open file descriptors

1729

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1730

if not stat.S_ISCHR(os.fstat(null).st_mode):

1731

raise OSError(errno.ENODEV,

1732

"%s not a character device"

1733

% os.path.devnull)

1734

os.dup2(null, sys.stdin.fileno())

1735

os.dup2(null, sys.stdout.fileno())

1736

os.dup2(null, sys.stderr.fileno())

1737

if null > 2:

1738

os.close(null)

1739

1740

1741

def main():

1742

1743

##################################################################

1744

# Parsing of options, both command line and config file

1745

1746

parser = argparse.ArgumentParser()

1747

parser.add_argument("-v", "--version", action="version",

1748

version = "%%(prog)s %s" % version,

1749

help="show version number and exit")

1750

parser.add_argument("-i", "--interface", metavar="IF",

1751

help="Bind to interface IF")

1752

parser.add_argument("-a", "--address",

1753

help="Address to listen for requests on")

1754

parser.add_argument("-p", "--port", type=int,

1755

help="Port number to receive requests on")

1756

parser.add_argument("--check", action="store_true",

1757

help="Run self-test")

1758

parser.add_argument("--debug", action="store_true",

1759

help="Debug mode; run in foreground and log"

1760

" to terminal")

1761

parser.add_argument("--debuglevel", metavar="LEVEL",

1762

help="Debug level for stdout output")

1763

parser.add_argument("--priority", help="GnuTLS"

1764

" priority string (see GnuTLS documentation)")

1765

parser.add_argument("--servicename",

1766

metavar="NAME", help="Zeroconf service name")

1767

parser.add_argument("--configdir",

1768

default="/etc/mandos", metavar="DIR",

1769

help="Directory to search for configuration"

1770

" files")

1771

parser.add_argument("--no-dbus", action="store_false",

1772

dest="use_dbus", help="Do not provide D-Bus"

1773

" system bus interface")

1774

parser.add_argument("--no-ipv6", action="store_false",

1775

dest="use_ipv6", help="Do not use IPv6")

1776

options = parser.parse_args()

1777

1778

if options.check:

1779

import doctest

1780

doctest.testmod()

1781

sys.exit()

1782

1783

# Default values for config file for server-global settings

1784

server_defaults = { "interface": "",

1785

"address": "",

1786

"port": "",

1787

"debug": "False",

1788

"priority":

1789

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1790

"servicename": "Mandos",

1791

"use_dbus": "True",

1792

"use_ipv6": "True",

1793

"debuglevel": "",

1794

}

1795

1796

# Parse config file for server-global settings

1797

server_config = configparser.SafeConfigParser(server_defaults)

1798

del server_defaults

1799

server_config.read(os.path.join(options.configdir,

1800

"mandos.conf"))

1801

# Convert the SafeConfigParser object to a dict

1802

server_settings = server_config.defaults()

1803

# Use the appropriate methods on the non-string config options

1804

for option in ("debug", "use_dbus", "use_ipv6"):

1805

server_settings[option] = server_config.getboolean("DEFAULT",

1806

option)

1807

if server_settings["port"]:

1808

server_settings["port"] = server_config.getint("DEFAULT",

1809

"port")

1810

del server_config

1811

1812

# Override the settings from the config file with command line

1813

# options, if set.

1814

for option in ("interface", "address", "port", "debug",

1815

"priority", "servicename", "configdir",

1816

"use_dbus", "use_ipv6", "debuglevel"):

1817

value = getattr(options, option)

1818

if value is not None:

1819

server_settings[option] = value

1820

del options

1821

# Force all strings to be unicode

1822

for option in server_settings.keys():

1823

if type(server_settings[option]) is str:

1824

server_settings[option] = unicode(server_settings[option])

1825

# Now we have our good server settings in "server_settings"

1826

1827

##################################################################

1828

1829

# For convenience

1830

debug = server_settings["debug"]

1831

debuglevel = server_settings["debuglevel"]

1832

use_dbus = server_settings["use_dbus"]

1833

use_ipv6 = server_settings["use_ipv6"]

1834

1835

if server_settings["servicename"] != "Mandos":

1836

syslogger.setFormatter(logging.Formatter

1837

('Mandos (%s) [%%(process)d]:'

1838

' %%(levelname)s: %%(message)s'

1839

% server_settings["servicename"]))

1840

1841

# Parse config file with clients

1842

client_defaults = { "timeout": "5m",

1843

"extended_timeout": "15m",

1844

"interval": "2m",

1845

"checker": "fping -q -- %%(host)s",

1846

"host": "",

1847

"approval_delay": "0s",

1848

"approval_duration": "1s",

1849

}

1850

client_config = configparser.SafeConfigParser(client_defaults)

