/mandos/trunk : revision 24.1.186

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

61

62

import functools

62

63

import cPickle as pickle

63

64

import multiprocessing

65

import types

64

66

65

67

import dbus

66

68

import dbus.service

81

83

SO_BINDTODEVICE = None

82

84

83

85

84

version = "1.0.14"

86

version = "1.3.1"

85

87

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

88

90

syslogger = (logging.handlers.SysLogHandler

89

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

90

address = "/dev/log"))

92

address = str("/dev/log")))

91

93

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

94

96

logger.addHandler(syslogger)

95

97

96

98

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

100

102

logger.addHandler(console)

101

103

102

104

class AvahiError(Exception):

119

121

Attributes:

120

122

interface: integer; avahi.IF_UNSPEC or an interface index.

121

123

Used to optionally bind to the specified interface.

122

name: string; Example: u'Mandos'

123

type: string; Example: u'_mandos._tcp'.

124

name: string; Example: 'Mandos'

125

type: string; Example: '_mandos._tcp'.

124

126

See <http://www.dns-sd.org/ServiceTypes.html>

125

127

port: integer; what port to announce

126

128

TXT: list of strings; TXT record for the service

135

137

"""

136

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

137

139

servicetype = None, port = None, TXT = None,

138

domain = u"", host = u"", max_renames = 32768,

140

domain = "", host = "", max_renames = 32768,

139

141

protocol = avahi.PROTO_UNSPEC, bus = None):

140

142

self.interface = interface

141

143

self.name = name

150

152

self.group = None # our entry group

151

153

self.server = None

152

154

self.bus = bus

155

self.entry_group_state_changed_match = None

153

156

def rename(self):

154

157

"""Derived from the Avahi example code"""

155

158

if self.rename_count >= self.max_renames:

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

158

161

self.rename_count)

159

raise AvahiServiceError(u"Too many renames")

162

raise AvahiServiceError("Too many renames")

160

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

164

logger.info("Changing Zeroconf service name to %r ...",

162

165

self.name)

163

166

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

166

169

% self.name))

167

170

self.remove()

168

171

try:

169

172

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

173

except dbus.exceptions.DBusException as error:

174

logger.critical("DBusException: %s", error)

172

175

self.cleanup()

173

176

os._exit(1)

174

177

self.rename_count += 1

175

178

def remove(self):

176

179

"""Derived from the Avahi example code"""

180

if self.entry_group_state_changed_match is not None:

181

self.entry_group_state_changed_match.remove()

182

self.entry_group_state_changed_match = None

177

183

if self.group is not None:

178

184

self.group.Reset()

179

185

def add(self):

180

186

"""Derived from the Avahi example code"""

187

self.remove()

181

188

if self.group is None:

182

189

self.group = dbus.Interface(

183

190

self.bus.get_object(avahi.DBUS_NAME,

184

191

self.server.EntryGroupNew()),

185

192

avahi.DBUS_INTERFACE_ENTRY_GROUP)

186

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

193

self.entry_group_state_changed_match = (

194

self.group.connect_to_signal(

195

'StateChanged', self .entry_group_state_changed))

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

190

197

self.name, self.type)

191

198

self.group.AddService(

192

199

self.interface,

199

206

self.group.Commit()

200

207

def entry_group_state_changed(self, state, error):

201

208

"""Derived from the Avahi example code"""

202

logger.debug(u"Avahi entry group state change: %i", state)

209

logger.debug("Avahi entry group state change: %i", state)

203

210

204

211

if state == avahi.ENTRY_GROUP_ESTABLISHED:

205

logger.debug(u"Zeroconf service established.")

212

logger.debug("Zeroconf service established.")

206

213

elif state == avahi.ENTRY_GROUP_COLLISION:

207

logger.warning(u"Zeroconf service name collision.")

214

logger.info("Zeroconf service name collision.")

208

215

self.rename()

209

216

elif state == avahi.ENTRY_GROUP_FAILURE:

210

logger.critical(u"Avahi: Error in group state changed %s",

217

logger.critical("Avahi: Error in group state changed %s",

211

218

unicode(error))

212

raise AvahiGroupError(u"State changed: %s"

219

raise AvahiGroupError("State changed: %s"

213

220

% unicode(error))

214

221

def cleanup(self):

215

222

"""Derived from the Avahi example code"""

216

223

if self.group is not None:

217

self.group.Free()

224

try:

225

self.group.Free()

226

except (dbus.exceptions.UnknownMethodException,

227

dbus.exceptions.DBusException) as e:

228

pass

218

229

self.group = None

219

def server_state_changed(self, state):

230

self.remove()

231

def server_state_changed(self, state, error=None):

220

232

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

222

if state == avahi.SERVER_COLLISION:

223

logger.error(u"Zeroconf server name collision")

224

self.remove()

233

logger.debug("Avahi server state change: %i", state)

234

bad_states = { avahi.SERVER_INVALID:

235

"Zeroconf server invalid",

236

avahi.SERVER_REGISTERING: None,

237

avahi.SERVER_COLLISION:

238

"Zeroconf server name collision",

239

avahi.SERVER_FAILURE:

240

"Zeroconf server failure" }

241

if state in bad_states:

242

if bad_states[state] is not None:

243

if error is None:

244

logger.error(bad_states[state])

245

else:

246

logger.error(bad_states[state] + ": %r", error)

247

self.cleanup()

225

248

elif state == avahi.SERVER_RUNNING:

226

249

self.add()

250

else:

251

if error is None:

252

logger.debug("Unknown state: %r", state)

253

else:

254

logger.debug("Unknown state: %r: %r", state, error)

227

255

def activate(self):

228

256

"""Derived from the Avahi example code"""

229

257

if self.server is None:

230

258

self.server = dbus.Interface(

231

259

self.bus.get_object(avahi.DBUS_NAME,

232

avahi.DBUS_PATH_SERVER),

260

avahi.DBUS_PATH_SERVER,

261

follow_name_owner_changes=True),

233

262

avahi.DBUS_INTERFACE_SERVER)

234

self.server.connect_to_signal(u"StateChanged",

263

self.server.connect_to_signal("StateChanged",

235

264

self.server_state_changed)

236

265

self.server_state_changed(self.server.GetState())

237

266

238

267

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

239

274

class Client(object):

240

275

"""A representation of a client host served by this server.

241

276

269

304

secret: bytestring; sent verbatim (over TLS) to client

270

305

timeout: datetime.timedelta(); How long from last_checked_ok

271

306

until this client is disabled

307

extended_timeout: extra long timeout when password has been sent

272

308

runtime_expansions: Allowed attributes for runtime expansion.

309

expires: datetime.datetime(); time (UTC) when a client will be

310

disabled, or None

273

311

"""

274

312

275

runtime_expansions = (u"approval_delay", u"approval_duration",

276

u"created", u"enabled", u"fingerprint",

277

u"host", u"interval", u"last_checked_ok",

278

u"last_enabled", u"name", u"timeout")

279

280

@staticmethod

281

def _timedelta_to_milliseconds(td):

282

"Convert a datetime.timedelta() to milliseconds"

283

return ((td.days * 24 * 60 * 60 * 1000)

284

+ (td.seconds * 1000)

285

+ (td.microseconds // 1000))

313

runtime_expansions = ("approval_delay", "approval_duration",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

316

"last_enabled", "name", "timeout")

286

317

287

318

def timeout_milliseconds(self):

288

319

"Return the 'timeout' attribute in milliseconds"

289

return self._timedelta_to_milliseconds(self.timeout)

320

return _timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

290

325

291

326

def interval_milliseconds(self):

292

327

"Return the 'interval' attribute in milliseconds"

293

return self._timedelta_to_milliseconds(self.interval)

294

328

return _timedelta_to_milliseconds(self.interval)

329

295

330

def approval_delay_milliseconds(self):

296

return self._timedelta_to_milliseconds(self.approval_delay)

331

return _timedelta_to_milliseconds(self.approval_delay)

297

332

298

333

def __init__(self, name = None, disable_hook=None, config=None):

299

334

"""Note: the 'checker' key in 'config' sets the

302

337

self.name = name

303

338

if config is None:

304

339

config = {}

305

logger.debug(u"Creating client %r", self.name)

340

logger.debug("Creating client %r", self.name)

306

341

# Uppercase and remove spaces from fingerprint for later

307

342

# comparison purposes with return value from the fingerprint()

308

343

# function

309

self.fingerprint = (config[u"fingerprint"].upper()

310

.replace(u" ", u""))

311

logger.debug(u" Fingerprint: %s", self.fingerprint)

312

if u"secret" in config:

313

self.secret = config[u"secret"].decode(u"base64")

314

elif u"secfile" in config:

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

315

350

with open(os.path.expanduser(os.path.expandvars

316

(config[u"secfile"])),

351

(config["secfile"])),

317

352

"rb") as secfile:

318

353

self.secret = secfile.read()

319

354

else:

320

raise TypeError(u"No secret or secfile for client %s"

355

raise TypeError("No secret or secfile for client %s"

321

356

% self.name)

322

self.host = config.get(u"host", u"")

357

self.host = config.get("host", "")

323

358

self.created = datetime.datetime.utcnow()

324

359

self.enabled = False

325

360

self.last_approval_request = None

326

361

self.last_enabled = None

327

362

self.last_checked_ok = None

328

self.timeout = string_to_delta(config[u"timeout"])

329

self.interval = string_to_delta(config[u"interval"])

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

330

366

self.disable_hook = disable_hook

331

367

self.checker = None

332

368

self.checker_initiator_tag = None

333

369

self.disable_initiator_tag = None

370

self.expires = None

334

371

self.checker_callback_tag = None

335

self.checker_command = config[u"checker"]

372

self.checker_command = config["checker"]

336

373

self.current_checker_command = None

337

374

self.last_connect = None

338

375

self._approved = None

339

self.approved_by_default = config.get(u"approved_by_default",

376

self.approved_by_default = config.get("approved_by_default",

340

377

True)

341

378

self.approvals_pending = 0

342

379

self.approval_delay = string_to_delta(

343

config[u"approval_delay"])

