/mandos/trunk : revision 24.1.186

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

61

62

import functools

62

63

import cPickle as pickle

63

64

import multiprocessing

65

import types

64

66

65

67

import dbus

66

68

import dbus.service

81

83

SO_BINDTODEVICE = None

82

84

83

85

84

version = "1.0.14"

86

version = "1.3.1"

85

87

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

88

90

syslogger = (logging.handlers.SysLogHandler

89

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

90

address = "/dev/log"))

92

address = str("/dev/log")))

91

93

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

94

96

logger.addHandler(syslogger)

95

97

96

98

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

100

102

logger.addHandler(console)

101

103

102

104

class AvahiError(Exception):

119

121

Attributes:

120

122

interface: integer; avahi.IF_UNSPEC or an interface index.

121

123

Used to optionally bind to the specified interface.

122

123

type: string; Example: u'_mandos._tcp'.

124

125

type: string; Example: '_mandos._tcp'.

124

126

See <http://www.dns-sd.org/ServiceTypes.html>

125

127

port: integer; what port to announce

126

128

TXT: list of strings; TXT record for the service

135

137

"""

136

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

137

139

servicetype = None, port = None, TXT = None,

138

domain = u"", host = u"", max_renames = 32768,

140

domain = "", host = "", max_renames = 32768,

139

141

protocol = avahi.PROTO_UNSPEC, bus = None):

140

142

self.interface = interface

141

143

self.name = name

150

152

self.group = None # our entry group

151

153

self.server = None

152

154

self.bus = bus

155

self.entry_group_state_changed_match = None

153

156

def rename(self):

154

157

"""Derived from the Avahi example code"""

155

158

if self.rename_count >= self.max_renames:

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

158

161

self.rename_count)

159

raise AvahiServiceError(u"Too many renames")

162

raise AvahiServiceError("Too many renames")

160

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

164

logger.info("Changing Zeroconf service name to %r ...",

162

165

self.name)

163

166

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

166

169

% self.name))

167

170

self.remove()

168

171

try:

169

172

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

173

except dbus.exceptions.DBusException as error:

174

logger.critical("DBusException: %s", error)

172

175

self.cleanup()

173

176

os._exit(1)

174

177

self.rename_count += 1

175

178

def remove(self):

176

179

"""Derived from the Avahi example code"""

180

if self.entry_group_state_changed_match is not None:

181

self.entry_group_state_changed_match.remove()

182

self.entry_group_state_changed_match = None

177

183

if self.group is not None:

178

184

self.group.Reset()

179

185

def add(self):

180

186

"""Derived from the Avahi example code"""

187

self.remove()

181

188

if self.group is None:

182

189

self.group = dbus.Interface(

183

190

self.bus.get_object(avahi.DBUS_NAME,

184

191

self.server.EntryGroupNew()),

185

192

avahi.DBUS_INTERFACE_ENTRY_GROUP)

186

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

193

self.entry_group_state_changed_match = (

194

self.group.connect_to_signal(

195

'StateChanged', self .entry_group_state_changed))

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

190

197

self.name, self.type)

191

198

self.group.AddService(

192

199

self.interface,

199

206

self.group.Commit()

200

207

def entry_group_state_changed(self, state, error):

201

208

"""Derived from the Avahi example code"""

202

logger.debug(u"Avahi entry group state change: %i", state)

209

logger.debug("Avahi entry group state change: %i", state)

203

210

204

211

if state == avahi.ENTRY_GROUP_ESTABLISHED:

205

logger.debug(u"Zeroconf service established.")

212

logger.debug("Zeroconf service established.")

206

213

elif state == avahi.ENTRY_GROUP_COLLISION:

207

logger.warning(u"Zeroconf service name collision.")

214

logger.info("Zeroconf service name collision.")

208

215

self.rename()

209

216

elif state == avahi.ENTRY_GROUP_FAILURE:

210

logger.critical(u"Avahi: Error in group state changed %s",

217

logger.critical("Avahi: Error in group state changed %s",

211

218

unicode(error))

212

raise AvahiGroupError(u"State changed: %s"

219

raise AvahiGroupError("State changed: %s"

213

220

% unicode(error))

214

221

def cleanup(self):

215

222

"""Derived from the Avahi example code"""

216

223

if self.group is not None:

217

self.group.Free()

224

try:

225

self.group.Free()

226

except (dbus.exceptions.UnknownMethodException,

227

dbus.exceptions.DBusException) as e:

228

pass

218

229

self.group = None

219

def server_state_changed(self, state):

230

self.remove()

231

def server_state_changed(self, state, error=None):

220

232

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

222

if state == avahi.SERVER_COLLISION:

223

logger.error(u"Zeroconf server name collision")

224

self.remove()

233

logger.debug("Avahi server state change: %i", state)

234

bad_states = { avahi.SERVER_INVALID:

235

"Zeroconf server invalid",

236

avahi.SERVER_REGISTERING: None,

237

avahi.SERVER_COLLISION:

238

"Zeroconf server name collision",

239

avahi.SERVER_FAILURE:

240

"Zeroconf server failure" }

241

if state in bad_states:

242

if bad_states[state] is not None:

243

if error is None:

244

logger.error(bad_states[state])

245

else:

246

logger.error(bad_states[state] + ": %r", error)

247

self.cleanup()

225

248

elif state == avahi.SERVER_RUNNING:

226

249

self.add()

250

else:

251

if error is None:

252

logger.debug("Unknown state: %r", state)

253

else:

254

logger.debug("Unknown state: %r: %r", state, error)

227

255

def activate(self):

228

256

"""Derived from the Avahi example code"""

229

257

if self.server is None:

230

258

self.server = dbus.Interface(

231

259

self.bus.get_object(avahi.DBUS_NAME,

232

avahi.DBUS_PATH_SERVER),

260

avahi.DBUS_PATH_SERVER,

261

follow_name_owner_changes=True),

233

262

avahi.DBUS_INTERFACE_SERVER)

234

self.server.connect_to_signal(u"StateChanged",

263

self.server.connect_to_signal("StateChanged",

235

264

self.server_state_changed)

236

265

self.server_state_changed(self.server.GetState())

237

266

238

267

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

239

274

class Client(object):

240

275

"""A representation of a client host served by this server.

241

276

242

277

Attributes:

243

244

D-Bus identifiers

278

_approved: bool(); 'None' if not yet approved/disapproved

279

approval_delay: datetime.timedelta(); Time to wait for approval

280

approval_duration: datetime.timedelta(); Duration of one approval

281

checker: subprocess.Popen(); a running checker process used

282

to see if the client lives.

283

'None' if no process is running.

284

checker_callback_tag: a gobject event source tag, or None

285

checker_command: string; External command which is run to check

286

if client lives. %() expansions are done at

287

runtime with vars(self) as dict, so that for

288

instance %(name)s can be used in the command.

289

checker_initiator_tag: a gobject event source tag, or None

290

created: datetime.datetime(); (UTC) object creation

291

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

293

disable_initiator_tag: a gobject event source tag, or None

294

enabled: bool()

245

295

fingerprint: string (40 or 32 hexadecimal digits); used to

246

296

uniquely identify the client

247

secret: bytestring; sent verbatim (over TLS) to client

248

297

host: string; available for use by the checker command

249

created: datetime.datetime(); (UTC) object creation

298

interval: datetime.timedelta(); How often to start a new checker

299

last_approval_request: datetime.datetime(); (UTC) or None

300

last_checked_ok: datetime.datetime(); (UTC) or None

250

301

last_enabled: datetime.datetime(); (UTC)

251

enabled: bool()

252

last_checked_ok: datetime.datetime(); (UTC) or None

302

303

D-Bus identifiers

304

secret: bytestring; sent verbatim (over TLS) to client

253

305

timeout: datetime.timedelta(); How long from last_checked_ok

254

306

until this client is disabled

255

interval: datetime.timedelta(); How often to start a new checker

256

disable_hook: If set, called by disable() as disable_hook(self)

257

checker: subprocess.Popen(); a running checker process used

258

to see if the client lives.

259

'None' if no process is running.

260

checker_initiator_tag: a gobject event source tag, or None

261

disable_initiator_tag: - '' -

262

checker_callback_tag: - '' -

263

checker_command: string; External command which is run to check if

264

client lives. %() expansions are done at

265

runtime with vars(self) as dict, so that for

266

instance %(name)s can be used in the command.

267

current_checker_command: string; current running checker_command

268

approval_delay: datetime.timedelta(); Time to wait for approval

269

_approved: bool(); 'None' if not yet approved/disapproved

270

approval_duration: datetime.timedelta(); Duration of one approval

307

extended_timeout: extra long timeout when password has been sent

308

runtime_expansions: Allowed attributes for runtime expansion.

309

expires: datetime.datetime(); time (UTC) when a client will be

310

disabled, or None

271

311

"""

272

312

273

@staticmethod

274

def _timedelta_to_milliseconds(td):

275

"Convert a datetime.timedelta() to milliseconds"

276

return ((td.days * 24 * 60 * 60 * 1000)

277

+ (td.seconds * 1000)

278

+ (td.microseconds // 1000))

313

runtime_expansions = ("approval_delay", "approval_duration",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

316

"last_enabled", "name", "timeout")

279

317

280

318

def timeout_milliseconds(self):

281

319

"Return the 'timeout' attribute in milliseconds"

282

return self._timedelta_to_milliseconds(self.timeout)

320

return _timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

283

325

284

326

def interval_milliseconds(self):

285

327

"Return the 'interval' attribute in milliseconds"

286

return self._timedelta_to_milliseconds(self.interval)

287

328

return _timedelta_to_milliseconds(self.interval)

329

288

330

def approval_delay_milliseconds(self):

289

return self._timedelta_to_milliseconds(self.approval_delay)

331

return _timedelta_to_milliseconds(self.approval_delay)

290

332

291

333

def __init__(self, name = None, disable_hook=None, config=None):

292

334

"""Note: the 'checker' key in 'config' sets the

295

337

self.name = name

296

338

if config is None:

297

339

config = {}

298

logger.debug(u"Creating client %r", self.name)

340

logger.debug("Creating client %r", self.name)

299

341

# Uppercase and remove spaces from fingerprint for later

300

342

# comparison purposes with return value from the fingerprint()

301

343

# function

302

self.fingerprint = (config[u"fingerprint"].upper()

