/mandos/trunk : revision 24.1.186

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

55

56

import logging

56

57

import logging.handlers

57

58

import pwd

58

from contextlib import closing

59

import contextlib

59

60

import struct

60

61

import fcntl

61

62

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

62

66

63

67

import dbus

64

68

import dbus.service

79

83

SO_BINDTODEVICE = None

80

84

81

85

82

version = "1.0.14"

86

version = "1.3.1"

83

87

84

logger = logging.Logger(u'mandos')

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

85

90

syslogger = (logging.handlers.SysLogHandler

86

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

87

address = "/dev/log"))

92

address = str("/dev/log")))

88

93

syslogger.setFormatter(logging.Formatter

89

(u'Mandos [%(process)d]: %(levelname)s:'

90

u' %(message)s'))

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

91

96

logger.addHandler(syslogger)

92

97

93

98

console = logging.StreamHandler()

94

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

95

u' %(levelname)s:'

96

u' %(message)s'))

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

97

102

logger.addHandler(console)

98

103

99

104

class AvahiError(Exception):

116

121

Attributes:

117

122

interface: integer; avahi.IF_UNSPEC or an interface index.

118

123

Used to optionally bind to the specified interface.

119

120

type: string; Example: u'_mandos._tcp'.

124

125

type: string; Example: '_mandos._tcp'.

121

126

See <http://www.dns-sd.org/ServiceTypes.html>

122

127

port: integer; what port to announce

123

128

TXT: list of strings; TXT record for the service

132

137

"""

133

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

134

139

servicetype = None, port = None, TXT = None,

135

domain = u"", host = u"", max_renames = 32768,

140

domain = "", host = "", max_renames = 32768,

136

141

protocol = avahi.PROTO_UNSPEC, bus = None):

137

142

self.interface = interface

138

143

self.name = name

147

152

self.group = None # our entry group

148

153

self.server = None

149

154

self.bus = bus

155

self.entry_group_state_changed_match = None

150

156

def rename(self):

151

157

"""Derived from the Avahi example code"""

152

158

if self.rename_count >= self.max_renames:

153

logger.critical(u"No suitable Zeroconf service name found"

154

u" after %i retries, exiting.",

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

155

161

self.rename_count)

156

raise AvahiServiceError(u"Too many renames")

157

self.name = self.server.GetAlternativeServiceName(self.name)

158

logger.info(u"Changing Zeroconf service name to %r ...",

159

unicode(self.name))

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

164

logger.info("Changing Zeroconf service name to %r ...",

165

self.name)

160

166

syslogger.setFormatter(logging.Formatter

161

(u'Mandos (%s) [%%(process)d]:'

162

u' %%(levelname)s: %%(message)s'

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

163

169

% self.name))

164

170

self.remove()

165

self.add()

171

try:

172

self.add()

173

except dbus.exceptions.DBusException as error:

174

logger.critical("DBusException: %s", error)

175

self.cleanup()

176

os._exit(1)

166

177

self.rename_count += 1

167

178

def remove(self):

168

179

"""Derived from the Avahi example code"""

180

if self.entry_group_state_changed_match is not None:

181

self.entry_group_state_changed_match.remove()

182

self.entry_group_state_changed_match = None

169

183

if self.group is not None:

170

184

self.group.Reset()

171

185

def add(self):

172

186

"""Derived from the Avahi example code"""

187

self.remove()

173

188

if self.group is None:

174

189

self.group = dbus.Interface(

175

190

self.bus.get_object(avahi.DBUS_NAME,

176

191

self.server.EntryGroupNew()),

177

192

avahi.DBUS_INTERFACE_ENTRY_GROUP)

178

self.group.connect_to_signal('StateChanged',

179

self

180

.entry_group_state_changed)

181

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

193

self.entry_group_state_changed_match = (

194

self.group.connect_to_signal(

195

'StateChanged', self .entry_group_state_changed))

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

182

197

self.name, self.type)

183

198

self.group.AddService(

184

199

self.interface,

191

206

self.group.Commit()

192

207

def entry_group_state_changed(self, state, error):

193

208

"""Derived from the Avahi example code"""

194

logger.debug(u"Avahi state change: %i", state)

209

logger.debug("Avahi entry group state change: %i", state)

195

210

196

211

if state == avahi.ENTRY_GROUP_ESTABLISHED:

197

logger.debug(u"Zeroconf service established.")

212

logger.debug("Zeroconf service established.")

198

213

elif state == avahi.ENTRY_GROUP_COLLISION:

199

logger.warning(u"Zeroconf service name collision.")

214

logger.info("Zeroconf service name collision.")

200

215

self.rename()

201

216

elif state == avahi.ENTRY_GROUP_FAILURE:

202

logger.critical(u"Avahi: Error in group state changed %s",

217

logger.critical("Avahi: Error in group state changed %s",

203

218

unicode(error))

204

raise AvahiGroupError(u"State changed: %s"

219

raise AvahiGroupError("State changed: %s"

205

220

% unicode(error))

206

221

def cleanup(self):

207

222

"""Derived from the Avahi example code"""

208

223

if self.group is not None:

209

self.group.Free()

224

try:

225

self.group.Free()

226

except (dbus.exceptions.UnknownMethodException,

227

dbus.exceptions.DBusException) as e:

228

pass

210

229

self.group = None

211

def server_state_changed(self, state):

230

self.remove()

231

def server_state_changed(self, state, error=None):

212

232

"""Derived from the Avahi example code"""

213

if state == avahi.SERVER_COLLISION:

214

logger.error(u"Zeroconf server name collision")

215

self.remove()

233

logger.debug("Avahi server state change: %i", state)

234

bad_states = { avahi.SERVER_INVALID:

235

"Zeroconf server invalid",

236

avahi.SERVER_REGISTERING: None,

237

avahi.SERVER_COLLISION:

238

"Zeroconf server name collision",

239

avahi.SERVER_FAILURE:

240

"Zeroconf server failure" }

241

if state in bad_states:

242

if bad_states[state] is not None:

243

if error is None:

244

logger.error(bad_states[state])

245

else:

246

logger.error(bad_states[state] + ": %r", error)

247

self.cleanup()

216

248

elif state == avahi.SERVER_RUNNING:

217

249

self.add()

250

else:

251

if error is None:

252

logger.debug("Unknown state: %r", state)

253

else:

254

logger.debug("Unknown state: %r: %r", state, error)

218

255

def activate(self):

219

256

"""Derived from the Avahi example code"""

220

257

if self.server is None:

221

258

self.server = dbus.Interface(

222

259

self.bus.get_object(avahi.DBUS_NAME,

223

avahi.DBUS_PATH_SERVER),

260

avahi.DBUS_PATH_SERVER,

261

follow_name_owner_changes=True),

224

262

avahi.DBUS_INTERFACE_SERVER)

225

self.server.connect_to_signal(u"StateChanged",

263

self.server.connect_to_signal("StateChanged",

226

264

self.server_state_changed)

227

265

self.server_state_changed(self.server.GetState())

228

266

229

267

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

230

274

class Client(object):

231

275

"""A representation of a client host served by this server.

232

276

233

277

Attributes:

234

235

D-Bus identifiers

236

fingerprint: string (40 or 32 hexadecimal digits); used to

237

uniquely identify the client

238

secret: bytestring; sent verbatim (over TLS) to client

239

host: string; available for use by the checker command

240

created: datetime.datetime(); (UTC) object creation

241

last_enabled: datetime.datetime(); (UTC)

242

enabled: bool()

243

last_checked_ok: datetime.datetime(); (UTC) or None

244

timeout: datetime.timedelta(); How long from last_checked_ok

245

until this client is invalid

246

interval: datetime.timedelta(); How often to start a new checker

247

disable_hook: If set, called by disable() as disable_hook(self)

278

_approved: bool(); 'None' if not yet approved/disapproved

279

approval_delay: datetime.timedelta(); Time to wait for approval

280

approval_duration: datetime.timedelta(); Duration of one approval

248

281

checker: subprocess.Popen(); a running checker process used

249

282

to see if the client lives.

250

283

'None' if no process is running.

251

checker_initiator_tag: a gobject event source tag, or None

252

disable_initiator_tag: - '' -

253

checker_callback_tag: - '' -

254

checker_command: string; External command which is run to check if

255

client lives. %() expansions are done at

284

checker_callback_tag: a gobject event source tag, or None

285

checker_command: string; External command which is run to check

286

if client lives. %() expansions are done at

256

287

runtime with vars(self) as dict, so that for

257

288

instance %(name)s can be used in the command.

289

checker_initiator_tag: a gobject event source tag, or None

290

created: datetime.datetime(); (UTC) object creation

258

291

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

293

disable_initiator_tag: a gobject event source tag, or None

294

enabled: bool()

295

fingerprint: string (40 or 32 hexadecimal digits); used to

296

uniquely identify the client

297

host: string; available for use by the checker command

298

interval: datetime.timedelta(); How often to start a new checker

299

last_approval_request: datetime.datetime(); (UTC) or None

300

last_checked_ok: datetime.datetime(); (UTC) or None

301

last_enabled: datetime.datetime(); (UTC)

302

303

D-Bus identifiers

304

secret: bytestring; sent verbatim (over TLS) to client

305

timeout: datetime.timedelta(); How long from last_checked_ok

306

until this client is disabled

307

extended_timeout: extra long timeout when password has been sent

308

runtime_expansions: Allowed attributes for runtime expansion.

309

expires: datetime.datetime(); time (UTC) when a client will be

310

disabled, or None

259

311

"""

260

312

261

@staticmethod

262

def _timedelta_to_milliseconds(td):

263

"Convert a datetime.timedelta() to milliseconds"

264

return ((td.days * 24 * 60 * 60 * 1000)

265

+ (td.seconds * 1000)

266

+ (td.microseconds // 1000))

313

runtime_expansions = ("approval_delay", "approval_duration",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

316

"last_enabled", "name", "timeout")

267

317

268

318

def timeout_milliseconds(self):

269

319

"Return the 'timeout' attribute in milliseconds"

270

return self._timedelta_to_milliseconds(self.timeout)

320

return _timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

271

325

272

326

def interval_milliseconds(self):

273

327

"Return the 'interval' attribute in milliseconds"

274

return self._timedelta_to_milliseconds(self.interval)

328

return _timedelta_to_milliseconds(self.interval)

329

330

def approval_delay_milliseconds(self):

331

return _timedelta_to_milliseconds(self.approval_delay)

275

332

276

333

def __init__(self, name = None, disable_hook=None, config=None):

277

334

"""Note: the 'checker' key in 'config' sets the

280

337

self.name = name

281

338

if config is None:

282

339

config = {}

283

logger.debug(u"Creating client %r", self.name)

340

logger.debug("Creating client %r", self.name)

284

341

# Uppercase and remove spaces from fingerprint for later

285

342

# comparison purposes with return value from the fingerprint()

286

343

# function

287

self.fingerprint = (config[u"fingerprint"].upper()

288

.replace(u" ", u""))

289

logger.debug(u" Fingerprint: %s", self.fingerprint)

290

if u"secret" in config:

291

self.secret = config[u"secret"].decode(u"base64")