380

config["approval_delay"])

344

381

self.approval_duration = string_to_delta(

345

config[u"approval_duration"])

382

config["approval_duration"])

346

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

347

384

348

385

def send_changedstate(self):

352

389

353

390

def enable(self):

354

391

"""Start this client's checker and timeout hooks"""

355

if getattr(self, u"enabled", False):

392

if getattr(self, "enabled", False):

356

393

# Already enabled

357

394

return

358

395

self.send_changedstate()

359

self.last_enabled = datetime.datetime.utcnow()

360

396

# Schedule a new checker to be started an 'interval' from now,

361

397

# and every interval from then on.

362

398

self.checker_initiator_tag = (gobject.timeout_add

363

399

(self.interval_milliseconds(),

364

400

self.start_checker))

365

401

# Schedule a disable() when 'timeout' has passed

402

self.expires = datetime.datetime.utcnow() + self.timeout

366

403

self.disable_initiator_tag = (gobject.timeout_add

367

404

(self.timeout_milliseconds(),

368

405

self.disable))

369

406

self.enabled = True

407

self.last_enabled = datetime.datetime.utcnow()

370

408

# Also start a new checker *right now*.

371

409

self.start_checker()

372

410

377

415

if not quiet:

378

416

self.send_changedstate()

379

417

if not quiet:

380

logger.info(u"Disabling client %s", self.name)

381

if getattr(self, u"disable_initiator_tag", False):

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

382

420

gobject.source_remove(self.disable_initiator_tag)

383

421

self.disable_initiator_tag = None

384

if getattr(self, u"checker_initiator_tag", False):

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

385

424

gobject.source_remove(self.checker_initiator_tag)

386

425

self.checker_initiator_tag = None

387

426

self.stop_checker()

402

441

if os.WIFEXITED(condition):

403

442

exitstatus = os.WEXITSTATUS(condition)

404

443

if exitstatus == 0:

405

logger.info(u"Checker for %(name)s succeeded",

444

logger.info("Checker for %(name)s succeeded",

406

445

vars(self))

407

446

self.checked_ok()

408

447

else:

409

logger.info(u"Checker for %(name)s failed",

448

logger.info("Checker for %(name)s failed",

410

449

vars(self))

411

450

else:

412

logger.warning(u"Checker for %(name)s crashed?",

451

logger.warning("Checker for %(name)s crashed?",

413

452

vars(self))

414

453

415

def checked_ok(self):

454

def checked_ok(self, timeout=None):

416

455

"""Bump up the timeout for this client.

417

456

418

457

This should only be called when the client has been seen,

419

458

alive and well.

420

459

"""

460

if timeout is None:

461

timeout = self.timeout

421

462

self.last_checked_ok = datetime.datetime.utcnow()

422

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

423

465

self.disable_initiator_tag = (gobject.timeout_add

424

(self.timeout_milliseconds(),

466

(_timedelta_to_milliseconds(timeout),

425

467

self.disable))

426

468

427

469

def need_approval(self):

444

486

# If a checker exists, make sure it is not a zombie

445

487

try:

446

488

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

447

except (AttributeError, OSError), error:

489

except (AttributeError, OSError) as error:

448

490

if (isinstance(error, OSError)

449

491

and error.errno != errno.ECHILD):

450

492

raise error

451

493

else:

452

494

if pid:

453

logger.warning(u"Checker was a zombie")

495

logger.warning("Checker was a zombie")

454

496

gobject.source_remove(self.checker_callback_tag)

455

497

self.checker_callback(pid, status,

456

498

self.current_checker_command)

463

505

# Escape attributes for the shell

464

506

escaped_attrs = dict(

465

507

(attr,

466

re.escape(unicode(str(getattr(self, attr, u"")),

508

re.escape(unicode(str(getattr(self, attr, "")),

467

509

errors=

468

u'replace')))

510

'replace')))

469

511

for attr in

470

512

self.runtime_expansions)

471

513

472

514

try:

473

515

command = self.checker_command % escaped_attrs

474

except TypeError, error:

475

logger.error(u'Could not format string "%s":'

476

u' %s', self.checker_command, error)

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

477

519

return True # Try again later

478

520

self.current_checker_command = command

479

521

try:

480

logger.info(u"Starting checker %r for %s",

522

logger.info("Starting checker %r for %s",

481

523

command, self.name)

482

524

# We don't need to redirect stdout and stderr, since

483

525

# in normal mode, that is already done by daemon(),

485

527

# always replaced by /dev/null.)

486

528

self.checker = subprocess.Popen(command,

487

529

close_fds=True,

488

shell=True, cwd=u"/")

530

shell=True, cwd="/")

489

531

self.checker_callback_tag = (gobject.child_watch_add

490

532

(self.checker.pid,

491

533

self.checker_callback,

496

538

if pid:

497

539

gobject.source_remove(self.checker_callback_tag)

498

540

self.checker_callback(pid, status, command)

499

except OSError, error:

500

logger.error(u"Failed to start subprocess: %s",

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

501

543

error)

502

544

# Re-run this periodically if run by gobject.timeout_add

503

545

return True

507

549

if self.checker_callback_tag:

508

550

gobject.source_remove(self.checker_callback_tag)

509

551

self.checker_callback_tag = None

510

if getattr(self, u"checker", None) is None:

552

if getattr(self, "checker", None) is None:

511

553

return

512

logger.debug(u"Stopping checker for %(name)s", vars(self))

554

logger.debug("Stopping checker for %(name)s", vars(self))

513

555

try:

514

556

os.kill(self.checker.pid, signal.SIGTERM)

515

557

#time.sleep(0.5)

516

558

#if self.checker.poll() is None:

517

559

# os.kill(self.checker.pid, signal.SIGKILL)

518

except OSError, error:

560

except OSError as error:

519

561

if error.errno != errno.ESRCH: # No such process

520

562

raise

521

563

self.checker = None

522

564

523

def dbus_service_property(dbus_interface, signature=u"v",

524

access=u"readwrite", byte_arrays=False):

565

566

def dbus_service_property(dbus_interface, signature="v",

567

access="readwrite", byte_arrays=False):

525

568

"""Decorators for marking methods of a DBusObjectWithProperties to

526

569

become properties on the D-Bus.

527

570

534

577

"""

535

578

# Encoding deeply encoded byte arrays is not supported yet by the

536

579

# "Set" method, so we fail early here:

537

if byte_arrays and signature != u"ay":

538

raise ValueError(u"Byte arrays not supported for non-'ay'"

539

u" signature %r" % signature)

580

if byte_arrays and signature != "ay":

581

raise ValueError("Byte arrays not supported for non-'ay'"

582

" signature %r" % signature)

540

583

def decorator(func):

541

584

func._dbus_is_property = True

542

585

func._dbus_interface = dbus_interface

543

586

func._dbus_signature = signature

544

587

func._dbus_access = access

545

588

func._dbus_name = func.__name__

546

if func._dbus_name.endswith(u"_dbus_property"):

589

if func._dbus_name.endswith("_dbus_property"):

547

590

func._dbus_name = func._dbus_name[:-14]

548

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

591

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

549

592

return func

550

593

return decorator

551

594

571

614

572

615

class DBusObjectWithProperties(dbus.service.Object):

573

616

"""A D-Bus object with properties.

574

617

575

618

Classes inheriting from this can use the dbus_service_property

576

619

decorator to expose methods as D-Bus properties. It exposes the

577

620

standard Get(), Set(), and GetAll() methods on the D-Bus.

579

622

580

623

@staticmethod

581

624

def _is_dbus_property(obj):

582

return getattr(obj, u"_dbus_is_property", False)

625

return getattr(obj, "_dbus_is_property", False)

583

626

584

627

def _get_all_dbus_properties(self):

585

628

"""Returns a generator of (name, attribute) pairs

586

629

"""

587

return ((prop._dbus_name, prop)

588

for name, prop in

589

inspect.getmembers(self, self._is_dbus_property))

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

631

for cls in self.__class__.__mro__

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

590

633

591

634

def _get_dbus_property(self, interface_name, property_name):

592

635

"""Returns a bound method if one exists which is a D-Bus

593

636

property with the specified name and interface.

594

637

"""

595

for name in (property_name,

596

property_name + u"_dbus_property"):

597

prop = getattr(self, name, None)

598

if (prop is None

599

or not self._is_dbus_property(prop)

600

or prop._dbus_name != property_name

601

or (interface_name and prop._dbus_interface

602

and interface_name != prop._dbus_interface)):

603

continue

604

return prop

638

for cls in self.__class__.__mro__:

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

641

return value.__get__(self)

642

605

643

# No such property

606

raise DBusPropertyNotFound(self.dbus_object_path + u":"

607

+ interface_name + u"."

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

645

+ interface_name + "."

608

646

+ property_name)

647

609

648

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

611

out_signature=u"v")

649

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

650

out_signature="v")

612

651

def Get(self, interface_name, property_name):

613

652

"""Standard D-Bus property Get() method, see D-Bus standard.

614

653

"""

615

654

prop = self._get_dbus_property(interface_name, property_name)

616

if prop._dbus_access == u"write":

655

if prop._dbus_access == "write":

617

656

raise DBusPropertyAccessException(property_name)

618

657

value = prop()

619

if not hasattr(value, u"variant_level"):

658

if not hasattr(value, "variant_level"):

620

659

return value

621

660

return type(value)(value, variant_level=value.variant_level+1)

622

661

623

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

662

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

624

663

def Set(self, interface_name, property_name, value):

625

664

"""Standard D-Bus property Set() method, see D-Bus standard.

626

665

"""

627

666

prop = self._get_dbus_property(interface_name, property_name)

628

if prop._dbus_access == u"read":

667

if prop._dbus_access == "read":

629

668

raise DBusPropertyAccessException(property_name)

630

if prop._dbus_get_args_options[u"byte_arrays"]:

669

if prop._dbus_get_args_options["byte_arrays"]:

631

670

# The byte_arrays option is not supported yet on

632

671

# signatures other than "ay".

633

if prop._dbus_signature != u"ay":

672

if prop._dbus_signature != "ay":

634

673

raise ValueError

635

674

value = dbus.ByteArray(''.join(unichr(byte)

636

675

for byte in value))

637

676

prop(value)

638

677

639

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

640

out_signature=u"a{sv}")

678

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

679

out_signature="a{sv}")

641

680

def GetAll(self, interface_name):

642

681

"""Standard D-Bus property GetAll() method, see D-Bus

643

682

standard.