303

.replace(u" ", u""))

304

logger.debug(u" Fingerprint: %s", self.fingerprint)

305

if u"secret" in config:

306

self.secret = config[u"secret"].decode(u"base64")

307

elif u"secfile" in config:

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

308

350

with open(os.path.expanduser(os.path.expandvars

309

(config[u"secfile"])),

351

(config["secfile"])),

310

352

"rb") as secfile:

311

353

self.secret = secfile.read()

312

354

else:

313

raise TypeError(u"No secret or secfile for client %s"

355

raise TypeError("No secret or secfile for client %s"

314

356

% self.name)

315

self.host = config.get(u"host", u"")

357

self.host = config.get("host", "")

316

358

self.created = datetime.datetime.utcnow()

317

359

self.enabled = False

360

self.last_approval_request = None

318

361

self.last_enabled = None

319

362

self.last_checked_ok = None

320

self.timeout = string_to_delta(config[u"timeout"])

321

self.interval = string_to_delta(config[u"interval"])

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

322

366

self.disable_hook = disable_hook

323

367

self.checker = None

324

368

self.checker_initiator_tag = None

325

369

self.disable_initiator_tag = None

370

self.expires = None

326

371

self.checker_callback_tag = None

327

self.checker_command = config[u"checker"]

372

self.checker_command = config["checker"]

328

373

self.current_checker_command = None

329

374

self.last_connect = None

330

375

self._approved = None

331

self.approved_by_default = config.get(u"approved_by_default",

376

self.approved_by_default = config.get("approved_by_default",

332

377

True)

333

378

self.approvals_pending = 0

334

379

self.approval_delay = string_to_delta(

335

config[u"approval_delay"])

380

config["approval_delay"])

336

381

self.approval_duration = string_to_delta(

337

config[u"approval_duration"])

382

config["approval_duration"])

338

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

339

384

340

385

def send_changedstate(self):

344

389

345

390

def enable(self):

346

391

"""Start this client's checker and timeout hooks"""

347

if getattr(self, u"enabled", False):

392

if getattr(self, "enabled", False):

348

393

# Already enabled

349

394

return

350

395

self.send_changedstate()

351

self.last_enabled = datetime.datetime.utcnow()

352

396

# Schedule a new checker to be started an 'interval' from now,

353

397

# and every interval from then on.

354

398

self.checker_initiator_tag = (gobject.timeout_add

355

399

(self.interval_milliseconds(),

356

400

self.start_checker))

357

401

# Schedule a disable() when 'timeout' has passed

402

self.expires = datetime.datetime.utcnow() + self.timeout

358

403

self.disable_initiator_tag = (gobject.timeout_add

359

404

(self.timeout_milliseconds(),

360

405

self.disable))

361

406

self.enabled = True

407

self.last_enabled = datetime.datetime.utcnow()

362

408

# Also start a new checker *right now*.

363

409

self.start_checker()

364

410

369

415

if not quiet:

370

416

self.send_changedstate()

371

417

if not quiet:

372

logger.info(u"Disabling client %s", self.name)

373

if getattr(self, u"disable_initiator_tag", False):

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

374

420

gobject.source_remove(self.disable_initiator_tag)

375

421

self.disable_initiator_tag = None

376

if getattr(self, u"checker_initiator_tag", False):

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

377

424

gobject.source_remove(self.checker_initiator_tag)

378

425

self.checker_initiator_tag = None

379

426

self.stop_checker()

394

441

if os.WIFEXITED(condition):

395

442

exitstatus = os.WEXITSTATUS(condition)

396

443

if exitstatus == 0:

397

logger.info(u"Checker for %(name)s succeeded",

444

logger.info("Checker for %(name)s succeeded",

398

445

vars(self))

399

446

self.checked_ok()

400

447

else:

401

logger.info(u"Checker for %(name)s failed",

448

logger.info("Checker for %(name)s failed",

402

449

vars(self))

403

450

else:

404

logger.warning(u"Checker for %(name)s crashed?",

451

logger.warning("Checker for %(name)s crashed?",

405

452

vars(self))

406

453

407

def checked_ok(self):

454

def checked_ok(self, timeout=None):

408

455

"""Bump up the timeout for this client.

409

456

410

457

This should only be called when the client has been seen,

411

458

alive and well.

412

459

"""

460

if timeout is None:

461

timeout = self.timeout

413

462

self.last_checked_ok = datetime.datetime.utcnow()

414

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

415

465

self.disable_initiator_tag = (gobject.timeout_add

416

(self.timeout_milliseconds(),

466

(_timedelta_to_milliseconds(timeout),

417

467

self.disable))

418

468

469

def need_approval(self):

470

self.last_approval_request = datetime.datetime.utcnow()

471

419

472

def start_checker(self):

420

473

"""Start a new checker subprocess if one is not running.

421

474

433

486

# If a checker exists, make sure it is not a zombie

434

487

try:

435

488

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

436

except (AttributeError, OSError), error:

489

except (AttributeError, OSError) as error:

437

490

if (isinstance(error, OSError)

438

491

and error.errno != errno.ECHILD):

439

492

raise error

440

493

else:

441

494

if pid:

442

logger.warning(u"Checker was a zombie")

495

logger.warning("Checker was a zombie")

443

496

gobject.source_remove(self.checker_callback_tag)

444

497

self.checker_callback(pid, status,

445

498

self.current_checker_command)

450

503

command = self.checker_command % self.host

451

504

except TypeError:

452

505

# Escape attributes for the shell

453

escaped_attrs = dict((key,

454

re.escape(unicode(str(val),

455

errors=

456

u'replace')))

457

for key, val in

458

vars(self).iteritems())

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

459

514

try:

460

515

command = self.checker_command % escaped_attrs

461

except TypeError, error:

462

logger.error(u'Could not format string "%s":'

463

u' %s', self.checker_command, error)

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

464

519

return True # Try again later

465

520

self.current_checker_command = command

466

521

try:

467

logger.info(u"Starting checker %r for %s",

522

logger.info("Starting checker %r for %s",

468

523

command, self.name)

469

524

# We don't need to redirect stdout and stderr, since

470

525

# in normal mode, that is already done by daemon(),

472

527

# always replaced by /dev/null.)

473

528

self.checker = subprocess.Popen(command,

474

529

close_fds=True,

475

shell=True, cwd=u"/")

530

shell=True, cwd="/")

476

531

self.checker_callback_tag = (gobject.child_watch_add

477

532

(self.checker.pid,

478

533

self.checker_callback,

483

538

if pid:

484

539

gobject.source_remove(self.checker_callback_tag)

485

540

self.checker_callback(pid, status, command)

486

except OSError, error:

487

logger.error(u"Failed to start subprocess: %s",

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

488

543

error)

489

544

# Re-run this periodically if run by gobject.timeout_add

490

545

return True

494

549

if self.checker_callback_tag:

495

550

gobject.source_remove(self.checker_callback_tag)

496

551

self.checker_callback_tag = None

497

if getattr(self, u"checker", None) is None:

552

if getattr(self, "checker", None) is None:

498

553

return

499

logger.debug(u"Stopping checker for %(name)s", vars(self))

554

logger.debug("Stopping checker for %(name)s", vars(self))

500

555

try:

501

556

os.kill(self.checker.pid, signal.SIGTERM)

502

557

#time.sleep(0.5)

503

558

#if self.checker.poll() is None:

504

559

# os.kill(self.checker.pid, signal.SIGKILL)

505

except OSError, error:

560

except OSError as error:

506

561

if error.errno != errno.ESRCH: # No such process

507

562

raise

508

563

self.checker = None

509

564

510

def dbus_service_property(dbus_interface, signature=u"v",

511

access=u"readwrite", byte_arrays=False):

565

566

def dbus_service_property(dbus_interface, signature="v",

567

access="readwrite", byte_arrays=False):

512

568

"""Decorators for marking methods of a DBusObjectWithProperties to

513

569

become properties on the D-Bus.

514

570

521

577

"""

522

578

# Encoding deeply encoded byte arrays is not supported yet by the

523

579

# "Set" method, so we fail early here:

524

if byte_arrays and signature != u"ay":

525

raise ValueError(u"Byte arrays not supported for non-'ay'"

526

u" signature %r" % signature)

580

if byte_arrays and signature != "ay":

581

raise ValueError("Byte arrays not supported for non-'ay'"

582

" signature %r" % signature)

527

583

def decorator(func):

528

584

func._dbus_is_property = True

529

585

func._dbus_interface = dbus_interface

530

586

func._dbus_signature = signature

531

587

func._dbus_access = access

532

588

func._dbus_name = func.__name__

533

if func._dbus_name.endswith(u"_dbus_property"):

589

if func._dbus_name.endswith("_dbus_property"):

534

590

func._dbus_name = func._dbus_name[:-14]

535

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

591

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

536

592

return func

537

593

return decorator

538

594

558

614

559

615

class DBusObjectWithProperties(dbus.service.Object):

560

616

"""A D-Bus object with properties.

561

617

562

618

Classes inheriting from this can use the dbus_service_property

563

619

decorator to expose methods as D-Bus properties. It exposes the

564

620

standard Get(), Set(), and GetAll() methods on the D-Bus.

566

622

567

623

@staticmethod

568

624

def _is_dbus_property(obj):

569

return getattr(obj, u"_dbus_is_property", False)

625

return getattr(obj, "_dbus_is_property", False)

570

626

571

627

def _get_all_dbus_properties(self):

572

628

"""Returns a generator of (name, attribute) pairs

573

629

"""

574

return ((prop._dbus_name, prop)

575

for name, prop in

576

inspect.getmembers(self, self._is_dbus_property))

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

631

for cls in self.__class__.__mro__

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

577

633

578

634

def _get_dbus_property(self, interface_name, property_name):

579

635

"""Returns a bound method if one exists which is a D-Bus

580

636

property with the specified name and interface.

581

637

"""

582

for name in (property_name,

583

property_name + u"_dbus_property"):

584

prop = getattr(self, name, None)

585

if (prop is None

586

or not self._is_dbus_property(prop)

587

or prop._dbus_name != property_name

588

or (interface_name and prop._dbus_interface

589

and interface_name != prop._dbus_interface)):

590

continue

591

return prop

638

for cls in self.__class__.__mro__:

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

641

return value.__get__(self)

642

592

643

# No such property

593

raise DBusPropertyNotFound(self.dbus_object_path + u":"

594

+ interface_name + u"."