292

elif u"secfile" in config:

293

with closing(open(os.path.expanduser

294

(os.path.expandvars

295

(config[u"secfile"])),

296

"rb")) as secfile:

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

350

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

352

"rb") as secfile:

297

353

self.secret = secfile.read()

298

354

else:

299

raise TypeError(u"No secret or secfile for client %s"

355

raise TypeError("No secret or secfile for client %s"

300

356

% self.name)

301

self.host = config.get(u"host", u"")

357

self.host = config.get("host", "")

302

358

self.created = datetime.datetime.utcnow()

303

359

self.enabled = False

360

self.last_approval_request = None

304

361

self.last_enabled = None

305

362

self.last_checked_ok = None

306

self.timeout = string_to_delta(config[u"timeout"])

307

self.interval = string_to_delta(config[u"interval"])

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

308

366

self.disable_hook = disable_hook

309

367

self.checker = None

310

368

self.checker_initiator_tag = None

311

369

self.disable_initiator_tag = None

370

self.expires = None

312

371

self.checker_callback_tag = None

313

self.checker_command = config[u"checker"]

372

self.checker_command = config["checker"]

314

373

self.current_checker_command = None

315

374

self.last_connect = None

375

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

377

True)

378

self.approvals_pending = 0

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

316

384

385

def send_changedstate(self):

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

317

390

def enable(self):

318

391

"""Start this client's checker and timeout hooks"""

319

if getattr(self, u"enabled", False):

392

if getattr(self, "enabled", False):

320

393

# Already enabled

321

394

return

322

self.last_enabled = datetime.datetime.utcnow()

395

self.send_changedstate()

323

396

# Schedule a new checker to be started an 'interval' from now,

324

397

# and every interval from then on.

325

398

self.checker_initiator_tag = (gobject.timeout_add

326

399

(self.interval_milliseconds(),

327

400

self.start_checker))

328

401

# Schedule a disable() when 'timeout' has passed

402

self.expires = datetime.datetime.utcnow() + self.timeout

329

403

self.disable_initiator_tag = (gobject.timeout_add

330

404

(self.timeout_milliseconds(),

331

405

self.disable))

332

406

self.enabled = True

407

self.last_enabled = datetime.datetime.utcnow()

333

408

# Also start a new checker *right now*.

334

409

self.start_checker()

335

410

338

413

if not getattr(self, "enabled", False):

339

414

return False

340

415

if not quiet:

341

logger.info(u"Disabling client %s", self.name)

342

if getattr(self, u"disable_initiator_tag", False):

416

self.send_changedstate()

417

if not quiet:

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

343

420

gobject.source_remove(self.disable_initiator_tag)

344

421

self.disable_initiator_tag = None

345

if getattr(self, u"checker_initiator_tag", False):

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

346

424

gobject.source_remove(self.checker_initiator_tag)

347

425

self.checker_initiator_tag = None

348

426

self.stop_checker()

363

441

if os.WIFEXITED(condition):

364

442

exitstatus = os.WEXITSTATUS(condition)

365

443

if exitstatus == 0:

366

logger.info(u"Checker for %(name)s succeeded",

444

logger.info("Checker for %(name)s succeeded",

367

445

vars(self))

368

446

self.checked_ok()

369

447

else:

370

logger.info(u"Checker for %(name)s failed",

448

logger.info("Checker for %(name)s failed",

371

449

vars(self))

372

450

else:

373

logger.warning(u"Checker for %(name)s crashed?",

451

logger.warning("Checker for %(name)s crashed?",

374

452

vars(self))

375

453

376

def checked_ok(self):

454

def checked_ok(self, timeout=None):

377

455

"""Bump up the timeout for this client.

378

456

379

457

This should only be called when the client has been seen,

380

458

alive and well.

381

459

"""

460

if timeout is None:

461

timeout = self.timeout

382

462

self.last_checked_ok = datetime.datetime.utcnow()

383

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

384

465

self.disable_initiator_tag = (gobject.timeout_add

385

(self.timeout_milliseconds(),

466

(_timedelta_to_milliseconds(timeout),

386

467

self.disable))

387

468

469

def need_approval(self):

470

self.last_approval_request = datetime.datetime.utcnow()

471

388

472

def start_checker(self):

389

473

"""Start a new checker subprocess if one is not running.

390

474

396

480

# client would inevitably timeout, since no checker would get

397

481

# a chance to run to completion. If we instead leave running

398

482

# checkers alone, the checker would have to take more time

399

# than 'timeout' for the client to be declared invalid, which

400

# is as it should be.

483

# than 'timeout' for the client to be disabled, which is as it

484

# should be.

401

485

402

486

# If a checker exists, make sure it is not a zombie

403

487

try:

404

488

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

405

except (AttributeError, OSError), error:

489

except (AttributeError, OSError) as error:

406

490

if (isinstance(error, OSError)

407

491

and error.errno != errno.ECHILD):

408

492

raise error

409

493

else:

410

494

if pid:

411

logger.warning(u"Checker was a zombie")

495

logger.warning("Checker was a zombie")

412

496

gobject.source_remove(self.checker_callback_tag)

413

497

self.checker_callback(pid, status,

414

498

self.current_checker_command)

419

503

command = self.checker_command % self.host

420

504

except TypeError:

421

505

# Escape attributes for the shell

422

escaped_attrs = dict((key,

423

re.escape(unicode(str(val),

424

errors=

425

u'replace')))

426

for key, val in

427

vars(self).iteritems())

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

428

514

try:

429

515

command = self.checker_command % escaped_attrs

430

except TypeError, error:

431

logger.error(u'Could not format string "%s":'

432

u' %s', self.checker_command, error)

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

433

519

return True # Try again later

434

520

self.current_checker_command = command

435

521

try:

436

logger.info(u"Starting checker %r for %s",

522

logger.info("Starting checker %r for %s",

437

523

command, self.name)

438

524

# We don't need to redirect stdout and stderr, since

439

525

# in normal mode, that is already done by daemon(),

441

527

# always replaced by /dev/null.)

442

528

self.checker = subprocess.Popen(command,

443

529

close_fds=True,

444

shell=True, cwd=u"/")

530

shell=True, cwd="/")

445

531

self.checker_callback_tag = (gobject.child_watch_add

446

532

(self.checker.pid,

447

533

self.checker_callback,

452

538

if pid:

453

539

gobject.source_remove(self.checker_callback_tag)

454

540

self.checker_callback(pid, status, command)

455

except OSError, error:

456

logger.error(u"Failed to start subprocess: %s",

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

457

543

error)

458

544

# Re-run this periodically if run by gobject.timeout_add

459

545

return True

463

549

if self.checker_callback_tag:

464

550

gobject.source_remove(self.checker_callback_tag)

465

551

self.checker_callback_tag = None

466

if getattr(self, u"checker", None) is None:

552

if getattr(self, "checker", None) is None:

467

553

return

468

logger.debug(u"Stopping checker for %(name)s", vars(self))

554

logger.debug("Stopping checker for %(name)s", vars(self))

469

555

try:

470

556

os.kill(self.checker.pid, signal.SIGTERM)

471

557

#time.sleep(0.5)

472

558

#if self.checker.poll() is None:

473

559

# os.kill(self.checker.pid, signal.SIGKILL)

474

except OSError, error:

560

except OSError as error:

475

561

if error.errno != errno.ESRCH: # No such process

476

562

raise

477

563

self.checker = None

478

479

def still_valid(self):

480

"""Has the timeout not yet passed for this client?"""

481

if not getattr(self, u"enabled", False):

482

return False

483

now = datetime.datetime.utcnow()

484

if self.last_checked_ok is None:

485

return now < (self.created + self.timeout)

486

else:

487

return now < (self.last_checked_ok + self.timeout)

488

489

490

def dbus_service_property(dbus_interface, signature=u"v",

491

access=u"readwrite", byte_arrays=False):

564

565

566

def dbus_service_property(dbus_interface, signature="v",

567

access="readwrite", byte_arrays=False):

492

568

"""Decorators for marking methods of a DBusObjectWithProperties to

493

569

become properties on the D-Bus.

494

570

499

575

dbus.service.method, except there is only "signature", since the

500

576

type from Get() and the type sent to Set() is the same.

501

577

"""

578

# Encoding deeply encoded byte arrays is not supported yet by the

579

# "Set" method, so we fail early here:

580

if byte_arrays and signature != "ay":

581

raise ValueError("Byte arrays not supported for non-'ay'"

582

" signature %r" % signature)

502

583

def decorator(func):

503

584

func._dbus_is_property = True

504

585

func._dbus_interface = dbus_interface

505

586

func._dbus_signature = signature

506

587

func._dbus_access = access

507

588

func._dbus_name = func.__name__

508

if func._dbus_name.endswith(u"_dbus_property"):

589

if func._dbus_name.endswith("_dbus_property"):

509

590

func._dbus_name = func._dbus_name[:-14]

510

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

591

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

511

592

return func

512

593

return decorator

513

594

533

614

534

615

class DBusObjectWithProperties(dbus.service.Object):

535

616

"""A D-Bus object with properties.

536

617

537

618

Classes inheriting from this can use the dbus_service_property

538

619

decorator to expose methods as D-Bus properties. It exposes the

539

620

standard Get(), Set(), and GetAll() methods on the D-Bus.

541

622

542

623

@staticmethod

543

624

def _is_dbus_property(obj):

544

return getattr(obj, u"_dbus_is_property", False)

625

return getattr(obj, "_dbus_is_property", False)

545

626

546

627

def _get_all_dbus_properties(self):

547

628

"""Returns a generator of (name, attribute) pairs

548

629

"""

549

return ((prop._dbus_name, prop)

550

for name, prop in

551

inspect.getmembers(self, self._is_dbus_property))

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

631

for cls in self.__class__.__mro__

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

552

633

553

634

def _get_dbus_property(self, interface_name, property_name):

554

635

"""Returns a bound method if one exists which is a D-Bus

555

636

property with the specified name and interface.

556

637

"""

557

for name in (property_name,

558

property_name + u"_dbus_property"):

559

prop = getattr(self, name, None)

560

if (prop is None

561

or not self._is_dbus_property(prop)

562

or prop._dbus_name != property_name

563

or (interface_name and prop._dbus_interface

564

and interface_name != prop._dbus_interface)):

565

continue

566

return prop

638

for cls in self.__class__.__mro__:

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

641

return value.__get__(self)

642

567

643

# No such property

568

raise DBusPropertyNotFound(self.dbus_object_path + u":"

569

+ interface_name + u"."

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

645

+ interface_name + "."

570

646

+ property_name)

647

571

648

572

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

573

out_signature=u"v")

649

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

650

out_signature="v")

574

651

def Get(self, interface_name, property_name):

575

652

"""Standard D-Bus property Get() method, see D-Bus standard.

576

653

"""

577

654

prop = self._get_dbus_property(interface_name, property_name)

578

if prop._dbus_access == u"write":

655

if prop._dbus_access == "write":

579

656

raise DBusPropertyAccessException(property_name)

580

657

value = prop()

581

if not hasattr(value, u"variant_level"):

658

if not hasattr(value, "variant_level"):

582

659

return value

583

660

return type(value)(value, variant_level=value.variant_level+1)

584

661

585

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

662

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

586

663

def Set(self, interface_name, property_name, value):

587

664

"""Standard D-Bus property Set() method, see D-Bus standard.