644

683

645

684

Note: Will not include properties with access="write".

646

685

"""

647

686

all = {}

651

690

# Interface non-empty but did not match

652

691

continue

653

692

# Ignore write-only properties

654

if prop._dbus_access == u"write":

693

if prop._dbus_access == "write":

655

694

continue

656

695

value = prop()

657

if not hasattr(value, u"variant_level"):

696

if not hasattr(value, "variant_level"):

658

697

all[name] = value

659

698

continue

660

699

all[name] = type(value)(value, variant_level=

661

700

value.variant_level+1)

662

return dbus.Dictionary(all, signature=u"sv")

701

return dbus.Dictionary(all, signature="sv")

663

702

664

703

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

665

out_signature=u"s",

704

out_signature="s",

666

705

path_keyword='object_path',

667

706

connection_keyword='connection')

668

707

def Introspect(self, object_path, connection):

673

712

try:

674

713

document = xml.dom.minidom.parseString(xmlstring)

675

714

def make_tag(document, name, prop):

676

e = document.createElement(u"property")

677

e.setAttribute(u"name", name)

678

e.setAttribute(u"type", prop._dbus_signature)

679

e.setAttribute(u"access", prop._dbus_access)

715

e = document.createElement("property")

716

e.setAttribute("name", name)

717

e.setAttribute("type", prop._dbus_signature)

718

e.setAttribute("access", prop._dbus_access)

680

719

return e

681

for if_tag in document.getElementsByTagName(u"interface"):

720

for if_tag in document.getElementsByTagName("interface"):

682

721

for tag in (make_tag(document, name, prop)

683

722

for name, prop

684

723

in self._get_all_dbus_properties()

685

724

if prop._dbus_interface

686

== if_tag.getAttribute(u"name")):

725

== if_tag.getAttribute("name")):

687

726

if_tag.appendChild(tag)

688

727

# Add the names to the return values for the

689

728

# "org.freedesktop.DBus.Properties" methods

690

if (if_tag.getAttribute(u"name")

691

== u"org.freedesktop.DBus.Properties"):

692

for cn in if_tag.getElementsByTagName(u"method"):

693

if cn.getAttribute(u"name") == u"Get":

694

for arg in cn.getElementsByTagName(u"arg"):

695

if (arg.getAttribute(u"direction")

696

== u"out"):

697

arg.setAttribute(u"name", u"value")

698

elif cn.getAttribute(u"name") == u"GetAll":

699

for arg in cn.getElementsByTagName(u"arg"):

700

if (arg.getAttribute(u"direction")

701

== u"out"):

702

arg.setAttribute(u"name", u"props")

703

xmlstring = document.toxml(u"utf-8")

729

if (if_tag.getAttribute("name")

730

== "org.freedesktop.DBus.Properties"):

731

for cn in if_tag.getElementsByTagName("method"):

732

if cn.getAttribute("name") == "Get":

733

for arg in cn.getElementsByTagName("arg"):

734

if (arg.getAttribute("direction")

735

== "out"):

736

arg.setAttribute("name", "value")

737

elif cn.getAttribute("name") == "GetAll":

738

for arg in cn.getElementsByTagName("arg"):

739

if (arg.getAttribute("direction")

740

== "out"):

741

arg.setAttribute("name", "props")

742

xmlstring = document.toxml("utf-8")

704

743

document.unlink()

705

744

except (AttributeError, xml.dom.DOMException,

706

xml.parsers.expat.ExpatError), error:

707

logger.error(u"Failed to override Introspection method",

745

xml.parsers.expat.ExpatError) as error:

746

logger.error("Failed to override Introspection method",

708

747

error)

709

748

return xmlstring

710

749

711

750

751

def datetime_to_dbus (dt, variant_level=0):

752

"""Convert a UTC datetime.datetime() to a D-Bus type."""

753

if dt is None:

754

return dbus.String("", variant_level = variant_level)

755

return dbus.String(dt.isoformat(),

756

variant_level=variant_level)

757

758

class transitional_dbus_metaclass(DBusObjectWithProperties.__metaclass__):

759

def __new__(mcs, name, bases, attr):

760

for attrname, old_dbusobj in inspect.getmembers(bases[0]):

761

new_interface = getattr(old_dbusobj, "_dbus_interface", "").replace("se.bsnet.fukt.", "se.recompile.")

762

if (getattr(old_dbusobj, "_dbus_is_signal", False)

763

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

764

unwrappedfunc = dict(zip(old_dbusobj.func_code.co_freevars,

765

old_dbusobj.__closure__))["func"].cell_contents

766

newfunc = types.FunctionType(unwrappedfunc.func_code,

767

unwrappedfunc.func_globals,

768

unwrappedfunc.func_name,

769

unwrappedfunc.func_defaults,

770

unwrappedfunc.func_closure)

771

new_dbusfunc = dbus.service.signal(

772

new_interface, old_dbusobj._dbus_signature)(newfunc)

773

attr["_transitional_" + attrname] = new_dbusfunc

774

775

def fixscope(func1, func2):

776

def newcall(*args, **kwargs):

777

func1(*args, **kwargs)

778

func2(*args, **kwargs)

779

return newcall

780

781

attr[attrname] = fixscope(old_dbusobj, new_dbusfunc)

782

783

elif (getattr(old_dbusobj, "_dbus_is_method", False)

784

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

785

new_dbusfunc = (dbus.service.method

786

(new_interface,

787

old_dbusobj._dbus_in_signature,

788

old_dbusobj._dbus_out_signature)

789

(types.FunctionType

790

(old_dbusobj.func_code,

791

old_dbusobj.func_globals,

792

old_dbusobj.func_name,

793

old_dbusobj.func_defaults,

794

old_dbusobj.func_closure)))

795

796

attr[attrname] = new_dbusfunc

797

elif (getattr(old_dbusobj, "_dbus_is_property", False)

798

and old_dbusobj._dbus_interface.startswith("se.bsnet.fukt.Mandos")):

799

new_dbusfunc = (dbus_service_property

800

(new_interface,

801

old_dbusobj._dbus_signature,

802

old_dbusobj._dbus_access,

803

old_dbusobj._dbus_get_args_options["byte_arrays"])

804

(types.FunctionType

805

(old_dbusobj.func_code,

806

old_dbusobj.func_globals,

807

old_dbusobj.func_name,

808

old_dbusobj.func_defaults,

809

old_dbusobj.func_closure)))

810

811

attr[attrname] = new_dbusfunc

812

return type.__new__(mcs, name, bases, attr)

813

712

814

class ClientDBus(Client, DBusObjectWithProperties):

713

815

"""A Client class using D-Bus

714

816

718

820

"""

719

821

720

822

runtime_expansions = (Client.runtime_expansions

721

+ (u"dbus_object_path",))

823

+ ("dbus_object_path",))

722

824

723

825

# dbus.service.Object doesn't use super(), so we can't either.

724

826

729

831

# Only now, when this client is initialized, can it show up on

730

832

# the D-Bus

731

833

client_object_name = unicode(self.name).translate(

732

{ord(u"."): ord(u"_"),

733

ord(u"-"): ord(u"_")})

834

{ord("."): ord("_"),

835

ord("-"): ord("_")})

734

836

self.dbus_object_path = (dbus.ObjectPath

735

(u"/clients/" + client_object_name))

837

("/clients/" + client_object_name))

736

838

DBusObjectWithProperties.__init__(self, self.bus,

737

839

self.dbus_object_path)

738

840

739

def _get_approvals_pending(self):

740

return self._approvals_pending

741

def _set_approvals_pending(self, value):

742

old_value = self._approvals_pending

743

self._approvals_pending = value

744

bval = bool(value)

745

if (hasattr(self, "dbus_object_path")

746

and bval is not bool(old_value)):

747

dbus_bool = dbus.Boolean(bval, variant_level=1)

748

self.PropertyChanged(dbus.String(u"ApprovalPending"),

749

dbus_bool)

750

751

approvals_pending = property(_get_approvals_pending,

752

_set_approvals_pending)

753

del _get_approvals_pending, _set_approvals_pending

754

755

@staticmethod

756

def _datetime_to_dbus(dt, variant_level=0):

757

"""Convert a UTC datetime.datetime() to a D-Bus type."""

758

return dbus.String(dt.isoformat(),

759

variant_level=variant_level)

760

761

def enable(self):

762

oldstate = getattr(self, u"enabled", False)

763

r = Client.enable(self)

764

if oldstate != self.enabled:

765

# Emit D-Bus signals

766

self.PropertyChanged(dbus.String(u"Enabled"),

767

dbus.Boolean(True, variant_level=1))

768

self.PropertyChanged(

769

dbus.String(u"LastEnabled"),

770

self._datetime_to_dbus(self.last_enabled,

771

variant_level=1))

772

return r

773

774

def disable(self, quiet = False):

775

oldstate = getattr(self, u"enabled", False)

776

r = Client.disable(self, quiet=quiet)

777

if not quiet and oldstate != self.enabled:

778

# Emit D-Bus signal

779

self.PropertyChanged(dbus.String(u"Enabled"),

780

dbus.Boolean(False, variant_level=1))

781

return r

841

def notifychangeproperty(transform_func,

842

dbus_name, type_func=lambda x: x,

843

variant_level=1):

844

""" Modify a variable so that its a property that announce its

845

changes to DBus.

846

transform_fun: Function that takes a value and transform it to

847

DBus type.