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

645

+ interface_name + "."

595

646

+ property_name)

647

596

648

597

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

598

out_signature=u"v")

649

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

650

out_signature="v")

599

651

def Get(self, interface_name, property_name):

600

652

"""Standard D-Bus property Get() method, see D-Bus standard.

601

653

"""

602

654

prop = self._get_dbus_property(interface_name, property_name)

603

if prop._dbus_access == u"write":

655

if prop._dbus_access == "write":

604

656

raise DBusPropertyAccessException(property_name)

605

657

value = prop()

606

if not hasattr(value, u"variant_level"):

658

if not hasattr(value, "variant_level"):

607

659

return value

608

660

return type(value)(value, variant_level=value.variant_level+1)

609

661

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

662

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

611

663

def Set(self, interface_name, property_name, value):

612

664

"""Standard D-Bus property Set() method, see D-Bus standard.

613

665

"""

614

666

prop = self._get_dbus_property(interface_name, property_name)

615

if prop._dbus_access == u"read":

667

if prop._dbus_access == "read":

616

668

raise DBusPropertyAccessException(property_name)

617

if prop._dbus_get_args_options[u"byte_arrays"]:

669

if prop._dbus_get_args_options["byte_arrays"]:

618

670

# The byte_arrays option is not supported yet on

619

671

# signatures other than "ay".

620

if prop._dbus_signature != u"ay":

672

if prop._dbus_signature != "ay":

621

673

raise ValueError

622

674

value = dbus.ByteArray(''.join(unichr(byte)

623

675

for byte in value))

624

676

prop(value)

625

677

626

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

627

out_signature=u"a{sv}")

678

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

679

out_signature="a{sv}")

628

680

def GetAll(self, interface_name):

629

681

"""Standard D-Bus property GetAll() method, see D-Bus

630

682

standard.

631

683

632

684

Note: Will not include properties with access="write".

633

685

"""

634

686

all = {}

638

690

# Interface non-empty but did not match

639

691

continue

640

692

# Ignore write-only properties

641

if prop._dbus_access == u"write":

693

if prop._dbus_access == "write":

642

694

continue

643

695

value = prop()

644

if not hasattr(value, u"variant_level"):

696

if not hasattr(value, "variant_level"):

645

697

all[name] = value

646

698

continue

647

699

all[name] = type(value)(value, variant_level=

648

700

value.variant_level+1)

649

return dbus.Dictionary(all, signature=u"sv")

701

return dbus.Dictionary(all, signature="sv")

650

702

651

703

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

652

out_signature=u"s",

704

out_signature="s",

653

705

path_keyword='object_path',

654

706

connection_keyword='connection')

655

707

def Introspect(self, object_path, connection):

660

712

try:

661

713

document = xml.dom.minidom.parseString(xmlstring)

662

714

def make_tag(document, name, prop):

663

e = document.createElement(u"property")

664

e.setAttribute(u"name", name)

665

e.setAttribute(u"type", prop._dbus_signature)

666

e.setAttribute(u"access", prop._dbus_access)

715

e = document.createElement("property")

716

e.setAttribute("name", name)

717

e.setAttribute("type", prop._dbus_signature)

718

e.setAttribute("access", prop._dbus_access)

667

719

return e

668

for if_tag in document.getElementsByTagName(u"interface"):

720

for if_tag in document.getElementsByTagName("interface"):

669

721

for tag in (make_tag(document, name, prop)

670

722

for name, prop

671

723

in self._get_all_dbus_properties()

672

724

if prop._dbus_interface

673

== if_tag.getAttribute(u"name")):

725

== if_tag.getAttribute("name")):

674

726

if_tag.appendChild(tag)

675

727

# Add the names to the return values for the

676

728

# "org.freedesktop.DBus.Properties" methods

677

if (if_tag.getAttribute(u"name")

678

== u"org.freedesktop.DBus.Properties"):

679

for cn in if_tag.getElementsByTagName(u"method"):

680

if cn.getAttribute(u"name") == u"Get":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"value")

685

elif cn.getAttribute(u"name") == u"GetAll":

686

for arg in cn.getElementsByTagName(u"arg"):

687

if (arg.getAttribute(u"direction")

688

== u"out"):

689

arg.setAttribute(u"name", u"props")

690

xmlstring = document.toxml(u"utf-8")

729

if (if_tag.getAttribute("name")

730

== "org.freedesktop.DBus.Properties"):

731

for cn in if_tag.getElementsByTagName("method"):

732

if cn.getAttribute("name") == "Get":

733

for arg in cn.getElementsByTagName("arg"):

734

if (arg.getAttribute("direction")

735

== "out"):

736

arg.setAttribute("name", "value")

737

elif cn.getAttribute("name") == "GetAll":

738

for arg in cn.getElementsByTagName("arg"):

739

if (arg.getAttribute("direction")

740

== "out"):

741

arg.setAttribute("name", "props")

742

xmlstring = document.toxml("utf-8")

691

743

document.unlink()

692

744

except (AttributeError, xml.dom.DOMException,

693

xml.parsers.expat.ExpatError), error:

694

logger.error(u"Failed to override Introspection method",

745

xml.parsers.expat.ExpatError) as error:

746

logger.error("Failed to override Introspection method",

695

747

error)

696

748

return xmlstring

697

749

698

750

751

def datetime_to_dbus (dt, variant_level=0):

752

"""Convert a UTC datetime.datetime() to a D-Bus type."""

753

if dt is None:

754

return dbus.String("", variant_level = variant_level)

755

return dbus.String(dt.isoformat(),

756

variant_level=variant_level)

757

758

class transitional_dbus_metaclass(DBusObjectWithProperties.__metaclass__):

759

def __new__(mcs, name, bases, attr):

760

for attrname, old_dbusobj in inspect.getmembers(bases[0]):

761

new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")

762

if (getattr(old_dbusobj, "_dbus_is_signal", False)

763

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

764

unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,

765

old_dbusobj.__closure__))["func"].cell_contents

766

newfunc = types.FunctionType(unwrappedfunc.func_code,

767

unwrappedfunc.func_globals,

768

unwrappedfunc.func_name,

769

unwrappedfunc.func_defaults,

770

unwrappedfunc.func_closure)

771

new_dbusfunc = dbus.service.signal(

772

new_interface, old_dbusobj._dbus_signature)(newfunc)

773

attr["_transitional_" + attrname] = new_dbusfunc

774

775

def fixscope(func1, func2):

776

def newcall(*args, **kwargs):

777

func1(*args, **kwargs)

778

func2(*args, **kwargs)

779

return newcall

780

781

attr[attrname] = fixscope(old_dbusobj, new_dbusfunc)

782

783

elif (getattr(old_dbusobj, "_dbus_is_method", False)

784

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

785

new_dbusfunc = (dbus.service.method

786

(new_interface,

787

old_dbusobj._dbus_in_signature,

788

old_dbusobj._dbus_out_signature)

789

(types.FunctionType

790

(old_dbusobj.func_code,

791

old_dbusobj.func_globals,

792

old_dbusobj.func_name,

793

old_dbusobj.func_defaults,

794

old_dbusobj.func_closure)))

795

796

attr[attrname] = new_dbusfunc

797

elif (getattr(old_dbusobj, "_dbus_is_property", False)

798

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

799

new_dbusfunc = (dbus_service_property

800

(new_interface,

801

old_dbusobj._dbus_signature,

802

old_dbusobj._dbus_access,

803

old_dbusobj._dbus_get_args_options["byte_arrays"])

804

(types.FunctionType

805

(old_dbusobj.func_code,

806

old_dbusobj.func_globals,

807

old_dbusobj.func_name,

808

old_dbusobj.func_defaults,

809

old_dbusobj.func_closure)))

810

811

attr[attrname] = new_dbusfunc

812

return type.__new__(mcs, name, bases, attr)

813

699

814

class ClientDBus(Client, DBusObjectWithProperties):

700

815

"""A Client class using D-Bus

701

816

703

818

dbus_object_path: dbus.ObjectPath

704

819

bus: dbus.SystemBus()

705

820

"""

821

822

runtime_expansions = (Client.runtime_expansions

823

+ ("dbus_object_path",))

824

706

825

# dbus.service.Object doesn't use super(), so we can't either.

707

826

708

827

def __init__(self, bus = None, *args, **kwargs):

711

830

Client.__init__(self, *args, **kwargs)

712

831

# Only now, when this client is initialized, can it show up on

713

832

# the D-Bus

833

client_object_name = unicode(self.name).translate(

834

{ord("."): ord("_"),

835

ord("-"): ord("_")})

714

836

self.dbus_object_path = (dbus.ObjectPath

715

(u"/clients/"

716

+ self.name.replace(u".", u"_")))

837

("/clients/" + client_object_name))

717

838

DBusObjectWithProperties.__init__(self, self.bus,

718

839

self.dbus_object_path)

719

840

720

def _get_approvals_pending(self):

721

return self._approvals_pending

722

def _set_approvals_pending(self, value):

723

old_value = self._approvals_pending

724

self._approvals_pending = value

725

bval = bool(value)

726

if (hasattr(self, "dbus_object_path")

727

and bval is not bool(old_value)):

728

dbus_bool = dbus.Boolean(bval, variant_level=1)

729

self.PropertyChanged(dbus.String(u"ApprovalPending"),

730

dbus_bool)

731

732

approvals_pending = property(_get_approvals_pending,

733

_set_approvals_pending)

734

del _get_approvals_pending, _set_approvals_pending

735

736

@staticmethod

737

def _datetime_to_dbus(dt, variant_level=0):

738

"""Convert a UTC datetime.datetime() to a D-Bus type."""

