/mandos/trunk : revision 24.1.186

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

60

61

import fcntl

61

62

import functools

62

63

import cPickle as pickle

63

import select

64

import multiprocessing

65

import types

64

66

65

67

import dbus

66

68

import dbus.service

81

83

SO_BINDTODEVICE = None

82

84

83

85

84

version = "1.0.14"

86

version = "1.3.1"

85

87

86

logger = logging.Logger(u'mandos')

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

87

90

syslogger = (logging.handlers.SysLogHandler

88

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

89

address = "/dev/log"))

92

address = str("/dev/log")))

90

93

syslogger.setFormatter(logging.Formatter

91

(u'Mandos [%(process)d]: %(levelname)s:'

92

u' %(message)s'))

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

93

96

logger.addHandler(syslogger)

94

97

95

98

console = logging.StreamHandler()

96

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

97

u' %(levelname)s:'

98

u' %(message)s'))

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

99

102

logger.addHandler(console)

100

103

101

104

class AvahiError(Exception):

118

121

Attributes:

119

122

interface: integer; avahi.IF_UNSPEC or an interface index.

120

123

Used to optionally bind to the specified interface.

121

122

type: string; Example: u'_mandos._tcp'.

124

125

type: string; Example: '_mandos._tcp'.

123

126

See <http://www.dns-sd.org/ServiceTypes.html>

124

127

port: integer; what port to announce

125

128

TXT: list of strings; TXT record for the service

134

137

"""

135

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

136

139

servicetype = None, port = None, TXT = None,

137

domain = u"", host = u"", max_renames = 32768,

140

domain = "", host = "", max_renames = 32768,

138

141

protocol = avahi.PROTO_UNSPEC, bus = None):

139

142

self.interface = interface

140

143

self.name = name

149

152

self.group = None # our entry group

150

153

self.server = None

151

154

self.bus = bus

155

self.entry_group_state_changed_match = None

152

156

def rename(self):

153

157

"""Derived from the Avahi example code"""

154

158

if self.rename_count >= self.max_renames:

155

logger.critical(u"No suitable Zeroconf service name found"

156

u" after %i retries, exiting.",

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

157

161

self.rename_count)

158

raise AvahiServiceError(u"Too many renames")

159

self.name = self.server.GetAlternativeServiceName(self.name)

160

logger.info(u"Changing Zeroconf service name to %r ...",

161

unicode(self.name))

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

164

logger.info("Changing Zeroconf service name to %r ...",

165

self.name)

162

166

syslogger.setFormatter(logging.Formatter

163

(u'Mandos (%s) [%%(process)d]:'

164

u' %%(levelname)s: %%(message)s'

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

165

169

% self.name))

166

170

self.remove()

167

self.add()

171

try:

172

self.add()

173

except dbus.exceptions.DBusException as error:

174

logger.critical("DBusException: %s", error)

175

self.cleanup()

176

os._exit(1)

168

177

self.rename_count += 1

169

178

def remove(self):

170

179

"""Derived from the Avahi example code"""

180

if self.entry_group_state_changed_match is not None:

181

self.entry_group_state_changed_match.remove()

182

self.entry_group_state_changed_match = None

171

183

if self.group is not None:

172

184

self.group.Reset()

173

185

def add(self):

174

186

"""Derived from the Avahi example code"""

187

self.remove()

175

188

if self.group is None:

176

189

self.group = dbus.Interface(

177

190

self.bus.get_object(avahi.DBUS_NAME,

178

191

self.server.EntryGroupNew()),

179

192

avahi.DBUS_INTERFACE_ENTRY_GROUP)

180

self.group.connect_to_signal('StateChanged',

181

self

182

.entry_group_state_changed)

183

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

193

self.entry_group_state_changed_match = (

194

self.group.connect_to_signal(

195

'StateChanged', self .entry_group_state_changed))

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

184

197

self.name, self.type)

185

198

self.group.AddService(

186

199

self.interface,

193

206

self.group.Commit()

194

207

def entry_group_state_changed(self, state, error):

195

208

"""Derived from the Avahi example code"""

196

logger.debug(u"Avahi entry group state change: %i", state)

209

logger.debug("Avahi entry group state change: %i", state)

197

210

198

211

if state == avahi.ENTRY_GROUP_ESTABLISHED:

199

logger.debug(u"Zeroconf service established.")

212

logger.debug("Zeroconf service established.")

200

213

elif state == avahi.ENTRY_GROUP_COLLISION:

201

logger.warning(u"Zeroconf service name collision.")

214

logger.info("Zeroconf service name collision.")

202

215

self.rename()

203

216

elif state == avahi.ENTRY_GROUP_FAILURE:

204

logger.critical(u"Avahi: Error in group state changed %s",

217

logger.critical("Avahi: Error in group state changed %s",

205

218

unicode(error))

206

raise AvahiGroupError(u"State changed: %s"

219

raise AvahiGroupError("State changed: %s"

207

220

% unicode(error))

208

221

def cleanup(self):

209

222

"""Derived from the Avahi example code"""

210

223

if self.group is not None:

211

self.group.Free()

224

try:

225

self.group.Free()

226

except (dbus.exceptions.UnknownMethodException,

227

dbus.exceptions.DBusException) as e:

228

pass

212

229

self.group = None

213

def server_state_changed(self, state):

230

self.remove()

231

def server_state_changed(self, state, error=None):

214

232

"""Derived from the Avahi example code"""

215

logger.debug(u"Avahi server state change: %i", state)

216

if state == avahi.SERVER_COLLISION:

217

logger.error(u"Zeroconf server name collision")

218

self.remove()

233

logger.debug("Avahi server state change: %i", state)

234

bad_states = { avahi.SERVER_INVALID:

235

"Zeroconf server invalid",

236

avahi.SERVER_REGISTERING: None,

237

avahi.SERVER_COLLISION:

238

"Zeroconf server name collision",

239

avahi.SERVER_FAILURE:

240

"Zeroconf server failure" }

241

if state in bad_states:

242

if bad_states[state] is not None:

243

if error is None:

244

logger.error(bad_states[state])

245

else:

246

logger.error(bad_states[state] + ": %r", error)

247

self.cleanup()

219

248

elif state == avahi.SERVER_RUNNING:

220

249

self.add()

250

else:

251

if error is None:

252

logger.debug("Unknown state: %r", state)

253

else:

254

logger.debug("Unknown state: %r: %r", state, error)

221

255

def activate(self):

222

256

"""Derived from the Avahi example code"""

223

257

if self.server is None:

224

258

self.server = dbus.Interface(

225

259

self.bus.get_object(avahi.DBUS_NAME,

226

avahi.DBUS_PATH_SERVER),

260

avahi.DBUS_PATH_SERVER,

261

follow_name_owner_changes=True),

227

262

avahi.DBUS_INTERFACE_SERVER)

228

self.server.connect_to_signal(u"StateChanged",

263

self.server.connect_to_signal("StateChanged",

229

264

self.server_state_changed)

230

265

self.server_state_changed(self.server.GetState())

231

266

232

267

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

233

274

class Client(object):

234

275

"""A representation of a client host served by this server.

235

276

236

277

Attributes:

237

238

D-Bus identifiers

278

_approved: bool(); 'None' if not yet approved/disapproved

279

approval_delay: datetime.timedelta(); Time to wait for approval

280

approval_duration: datetime.timedelta(); Duration of one approval

281

checker: subprocess.Popen(); a running checker process used

282

to see if the client lives.

283

'None' if no process is running.

284

checker_callback_tag: a gobject event source tag, or None

285

checker_command: string; External command which is run to check

286

if client lives. %() expansions are done at

287

runtime with vars(self) as dict, so that for

288

instance %(name)s can be used in the command.

289

checker_initiator_tag: a gobject event source tag, or None

290

created: datetime.datetime(); (UTC) object creation

291

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

293

disable_initiator_tag: a gobject event source tag, or None

294

enabled: bool()

239

295

fingerprint: string (40 or 32 hexadecimal digits); used to

240

296

uniquely identify the client

241

secret: bytestring; sent verbatim (over TLS) to client

242

297

host: string; available for use by the checker command

243

created: datetime.datetime(); (UTC) object creation

298

interval: datetime.timedelta(); How often to start a new checker

299

last_approval_request: datetime.datetime(); (UTC) or None

300

last_checked_ok: datetime.datetime(); (UTC) or None

244

301

last_enabled: datetime.datetime(); (UTC)

245

enabled: bool()

246

last_checked_ok: datetime.datetime(); (UTC) or None

302

303

D-Bus identifiers

304

secret: bytestring; sent verbatim (over TLS) to client

247

305

timeout: datetime.timedelta(); How long from last_checked_ok

248

306

until this client is disabled

249

interval: datetime.timedelta(); How often to start a new checker

250

disable_hook: If set, called by disable() as disable_hook(self)

251

checker: subprocess.Popen(); a running checker process used

252

to see if the client lives.

253

'None' if no process is running.

254

checker_initiator_tag: a gobject event source tag, or None

255

disable_initiator_tag: - '' -

256

checker_callback_tag: - '' -

257

checker_command: string; External command which is run to check if

258

client lives. %() expansions are done at

259

runtime with vars(self) as dict, so that for

260

instance %(name)s can be used in the command.

261

current_checker_command: string; current running checker_command

307

extended_timeout: extra long timeout when password has been sent

308

runtime_expansions: Allowed attributes for runtime expansion.

309

expires: datetime.datetime(); time (UTC) when a client will be

310

disabled, or None

262

311

"""

263

312

264

@staticmethod

265

def _timedelta_to_milliseconds(td):

266

"Convert a datetime.timedelta() to milliseconds"

267

return ((td.days * 24 * 60 * 60 * 1000)

268

+ (td.seconds * 1000)

269

+ (td.microseconds // 1000))

313

runtime_expansions = ("approval_delay", "approval_duration",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

316

"last_enabled", "name", "timeout")

270

317

271

318

def timeout_milliseconds(self):

272

319

"Return the 'timeout' attribute in milliseconds"

273

return self._timedelta_to_milliseconds(self.timeout)

320

return _timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

274

325

275

326

def interval_milliseconds(self):

276

327

"Return the 'interval' attribute in milliseconds"

277

return self._timedelta_to_milliseconds(self.interval)

328

return _timedelta_to_milliseconds(self.interval)

329

330

def approval_delay_milliseconds(self):

331

return _timedelta_to_milliseconds(self.approval_delay)

278

332

279

333

def __init__(self, name = None, disable_hook=None, config=None):

280

334

"""Note: the 'checker' key in 'config' sets the

283

337

self.name = name

284

338

if config is None:

285

339

config = {}

286

logger.debug(u"Creating client %r", self.name)

340

logger.debug("Creating client %r", self.name)

287

341

# Uppercase and remove spaces from fingerprint for later

288

342

# comparison purposes with return value from the fingerprint()

289

343

# function

290

self.fingerprint = (config[u"fingerprint"].upper()

291

.replace(u" ", u""))

292

logger.debug(u" Fingerprint: %s", self.fingerprint)

293

if u"secret" in config:

294

self.secret = config[u"secret"].decode(u"base64")