848

dbus_name: DBus name of the variable

849

type_func: Function that transform the value before sending it

850

to DBus

851

variant_level: DBus variant level. default: 1

852

"""

853

real_value = [None,]

854

def setter(self, value):

855

old_value = real_value[0]

856

real_value[0] = value

857

if hasattr(self, "dbus_object_path"):

858

if type_func(old_value) != type_func(real_value[0]):

859

dbus_value = transform_func(type_func(real_value[0]),

860

variant_level)

861

self.PropertyChanged(dbus.String(dbus_name),

862

dbus_value)

863

864

return property(lambda self: real_value[0], setter)

865

866

867

expires = notifychangeproperty(datetime_to_dbus, "Expires")

868

approvals_pending = notifychangeproperty(dbus.Boolean,

869

"ApprovalPending",

870

type_func = bool)

871

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

872

last_enabled = notifychangeproperty(datetime_to_dbus,

873

"LastEnabled")

874

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

875

type_func = lambda checker: checker is not None)

876

last_checked_ok = notifychangeproperty(datetime_to_dbus,

877

"LastCheckedOK")

878

last_approval_request = notifychangeproperty(datetime_to_dbus,

879

"LastApprovalRequest")

880

approved_by_default = notifychangeproperty(dbus.Boolean,

881

"ApprovedByDefault")

882

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

883

type_func = _timedelta_to_milliseconds)

884

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

885

type_func = _timedelta_to_milliseconds)

886

host = notifychangeproperty(dbus.String, "Host")

887

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

888

type_func = _timedelta_to_milliseconds)

889

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

890

type_func = _timedelta_to_milliseconds)

891

interval = notifychangeproperty(dbus.UInt16, "Interval",

892

type_func = _timedelta_to_milliseconds)

893

checker_command = notifychangeproperty(dbus.String, "Checker")

894

895

del notifychangeproperty

782

896

783

897

def __del__(self, *args, **kwargs):

784

898

try:

785

899

self.remove_from_connection()

786

900

except LookupError:

787

901

pass

788

if hasattr(DBusObjectWithProperties, u"__del__"):

902

if hasattr(DBusObjectWithProperties, "__del__"):

789

903

DBusObjectWithProperties.__del__(self, *args, **kwargs)

790

904

Client.__del__(self, *args, **kwargs)

791

905

793

907

*args, **kwargs):

794

908

self.checker_callback_tag = None

795

909

self.checker = None

796

# Emit D-Bus signal

797

self.PropertyChanged(dbus.String(u"CheckerRunning"),

798

dbus.Boolean(False, variant_level=1))

799

910

if os.WIFEXITED(condition):

800

911

exitstatus = os.WEXITSTATUS(condition)

801

912

# Emit D-Bus signal

811

922

return Client.checker_callback(self, pid, condition, command,

812

923

*args, **kwargs)

813

924

814

def checked_ok(self, *args, **kwargs):

815

r = Client.checked_ok(self, *args, **kwargs)

816

# Emit D-Bus signal

817

self.PropertyChanged(

818

dbus.String(u"LastCheckedOK"),

819

(self._datetime_to_dbus(self.last_checked_ok,

820

variant_level=1)))

821

return r

822

823

def need_approval(self, *args, **kwargs):

824

r = Client.need_approval(self, *args, **kwargs)

825

# Emit D-Bus signal

826

self.PropertyChanged(

827

dbus.String(u"LastApprovalRequest"),

828

(self._datetime_to_dbus(self.last_approval_request,

829

variant_level=1)))

830

return r

831

832

925

def start_checker(self, *args, **kwargs):

833

926

old_checker = self.checker

834

927

if self.checker is not None:

841

934

and old_checker_pid != self.checker.pid):

842

935

# Emit D-Bus signal

843

936

self.CheckerStarted(self.current_checker_command)

844

self.PropertyChanged(

845

dbus.String(u"CheckerRunning"),

846

dbus.Boolean(True, variant_level=1))

847

937

return r

848

938

849

def stop_checker(self, *args, **kwargs):

850

old_checker = getattr(self, u"checker", None)

851

r = Client.stop_checker(self, *args, **kwargs)

852

if (old_checker is not None

853

and getattr(self, u"checker", None) is None):

854

self.PropertyChanged(dbus.String(u"CheckerRunning"),

855

dbus.Boolean(False, variant_level=1))

856

return r

857

858

939

def _reset_approved(self):

859

940

self._approved = None

860

941

return False

862

943

def approve(self, value=True):

863

944

self.send_changedstate()

864

945

self._approved = value

865

gobject.timeout_add(self._timedelta_to_milliseconds

946

gobject.timeout_add(_timedelta_to_milliseconds

866

947

(self.approval_duration),

867

948

self._reset_approved)

868

949

869

950

870

951

## D-Bus methods, signals & properties

871

_interface = u"se.bsnet.fukt.Mandos.Client"

872

952

_interface = "se.bsnet.fukt.Mandos.Client"

953

873

954

## Signals

874

955

875

956

# CheckerCompleted - signal

876

@dbus.service.signal(_interface, signature=u"nxs")

957

@dbus.service.signal(_interface, signature="nxs")

877

958

def CheckerCompleted(self, exitcode, waitstatus, command):

878

959

"D-Bus signal"

879

960

pass

880

961

881

962

# CheckerStarted - signal

882

@dbus.service.signal(_interface, signature=u"s")

963

@dbus.service.signal(_interface, signature="s")

883

964

def CheckerStarted(self, command):

884

965

"D-Bus signal"

885

966

pass

886

967

887

968

# PropertyChanged - signal

888

@dbus.service.signal(_interface, signature=u"sv")

969

@dbus.service.signal(_interface, signature="sv")

889

970

def PropertyChanged(self, property, value):

890

971

"D-Bus signal"

891

972

pass

900

981

pass

901

982

902

983

# Rejected - signal

903

@dbus.service.signal(_interface, signature=u"s")

984

@dbus.service.signal(_interface, signature="s")

904

985

def Rejected(self, reason):

905

986

"D-Bus signal"

906

987

pass

907

988

908

989

# NeedApproval - signal

909

@dbus.service.signal(_interface, signature=u"tb")

990

@dbus.service.signal(_interface, signature="tb")

910

991

def NeedApproval(self, timeout, default):

911

992

"D-Bus signal"

912

993

return self.need_approval()

914

995

## Methods

915

996

916

997

# Approve - method

917

@dbus.service.method(_interface, in_signature=u"b")

998

@dbus.service.method(_interface, in_signature="b")

918

999

def Approve(self, value):

919

1000

self.approve(value)

920

1001

921

1002

# CheckedOK - method

922

1003

@dbus.service.method(_interface)

923

1004

def CheckedOK(self):

924

return self.checked_ok()

1005

self.checked_ok()

925

1006

926

1007

# Enable - method

927

1008

@dbus.service.method(_interface)

949

1030

## Properties

950

1031

951

1032

# ApprovalPending - property

952

@dbus_service_property(_interface, signature=u"b", access=u"read")

1033

@dbus_service_property(_interface, signature="b", access="read")

953

1034

def ApprovalPending_dbus_property(self):

954

1035

return dbus.Boolean(bool(self.approvals_pending))

955

1036

956

1037

# ApprovedByDefault - property

957

@dbus_service_property(_interface, signature=u"b",

958

access=u"readwrite")

1038

@dbus_service_property(_interface, signature="b",

1039

access="readwrite")

959

1040

def ApprovedByDefault_dbus_property(self, value=None):

960

1041

if value is None: # get

961

1042

return dbus.Boolean(self.approved_by_default)

962

1043

self.approved_by_default = bool(value)

963

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

965

dbus.Boolean(value, variant_level=1))

966

1044

967

1045

# ApprovalDelay - property

968

@dbus_service_property(_interface, signature=u"t",

969

access=u"readwrite")

1046

@dbus_service_property(_interface, signature="t",

1047

access="readwrite")

970

1048

def ApprovalDelay_dbus_property(self, value=None):

971

1049

if value is None: # get

972

1050

return dbus.UInt64(self.approval_delay_milliseconds())

973

1051

self.approval_delay = datetime.timedelta(0, 0, 0, value)

974

# Emit D-Bus signal

975

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

976

dbus.UInt64(value, variant_level=1))

977

1052

978

1053

# ApprovalDuration - property

979

@dbus_service_property(_interface, signature=u"t",

980

access=u"readwrite")

1054

@dbus_service_property(_interface, signature="t",

1055

access="readwrite")

981

1056

def ApprovalDuration_dbus_property(self, value=None):

982

1057

if value is None: # get

983

return dbus.UInt64(self._timedelta_to_milliseconds(

1058

return dbus.UInt64(_timedelta_to_milliseconds(

984

1059

self.approval_duration))

985

1060

self.approval_duration = datetime.timedelta(0, 0, 0, value)

986

# Emit D-Bus signal

987

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

988

dbus.UInt64(value, variant_level=1))

989

1061

990

1062

# Name - property

991

@dbus_service_property(_interface, signature=u"s", access=u"read")

1063

@dbus_service_property(_interface, signature="s", access="read")

992

1064

def Name_dbus_property(self):

993

1065

return dbus.String(self.name)

994

1066

995

1067

# Fingerprint - property

996

@dbus_service_property(_interface, signature=u"s", access=u"read")

1068

@dbus_service_property(_interface, signature="s", access="read")

997

1069

def Fingerprint_dbus_property(self):

998

1070

return dbus.String(self.fingerprint)

999

1071

1000

1072

# Host - property

1001

@dbus_service_property(_interface, signature=u"s",

1002

access=u"readwrite")

1073

@dbus_service_property(_interface, signature="s",

1074

access="readwrite")

1003

1075

def Host_dbus_property(self, value=None):

1004

1076

if value is None: # get

1005

1077

return dbus.String(self.host)

1006

1078

self.host = value

1007

# Emit D-Bus signal

1008

self.PropertyChanged(dbus.String(u"Host"),

1009

dbus.String(value, variant_level=1))

1010

1079

1011

1080

# Created - property

1012

@dbus_service_property(_interface, signature=u"s", access=u"read")

1081

@dbus_service_property(_interface, signature="s", access="read")

1013

1082

def Created_dbus_property(self):

1014

return dbus.String(self._datetime_to_dbus(self.created))

1083

return dbus.String(datetime_to_dbus(self.created))