739

return dbus.String(dt.isoformat(),

740

variant_level=variant_level)

741

742

def enable(self):

743

oldstate = getattr(self, u"enabled", False)

744

r = Client.enable(self)

745

if oldstate != self.enabled:

746

# Emit D-Bus signals

747

self.PropertyChanged(dbus.String(u"Enabled"),

748

dbus.Boolean(True, variant_level=1))

749

self.PropertyChanged(

750

dbus.String(u"LastEnabled"),

751

self._datetime_to_dbus(self.last_enabled,

752

variant_level=1))

753

return r

754

755

def disable(self, quiet = False):

756

oldstate = getattr(self, u"enabled", False)

757

r = Client.disable(self, quiet=quiet)

758

if not quiet and oldstate != self.enabled:

759

# Emit D-Bus signal

760

self.PropertyChanged(dbus.String(u"Enabled"),

761

dbus.Boolean(False, variant_level=1))

762

return r

841

def notifychangeproperty(transform_func,

842

dbus_name, type_func=lambda x: x,

843

variant_level=1):

844

""" Modify a variable so that its a property that announce its

845

changes to DBus.

846

transform_fun: Function that takes a value and transform it to

847

DBus type.

848

dbus_name: DBus name of the variable

849

type_func: Function that transform the value before sending it

850

to DBus

851

variant_level: DBus variant level. default: 1

852

"""

853

real_value = [None,]

854

def setter(self, value):

855

old_value = real_value[0]

856

real_value[0] = value

857

if hasattr(self, "dbus_object_path"):

858

if type_func(old_value) != type_func(real_value[0]):

859

dbus_value = transform_func(type_func(real_value[0]),

860

variant_level)

861

self.PropertyChanged(dbus.String(dbus_name),

862

dbus_value)

863

864

return property(lambda self: real_value[0], setter)

865

866

867

expires = notifychangeproperty(datetime_to_dbus, "Expires")

868

approvals_pending = notifychangeproperty(dbus.Boolean,

869

"ApprovalPending",

870

type_func = bool)

871

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

872

last_enabled = notifychangeproperty(datetime_to_dbus,

873

"LastEnabled")

874

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

875

type_func = lambda checker: checker is not None)

876

last_checked_ok = notifychangeproperty(datetime_to_dbus,

877

"LastCheckedOK")

878

last_approval_request = notifychangeproperty(datetime_to_dbus,

879

"LastApprovalRequest")

880

approved_by_default = notifychangeproperty(dbus.Boolean,

881

"ApprovedByDefault")

882

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

883

type_func = _timedelta_to_milliseconds)

884

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

885

type_func = _timedelta_to_milliseconds)

886

host = notifychangeproperty(dbus.String, "Host")

887

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

888

type_func = _timedelta_to_milliseconds)

889

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

890

type_func = _timedelta_to_milliseconds)

891

interval = notifychangeproperty(dbus.UInt16, "Interval",

892

type_func = _timedelta_to_milliseconds)

893

checker_command = notifychangeproperty(dbus.String, "Checker")

894

895

del notifychangeproperty

763

896

764

897

def __del__(self, *args, **kwargs):

765

898

try:

766

899

self.remove_from_connection()

767

900

except LookupError:

768

901

pass

769

if hasattr(DBusObjectWithProperties, u"__del__"):

902

if hasattr(DBusObjectWithProperties, "__del__"):

770

903

DBusObjectWithProperties.__del__(self, *args, **kwargs)

771

904

Client.__del__(self, *args, **kwargs)

772

905

774

907

*args, **kwargs):

775

908

self.checker_callback_tag = None

776

909

self.checker = None

777

# Emit D-Bus signal

778

self.PropertyChanged(dbus.String(u"CheckerRunning"),

779

dbus.Boolean(False, variant_level=1))

780

910

if os.WIFEXITED(condition):

781

911

exitstatus = os.WEXITSTATUS(condition)

782

912

# Emit D-Bus signal

792

922

return Client.checker_callback(self, pid, condition, command,

793

923

*args, **kwargs)

794

924

795

def checked_ok(self, *args, **kwargs):

796

r = Client.checked_ok(self, *args, **kwargs)

797

# Emit D-Bus signal

798

self.PropertyChanged(

799

dbus.String(u"LastCheckedOK"),

800

(self._datetime_to_dbus(self.last_checked_ok,

801

variant_level=1)))

802

return r

803

804

925

def start_checker(self, *args, **kwargs):

805

926

old_checker = self.checker

806

927

if self.checker is not None:

813

934

and old_checker_pid != self.checker.pid):

814

935

# Emit D-Bus signal

815

936

self.CheckerStarted(self.current_checker_command)

816

self.PropertyChanged(

817

dbus.String(u"CheckerRunning"),

818

dbus.Boolean(True, variant_level=1))

819

937

return r

820

938

821

def stop_checker(self, *args, **kwargs):

822

old_checker = getattr(self, u"checker", None)

823

r = Client.stop_checker(self, *args, **kwargs)

824

if (old_checker is not None

825

and getattr(self, u"checker", None) is None):

826

self.PropertyChanged(dbus.String(u"CheckerRunning"),

827

dbus.Boolean(False, variant_level=1))

828

return r

829

830

939

def _reset_approved(self):

831

940

self._approved = None

832

941

return False

834

943

def approve(self, value=True):

835

944

self.send_changedstate()

836

945

self._approved = value

837

gobject.timeout_add(self._timedelta_to_milliseconds

946

gobject.timeout_add(_timedelta_to_milliseconds

838

947

(self.approval_duration),

839

948

self._reset_approved)

840

949

841

950

842

951

## D-Bus methods, signals & properties

843

_interface = u"se.bsnet.fukt.Mandos.Client"

844

952

_interface = "se.bsnet.fukt.Mandos.Client"

953

845

954

## Signals

846

955

847

956

# CheckerCompleted - signal

848

@dbus.service.signal(_interface, signature=u"nxs")

957

@dbus.service.signal(_interface, signature="nxs")

849

958

def CheckerCompleted(self, exitcode, waitstatus, command):

850

959

"D-Bus signal"

851

960

pass

852

961

853

962

# CheckerStarted - signal

854

@dbus.service.signal(_interface, signature=u"s")

963

@dbus.service.signal(_interface, signature="s")

855

964

def CheckerStarted(self, command):

856

965

"D-Bus signal"

857

966

pass

858

967

859

968

# PropertyChanged - signal

860

@dbus.service.signal(_interface, signature=u"sv")

969

@dbus.service.signal(_interface, signature="sv")

861

970

def PropertyChanged(self, property, value):

862

971

"D-Bus signal"

863

972

pass

872

981

pass

873

982

874

983

# Rejected - signal

875

@dbus.service.signal(_interface, signature=u"s")

984

@dbus.service.signal(_interface, signature="s")

876

985

def Rejected(self, reason):

877

986

"D-Bus signal"

878

987

pass

879

988

880

989

# NeedApproval - signal

881

@dbus.service.signal(_interface, signature=u"tb")

990

@dbus.service.signal(_interface, signature="tb")

882

991

def NeedApproval(self, timeout, default):

883

992

"D-Bus signal"

884

pass

993

return self.need_approval()

885

994

886

995

## Methods

887

996

888

997

# Approve - method

889

@dbus.service.method(_interface, in_signature=u"b")

998

@dbus.service.method(_interface, in_signature="b")

890

999

def Approve(self, value):

891

1000

self.approve(value)

892

1001

893

1002

# CheckedOK - method

894

1003

@dbus.service.method(_interface)

895

1004

def CheckedOK(self):

896

return self.checked_ok()

1005

self.checked_ok()

897

1006

898

1007

# Enable - method

899

1008

@dbus.service.method(_interface)

921

1030

## Properties

922

1031

923

1032

# ApprovalPending - property

924

@dbus_service_property(_interface, signature=u"b", access=u"read")

1033

@dbus_service_property(_interface, signature="b", access="read")

925

1034

def ApprovalPending_dbus_property(self):

926

1035

return dbus.Boolean(bool(self.approvals_pending))

927

1036

928

1037

# ApprovedByDefault - property

929

@dbus_service_property(_interface, signature=u"b",

930

access=u"readwrite")

1038

@dbus_service_property(_interface, signature="b",

1039

access="readwrite")

931

1040

def ApprovedByDefault_dbus_property(self, value=None):

932

1041

if value is None: # get

933

1042

return dbus.Boolean(self.approved_by_default)

934

1043

self.approved_by_default = bool(value)

935

# Emit D-Bus signal

936

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

937

dbus.Boolean(value, variant_level=1))

938

1044

939

1045

# ApprovalDelay - property

940

@dbus_service_property(_interface, signature=u"t",

941

access=u"readwrite")

1046

@dbus_service_property(_interface, signature="t",

1047

access="readwrite")

942

1048

def ApprovalDelay_dbus_property(self, value=None):

943

1049

if value is None: # get

944

1050

return dbus.UInt64(self.approval_delay_milliseconds())

945

1051

self.approval_delay = datetime.timedelta(0, 0, 0, value)

946

# Emit D-Bus signal

947

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

948

dbus.UInt64(value, variant_level=1))

949

1052

950

1053

# ApprovalDuration - property

951

@dbus_service_property(_interface, signature=u"t",

952

access=u"readwrite")

1054

@dbus_service_property(_interface, signature="t",

1055

access="readwrite")

953

1056

def ApprovalDuration_dbus_property(self, value=None):

954

1057

if value is None: # get

955

return dbus.UInt64(self._timedelta_to_milliseconds(

1058

return dbus.UInt64(_timedelta_to_milliseconds(

956

1059

self.approval_duration))

957

1060

self.approval_duration = datetime.timedelta(0, 0, 0, value)

958

# Emit D-Bus signal

959

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

960

dbus.UInt64(value, variant_level=1))

961

1061

962

1062

# Name - property

963

@dbus_service_property(_interface, signature=u"s", access=u"read")

1063

@dbus_service_property(_interface, signature="s", access="read")

964

1064

def Name_dbus_property(self):

965

1065

return dbus.String(self.name)

966

1066

967

1067

# Fingerprint - property

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

1068

@dbus_service_property(_interface, signature="s", access="read")

969

1069

def Fingerprint_dbus_property(self):

970

1070

return dbus.String(self.fingerprint)

971

1071

972

1072

# Host - property

973

@dbus_service_property(_interface, signature=u"s",

974

access=u"readwrite")

1073

@dbus_service_property(_interface, signature="s",

1074

access="readwrite")

975

1075

def Host_dbus_property(self, value=None):