295

elif u"secfile" in config:

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

296

350

with open(os.path.expanduser(os.path.expandvars

297

(config[u"secfile"])),

351

(config["secfile"])),

298

352

"rb") as secfile:

299

353

self.secret = secfile.read()

300

354

else:

301

raise TypeError(u"No secret or secfile for client %s"

355

raise TypeError("No secret or secfile for client %s"

302

356

% self.name)

303

self.host = config.get(u"host", u"")

357

self.host = config.get("host", "")

304

358

self.created = datetime.datetime.utcnow()

305

359

self.enabled = False

360

self.last_approval_request = None

306

361

self.last_enabled = None

307

362

self.last_checked_ok = None

308

self.timeout = string_to_delta(config[u"timeout"])

309

self.interval = string_to_delta(config[u"interval"])

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

310

366

self.disable_hook = disable_hook

311

367

self.checker = None

312

368

self.checker_initiator_tag = None

313

369

self.disable_initiator_tag = None

370

self.expires = None

314

371

self.checker_callback_tag = None

315

self.checker_command = config[u"checker"]

372

self.checker_command = config["checker"]

316

373

self.current_checker_command = None

317

374

self.last_connect = None

375

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

377

True)

378

self.approvals_pending = 0

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

318

384

385

def send_changedstate(self):

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

319

390

def enable(self):

320

391

"""Start this client's checker and timeout hooks"""

321

if getattr(self, u"enabled", False):

392

if getattr(self, "enabled", False):

322

393

# Already enabled

323

394

return

324

self.last_enabled = datetime.datetime.utcnow()

395

self.send_changedstate()

325

396

# Schedule a new checker to be started an 'interval' from now,

326

397

# and every interval from then on.

327

398

self.checker_initiator_tag = (gobject.timeout_add

328

399

(self.interval_milliseconds(),

329

400

self.start_checker))

330

401

# Schedule a disable() when 'timeout' has passed

402

self.expires = datetime.datetime.utcnow() + self.timeout

331

403

self.disable_initiator_tag = (gobject.timeout_add

332

404

(self.timeout_milliseconds(),

333

405

self.disable))

334

406

self.enabled = True

407

self.last_enabled = datetime.datetime.utcnow()

335

408

# Also start a new checker *right now*.

336

409

self.start_checker()

337

410

340

413

if not getattr(self, "enabled", False):

341

414

return False

342

415

if not quiet:

343

logger.info(u"Disabling client %s", self.name)

344

if getattr(self, u"disable_initiator_tag", False):

416

self.send_changedstate()

417

if not quiet:

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

345

420

gobject.source_remove(self.disable_initiator_tag)

346

421

self.disable_initiator_tag = None

347

if getattr(self, u"checker_initiator_tag", False):

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

348

424

gobject.source_remove(self.checker_initiator_tag)

349

425

self.checker_initiator_tag = None

350

426

self.stop_checker()

365

441

if os.WIFEXITED(condition):

366

442

exitstatus = os.WEXITSTATUS(condition)

367

443

if exitstatus == 0:

368

logger.info(u"Checker for %(name)s succeeded",

444

logger.info("Checker for %(name)s succeeded",

369

445

vars(self))

370

446

self.checked_ok()

371

447

else:

372

logger.info(u"Checker for %(name)s failed",

448

logger.info("Checker for %(name)s failed",

373

449

vars(self))

374

450

else:

375

logger.warning(u"Checker for %(name)s crashed?",

451

logger.warning("Checker for %(name)s crashed?",

376

452

vars(self))

377

453

378

def checked_ok(self):

454

def checked_ok(self, timeout=None):

379

455

"""Bump up the timeout for this client.

380

456

381

457

This should only be called when the client has been seen,

382

458

alive and well.

383

459

"""

460

if timeout is None:

461

timeout = self.timeout

384

462

self.last_checked_ok = datetime.datetime.utcnow()

385

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

386

465

self.disable_initiator_tag = (gobject.timeout_add

387

(self.timeout_milliseconds(),

466

(_timedelta_to_milliseconds(timeout),

388

467

self.disable))

389

468

469

def need_approval(self):

470

self.last_approval_request = datetime.datetime.utcnow()

471

390

472

def start_checker(self):

391

473

"""Start a new checker subprocess if one is not running.

392

474

404

486

# If a checker exists, make sure it is not a zombie

405

487

try:

406

488

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

407

except (AttributeError, OSError), error:

489

except (AttributeError, OSError) as error:

408

490

if (isinstance(error, OSError)

409

491

and error.errno != errno.ECHILD):

410

492

raise error

411

493

else:

412

494

if pid:

413

logger.warning(u"Checker was a zombie")

495

logger.warning("Checker was a zombie")

414

496

gobject.source_remove(self.checker_callback_tag)

415

497

self.checker_callback(pid, status,

416

498

self.current_checker_command)

421

503

command = self.checker_command % self.host

422

504

except TypeError:

423

505

# Escape attributes for the shell

424

escaped_attrs = dict((key,

425

re.escape(unicode(str(val),

426

errors=

427

u'replace')))

428

for key, val in

429

vars(self).iteritems())

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

430

514

try:

431

515

command = self.checker_command % escaped_attrs

432

except TypeError, error:

433

logger.error(u'Could not format string "%s":'

434

u' %s', self.checker_command, error)

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

435

519

return True # Try again later

436

520

self.current_checker_command = command

437

521

try:

438

logger.info(u"Starting checker %r for %s",

522

logger.info("Starting checker %r for %s",

439

523

command, self.name)

440

524

# We don't need to redirect stdout and stderr, since

441

525

# in normal mode, that is already done by daemon(),

443

527

# always replaced by /dev/null.)

444

528

self.checker = subprocess.Popen(command,

445

529

close_fds=True,

446

shell=True, cwd=u"/")

530

shell=True, cwd="/")

447

531

self.checker_callback_tag = (gobject.child_watch_add

448

532

(self.checker.pid,

449

533

self.checker_callback,

454

538

if pid:

455

539

gobject.source_remove(self.checker_callback_tag)

456

540

self.checker_callback(pid, status, command)

457

except OSError, error:

458

logger.error(u"Failed to start subprocess: %s",

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

459

543

error)

460

544

# Re-run this periodically if run by gobject.timeout_add

461

545

return True

465

549

if self.checker_callback_tag:

466

550

gobject.source_remove(self.checker_callback_tag)

467

551

self.checker_callback_tag = None

468

if getattr(self, u"checker", None) is None:

552

if getattr(self, "checker", None) is None:

469

553

return

470

logger.debug(u"Stopping checker for %(name)s", vars(self))

554

logger.debug("Stopping checker for %(name)s", vars(self))

471

555

try:

472

556

os.kill(self.checker.pid, signal.SIGTERM)

473

557

#time.sleep(0.5)

474

558

#if self.checker.poll() is None:

475

559

# os.kill(self.checker.pid, signal.SIGKILL)

476

except OSError, error:

560

except OSError as error:

477

561

if error.errno != errno.ESRCH: # No such process

478

562

raise

479

563

self.checker = None

480

564

481

565

482

def dbus_service_property(dbus_interface, signature=u"v",

483

access=u"readwrite", byte_arrays=False):

566

def dbus_service_property(dbus_interface, signature="v",

567

access="readwrite", byte_arrays=False):

484

568

"""Decorators for marking methods of a DBusObjectWithProperties to

485

569

become properties on the D-Bus.

486

570

493

577

"""

494

578

# Encoding deeply encoded byte arrays is not supported yet by the

495

579

# "Set" method, so we fail early here:

496

if byte_arrays and signature != u"ay":

497

raise ValueError(u"Byte arrays not supported for non-'ay'"

498

u" signature %r" % signature)

580

if byte_arrays and signature != "ay":

581

raise ValueError("Byte arrays not supported for non-'ay'"

582

" signature %r" % signature)

499

583

def decorator(func):

500

584

func._dbus_is_property = True

501

585

func._dbus_interface = dbus_interface

502

586

func._dbus_signature = signature

503

587

func._dbus_access = access

504

588

func._dbus_name = func.__name__

505

if func._dbus_name.endswith(u"_dbus_property"):

589

if func._dbus_name.endswith("_dbus_property"):

506

590

func._dbus_name = func._dbus_name[:-14]

507

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

591

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

508

592

return func

509

593

return decorator

510

594

530

614

531

615

class DBusObjectWithProperties(dbus.service.Object):

532

616

"""A D-Bus object with properties.

533

617

534

618

Classes inheriting from this can use the dbus_service_property

535

619

decorator to expose methods as D-Bus properties. It exposes the

536

620

standard Get(), Set(), and GetAll() methods on the D-Bus.

538

622

539

623

@staticmethod

540

624

def _is_dbus_property(obj):

541

return getattr(obj, u"_dbus_is_property", False)

625

return getattr(obj, "_dbus_is_property", False)

542

626

543

627

def _get_all_dbus_properties(self):

544

628

"""Returns a generator of (name, attribute) pairs

545

629

"""

546

return ((prop._dbus_name, prop)

547

for name, prop in

548

inspect.getmembers(self, self._is_dbus_property))

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

631

for cls in self.__class__.__mro__

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

549

633

550

634

def _get_dbus_property(self, interface_name, property_name):

551

635

"""Returns a bound method if one exists which is a D-Bus

552

636

property with the specified name and interface.

553

637

"""

554

for name in (property_name,

555

property_name + u"_dbus_property"):

556

prop = getattr(self, name, None)

557

if (prop is None

558

or not self._is_dbus_property(prop)

559

or prop._dbus_name != property_name

560

or (interface_name and prop._dbus_interface

561

and interface_name != prop._dbus_interface)):

562

continue

563

return prop

638

for cls in self.__class__.__mro__:

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

641

return value.__get__(self)

642

564

643

# No such property

565

raise DBusPropertyNotFound(self.dbus_object_path + u":"

566

+ interface_name + u"."

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

645

+ interface_name + "."

567

646

+ property_name)

647

568

648

569

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

570

out_signature=u"v")

649

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

650

out_signature="v")

571

651

def Get(self, interface_name, property_name):

572

652

"""Standard D-Bus property Get() method, see D-Bus standard.

573

653

"""

574

654

prop = self._get_dbus_property(interface_name, property_name)

575

if prop._dbus_access == u"write":

655

if prop._dbus_access == "write":

576

656

raise DBusPropertyAccessException(property_name)

577

657

value = prop()

578

if not hasattr(value, u"variant_level"):

658

if not hasattr(value, "variant_level"):

579

659

return value

580

660

return type(value)(value, variant_level=value.variant_level+1)

581

661

582

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

662

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

583

663

def Set(self, interface_name, property_name, value):

584

664

"""Standard D-Bus property Set() method, see D-Bus standard.