1015

1084

1016

1085

# LastEnabled - property

1017

@dbus_service_property(_interface, signature=u"s", access=u"read")

1086

@dbus_service_property(_interface, signature="s", access="read")

1018

1087

def LastEnabled_dbus_property(self):

1019

if self.last_enabled is None:

1020

return dbus.String(u"")

1021

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1088

return datetime_to_dbus(self.last_enabled)

1022

1089

1023

1090

# Enabled - property

1024

@dbus_service_property(_interface, signature=u"b",

1025

access=u"readwrite")

1091

@dbus_service_property(_interface, signature="b",

1092

access="readwrite")

1026

1093

def Enabled_dbus_property(self, value=None):

1027

1094

if value is None: # get

1028

1095

return dbus.Boolean(self.enabled)

1032

1099

self.disable()

1033

1100

1034

1101

# LastCheckedOK - property

1035

@dbus_service_property(_interface, signature=u"s",

1036

access=u"readwrite")

1102

@dbus_service_property(_interface, signature="s",

1103

access="readwrite")

1037

1104

def LastCheckedOK_dbus_property(self, value=None):

1038

1105

if value is not None:

1039

1106

self.checked_ok()

1040

1107

return

1041

if self.last_checked_ok is None:

1042

return dbus.String(u"")

1043

return dbus.String(self._datetime_to_dbus(self

1044

.last_checked_ok))

1108

return datetime_to_dbus(self.last_checked_ok)

1109

1110

# Expires - property

1111

@dbus_service_property(_interface, signature="s", access="read")

1112

def Expires_dbus_property(self):

1113

return datetime_to_dbus(self.expires)

1045

1114

1046

1115

# LastApprovalRequest - property

1047

@dbus_service_property(_interface, signature=u"s", access=u"read")

1116

@dbus_service_property(_interface, signature="s", access="read")

1048

1117

def LastApprovalRequest_dbus_property(self):

1049

if self.last_approval_request is None:

1050

return dbus.String(u"")

1051

return dbus.String(self.

1052

_datetime_to_dbus(self

1053

.last_approval_request))

1118

return datetime_to_dbus(self.last_approval_request)

1054

1119

1055

1120

# Timeout - property

1056

@dbus_service_property(_interface, signature=u"t",

1057

access=u"readwrite")

1121

@dbus_service_property(_interface, signature="t",

1122

access="readwrite")

1058

1123

def Timeout_dbus_property(self, value=None):

1059

1124

if value is None: # get

1060

1125

return dbus.UInt64(self.timeout_milliseconds())

1061

1126

self.timeout = datetime.timedelta(0, 0, 0, value)

1062

# Emit D-Bus signal

1063

self.PropertyChanged(dbus.String(u"Timeout"),

1064

dbus.UInt64(value, variant_level=1))

1065

if getattr(self, u"disable_initiator_tag", None) is None:

1127

if getattr(self, "disable_initiator_tag", None) is None:

1066

1128

return

1067

1129

# Reschedule timeout

1068

1130

gobject.source_remove(self.disable_initiator_tag)

1069

1131

self.disable_initiator_tag = None

1132

self.expires = None

1070

1133

time_to_die = (self.

1071

1134

_timedelta_to_milliseconds((self

1072

1135

.last_checked_ok

1077

1140

# The timeout has passed

1078

1141

self.disable()

1079

1142

else:

1143

self.expires = (datetime.datetime.utcnow()

1144

+ datetime.timedelta(milliseconds = time_to_die))

1080

1145

self.disable_initiator_tag = (gobject.timeout_add

1081

1146

(time_to_die, self.disable))

1082

1147

1148

# ExtendedTimeout - property

1149

@dbus_service_property(_interface, signature="t",

1150

access="readwrite")

1151

def ExtendedTimeout_dbus_property(self, value=None):

1152

if value is None: # get

1153

return dbus.UInt64(self.extended_timeout_milliseconds())

1154

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1155

1083

1156

# Interval - property

1084

@dbus_service_property(_interface, signature=u"t",

1085

access=u"readwrite")

1157

@dbus_service_property(_interface, signature="t",

1158

access="readwrite")

1086

1159

def Interval_dbus_property(self, value=None):

1087

1160

if value is None: # get

1088

1161

return dbus.UInt64(self.interval_milliseconds())

1089

1162

self.interval = datetime.timedelta(0, 0, 0, value)

1090

# Emit D-Bus signal

1091

self.PropertyChanged(dbus.String(u"Interval"),

1092

dbus.UInt64(value, variant_level=1))

1093

if getattr(self, u"checker_initiator_tag", None) is None:

1163

if getattr(self, "checker_initiator_tag", None) is None:

1094

1164

return

1095

1165

# Reschedule checker run

1096

1166

gobject.source_remove(self.checker_initiator_tag)

1097

1167

self.checker_initiator_tag = (gobject.timeout_add

1098

1168

(value, self.start_checker))

1099

1169

self.start_checker() # Start one now, too

1100

1170

1101

1171

# Checker - property

1102

@dbus_service_property(_interface, signature=u"s",

1103

access=u"readwrite")

1172

@dbus_service_property(_interface, signature="s",

1173

access="readwrite")

1104

1174

def Checker_dbus_property(self, value=None):

1105

1175

if value is None: # get

1106

1176

return dbus.String(self.checker_command)

1107

1177

self.checker_command = value

1108

# Emit D-Bus signal

1109

self.PropertyChanged(dbus.String(u"Checker"),

1110

dbus.String(self.checker_command,

1111

variant_level=1))

1112

1178

1113

1179

# CheckerRunning - property

1114

@dbus_service_property(_interface, signature=u"b",

1115

access=u"readwrite")

1180

@dbus_service_property(_interface, signature="b",

1181

access="readwrite")

1116

1182

def CheckerRunning_dbus_property(self, value=None):

1117

1183

if value is None: # get

1118

1184

return dbus.Boolean(self.checker is not None)

1122

1188

self.stop_checker()

1123

1189

1124

1190

# ObjectPath - property

1125

@dbus_service_property(_interface, signature=u"o", access=u"read")

1191

@dbus_service_property(_interface, signature="o", access="read")

1126

1192

def ObjectPath_dbus_property(self):

1127

1193

return self.dbus_object_path # is already a dbus.ObjectPath

1128

1194

1129

1195

# Secret = property

1130

@dbus_service_property(_interface, signature=u"ay",

1131

access=u"write", byte_arrays=True)

1196

@dbus_service_property(_interface, signature="ay",

1197

access="write", byte_arrays=True)

1132

1198

def Secret_dbus_property(self, value):

1133

1199

self.secret = str(value)

1134

1200

1141

1207

self._pipe.send(('init', fpr, address))

1142

1208

if not self._pipe.recv():

1143

1209

raise KeyError()

1144

1210

1145

1211

def __getattribute__(self, name):

1146

1212

if(name == '_pipe'):

1147

1213

return super(ProxyClient, self).__getattribute__(name)

1154

1220

self._pipe.send(('funcall', name, args, kwargs))

1155

1221

return self._pipe.recv()[1]

1156

1222

return func

1157

1223

1158

1224

def __setattr__(self, name, value):

1159

1225

if(name == '_pipe'):

1160

1226

return super(ProxyClient, self).__setattr__(name, value)

1161

1227

self._pipe.send(('setattr', name, value))

1162

1228

1229

class ClientDBusTransitional(ClientDBus):

1230

__metaclass__ = transitional_dbus_metaclass

1163

1231

1164

1232

class ClientHandler(socketserver.BaseRequestHandler, object):

1165

1233

"""A class to handle client connections.

1169

1237

1170

1238

def handle(self):

1171

1239

with contextlib.closing(self.server.child_pipe) as child_pipe:

1172

logger.info(u"TCP connection from: %s",

1240

logger.info("TCP connection from: %s",

1173

1241

unicode(self.client_address))

1174

logger.debug(u"Pipe FD: %d",

1242

logger.debug("Pipe FD: %d",

1175

1243

self.server.child_pipe.fileno())

1176

1244

1177

1245

session = (gnutls.connection

1178

1246

.ClientSession(self.request,

1179

1247

gnutls.connection

1180

1248

.X509Credentials()))

1181

1249

1182

1250

# Note: gnutls.connection.X509Credentials is really a

1183

1251

# generic GnuTLS certificate credentials object so long as

1184

1252

# no X.509 keys are added to it. Therefore, we can use it

1185

1253

# here despite using OpenPGP certificates.

1186

1187

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1188

# u"+AES-256-CBC", u"+SHA1",

1189

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1190

# u"+DHE-DSS"))

1254

1255

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1256

# "+AES-256-CBC", "+SHA1",

1257

# "+COMP-NULL", "+CTYPE-OPENPGP",

1258

# "+DHE-DSS"))

1191

1259

# Use a fallback default, since this MUST be set.

1192

1260

priority = self.server.gnutls_priority

1193

1261

if priority is None:

1194

priority = u"NORMAL"

1262

priority = "NORMAL"

1195

1263

(gnutls.library.functions

1196

1264

.gnutls_priority_set_direct(session._c_object,

1197

1265

priority, None))

1198

1266

1199

1267

# Start communication using the Mandos protocol

1200

1268

# Get protocol number

1201

1269

line = self.request.makefile().readline()

1202

logger.debug(u"Protocol version: %r", line)

1270

logger.debug("Protocol version: %r", line)

1203

1271

try:

1204

1272

if int(line.strip().split()[0]) > 1:

1205

1273

raise RuntimeError

1206

except (ValueError, IndexError, RuntimeError), error:

1207

logger.error(u"Unknown protocol version: %s", error)

1274

except (ValueError, IndexError, RuntimeError) as error:

1275

logger.error("Unknown protocol version: %s", error)

1208

1276

return

1209

1277

1210

1278

# Start GnuTLS connection

1211

1279

try:

1212

1280

session.handshake()

1213

except gnutls.errors.GNUTLSError, error:

1214

logger.warning(u"Handshake failed: %s", error)

1281

except gnutls.errors.GNUTLSError as error:

1282

logger.warning("Handshake failed: %s", error)