588

665

"""

589

666

prop = self._get_dbus_property(interface_name, property_name)

590

if prop._dbus_access == u"read":

667

if prop._dbus_access == "read":

591

668

raise DBusPropertyAccessException(property_name)

592

if prop._dbus_get_args_options[u"byte_arrays"]:

669

if prop._dbus_get_args_options["byte_arrays"]:

670

# The byte_arrays option is not supported yet on

671

# signatures other than "ay".

672

if prop._dbus_signature != "ay":

673

raise ValueError

593

674

value = dbus.ByteArray(''.join(unichr(byte)

594

675

for byte in value))

595

676

prop(value)

596

677

597

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

598

out_signature=u"a{sv}")

678

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

679

out_signature="a{sv}")

599

680

def GetAll(self, interface_name):

600

681

"""Standard D-Bus property GetAll() method, see D-Bus

601

682

standard.

602

683

603

684

Note: Will not include properties with access="write".

604

685

"""

605

686

all = {}

609

690

# Interface non-empty but did not match

610

691

continue

611

692

# Ignore write-only properties

612

if prop._dbus_access == u"write":

693

if prop._dbus_access == "write":

613

694

continue

614

695

value = prop()

615

if not hasattr(value, u"variant_level"):

696

if not hasattr(value, "variant_level"):

616

697

all[name] = value

617

698

continue

618

699

all[name] = type(value)(value, variant_level=

619

700

value.variant_level+1)

620

return dbus.Dictionary(all, signature=u"sv")

701

return dbus.Dictionary(all, signature="sv")

621

702

622

703

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

623

out_signature=u"s",

704

out_signature="s",

624

705

path_keyword='object_path',

625

706

connection_keyword='connection')

626

707

def Introspect(self, object_path, connection):

631

712

try:

632

713

document = xml.dom.minidom.parseString(xmlstring)

633

714

def make_tag(document, name, prop):

634

e = document.createElement(u"property")

635

e.setAttribute(u"name", name)

636

e.setAttribute(u"type", prop._dbus_signature)

637

e.setAttribute(u"access", prop._dbus_access)

715

e = document.createElement("property")

716

e.setAttribute("name", name)

717

e.setAttribute("type", prop._dbus_signature)

718

e.setAttribute("access", prop._dbus_access)

638

719

return e

639

for if_tag in document.getElementsByTagName(u"interface"):

720

for if_tag in document.getElementsByTagName("interface"):

640

721

for tag in (make_tag(document, name, prop)

641

722

for name, prop

642

723

in self._get_all_dbus_properties()

643

724

if prop._dbus_interface

644

== if_tag.getAttribute(u"name")):

725

== if_tag.getAttribute("name")):

645

726

if_tag.appendChild(tag)

646

727

# Add the names to the return values for the

647

728

# "org.freedesktop.DBus.Properties" methods

648

if (if_tag.getAttribute(u"name")

649

== u"org.freedesktop.DBus.Properties"):

650

for cn in if_tag.getElementsByTagName(u"method"):

651

if cn.getAttribute(u"name") == u"Get":

652

for arg in cn.getElementsByTagName(u"arg"):

653

if (arg.getAttribute(u"direction")

654

== u"out"):

655

arg.setAttribute(u"name", u"value")

656

elif cn.getAttribute(u"name") == u"GetAll":

657

for arg in cn.getElementsByTagName(u"arg"):

658

if (arg.getAttribute(u"direction")

659

== u"out"):

660

arg.setAttribute(u"name", u"props")

661

xmlstring = document.toxml(u"utf-8")

729

if (if_tag.getAttribute("name")

730

== "org.freedesktop.DBus.Properties"):

731

for cn in if_tag.getElementsByTagName("method"):

732

if cn.getAttribute("name") == "Get":

733

for arg in cn.getElementsByTagName("arg"):

734

if (arg.getAttribute("direction")

735

== "out"):

736

arg.setAttribute("name", "value")

737

elif cn.getAttribute("name") == "GetAll":

738

for arg in cn.getElementsByTagName("arg"):

739

if (arg.getAttribute("direction")

740

== "out"):

741

arg.setAttribute("name", "props")

742

xmlstring = document.toxml("utf-8")

662

743

document.unlink()

663

744

except (AttributeError, xml.dom.DOMException,

664

xml.parsers.expat.ExpatError), error:

665

logger.error(u"Failed to override Introspection method",

745

xml.parsers.expat.ExpatError) as error:

746

logger.error("Failed to override Introspection method",

666

747

error)

667

748

return xmlstring

668

749

669

750

751

def datetime_to_dbus (dt, variant_level=0):

752

"""Convert a UTC datetime.datetime() to a D-Bus type."""

753

if dt is None:

754

return dbus.String("", variant_level = variant_level)

755

return dbus.String(dt.isoformat(),

756

variant_level=variant_level)

757

758

class transitional_dbus_metaclass(DBusObjectWithProperties.__metaclass__):

759

def __new__(mcs, name, bases, attr):

760

for attrname, old_dbusobj in inspect.getmembers(bases[0]):

761

new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")

762

if (getattr(old_dbusobj, "_dbus_is_signal", False)

763

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

764

unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,

765

old_dbusobj.__closure__))["func"].cell_contents

766

newfunc = types.FunctionType(unwrappedfunc.func_code,

767

unwrappedfunc.func_globals,

768

unwrappedfunc.func_name,

769

unwrappedfunc.func_defaults,

770

unwrappedfunc.func_closure)

771

new_dbusfunc = dbus.service.signal(

772

new_interface, old_dbusobj._dbus_signature)(newfunc)

773

attr["_transitional_" + attrname] = new_dbusfunc

774

775

def fixscope(func1, func2):

776

def newcall(*args, **kwargs):

777

func1(*args, **kwargs)

778

func2(*args, **kwargs)

779

return newcall

780

781

attr[attrname] = fixscope(old_dbusobj, new_dbusfunc)

782

783

elif (getattr(old_dbusobj, "_dbus_is_method", False)

784

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

785

new_dbusfunc = (dbus.service.method

786

(new_interface,

787

old_dbusobj._dbus_in_signature,

788

old_dbusobj._dbus_out_signature)

789

(types.FunctionType

790

(old_dbusobj.func_code,

791

old_dbusobj.func_globals,

792

old_dbusobj.func_name,

793

old_dbusobj.func_defaults,

794

old_dbusobj.func_closure)))

795

796

attr[attrname] = new_dbusfunc

797

elif (getattr(old_dbusobj, "_dbus_is_property", False)

798

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

799

new_dbusfunc = (dbus_service_property

800

(new_interface,

801

old_dbusobj._dbus_signature,

802

old_dbusobj._dbus_access,

803

old_dbusobj._dbus_get_args_options["byte_arrays"])

804

(types.FunctionType

805

(old_dbusobj.func_code,

806

old_dbusobj.func_globals,

807

old_dbusobj.func_name,

808

old_dbusobj.func_defaults,

809

old_dbusobj.func_closure)))

810

811

attr[attrname] = new_dbusfunc

812

return type.__new__(mcs, name, bases, attr)

813

670

814

class ClientDBus(Client, DBusObjectWithProperties):

671

815

"""A Client class using D-Bus

672

816

674

818

dbus_object_path: dbus.ObjectPath

675

819

bus: dbus.SystemBus()

676

820

"""

821

822

runtime_expansions = (Client.runtime_expansions

823

+ ("dbus_object_path",))

824

677

825

# dbus.service.Object doesn't use super(), so we can't either.

678

826

679

827

def __init__(self, bus = None, *args, **kwargs):

828

self._approvals_pending = 0

680

829

self.bus = bus

681

830

Client.__init__(self, *args, **kwargs)

682

831

# Only now, when this client is initialized, can it show up on

683

832

# the D-Bus

833

client_object_name = unicode(self.name).translate(

834

{ord("."): ord("_"),

835

ord("-"): ord("_")})

684

836

self.dbus_object_path = (dbus.ObjectPath

685

(u"/clients/"

686

+ self.name.replace(u".", u"_")))

837

("/clients/" + client_object_name))

687

838

DBusObjectWithProperties.__init__(self, self.bus,

688

839

self.dbus_object_path)

689

690

@staticmethod

691

def _datetime_to_dbus(dt, variant_level=0):

692

"""Convert a UTC datetime.datetime() to a D-Bus type."""

693

return dbus.String(dt.isoformat(),

694

variant_level=variant_level)

695

696

def enable(self):

697

oldstate = getattr(self, u"enabled", False)

698

r = Client.enable(self)

699

if oldstate != self.enabled:

700

# Emit D-Bus signals

701

self.PropertyChanged(dbus.String(u"enabled"),

702

dbus.Boolean(True, variant_level=1))

703

self.PropertyChanged(

704

dbus.String(u"last_enabled"),

705

self._datetime_to_dbus(self.last_enabled,

706

variant_level=1))

707

return r

708

709

def disable(self, quiet = False):

710

oldstate = getattr(self, u"enabled", False)

711

r = Client.disable(self, quiet=quiet)

712

if not quiet and oldstate != self.enabled:

713

# Emit D-Bus signal

714

self.PropertyChanged(dbus.String(u"enabled"),

715

dbus.Boolean(False, variant_level=1))

716

return r

840

841

def notifychangeproperty(transform_func,

842

dbus_name, type_func=lambda x: x,

843

variant_level=1):

844

""" Modify a variable so that its a property that announce its

845

changes to DBus.

846

transform_fun: Function that takes a value and transform it to

847

DBus type.

