/mandos/trunk : revision 24.2.1

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

82

81

SO_BINDTODEVICE = None

83

82

84

83

85

version = "1.3.1"

84

version = "1.0.14"

86

85

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

86

logger = logging.Logger(u'mandos')

89

87

syslogger = (logging.handlers.SysLogHandler

90

88

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

address = str("/dev/log")))

89

address = "/dev/log"))

92

90

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

91

(u'Mandos [%(process)d]: %(levelname)s:'

92

u' %(message)s'))

95

93

logger.addHandler(syslogger)

96

94

97

95

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

96

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

97

u' %(levelname)s:'

98

u' %(message)s'))

101

99

logger.addHandler(console)

102

100

101

multiprocessing_manager = multiprocessing.Manager()

102

103

class AvahiError(Exception):

104

def __init__(self, value, *args, **kwargs):

105

self.value = value

120

Attributes:

121

interface: integer; avahi.IF_UNSPEC or an interface index.

122

Used to optionally bind to the specified interface.

123

124

type: string; Example: '_mandos._tcp'.

123

124

type: string; Example: u'_mandos._tcp'.

125

See <http://www.dns-sd.org/ServiceTypes.html>

126

port: integer; what port to announce

127

TXT: list of strings; TXT record for the service

136

"""

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

138

servicetype = None, port = None, TXT = None,

139

domain = "", host = "", max_renames = 32768,

139

domain = u"", host = u"", max_renames = 32768,

140

protocol = avahi.PROTO_UNSPEC, bus = None):

141

self.interface = interface

142

self.name = name

151

self.group = None # our entry group

152

self.server = None

153

self.bus = bus

154

self.entry_group_state_changed_match = None

155

154

def rename(self):

156

155

"""Derived from the Avahi example code"""

157

156

if self.rename_count >= self.max_renames:

158

logger.critical("No suitable Zeroconf service name found"

159

" after %i retries, exiting.",

157

logger.critical(u"No suitable Zeroconf service name found"

158

u" after %i retries, exiting.",

160

159

self.rename_count)

161

raise AvahiServiceError("Too many renames")

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

163

logger.info("Changing Zeroconf service name to %r ...",

164

self.name)

160

raise AvahiServiceError(u"Too many renames")

161

self.name = self.server.GetAlternativeServiceName(self.name)

162

logger.info(u"Changing Zeroconf service name to %r ...",

163

unicode(self.name))

165

164

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

165

(u'Mandos (%s) [%%(process)d]:'

166

u' %%(levelname)s: %%(message)s'

168

167

% self.name))

169

168

self.remove()

170

try:

171

self.add()

172

except dbus.exceptions.DBusException as error:

173

logger.critical("DBusException: %s", error)

174

self.cleanup()

175

os._exit(1)

169

self.add()

176

170

self.rename_count += 1

177

171

def remove(self):

178

172

"""Derived from the Avahi example code"""

179

if self.entry_group_state_changed_match is not None:

180

self.entry_group_state_changed_match.remove()

181

self.entry_group_state_changed_match = None

182

173

if self.group is not None:

183

174

self.group.Reset()

184

175

def add(self):

185

176

"""Derived from the Avahi example code"""

186

self.remove()

187

177

if self.group is None:

188

178

self.group = dbus.Interface(

189

179

self.bus.get_object(avahi.DBUS_NAME,

190

180

self.server.EntryGroupNew()),

191

181

avahi.DBUS_INTERFACE_ENTRY_GROUP)

192

self.entry_group_state_changed_match = (

193

self.group.connect_to_signal(

194

'StateChanged', self .entry_group_state_changed))

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

182

self.group.connect_to_signal('StateChanged',

183

self

184

.entry_group_state_changed)

185

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

196

186

self.name, self.type)

197

187

self.group.AddService(

198

188

self.interface,

205

195

self.group.Commit()

206

196

def entry_group_state_changed(self, state, error):

207

197

"""Derived from the Avahi example code"""

208

logger.debug("Avahi entry group state change: %i", state)

198

logger.debug(u"Avahi state change: %i", state)

209

199

210

200

if state == avahi.ENTRY_GROUP_ESTABLISHED:

211

logger.debug("Zeroconf service established.")

201

logger.debug(u"Zeroconf service established.")

212

202

elif state == avahi.ENTRY_GROUP_COLLISION:

213

logger.info("Zeroconf service name collision.")

203

logger.warning(u"Zeroconf service name collision.")