1215

1283

# Do not run session.bye() here: the session is not

1216

1284

# established. Just abandon the request.

1217

1285

return

1218

logger.debug(u"Handshake succeeded")

1219

1286

logger.debug("Handshake succeeded")

1287

1220

1288

approval_required = False

1221

1289

try:

1222

1290

try:

1223

1291

fpr = self.fingerprint(self.peer_certificate

1224

1292

(session))

1225

except (TypeError, gnutls.errors.GNUTLSError), error:

1226

logger.warning(u"Bad certificate: %s", error)

1293

except (TypeError,

1294

gnutls.errors.GNUTLSError) as error:

1295

logger.warning("Bad certificate: %s", error)

1227

1296

return

1228

logger.debug(u"Fingerprint: %s", fpr)

1229

1297

logger.debug("Fingerprint: %s", fpr)

1298

1230

1299

try:

1231

1300

client = ProxyClient(child_pipe, fpr,

1232

1301

self.client_address)

1240

1309

1241

1310

while True:

1242

1311

if not client.enabled:

1243

logger.warning(u"Client %s is disabled",

1312

logger.info("Client %s is disabled",

1244

1313

client.name)

1245

1314

if self.server.use_dbus:

1246

1315

# Emit D-Bus signal

1251

1320

#We are approved or approval is disabled

1252

1321

break

1253

1322

elif client._approved is None:

1254

logger.info(u"Client %s needs approval",

1323

logger.info("Client %s needs approval",

1255

1324

client.name)

1256

1325

if self.server.use_dbus:

1257

1326

# Emit D-Bus signal

1259

1328

client.approval_delay_milliseconds(),

1260

1329

client.approved_by_default)

1261

1330

else:

1262

logger.warning(u"Client %s was not approved",

1331

logger.warning("Client %s was not approved",

1263

1332

client.name)

1264

1333

if self.server.use_dbus:

1265

1334

# Emit D-Bus signal

1291

1360

while sent_size < len(client.secret):

1292

1361

try:

1293

1362

sent = session.send(client.secret[sent_size:])

1294

except (gnutls.errors.GNUTLSError), error:

1363

except gnutls.errors.GNUTLSError as error:

1295

1364

logger.warning("gnutls send failed")

1296

1365

return

1297

logger.debug(u"Sent: %d, remaining: %d",

1366

logger.debug("Sent: %d, remaining: %d",

1298

1367

sent, len(client.secret)

1299

1368

- (sent_size + sent))

1300

1369

sent_size += sent

1301

1302

logger.info(u"Sending secret to %s", client.name)

1370

1371

logger.info("Sending secret to %s", client.name)

1303

1372

# bump the timeout as if seen

1304

client.checked_ok()

1373

client.checked_ok(client.extended_timeout)

1305

1374

if self.server.use_dbus:

1306

1375

# Emit D-Bus signal

1307

1376

client.GotSecret()

1311

1380

client.approvals_pending -= 1

1312

1381

try:

1313

1382

session.bye()

1314

except (gnutls.errors.GNUTLSError), error:

1383

except gnutls.errors.GNUTLSError as error:

1315

1384

logger.warning("GnuTLS bye failed")

1316

1385

1317

1386

@staticmethod

1328

1397

.gnutls_certificate_get_peers

1329

1398

(session._c_object, ctypes.byref(list_size)))

1330

1399

if not bool(cert_list) and list_size.value != 0:

1331

raise gnutls.errors.GNUTLSError(u"error getting peer"

1332

u" certificate")

1400

raise gnutls.errors.GNUTLSError("error getting peer"

1401

" certificate")

1333

1402

if list_size.value == 0:

1334

1403

return None

1335

1404

cert = cert_list[0]

1361

1430

if crtverify.value != 0:

1362

1431

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1363

1432

raise (gnutls.errors.CertificateSecurityError

1364

(u"Verify failed"))

1433

("Verify failed"))

1365

1434

# New buffer for the fingerprint

1366

1435

buf = ctypes.create_string_buffer(20)

1367

1436

buf_len = ctypes.c_size_t()

1374

1443

# Convert the buffer to a Python bytestring

1375

1444

fpr = ctypes.string_at(buf, buf_len.value)

1376

1445

# Convert the bytestring to hexadecimal notation

1377

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1446

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1378

1447

return hex_fpr

1379

1448

1380

1449

1392

1461

multiprocessing.Process(target = self.sub_process_main,

1393

1462

args = (request, address)).start()

1394

1463

1464

1395

1465

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1396

1466

""" adds a pipe to the MixIn """

1397

1467

def process_request(self, request, client_address):

1400

1470

This function creates a new pipe in self.pipe

1401

1471

"""

1402

1472

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1403

1473

1404

1474

super(MultiprocessingMixInWithPipe,

1405

1475

self).process_request(request, client_address)

1406

1476

self.child_pipe.close()

1407

1477

self.add_pipe(parent_pipe)

1408

1478

1409

1479

def add_pipe(self, parent_pipe):

1410

1480

"""Dummy function; override as necessary"""

1411

pass

1481

raise NotImplementedError

1482

1412

1483

1413

1484

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1414

1485

socketserver.TCPServer, object):

1432

1503

bind to an address or port if they were not specified."""

1433

1504

if self.interface is not None:

1434

1505

if SO_BINDTODEVICE is None:

1435

logger.error(u"SO_BINDTODEVICE does not exist;"

1436

u" cannot bind to interface %s",

1506

logger.error("SO_BINDTODEVICE does not exist;"

1507

" cannot bind to interface %s",

1437

1508

self.interface)

1438

1509

else:

1439

1510

try:

1440

1511

self.socket.setsockopt(socket.SOL_SOCKET,

1441

1512

SO_BINDTODEVICE,

1442

1513

str(self.interface

1443

+ u'\0'))

1444

except socket.error, error:

1514

+ '\0'))

1515

except socket.error as error:

1445

1516

if error[0] == errno.EPERM:

1446

logger.error(u"No permission to"

1447

u" bind to interface %s",

1517

logger.error("No permission to"

1518

" bind to interface %s",

1448

1519

self.interface)

1449

1520

elif error[0] == errno.ENOPROTOOPT:

1450

logger.error(u"SO_BINDTODEVICE not available;"

1451

u" cannot bind to interface %s",

1521

logger.error("SO_BINDTODEVICE not available;"

1522

" cannot bind to interface %s",

1452

1523

self.interface)

1453

1524

else:

1454

1525

raise

1456

1527

if self.server_address[0] or self.server_address[1]:

1457

1528

if not self.server_address[0]:

1458

1529

if self.address_family == socket.AF_INET6:

1459

any_address = u"::" # in6addr_any

1530

any_address = "::" # in6addr_any

1460

1531

else:

1461

1532

any_address = socket.INADDR_ANY

1462

1533

self.server_address = (any_address,

1511

1582

def handle_ipc(self, source, condition, parent_pipe=None,

1512

1583

client_object=None):

1513

1584

condition_names = {

1514

gobject.IO_IN: u"IN", # There is data to read.

1515

gobject.IO_OUT: u"OUT", # Data can be written (without

1585

gobject.IO_IN: "IN", # There is data to read.

1586

gobject.IO_OUT: "OUT", # Data can be written (without

1516

1587

# blocking).

1517

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1518

gobject.IO_ERR: u"ERR", # Error condition.

1519

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1588

gobject.IO_PRI: "PRI", # There is urgent data to read.

1589

gobject.IO_ERR: "ERR", # Error condition.

1590

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1520

1591

# broken, usually for pipes and

1521

1592

# sockets).

1522

1593

}

1541

1612

client = c

1542

1613

break

1543

1614

else:

1544

logger.warning(u"Client not found for fingerprint: %s, ad"

1545

u"dress: %s", fpr, address)

1615

logger.info("Client not found for fingerprint: %s, ad"

1616

"dress: %s", fpr, address)

1546

1617

if self.use_dbus:

1547

1618

# Emit D-Bus signal

1548

1619

mandos_dbus_service.ClientNotFound(fpr, address[0])

1563

1634

kwargs = request[3]

1564

1635

1565

1636

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1566

1637

1567

1638

if command == 'getattr':

1568

1639

attrname = request[1]

1569

1640

if callable(client_object.__getattribute__(attrname)):

1575

1646

attrname = request[1]

1576

1647

value = request[2]

1577

1648

setattr(client_object, attrname, value)

1578

1649

1579

1650

return True

1580

1651

1581

1652

1582

1653

def string_to_delta(interval):

1583

1654

"""Parse a string and return a datetime.timedelta

1584

1655

1585

>>> string_to_delta(u'7d')

1656

>>> string_to_delta('7d')

1586

1657

datetime.timedelta(7)

1587

>>> string_to_delta(u'60s')

1658

>>> string_to_delta('60s')

1588

1659

datetime.timedelta(0, 60)

1589

>>> string_to_delta(u'60m')

1660

>>> string_to_delta('60m')

1590

1661

datetime.timedelta(0, 3600)

1591

>>> string_to_delta(u'24h')

1662

>>> string_to_delta('24h')

1592

1663

datetime.timedelta(1)

1593

>>> string_to_delta(u'1w')

1664

>>> string_to_delta('1w')

1594

1665

datetime.timedelta(7)

1595

>>> string_to_delta(u'5m 30s')

1666

>>> string_to_delta('5m 30s')

1596

1667

datetime.timedelta(0, 330)

1597

1668

"""

1598

1669

timevalue = datetime.timedelta(0)

1600

1671

try:

1601

1672

suffix = unicode(s[-1])

1602

1673

value = int(s[:-1])

1603

if suffix == u"d":

1674

if suffix == "d":

1604

1675

delta = datetime.timedelta(value)

1605

elif suffix == u"s":

1676

elif suffix == "s":

1606

1677

delta = datetime.timedelta(0, value)

1607

elif suffix == u"m":

1678

elif suffix == "m":

1608

1679

delta = datetime.timedelta(0, 0, 0, 0, value)

1609

elif suffix == u"h":

1680

elif suffix == "h":

1610

1681

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1611

elif suffix == u"w":

1682

elif suffix == "w":