848

dbus_name: DBus name of the variable

849

type_func: Function that transform the value before sending it

850

to DBus

851

variant_level: DBus variant level. default: 1

852

"""

853

real_value = [None,]

854

def setter(self, value):

855

old_value = real_value[0]

856

real_value[0] = value

857

if hasattr(self, "dbus_object_path"):

858

if type_func(old_value) != type_func(real_value[0]):

859

dbus_value = transform_func(type_func(real_value[0]),

860

variant_level)

861

self.PropertyChanged(dbus.String(dbus_name),

862

dbus_value)

863

864

return property(lambda self: real_value[0], setter)

865

866

867

expires = notifychangeproperty(datetime_to_dbus, "Expires")

868

approvals_pending = notifychangeproperty(dbus.Boolean,

869

"ApprovalPending",

870

type_func = bool)

871

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

872

last_enabled = notifychangeproperty(datetime_to_dbus,

873

"LastEnabled")

874

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

875

type_func = lambda checker: checker is not None)

876

last_checked_ok = notifychangeproperty(datetime_to_dbus,

877

"LastCheckedOK")

878

last_approval_request = notifychangeproperty(datetime_to_dbus,

879

"LastApprovalRequest")

880

approved_by_default = notifychangeproperty(dbus.Boolean,

881

"ApprovedByDefault")

882

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

883

type_func = _timedelta_to_milliseconds)

884

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

885

type_func = _timedelta_to_milliseconds)

886

host = notifychangeproperty(dbus.String, "Host")

887

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

888

type_func = _timedelta_to_milliseconds)

889

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

890

type_func = _timedelta_to_milliseconds)

891

interval = notifychangeproperty(dbus.UInt16, "Interval",

892

type_func = _timedelta_to_milliseconds)

893

checker_command = notifychangeproperty(dbus.String, "Checker")

894

895

del notifychangeproperty

717

896

718

897

def __del__(self, *args, **kwargs):

719

898

try:

720

899

self.remove_from_connection()

721

900

except LookupError:

722

901

pass

723

if hasattr(DBusObjectWithProperties, u"__del__"):

902

if hasattr(DBusObjectWithProperties, "__del__"):

724

903

DBusObjectWithProperties.__del__(self, *args, **kwargs)

725

904

Client.__del__(self, *args, **kwargs)

726

905

728

907

*args, **kwargs):

729

908

self.checker_callback_tag = None

730

909

self.checker = None

731

# Emit D-Bus signal

732

self.PropertyChanged(dbus.String(u"checker_running"),

733

dbus.Boolean(False, variant_level=1))

734

910

if os.WIFEXITED(condition):

735

911

exitstatus = os.WEXITSTATUS(condition)

736

912

# Emit D-Bus signal

746

922

return Client.checker_callback(self, pid, condition, command,

747

923

*args, **kwargs)

748

924

749

def checked_ok(self, *args, **kwargs):

750

r = Client.checked_ok(self, *args, **kwargs)

751

# Emit D-Bus signal

752

self.PropertyChanged(

753

dbus.String(u"last_checked_ok"),

754

(self._datetime_to_dbus(self.last_checked_ok,

755

variant_level=1)))

756

return r

757

758

925

def start_checker(self, *args, **kwargs):

759

926

old_checker = self.checker

760

927

if self.checker is not None:

767

934

and old_checker_pid != self.checker.pid):

768

935

# Emit D-Bus signal

769

936

self.CheckerStarted(self.current_checker_command)

770

self.PropertyChanged(

771

dbus.String(u"checker_running"),

772

dbus.Boolean(True, variant_level=1))

773

return r

774

775

def stop_checker(self, *args, **kwargs):

776

old_checker = getattr(self, u"checker", None)

777

r = Client.stop_checker(self, *args, **kwargs)

778

if (old_checker is not None

779

and getattr(self, u"checker", None) is None):

780

self.PropertyChanged(dbus.String(u"checker_running"),

781

dbus.Boolean(False, variant_level=1))

782

return r

783

784

## D-Bus methods & signals

785

_interface = u"se.bsnet.fukt.Mandos.Client"

786

787

# CheckedOK - method

788

@dbus.service.method(_interface)

789

def CheckedOK(self):

790

return self.checked_ok()

937

return r

938

939

def _reset_approved(self):

940

self._approved = None

941

return False

942

943

def approve(self, value=True):

944

self.send_changedstate()

945

self._approved = value

946

gobject.timeout_add(_timedelta_to_milliseconds

947

(self.approval_duration),

948

self._reset_approved)

949

950

951

## D-Bus methods, signals & properties

952

_interface = "se.bsnet.fukt.Mandos.Client"

953

954

## Signals

791

955

792

956

# CheckerCompleted - signal

793

@dbus.service.signal(_interface, signature=u"nxs")

957

@dbus.service.signal(_interface, signature="nxs")

794

958

def CheckerCompleted(self, exitcode, waitstatus, command):

795

959

"D-Bus signal"

796

960

pass

797

961

798

962

# CheckerStarted - signal

799

@dbus.service.signal(_interface, signature=u"s")

963

@dbus.service.signal(_interface, signature="s")

800

964

def CheckerStarted(self, command):

801

965

"D-Bus signal"

802

966

pass

803

967

804

968

# PropertyChanged - signal

805

@dbus.service.signal(_interface, signature=u"sv")

969

@dbus.service.signal(_interface, signature="sv")

806

970

def PropertyChanged(self, property, value):

807

971

"D-Bus signal"

808

972

pass

810

974

# GotSecret - signal

811

975

@dbus.service.signal(_interface)

812

976

def GotSecret(self):

813

"D-Bus signal"

977

"""D-Bus signal

978

Is sent after a successful transfer of secret from the Mandos

979

server to mandos-client

980

"""

814

981

pass

815

982

816

983

# Rejected - signal

817

@dbus.service.signal(_interface)

818

def Rejected(self):

984

@dbus.service.signal(_interface, signature="s")

985

def Rejected(self, reason):

819

986

"D-Bus signal"

820

987

pass

821

988

989

# NeedApproval - signal

990

@dbus.service.signal(_interface, signature="tb")

991

def NeedApproval(self, timeout, default):

992

"D-Bus signal"

993

return self.need_approval()

994

995

## Methods

996

997

# Approve - method

998

@dbus.service.method(_interface, in_signature="b")

999

def Approve(self, value):

1000

self.approve(value)

1001

1002

# CheckedOK - method

1003

@dbus.service.method(_interface)

1004

def CheckedOK(self):

1005

self.checked_ok()

1006

822

1007

# Enable - method

823

1008

@dbus.service.method(_interface)

824

1009

def Enable(self):

842

1027

def StopChecker(self):

843

1028

self.stop_checker()

844

1029

845

# name - property

846

@dbus_service_property(_interface, signature=u"s", access=u"read")

847

def name_dbus_property(self):

1030

## Properties

1031

1032

# ApprovalPending - property

1033

@dbus_service_property(_interface, signature="b", access="read")

1034

def ApprovalPending_dbus_property(self):

1035

return dbus.Boolean(bool(self.approvals_pending))

1036

1037

# ApprovedByDefault - property

1038

@dbus_service_property(_interface, signature="b",

1039

access="readwrite")

1040

def ApprovedByDefault_dbus_property(self, value=None):

1041

if value is None: # get

1042

return dbus.Boolean(self.approved_by_default)

1043

self.approved_by_default = bool(value)

1044

1045

# ApprovalDelay - property

1046

@dbus_service_property(_interface, signature="t",

1047

access="readwrite")

1048

def ApprovalDelay_dbus_property(self, value=None):

1049

if value is None: # get

1050

return dbus.UInt64(self.approval_delay_milliseconds())

1051

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1052

1053

# ApprovalDuration - property

1054

@dbus_service_property(_interface, signature="t",

1055

access="readwrite")

1056

def ApprovalDuration_dbus_property(self, value=None):

1057

if value is None: # get

1058

return dbus.UInt64(_timedelta_to_milliseconds(

1059

self.approval_duration))

1060

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1061

1062

# Name - property

1063

@dbus_service_property(_interface, signature="s", access="read")

1064

def Name_dbus_property(self):

848

1065

return dbus.String(self.name)

849

1066

850

# fingerprint - property

851

@dbus_service_property(_interface, signature=u"s", access=u"read")

852

def fingerprint_dbus_property(self):

1067

# Fingerprint - property

1068

@dbus_service_property(_interface, signature="s", access="read")

1069

def Fingerprint_dbus_property(self):

853

1070

return dbus.String(self.fingerprint)

854

1071

855

# host - property

856

@dbus_service_property(_interface, signature=u"s",

857

access=u"readwrite")

858

def host_dbus_property(self, value=None):

1072

# Host - property

1073

@dbus_service_property(_interface, signature="s",

1074

access="readwrite")

1075

def Host_dbus_property(self, value=None):

859

1076

if value is None: # get

860

1077

return dbus.String(self.host)

861

1078

self.host = value

862

# Emit D-Bus signal

863

self.PropertyChanged(dbus.String(u"host"),

864

dbus.String(value, variant_level=1))

865

866

# created - property

867

@dbus_service_property(_interface, signature=u"s", access=u"read")

868

def created_dbus_property(self):

869

return dbus.String(self._datetime_to_dbus(self.created))

870

871

# last_enabled - property

872

@dbus_service_property(_interface, signature=u"s", access=u"read")

873

def last_enabled_dbus_property(self):

874

if self.last_enabled is None:

875

return dbus.String(u"")

876

return dbus.String(self._datetime_to_dbus(self.last_enabled))

877

878

# enabled - property

879

@dbus_service_property(_interface, signature=u"b",

880

access=u"readwrite")

881

def enabled_dbus_property(self, value=None):

1079

1080

# Created - property

1081

@dbus_service_property(_interface, signature="s", access="read")

1082

def Created_dbus_property(self):

1083

return dbus.String(datetime_to_dbus(self.created))

1084

1085

# LastEnabled - property

1086

@dbus_service_property(_interface, signature="s", access="read")

1087

def LastEnabled_dbus_property(self):

1088

return datetime_to_dbus(self.last_enabled)

1089

1090

# Enabled - property

1091

@dbus_service_property(_interface, signature="b",

1092

access="readwrite")

1093

def Enabled_dbus_property(self, value=None):

882

1094

if value is None: # get

883

1095

return dbus.Boolean(self.enabled)

884

1096

if value:

886

1098

else:

887

1099

self.disable()

888

1100

889

# last_checked_ok - property

890

@dbus_service_property(_interface, signature=u"s",

891

access=u"readwrite")

892

def last_checked_ok_dbus_property(self, value=None):

1101

# LastCheckedOK - property

1102

@dbus_service_property(_interface, signature="s",

1103

access="readwrite")

1104

def LastCheckedOK_dbus_property(self, value=None):

893

1105

if value is not None:

894

1106

self.checked_ok()

895

1107

return

896

if self.last_checked_ok is None:

897

return dbus.String(u"")

898

return dbus.String(self._datetime_to_dbus(self

899

.last_checked_ok))

900

901

# timeout - property

902

@dbus_service_property(_interface, signature=u"t",

903

access=u"readwrite")

904

def timeout_dbus_property(self, value=None):

1108

return datetime_to_dbus(self.last_checked_ok)

1109

1110

# Expires - property

1111

@dbus_service_property(_interface, signature="s", access="read")

1112

def Expires_dbus_property(self):

1113

return datetime_to_dbus(self.expires)

1114

1115

# LastApprovalRequest - property

1116

@dbus_service_property(_interface, signature="s", access="read")

1117

def LastApprovalRequest_dbus_property(self):

1118

return datetime_to_dbus(self.last_approval_request)

1119

1120

# Timeout - property

1121

@dbus_service_property(_interface, signature="t",

1122

access="readwrite")

1123

def Timeout_dbus_property(self, value=None):

905

1124

if value is None: # get

906

1125

return dbus.UInt64(self.timeout_milliseconds())

907

1126

self.timeout = datetime.timedelta(0, 0, 0, value)

908

# Emit D-Bus signal

909

self.PropertyChanged(dbus.String(u"timeout"),

910

dbus.UInt64(value, variant_level=1))

911

if getattr(self, u"disable_initiator_tag", None) is None:

1127

if getattr(self, "disable_initiator_tag", None) is None:

912

1128

return

913

1129

# Reschedule timeout

914

1130

gobject.source_remove(self.disable_initiator_tag)

915

1131

self.disable_initiator_tag = None

1132

self.expires = None

916

1133

time_to_die = (self.