214

204

self.rename()

215

205

elif state == avahi.ENTRY_GROUP_FAILURE:

216

logger.critical("Avahi: Error in group state changed %s",

206

logger.critical(u"Avahi: Error in group state changed %s",

217

207

unicode(error))

218

raise AvahiGroupError("State changed: %s"

208

raise AvahiGroupError(u"State changed: %s"

219

209

% unicode(error))

220

210

def cleanup(self):

221

211

"""Derived from the Avahi example code"""

222

212

if self.group is not None:

223

try:

224

self.group.Free()

225

except (dbus.exceptions.UnknownMethodException,

226

dbus.exceptions.DBusException) as e:

227

pass

213

self.group.Free()

228

214

self.group = None

229

self.remove()

230

def server_state_changed(self, state, error=None):

215

def server_state_changed(self, state):

231

216

"""Derived from the Avahi example code"""

232

logger.debug("Avahi server state change: %i", state)

233

bad_states = { avahi.SERVER_INVALID:

234

"Zeroconf server invalid",

235

avahi.SERVER_REGISTERING: None,

236

avahi.SERVER_COLLISION:

237

"Zeroconf server name collision",

238

avahi.SERVER_FAILURE:

239

"Zeroconf server failure" }

240

if state in bad_states:

241

if bad_states[state] is not None:

242

if error is None:

243

logger.error(bad_states[state])

244

else:

245

logger.error(bad_states[state] + ": %r", error)

246

self.cleanup()

217

if state == avahi.SERVER_COLLISION:

218

logger.error(u"Zeroconf server name collision")

219

self.remove()

247

220

elif state == avahi.SERVER_RUNNING:

248

221

self.add()

249

else:

250

if error is None:

251

logger.debug("Unknown state: %r", state)

252

else:

253

logger.debug("Unknown state: %r: %r", state, error)

254

222

def activate(self):

255

223

"""Derived from the Avahi example code"""

256

224

if self.server is None:

257

225

self.server = dbus.Interface(

258

226

self.bus.get_object(avahi.DBUS_NAME,

259

avahi.DBUS_PATH_SERVER,

260

follow_name_owner_changes=True),

227

avahi.DBUS_PATH_SERVER),

261

228

avahi.DBUS_INTERFACE_SERVER)

262

self.server.connect_to_signal("StateChanged",

229

self.server.connect_to_signal(u"StateChanged",

263

230

self.server_state_changed)

264

231

self.server_state_changed(self.server.GetState())

265

232

268

235

"""A representation of a client host served by this server.

269

236

270

237

Attributes:

271

_approved: bool(); 'None' if not yet approved/disapproved

272

approval_delay: datetime.timedelta(); Time to wait for approval

273

approval_duration: datetime.timedelta(); Duration of one approval

238

239

D-Bus identifiers

240

fingerprint: string (40 or 32 hexadecimal digits); used to

241

uniquely identify the client

242

secret: bytestring; sent verbatim (over TLS) to client

243

host: string; available for use by the checker command

244

created: datetime.datetime(); (UTC) object creation

245

last_enabled: datetime.datetime(); (UTC)

246

enabled: bool()

247

last_checked_ok: datetime.datetime(); (UTC) or None

248

timeout: datetime.timedelta(); How long from last_checked_ok

249

until this client is disabled

250

interval: datetime.timedelta(); How often to start a new checker

251

disable_hook: If set, called by disable() as disable_hook(self)

274

252

checker: subprocess.Popen(); a running checker process used

275

253

to see if the client lives.

276

254

'None' if no process is running.

277

checker_callback_tag: a gobject event source tag, or None

278

checker_command: string; External command which is run to check

279

if client lives. %() expansions are done at

255

checker_initiator_tag: a gobject event source tag, or None

256

disable_initiator_tag: - '' -

257

checker_callback_tag: - '' -

258

checker_command: string; External command which is run to check if

259

client lives. %() expansions are done at

280

260

runtime with vars(self) as dict, so that for

281

261

instance %(name)s can be used in the command.

282

checker_initiator_tag: a gobject event source tag, or None

283

created: datetime.datetime(); (UTC) object creation

284

262

current_checker_command: string; current running checker_command

285

disable_hook: If set, called by disable() as disable_hook(self)

286

disable_initiator_tag: a gobject event source tag, or None

287

enabled: bool()

288

fingerprint: string (40 or 32 hexadecimal digits); used to

289

uniquely identify the client

290

host: string; available for use by the checker command

291

interval: datetime.timedelta(); How often to start a new checker

292

last_approval_request: datetime.datetime(); (UTC) or None

293

last_checked_ok: datetime.datetime(); (UTC) or None

294

last_enabled: datetime.datetime(); (UTC)

295

296

D-Bus identifiers

297

secret: bytestring; sent verbatim (over TLS) to client

298

timeout: datetime.timedelta(); How long from last_checked_ok

299

until this client is disabled

300

extended_timeout: extra long timeout when password has been sent

301

runtime_expansions: Allowed attributes for runtime expansion.