585

665

"""

586

666

prop = self._get_dbus_property(interface_name, property_name)

587

if prop._dbus_access == u"read":

667

if prop._dbus_access == "read":

588

668

raise DBusPropertyAccessException(property_name)

589

if prop._dbus_get_args_options[u"byte_arrays"]:

669

if prop._dbus_get_args_options["byte_arrays"]:

590

670

# The byte_arrays option is not supported yet on

591

671

# signatures other than "ay".

592

if prop._dbus_signature != u"ay":

672

if prop._dbus_signature != "ay":

593

673

raise ValueError

594

674

value = dbus.ByteArray(''.join(unichr(byte)

595

675

for byte in value))

596

676

prop(value)

597

677

598

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

599

out_signature=u"a{sv}")

678

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

679

out_signature="a{sv}")

600

680

def GetAll(self, interface_name):

601

681

"""Standard D-Bus property GetAll() method, see D-Bus

602

682

standard.

603

683

604

684

Note: Will not include properties with access="write".

605

685

"""

606

686

all = {}

610

690

# Interface non-empty but did not match

611

691

continue

612

692

# Ignore write-only properties

613

if prop._dbus_access == u"write":

693

if prop._dbus_access == "write":

614

694

continue

615

695

value = prop()

616

if not hasattr(value, u"variant_level"):

696

if not hasattr(value, "variant_level"):

617

697

all[name] = value

618

698

continue

619

699

all[name] = type(value)(value, variant_level=

620

700

value.variant_level+1)

621

return dbus.Dictionary(all, signature=u"sv")

701

return dbus.Dictionary(all, signature="sv")

622

702

623

703

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

624

out_signature=u"s",

704

out_signature="s",

625

705

path_keyword='object_path',

626

706

connection_keyword='connection')

627

707

def Introspect(self, object_path, connection):

632

712

try:

633

713

document = xml.dom.minidom.parseString(xmlstring)

634

714

def make_tag(document, name, prop):

635

e = document.createElement(u"property")

636

e.setAttribute(u"name", name)

637

e.setAttribute(u"type", prop._dbus_signature)

638

e.setAttribute(u"access", prop._dbus_access)

715

e = document.createElement("property")

716

e.setAttribute("name", name)

717

e.setAttribute("type", prop._dbus_signature)

718

e.setAttribute("access", prop._dbus_access)

639

719

return e

640

for if_tag in document.getElementsByTagName(u"interface"):

720

for if_tag in document.getElementsByTagName("interface"):

641

721

for tag in (make_tag(document, name, prop)

642

722

for name, prop

643

723

in self._get_all_dbus_properties()

644

724

if prop._dbus_interface

645

== if_tag.getAttribute(u"name")):

725

== if_tag.getAttribute("name")):

646

726

if_tag.appendChild(tag)

647

727

# Add the names to the return values for the

648

728

# "org.freedesktop.DBus.Properties" methods

649

if (if_tag.getAttribute(u"name")

650

== u"org.freedesktop.DBus.Properties"):

651

for cn in if_tag.getElementsByTagName(u"method"):

652

if cn.getAttribute(u"name") == u"Get":

653

for arg in cn.getElementsByTagName(u"arg"):

654

if (arg.getAttribute(u"direction")

655

== u"out"):

656

arg.setAttribute(u"name", u"value")

657

elif cn.getAttribute(u"name") == u"GetAll":

658

for arg in cn.getElementsByTagName(u"arg"):

659

if (arg.getAttribute(u"direction")

660

== u"out"):

661

arg.setAttribute(u"name", u"props")

662

xmlstring = document.toxml(u"utf-8")

729

if (if_tag.getAttribute("name")

730

== "org.freedesktop.DBus.Properties"):

731

for cn in if_tag.getElementsByTagName("method"):

732

if cn.getAttribute("name") == "Get":

733

for arg in cn.getElementsByTagName("arg"):

734

if (arg.getAttribute("direction")

735

== "out"):

736

arg.setAttribute("name", "value")

737

elif cn.getAttribute("name") == "GetAll":

738

for arg in cn.getElementsByTagName("arg"):

739

if (arg.getAttribute("direction")

740

== "out"):

741

arg.setAttribute("name", "props")

742

xmlstring = document.toxml("utf-8")

663

743

document.unlink()

664

744

except (AttributeError, xml.dom.DOMException,

665

xml.parsers.expat.ExpatError), error:

666

logger.error(u"Failed to override Introspection method",

745

xml.parsers.expat.ExpatError) as error:

746

logger.error("Failed to override Introspection method",

667

747

error)

668

748

return xmlstring

669

749

670

750

751

def datetime_to_dbus (dt, variant_level=0):

752

"""Convert a UTC datetime.datetime() to a D-Bus type."""

753

if dt is None:

754

return dbus.String("", variant_level = variant_level)

755

return dbus.String(dt.isoformat(),

756

variant_level=variant_level)

757

758

class transitional_dbus_metaclass(DBusObjectWithProperties.__metaclass__):

759

def __new__(mcs, name, bases, attr):

760

for attrname, old_dbusobj in inspect.getmembers(bases[0]):

761

new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")

762

if (getattr(old_dbusobj, "_dbus_is_signal", False)

763

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

764

unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,

765

old_dbusobj.__closure__))["func"].cell_contents

766

newfunc = types.FunctionType(unwrappedfunc.func_code,

767

unwrappedfunc.func_globals,

768

unwrappedfunc.func_name,

769

unwrappedfunc.func_defaults,

770

unwrappedfunc.func_closure)

771

new_dbusfunc = dbus.service.signal(

772

new_interface, old_dbusobj._dbus_signature)(newfunc)

773

attr["_transitional_" + attrname] = new_dbusfunc

774

775

def fixscope(func1, func2):

776

def newcall(*args, **kwargs):

777

func1(*args, **kwargs)

778

func2(*args, **kwargs)

779

return newcall

780

781

attr[attrname] = fixscope(old_dbusobj, new_dbusfunc)

782

783

elif (getattr(old_dbusobj, "_dbus_is_method", False)

784

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

785

new_dbusfunc = (dbus.service.method

786

(new_interface,

787

old_dbusobj._dbus_in_signature,

788

old_dbusobj._dbus_out_signature)

789

(types.FunctionType

790

(old_dbusobj.func_code,

791

old_dbusobj.func_globals,

792

old_dbusobj.func_name,

793

old_dbusobj.func_defaults,

794

old_dbusobj.func_closure)))

795

796

attr[attrname] = new_dbusfunc

797

elif (getattr(old_dbusobj, "_dbus_is_property", False)

798

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

799

new_dbusfunc = (dbus_service_property

800

(new_interface,

801

old_dbusobj._dbus_signature,

802

old_dbusobj._dbus_access,

803

old_dbusobj._dbus_get_args_options["byte_arrays"])

804

(types.FunctionType

805

(old_dbusobj.func_code,

806

old_dbusobj.func_globals,

807

old_dbusobj.func_name,

808

old_dbusobj.func_defaults,

809

old_dbusobj.func_closure)))

810

811

attr[attrname] = new_dbusfunc

812

return type.__new__(mcs, name, bases, attr)

813

671

814

class ClientDBus(Client, DBusObjectWithProperties):

672

815

"""A Client class using D-Bus

673

816

675

818

dbus_object_path: dbus.ObjectPath

676

819

bus: dbus.SystemBus()

677

820

"""

821

822

runtime_expansions = (Client.runtime_expansions

823

+ ("dbus_object_path",))

824

678

825

# dbus.service.Object doesn't use super(), so we can't either.

679

826

680

827

def __init__(self, bus = None, *args, **kwargs):

828

self._approvals_pending = 0

681

829

self.bus = bus

682

830

Client.__init__(self, *args, **kwargs)

683

831

# Only now, when this client is initialized, can it show up on

684

832

# the D-Bus

833

client_object_name = unicode(self.name).translate(

834

{ord("."): ord("_"),

835

ord("-"): ord("_")})

685

836

self.dbus_object_path = (dbus.ObjectPath

686

(u"/clients/"

687

+ self.name.replace(u".", u"_")))

837

("/clients/" + client_object_name))

688

838

DBusObjectWithProperties.__init__(self, self.bus,

689

839

self.dbus_object_path)

690

691

@staticmethod

692

def _datetime_to_dbus(dt, variant_level=0):

693

"""Convert a UTC datetime.datetime() to a D-Bus type."""

694

return dbus.String(dt.isoformat(),

695

variant_level=variant_level)

696

697

def enable(self):

698

oldstate = getattr(self, u"enabled", False)

699

r = Client.enable(self)

700

if oldstate != self.enabled:

701

# Emit D-Bus signals

702

self.PropertyChanged(dbus.String(u"enabled"),

703

dbus.Boolean(True, variant_level=1))

704

self.PropertyChanged(

705

dbus.String(u"last_enabled"),

706

self._datetime_to_dbus(self.last_enabled,

707

variant_level=1))

708

return r

709

710

def disable(self, quiet = False):

711

oldstate = getattr(self, u"enabled", False)

712

r = Client.disable(self, quiet=quiet)

713

if not quiet and oldstate != self.enabled:

714

# Emit D-Bus signal

715

self.PropertyChanged(dbus.String(u"enabled"),

716

dbus.Boolean(False, variant_level=1))

717

return r

840

841

def notifychangeproperty(transform_func,

842

dbus_name, type_func=lambda x: x,

843

variant_level=1):

844

""" Modify a variable so that its a property that announce its

845

changes to DBus.

846

transform_fun: Function that takes a value and transform it to

847

DBus type.

848

dbus_name: DBus name of the variable

849

type_func: Function that transform the value before sending it

850

to DBus

851

variant_level: DBus variant level. default: 1

852

"""

853

real_value = [None,]

854

def setter(self, value):

855

old_value = real_value[0]

856

real_value[0] = value

857

if hasattr(self, "dbus_object_path"):

858

if type_func(old_value) != type_func(real_value[0]):

859

dbus_value = transform_func(type_func(real_value[0]),

860

variant_level)

861

self.PropertyChanged(dbus.String(dbus_name),

862

dbus_value)

863

864

return property(lambda self: real_value[0], setter)

865

866

867

expires = notifychangeproperty(datetime_to_dbus, "Expires")

868

approvals_pending = notifychangeproperty(dbus.Boolean,

869

"ApprovalPending",

870

type_func = bool)

871

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

872

last_enabled = notifychangeproperty(datetime_to_dbus,

873

"LastEnabled")

874

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

875

type_func = lambda checker: checker is not None)

876

last_checked_ok = notifychangeproperty(datetime_to_dbus,

877

"LastCheckedOK")

878

last_approval_request = notifychangeproperty(datetime_to_dbus,

879

"LastApprovalRequest")

880

approved_by_default = notifychangeproperty(dbus.Boolean,

881

"ApprovedByDefault")

882

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

883

type_func = _timedelta_to_milliseconds)

884

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

885

type_func = _timedelta_to_milliseconds)

886

host = notifychangeproperty(dbus.String, "Host")

887

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

888

type_func = _timedelta_to_milliseconds)

889

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

890

type_func = _timedelta_to_milliseconds)

891

interval = notifychangeproperty(dbus.UInt16, "Interval",

892

type_func = _timedelta_to_milliseconds)

893

checker_command = notifychangeproperty(dbus.String, "Checker")

894

895

del notifychangeproperty

718

896

719

897

def __del__(self, *args, **kwargs):

720

898

try:

721

899

self.remove_from_connection()

722

900

except LookupError:

723

901

pass

724

if hasattr(DBusObjectWithProperties, u"__del__"):

902

if hasattr(DBusObjectWithProperties, "__del__"):

725

903

DBusObjectWithProperties.__del__(self, *args, **kwargs)

726

904

Client.__del__(self, *args, **kwargs)

727

905

729

907

*args, **kwargs):

730

908

self.checker_callback_tag = None

731

909

self.checker = None

732

# Emit D-Bus signal

733

self.PropertyChanged(dbus.String(u"checker_running"),

734

dbus.Boolean(False, variant_level=1))

735

910

if os.WIFEXITED(condition):

736

911

exitstatus = os.WEXITSTATUS(condition)

737

912

# Emit D-Bus signal

747

922

return Client.checker_callback(self, pid, condition, command,

748

923

*args, **kwargs)

749

924

750

def checked_ok(self, *args, **kwargs):

751

r = Client.checked_ok(self, *args, **kwargs)

752

# Emit D-Bus signal

753

self.PropertyChanged(

754

dbus.String(u"last_checked_ok"),

755

(self._datetime_to_dbus(self.last_checked_ok,

756

variant_level=1)))

757

return r

758

759

925

def start_checker(self, *args, **kwargs):

760

926

old_checker = self.checker

761

927

if self.checker is not None:

768

934

and old_checker_pid != self.checker.pid):

769

935

# Emit D-Bus signal

770

936

self.CheckerStarted(self.current_checker_command)

771

self.PropertyChanged(

772

dbus.String(u"checker_running"),

773

dbus.Boolean(True, variant_level=1))

774

return r

775

776

def stop_checker(self, *args, **kwargs):

777

old_checker = getattr(self, u"checker", None)

778

r = Client.stop_checker(self, *args, **kwargs)

779

if (old_checker is not None

780

and getattr(self, u"checker", None) is None):

781

self.PropertyChanged(dbus.String(u"checker_running"),

782

dbus.Boolean(False, variant_level=1))

783

return r

937

return r

938

939

def _reset_approved(self):

940

self._approved = None

941

return False

942

943

def approve(self, value=True):

944

self.send_changedstate()

945

self._approved = value

946

gobject.timeout_add(_timedelta_to_milliseconds

947

(self.approval_duration),

948

self._reset_approved)

949

784

950

785

951

## D-Bus methods, signals & properties

786

_interface = u"se.bsnet.fukt.Mandos.Client"

787

952

_interface = "se.bsnet.fukt.Mandos.Client"

953

788

954

## Signals

789

955

790

956

# CheckerCompleted - signal

791

@dbus.service.signal(_interface, signature=u"nxs")

957

@dbus.service.signal(_interface, signature="nxs")

792

958

def CheckerCompleted(self, exitcode, waitstatus, command):

793

959

"D-Bus signal"

794

960

pass

795

961

796

962

# CheckerStarted - signal

797

@dbus.service.signal(_interface, signature=u"s")

963

@dbus.service.signal(_interface, signature="s")

798

964

def CheckerStarted(self, command):

799

965

"D-Bus signal"

800

966

pass

801

967

802

968

# PropertyChanged - signal

803

@dbus.service.signal(_interface, signature=u"sv")

969

@dbus.service.signal(_interface, signature="sv")

804

970

def PropertyChanged(self, property, value):

805

971

"D-Bus signal"

806

972

pass

808

974

# GotSecret - signal

809

975

@dbus.service.signal(_interface)

810

976

def GotSecret(self):

811

"D-Bus signal"

977

"""D-Bus signal

978

Is sent after a successful transfer of secret from the Mandos

979

server to mandos-client

980

"""

812

981

pass

813

982

814

983

# Rejected - signal

815

@dbus.service.signal(_interface)

816

def Rejected(self):

984

@dbus.service.signal(_interface, signature="s")

985

def Rejected(self, reason):

817

986

"D-Bus signal"

818

987

pass

819

988

989

# NeedApproval - signal

990

@dbus.service.signal(_interface, signature="tb")

991

def NeedApproval(self, timeout, default):

992

"D-Bus signal"

993

return self.need_approval()

994

820

995

## Methods

821

996

997

# Approve - method

998

@dbus.service.method(_interface, in_signature="b")

999

def Approve(self, value):

1000

self.approve(value)

1001

822

1002

# CheckedOK - method

823

1003

@dbus.service.method(_interface)

824

1004

def CheckedOK(self):

825

return self.checked_ok()

1005

self.checked_ok()

826

1006

827

1007

# Enable - method

828

1008

@dbus.service.method(_interface)

849

1029

850

1030

## Properties

851

1031

852

# name - property

853

@dbus_service_property(_interface, signature=u"s", access=u"read")

854

def name_dbus_property(self):

1032

# ApprovalPending - property

1033

@dbus_service_property(_interface, signature="b", access="read")

1034

def ApprovalPending_dbus_property(self):

1035

return dbus.Boolean(bool(self.approvals_pending))

1036

1037

# ApprovedByDefault - property

1038

@dbus_service_property(_interface, signature="b",

1039

access="readwrite")

1040

def ApprovedByDefault_dbus_property(self, value=None):

1041

if value is None: # get

1042

return dbus.Boolean(self.approved_by_default)

1043

self.approved_by_default = bool(value)

1044

1045

# ApprovalDelay - property

1046

@dbus_service_property(_interface, signature="t",

1047

access="readwrite")

1048

def ApprovalDelay_dbus_property(self, value=None):

1049

if value is None: # get

1050

return dbus.UInt64(self.approval_delay_milliseconds())

1051

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1052

1053

# ApprovalDuration - property

1054

@dbus_service_property(_interface, signature="t",

1055

access="readwrite")

1056

def ApprovalDuration_dbus_property(self, value=None):

1057

if value is None: # get

1058

return dbus.UInt64(_timedelta_to_milliseconds(

1059

self.approval_duration))

1060

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1061

1062

# Name - property

1063

@dbus_service_property(_interface, signature="s", access="read")

1064

def Name_dbus_property(self):

855

1065

return dbus.String(self.name)

856

1066

857

# fingerprint - property

858

@dbus_service_property(_interface, signature=u"s", access=u"read")

859

def fingerprint_dbus_property(self):

1067

# Fingerprint - property

1068

@dbus_service_property(_interface, signature="s", access="read")

1069

def Fingerprint_dbus_property(self):

860

1070

return dbus.String(self.fingerprint)

861

1071

862

# host - property

863

@dbus_service_property(_interface, signature=u"s",

864

access=u"readwrite")

865

def host_dbus_property(self, value=None):

1072

# Host - property

1073

@dbus_service_property(_interface, signature="s",

1074

access="readwrite")

1075

def Host_dbus_property(self, value=None):

866

1076

if value is None: # get

867

1077

return dbus.String(self.host)

868

1078

self.host = value

869

# Emit D-Bus signal

870

self.PropertyChanged(dbus.String(u"host"),

871

dbus.String(value, variant_level=1))

872

873

# created - property

874

@dbus_service_property(_interface, signature=u"s", access=u"read")

875

def created_dbus_property(self):

876

return dbus.String(self._datetime_to_dbus(self.created))

877

878

# last_enabled - property

879

@dbus_service_property(_interface, signature=u"s", access=u"read")

880

def last_enabled_dbus_property(self):

881

if self.last_enabled is None:

882

return dbus.String(u"")

883

return dbus.String(self._datetime_to_dbus(self.last_enabled))

884

885

# enabled - property

886

@dbus_service_property(_interface, signature=u"b",

887

access=u"readwrite")

888

def enabled_dbus_property(self, value=None):

1079

1080

# Created - property

1081

@dbus_service_property(_interface, signature="s", access="read")

1082

def Created_dbus_property(self):

1083

return dbus.String(datetime_to_dbus(self.created))

1084

1085

# LastEnabled - property

1086

@dbus_service_property(_interface, signature="s", access="read")

1087

def LastEnabled_dbus_property(self):

1088

return datetime_to_dbus(self.last_enabled)

1089

1090

# Enabled - property

1091

@dbus_service_property(_interface, signature="b",

1092

access="readwrite")

1093

def Enabled_dbus_property(self, value=None):

889

1094

if value is None: # get

890

1095

return dbus.Boolean(self.enabled)

891

1096

if value:

893

1098

else:

894

1099

self.disable()

895

1100

896

# last_checked_ok - property

897

@dbus_service_property(_interface, signature=u"s",

898

access=u"readwrite")

899

def last_checked_ok_dbus_property(self, value=None):

1101

# LastCheckedOK - property

1102

@dbus_service_property(_interface, signature="s",

1103

access="readwrite")

1104

def LastCheckedOK_dbus_property(self, value=None):

900

1105

if value is not None:

901

1106

self.checked_ok()

902

1107

return

903

if self.last_checked_ok is None:

904

return dbus.String(u"")

905

return dbus.String(self._datetime_to_dbus(self

906

.last_checked_ok))

907

908

# timeout - property

909

@dbus_service_property(_interface, signature=u"t",

910

access=u"readwrite")

911

def timeout_dbus_property(self, value=None):

1108

return datetime_to_dbus(self.last_checked_ok)

1109

1110

# Expires - property

1111

@dbus_service_property(_interface, signature="s", access="read")

1112

def Expires_dbus_property(self):

1113

return datetime_to_dbus(self.expires)

1114

1115

# LastApprovalRequest - property

1116

@dbus_service_property(_interface, signature="s", access="read")

1117

def LastApprovalRequest_dbus_property(self):

1118

return datetime_to_dbus(self.last_approval_request)

1119

1120

# Timeout - property

1121

@dbus_service_property(_interface, signature="t",

1122

access="readwrite")

1123

def Timeout_dbus_property(self, value=None):

912

1124

if value is None: # get

913

1125

return dbus.UInt64(self.timeout_milliseconds())

914

1126

self.timeout = datetime.timedelta(0, 0, 0, value)

915

# Emit D-Bus signal

916

self.PropertyChanged(dbus.String(u"timeout"),

917

dbus.UInt64(value, variant_level=1))

918

if getattr(self, u"disable_initiator_tag", None) is None:

1127

if getattr(self, "disable_initiator_tag", None) is None:

919

1128

return

920

1129

# Reschedule timeout

921

1130

gobject.source_remove(self.disable_initiator_tag)

922

1131

self.disable_initiator_tag = None

1132

self.expires = None

923

1133

time_to_die = (self.