917

1134

_timedelta_to_milliseconds((self

918

1135

.last_checked_ok

923

1140

# The timeout has passed

924

1141

self.disable()

925

1142

else:

1143

self.expires = (datetime.datetime.utcnow()

1144

+ datetime.timedelta(milliseconds = time_to_die))

926

1145

self.disable_initiator_tag = (gobject.timeout_add

927

1146

(time_to_die, self.disable))

928

1147

929

# interval - property

930

@dbus_service_property(_interface, signature=u"t",

931

access=u"readwrite")

932

def interval_dbus_property(self, value=None):

1148

# ExtendedTimeout - property

1149

@dbus_service_property(_interface, signature="t",

1150

access="readwrite")

1151

def ExtendedTimeout_dbus_property(self, value=None):

1152

if value is None: # get

1153

return dbus.UInt64(self.extended_timeout_milliseconds())

1154

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1155

1156

# Interval - property

1157

@dbus_service_property(_interface, signature="t",

1158

access="readwrite")

1159

def Interval_dbus_property(self, value=None):

933

1160

if value is None: # get

934

1161

return dbus.UInt64(self.interval_milliseconds())

935

1162

self.interval = datetime.timedelta(0, 0, 0, value)

936

# Emit D-Bus signal

937

self.PropertyChanged(dbus.String(u"interval"),

938

dbus.UInt64(value, variant_level=1))

939

if getattr(self, u"checker_initiator_tag", None) is None:

1163

if getattr(self, "checker_initiator_tag", None) is None:

940

1164

return

941

1165

# Reschedule checker run

942

1166

gobject.source_remove(self.checker_initiator_tag)

943

1167

self.checker_initiator_tag = (gobject.timeout_add

944

1168

(value, self.start_checker))

945

1169

self.start_checker() # Start one now, too

946

947

# checker - property

948

@dbus_service_property(_interface, signature=u"s",

949

access=u"readwrite")

950

def checker_dbus_property(self, value=None):

1170

1171

# Checker - property

1172

@dbus_service_property(_interface, signature="s",

1173

access="readwrite")

1174

def Checker_dbus_property(self, value=None):

951

1175

if value is None: # get

952

1176

return dbus.String(self.checker_command)

953

1177

self.checker_command = value

954

# Emit D-Bus signal

955

self.PropertyChanged(dbus.String(u"checker"),

956

dbus.String(self.checker_command,

957

variant_level=1))

958

1178

959

# checker_running - property

960

@dbus_service_property(_interface, signature=u"b",

961

access=u"readwrite")

962

def checker_running_dbus_property(self, value=None):

1179

# CheckerRunning - property

1180

@dbus_service_property(_interface, signature="b",

1181

access="readwrite")

1182

def CheckerRunning_dbus_property(self, value=None):

963

1183

if value is None: # get

964

1184

return dbus.Boolean(self.checker is not None)

965

1185

if value:

967

1187

else:

968

1188

self.stop_checker()

969

1189

970

# object_path - property

971

@dbus_service_property(_interface, signature=u"o", access=u"read")

972

def object_path_dbus_property(self):

1190

# ObjectPath - property

1191

@dbus_service_property(_interface, signature="o", access="read")

1192

def ObjectPath_dbus_property(self):

973

1193

return self.dbus_object_path # is already a dbus.ObjectPath

974

1194

975

# secret = property

976

@dbus_service_property(_interface, signature=u"ay",

977

access=u"write", byte_arrays=True)

978

def secret_dbus_property(self, value):

1195

# Secret = property

1196

@dbus_service_property(_interface, signature="ay",

1197

access="write", byte_arrays=True)

1198

def Secret_dbus_property(self, value):

979

1199

self.secret = str(value)

980

1200

981

1201

del _interface

982

1202

983

1203

1204

class ProxyClient(object):

1205

def __init__(self, child_pipe, fpr, address):

1206

self._pipe = child_pipe

1207

self._pipe.send(('init', fpr, address))

1208

if not self._pipe.recv():

1209

raise KeyError()

1210

1211

def __getattribute__(self, name):

1212

if(name == '_pipe'):

1213

return super(ProxyClient, self).__getattribute__(name)

1214

self._pipe.send(('getattr', name))

1215

data = self._pipe.recv()

1216

if data[0] == 'data':

1217

return data[1]

1218

if data[0] == 'function':

1219

def func(*args, **kwargs):

1220

self._pipe.send(('funcall', name, args, kwargs))

1221

return self._pipe.recv()[1]

1222

return func

1223

1224

def __setattr__(self, name, value):

1225

if(name == '_pipe'):

1226

return super(ProxyClient, self).__setattr__(name, value)

1227

self._pipe.send(('setattr', name, value))

1228

1229

class ClientDBusTransitional(ClientDBus):

1230

__metaclass__ = transitional_dbus_metaclass

1231

984

1232

class ClientHandler(socketserver.BaseRequestHandler, object):

985

1233

"""A class to handle client connections.

986

1234

988

1236

Note: This will run in its own forked process."""

989

1237

990

1238

def handle(self):

991

logger.info(u"TCP connection from: %s",

992

unicode(self.client_address))

993

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

994

# Open IPC pipe to parent process

995

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

1239

with contextlib.closing(self.server.child_pipe) as child_pipe:

1240

logger.info("TCP connection from: %s",

1241

unicode(self.client_address))

1242

logger.debug("Pipe FD: %d",

1243

self.server.child_pipe.fileno())

1244

996

1245

session = (gnutls.connection

997

1246

.ClientSession(self.request,

998

1247

gnutls.connection

999

1248

.X509Credentials()))

1000

1249

1001

line = self.request.makefile().readline()

1002

logger.debug(u"Protocol version: %r", line)

1003

try:

1004

if int(line.strip().split()[0]) > 1:

1005

raise RuntimeError

1006

except (ValueError, IndexError, RuntimeError), error:

1007

logger.error(u"Unknown protocol version: %s", error)

1008

return

1009

1010

1250

# Note: gnutls.connection.X509Credentials is really a

1011

1251

# generic GnuTLS certificate credentials object so long as

1012

1252

# no X.509 keys are added to it. Therefore, we can use it

1013

1253

# here despite using OpenPGP certificates.

1014

1254

1015

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1016

# u"+AES-256-CBC", u"+SHA1",

1017

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1018

# u"+DHE-DSS"))

1255

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1256

# "+AES-256-CBC", "+SHA1",

1257

# "+COMP-NULL", "+CTYPE-OPENPGP",

1258

# "+DHE-DSS"))

1019

1259

# Use a fallback default, since this MUST be set.

1020

1260

priority = self.server.gnutls_priority

1021

1261

if priority is None:

1022

priority = u"NORMAL"

1262

priority = "NORMAL"

1023

1263

(gnutls.library.functions

1024

1264

.gnutls_priority_set_direct(session._c_object,

1025

1265

priority, None))

1026

1266

1267

# Start communication using the Mandos protocol

1268

# Get protocol number

1269

line = self.request.makefile().readline()

1270

logger.debug("Protocol version: %r", line)

1271

try:

1272

if int(line.strip().split()[0]) > 1:

1273

raise RuntimeError

1274

except (ValueError, IndexError, RuntimeError) as error:

1275

logger.error("Unknown protocol version: %s", error)

1276

return

1277

1278

# Start GnuTLS connection

1027

1279

try:

1028

1280

session.handshake()

1029

except gnutls.errors.GNUTLSError, error:

1030

logger.warning(u"Handshake failed: %s", error)

1281

except gnutls.errors.GNUTLSError as error:

1282

logger.warning("Handshake failed: %s", error)

1031

1283

# Do not run session.bye() here: the session is not

1032

1284

# established. Just abandon the request.

1033

1285

return

1034

logger.debug(u"Handshake succeeded")

1286

logger.debug("Handshake succeeded")

1287

1288

approval_required = False

1035

1289

try:

1036

fpr = self.fingerprint(self.peer_certificate(session))

1037

except (TypeError, gnutls.errors.GNUTLSError), error:

1038

logger.warning(u"Bad certificate: %s", error)

1039

session.bye()

1040

return

1041

logger.debug(u"Fingerprint: %s", fpr)

1290

try:

1291

fpr = self.fingerprint(self.peer_certificate

1292

(session))

1293

except (TypeError,

1294

gnutls.errors.GNUTLSError) as error:

1295

logger.warning("Bad certificate: %s", error)

1296

return

1297

logger.debug("Fingerprint: %s", fpr)

1298

1299

try:

1300

client = ProxyClient(child_pipe, fpr,

1301

self.client_address)

1302

except KeyError:

1303

return

1304

1305

if client.approval_delay:

1306

delay = client.approval_delay

1307

client.approvals_pending += 1

1308

approval_required = True

1309

1310

while True:

1311

if not client.enabled:

1312

logger.info("Client %s is disabled",

1313

client.name)

1314

if self.server.use_dbus:

1315

# Emit D-Bus signal

1316

client.Rejected("Disabled")

1317

return

1318

1319

if client._approved or not client.approval_delay:

1320

#We are approved or approval is disabled

1321

break

1322

elif client._approved is None:

1323

logger.info("Client %s needs approval",

1324

client.name)

1325

if self.server.use_dbus:

1326

# Emit D-Bus signal

1327

client.NeedApproval(

1328

client.approval_delay_milliseconds(),

1329

client.approved_by_default)

1330

else:

1331

logger.warning("Client %s was not approved",

1332

client.name)

1333

if self.server.use_dbus:

1334

# Emit D-Bus signal

1335

client.Rejected("Denied")

1336

return

1337

1338

#wait until timeout or approved

1339

#x = float(client._timedelta_to_milliseconds(delay))

1340

time = datetime.datetime.now()

1341

client.changedstate.acquire()

1342

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1343

client.changedstate.release()

1344

time2 = datetime.datetime.now()

1345

if (time2 - time) >= delay:

1346

if not client.approved_by_default:

1347

logger.warning("Client %s timed out while"

1348

" waiting for approval",

1349

client.name)

1350

if self.server.use_dbus:

1351

# Emit D-Bus signal

1352

client.Rejected("Approval timed out")

1353

return

1354

else:

1355

break

1356

else:

1357

delay -= time2 - time

1358

1359

sent_size = 0

1360

while sent_size < len(client.secret):

1361

try:

1362

sent = session.send(client.secret[sent_size:])

1363

except gnutls.errors.GNUTLSError as error:

1364

logger.warning("gnutls send failed")

1365

return

1366

logger.debug("Sent: %d, remaining: %d",

1367

sent, len(client.secret)

1368

- (sent_size + sent))

1369

sent_size += sent

1370

1371

logger.info("Sending secret to %s", client.name)

1372

# bump the timeout as if seen

1373

client.checked_ok(client.extended_timeout)

1374

if self.server.use_dbus:

1375

# Emit D-Bus signal

1376

client.GotSecret()

1042

1377

1043

for c in self.server.clients:

1044

if c.fingerprint == fpr:

1045

client = c

1046

break

1047

else:

1048

ipc.write(u"NOTFOUND %s %s\n"

1049

% (fpr, unicode(self.client_address)))

1050

session.bye()

1051

return

1052

# Have to check if client.still_valid(), since it is

1053

# possible that the client timed out while establishing

1054

# the GnuTLS session.

1055

if not client.still_valid():