302

expires: datetime.datetime(); time (UTC) when a client will be

303

disabled, or None

263

approved_delay: datetime.timedelta(); Time to wait for approval

264

_approved: bool(); 'None' if not yet approved/disapproved

265

approved_duration: datetime.timedelta(); Duration of one approval

304

266

"""

305

267

306

runtime_expansions = ("approval_delay", "approval_duration",

307

"created", "enabled", "fingerprint",

308

"host", "interval", "last_checked_ok",

309

"last_enabled", "name", "timeout")

310

311

268

@staticmethod

312

269

def _timedelta_to_milliseconds(td):

313

270

"Convert a datetime.timedelta() to milliseconds"

318

275

def timeout_milliseconds(self):

319

276

"Return the 'timeout' attribute in milliseconds"

320

277

return self._timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return self._timedelta_to_milliseconds(self.extended_timeout)

325

278

326

279

def interval_milliseconds(self):

327

280

"Return the 'interval' attribute in milliseconds"

328

281

return self._timedelta_to_milliseconds(self.interval)

329

282

330

def approval_delay_milliseconds(self):

331

return self._timedelta_to_milliseconds(self.approval_delay)

283

def approved_delay_milliseconds(self):

284

return self._timedelta_to_milliseconds(self.approved_delay)

332

285

333

286

def __init__(self, name = None, disable_hook=None, config=None):

334

287

"""Note: the 'checker' key in 'config' sets the

337

290

self.name = name

338

291

if config is None:

339

292

config = {}

340

logger.debug("Creating client %r", self.name)

293

logger.debug(u"Creating client %r", self.name)

341

294

# Uppercase and remove spaces from fingerprint for later

342

295

# comparison purposes with return value from the fingerprint()

343

296

# function

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

297

self.fingerprint = (config[u"fingerprint"].upper()

298

.replace(u" ", u""))

299

logger.debug(u" Fingerprint: %s", self.fingerprint)

300

if u"secret" in config:

301

self.secret = config[u"secret"].decode(u"base64")

302

elif u"secfile" in config:

350

303

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

304

(config[u"secfile"])),

352

305

"rb") as secfile:

353

306

self.secret = secfile.read()

354

307

else:

355

raise TypeError("No secret or secfile for client %s"

308

#XXX Need to allow secret on demand!

309

raise TypeError(u"No secret or secfile for client %s"

356

310

% self.name)

357

self.host = config.get("host", "")

311

self.host = config.get(u"host", u"")

358

312

self.created = datetime.datetime.utcnow()

359

313

self.enabled = False

360

self.last_approval_request = None

361

314

self.last_enabled = None

362

315

self.last_checked_ok = None

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

316

self.timeout = string_to_delta(config[u"timeout"])

317

self.interval = string_to_delta(config[u"interval"])

366

318

self.disable_hook = disable_hook

367

319

self.checker = None

368

320

self.checker_initiator_tag = None

369

321

self.disable_initiator_tag = None

370

self.expires = None

371

322

self.checker_callback_tag = None

372

self.checker_command = config["checker"]

323

self.checker_command = config[u"checker"]

373

324

self.current_checker_command = None

374

325

self.last_connect = None

326

self.approvals_pending = 0

375

327

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

328

self.approved_by_default = config.get(u"approved_by_default",

377

329

True)

378

self.approvals_pending = 0

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

330

self.approved_delay = string_to_delta(

331

config[u"approved_delay"])

332

self.approved_duration = string_to_delta(

333

config[u"approved_duration"])

383

334

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

384

335

385

336

def send_changedstate(self):

386

337

self.changedstate.acquire()

387

338

self.changedstate.notify_all()

389

340

390

341

def enable(self):

391

342

"""Start this client's checker and timeout hooks"""

392

if getattr(self, "enabled", False):

343

if getattr(self, u"enabled", False):

393

344

# Already enabled

394

345

return

395

346

self.send_changedstate()

400

351

(self.interval_milliseconds(),

401

352

self.start_checker))

402

353

# Schedule a disable() when 'timeout' has passed

403

self.expires = datetime.datetime.utcnow() + self.timeout

404

354

self.disable_initiator_tag = (gobject.timeout_add

405

355

(self.timeout_milliseconds(),

406

356

self.disable))

415

365

if not quiet:

416

366

self.send_changedstate()

417

367

if not quiet:

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

368

logger.info(u"Disabling client %s", self.name)

369

if getattr(self, u"disable_initiator_tag", False):

420

370

gobject.source_remove(self.disable_initiator_tag)

421

371

self.disable_initiator_tag = None

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

372

if getattr(self, u"checker_initiator_tag", False):

424

373

gobject.source_remove(self.checker_initiator_tag)

425

374

self.checker_initiator_tag = None

426

375

self.stop_checker()

441

390

if os.WIFEXITED(condition):

442

391

exitstatus = os.WEXITSTATUS(condition)

443

392

if exitstatus == 0:

444

logger.info("Checker for %(name)s succeeded",

393

logger.info(u"Checker for %(name)s succeeded",

445

394

vars(self))

446

395

self.checked_ok()

447

396

else:

448

logger.info("Checker for %(name)s failed",

397

logger.info(u"Checker for %(name)s failed",

449

398

vars(self))

450

399

else:

451

logger.warning("Checker for %(name)s crashed?",

400

logger.warning(u"Checker for %(name)s crashed?",

452

401

vars(self))

453

402

454

def checked_ok(self, timeout=None):

403

def checked_ok(self):

455

404

"""Bump up the timeout for this client.

456

405

457

406

This should only be called when the client has been seen,

458

407

alive and well.