1851

client_config.read(os.path.join(server_settings["configdir"],

1852

"clients.conf"))

1853

1854

global mandos_dbus_service

1855

mandos_dbus_service = None

1856

1857

tcp_server = MandosServer((server_settings["address"],

1858

server_settings["port"]),

1859

ClientHandler,

1860

interface=(server_settings["interface"]

1861

or None),

1862

use_ipv6=use_ipv6,

1863

gnutls_priority=

1864

server_settings["priority"],

1865

use_dbus=use_dbus)

1866

if not debug:

1867

pidfilename = "/var/run/mandos.pid"

1868

try:

1869

pidfile = open(pidfilename, "w")

1870

except IOError:

1871

logger.error("Could not open file %r", pidfilename)

1872

1873

try:

1874

uid = pwd.getpwnam("_mandos").pw_uid

1875

gid = pwd.getpwnam("_mandos").pw_gid

1876

except KeyError:

1877

try:

1878

uid = pwd.getpwnam("mandos").pw_uid

1879

gid = pwd.getpwnam("mandos").pw_gid

1880

except KeyError:

1881

try:

1882

uid = pwd.getpwnam("nobody").pw_uid

1883

gid = pwd.getpwnam("nobody").pw_gid

1884

except KeyError:

1885

uid = 65534

1886

gid = 65534

1887

try:

1888

os.setgid(gid)

1889

os.setuid(uid)

1890

except OSError as error:

1891

if error[0] != errno.EPERM:

1892

raise error

1893

1894

if not debug and not debuglevel:

1895

syslogger.setLevel(logging.WARNING)

1896

console.setLevel(logging.WARNING)

1897

if debuglevel:

1898

level = getattr(logging, debuglevel.upper())

1899

syslogger.setLevel(level)

1900

console.setLevel(level)

1901

1902

if debug:

1903

# Enable all possible GnuTLS debugging

1904

1905

# "Use a log level over 10 to enable all debugging options."

1906

# - GnuTLS manual

1907

gnutls.library.functions.gnutls_global_set_log_level(11)

1908

1909

@gnutls.library.types.gnutls_log_func

1910

def debug_gnutls(level, string):

1911

logger.debug("GnuTLS: %s", string[:-1])

1912

1913

(gnutls.library.functions

1914

.gnutls_global_set_log_function(debug_gnutls))

1915

1916

# Redirect stdin so all checkers get /dev/null

1917

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1918

os.dup2(null, sys.stdin.fileno())

1919

if null > 2:

1920

os.close(null)

1921

else:

1922

# No console logging

1923

logger.removeHandler(console)

1924

1925

# Need to fork before connecting to D-Bus

1926

if not debug:

1927

# Close all input and output, do double fork, etc.

1928

daemon()

1929

1930

global main_loop

1931

# From the Avahi example code

1932

DBusGMainLoop(set_as_default=True )

1933

main_loop = gobject.MainLoop()

1934

bus = dbus.SystemBus()

1935

# End of Avahi example code

1936

if use_dbus:

1937

try:

1938

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1939

bus, do_not_queue=True)

1940

bus_name2 = dbus.service.BusName("se.recompile.Mandos",

1941

bus, do_not_queue=True)

1942

except dbus.exceptions.NameExistsException as e:

1943

logger.error(unicode(e) + ", disabling D-Bus")

1944

use_dbus = False

1945

server_settings["use_dbus"] = False

1946

tcp_server.use_dbus = False

1947

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1948

service = AvahiService(name = server_settings["servicename"],

1949

servicetype = "_mandos._tcp",

1950

protocol = protocol, bus = bus)

1951

if server_settings["interface"]:

1952

service.interface = (if_nametoindex

1953

(str(server_settings["interface"])))

1954

1955

global multiprocessing_manager

1956

multiprocessing_manager = multiprocessing.Manager()

1957

1958

client_class = Client

1959

if use_dbus:

1960

client_class = functools.partial(ClientDBusTransitional, bus = bus)

1961

def client_config_items(config, section):

1962

special_settings = {

1963

"approved_by_default":

1964

lambda: config.getboolean(section,

1965

"approved_by_default"),

1966

}

1967

for name, value in config.items(section):

1968

try:

1969

yield (name, special_settings[name]())

1970

except KeyError:

1971

yield (name, value)

1972

1973

tcp_server.clients.update(set(

1974

client_class(name = section,

1975

config= dict(client_config_items(

1976

client_config, section)))

1977

for section in client_config.sections()))

1978

if not tcp_server.clients:

1979

logger.warning("No clients defined")

1980

1981

if not debug:

1982

try:

1983

with pidfile:

1984

pid = os.getpid()

1985

pidfile.write(str(pid) + "\n".encode("utf-8"))

1986

del pidfile

1987

except IOError:

1988

logger.error("Could not write to file %r with PID %d",

1989

pidfilename, pid)

1990

except NameError:

1991

# "pidfile" was never created

1992

pass

1993

del pidfilename

1994

1995

signal.signal(signal.SIGINT, signal.SIG_IGN)

1996

1997

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1998

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1999

2000

if use_dbus:

2001

class MandosDBusService(dbus.service.Object):

2002

"""A D-Bus proxy object"""

2003

def __init__(self):

2004

dbus.service.Object.__init__(self, bus, "/")

2005

_interface = "se.bsnet.fukt.Mandos"

2006

2007

@dbus.service.signal(_interface, signature="o")

2008

def ClientAdded(self, objpath):

2009

"D-Bus signal"

2010

pass

2011

2012

@dbus.service.signal(_interface, signature="ss")

2013

def ClientNotFound(self, fingerprint, address):

2014

"D-Bus signal"

2015

pass

2016

2017

@dbus.service.signal(_interface, signature="os")

2018

def ClientRemoved(self, objpath, name):

2019

"D-Bus signal"

2020

pass

2021

2022

@dbus.service.method(_interface, out_signature="ao")

2023

def GetAllClients(self):

2024

"D-Bus method"

2025

return dbus.Array(c.dbus_object_path

2026

for c in tcp_server.clients)

2027

2028

@dbus.service.method(_interface,

2029

out_signature="a{oa{sv}}")

2030

def GetAllClientsWithProperties(self):

2031

"D-Bus method"

2032

return dbus.Dictionary(

2033

((c.dbus_object_path, c.GetAll(""))

2034

for c in tcp_server.clients),

2035

signature="oa{sv}")

2036

2037

@dbus.service.method(_interface, in_signature="o")

2038

def RemoveClient(self, object_path):

2039

"D-Bus method"

2040

for c in tcp_server.clients:

2041

if c.dbus_object_path == object_path:

2042

tcp_server.clients.remove(c)

2043

c.remove_from_connection()

2044

# Don't signal anything except ClientRemoved

2045

c.disable(quiet=True)

2046

# Emit D-Bus signal

2047

self.ClientRemoved(object_path, c.name)

2048

return

2049

raise KeyError(object_path)

2050

2051

del _interface

2052

2053

class MandosDBusServiceTransitional(MandosDBusService):

2054

__metaclass__ = transitional_dbus_metaclass

2055

mandos_dbus_service = MandosDBusServiceTransitional()

2056

2057

def cleanup():

2058

"Cleanup function; run on exit"

2059

service.cleanup()

2060

2061

while tcp_server.clients:

2062

client = tcp_server.clients.pop()

2063

if use_dbus:

2064

client.remove_from_connection()

2065

client.disable_hook = None

2066

# Don't signal anything except ClientRemoved

2067

client.disable(quiet=True)

2068

if use_dbus:

2069

# Emit D-Bus signal

2070

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2071

client.name)

2072

2073

atexit.register(cleanup)

2074

2075

for client in tcp_server.clients:

2076

if use_dbus:

2077

# Emit D-Bus signal

2078

mandos_dbus_service.ClientAdded(client.dbus_object_path)

2079

client.enable()

2080

2081

tcp_server.enable()

2082

tcp_server.server_activate()

2083

2084

# Find out what port we got

2085

service.port = tcp_server.socket.getsockname()[1]

2086

if use_ipv6:

2087

logger.info("Now listening on address %r, port %d,"

2088

" flowinfo %d, scope_id %d"

2089

% tcp_server.socket.getsockname())

2090

else: # IPv4

2091

logger.info("Now listening on address %r, port %d"

2092

% tcp_server.socket.getsockname())

2093

2094

#service.interface = tcp_server.socket.getsockname()[3]

2095

2096

try:

2097

# From the Avahi example code

2098

try:

2099

service.activate()

2100

except dbus.exceptions.DBusException as error:

2101

logger.critical("DBusException: %s", error)

2102

cleanup()

2103

sys.exit(1)

2104

# End of Avahi example code

2105

2106

gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,

2107

lambda *args, **kwargs:

2108

(tcp_server.handle_request

2109

(*args[2:], **kwargs) or True))

2110

2111

logger.debug("Starting main loop")

2112

main_loop.run()

2113

except AvahiError as error:

2114

logger.critical("AvahiError: %s", error)

2115

cleanup()

2116

sys.exit(1)

2117

except KeyboardInterrupt:

2118

if debug:

2119

print("", file=sys.stderr)

2120

logger.debug("Server received KeyboardInterrupt")

2121

logger.debug("Server exiting")

2122

# Must run before the D-Bus bus name gets deregistered

2123

cleanup()

2124

2125

2126

if __name__ == '__main__':

2127

main()