976

1076

if value is None: # get

977

1077

return dbus.String(self.host)

978

1078

self.host = value

979

# Emit D-Bus signal

980

self.PropertyChanged(dbus.String(u"Host"),

981

dbus.String(value, variant_level=1))

982

1079

983

1080

# Created - property

984

@dbus_service_property(_interface, signature=u"s", access=u"read")

1081

@dbus_service_property(_interface, signature="s", access="read")

985

1082

def Created_dbus_property(self):

986

return dbus.String(self._datetime_to_dbus(self.created))

1083

return dbus.String(datetime_to_dbus(self.created))

987

1084

988

1085

# LastEnabled - property

989

@dbus_service_property(_interface, signature=u"s", access=u"read")

1086

@dbus_service_property(_interface, signature="s", access="read")

990

1087

def LastEnabled_dbus_property(self):

991

if self.last_enabled is None:

992

return dbus.String(u"")

993

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1088

return datetime_to_dbus(self.last_enabled)

994

1089

995

1090

# Enabled - property

996

@dbus_service_property(_interface, signature=u"b",

997

access=u"readwrite")

1091

@dbus_service_property(_interface, signature="b",

1092

access="readwrite")

998

1093

def Enabled_dbus_property(self, value=None):

999

1094

if value is None: # get

1000

1095

return dbus.Boolean(self.enabled)

1004

1099

self.disable()

1005

1100

1006

1101

# LastCheckedOK - property

1007

@dbus_service_property(_interface, signature=u"s",

1008

access=u"readwrite")

1102

@dbus_service_property(_interface, signature="s",

1103

access="readwrite")

1009

1104

def LastCheckedOK_dbus_property(self, value=None):

1010

1105

if value is not None:

1011

1106

self.checked_ok()

1012

1107

return

1013

if self.last_checked_ok is None:

1014

return dbus.String(u"")

1015

return dbus.String(self._datetime_to_dbus(self

1016

.last_checked_ok))

1108

return datetime_to_dbus(self.last_checked_ok)

1109

1110

# Expires - property

1111

@dbus_service_property(_interface, signature="s", access="read")

1112

def Expires_dbus_property(self):

1113

return datetime_to_dbus(self.expires)

1114

1115

# LastApprovalRequest - property

1116

@dbus_service_property(_interface, signature="s", access="read")

1117

def LastApprovalRequest_dbus_property(self):

1118

return datetime_to_dbus(self.last_approval_request)

1017

1119

1018

1120

# Timeout - property

1019

@dbus_service_property(_interface, signature=u"t",

1020

access=u"readwrite")

1121

@dbus_service_property(_interface, signature="t",

1122

access="readwrite")

1021

1123

def Timeout_dbus_property(self, value=None):

1022

1124

if value is None: # get

1023

1125

return dbus.UInt64(self.timeout_milliseconds())

1024

1126

self.timeout = datetime.timedelta(0, 0, 0, value)

1025

# Emit D-Bus signal

1026

self.PropertyChanged(dbus.String(u"Timeout"),

1027

dbus.UInt64(value, variant_level=1))

1028

if getattr(self, u"disable_initiator_tag", None) is None:

1127

if getattr(self, "disable_initiator_tag", None) is None:

1029

1128

return

1030

1129

# Reschedule timeout

1031

1130

gobject.source_remove(self.disable_initiator_tag)

1032

1131

self.disable_initiator_tag = None

1132

self.expires = None

1033

1133

time_to_die = (self.

1034

1134

_timedelta_to_milliseconds((self

1035

1135

.last_checked_ok

1040

1140

# The timeout has passed

1041

1141

self.disable()

1042

1142

else:

1143

self.expires = (datetime.datetime.utcnow()

1144

+ datetime.timedelta(milliseconds = time_to_die))

1043

1145

self.disable_initiator_tag = (gobject.timeout_add

1044

1146

(time_to_die, self.disable))

1045

1147

1148

# ExtendedTimeout - property

1149

@dbus_service_property(_interface, signature="t",

1150

access="readwrite")

1151

def ExtendedTimeout_dbus_property(self, value=None):

1152

if value is None: # get

1153

return dbus.UInt64(self.extended_timeout_milliseconds())

1154

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1155

1046

1156

# Interval - property

1047

@dbus_service_property(_interface, signature=u"t",

1048

access=u"readwrite")

1157

@dbus_service_property(_interface, signature="t",

1158

access="readwrite")

1049

1159

def Interval_dbus_property(self, value=None):

1050

1160

if value is None: # get

1051

1161

return dbus.UInt64(self.interval_milliseconds())

1052

1162

self.interval = datetime.timedelta(0, 0, 0, value)

1053

# Emit D-Bus signal

1054

self.PropertyChanged(dbus.String(u"Interval"),

1055

dbus.UInt64(value, variant_level=1))

1056

if getattr(self, u"checker_initiator_tag", None) is None:

1163

if getattr(self, "checker_initiator_tag", None) is None:

1057

1164

return

1058

1165

# Reschedule checker run

1059

1166

gobject.source_remove(self.checker_initiator_tag)

1060

1167

self.checker_initiator_tag = (gobject.timeout_add

1061

1168

(value, self.start_checker))

1062

1169

self.start_checker() # Start one now, too

1063

1170

1064

1171

# Checker - property

1065

@dbus_service_property(_interface, signature=u"s",

1066

access=u"readwrite")

1172

@dbus_service_property(_interface, signature="s",

1173

access="readwrite")

1067

1174

def Checker_dbus_property(self, value=None):

1068

1175

if value is None: # get

1069

1176

return dbus.String(self.checker_command)

1070

1177

self.checker_command = value

1071

# Emit D-Bus signal

1072

self.PropertyChanged(dbus.String(u"Checker"),

1073

dbus.String(self.checker_command,

1074

variant_level=1))

1075

1178

1076

1179

# CheckerRunning - property

1077

@dbus_service_property(_interface, signature=u"b",

1078

access=u"readwrite")

1180

@dbus_service_property(_interface, signature="b",

1181

access="readwrite")

1079

1182

def CheckerRunning_dbus_property(self, value=None):

1080

1183

if value is None: # get

1081

1184

return dbus.Boolean(self.checker is not None)

1085

1188

self.stop_checker()

1086

1189

1087

1190

# ObjectPath - property

1088

@dbus_service_property(_interface, signature=u"o", access=u"read")

1191

@dbus_service_property(_interface, signature="o", access="read")

1089

1192

def ObjectPath_dbus_property(self):

1090

1193

return self.dbus_object_path # is already a dbus.ObjectPath

1091

1194

1092

1195

# Secret = property

1093

@dbus_service_property(_interface, signature=u"ay",

1094

access=u"write", byte_arrays=True)

1196

@dbus_service_property(_interface, signature="ay",

1197

access="write", byte_arrays=True)

1095

1198

def Secret_dbus_property(self, value):

1096

1199

self.secret = str(value)

1097

1200

1104

1207

self._pipe.send(('init', fpr, address))

1105

1208

if not self._pipe.recv():

1106

1209

raise KeyError()

1107

1210

1108

1211

def __getattribute__(self, name):

1109

1212

if(name == '_pipe'):

1110

1213

return super(ProxyClient, self).__getattribute__(name)

1117

1220

self._pipe.send(('funcall', name, args, kwargs))

1118

1221

return self._pipe.recv()[1]

1119

1222

return func

1120

1223

1121

1224

def __setattr__(self, name, value):

1122

1225

if(name == '_pipe'):

1123

1226

return super(ProxyClient, self).__setattr__(name, value)

1124

1227

self._pipe.send(('setattr', name, value))

1125

1228

1229

class ClientDBusTransitional(ClientDBus):

1230

__metaclass__ = transitional_dbus_metaclass

1126

1231

1127

1232

class ClientHandler(socketserver.BaseRequestHandler, object):

1128

1233

"""A class to handle client connections.

1132

1237

1133

1238

def handle(self):

1134

1239

with contextlib.closing(self.server.child_pipe) as child_pipe:

1135

logger.info(u"TCP connection from: %s",

1240

logger.info("TCP connection from: %s",

1136

1241

unicode(self.client_address))

1137

logger.debug(u"Pipe FD: %d",

1242

logger.debug("Pipe FD: %d",

1138

1243

self.server.child_pipe.fileno())

1139

1244

1140

1245

session = (gnutls.connection

1141

1246

.ClientSession(self.request,

1142

1247

gnutls.connection

1143

1248

.X509Credentials()))

1144

1249

1145

1250

# Note: gnutls.connection.X509Credentials is really a

1146

1251

# generic GnuTLS certificate credentials object so long as

1147

1252

# no X.509 keys are added to it. Therefore, we can use it

1148

1253

# here despite using OpenPGP certificates.

1149

1150

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1151

# u"+AES-256-CBC", u"+SHA1",

1152

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1153

# u"+DHE-DSS"))

1254

1255

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1256

# "+AES-256-CBC", "+SHA1",

1257

# "+COMP-NULL", "+CTYPE-OPENPGP",

1258

# "+DHE-DSS"))

1154

1259

# Use a fallback default, since this MUST be set.

1155

1260

priority = self.server.gnutls_priority

1156

1261

if priority is None:

1157

priority = u"NORMAL"

1262

priority = "NORMAL"

1158

1263

(gnutls.library.functions

1159

1264

.gnutls_priority_set_direct(session._c_object,

1160

1265

priority, None))

1161

1266

1162

1267

# Start communication using the Mandos protocol

1163

1268

# Get protocol number

1164

1269

line = self.request.makefile().readline()

1165

logger.debug(u"Protocol version: %r", line)

1270

logger.debug("Protocol version: %r", line)

1166

1271

try:

1167

1272

if int(line.strip().split()[0]) > 1:

1168

1273

raise RuntimeError

1169

except (ValueError, IndexError, RuntimeError), error:

1170

logger.error(u"Unknown protocol version: %s", error)

1274

except (ValueError, IndexError, RuntimeError) as error:

1275

logger.error("Unknown protocol version: %s", error)

1171

1276

return

1172

1277

1173

1278

# Start GnuTLS connection

1174

1279

try:

1175

1280

session.handshake()

1176

except gnutls.errors.GNUTLSError, error:

1177

logger.warning(u"Handshake failed: %s", error)