459

408

"""

460

if timeout is None:

461

timeout = self.timeout

462

409

self.last_checked_ok = datetime.datetime.utcnow()

463

410

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

465

411

self.disable_initiator_tag = (gobject.timeout_add

466

(self._timedelta_to_milliseconds(timeout),

412

(self.timeout_milliseconds(),

467

413

self.disable))

468

414

469

def need_approval(self):

470

self.last_approval_request = datetime.datetime.utcnow()

471

472

415

def start_checker(self):

473

416

"""Start a new checker subprocess if one is not running.

474

417

486

429

# If a checker exists, make sure it is not a zombie

487

430

try:

488

431

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

489

except (AttributeError, OSError) as error:

432

except (AttributeError, OSError), error:

490

433

if (isinstance(error, OSError)

491

434

and error.errno != errno.ECHILD):

492

435

raise error

493

436

else:

494

437

if pid:

495

logger.warning("Checker was a zombie")

438

logger.warning(u"Checker was a zombie")

496

439

gobject.source_remove(self.checker_callback_tag)

497

440

self.checker_callback(pid, status,

498

441

self.current_checker_command)

503

446

command = self.checker_command % self.host

504

447

except TypeError:

505

448

# Escape attributes for the shell

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

449

escaped_attrs = dict((key,

450

re.escape(unicode(str(val),

451

errors=

452

u'replace')))

453

for key, val in

454

vars(self).iteritems())

514

455

try:

515

456

command = self.checker_command % escaped_attrs

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

457

except TypeError, error:

458

logger.error(u'Could not format string "%s":'

459

u' %s', self.checker_command, error)

519

460

return True # Try again later

520

461

self.current_checker_command = command

521

462

try:

522

logger.info("Starting checker %r for %s",

463

logger.info(u"Starting checker %r for %s",

523

464

command, self.name)

524

465

# We don't need to redirect stdout and stderr, since

525

466

# in normal mode, that is already done by daemon(),

527

468

# always replaced by /dev/null.)

528

469

self.checker = subprocess.Popen(command,

529

470

close_fds=True,

530

shell=True, cwd="/")

471

shell=True, cwd=u"/")

531

472

self.checker_callback_tag = (gobject.child_watch_add

532

473

(self.checker.pid,

533

474

self.checker_callback,

538

479

if pid:

539

480

gobject.source_remove(self.checker_callback_tag)

540

481

self.checker_callback(pid, status, command)

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

482

except OSError, error:

483

logger.error(u"Failed to start subprocess: %s",

543

484

error)

544

485

# Re-run this periodically if run by gobject.timeout_add

545

486

return True

549

490

if self.checker_callback_tag:

550

491

gobject.source_remove(self.checker_callback_tag)

551

492

self.checker_callback_tag = None

552

if getattr(self, "checker", None) is None:

493

if getattr(self, u"checker", None) is None:

553

494

return

554

logger.debug("Stopping checker for %(name)s", vars(self))

495

logger.debug(u"Stopping checker for %(name)s", vars(self))

555

496

try:

556

497

os.kill(self.checker.pid, signal.SIGTERM)

557

498

#time.sleep(0.5)

558

499

#if self.checker.poll() is None:

559

500

# os.kill(self.checker.pid, signal.SIGKILL)

560

except OSError as error:

501

except OSError, error:

561

502

if error.errno != errno.ESRCH: # No such process

562

503

raise

563

504

self.checker = None

564

505

565

def dbus_service_property(dbus_interface, signature="v",

566

access="readwrite", byte_arrays=False):

506

def dbus_service_property(dbus_interface, signature=u"v",

507

access=u"readwrite", byte_arrays=False):

567

508

"""Decorators for marking methods of a DBusObjectWithProperties to

568

509

become properties on the D-Bus.

569

510

576

517

"""

577

518

# Encoding deeply encoded byte arrays is not supported yet by the

578

519

# "Set" method, so we fail early here:

579

if byte_arrays and signature != "ay":

580

raise ValueError("Byte arrays not supported for non-'ay'"

581

" signature %r" % signature)

520

if byte_arrays and signature != u"ay":

521

raise ValueError(u"Byte arrays not supported for non-'ay'"

522

u" signature %r" % signature)

582

523

def decorator(func):

583

524

func._dbus_is_property = True

584

525

func._dbus_interface = dbus_interface

585

526

func._dbus_signature = signature

586

527

func._dbus_access = access

587

528

func._dbus_name = func.__name__

588

if func._dbus_name.endswith("_dbus_property"):

529

if func._dbus_name.endswith(u"_dbus_property"):

589

530

func._dbus_name = func._dbus_name[:-14]

590

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

531

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

591

532

return func

592

533

return decorator

593

534

621

562

622

563

@staticmethod

623

564

def _is_dbus_property(obj):

624

return getattr(obj, "_dbus_is_property", False)

565

return getattr(obj, u"_dbus_is_property", False)

625

566

626

567

def _get_all_dbus_properties(self):

627

568

"""Returns a generator of (name, attribute) pairs

635

576

property with the specified name and interface.