1056

ipc.write(u"INVALID %s\n" % client.name)

1057

session.bye()

1058

return

1059

ipc.write(u"SENDING %s\n" % client.name)

1060

sent_size = 0

1061

while sent_size < len(client.secret):

1062

sent = session.send(client.secret[sent_size:])

1063

logger.debug(u"Sent: %d, remaining: %d",

1064

sent, len(client.secret)

1065

- (sent_size + sent))

1066

sent_size += sent

1067

session.bye()

1378

finally:

1379

if approval_required:

1380

client.approvals_pending -= 1

1381

try:

1382

session.bye()

1383

except gnutls.errors.GNUTLSError as error:

1384

logger.warning("GnuTLS bye failed")

1068

1385

1069

1386

@staticmethod

1070

1387

def peer_certificate(session):

1080

1397

.gnutls_certificate_get_peers

1081

1398

(session._c_object, ctypes.byref(list_size)))

1082

1399

if not bool(cert_list) and list_size.value != 0:

1083

raise gnutls.errors.GNUTLSError(u"error getting peer"

1084

u" certificate")

1400

raise gnutls.errors.GNUTLSError("error getting peer"

1401

" certificate")

1085

1402

if list_size.value == 0:

1086

1403

return None

1087

1404

cert = cert_list[0]

1113

1430

if crtverify.value != 0:

1114

1431

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1115

1432

raise (gnutls.errors.CertificateSecurityError

1116

(u"Verify failed"))

1433

("Verify failed"))

1117

1434

# New buffer for the fingerprint

1118

1435

buf = ctypes.create_string_buffer(20)

1119

1436

buf_len = ctypes.c_size_t()

1126

1443

# Convert the buffer to a Python bytestring

1127

1444

fpr = ctypes.string_at(buf, buf_len.value)

1128

1445

# Convert the bytestring to hexadecimal notation

1129

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1446

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1130

1447

return hex_fpr

1131

1448

1132

1449

1133

class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):

1134

"""Like socketserver.ForkingMixIn, but also pass a pipe."""

1450

class MultiprocessingMixIn(object):

1451

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1452

def sub_process_main(self, request, address):

1453

try:

1454

self.finish_request(request, address)

1455

except:

1456

self.handle_error(request, address)

1457

self.close_request(request)

1458

1459

def process_request(self, request, address):

1460

"""Start a new process to process the request."""

1461

multiprocessing.Process(target = self.sub_process_main,

1462

args = (request, address)).start()

1463

1464

1465

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1466

""" adds a pipe to the MixIn """

1135

1467

def process_request(self, request, client_address):

1136

1468

"""Overrides and wraps the original process_request().

1137

1469

1138

1470

This function creates a new pipe in self.pipe

1139

1471

"""

1140

self.pipe = os.pipe()

1141

super(ForkingMixInWithPipe,

1472

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1473

1474

super(MultiprocessingMixInWithPipe,

1142

1475

self).process_request(request, client_address)

1143

os.close(self.pipe[1]) # close write end

1144

self.add_pipe(self.pipe[0])

1145

def add_pipe(self, pipe):

1476

self.child_pipe.close()

1477

self.add_pipe(parent_pipe)

1478

1479

def add_pipe(self, parent_pipe):

1146

1480

"""Dummy function; override as necessary"""

1147

os.close(pipe)

1148

1149

1150

class IPv6_TCPServer(ForkingMixInWithPipe,

1481

raise NotImplementedError

1482

1483

1484

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1151

1485

socketserver.TCPServer, object):

1152

1486

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1153

1487

1169

1503

bind to an address or port if they were not specified."""

1170

1504

if self.interface is not None:

1171

1505

if SO_BINDTODEVICE is None:

1172

logger.error(u"SO_BINDTODEVICE does not exist;"

1173

u" cannot bind to interface %s",

1506

logger.error("SO_BINDTODEVICE does not exist;"

1507

" cannot bind to interface %s",

1174

1508

self.interface)

1175

1509

else:

1176

1510

try:

1177

1511

self.socket.setsockopt(socket.SOL_SOCKET,

1178

1512

SO_BINDTODEVICE,

1179

1513

str(self.interface

1180

+ u'\0'))

1181

except socket.error, error:

1514

+ '\0'))

1515

except socket.error as error:

1182

1516

if error[0] == errno.EPERM:

1183

logger.error(u"No permission to"

1184

u" bind to interface %s",

1517

logger.error("No permission to"

1518

" bind to interface %s",

1185

1519

self.interface)

1186

1520

elif error[0] == errno.ENOPROTOOPT:

1187

logger.error(u"SO_BINDTODEVICE not available;"

1188

u" cannot bind to interface %s",

1521

logger.error("SO_BINDTODEVICE not available;"

1522

" cannot bind to interface %s",

1189

1523

self.interface)

1190

1524

else:

1191

1525

raise

1193

1527

if self.server_address[0] or self.server_address[1]:

1194

1528

if not self.server_address[0]:

1195

1529

if self.address_family == socket.AF_INET6:

1196

any_address = u"::" # in6addr_any

1530

any_address = "::" # in6addr_any

1197

1531

else:

1198

1532

any_address = socket.INADDR_ANY

1199

1533

self.server_address = (any_address,

1238

1572

return socketserver.TCPServer.server_activate(self)

1239

1573

def enable(self):

1240

1574

self.enabled = True

1241

def add_pipe(self, pipe):

1575

def add_pipe(self, parent_pipe):

1242

1576

# Call "handle_ipc" for both data and EOF events

1243

gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,

1244

self.handle_ipc)

1245

def handle_ipc(self, source, condition, file_objects={}):

1577

gobject.io_add_watch(parent_pipe.fileno(),

1578

gobject.IO_IN | gobject.IO_HUP,

1579

functools.partial(self.handle_ipc,

1580

parent_pipe = parent_pipe))

1581

1582

def handle_ipc(self, source, condition, parent_pipe=None,

1583

client_object=None):

1246

1584

condition_names = {

1247

gobject.IO_IN: u"IN", # There is data to read.

1248

gobject.IO_OUT: u"OUT", # Data can be written (without

1585

gobject.IO_IN: "IN", # There is data to read.

1586

gobject.IO_OUT: "OUT", # Data can be written (without

1249

1587

# blocking).

1250

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1251

gobject.IO_ERR: u"ERR", # Error condition.

1252

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1588

gobject.IO_PRI: "PRI", # There is urgent data to read.

1589

gobject.IO_ERR: "ERR", # Error condition.

1590

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1253

1591

# broken, usually for pipes and

1254

1592

# sockets).

1255

1593

}

1257

1595

for cond, name in

1258

1596

condition_names.iteritems()

1259

1597

if cond & condition)

1260

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1261

conditions_string)

1262

1263

# Turn the pipe file descriptor into a Python file object

1264

if source not in file_objects:

1265

file_objects[source] = os.fdopen(source, u"r", 1)

1266

1267

# Read a line from the file object

1268

cmdline = file_objects[source].readline()

1269

if not cmdline: # Empty line means end of file

1270

# close the IPC pipe

1271

file_objects[source].close()

1272

del file_objects[source]

1273

1274

# Stop calling this function

1275

return False

1276

1277

logger.debug(u"IPC command: %r", cmdline)

1278

1279

# Parse and act on command

1280

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1281

1282

if cmd == u"NOTFOUND":

1283

logger.warning(u"Client not found for fingerprint: %s",

1284

args)

1285

if self.use_dbus:

1286

# Emit D-Bus signal

1287

mandos_dbus_service.ClientNotFound(args)

1288

elif cmd == u"INVALID":

1289

for client in self.clients:

1290

if client.name == args:

1291

logger.warning(u"Client %s is invalid", args)

1292

if self.use_dbus:

1293

# Emit D-Bus signal

1294

client.Rejected()

1295

break

1296

else:

1297

logger.error(u"Unknown client %s is invalid", args)

1298

elif cmd == u"SENDING":

1299

for client in self.clients:

1300

if client.name == args:

1301

logger.info(u"Sending secret to %s", client.name)

1302

client.checked_ok()

1303

if self.use_dbus:

1304

# Emit D-Bus signal

1305

client.GotSecret()

1306

break

1307

else:

1308

logger.error(u"Sending secret to unknown client %s",

1309

args)

1310

else:

1311

logger.error(u"Unknown IPC command: %r", cmdline)

1312

1313

# Keep calling this function

1598

# error or the other end of multiprocessing.Pipe has closed

1599

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1600

return False

1601

1602

# Read a request from the child

1603

request = parent_pipe.recv()

1604

command = request[0]

1605

1606

if command == 'init':

1607

fpr = request[1]

1608

address = request[2]

1609

1610

for c in self.clients:

1611

if c.fingerprint == fpr:

1612

client = c

1613

break

1614

else:

1615

logger.info("Client not found for fingerprint: %s, ad"

1616

"dress: %s", fpr, address)

1617

if self.use_dbus:

1618

# Emit D-Bus signal

1619

mandos_dbus_service.ClientNotFound(fpr, address[0])

1620

parent_pipe.send(False)

1621

return False

1622

1623

gobject.io_add_watch(parent_pipe.fileno(),

1624

gobject.IO_IN | gobject.IO_HUP,

1625

functools.partial(self.handle_ipc,

1626

parent_pipe = parent_pipe,

1627

client_object = client))

1628

parent_pipe.send(True)

1629

# remove the old hook in favor of the new above hook on same fileno

1630

return False

1631

if command == 'funcall':

1632

funcname = request[1]

1633

args = request[2]

1634

kwargs = request[3]

1635

1636

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1637

1638

if command == 'getattr':

1639

attrname = request[1]

1640

if callable(client_object.__getattribute__(attrname)):

1641

parent_pipe.send(('function',))

1642

else:

1643

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1644

1645

if command == 'setattr':

1646

attrname = request[1]

1647

value = request[2]

1648

setattr(client_object, attrname, value)

1649

1314

1650

return True

1315

1651

1316

1652

1317

1653

def string_to_delta(interval):

1318

1654

"""Parse a string and return a datetime.timedelta

1319

1655

1320

>>> string_to_delta(u'7d')

1656

>>> string_to_delta('7d')

1321

1657

datetime.timedelta(7)

1322

>>> string_to_delta(u'60s')

1658

>>> string_to_delta('60s')

1323

1659

datetime.timedelta(0, 60)

1324

>>> string_to_delta(u'60m')

1660

>>> string_to_delta('60m')

1325

1661

datetime.timedelta(0, 3600)

1326

>>> string_to_delta(u'24h')

1662

>>> string_to_delta('24h')

1327

1663

datetime.timedelta(1)

1328

>>> string_to_delta(u'1w')

1664

>>> string_to_delta('1w')

1329

1665

datetime.timedelta(7)

1330

>>> string_to_delta(u'5m 30s')

1666

>>> string_to_delta('5m 30s')

1331

1667

datetime.timedelta(0, 330)

1332

1668

"""

1333

1669

timevalue = datetime.timedelta(0)

1335

1671

try:

1336

1672

suffix = unicode(s[-1])

1337

1673

value = int(s[:-1])