924

1134

_timedelta_to_milliseconds((self

925

1135

.last_checked_ok

930

1140

# The timeout has passed

931

1141

self.disable()

932

1142

else:

1143

self.expires = (datetime.datetime.utcnow()

1144

+ datetime.timedelta(milliseconds = time_to_die))

933

1145

self.disable_initiator_tag = (gobject.timeout_add

934

1146

(time_to_die, self.disable))

935

1147

936

# interval - property

937

@dbus_service_property(_interface, signature=u"t",

938

access=u"readwrite")

939

def interval_dbus_property(self, value=None):

1148

# ExtendedTimeout - property

1149

@dbus_service_property(_interface, signature="t",

1150

access="readwrite")

1151

def ExtendedTimeout_dbus_property(self, value=None):

1152

if value is None: # get

1153

return dbus.UInt64(self.extended_timeout_milliseconds())

1154

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1155

1156

# Interval - property

1157

@dbus_service_property(_interface, signature="t",

1158

access="readwrite")

1159

def Interval_dbus_property(self, value=None):

940

1160

if value is None: # get

941

1161

return dbus.UInt64(self.interval_milliseconds())

942

1162

self.interval = datetime.timedelta(0, 0, 0, value)

943

# Emit D-Bus signal

944

self.PropertyChanged(dbus.String(u"interval"),

945

dbus.UInt64(value, variant_level=1))

946

if getattr(self, u"checker_initiator_tag", None) is None:

1163

if getattr(self, "checker_initiator_tag", None) is None:

947

1164

return

948

1165

# Reschedule checker run

949

1166

gobject.source_remove(self.checker_initiator_tag)

950

1167

self.checker_initiator_tag = (gobject.timeout_add

951

1168

(value, self.start_checker))

952

1169

self.start_checker() # Start one now, too

953

954

# checker - property

955

@dbus_service_property(_interface, signature=u"s",

956

access=u"readwrite")

957

def checker_dbus_property(self, value=None):

1170

1171

# Checker - property

1172

@dbus_service_property(_interface, signature="s",

1173

access="readwrite")

1174

def Checker_dbus_property(self, value=None):

958

1175

if value is None: # get

959

1176

return dbus.String(self.checker_command)

960

1177

self.checker_command = value

961

# Emit D-Bus signal

962

self.PropertyChanged(dbus.String(u"checker"),

963

dbus.String(self.checker_command,

964

variant_level=1))

965

1178

966

# checker_running - property

967

@dbus_service_property(_interface, signature=u"b",

968

access=u"readwrite")

969

def checker_running_dbus_property(self, value=None):

1179

# CheckerRunning - property

1180

@dbus_service_property(_interface, signature="b",

1181

access="readwrite")

1182

def CheckerRunning_dbus_property(self, value=None):

970

1183

if value is None: # get

971

1184

return dbus.Boolean(self.checker is not None)

972

1185

if value:

974

1187

else:

975

1188

self.stop_checker()

976

1189

977

# object_path - property

978

@dbus_service_property(_interface, signature=u"o", access=u"read")

979

def object_path_dbus_property(self):

1190

# ObjectPath - property

1191

@dbus_service_property(_interface, signature="o", access="read")

1192

def ObjectPath_dbus_property(self):

980

1193

return self.dbus_object_path # is already a dbus.ObjectPath

981

1194

982

# secret = property

983

@dbus_service_property(_interface, signature=u"ay",

984

access=u"write", byte_arrays=True)

985

def secret_dbus_property(self, value):

1195

# Secret = property

1196

@dbus_service_property(_interface, signature="ay",

1197

access="write", byte_arrays=True)

1198

def Secret_dbus_property(self, value):

986

1199

self.secret = str(value)

987

1200

988

1201

del _interface

989

1202

990

1203

1204

class ProxyClient(object):

1205

def __init__(self, child_pipe, fpr, address):

1206

self._pipe = child_pipe

1207

self._pipe.send(('init', fpr, address))

1208

if not self._pipe.recv():

1209

raise KeyError()

1210

1211

def __getattribute__(self, name):

1212

if(name == '_pipe'):

1213

return super(ProxyClient, self).__getattribute__(name)

1214

self._pipe.send(('getattr', name))

1215

data = self._pipe.recv()

1216

if data[0] == 'data':

1217

return data[1]

1218

if data[0] == 'function':

1219

def func(*args, **kwargs):

1220

self._pipe.send(('funcall', name, args, kwargs))

1221

return self._pipe.recv()[1]

1222

return func

1223

1224

def __setattr__(self, name, value):

1225

if(name == '_pipe'):

1226

return super(ProxyClient, self).__setattr__(name, value)

1227

self._pipe.send(('setattr', name, value))

1228

1229

class ClientDBusTransitional(ClientDBus):

1230

__metaclass__ = transitional_dbus_metaclass

1231

991

1232

class ClientHandler(socketserver.BaseRequestHandler, object):

992

1233

"""A class to handle client connections.

993

1234

995

1236

Note: This will run in its own forked process."""

996

1237

997

1238

def handle(self):

998

logger.info(u"TCP connection from: %s",

999

unicode(self.client_address))

1000

logger.debug(u"IPC Pipe FD: %d",

1001

self.server.child_pipe[1].fileno())

1002

# Open IPC pipe to parent process

1003

with contextlib.nested(self.server.child_pipe[1],

1004

self.server.parent_pipe[0]

1005

) as (ipc, ipc_return):

1239

with contextlib.closing(self.server.child_pipe) as child_pipe:

1240

logger.info("TCP connection from: %s",

1241

unicode(self.client_address))

1242

logger.debug("Pipe FD: %d",

1243

self.server.child_pipe.fileno())

1244

1006

1245

session = (gnutls.connection

1007

1246

.ClientSession(self.request,

1008

1247

gnutls.connection

1013

1252

# no X.509 keys are added to it. Therefore, we can use it

1014

1253

# here despite using OpenPGP certificates.

1015

1254

1016

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1017

# u"+AES-256-CBC", u"+SHA1",

1018

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1019

# u"+DHE-DSS"))

1255

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1256

# "+AES-256-CBC", "+SHA1",

1257

# "+COMP-NULL", "+CTYPE-OPENPGP",

1258

# "+DHE-DSS"))

1020

1259

# Use a fallback default, since this MUST be set.

1021

1260

priority = self.server.gnutls_priority

1022

1261

if priority is None:

1023

priority = u"NORMAL"

1262

priority = "NORMAL"

1024

1263

(gnutls.library.functions

1025

1264

.gnutls_priority_set_direct(session._c_object,

1026

1265

priority, None))

1028

1267

# Start communication using the Mandos protocol

1029

1268

# Get protocol number

1030

1269

line = self.request.makefile().readline()

1031

logger.debug(u"Protocol version: %r", line)

1270

logger.debug("Protocol version: %r", line)

1032

1271

try:

1033

1272

if int(line.strip().split()[0]) > 1:

1034

1273

raise RuntimeError

1035

except (ValueError, IndexError, RuntimeError), error:

1036

logger.error(u"Unknown protocol version: %s", error)

1274

except (ValueError, IndexError, RuntimeError) as error:

1275

logger.error("Unknown protocol version: %s", error)

1037

1276

return

1038

1277

1039

1278

# Start GnuTLS connection

1040

1279

try:

1041

1280

session.handshake()

1042

except gnutls.errors.GNUTLSError, error:

1043

logger.warning(u"Handshake failed: %s", error)

1281

except gnutls.errors.GNUTLSError as error:

1282

logger.warning("Handshake failed: %s", error)

1044

1283

# Do not run session.bye() here: the session is not

1045

1284

# established. Just abandon the request.

1046

1285

return

1047

logger.debug(u"Handshake succeeded")

1286

logger.debug("Handshake succeeded")

1287

1288

approval_required = False

1048

1289

try:

1049

1290

try:

1050

1291

fpr = self.fingerprint(self.peer_certificate

1051

1292

(session))

1052

except (TypeError, gnutls.errors.GNUTLSError), error:

1053

logger.warning(u"Bad certificate: %s", error)

1054

return

1055

logger.debug(u"Fingerprint: %s", fpr)

1056

1057

for c in self.server.clients:

1058

if c.fingerprint == fpr:

1059

client = c

1293

except (TypeError,

1294

gnutls.errors.GNUTLSError) as error:

1295

logger.warning("Bad certificate: %s", error)

1296

return

1297

logger.debug("Fingerprint: %s", fpr)

1298

1299

try:

1300

client = ProxyClient(child_pipe, fpr,

1301

self.client_address)

1302

except KeyError:

1303

return

1304

1305

if client.approval_delay:

1306

delay = client.approval_delay

1307

client.approvals_pending += 1

1308

approval_required = True

1309

1310

while True:

1311

if not client.enabled:

1312

logger.info("Client %s is disabled",

1313

client.name)

1314

if self.server.use_dbus:

1315

# Emit D-Bus signal

1316

client.Rejected("Disabled")

1317

return

1318

1319

if client._approved or not client.approval_delay:

1320

#We are approved or approval is disabled

1060

1321

break

1061

else:

1062

ipc.write(u"NOTFOUND %s %s\n"

1063

% (fpr, unicode(self.client_address)))

1064

return

1065

1066

class ClientProxy(object):

1067

"""Client proxy object. Not for calling methods."""

1068

def __init__(self, client):

1069

self.client = client

1070

def __getattr__(self, name):

1071

if name.startswith("ipc_"):

1072

def tempfunc():

1073

ipc.write("%s %s\n" % (name[4:].upper(),

1074

self.client.name))

1075

return tempfunc

1076

if not hasattr(self.client, name):

1077

raise AttributeError

1078

ipc.write(u"GETATTR %s %s\n"

1079

% (name, self.client.fingerprint))

1080

return pickle.load(ipc_return)

1081

clientproxy = ClientProxy(client)

1082

# Have to check if client.enabled, since it is

1083

# possible that the client was disabled since the

1084

# GnuTLS session was established.

1085

if not clientproxy.enabled:

1086

clientproxy.ipc_disabled()

1087

return

1088

1089

clientproxy.ipc_sending()

1322

elif client._approved is None:

1323

logger.info("Client %s needs approval",

1324

client.name)

1325

if self.server.use_dbus:

1326

# Emit D-Bus signal

1327

client.NeedApproval(

1328

client.approval_delay_milliseconds(),

1329

client.approved_by_default)

1330

else:

1331

logger.warning("Client %s was not approved",

1332

client.name)

1333

if self.server.use_dbus:

1334

# Emit D-Bus signal

1335

client.Rejected("Denied")

1336

return

1337

1338

#wait until timeout or approved

1339

#x = float(client._timedelta_to_milliseconds(delay))

1340

time = datetime.datetime.now()

1341

client.changedstate.acquire()

1342

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1343

client.changedstate.release()

1344

time2 = datetime.datetime.now()

1345

if (time2 - time) >= delay:

1346

if not client.approved_by_default:

1347

logger.warning("Client %s timed out while"

1348

" waiting for approval",

1349

client.name)

1350

if self.server.use_dbus:

1351

# Emit D-Bus signal

1352

client.Rejected("Approval timed out")

1353

return

1354

else:

1355

break

1356

else:

1357

delay -= time2 - time

1358

1090

1359

sent_size = 0

1091

1360

while sent_size < len(client.secret):

1092

sent = session.send(client.secret[sent_size:])

1093

logger.debug(u"Sent: %d, remaining: %d",

1361

try:

1362

sent = session.send(client.secret[sent_size:])

1363

except gnutls.errors.GNUTLSError as error:

1364

logger.warning("gnutls send failed")

1365

return

1366

logger.debug("Sent: %d, remaining: %d",

1094

1367

sent, len(client.secret)

1095

1368

- (sent_size + sent))

1096

1369

sent_size += sent

1370

1371

logger.info("Sending secret to %s", client.name)