636

577

"""

637

578

for name in (property_name,

638

property_name + "_dbus_property"):

579

property_name + u"_dbus_property"):

639

580

prop = getattr(self, name, None)

640

581

if (prop is None

641

582

or not self._is_dbus_property(prop)

645

586

continue

646

587

return prop

647

588

# No such property

648

raise DBusPropertyNotFound(self.dbus_object_path + ":"

649

+ interface_name + "."

589

raise DBusPropertyNotFound(self.dbus_object_path + u":"

590

+ interface_name + u"."

650

591

+ property_name)

651

592

652

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

653

out_signature="v")

593

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

594

out_signature=u"v")

654

595

def Get(self, interface_name, property_name):

655

596

"""Standard D-Bus property Get() method, see D-Bus standard.

656

597

"""

657

598

prop = self._get_dbus_property(interface_name, property_name)

658

if prop._dbus_access == "write":

599

if prop._dbus_access == u"write":

659

600

raise DBusPropertyAccessException(property_name)

660

601

value = prop()

661

if not hasattr(value, "variant_level"):

602

if not hasattr(value, u"variant_level"):

662

603

return value

663

604

return type(value)(value, variant_level=value.variant_level+1)

664

605

665

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

606

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

666

607

def Set(self, interface_name, property_name, value):

667

608

"""Standard D-Bus property Set() method, see D-Bus standard.

668

609

"""

669

610

prop = self._get_dbus_property(interface_name, property_name)

670

if prop._dbus_access == "read":

611

if prop._dbus_access == u"read":

671

612

raise DBusPropertyAccessException(property_name)

672

if prop._dbus_get_args_options["byte_arrays"]:

613

if prop._dbus_get_args_options[u"byte_arrays"]:

673

614

# The byte_arrays option is not supported yet on

674

615

# signatures other than "ay".

675

if prop._dbus_signature != "ay":

616

if prop._dbus_signature != u"ay":

676

617

raise ValueError

677

618

value = dbus.ByteArray(''.join(unichr(byte)

678

619

for byte in value))

679

620

prop(value)

680

621

681

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

682

out_signature="a{sv}")

622

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

623

out_signature=u"a{sv}")

683

624

def GetAll(self, interface_name):

684

625

"""Standard D-Bus property GetAll() method, see D-Bus

685

626

standard.

693

634

# Interface non-empty but did not match

694

635

continue

695

636

# Ignore write-only properties

696

if prop._dbus_access == "write":

637

if prop._dbus_access == u"write":

697

638

continue

698

639

value = prop()

699

if not hasattr(value, "variant_level"):

640

if not hasattr(value, u"variant_level"):

700

641

all[name] = value

701

642

continue

702

643

all[name] = type(value)(value, variant_level=

703

644

value.variant_level+1)

704

return dbus.Dictionary(all, signature="sv")

645

return dbus.Dictionary(all, signature=u"sv")

705

646

706

647

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

707

out_signature="s",

648

out_signature=u"s",

708

649

path_keyword='object_path',

709

650

connection_keyword='connection')

710

651

def Introspect(self, object_path, connection):

715

656

try:

716

657

document = xml.dom.minidom.parseString(xmlstring)

717

658

def make_tag(document, name, prop):

718

e = document.createElement("property")

719

e.setAttribute("name", name)

720

e.setAttribute("type", prop._dbus_signature)

721

e.setAttribute("access", prop._dbus_access)

659

e = document.createElement(u"property")

660

e.setAttribute(u"name", name)

661

e.setAttribute(u"type", prop._dbus_signature)

662

e.setAttribute(u"access", prop._dbus_access)

722

663

return e

723

for if_tag in document.getElementsByTagName("interface"):

664

for if_tag in document.getElementsByTagName(u"interface"):

724

665

for tag in (make_tag(document, name, prop)

725

666

for name, prop

726

667

in self._get_all_dbus_properties()

727

668

if prop._dbus_interface

728

== if_tag.getAttribute("name")):

669

== if_tag.getAttribute(u"name")):

729

670

if_tag.appendChild(tag)

730

671

# Add the names to the return values for the

731

672

# "org.freedesktop.DBus.Properties" methods

732

if (if_tag.getAttribute("name")

733

== "org.freedesktop.DBus.Properties"):

734

for cn in if_tag.getElementsByTagName("method"):

735

if cn.getAttribute("name") == "Get":

736

for arg in cn.getElementsByTagName("arg"):

737

if (arg.getAttribute("direction")

738

== "out"):

739

arg.setAttribute("name", "value")

740

elif cn.getAttribute("name") == "GetAll":

741

for arg in cn.getElementsByTagName("arg"):

742

if (arg.getAttribute("direction")

743

== "out"):

744

arg.setAttribute("name", "props")

745

xmlstring = document.toxml("utf-8")

673

if (if_tag.getAttribute(u"name")

674

== u"org.freedesktop.DBus.Properties"):

675

for cn in if_tag.getElementsByTagName(u"method"):

676

if cn.getAttribute(u"name") == u"Get":

677

for arg in cn.getElementsByTagName(u"arg"):

678

if (arg.getAttribute(u"direction")

679

== u"out"):

680

arg.setAttribute(u"name", u"value")

681

elif cn.getAttribute(u"name") == u"GetAll":