1338

if suffix == u"d":

1674

if suffix == "d":

1339

1675

delta = datetime.timedelta(value)

1340

elif suffix == u"s":

1676

elif suffix == "s":

1341

1677

delta = datetime.timedelta(0, value)

1342

elif suffix == u"m":

1678

elif suffix == "m":

1343

1679

delta = datetime.timedelta(0, 0, 0, 0, value)

1344

elif suffix == u"h":

1680

elif suffix == "h":

1345

1681

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1346

elif suffix == u"w":

1682

elif suffix == "w":

1347

1683

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1348

1684

else:

1349

raise ValueError(u"Unknown suffix %r" % suffix)

1350

except (ValueError, IndexError), e:

1351

raise ValueError(e.message)

1685

raise ValueError("Unknown suffix %r" % suffix)

1686

except (ValueError, IndexError) as e:

1687

raise ValueError(*(e.args))

1352

1688

timevalue += delta

1353

1689

return timevalue

1354

1690

1360

1696

global if_nametoindex

1361

1697

try:

1362

1698

if_nametoindex = (ctypes.cdll.LoadLibrary

1363

(ctypes.util.find_library(u"c"))

1699

(ctypes.util.find_library("c"))

1364

1700

.if_nametoindex)

1365

1701

except (OSError, AttributeError):

1366

logger.warning(u"Doing if_nametoindex the hard way")

1702

logger.warning("Doing if_nametoindex the hard way")

1367

1703

def if_nametoindex(interface):

1368

1704

"Get an interface index the hard way, i.e. using fcntl()"

1369

1705

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1370

with closing(socket.socket()) as s:

1706

with contextlib.closing(socket.socket()) as s:

1371

1707

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1372

struct.pack(str(u"16s16x"),

1708

struct.pack(str("16s16x"),

1373

1709

interface))

1374

interface_index = struct.unpack(str(u"I"),

1710

interface_index = struct.unpack(str("I"),

1375

1711

ifreq[16:20])[0]

1376

1712

return interface_index

1377

1713

return if_nametoindex(interface)

1385

1721

sys.exit()

1386

1722

os.setsid()

1387

1723

if not nochdir:

1388

os.chdir(u"/")

1724

os.chdir("/")

1389

1725

if os.fork():

1390

1726

sys.exit()

1391

1727

if not noclose:

1393

1729

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1394

1730

if not stat.S_ISCHR(os.fstat(null).st_mode):

1395

1731

raise OSError(errno.ENODEV,

1396

u"%s not a character device"

1732

"%s not a character device"

1397

1733

% os.path.devnull)

1398

1734

os.dup2(null, sys.stdin.fileno())

1399

1735

os.dup2(null, sys.stdout.fileno())

1407

1743

##################################################################

1408

1744

# Parsing of options, both command line and config file

1409

1745

1410

parser = optparse.OptionParser(version = "%%prog %s" % version)

1411

parser.add_option("-i", u"--interface", type=u"string",

1412

metavar="IF", help=u"Bind to interface IF")

1413

parser.add_option("-a", u"--address", type=u"string",

1414

help=u"Address to listen for requests on")

1415

parser.add_option("-p", u"--port", type=u"int",

1416

help=u"Port number to receive requests on")

1417

parser.add_option("--check", action=u"store_true",

1418

help=u"Run self-test")

1419

parser.add_option("--debug", action=u"store_true",

1420

help=u"Debug mode; run in foreground and log to"

1421

u" terminal")

1422

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1423

u" priority string (see GnuTLS documentation)")

1424

parser.add_option("--servicename", type=u"string",

1425

metavar=u"NAME", help=u"Zeroconf service name")

1426

parser.add_option("--configdir", type=u"string",

1427

default=u"/etc/mandos", metavar=u"DIR",

1428

help=u"Directory to search for configuration"

1429

u" files")

1430

parser.add_option("--no-dbus", action=u"store_false",

1431

dest=u"use_dbus", help=u"Do not provide D-Bus"

1432

u" system bus interface")

1433

parser.add_option("--no-ipv6", action=u"store_false",

1434

dest=u"use_ipv6", help=u"Do not use IPv6")

1435

options = parser.parse_args()[0]

1746

parser = argparse.ArgumentParser()

1747

parser.add_argument("-v", "--version", action="version",

1748

version = "%%(prog)s %s" % version,

1749

help="show version number and exit")

1750

parser.add_argument("-i", "--interface", metavar="IF",

1751

help="Bind to interface IF")

1752

parser.add_argument("-a", "--address",

1753

help="Address to listen for requests on")

1754

parser.add_argument("-p", "--port", type=int,

1755

help="Port number to receive requests on")

1756

parser.add_argument("--check", action="store_true",

1757

help="Run self-test")

1758

parser.add_argument("--debug", action="store_true",

1759

help="Debug mode; run in foreground and log"

1760

" to terminal")

1761

parser.add_argument("--debuglevel", metavar="LEVEL",

1762

help="Debug level for stdout output")

1763

parser.add_argument("--priority", help="GnuTLS"

1764

" priority string (see GnuTLS documentation)")

1765

parser.add_argument("--servicename",

1766

metavar="NAME", help="Zeroconf service name")

1767

parser.add_argument("--configdir",

1768

default="/etc/mandos", metavar="DIR",

1769

help="Directory to search for configuration"

1770

" files")

1771

parser.add_argument("--no-dbus", action="store_false",

1772

dest="use_dbus", help="Do not provide D-Bus"

1773

" system bus interface")

1774

parser.add_argument("--no-ipv6", action="store_false",

1775

dest="use_ipv6", help="Do not use IPv6")

1776

options = parser.parse_args()

1436

1777

1437

1778

if options.check:

1438

1779

import doctest

1440

1781

sys.exit()

1441

1782

1442

1783

# Default values for config file for server-global settings

1443

server_defaults = { u"interface": u"",

1444

u"address": u"",

1445

u"port": u"",

1446

u"debug": u"False",

1447

u"priority":

1448

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1449

u"servicename": u"Mandos",

1450

u"use_dbus": u"True",

1451

u"use_ipv6": u"True",

1784

server_defaults = { "interface": "",

1785

"address": "",

1786

"port": "",

1787

"debug": "False",

1788

"priority":

1789

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1790

"servicename": "Mandos",

1791

"use_dbus": "True",

1792

"use_ipv6": "True",

1793

"debuglevel": "",

1452

1794

}

1453

1795

1454

1796

# Parse config file for server-global settings

1455

1797

server_config = configparser.SafeConfigParser(server_defaults)

1456

1798

del server_defaults

1457

1799

server_config.read(os.path.join(options.configdir,

1458

u"mandos.conf"))

1800

"mandos.conf"))

1459

1801

# Convert the SafeConfigParser object to a dict

1460

1802

server_settings = server_config.defaults()

1461

1803

# Use the appropriate methods on the non-string config options

1462

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1463

server_settings[option] = server_config.getboolean(u"DEFAULT",

1804

for option in ("debug", "use_dbus", "use_ipv6"):

1805

server_settings[option] = server_config.getboolean("DEFAULT",

1464

1806

option)

1465

1807

if server_settings["port"]:

1466

server_settings["port"] = server_config.getint(u"DEFAULT",

1467

u"port")

1808

server_settings["port"] = server_config.getint("DEFAULT",

1809

"port")

1468

1810

del server_config

1469

1811

1470

1812

# Override the settings from the config file with command line

1471

1813

# options, if set.

1472

for option in (u"interface", u"address", u"port", u"debug",

1473

u"priority", u"servicename", u"configdir",

1474

u"use_dbus", u"use_ipv6"):

1814

for option in ("interface", "address", "port", "debug",

1815

"priority", "servicename", "configdir",

1816

"use_dbus", "use_ipv6", "debuglevel"):

1475

1817

value = getattr(options, option)

1476

1818

if value is not None:

1477

1819

server_settings[option] = value

1485

1827

##################################################################

1486

1828

1487

1829

# For convenience

1488

debug = server_settings[u"debug"]

1489

use_dbus = server_settings[u"use_dbus"]

1490

use_ipv6 = server_settings[u"use_ipv6"]

1491

1492

if not debug:

1493

syslogger.setLevel(logging.WARNING)

1494

console.setLevel(logging.WARNING)

1495

1496

if server_settings[u"servicename"] != u"Mandos":

1830

debug = server_settings["debug"]

1831

debuglevel = server_settings["debuglevel"]

1832

use_dbus = server_settings["use_dbus"]

1833

use_ipv6 = server_settings["use_ipv6"]

1834

1835

if server_settings["servicename"] != "Mandos":

1497

1836

syslogger.setFormatter(logging.Formatter

1498

(u'Mandos (%s) [%%(process)d]:'

1499

u' %%(levelname)s: %%(message)s'

1500

% server_settings[u"servicename"]))

1837

('Mandos (%s) [%%(process)d]:'

1838

' %%(levelname)s: %%(message)s'

1839

% server_settings["servicename"]))

1501

1840

1502

1841

# Parse config file with clients

1503

client_defaults = { u"timeout": u"1h",

1504

u"interval": u"5m",

1505

u"checker": u"fping -q -- %%(host)s",

1506

u"host": u"",

1842

client_defaults = { "timeout": "5m",

1843

"extended_timeout": "15m",

1844

"interval": "2m",

1845

"checker": "fping -q -- %%(host)s",

1846

"host": "",

1847

"approval_delay": "0s",

1848

"approval_duration": "1s",

1507

1849

}

1508

1850

client_config = configparser.SafeConfigParser(client_defaults)

1509

client_config.read(os.path.join(server_settings[u"configdir"],

1510

u"clients.conf"))

1851

client_config.read(os.path.join(server_settings["configdir"],

1852

"clients.conf"))

1511

1853

1512

1854

global mandos_dbus_service

1513

1855

mandos_dbus_service = None

1514

1856

1515

tcp_server = MandosServer((server_settings[u"address"],

1516

server_settings[u"port"]),

1857

tcp_server = MandosServer((server_settings["address"],

1858

server_settings["port"]),

1517

1859

ClientHandler,

1518

interface=server_settings[u"interface"],

1860

interface=(server_settings["interface"]

1861

or None),

1519

1862

use_ipv6=use_ipv6,

1520

1863

gnutls_priority=

1521

server_settings[u"priority"],

1864

server_settings["priority"],

1522

1865

use_dbus=use_dbus)

1523

pidfilename = u"/var/run/mandos.pid"

1524

try:

1525

pidfile = open(pidfilename, u"w")

1526

except IOError:

1527

logger.error(u"Could not open file %r", pidfilename)

1866

if not debug:

1867

pidfilename = "/var/run/mandos.pid"

1868

try:

1869

pidfile = open(pidfilename, "w")

1870

except IOError:

1871

logger.error("Could not open file %r", pidfilename)

1528

1872

1529

1873

try:

1530

uid = pwd.getpwnam(u"_mandos").pw_uid

1531

gid = pwd.getpwnam(u"_mandos").pw_gid

1874

uid = pwd.getpwnam("_mandos").pw_uid

1875

gid = pwd.getpwnam("_mandos").pw_gid

1532

1876

except KeyError:

1533

1877

try:

1534

uid = pwd.getpwnam(u"mandos").pw_uid

1535

gid = pwd.getpwnam(u"mandos").pw_gid

1878

uid = pwd.getpwnam("mandos").pw_uid

1879

gid = pwd.getpwnam("mandos").pw_gid

1536

1880

except KeyError:

1537

1881

try:

1538

uid = pwd.getpwnam(u"nobody").pw_uid

1539

gid = pwd.getpwnam(u"nobody").pw_gid

1882

uid = pwd.getpwnam("nobody").pw_uid

1883

gid = pwd.getpwnam("nobody").pw_gid

1540

1884

except KeyError:

1541

1885

uid = 65534

1542

1886

gid = 65534

1543

1887

try:

1544

1888

os.setgid(gid)

1545

1889

os.setuid(uid)

1546

except OSError, error:

1890

except OSError as error:

1547

1891

if error[0] != errno.EPERM:

1548

1892

raise error

1549

1893

1550

# Enable all possible GnuTLS debugging

1894

if not debug and not debuglevel:

1895

syslogger.setLevel(logging.WARNING)

1896

console.setLevel(logging.WARNING)

1897

if debuglevel:

1898

level = getattr(logging, debuglevel.upper())

1899

syslogger.setLevel(level)

1900

console.setLevel(level)

1901

1551

1902

if debug:

1903

# Enable all possible GnuTLS debugging

1904

1552

1905

# "Use a log level over 10 to enable all debugging options."

1553

1906

# - GnuTLS manual

1554

1907

gnutls.library.functions.gnutls_global_set_log_level(11)

1555

1908

1556

1909

@gnutls.library.types.gnutls_log_func

1557

1910

def debug_gnutls(level, string):

1558

logger.debug(u"GnuTLS: %s", string[:-1])

1911

logger.debug("GnuTLS: %s", string[:-1])

1559

1912

1560

1913

(gnutls.library.functions

1561

1914

.gnutls_global_set_log_function(debug_gnutls))

1915

1916

# Redirect stdin so all checkers get /dev/null

1917

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1918

os.dup2(null, sys.stdin.fileno())

1919

if null > 2:

1920

os.close(null)

1921

else:

1922

# No console logging

1923

logger.removeHandler(console)

1924

1925

# Need to fork before connecting to D-Bus

1926

if not debug:

1927

# Close all input and output, do double fork, etc.

1928

daemon()

1562

1929

1563

1930

global main_loop

1564

1931

# From the Avahi example code

1568

1935

# End of Avahi example code

1569

1936

if use_dbus:

1570

1937

try:

1571

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1572

bus, do_not_queue=True)

1573

except dbus.exceptions.NameExistsException, e:

1574

logger.error(unicode(e) + u", disabling D-Bus")

1938

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1939

bus, do_not_queue=True)

1940

bus_name2 = dbus.service.BusName("se.recompile.Mandos",

1941

bus, do_not_queue=True)

1942

except dbus.exceptions.NameExistsException as e:

1943

logger.error(unicode(e) + ", disabling D-Bus")

1575

1944

use_dbus = False

1576

server_settings[u"use_dbus"] = False

1945

server_settings["use_dbus"] = False

1577

1946

tcp_server.use_dbus = False

1578

1947

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1579

service = AvahiService(name = server_settings[u"servicename"],

1580

servicetype = u"_mandos._tcp",

1948

service = AvahiService(name = server_settings["servicename"],

1949

servicetype = "_mandos._tcp",

1581

1950

protocol = protocol, bus = bus)

1582

1951

if server_settings["interface"]:

1583

1952

service.interface = (if_nametoindex

1584

(str(server_settings[u"interface"])))

1953

(str(server_settings["interface"])))

1954

1955

global multiprocessing_manager

1956

multiprocessing_manager = multiprocessing.Manager()

1585

1957

1586

1958

client_class = Client

1587

1959

if use_dbus:

1588

client_class = functools.partial(ClientDBus, bus = bus)

1960

client_class = functools.partial(ClientDBusTransitional, bus = bus)

1961

def client_config_items(config, section):

1962

special_settings = {

1963

"approved_by_default":

1964

lambda: config.getboolean(section,

1965

"approved_by_default"),

1966

}

1967

for name, value in config.items(section):

1968

try:

1969

yield (name, special_settings[name]())

1970

except KeyError:

1971

yield (name, value)

1972

1589

1973

tcp_server.clients.update(set(

1590

1974

client_class(name = section,

1591

config= dict(client_config.items(section)))

1975

config= dict(client_config_items(

1976

client_config, section)))

1592

1977

for section in client_config.sections()))

1593

1978

if not tcp_server.clients:

1594

logger.warning(u"No clients defined")

1595

1596

if debug:

1597

# Redirect stdin so all checkers get /dev/null

1598

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1599

os.dup2(null, sys.stdin.fileno())

1600

if null > 2:

1601

os.close(null)

1602

else:

1603

# No console logging

1604

logger.removeHandler(console)

1605

# Close all input and output, do double fork, etc.

1606

daemon()

1607

1608

try:

1609

with closing(pidfile):

1610

pid = os.getpid()

1611

pidfile.write(str(pid) + "\n")

1612

del pidfile

1613

except IOError:

1614

logger.error(u"Could not write to file %r with PID %d",

1615

pidfilename, pid)

1616

except NameError:

1617

# "pidfile" was never created

1618

pass

1619

del pidfilename

1620

1979

logger.warning("No clients defined")

1980

1621

1981

if not debug:

1982

try:

1983

with pidfile:

1984

pid = os.getpid()

1985

pidfile.write(str(pid) + "\n".encode("utf-8"))

1986

del pidfile

1987

except IOError:

1988

logger.error("Could not write to file %r with PID %d",

1989

pidfilename, pid)

1990

except NameError:

1991

# "pidfile" was never created

1992

pass

1993

del pidfilename

1994

1622

1995

signal.signal(signal.SIGINT, signal.SIG_IGN)

1996

1623

1997

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1624

1998

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1625

1999

1627

2001

class MandosDBusService(dbus.service.Object):

1628

2002

"""A D-Bus proxy object"""

1629

2003

def __init__(self):

1630

dbus.service.Object.__init__(self, bus, u"/")

1631

_interface = u"se.bsnet.fukt.Mandos"

1632

1633

@dbus.service.signal(_interface, signature=u"oa{sv}")

1634

def ClientAdded(self, objpath, properties):

1635

"D-Bus signal"

1636

pass

1637

1638

@dbus.service.signal(_interface, signature=u"s")

1639

def ClientNotFound(self, fingerprint):

1640

"D-Bus signal"

1641

pass

1642

1643

@dbus.service.signal(_interface, signature=u"os")

2004

dbus.service.Object.__init__(self, bus, "/")

2005

_interface = "se.bsnet.fukt.Mandos"

2006

2007

@dbus.service.signal(_interface, signature="o")

2008

def ClientAdded(self, objpath):

2009

"D-Bus signal"

2010

pass

2011

2012

@dbus.service.signal(_interface, signature="ss")

2013

def ClientNotFound(self, fingerprint, address):

2014

"D-Bus signal"

2015

pass

2016

2017

@dbus.service.signal(_interface, signature="os")

1644

2018

def ClientRemoved(self, objpath, name):

1645

2019

"D-Bus signal"

1646

2020

pass

1647

2021

1648

@dbus.service.method(_interface, out_signature=u"ao")

2022

@dbus.service.method(_interface, out_signature="ao")

1649

2023

def GetAllClients(self):

1650

2024

"D-Bus method"

1651

2025

return dbus.Array(c.dbus_object_path

1652

2026

for c in tcp_server.clients)

1653

2027

1654

2028

@dbus.service.method(_interface,

1655

out_signature=u"a{oa{sv}}")

2029

out_signature="a{oa{sv}}")

1656

2030

def GetAllClientsWithProperties(self):

1657

2031

"D-Bus method"

1658

2032

return dbus.Dictionary(

1659

((c.dbus_object_path, c.GetAll(u""))

2033

((c.dbus_object_path, c.GetAll(""))

1660

2034

for c in tcp_server.clients),

1661

signature=u"oa{sv}")

2035

signature="oa{sv}")

1662

2036

1663

@dbus.service.method(_interface, in_signature=u"o")

2037

@dbus.service.method(_interface, in_signature="o")

1664

2038

def RemoveClient(self, object_path):

1665

2039

"D-Bus method"

1666

2040

for c in tcp_server.clients:

1676

2050

1677

2051

del _interface

1678

2052

1679

mandos_dbus_service = MandosDBusService()

2053

class MandosDBusServiceTransitional(MandosDBusService):

2054

__metaclass__ = transitional_dbus_metaclass

2055

mandos_dbus_service = MandosDBusServiceTransitional()

1680

2056

1681

2057

def cleanup():

1682

2058

"Cleanup function; run on exit"

1699

2075

for client in tcp_server.clients:

1700

2076

if use_dbus:

1701

2077

# Emit D-Bus signal

1702

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1703

client.GetAll(u""))

2078

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1704

2079

client.enable()

1705

2080

1706

2081

tcp_server.enable()

1709

2084

# Find out what port we got

1710

2085

service.port = tcp_server.socket.getsockname()[1]

1711

2086

if use_ipv6:

1712

logger.info(u"Now listening on address %r, port %d,"

2087

logger.info("Now listening on address %r, port %d,"

1713

2088

" flowinfo %d, scope_id %d"

1714

2089

% tcp_server.socket.getsockname())

1715

2090

else: # IPv4

1716

logger.info(u"Now listening on address %r, port %d"

2091

logger.info("Now listening on address %r, port %d"

1717

2092

% tcp_server.socket.getsockname())

1718

2093

1719

2094

#service.interface = tcp_server.socket.getsockname()[3]

1722

2097

# From the Avahi example code

1723

2098

try:

1724

2099

service.activate()

1725

except dbus.exceptions.DBusException, error:

1726

logger.critical(u"DBusException: %s", error)

2100

except dbus.exceptions.DBusException as error:

2101

logger.critical("DBusException: %s", error)

1727

2102

cleanup()

1728

2103

sys.exit(1)

1729

2104

# End of Avahi example code

1733

2108

(tcp_server.handle_request

1734

2109

(*args[2:], **kwargs) or True))

1735

2110

1736

logger.debug(u"Starting main loop")

2111

logger.debug("Starting main loop")

1737

2112

main_loop.run()

1738

except AvahiError, error:

1739

logger.critical(u"AvahiError: %s", error)

2113

except AvahiError as error:

2114

logger.critical("AvahiError: %s", error)

1740

2115

cleanup()

1741

2116

sys.exit(1)

1742

2117

except KeyboardInterrupt:

1743

2118

if debug:

1744

print >> sys.stderr

1745

logger.debug(u"Server received KeyboardInterrupt")

1746

logger.debug(u"Server exiting")

2119

print("", file=sys.stderr)

2120

logger.debug("Server received KeyboardInterrupt")

2121

logger.debug("Server exiting")

1747

2122

# Must run before the D-Bus bus name gets deregistered

1748

2123

cleanup()

1749

2124

2125

1750

2126

if __name__ == '__main__':

1751

2127

main()