1372

# bump the timeout as if seen

1373

client.checked_ok(client.extended_timeout)

1374

if self.server.use_dbus:

1375

# Emit D-Bus signal

1376

client.GotSecret()

1377

1097

1378

finally:

1098

session.bye()

1379

if approval_required:

1380

client.approvals_pending -= 1

1381

try:

1382

session.bye()

1383

except gnutls.errors.GNUTLSError as error:

1384

logger.warning("GnuTLS bye failed")

1099

1385

1100

1386

@staticmethod

1101

1387

def peer_certificate(session):

1111

1397

.gnutls_certificate_get_peers

1112

1398

(session._c_object, ctypes.byref(list_size)))

1113

1399

if not bool(cert_list) and list_size.value != 0:

1114

raise gnutls.errors.GNUTLSError(u"error getting peer"

1115

u" certificate")

1400

raise gnutls.errors.GNUTLSError("error getting peer"

1401

" certificate")

1116

1402

if list_size.value == 0:

1117

1403

return None

1118

1404

cert = cert_list[0]

1144

1430

if crtverify.value != 0:

1145

1431

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1146

1432

raise (gnutls.errors.CertificateSecurityError

1147

(u"Verify failed"))

1433

("Verify failed"))

1148

1434

# New buffer for the fingerprint

1149

1435

buf = ctypes.create_string_buffer(20)

1150

1436

buf_len = ctypes.c_size_t()

1157

1443

# Convert the buffer to a Python bytestring

1158

1444

fpr = ctypes.string_at(buf, buf_len.value)

1159

1445

# Convert the bytestring to hexadecimal notation

1160

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1446

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1161

1447

return hex_fpr

1162

1448

1163

1449

1164

class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):

1165

"""Like socketserver.ForkingMixIn, but also pass a pipe pair."""

1450

class MultiprocessingMixIn(object):

1451

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1452

def sub_process_main(self, request, address):

1453

try:

1454

self.finish_request(request, address)

1455

except:

1456

self.handle_error(request, address)

1457

self.close_request(request)

1458

1459

def process_request(self, request, address):

1460

"""Start a new process to process the request."""

1461

multiprocessing.Process(target = self.sub_process_main,

1462

args = (request, address)).start()

1463

1464

1465

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1466

""" adds a pipe to the MixIn """

1166

1467

def process_request(self, request, client_address):

1167

1468

"""Overrides and wraps the original process_request().

1168

1469

1169

1470

This function creates a new pipe in self.pipe

1170

1471

"""

1171

# Child writes to child_pipe

1172

self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))

1173

# Parent writes to parent_pipe

1174

self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))

1175

super(ForkingMixInWithPipes,

1472

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1473

1474

super(MultiprocessingMixInWithPipe,

1176

1475

self).process_request(request, client_address)

1177

# Close unused ends for parent

1178

self.parent_pipe[0].close() # close read end

1179

self.child_pipe[1].close() # close write end

1180

self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])

1181

def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):

1476

self.child_pipe.close()

1477

self.add_pipe(parent_pipe)

1478

1479

def add_pipe(self, parent_pipe):

1182

1480

"""Dummy function; override as necessary"""

1183

child_pipe_fd.close()

1184

parent_pipe_fd.close()

1185

1186

1187

class IPv6_TCPServer(ForkingMixInWithPipes,

1481

raise NotImplementedError

1482

1483

1484

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1188

1485

socketserver.TCPServer, object):

1189

1486

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1190

1487

1206

1503

bind to an address or port if they were not specified."""

1207

1504

if self.interface is not None:

1208

1505

if SO_BINDTODEVICE is None:

1209

logger.error(u"SO_BINDTODEVICE does not exist;"

1210

u" cannot bind to interface %s",

1506

logger.error("SO_BINDTODEVICE does not exist;"

1507

" cannot bind to interface %s",

1211

1508

self.interface)

1212

1509

else:

1213

1510

try:

1214

1511

self.socket.setsockopt(socket.SOL_SOCKET,

1215

1512

SO_BINDTODEVICE,

1216

1513

str(self.interface

1217

+ u'\0'))

1218

except socket.error, error:

1514

+ '\0'))

1515

except socket.error as error:

1219

1516

if error[0] == errno.EPERM:

1220

logger.error(u"No permission to"

1221

u" bind to interface %s",

1517

logger.error("No permission to"

1518

" bind to interface %s",

1222

1519

self.interface)

1223

1520

elif error[0] == errno.ENOPROTOOPT:

1224

logger.error(u"SO_BINDTODEVICE not available;"

1225

u" cannot bind to interface %s",

1521

logger.error("SO_BINDTODEVICE not available;"

1522

" cannot bind to interface %s",

1226

1523

self.interface)

1227

1524

else:

1228

1525

raise

1230

1527

if self.server_address[0] or self.server_address[1]:

1231

1528

if not self.server_address[0]:

1232

1529

if self.address_family == socket.AF_INET6:

1233

any_address = u"::" # in6addr_any

1530

any_address = "::" # in6addr_any

1234

1531

else:

1235

1532

any_address = socket.INADDR_ANY

1236

1533

self.server_address = (any_address,

1275

1572

return socketserver.TCPServer.server_activate(self)

1276

1573

def enable(self):

1277

1574

self.enabled = True

1278

def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):

1575

def add_pipe(self, parent_pipe):

1279

1576

# Call "handle_ipc" for both data and EOF events

1280

gobject.io_add_watch(child_pipe_fd.fileno(),

1577

gobject.io_add_watch(parent_pipe.fileno(),

1281

1578

gobject.IO_IN | gobject.IO_HUP,

1282

1579

functools.partial(self.handle_ipc,

1283

reply = parent_pipe_fd,

1284

sender= child_pipe_fd))

1285

def handle_ipc(self, source, condition, reply=None, sender=None):

1580

parent_pipe = parent_pipe))

1581

1582

def handle_ipc(self, source, condition, parent_pipe=None,

1583

client_object=None):

1286

1584

condition_names = {

1287

gobject.IO_IN: u"IN", # There is data to read.

1288

gobject.IO_OUT: u"OUT", # Data can be written (without

1585

gobject.IO_IN: "IN", # There is data to read.

1586

gobject.IO_OUT: "OUT", # Data can be written (without

1289

1587

# blocking).

1290

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1291

gobject.IO_ERR: u"ERR", # Error condition.

1292

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1588

gobject.IO_PRI: "PRI", # There is urgent data to read.

1589

gobject.IO_ERR: "ERR", # Error condition.

1590

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1293

1591

# broken, usually for pipes and

1294

1592

# sockets).

1295

1593

}

1297

1595

for cond, name in

1298

1596

condition_names.iteritems()

1299

1597

if cond & condition)

1300

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1301

conditions_string)

1302

1303

# Read a line from the file object

1304

cmdline = sender.readline()

1305

if not cmdline: # Empty line means end of file

1306

# close the IPC pipes

1307

sender.close()

1308

reply.close()

1309

1310

# Stop calling this function

1311

return False

1312

1313

logger.debug(u"IPC command: %r", cmdline)

1314

1315

# Parse and act on command

1316

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1317

1318

if cmd == u"NOTFOUND":

1319

fpr, address = args.split(None, 1)

1320

logger.warning(u"Client not found for fingerprint: %s, ad"

1321

u"dress: %s", fpr, address)

1322

if self.use_dbus:

1323

# Emit D-Bus signal

1324

mandos_dbus_service.ClientNotFound(fpr, address)

1325

elif cmd == u"DISABLED":

1326

for client in self.clients:

1327

if client.name == args:

1328

logger.warning(u"Client %s is disabled", args)

1329

if self.use_dbus:

1330

# Emit D-Bus signal

1331

client.Rejected()

1332

break

1333

else:

1334

logger.error(u"Unknown client %s is disabled", args)

1335

elif cmd == u"SENDING":

1336

for client in self.clients:

1337

if client.name == args:

1338

logger.info(u"Sending secret to %s", client.name)

1339

client.checked_ok()

1340

if self.use_dbus:

1341

# Emit D-Bus signal

1342

client.GotSecret()

1343

break

1344

else:

1345

logger.error(u"Sending secret to unknown client %s",

1346

args)

1347

elif cmd == u"GETATTR":

1348

attr_name, fpr = args.split(None, 1)

1349

for client in self.clients:

1350

if client.fingerprint == fpr:

1351

attr_value = getattr(client, attr_name, None)

1352

logger.debug("IPC reply: %r", attr_value)

1353

pickle.dump(attr_value, reply)

1354

break

1355

else:

1356

logger.error(u"Client %s on address %s requesting "

1357

u"attribute %s not found", fpr, address,

1358

attr_name)

1359

pickle.dump(None, reply)

1360

else:

1361

logger.error(u"Unknown IPC command: %r", cmdline)

1362

1363

# Keep calling this function

1598

# error or the other end of multiprocessing.Pipe has closed

1599

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1600

return False

1601

1602

# Read a request from the child

1603

request = parent_pipe.recv()

1604

command = request[0]

1605

1606

if command == 'init':

1607

fpr = request[1]

1608

address = request[2]

1609

1610

for c in self.clients:

1611

if c.fingerprint == fpr:

1612

client = c

1613

break

1614

else:

1615

logger.info("Client not found for fingerprint: %s, ad"

1616

"dress: %s", fpr, address)

1617

if self.use_dbus:

1618

# Emit D-Bus signal

1619

mandos_dbus_service.ClientNotFound(fpr, address[0])

1620

parent_pipe.send(False)

1621

return False

1622

1623

gobject.io_add_watch(parent_pipe.fileno(),

1624

gobject.IO_IN | gobject.IO_HUP,

1625

functools.partial(self.handle_ipc,

1626

parent_pipe = parent_pipe,

1627

client_object = client))

1628

parent_pipe.send(True)

1629

# remove the old hook in favor of the new above hook on same fileno

1630

return False

1631

if command == 'funcall':

1632

funcname = request[1]

1633

args = request[2]

1634

kwargs = request[3]

1635

1636

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1637

1638

if command == 'getattr':

1639

attrname = request[1]

1640

if callable(client_object.__getattribute__(attrname)):

1641

parent_pipe.send(('function',))

1642

else:

1643

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1644

1645

if command == 'setattr':

1646

attrname = request[1]

1647

value = request[2]

1648

setattr(client_object, attrname, value)

1649

1364

1650

return True

1365

1651

1366

1652

1367

1653

def string_to_delta(interval):

1368

1654

"""Parse a string and return a datetime.timedelta

1369

1655

1370

>>> string_to_delta(u'7d')

1656

>>> string_to_delta('7d')

1371

1657

datetime.timedelta(7)

1372

>>> string_to_delta(u'60s')

1658

>>> string_to_delta('60s')

1373

1659

datetime.timedelta(0, 60)

1374

>>> string_to_delta(u'60m')

1660

>>> string_to_delta('60m')

1375

1661

datetime.timedelta(0, 3600)

1376

>>> string_to_delta(u'24h')

1662

>>> string_to_delta('24h')

1377

1663

datetime.timedelta(1)

1378

>>> string_to_delta(u'1w')

1664

>>> string_to_delta('1w')