682

for arg in cn.getElementsByTagName(u"arg"):

683

if (arg.getAttribute(u"direction")

684

== u"out"):

685

arg.setAttribute(u"name", u"props")

686

xmlstring = document.toxml(u"utf-8")

746

687

document.unlink()

747

688

except (AttributeError, xml.dom.DOMException,

748

xml.parsers.expat.ExpatError) as error:

749

logger.error("Failed to override Introspection method",

689

xml.parsers.expat.ExpatError), error:

690

logger.error(u"Failed to override Introspection method",

750

691

error)

751

692

return xmlstring

752

693

758

699

dbus_object_path: dbus.ObjectPath

759

700

bus: dbus.SystemBus()

760

701

"""

761

762

runtime_expansions = (Client.runtime_expansions

763

+ ("dbus_object_path",))

764

765

702

# dbus.service.Object doesn't use super(), so we can't either.

766

703

767

704

def __init__(self, bus = None, *args, **kwargs):

768

self._approvals_pending = 0

769

705

self.bus = bus

770

706

Client.__init__(self, *args, **kwargs)

771

707

# Only now, when this client is initialized, can it show up on

772

708

# the D-Bus

773

client_object_name = unicode(self.name).translate(

774

{ord("."): ord("_"),

775

ord("-"): ord("_")})

776

709

self.dbus_object_path = (dbus.ObjectPath

777

("/clients/" + client_object_name))

710

(u"/clients/"

711

+ self.name.replace(u".", u"_")))

778

712

DBusObjectWithProperties.__init__(self, self.bus,

779

713

self.dbus_object_path)

780

def _set_expires(self, value):

781

old_value = getattr(self, "_expires", None)

782

self._expires = value

783

if hasattr(self, "dbus_object_path") and old_value != value:

784

dbus_time = (self._datetime_to_dbus(self._expires,

785

variant_level=1))

786

self.PropertyChanged(dbus.String("Expires"),

787

dbus_time)

788

expires = property(lambda self: self._expires, _set_expires)

789

del _set_expires

790

791

def _get_approvals_pending(self):

792

return self._approvals_pending

793

def _set_approvals_pending(self, value):

794

old_value = self._approvals_pending

795

self._approvals_pending = value

796

bval = bool(value)

797

if (hasattr(self, "dbus_object_path")

798

and bval is not bool(old_value)):

799

dbus_bool = dbus.Boolean(bval, variant_level=1)

800

self.PropertyChanged(dbus.String("ApprovalPending"),

801

dbus_bool)

802

803

approvals_pending = property(_get_approvals_pending,

804

_set_approvals_pending)

805

del _get_approvals_pending, _set_approvals_pending

806

714

807

715

@staticmethod

808

716

def _datetime_to_dbus(dt, variant_level=0):

809

717

"""Convert a UTC datetime.datetime() to a D-Bus type."""

810

if dt is None:

811

return dbus.String("", variant_level = variant_level)

812

718

return dbus.String(dt.isoformat(),

813

719

variant_level=variant_level)

814

720

815

721

def enable(self):

816

oldstate = getattr(self, "enabled", False)

722

oldstate = getattr(self, u"enabled", False)

817

723

r = Client.enable(self)

818

724

if oldstate != self.enabled:

819

725

# Emit D-Bus signals

820

self.PropertyChanged(dbus.String("Enabled"),

726

self.PropertyChanged(dbus.String(u"enabled"),

821

727

dbus.Boolean(True, variant_level=1))

822

728

self.PropertyChanged(

823

dbus.String("LastEnabled"),

729

dbus.String(u"last_enabled"),

824

730

self._datetime_to_dbus(self.last_enabled,

825

731

variant_level=1))

826

732

return r

827

733

828

734

def disable(self, quiet = False):

829

oldstate = getattr(self, "enabled", False)

735

oldstate = getattr(self, u"enabled", False)

830

736

r = Client.disable(self, quiet=quiet)

831

737

if not quiet and oldstate != self.enabled:

832

738

# Emit D-Bus signal

833

self.PropertyChanged(dbus.String("Enabled"),

739

self.PropertyChanged(dbus.String(u"enabled"),

834

740

dbus.Boolean(False, variant_level=1))

835

741

return r

836

742

839

745

self.remove_from_connection()

840

746

except LookupError:

841

747

pass

842

if hasattr(DBusObjectWithProperties, "__del__"):

748

if hasattr(DBusObjectWithProperties, u"__del__"):

843

749

DBusObjectWithProperties.__del__(self, *args, **kwargs)

844

750

Client.__del__(self, *args, **kwargs)

845

751

848

754

self.checker_callback_tag = None

849

755

self.checker = None

850

756

# Emit D-Bus signal

851

self.PropertyChanged(dbus.String("CheckerRunning"),

757

self.PropertyChanged(dbus.String(u"checker_running"),

852

758

dbus.Boolean(False, variant_level=1))

853

759

if os.WIFEXITED(condition):

854

760

exitstatus = os.WEXITSTATUS(condition)

866

772

*args, **kwargs)