1612

1683

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1613

1684

else:

1614

raise ValueError(u"Unknown suffix %r" % suffix)

1615

except (ValueError, IndexError), e:

1616

raise ValueError(e.message)

1685

raise ValueError("Unknown suffix %r" % suffix)

1686

except (ValueError, IndexError) as e:

1687

raise ValueError(*(e.args))

1617

1688

timevalue += delta

1618

1689

return timevalue

1619

1690

1625

1696

global if_nametoindex

1626

1697

try:

1627

1698

if_nametoindex = (ctypes.cdll.LoadLibrary

1628

(ctypes.util.find_library(u"c"))

1699

(ctypes.util.find_library("c"))

1629

1700

.if_nametoindex)

1630

1701

except (OSError, AttributeError):

1631

logger.warning(u"Doing if_nametoindex the hard way")

1702

logger.warning("Doing if_nametoindex the hard way")

1632

1703

def if_nametoindex(interface):

1633

1704

"Get an interface index the hard way, i.e. using fcntl()"

1634

1705

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1635

1706

with contextlib.closing(socket.socket()) as s:

1636

1707

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1637

struct.pack(str(u"16s16x"),

1708

struct.pack(str("16s16x"),

1638

1709

interface))

1639

interface_index = struct.unpack(str(u"I"),

1710

interface_index = struct.unpack(str("I"),

1640

1711

ifreq[16:20])[0]

1641

1712

return interface_index

1642

1713

return if_nametoindex(interface)

1650

1721

sys.exit()

1651

1722

os.setsid()

1652

1723

if not nochdir:

1653

os.chdir(u"/")

1724

os.chdir("/")

1654

1725

if os.fork():

1655

1726

sys.exit()

1656

1727

if not noclose:

1658

1729

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1659

1730

if not stat.S_ISCHR(os.fstat(null).st_mode):

1660

1731

raise OSError(errno.ENODEV,

1661

u"%s not a character device"

1732

"%s not a character device"

1662

1733

% os.path.devnull)

1663

1734

os.dup2(null, sys.stdin.fileno())

1664

1735

os.dup2(null, sys.stdout.fileno())

1672

1743

##################################################################

1673

1744

# Parsing of options, both command line and config file

1674

1745

1675

parser = optparse.OptionParser(version = "%%prog %s" % version)

1676

parser.add_option("-i", u"--interface", type=u"string",

1677

metavar="IF", help=u"Bind to interface IF")

1678

parser.add_option("-a", u"--address", type=u"string",

1679

help=u"Address to listen for requests on")

1680

parser.add_option("-p", u"--port", type=u"int",

1681

help=u"Port number to receive requests on")

1682

parser.add_option("--check", action=u"store_true",

1683

help=u"Run self-test")

1684

parser.add_option("--debug", action=u"store_true",

1685

help=u"Debug mode; run in foreground and log to"

1686

u" terminal")

1687

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1688

help=u"Debug level for stdout output")

1689

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1690

u" priority string (see GnuTLS documentation)")

1691

parser.add_option("--servicename", type=u"string",

1692

metavar=u"NAME", help=u"Zeroconf service name")

1693

parser.add_option("--configdir", type=u"string",

1694

default=u"/etc/mandos", metavar=u"DIR",

1695

help=u"Directory to search for configuration"

1696

u" files")

1697

parser.add_option("--no-dbus", action=u"store_false",

1698

dest=u"use_dbus", help=u"Do not provide D-Bus"

1699

u" system bus interface")

1700

parser.add_option("--no-ipv6", action=u"store_false",

1701

dest=u"use_ipv6", help=u"Do not use IPv6")

1702

options = parser.parse_args()[0]

1746

parser = argparse.ArgumentParser()

1747

parser.add_argument("-v", "--version", action="version",

1748

version = "%%(prog)s %s" % version,

1749

help="show version number and exit")

1750

parser.add_argument("-i", "--interface", metavar="IF",

1751

help="Bind to interface IF")

1752

parser.add_argument("-a", "--address",

1753

help="Address to listen for requests on")

1754

parser.add_argument("-p", "--port", type=int,

1755

help="Port number to receive requests on")

1756

parser.add_argument("--check", action="store_true",

1757

help="Run self-test")

1758

parser.add_argument("--debug", action="store_true",

1759

help="Debug mode; run in foreground and log"

1760

" to terminal")

1761

parser.add_argument("--debuglevel", metavar="LEVEL",

1762

help="Debug level for stdout output")

1763

parser.add_argument("--priority", help="GnuTLS"

1764

" priority string (see GnuTLS documentation)")

1765

parser.add_argument("--servicename",

1766

metavar="NAME", help="Zeroconf service name")

1767

parser.add_argument("--configdir",

1768

default="/etc/mandos", metavar="DIR",

1769

help="Directory to search for configuration"

1770

" files")

1771

parser.add_argument("--no-dbus", action="store_false",

1772

dest="use_dbus", help="Do not provide D-Bus"

1773

" system bus interface")

1774

parser.add_argument("--no-ipv6", action="store_false",

1775

dest="use_ipv6", help="Do not use IPv6")

1776

options = parser.parse_args()

1703

1777

1704

1778

if options.check:

1705

1779

import doctest

1707

1781

sys.exit()

1708

1782

1709

1783

# Default values for config file for server-global settings

1710

server_defaults = { u"interface": u"",

1711

u"address": u"",

1712

u"port": u"",

1713

u"debug": u"False",

1714

u"priority":

1715

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1716

u"servicename": u"Mandos",

1717

u"use_dbus": u"True",

1718

u"use_ipv6": u"True",

1719

u"debuglevel": u"",

1784

server_defaults = { "interface": "",

1785

"address": "",

1786

"port": "",

1787

"debug": "False",

1788

"priority":

1789

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1790

"servicename": "Mandos",

1791

"use_dbus": "True",

1792

"use_ipv6": "True",

1793

"debuglevel": "",

1720

1794

}

1721

1795

1722

1796

# Parse config file for server-global settings

1723

1797

server_config = configparser.SafeConfigParser(server_defaults)

1724

1798

del server_defaults

1725

1799

server_config.read(os.path.join(options.configdir,

1726

u"mandos.conf"))

1800

"mandos.conf"))

1727

1801

# Convert the SafeConfigParser object to a dict

1728

1802

server_settings = server_config.defaults()

1729

1803

# Use the appropriate methods on the non-string config options

1730

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1731

server_settings[option] = server_config.getboolean(u"DEFAULT",

1804

for option in ("debug", "use_dbus", "use_ipv6"):

1805

server_settings[option] = server_config.getboolean("DEFAULT",

1732

1806

option)

1733

1807

if server_settings["port"]:

1734

server_settings["port"] = server_config.getint(u"DEFAULT",

1735

u"port")

1808

server_settings["port"] = server_config.getint("DEFAULT",

1809

"port")

1736

1810

del server_config

1737

1811

1738

1812

# Override the settings from the config file with command line

1739

1813

# options, if set.

1740

for option in (u"interface", u"address", u"port", u"debug",

1741

u"priority", u"servicename", u"configdir",

1742

u"use_dbus", u"use_ipv6", u"debuglevel"):

1814

for option in ("interface", "address", "port", "debug",

1815

"priority", "servicename", "configdir",

1816

"use_dbus", "use_ipv6", "debuglevel"):

1743

1817

value = getattr(options, option)

1744

1818

if value is not None:

1745

1819

server_settings[option] = value

1753

1827

##################################################################

1754

1828

1755

1829

# For convenience

1756

debug = server_settings[u"debug"]

1757

debuglevel = server_settings[u"debuglevel"]

1758

use_dbus = server_settings[u"use_dbus"]

1759

use_ipv6 = server_settings[u"use_ipv6"]

1760

1761

if server_settings[u"servicename"] != u"Mandos":

1830

debug = server_settings["debug"]

1831

debuglevel = server_settings["debuglevel"]

1832

use_dbus = server_settings["use_dbus"]

1833

use_ipv6 = server_settings["use_ipv6"]

1834

1835

if server_settings["servicename"] != "Mandos":

1762

1836

syslogger.setFormatter(logging.Formatter

1763

(u'Mandos (%s) [%%(process)d]:'

1764

u' %%(levelname)s: %%(message)s'

1765

% server_settings[u"servicename"]))

1837

('Mandos (%s) [%%(process)d]:'

1838

' %%(levelname)s: %%(message)s'

1839

% server_settings["servicename"]))

1766

1840

1767

1841

# Parse config file with clients

1768

client_defaults = { u"timeout": u"1h",

1769

u"interval": u"5m",

1770

u"checker": u"fping -q -- %%(host)s",

1771

u"host": u"",

1772

u"approval_delay": u"0s",

1773

u"approval_duration": u"1s",

1842

client_defaults = { "timeout": "5m",

1843

"extended_timeout": "15m",

1844

"interval": "2m",

1845

"checker": "fping -q -- %%(host)s",

1846

"host": "",

1847

"approval_delay": "0s",

1848

"approval_duration": "1s",

1774

1849

}

1775

1850

client_config = configparser.SafeConfigParser(client_defaults)

1776

client_config.read(os.path.join(server_settings[u"configdir"],

1777

u"clients.conf"))

1851

client_config.read(os.path.join(server_settings["configdir"],

1852

"clients.conf"))

1778

1853

1779

1854

global mandos_dbus_service

1780

1855

mandos_dbus_service = None

1781

1856

1782

tcp_server = MandosServer((server_settings[u"address"],

1783

server_settings[u"port"]),

1857

tcp_server = MandosServer((server_settings["address"],

1858

server_settings["port"]),

1784

1859

ClientHandler,

1785

interface=(server_settings[u"interface"]

1860

interface=(server_settings["interface"]

1786

1861

or None),

1787

1862

use_ipv6=use_ipv6,

1788

1863

gnutls_priority=

1789

server_settings[u"priority"],

1864

server_settings["priority"],

1790

1865

use_dbus=use_dbus)

1791

1866

if not debug:

1792

pidfilename = u"/var/run/mandos.pid"

1867

pidfilename = "/var/run/mandos.pid"