1281

except gnutls.errors.GNUTLSError as error:

1282

logger.warning("Handshake failed: %s", error)

1178

1283

# Do not run session.bye() here: the session is not

1179

1284

# established. Just abandon the request.

1180

1285

return

1181

logger.debug(u"Handshake succeeded")

1182

1286

logger.debug("Handshake succeeded")

1287

1183

1288

approval_required = False

1184

1289

try:

1185

1290

try:

1186

1291

fpr = self.fingerprint(self.peer_certificate

1187

1292

(session))

1188

except (TypeError, gnutls.errors.GNUTLSError), error:

1189

logger.warning(u"Bad certificate: %s", error)

1293

except (TypeError,

1294

gnutls.errors.GNUTLSError) as error:

1295

logger.warning("Bad certificate: %s", error)

1190

1296

return

1191

logger.debug(u"Fingerprint: %s", fpr)

1192

1297

logger.debug("Fingerprint: %s", fpr)

1298

1193

1299

try:

1194

1300

client = ProxyClient(child_pipe, fpr,

1195

1301

self.client_address)

1203

1309

1204

1310

while True:

1205

1311

if not client.enabled:

1206

logger.warning(u"Client %s is disabled",

1312

logger.info("Client %s is disabled",

1207

1313

client.name)

1208

1314

if self.server.use_dbus:

1209

1315

# Emit D-Bus signal

1214

1320

#We are approved or approval is disabled

1215

1321

break

1216

1322

elif client._approved is None:

1217

logger.info(u"Client %s needs approval",

1323

logger.info("Client %s needs approval",

1218

1324

client.name)

1219

1325

if self.server.use_dbus:

1220

1326

# Emit D-Bus signal

1222

1328

client.approval_delay_milliseconds(),

1223

1329

client.approved_by_default)

1224

1330

else:

1225

logger.warning(u"Client %s was not approved",

1331

logger.warning("Client %s was not approved",

1226

1332

client.name)

1227

1333

if self.server.use_dbus:

1228

1334

# Emit D-Bus signal

1254

1360

while sent_size < len(client.secret):

1255

1361

try:

1256

1362

sent = session.send(client.secret[sent_size:])

1257

except (gnutls.errors.GNUTLSError), error:

1363

except gnutls.errors.GNUTLSError as error:

1258

1364

logger.warning("gnutls send failed")

1259

1365

return

1260

logger.debug(u"Sent: %d, remaining: %d",

1366

logger.debug("Sent: %d, remaining: %d",

1261

1367

sent, len(client.secret)

1262

1368

- (sent_size + sent))

1263

1369

sent_size += sent

1264

1265

logger.info(u"Sending secret to %s", client.name)

1370

1371

logger.info("Sending secret to %s", client.name)

1266

1372

# bump the timeout as if seen

1267

client.checked_ok()

1373

client.checked_ok(client.extended_timeout)

1268

1374

if self.server.use_dbus:

1269

1375

# Emit D-Bus signal

1270

1376

client.GotSecret()

1274

1380

client.approvals_pending -= 1

1275

1381

try:

1276

1382

session.bye()

1277

except (gnutls.errors.GNUTLSError), error:

1383

except gnutls.errors.GNUTLSError as error:

1278

1384

logger.warning("GnuTLS bye failed")

1279

1385

1280

1386

@staticmethod

1291

1397

.gnutls_certificate_get_peers

1292

1398

(session._c_object, ctypes.byref(list_size)))

1293

1399

if not bool(cert_list) and list_size.value != 0:

1294

raise gnutls.errors.GNUTLSError(u"error getting peer"

1295

u" certificate")

1400

raise gnutls.errors.GNUTLSError("error getting peer"

1401

" certificate")

1296

1402

if list_size.value == 0:

1297

1403

return None

1298

1404

cert = cert_list[0]

1324

1430

if crtverify.value != 0:

1325

1431

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1326

1432

raise (gnutls.errors.CertificateSecurityError

1327

(u"Verify failed"))

1433

("Verify failed"))

1328

1434

# New buffer for the fingerprint

1329

1435

buf = ctypes.create_string_buffer(20)

1330

1436

buf_len = ctypes.c_size_t()

1337

1443

# Convert the buffer to a Python bytestring

1338

1444

fpr = ctypes.string_at(buf, buf_len.value)

1339

1445

# Convert the bytestring to hexadecimal notation

1340

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1446

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1341

1447

return hex_fpr

1342

1448

1343

1449

1355

1461

multiprocessing.Process(target = self.sub_process_main,

1356

1462

args = (request, address)).start()

1357

1463

1464

1358

1465

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1359

1466

""" adds a pipe to the MixIn """

1360

1467

def process_request(self, request, client_address):

1363

1470

This function creates a new pipe in self.pipe

1364

1471

"""

1365

1472

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1366

1473

1367

1474

super(MultiprocessingMixInWithPipe,

1368

1475

self).process_request(request, client_address)

1369

1476

self.child_pipe.close()

1370

1477

self.add_pipe(parent_pipe)

1371

1478

1372

1479

def add_pipe(self, parent_pipe):

1373

1480

"""Dummy function; override as necessary"""

1374

pass

1481

raise NotImplementedError

1482

1375

1483

1376

1484

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1377

1485

socketserver.TCPServer, object):

1395

1503

bind to an address or port if they were not specified."""

1396

1504

if self.interface is not None:

1397

1505

if SO_BINDTODEVICE is None:

1398

logger.error(u"SO_BINDTODEVICE does not exist;"

1399

u" cannot bind to interface %s",

1506

logger.error("SO_BINDTODEVICE does not exist;"

1507

" cannot bind to interface %s",

1400

1508

self.interface)

1401

1509

else:

1402

1510

try:

1403

1511

self.socket.setsockopt(socket.SOL_SOCKET,

1404

1512

SO_BINDTODEVICE,

1405

1513

str(self.interface

1406

+ u'\0'))

1407

except socket.error, error:

1514

+ '\0'))

1515

except socket.error as error:

1408

1516

if error[0] == errno.EPERM:

1409

logger.error(u"No permission to"

1410

u" bind to interface %s",

1517

logger.error("No permission to"

1518

" bind to interface %s",

1411

1519

self.interface)

1412

1520

elif error[0] == errno.ENOPROTOOPT:

1413

logger.error(u"SO_BINDTODEVICE not available;"

1414

u" cannot bind to interface %s",

1521

logger.error("SO_BINDTODEVICE not available;"

1522

" cannot bind to interface %s",

1415

1523

self.interface)

1416

1524

else:

1417

1525

raise

1419

1527

if self.server_address[0] or self.server_address[1]:

1420

1528

if not self.server_address[0]:

1421

1529

if self.address_family == socket.AF_INET6:

1422

any_address = u"::" # in6addr_any

1530

any_address = "::" # in6addr_any

1423

1531

else:

1424

1532

any_address = socket.INADDR_ANY

1425

1533

self.server_address = (any_address,

1474

1582

def handle_ipc(self, source, condition, parent_pipe=None,

1475

1583

client_object=None):

1476

1584

condition_names = {

1477

gobject.IO_IN: u"IN", # There is data to read.

1478

gobject.IO_OUT: u"OUT", # Data can be written (without

1585

gobject.IO_IN: "IN", # There is data to read.

1586

gobject.IO_OUT: "OUT", # Data can be written (without

1479

1587

# blocking).

1480

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1481

gobject.IO_ERR: u"ERR", # Error condition.

1482

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1588

gobject.IO_PRI: "PRI", # There is urgent data to read.

1589

gobject.IO_ERR: "ERR", # Error condition.

1590

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1483

1591

# broken, usually for pipes and

1484

1592

# sockets).

1485

1593

}

1504

1612

client = c

1505

1613

break

1506

1614

else:

1507

logger.warning(u"Client not found for fingerprint: %s, ad"

1508

u"dress: %s", fpr, address)

1615

logger.info("Client not found for fingerprint: %s, ad"

1616

"dress: %s", fpr, address)

1509

1617

if self.use_dbus:

1510

1618

# Emit D-Bus signal

1511

mandos_dbus_service.ClientNotFound(fpr, address)

1619

mandos_dbus_service.ClientNotFound(fpr, address[0])

1512

1620

parent_pipe.send(False)

1513

1621

return False

1514

1622

1526

1634

kwargs = request[3]

1527

1635

1528

1636

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1529

1637

1530

1638

if command == 'getattr':

1531

1639

attrname = request[1]

1532

1640

if callable(client_object.__getattribute__(attrname)):

1538

1646

attrname = request[1]

1539

1647

value = request[2]

1540

1648

setattr(client_object, attrname, value)

1541

1649

1542

1650

return True

1543

1651

1544

1652

1545

1653

def string_to_delta(interval):

1546

1654

"""Parse a string and return a datetime.timedelta

1547

1655

1548

>>> string_to_delta(u'7d')

1656

>>> string_to_delta('7d')

1549

1657

datetime.timedelta(7)

1550

>>> string_to_delta(u'60s')

1658

>>> string_to_delta('60s')

1551

1659

datetime.timedelta(0, 60)

1552

>>> string_to_delta(u'60m')

1660

>>> string_to_delta('60m')

1553

1661

datetime.timedelta(0, 3600)

1554

>>> string_to_delta(u'24h')

1662

>>> string_to_delta('24h')

1555

1663

datetime.timedelta(1)

1556

>>> string_to_delta(u'1w')

1664

>>> string_to_delta('1w')

1557

1665

datetime.timedelta(7)

1558

>>> string_to_delta(u'5m 30s')

1666

>>> string_to_delta('5m 30s')

1559

1667

datetime.timedelta(0, 330)

1560

1668

"""

1561

1669

timevalue = datetime.timedelta(0)

1563

1671

try:

1564

1672

suffix = unicode(s[-1])

1565

1673

value = int(s[:-1])

1566

if suffix == u"d":

1674

if suffix == "d":

1567

1675

delta = datetime.timedelta(value)

1568

elif suffix == u"s":

1676

elif suffix == "s":

1569

1677

delta = datetime.timedelta(0, value)

1570

elif suffix == u"m":

1678

elif suffix == "m":

1571

1679

delta = datetime.timedelta(0, 0, 0, 0, value)

1572

elif suffix == u"h":