867

773

868

774

def checked_ok(self, *args, **kwargs):

869

Client.checked_ok(self, *args, **kwargs)

775

r = Client.checked_ok(self, *args, **kwargs)

870

776

# Emit D-Bus signal

871

777

self.PropertyChanged(

872

dbus.String("LastCheckedOK"),

778

dbus.String(u"last_checked_ok"),

873

779

(self._datetime_to_dbus(self.last_checked_ok,

874

780

variant_level=1)))

875

876

def need_approval(self, *args, **kwargs):

877

r = Client.need_approval(self, *args, **kwargs)

878

# Emit D-Bus signal

879

self.PropertyChanged(

880

dbus.String("LastApprovalRequest"),

881

(self._datetime_to_dbus(self.last_approval_request,

882

variant_level=1)))

883

781

return r

884

782

885

783

def start_checker(self, *args, **kwargs):

895

793

# Emit D-Bus signal

896

794

self.CheckerStarted(self.current_checker_command)

897

795

self.PropertyChanged(

898

dbus.String("CheckerRunning"),

796

dbus.String(u"checker_running"),

899

797

dbus.Boolean(True, variant_level=1))

900

798

return r

901

799

902

800

def stop_checker(self, *args, **kwargs):

903

old_checker = getattr(self, "checker", None)

801

old_checker = getattr(self, u"checker", None)

904

802

r = Client.stop_checker(self, *args, **kwargs)

905

803

if (old_checker is not None

906

and getattr(self, "checker", None) is None):

907

self.PropertyChanged(dbus.String("CheckerRunning"),

804

and getattr(self, u"checker", None) is None):

805

self.PropertyChanged(dbus.String(u"checker_running"),

908

806

dbus.Boolean(False, variant_level=1))

909

807

return r

910

808

913

811

return False

914

812

915

813

def approve(self, value=True):

916

self.send_changedstate()

917

814

self._approved = value

918

gobject.timeout_add(self._timedelta_to_milliseconds

919

(self.approval_duration),

920

self._reset_approved)

815

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))

816

817

def approved_pending(self):

818

return self.approvals_pending > 0

921

819

922

820

923

821

## D-Bus methods, signals & properties

924

_interface = "se.bsnet.fukt.Mandos.Client"

822

_interface = u"se.bsnet.fukt.Mandos.Client"

925

823

926

824

## Signals

927

825

928

826

# CheckerCompleted - signal

929

@dbus.service.signal(_interface, signature="nxs")

827

@dbus.service.signal(_interface, signature=u"nxs")

930

828

def CheckerCompleted(self, exitcode, waitstatus, command):

931

829

"D-Bus signal"

932

830

pass

933

831

934

832

# CheckerStarted - signal

935

@dbus.service.signal(_interface, signature="s")

833

@dbus.service.signal(_interface, signature=u"s")

936

834

def CheckerStarted(self, command):

937

835

"D-Bus signal"

938

836

pass

939

837

940

838

# PropertyChanged - signal

941

@dbus.service.signal(_interface, signature="sv")

839

@dbus.service.signal(_interface, signature=u"sv")

942

840

def PropertyChanged(self, property, value):

943

841

"D-Bus signal"

944

842

pass

946

844

# GotSecret - signal

947

845

@dbus.service.signal(_interface)

948

846

def GotSecret(self):

949

"""D-Bus signal

950

Is sent after a successful transfer of secret from the Mandos

951

server to mandos-client

952

"""

953

pass

847

"D-Bus signal"

848

if self.approved_pending():

849

self.PropertyChanged(dbus.String(u"checker_running"),

850

dbus.Boolean(False, variant_level=1))

954

851

955

852

# Rejected - signal

956

@dbus.service.signal(_interface, signature="s")

853

@dbus.service.signal(_interface, signature=u"s")

957

854

def Rejected(self, reason):

958

855

"D-Bus signal"

959

pass

856

if self.approved_pending():

857

self.PropertyChanged(dbus.String(u"checker_running"),

858

dbus.Boolean(False, variant_level=1))

960

859

961

860

# NeedApproval - signal

962

@dbus.service.signal(_interface, signature="tb")

861

@dbus.service.signal(_interface, signature=u"db")

963

862

def NeedApproval(self, timeout, default):

964

863

"D-Bus signal"

965

return self.need_approval()

864

if not self.approved_pending():

865

self.PropertyChanged(dbus.String(u"approved_pending"),

866

dbus.Boolean(True, variant_level=1))

966

867

967

868

## Methods

968

869

969

870

# Approve - method

970

@dbus.service.method(_interface, in_signature="b")

871

@dbus.service.method(_interface, in_signature=u"b")

971

872

def Approve(self, value):

972

873

self.approve(value)

973

874

974

875

# CheckedOK - method

975

876

@dbus.service.method(_interface)

976

877

def CheckedOK(self):

977

self.checked_ok()

878

return self.checked_ok()

978

879

979

880

# Enable - method

980

881

@dbus.service.method(_interface)

1001

902

1002

903

## Properties

1003

904

1004

# ApprovalPending - property

1005

@dbus_service_property(_interface, signature="b", access="read")