1793

1868

try:

1794

pidfile = open(pidfilename, u"w")

1869

pidfile = open(pidfilename, "w")

1795

1870

except IOError:

1796

logger.error(u"Could not open file %r", pidfilename)

1871

logger.error("Could not open file %r", pidfilename)

1797

1872

1798

1873

try:

1799

uid = pwd.getpwnam(u"_mandos").pw_uid

1800

gid = pwd.getpwnam(u"_mandos").pw_gid

1874

uid = pwd.getpwnam("_mandos").pw_uid

1875

gid = pwd.getpwnam("_mandos").pw_gid

1801

1876

except KeyError:

1802

1877

try:

1803

uid = pwd.getpwnam(u"mandos").pw_uid

1804

gid = pwd.getpwnam(u"mandos").pw_gid

1878

uid = pwd.getpwnam("mandos").pw_uid

1879

gid = pwd.getpwnam("mandos").pw_gid

1805

1880

except KeyError:

1806

1881

try:

1807

uid = pwd.getpwnam(u"nobody").pw_uid

1808

gid = pwd.getpwnam(u"nobody").pw_gid

1882

uid = pwd.getpwnam("nobody").pw_uid

1883

gid = pwd.getpwnam("nobody").pw_gid

1809

1884

except KeyError:

1810

1885

uid = 65534

1811

1886

gid = 65534

1812

1887

try:

1813

1888

os.setgid(gid)

1814

1889

os.setuid(uid)

1815

except OSError, error:

1890

except OSError as error:

1816

1891

if error[0] != errno.EPERM:

1817

1892

raise error

1818

1893

1823

1898

level = getattr(logging, debuglevel.upper())

1824

1899

syslogger.setLevel(level)

1825

1900

console.setLevel(level)

1826

1901

1827

1902

if debug:

1828

1903

# Enable all possible GnuTLS debugging

1829

1904

1833

1908

1834

1909

@gnutls.library.types.gnutls_log_func

1835

1910

def debug_gnutls(level, string):

1836

logger.debug(u"GnuTLS: %s", string[:-1])

1911

logger.debug("GnuTLS: %s", string[:-1])

1837

1912

1838

1913

(gnutls.library.functions

1839

1914

.gnutls_global_set_log_function(debug_gnutls))

1847

1922

# No console logging

1848

1923

logger.removeHandler(console)

1849

1924

1925

# Need to fork before connecting to D-Bus

1926

if not debug:

1927

# Close all input and output, do double fork, etc.

1928

daemon()

1850

1929

1851

1930

global main_loop

1852

1931

# From the Avahi example code

1856

1935

# End of Avahi example code

1857

1936

if use_dbus:

1858

1937

try:

1859

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1860

bus, do_not_queue=True)

1861

except dbus.exceptions.NameExistsException, e:

1862

logger.error(unicode(e) + u", disabling D-Bus")

1938

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1939

bus, do_not_queue=True)

1940

bus_name2 = dbus.service.BusName("se.recompile.Mandos",

1941

bus, do_not_queue=True)

1942

except dbus.exceptions.NameExistsException as e:

1943

logger.error(unicode(e) + ", disabling D-Bus")

1863

1944

use_dbus = False

1864

server_settings[u"use_dbus"] = False

1945

server_settings["use_dbus"] = False

1865

1946

tcp_server.use_dbus = False

1866

1947

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1867

service = AvahiService(name = server_settings[u"servicename"],

1868

servicetype = u"_mandos._tcp",

1948

service = AvahiService(name = server_settings["servicename"],

1949

servicetype = "_mandos._tcp",

1869

1950

protocol = protocol, bus = bus)

1870

1951

if server_settings["interface"]:

1871

1952

service.interface = (if_nametoindex

1872

(str(server_settings[u"interface"])))

1873

1874

if not debug:

1875

# Close all input and output, do double fork, etc.

1876

daemon()

1877

1953

(str(server_settings["interface"])))

1954

1878

1955

global multiprocessing_manager

1879

1956

multiprocessing_manager = multiprocessing.Manager()

1880

1957

1881

1958

client_class = Client

1882

1959

if use_dbus:

1883

client_class = functools.partial(ClientDBus, bus = bus)

1960

client_class = functools.partial(ClientDBusTransitional, bus = bus)

1884

1961

def client_config_items(config, section):

1885

1962

special_settings = {

1886

1963

"approved_by_default":

1899

1976

client_config, section)))

1900

1977

for section in client_config.sections()))

1901

1978

if not tcp_server.clients:

1902

logger.warning(u"No clients defined")

1979

logger.warning("No clients defined")

1903

1980

1904

1981

if not debug:

1905

1982

try:

1906

1983

with pidfile:

1907

1984

pid = os.getpid()

1908

pidfile.write(str(pid) + "\n")

1985

pidfile.write(str(pid) + "\n".encode("utf-8"))

1909

1986

del pidfile

1910

1987

except IOError:

1911

logger.error(u"Could not write to file %r with PID %d",

1988

logger.error("Could not write to file %r with PID %d",

1912

1989

pidfilename, pid)

1913

1990

except NameError:

1914

1991

# "pidfile" was never created

1916

1993

del pidfilename

1917

1994

1918

1995

signal.signal(signal.SIGINT, signal.SIG_IGN)

1919

1996

1920

1997

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1921

1998

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1922

1999

1924

2001

class MandosDBusService(dbus.service.Object):

1925

2002

"""A D-Bus proxy object"""

1926

2003

def __init__(self):

1927

dbus.service.Object.__init__(self, bus, u"/")

1928

_interface = u"se.bsnet.fukt.Mandos"

2004

dbus.service.Object.__init__(self, bus, "/")

2005

_interface = "se.bsnet.fukt.Mandos"

1929

2006

1930

@dbus.service.signal(_interface, signature=u"o")

2007

@dbus.service.signal(_interface, signature="o")

1931

2008

def ClientAdded(self, objpath):

1932

2009

"D-Bus signal"

1933

2010

pass

1934

2011

1935

@dbus.service.signal(_interface, signature=u"ss")

2012

@dbus.service.signal(_interface, signature="ss")

1936

2013

def ClientNotFound(self, fingerprint, address):

1937

2014

"D-Bus signal"

1938

2015

pass

1939

2016

1940

@dbus.service.signal(_interface, signature=u"os")

2017

@dbus.service.signal(_interface, signature="os")

1941

2018

def ClientRemoved(self, objpath, name):

1942

2019

"D-Bus signal"

1943

2020

pass

1944

2021

1945

@dbus.service.method(_interface, out_signature=u"ao")

2022

@dbus.service.method(_interface, out_signature="ao")

1946

2023

def GetAllClients(self):

1947

2024

"D-Bus method"

1948

2025

return dbus.Array(c.dbus_object_path

1949

2026

for c in tcp_server.clients)

1950

2027

1951

2028

@dbus.service.method(_interface,

1952

out_signature=u"a{oa{sv}}")

2029

out_signature="a{oa{sv}}")

1953

2030

def GetAllClientsWithProperties(self):

1954

2031

"D-Bus method"

1955

2032

return dbus.Dictionary(

1956

((c.dbus_object_path, c.GetAll(u""))

2033

((c.dbus_object_path, c.GetAll(""))

1957

2034

for c in tcp_server.clients),

1958

signature=u"oa{sv}")

2035

signature="oa{sv}")

1959

2036

1960

@dbus.service.method(_interface, in_signature=u"o")

2037

@dbus.service.method(_interface, in_signature="o")

1961

2038

def RemoveClient(self, object_path):

1962

2039

"D-Bus method"

1963

2040

for c in tcp_server.clients:

1973

2050

1974

2051

del _interface

1975

2052

1976

mandos_dbus_service = MandosDBusService()

2053

class MandosDBusServiceTransitional(MandosDBusService):

2054

__metaclass__ = transitional_dbus_metaclass

2055

mandos_dbus_service = MandosDBusServiceTransitional()

1977

2056

1978

2057

def cleanup():

1979

2058

"Cleanup function; run on exit"

2005

2084

# Find out what port we got

2006

2085

service.port = tcp_server.socket.getsockname()[1]

2007

2086

if use_ipv6:

2008

logger.info(u"Now listening on address %r, port %d,"

2087

logger.info("Now listening on address %r, port %d,"

2009

2088

" flowinfo %d, scope_id %d"

2010

2089

% tcp_server.socket.getsockname())

2011

2090

else: # IPv4

2012

logger.info(u"Now listening on address %r, port %d"

2091

logger.info("Now listening on address %r, port %d"

2013

2092

% tcp_server.socket.getsockname())

2014

2093

2015

2094

#service.interface = tcp_server.socket.getsockname()[3]

2018

2097

# From the Avahi example code

2019

2098

try:

2020

2099

service.activate()

2021

except dbus.exceptions.DBusException, error:

2022

logger.critical(u"DBusException: %s", error)

2100

except dbus.exceptions.DBusException as error:

2101

logger.critical("DBusException: %s", error)

2023

2102

cleanup()

2024

2103

sys.exit(1)

2025

2104

# End of Avahi example code

2029

2108

(tcp_server.handle_request

2030

2109

(*args[2:], **kwargs) or True))

2031

2110

2032

logger.debug(u"Starting main loop")

2111

logger.debug("Starting main loop")

2033

2112

main_loop.run()

2034

except AvahiError, error:

2035

logger.critical(u"AvahiError: %s", error)

2113

except AvahiError as error:

2114

logger.critical("AvahiError: %s", error)

2036

2115

cleanup()

2037

2116

sys.exit(1)

2038

2117

except KeyboardInterrupt:

2039

2118

if debug:

2040

print >> sys.stderr

2041

logger.debug(u"Server received KeyboardInterrupt")

2042

logger.debug(u"Server exiting")

2119

print("", file=sys.stderr)

2120

logger.debug("Server received KeyboardInterrupt")

2121

logger.debug("Server exiting")

2043

2122

# Must run before the D-Bus bus name gets deregistered

2044

2123

cleanup()

2045

2124

2125

2046

2126

if __name__ == '__main__':

2047

2127

main()