1379

1665

datetime.timedelta(7)

1380

>>> string_to_delta(u'5m 30s')

1666

>>> string_to_delta('5m 30s')

1381

1667

datetime.timedelta(0, 330)

1382

1668

"""

1383

1669

timevalue = datetime.timedelta(0)

1385

1671

try:

1386

1672

suffix = unicode(s[-1])

1387

1673

value = int(s[:-1])

1388

if suffix == u"d":

1674

if suffix == "d":

1389

1675

delta = datetime.timedelta(value)

1390

elif suffix == u"s":

1676

elif suffix == "s":

1391

1677

delta = datetime.timedelta(0, value)

1392

elif suffix == u"m":

1678

elif suffix == "m":

1393

1679

delta = datetime.timedelta(0, 0, 0, 0, value)

1394

elif suffix == u"h":

1680

elif suffix == "h":

1395

1681

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1396

elif suffix == u"w":

1682

elif suffix == "w":

1397

1683

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1398

1684

else:

1399

raise ValueError(u"Unknown suffix %r" % suffix)

1400

except (ValueError, IndexError), e:

1401

raise ValueError(e.message)

1685

raise ValueError("Unknown suffix %r" % suffix)

1686

except (ValueError, IndexError) as e:

1687

raise ValueError(*(e.args))

1402

1688

timevalue += delta

1403

1689

return timevalue

1404

1690

1410

1696

global if_nametoindex

1411

1697

try:

1412

1698

if_nametoindex = (ctypes.cdll.LoadLibrary

1413

(ctypes.util.find_library(u"c"))

1699

(ctypes.util.find_library("c"))

1414

1700

.if_nametoindex)

1415

1701

except (OSError, AttributeError):

1416

logger.warning(u"Doing if_nametoindex the hard way")

1702

logger.warning("Doing if_nametoindex the hard way")

1417

1703

def if_nametoindex(interface):

1418

1704

"Get an interface index the hard way, i.e. using fcntl()"

1419

1705

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1420

1706

with contextlib.closing(socket.socket()) as s:

1421

1707

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1422

struct.pack(str(u"16s16x"),

1708

struct.pack(str("16s16x"),

1423

1709

interface))

1424

interface_index = struct.unpack(str(u"I"),

1710

interface_index = struct.unpack(str("I"),

1425

1711

ifreq[16:20])[0]

1426

1712

return interface_index

1427

1713

return if_nametoindex(interface)

1435

1721

sys.exit()

1436

1722

os.setsid()

1437

1723

if not nochdir:

1438

os.chdir(u"/")

1724

os.chdir("/")

1439

1725

if os.fork():

1440

1726

sys.exit()

1441

1727

if not noclose:

1443

1729

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1444

1730

if not stat.S_ISCHR(os.fstat(null).st_mode):

1445

1731

raise OSError(errno.ENODEV,

1446

u"%s not a character device"

1732

"%s not a character device"

1447

1733

% os.path.devnull)

1448

1734

os.dup2(null, sys.stdin.fileno())

1449

1735

os.dup2(null, sys.stdout.fileno())

1457

1743

##################################################################

1458

1744

# Parsing of options, both command line and config file

1459

1745

1460

parser = optparse.OptionParser(version = "%%prog %s" % version)

1461

parser.add_option("-i", u"--interface", type=u"string",

1462

metavar="IF", help=u"Bind to interface IF")

1463

parser.add_option("-a", u"--address", type=u"string",

1464

help=u"Address to listen for requests on")

1465

parser.add_option("-p", u"--port", type=u"int",

1466

help=u"Port number to receive requests on")

1467

parser.add_option("--check", action=u"store_true",

1468

help=u"Run self-test")

1469

parser.add_option("--debug", action=u"store_true",

1470

help=u"Debug mode; run in foreground and log to"

1471

u" terminal")

1472

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1473

u" priority string (see GnuTLS documentation)")

1474

parser.add_option("--servicename", type=u"string",

1475

metavar=u"NAME", help=u"Zeroconf service name")

1476

parser.add_option("--configdir", type=u"string",

1477

default=u"/etc/mandos", metavar=u"DIR",

1478

help=u"Directory to search for configuration"

1479

u" files")

1480

parser.add_option("--no-dbus", action=u"store_false",

1481

dest=u"use_dbus", help=u"Do not provide D-Bus"

1482

u" system bus interface")

1483

parser.add_option("--no-ipv6", action=u"store_false",

1484

dest=u"use_ipv6", help=u"Do not use IPv6")

1485

options = parser.parse_args()[0]

1746

parser = argparse.ArgumentParser()

1747

parser.add_argument("-v", "--version", action="version",

1748

version = "%%(prog)s %s" % version,

1749

help="show version number and exit")

1750

parser.add_argument("-i", "--interface", metavar="IF",

1751

help="Bind to interface IF")

1752

parser.add_argument("-a", "--address",

1753

help="Address to listen for requests on")

1754

parser.add_argument("-p", "--port", type=int,

1755

help="Port number to receive requests on")

1756

parser.add_argument("--check", action="store_true",

1757

help="Run self-test")

1758

parser.add_argument("--debug", action="store_true",

1759

help="Debug mode; run in foreground and log"

1760

" to terminal")

1761

parser.add_argument("--debuglevel", metavar="LEVEL",

1762

help="Debug level for stdout output")

1763

parser.add_argument("--priority", help="GnuTLS"

1764

" priority string (see GnuTLS documentation)")

1765

parser.add_argument("--servicename",

1766

metavar="NAME", help="Zeroconf service name")

1767

parser.add_argument("--configdir",

1768

default="/etc/mandos", metavar="DIR",

1769

help="Directory to search for configuration"

1770

" files")

1771

parser.add_argument("--no-dbus", action="store_false",

1772

dest="use_dbus", help="Do not provide D-Bus"

1773

" system bus interface")

1774

parser.add_argument("--no-ipv6", action="store_false",

1775

dest="use_ipv6", help="Do not use IPv6")

1776

options = parser.parse_args()

1486

1777

1487

1778

if options.check:

1488

1779

import doctest

1490

1781

sys.exit()

1491

1782

1492

1783

# Default values for config file for server-global settings

1493

server_defaults = { u"interface": u"",

1494

u"address": u"",

1495

u"port": u"",

1496

u"debug": u"False",

1497

u"priority":

1498

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1499

u"servicename": u"Mandos",

1500

u"use_dbus": u"True",

1501

u"use_ipv6": u"True",

1784

server_defaults = { "interface": "",

1785

"address": "",

1786

"port": "",

1787

"debug": "False",

1788

"priority":

1789

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1790

"servicename": "Mandos",

1791

"use_dbus": "True",

1792

"use_ipv6": "True",

1793

"debuglevel": "",

1502

1794

}

1503

1795

1504

1796

# Parse config file for server-global settings

1505

1797

server_config = configparser.SafeConfigParser(server_defaults)

1506

1798

del server_defaults

1507

1799

server_config.read(os.path.join(options.configdir,

1508

u"mandos.conf"))

1800

"mandos.conf"))

1509

1801

# Convert the SafeConfigParser object to a dict

1510

1802

server_settings = server_config.defaults()

1511

1803

# Use the appropriate methods on the non-string config options

1512

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1513

server_settings[option] = server_config.getboolean(u"DEFAULT",

1804

for option in ("debug", "use_dbus", "use_ipv6"):

1805

server_settings[option] = server_config.getboolean("DEFAULT",

1514

1806

option)

1515

1807

if server_settings["port"]:

1516

server_settings["port"] = server_config.getint(u"DEFAULT",

1517

u"port")

1808

server_settings["port"] = server_config.getint("DEFAULT",

1809

"port")

1518

1810

del server_config

1519

1811

1520

1812

# Override the settings from the config file with command line

1521

1813

# options, if set.

1522

for option in (u"interface", u"address", u"port", u"debug",

1523

u"priority", u"servicename", u"configdir",

1524

u"use_dbus", u"use_ipv6"):

1814

for option in ("interface", "address", "port", "debug",

1815

"priority", "servicename", "configdir",

1816

"use_dbus", "use_ipv6", "debuglevel"):

1525

1817

value = getattr(options, option)

1526

1818

if value is not None:

1527

1819

server_settings[option] = value

1535

1827

##################################################################

1536

1828

1537

1829

# For convenience

1538

debug = server_settings[u"debug"]

1539

use_dbus = server_settings[u"use_dbus"]

1540

use_ipv6 = server_settings[u"use_ipv6"]

1541

1542

if not debug:

1543

syslogger.setLevel(logging.WARNING)

1544

console.setLevel(logging.WARNING)

1545

1546

if server_settings[u"servicename"] != u"Mandos":

1830

debug = server_settings["debug"]

1831

debuglevel = server_settings["debuglevel"]

1832

use_dbus = server_settings["use_dbus"]

1833

use_ipv6 = server_settings["use_ipv6"]

1834

1835

if server_settings["servicename"] != "Mandos":

1547

1836

syslogger.setFormatter(logging.Formatter

1548

(u'Mandos (%s) [%%(process)d]:'

1549

u' %%(levelname)s: %%(message)s'

1550

% server_settings[u"servicename"]))

1837

('Mandos (%s) [%%(process)d]:'

1838

' %%(levelname)s: %%(message)s'

1839

% server_settings["servicename"]))

1551

1840

1552

1841

# Parse config file with clients

1553

client_defaults = { u"timeout": u"1h",

1554

u"interval": u"5m",

1555

u"checker": u"fping -q -- %%(host)s",

1556

u"host": u"",

1842

client_defaults = { "timeout": "5m",

1843

"extended_timeout": "15m",

1844

"interval": "2m",

1845

"checker": "fping -q -- %%(host)s",

1846

"host": "",

1847

"approval_delay": "0s",

1848

"approval_duration": "1s",

1557

1849

}

1558

1850

client_config = configparser.SafeConfigParser(client_defaults)

1559

client_config.read(os.path.join(server_settings[u"configdir"],

1560

u"clients.conf"))

1851

client_config.read(os.path.join(server_settings["configdir"],

1852

"clients.conf"))

1561

1853

1562

1854

global mandos_dbus_service

1563

1855

mandos_dbus_service = None

1564

1856

1565

tcp_server = MandosServer((server_settings[u"address"],

1566

server_settings[u"port"]),

1857

tcp_server = MandosServer((server_settings["address"],

1858

server_settings["port"]),

1567

1859

ClientHandler,

1568

interface=(server_settings[u"interface"]

1860

interface=(server_settings["interface"]

1569

1861

or None),

1570

1862

use_ipv6=use_ipv6,

1571

1863

gnutls_priority=

1572

server_settings[u"priority"],

1864

server_settings["priority"],

1573

1865

use_dbus=use_dbus)

1574

pidfilename = u"/var/run/mandos.pid"

1575

try:

1576

pidfile = open(pidfilename, u"w")

1577

except IOError:

1578

logger.error(u"Could not open file %r", pidfilename)

1866

if not debug:

1867

pidfilename = "/var/run/mandos.pid"

1868

try:

1869

pidfile = open(pidfilename, "w")

1870

except IOError:

1871

logger.error("Could not open file %r", pidfilename)

1579

1872

1580

1873

try:

1581

uid = pwd.getpwnam(u"_mandos").pw_uid

1582

gid = pwd.getpwnam(u"_mandos").pw_gid

1874

uid = pwd.getpwnam("_mandos").pw_uid

1875

gid = pwd.getpwnam("_mandos").pw_gid

1583

1876

except KeyError:

1584

1877

try:

1585

uid = pwd.getpwnam(u"mandos").pw_uid

1586

gid = pwd.getpwnam(u"mandos").pw_gid

1878

uid = pwd.getpwnam("mandos").pw_uid

1879

gid = pwd.getpwnam("mandos").pw_gid

1587

1880

except KeyError:

1588

1881

try:

1589

uid = pwd.getpwnam(u"nobody").pw_uid

1590

gid = pwd.getpwnam(u"nobody").pw_gid

1882

uid = pwd.getpwnam("nobody").pw_uid

1883

gid = pwd.getpwnam("nobody").pw_gid

1591

1884

except KeyError:

1592

1885

uid = 65534

1593

1886

gid = 65534

1594

1887

try:

1595

1888

os.setgid(gid)

1596

1889

os.setuid(uid)

1597

except OSError, error:

1890

except OSError as error:

1598

1891

if error[0] != errno.EPERM:

1599

1892

raise error

1600

1893

1601

# Enable all possible GnuTLS debugging

1894

if not debug and not debuglevel:

1895

syslogger.setLevel(logging.WARNING)

1896

console.setLevel(logging.WARNING)

1897

if debuglevel:

1898

level = getattr(logging, debuglevel.upper())

1899

syslogger.setLevel(level)

1900

console.setLevel(level)

1901

1602

1902

if debug:

1903

# Enable all possible GnuTLS debugging

1904

1603

1905

# "Use a log level over 10 to enable all debugging options."

1604

1906

# - GnuTLS manual

1605

1907

gnutls.library.functions.gnutls_global_set_log_level(11)

1606

1908

1607

1909

@gnutls.library.types.gnutls_log_func

1608

1910

def debug_gnutls(level, string):

1609

logger.debug(u"GnuTLS: %s", string[:-1])

1911

logger.debug("GnuTLS: %s", string[:-1])

1610

1912

1611

1913

(gnutls.library.functions

1612

1914

.gnutls_global_set_log_function(debug_gnutls))

1915

1916

# Redirect stdin so all checkers get /dev/null

1917

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1918

os.dup2(null, sys.stdin.fileno())

1919

if null > 2:

1920

os.close(null)

1921

else:

1922

# No console logging

1923

logger.removeHandler(console)

1924

1925

# Need to fork before connecting to D-Bus

1926

if not debug:

1927

# Close all input and output, do double fork, etc.

1928

daemon()

1613

1929

1614

1930

global main_loop

1615

1931

# From the Avahi example code

1619

1935

# End of Avahi example code

1620

1936

if use_dbus:

1621

1937

try:

1622

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1623

bus, do_not_queue=True)

1624

except dbus.exceptions.NameExistsException, e:

1625

logger.error(unicode(e) + u", disabling D-Bus")

1938

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1939

bus, do_not_queue=True)

1940

bus_name2 = dbus.service.BusName("se.recompile.Mandos",

1941

bus, do_not_queue=True)

1942

except dbus.exceptions.NameExistsException as e:

1943

logger.error(unicode(e) + ", disabling D-Bus")

1626

1944

use_dbus = False

1627

server_settings[u"use_dbus"] = False

1945

server_settings["use_dbus"] = False

1628

1946

tcp_server.use_dbus = False

1629

1947

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1630

service = AvahiService(name = server_settings[u"servicename"],

1631

servicetype = u"_mandos._tcp",

1948

service = AvahiService(name = server_settings["servicename"],

1949

servicetype = "_mandos._tcp",

1632

1950

protocol = protocol, bus = bus)

1633

1951

if server_settings["interface"]:

1634

1952

service.interface = (if_nametoindex

1635

(str(server_settings[u"interface"])))

1953

(str(server_settings["interface"])))

1954

1955

global multiprocessing_manager

1956

multiprocessing_manager = multiprocessing.Manager()

1636

1957

1637

1958

client_class = Client

1638

1959

if use_dbus:

1639

client_class = functools.partial(ClientDBus, bus = bus)

1960

client_class = functools.partial(ClientDBusTransitional, bus = bus)

1961

def client_config_items(config, section):

1962

special_settings = {

1963

"approved_by_default":

1964

lambda: config.getboolean(section,

1965

"approved_by_default"),

1966

}

1967

for name, value in config.items(section):

1968

try:

1969

yield (name, special_settings[name]())

1970

except KeyError:

1971

yield (name, value)

1972

1640

1973

tcp_server.clients.update(set(

1641

1974

client_class(name = section,

1642

config= dict(client_config.items(section)))

1975

config= dict(client_config_items(

1976

client_config, section)))

1643

1977

for section in client_config.sections()))

1644

1978

if not tcp_server.clients:

1645

logger.warning(u"No clients defined")

1646

1647

if debug:

1648

# Redirect stdin so all checkers get /dev/null

1649

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1650

os.dup2(null, sys.stdin.fileno())

1651

if null > 2:

1652

os.close(null)

1653

else:

1654

# No console logging

1655

logger.removeHandler(console)

1656

# Close all input and output, do double fork, etc.

1657

daemon()

1658

1659

try:

1660

with pidfile:

1661

pid = os.getpid()

1662

pidfile.write(str(pid) + "\n")

1663

del pidfile

1664

except IOError:

1665

logger.error(u"Could not write to file %r with PID %d",

1666

pidfilename, pid)

1667

except NameError:

1668

# "pidfile" was never created

1669

pass

1670

del pidfilename

1671

1979

logger.warning("No clients defined")

1980

1672

1981

if not debug:

1982

try:

1983

with pidfile:

1984

pid = os.getpid()

1985

pidfile.write(str(pid) + "\n".encode("utf-8"))

1986

del pidfile

1987

except IOError:

1988

logger.error("Could not write to file %r with PID %d",

1989

pidfilename, pid)

1990

except NameError:

1991

# "pidfile" was never created

1992

pass

1993

del pidfilename

1994

1673

1995

signal.signal(signal.SIGINT, signal.SIG_IGN)

1996

1674

1997

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1675

1998

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1676

1999

1678

2001

class MandosDBusService(dbus.service.Object):

1679

2002

"""A D-Bus proxy object"""

1680

2003

def __init__(self):

1681

dbus.service.Object.__init__(self, bus, u"/")

1682

_interface = u"se.bsnet.fukt.Mandos"

2004

dbus.service.Object.__init__(self, bus, "/")

2005

_interface = "se.bsnet.fukt.Mandos"

1683

2006

1684

@dbus.service.signal(_interface, signature=u"o")

2007

@dbus.service.signal(_interface, signature="o")

1685

2008

def ClientAdded(self, objpath):

1686

2009

"D-Bus signal"

1687

2010

pass

1688

2011

1689

@dbus.service.signal(_interface, signature=u"ss")

2012

@dbus.service.signal(_interface, signature="ss")

1690

2013

def ClientNotFound(self, fingerprint, address):

1691

2014

"D-Bus signal"

1692

2015

pass

1693

2016

1694

@dbus.service.signal(_interface, signature=u"os")

2017

@dbus.service.signal(_interface, signature="os")

1695

2018

def ClientRemoved(self, objpath, name):

1696

2019

"D-Bus signal"

1697

2020

pass

1698

2021

1699

@dbus.service.method(_interface, out_signature=u"ao")

2022

@dbus.service.method(_interface, out_signature="ao")

1700

2023

def GetAllClients(self):

1701

2024

"D-Bus method"

1702

2025

return dbus.Array(c.dbus_object_path

1703

2026

for c in tcp_server.clients)

1704

2027

1705

2028

@dbus.service.method(_interface,

1706

out_signature=u"a{oa{sv}}")

2029

out_signature="a{oa{sv}}")

1707

2030

def GetAllClientsWithProperties(self):

1708

2031

"D-Bus method"

1709

2032

return dbus.Dictionary(

1710

((c.dbus_object_path, c.GetAll(u""))

2033

((c.dbus_object_path, c.GetAll(""))

1711

2034

for c in tcp_server.clients),

1712

signature=u"oa{sv}")

2035

signature="oa{sv}")

1713

2036

1714

@dbus.service.method(_interface, in_signature=u"o")

2037

@dbus.service.method(_interface, in_signature="o")

1715

2038

def RemoveClient(self, object_path):

1716

2039

"D-Bus method"

1717

2040

for c in tcp_server.clients:

1727

2050

1728

2051

del _interface

1729

2052

1730

mandos_dbus_service = MandosDBusService()

2053

class MandosDBusServiceTransitional(MandosDBusService):

2054

__metaclass__ = transitional_dbus_metaclass

2055

mandos_dbus_service = MandosDBusServiceTransitional()

1731

2056

1732

2057

def cleanup():

1733

2058

"Cleanup function; run on exit"

1759

2084

# Find out what port we got

1760

2085

service.port = tcp_server.socket.getsockname()[1]

1761

2086

if use_ipv6:

1762

logger.info(u"Now listening on address %r, port %d,"

2087

logger.info("Now listening on address %r, port %d,"

1763

2088

" flowinfo %d, scope_id %d"

1764

2089

% tcp_server.socket.getsockname())

1765

2090

else: # IPv4

1766

logger.info(u"Now listening on address %r, port %d"

2091

logger.info("Now listening on address %r, port %d"

1767

2092

% tcp_server.socket.getsockname())

1768

2093

1769

2094

#service.interface = tcp_server.socket.getsockname()[3]

1772

2097

# From the Avahi example code

1773

2098

try:

1774

2099

service.activate()

1775

except dbus.exceptions.DBusException, error:

1776

logger.critical(u"DBusException: %s", error)

2100

except dbus.exceptions.DBusException as error:

2101

logger.critical("DBusException: %s", error)

1777

2102

cleanup()

1778

2103

sys.exit(1)

1779

2104

# End of Avahi example code

1783

2108

(tcp_server.handle_request

1784

2109

(*args[2:], **kwargs) or True))

1785

2110

1786

logger.debug(u"Starting main loop")

2111

logger.debug("Starting main loop")

1787

2112

main_loop.run()

1788

except AvahiError, error:

1789

logger.critical(u"AvahiError: %s", error)

2113

except AvahiError as error:

2114

logger.critical("AvahiError: %s", error)

1790

2115

cleanup()

1791

2116

sys.exit(1)

1792

2117

except KeyboardInterrupt:

1793

2118

if debug:

1794

print >> sys.stderr

1795

logger.debug(u"Server received KeyboardInterrupt")

1796

logger.debug(u"Server exiting")

2119

print("", file=sys.stderr)

2120

logger.debug("Server received KeyboardInterrupt")

2121

logger.debug("Server exiting")

1797

2122

# Must run before the D-Bus bus name gets deregistered

1798

2123

cleanup()

1799

2124

2125

1800

2126

if __name__ == '__main__':

1801

2127

main()