1680

elif suffix == "h":

1573

1681

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1574

elif suffix == u"w":

1682

elif suffix == "w":

1575

1683

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1576

1684

else:

1577

raise ValueError(u"Unknown suffix %r" % suffix)

1578

except (ValueError, IndexError), e:

1579

raise ValueError(e.message)

1685

raise ValueError("Unknown suffix %r" % suffix)

1686

except (ValueError, IndexError) as e:

1687

raise ValueError(*(e.args))

1580

1688

timevalue += delta

1581

1689

return timevalue

1582

1690

1588

1696

global if_nametoindex

1589

1697

try:

1590

1698

if_nametoindex = (ctypes.cdll.LoadLibrary

1591

(ctypes.util.find_library(u"c"))

1699

(ctypes.util.find_library("c"))

1592

1700

.if_nametoindex)

1593

1701

except (OSError, AttributeError):

1594

logger.warning(u"Doing if_nametoindex the hard way")

1702

logger.warning("Doing if_nametoindex the hard way")

1595

1703

def if_nametoindex(interface):

1596

1704

"Get an interface index the hard way, i.e. using fcntl()"

1597

1705

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1598

1706

with contextlib.closing(socket.socket()) as s:

1599

1707

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1600

struct.pack(str(u"16s16x"),

1708

struct.pack(str("16s16x"),

1601

1709

interface))

1602

interface_index = struct.unpack(str(u"I"),

1710

interface_index = struct.unpack(str("I"),

1603

1711

ifreq[16:20])[0]

1604

1712

return interface_index

1605

1713

return if_nametoindex(interface)

1613

1721

sys.exit()

1614

1722

os.setsid()

1615

1723

if not nochdir:

1616

os.chdir(u"/")

1724

os.chdir("/")

1617

1725

if os.fork():

1618

1726

sys.exit()

1619

1727

if not noclose:

1621

1729

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1622

1730

if not stat.S_ISCHR(os.fstat(null).st_mode):

1623

1731

raise OSError(errno.ENODEV,

1624

u"%s not a character device"

1732

"%s not a character device"

1625

1733

% os.path.devnull)

1626

1734

os.dup2(null, sys.stdin.fileno())

1627

1735

os.dup2(null, sys.stdout.fileno())

1635

1743

##################################################################

1636

1744

# Parsing of options, both command line and config file

1637

1745

1638

parser = optparse.OptionParser(version = "%%prog %s" % version)

1639

parser.add_option("-i", u"--interface", type=u"string",

1640

metavar="IF", help=u"Bind to interface IF")

1641

parser.add_option("-a", u"--address", type=u"string",

1642

help=u"Address to listen for requests on")

1643

parser.add_option("-p", u"--port", type=u"int",

1644

help=u"Port number to receive requests on")

1645

parser.add_option("--check", action=u"store_true",

1646

help=u"Run self-test")

1647

parser.add_option("--debug", action=u"store_true",

1648

help=u"Debug mode; run in foreground and log to"

1649

u" terminal")

1650

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1651

help=u"Debug level for stdout output")

1652

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1653

u" priority string (see GnuTLS documentation)")

1654

parser.add_option("--servicename", type=u"string",

1655

metavar=u"NAME", help=u"Zeroconf service name")

1656

parser.add_option("--configdir", type=u"string",

1657

default=u"/etc/mandos", metavar=u"DIR",

1658

help=u"Directory to search for configuration"

1659

u" files")

1660

parser.add_option("--no-dbus", action=u"store_false",

1661

dest=u"use_dbus", help=u"Do not provide D-Bus"

1662

u" system bus interface")

1663

parser.add_option("--no-ipv6", action=u"store_false",

1664

dest=u"use_ipv6", help=u"Do not use IPv6")

1665

options = parser.parse_args()[0]

1746

parser = argparse.ArgumentParser()

1747

parser.add_argument("-v", "--version", action="version",

1748

version = "%%(prog)s %s" % version,

1749

help="show version number and exit")

1750

parser.add_argument("-i", "--interface", metavar="IF",

1751

help="Bind to interface IF")

1752

parser.add_argument("-a", "--address",

1753

help="Address to listen for requests on")

1754

parser.add_argument("-p", "--port", type=int,

1755

help="Port number to receive requests on")

1756

parser.add_argument("--check", action="store_true",

1757

help="Run self-test")

1758

parser.add_argument("--debug", action="store_true",

1759

help="Debug mode; run in foreground and log"

1760

" to terminal")

1761

parser.add_argument("--debuglevel", metavar="LEVEL",

1762

help="Debug level for stdout output")

1763

parser.add_argument("--priority", help="GnuTLS"

1764

" priority string (see GnuTLS documentation)")

1765

parser.add_argument("--servicename",

1766

metavar="NAME", help="Zeroconf service name")

1767

parser.add_argument("--configdir",

1768

default="/etc/mandos", metavar="DIR",

1769

help="Directory to search for configuration"

1770

" files")

1771

parser.add_argument("--no-dbus", action="store_false",

1772

dest="use_dbus", help="Do not provide D-Bus"

1773

" system bus interface")

1774

parser.add_argument("--no-ipv6", action="store_false",

1775

dest="use_ipv6", help="Do not use IPv6")

1776

options = parser.parse_args()

1666

1777

1667

1778

if options.check:

1668

1779

import doctest

1670

1781

sys.exit()

1671

1782

1672

1783

# Default values for config file for server-global settings

1673

server_defaults = { u"interface": u"",

1674

u"address": u"",

1675

u"port": u"",

1676

u"debug": u"False",

1677

u"priority":

1678

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1679

u"servicename": u"Mandos",

1680

u"use_dbus": u"True",

1681

u"use_ipv6": u"True",

1682

u"debuglevel": u"",

1784

server_defaults = { "interface": "",

1785

"address": "",

1786

"port": "",

1787

"debug": "False",

1788

"priority":

1789

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1790

"servicename": "Mandos",

1791

"use_dbus": "True",

1792

"use_ipv6": "True",

1793

"debuglevel": "",

1683

1794

}

1684

1795

1685

1796

# Parse config file for server-global settings

1686

1797

server_config = configparser.SafeConfigParser(server_defaults)

1687

1798

del server_defaults

1688

1799

server_config.read(os.path.join(options.configdir,

1689

u"mandos.conf"))

1800

"mandos.conf"))

1690

1801

# Convert the SafeConfigParser object to a dict

1691

1802

server_settings = server_config.defaults()

1692

1803

# Use the appropriate methods on the non-string config options

1693

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1694

server_settings[option] = server_config.getboolean(u"DEFAULT",

1804

for option in ("debug", "use_dbus", "use_ipv6"):

1805

server_settings[option] = server_config.getboolean("DEFAULT",

1695

1806

option)

1696

1807

if server_settings["port"]:

1697

server_settings["port"] = server_config.getint(u"DEFAULT",

1698

u"port")

1808

server_settings["port"] = server_config.getint("DEFAULT",

1809

"port")

1699

1810

del server_config

1700

1811

1701

1812

# Override the settings from the config file with command line

1702

1813

# options, if set.

1703

for option in (u"interface", u"address", u"port", u"debug",

1704

u"priority", u"servicename", u"configdir",

1705

u"use_dbus", u"use_ipv6", u"debuglevel"):

1814

for option in ("interface", "address", "port", "debug",

1815

"priority", "servicename", "configdir",

1816

"use_dbus", "use_ipv6", "debuglevel"):

1706

1817

value = getattr(options, option)

1707

1818

if value is not None:

1708

1819

server_settings[option] = value

1716

1827

##################################################################

1717

1828

1718

1829

# For convenience

1719

debug = server_settings[u"debug"]

1720

debuglevel = server_settings[u"debuglevel"]

1721

use_dbus = server_settings[u"use_dbus"]

1722

use_ipv6 = server_settings[u"use_ipv6"]

1723

1724

if server_settings[u"servicename"] != u"Mandos":

1830

debug = server_settings["debug"]

1831

debuglevel = server_settings["debuglevel"]

1832

use_dbus = server_settings["use_dbus"]

1833

use_ipv6 = server_settings["use_ipv6"]

1834

1835

if server_settings["servicename"] != "Mandos":

1725

1836

syslogger.setFormatter(logging.Formatter

1726

(u'Mandos (%s) [%%(process)d]:'

1727

u' %%(levelname)s: %%(message)s'

1728

% server_settings[u"servicename"]))

1837

('Mandos (%s) [%%(process)d]:'

1838

' %%(levelname)s: %%(message)s'

1839

% server_settings["servicename"]))

1729

1840

1730

1841

# Parse config file with clients

1731

client_defaults = { u"timeout": u"1h",

1732

u"interval": u"5m",

1733

u"checker": u"fping -q -- %%(host)s",

1734

u"host": u"",

1735

u"approval_delay": u"0s",

1736

u"approval_duration": u"1s",

1842

client_defaults = { "timeout": "5m",

1843

"extended_timeout": "15m",

1844

"interval": "2m",

1845

"checker": "fping -q -- %%(host)s",

1846

"host": "",

1847

"approval_delay": "0s",

1848

"approval_duration": "1s",

1737

1849

}

1738

1850

client_config = configparser.SafeConfigParser(client_defaults)

1739

client_config.read(os.path.join(server_settings[u"configdir"],

1740

u"clients.conf"))

1851

client_config.read(os.path.join(server_settings["configdir"],

1852

"clients.conf"))

1741

1853

1742

1854

global mandos_dbus_service

1743

1855

mandos_dbus_service = None

1744

1856

1745

tcp_server = MandosServer((server_settings[u"address"],

1746

server_settings[u"port"]),

1857

tcp_server = MandosServer((server_settings["address"],

1858

server_settings["port"]),

1747

1859

ClientHandler,

1748

interface=(server_settings[u"interface"]

1860

interface=(server_settings["interface"]

1749

1861

or None),

1750

1862

use_ipv6=use_ipv6,

1751

1863

gnutls_priority=

1752

server_settings[u"priority"],

1864

server_settings["priority"],

1753

1865

use_dbus=use_dbus)

1754

pidfilename = u"/var/run/mandos.pid"

1755

try:

1756

pidfile = open(pidfilename, u"w")

1757

except IOError:

1758

logger.error(u"Could not open file %r", pidfilename)

1866

if not debug:

1867

pidfilename = "/var/run/mandos.pid"

1868

try:

1869

pidfile = open(pidfilename, "w")

1870

except IOError:

1871

logger.error("Could not open file %r", pidfilename)

1759

1872

1760

1873

try:

1761

uid = pwd.getpwnam(u"_mandos").pw_uid

1762

gid = pwd.getpwnam(u"_mandos").pw_gid

1874

uid = pwd.getpwnam("_mandos").pw_uid

1875

gid = pwd.getpwnam("_mandos").pw_gid

1763

1876

except KeyError:

1764

1877

try:

1765

uid = pwd.getpwnam(u"mandos").pw_uid

1766

gid = pwd.getpwnam(u"mandos").pw_gid

1878

uid = pwd.getpwnam("mandos").pw_uid

1879

gid = pwd.getpwnam("mandos").pw_gid

1767

1880

except KeyError:

1768

1881

try:

1769

uid = pwd.getpwnam(u"nobody").pw_uid

1770

gid = pwd.getpwnam(u"nobody").pw_gid

1882

uid = pwd.getpwnam("nobody").pw_uid

1883

gid = pwd.getpwnam("nobody").pw_gid

1771

1884

except KeyError:

1772

1885

uid = 65534

1773

1886

gid = 65534

1774

1887

try:

1775

1888

os.setgid(gid)

1776

1889

os.setuid(uid)

1777

except OSError, error:

1890

except OSError as error:

1778

1891

if error[0] != errno.EPERM:

1779

1892

raise error

1780

1893

1785

1898

level = getattr(logging, debuglevel.upper())

1786

1899

syslogger.setLevel(level)

1787

1900

console.setLevel(level)

1788

1901

1789

1902

if debug:

1790

1903

# Enable all possible GnuTLS debugging

1791

1904

1795

1908

1796

1909

@gnutls.library.types.gnutls_log_func

1797

1910

def debug_gnutls(level, string):

1798

logger.debug(u"GnuTLS: %s", string[:-1])

1911

logger.debug("GnuTLS: %s", string[:-1])

1799

1912

1800

1913

(gnutls.library.functions

1801

1914

.gnutls_global_set_log_function(debug_gnutls))

1809

1922

# No console logging

1810

1923

logger.removeHandler(console)

1811

1924

1925

# Need to fork before connecting to D-Bus

1926

if not debug:

1927

# Close all input and output, do double fork, etc.

1928

daemon()

1812

1929

1813

1930

global main_loop

1814

1931

# From the Avahi example code

1818

1935

# End of Avahi example code

1819

1936

if use_dbus:

1820

1937

try:

1821

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1822

bus, do_not_queue=True)

1823

except dbus.exceptions.NameExistsException, e:

1824

logger.error(unicode(e) + u", disabling D-Bus")

1938

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1939

bus, do_not_queue=True)

1940

bus_name2 = dbus.service.BusName("se.recompile.Mandos",

1941

bus, do_not_queue=True)

1942

except dbus.exceptions.NameExistsException as e:

1943

logger.error(unicode(e) + ", disabling D-Bus")

1825

1944

use_dbus = False

1826

server_settings[u"use_dbus"] = False

1945

server_settings["use_dbus"] = False

1827

1946

tcp_server.use_dbus = False

1828

1947

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1829

service = AvahiService(name = server_settings[u"servicename"],

1830

servicetype = u"_mandos._tcp",

1948

service = AvahiService(name = server_settings["servicename"],

1949

servicetype = "_mandos._tcp",

1831

1950

protocol = protocol, bus = bus)

1832

1951

if server_settings["interface"]:

1833

1952

service.interface = (if_nametoindex

1834

(str(server_settings[u"interface"])))

1835

1836

if not debug:

1837

# Close all input and output, do double fork, etc.

1838

daemon()

1839

1953

(str(server_settings["interface"])))

1954

1840

1955

global multiprocessing_manager

1841

1956

multiprocessing_manager = multiprocessing.Manager()

1842

1957

1843

1958

client_class = Client

1844

1959

if use_dbus:

1845

client_class = functools.partial(ClientDBus, bus = bus)

1960

client_class = functools.partial(ClientDBusTransitional, bus = bus)

1846

1961

def client_config_items(config, section):

1847

1962

special_settings = {

1848

1963

"approved_by_default":

1861

1976

client_config, section)))

1862

1977

for section in client_config.sections()))

1863

1978

if not tcp_server.clients:

1864

logger.warning(u"No clients defined")

1979

logger.warning("No clients defined")

1865

1980

1866

try:

1867

with pidfile:

1868

pid = os.getpid()

1869

pidfile.write(str(pid) + "\n")

1870

del pidfile

1871

except IOError:

1872

logger.error(u"Could not write to file %r with PID %d",

1873

pidfilename, pid)

1874

except NameError:

1875

# "pidfile" was never created

1876

pass

1877

del pidfilename

1878

1879

1981

if not debug:

1982

try:

1983

with pidfile:

1984

pid = os.getpid()

1985

pidfile.write(str(pid) + "\n".encode("utf-8"))

1986

del pidfile

1987

except IOError:

1988

logger.error("Could not write to file %r with PID %d",

1989

pidfilename, pid)

1990

except NameError:

1991

# "pidfile" was never created

1992

pass

1993

del pidfilename

1994

1880

1995

signal.signal(signal.SIGINT, signal.SIG_IGN)

1996

1881

1997

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1882

1998

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1883

1999

1885

2001

class MandosDBusService(dbus.service.Object):

1886

2002

"""A D-Bus proxy object"""

1887

2003

def __init__(self):

1888

dbus.service.Object.__init__(self, bus, u"/")

1889

_interface = u"se.bsnet.fukt.Mandos"

2004

dbus.service.Object.__init__(self, bus, "/")

2005

_interface = "se.bsnet.fukt.Mandos"

1890

2006

1891

@dbus.service.signal(_interface, signature=u"o")

2007

@dbus.service.signal(_interface, signature="o")

1892

2008

def ClientAdded(self, objpath):

1893

2009

"D-Bus signal"

1894

2010

pass

1895

2011

1896

@dbus.service.signal(_interface, signature=u"ss")

2012

@dbus.service.signal(_interface, signature="ss")

1897

2013

def ClientNotFound(self, fingerprint, address):

1898

2014

"D-Bus signal"

1899

2015

pass

1900

2016

1901

@dbus.service.signal(_interface, signature=u"os")

2017

@dbus.service.signal(_interface, signature="os")

1902

2018

def ClientRemoved(self, objpath, name):

1903

2019

"D-Bus signal"

1904

2020

pass

1905

2021

1906

@dbus.service.method(_interface, out_signature=u"ao")

2022

@dbus.service.method(_interface, out_signature="ao")

1907

2023

def GetAllClients(self):

1908

2024

"D-Bus method"

1909

2025

return dbus.Array(c.dbus_object_path

1910

2026

for c in tcp_server.clients)

1911

2027

1912

2028

@dbus.service.method(_interface,

1913

out_signature=u"a{oa{sv}}")

2029

out_signature="a{oa{sv}}")

1914

2030

def GetAllClientsWithProperties(self):

1915

2031

"D-Bus method"

1916

2032

return dbus.Dictionary(

1917

((c.dbus_object_path, c.GetAll(u""))

2033

((c.dbus_object_path, c.GetAll(""))

1918

2034

for c in tcp_server.clients),

1919

signature=u"oa{sv}")

2035

signature="oa{sv}")

1920

2036

1921

@dbus.service.method(_interface, in_signature=u"o")

2037

@dbus.service.method(_interface, in_signature="o")

1922

2038

def RemoveClient(self, object_path):

1923

2039

"D-Bus method"

1924

2040

for c in tcp_server.clients:

1934

2050

1935

2051

del _interface

1936

2052

1937

mandos_dbus_service = MandosDBusService()

2053

class MandosDBusServiceTransitional(MandosDBusService):

2054

__metaclass__ = transitional_dbus_metaclass

2055

mandos_dbus_service = MandosDBusServiceTransitional()

1938

2056

1939

2057

def cleanup():

1940

2058

"Cleanup function; run on exit"

1966

2084

# Find out what port we got

1967

2085

service.port = tcp_server.socket.getsockname()[1]

1968

2086

if use_ipv6:

1969

logger.info(u"Now listening on address %r, port %d,"

2087

logger.info("Now listening on address %r, port %d,"

1970

2088

" flowinfo %d, scope_id %d"

1971

2089

% tcp_server.socket.getsockname())

1972

2090

else: # IPv4

1973

logger.info(u"Now listening on address %r, port %d"

2091

logger.info("Now listening on address %r, port %d"

1974

2092

% tcp_server.socket.getsockname())

1975

2093

1976

2094

#service.interface = tcp_server.socket.getsockname()[3]

1979

2097

# From the Avahi example code

1980

2098

try:

1981

2099

service.activate()

1982

except dbus.exceptions.DBusException, error:

1983

logger.critical(u"DBusException: %s", error)

2100

except dbus.exceptions.DBusException as error:

2101

logger.critical("DBusException: %s", error)

1984

2102

cleanup()

1985

2103

sys.exit(1)

1986

2104

# End of Avahi example code

1990

2108

(tcp_server.handle_request

1991

2109

(*args[2:], **kwargs) or True))

1992

2110

1993

logger.debug(u"Starting main loop")

2111

logger.debug("Starting main loop")

1994

2112

main_loop.run()

1995

except AvahiError, error:

1996

logger.critical(u"AvahiError: %s", error)

2113

except AvahiError as error:

2114

logger.critical("AvahiError: %s", error)

1997

2115

cleanup()

1998

2116

sys.exit(1)

1999

2117

except KeyboardInterrupt:

2000

2118

if debug:

2001

print >> sys.stderr

2002

logger.debug(u"Server received KeyboardInterrupt")

2003

logger.debug(u"Server exiting")

2119

print("", file=sys.stderr)

2120

logger.debug("Server received KeyboardInterrupt")

2121

logger.debug("Server exiting")

2004

2122

# Must run before the D-Bus bus name gets deregistered

2005

2123

cleanup()

2006

2124

2125

2007

2126

if __name__ == '__main__':

2008

2127

main()