1006

def ApprovalPending_dbus_property(self):

1007

return dbus.Boolean(bool(self.approvals_pending))

1008

1009

# ApprovedByDefault - property

1010

@dbus_service_property(_interface, signature="b",

1011

access="readwrite")

1012

def ApprovedByDefault_dbus_property(self, value=None):

1013

if value is None: # get

1014

return dbus.Boolean(self.approved_by_default)

1015

old_value = self.approved_by_default

1016

self.approved_by_default = bool(value)

1017

# Emit D-Bus signal

1018

if old_value != self.approved_by_default:

1019

self.PropertyChanged(dbus.String("ApprovedByDefault"),

1020

dbus.Boolean(value, variant_level=1))

1021

1022

# ApprovalDelay - property

1023

@dbus_service_property(_interface, signature="t",

1024

access="readwrite")

1025

def ApprovalDelay_dbus_property(self, value=None):

1026

if value is None: # get

1027

return dbus.UInt64(self.approval_delay_milliseconds())

1028

old_value = self.approval_delay

1029

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1030

# Emit D-Bus signal

1031

if old_value != self.approval_delay:

1032

self.PropertyChanged(dbus.String("ApprovalDelay"),

1033

dbus.UInt64(value, variant_level=1))

1034

1035

# ApprovalDuration - property

1036

@dbus_service_property(_interface, signature="t",

1037

access="readwrite")

1038

def ApprovalDuration_dbus_property(self, value=None):

1039

if value is None: # get

1040

return dbus.UInt64(self._timedelta_to_milliseconds(

1041

self.approval_duration))

1042

old_value = self.approval_duration

1043

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1044

# Emit D-Bus signal

1045

if old_value != self.approval_duration:

1046

self.PropertyChanged(dbus.String("ApprovalDuration"),

1047

dbus.UInt64(value, variant_level=1))

1048

1049

# Name - property

1050

@dbus_service_property(_interface, signature="s", access="read")

1051

def Name_dbus_property(self):

905

# approved_pending - property

906

@dbus_service_property(_interface, signature=u"b", access=u"read")

907

def approved_pending_dbus_property(self):

908

return dbus.Boolean(self.approved_pending())

909

910

# approved_by_default - property

911

@dbus_service_property(_interface, signature=u"b",

912

access=u"readwrite")

913

def approved_by_default_dbus_property(self):

914

return dbus.Boolean(self.approved_by_default)

915

916

# approved_delay - property

917

@dbus_service_property(_interface, signature=u"t",

918

access=u"readwrite")

919

def approved_delay_dbus_property(self):

920

return dbus.UInt64(self.approved_delay_milliseconds())

921

922

# approved_duration - property

923

@dbus_service_property(_interface, signature=u"t",

924

access=u"readwrite")

925

def approved_duration_dbus_property(self):

926

return dbus.UInt64(self._timedelta_to_milliseconds(

927

self.approved_duration))

928

929

# name - property

930

@dbus_service_property(_interface, signature=u"s", access=u"read")

931

def name_dbus_property(self):

1052

932

return dbus.String(self.name)

1053

933

1054

# Fingerprint - property

1055

@dbus_service_property(_interface, signature="s", access="read")

1056

def Fingerprint_dbus_property(self):

934

# fingerprint - property

935

@dbus_service_property(_interface, signature=u"s", access=u"read")

936

def fingerprint_dbus_property(self):

1057

937

return dbus.String(self.fingerprint)

1058

938

1059

# Host - property

1060

@dbus_service_property(_interface, signature="s",

1061

access="readwrite")

1062

def Host_dbus_property(self, value=None):

939

# host - property

940

@dbus_service_property(_interface, signature=u"s",

941

access=u"readwrite")

942

def host_dbus_property(self, value=None):

1063

943

if value is None: # get

1064

944

return dbus.String(self.host)

1065

old_value = self.host

1066

945

self.host = value

1067

946

# Emit D-Bus signal

1068

if old_value != self.host:

1069

self.PropertyChanged(dbus.String("Host"),

1070

dbus.String(value, variant_level=1))

947

self.PropertyChanged(dbus.String(u"host"),

948

dbus.String(value, variant_level=1))

1071

949

1072

# Created - property

1073

@dbus_service_property(_interface, signature="s", access="read")

1074

def Created_dbus_property(self):

950

# created - property

951

@dbus_service_property(_interface, signature=u"s", access=u"read")

952

def created_dbus_property(self):

1075

953

return dbus.String(self._datetime_to_dbus(self.created))

1076

954

1077

# LastEnabled - property

1078

@dbus_service_property(_interface, signature="s", access="read")

1079

def LastEnabled_dbus_property(self):

1080

return self._datetime_to_dbus(self.last_enabled)

955

# last_enabled - property

956

@dbus_service_property(_interface, signature=u"s", access=u"read")

957

def last_enabled_dbus_property(self):

958

if self.last_enabled is None:

959

return dbus.String(u"")

960

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1081

961

1082

# Enabled - property

1083

@dbus_service_property(_interface, signature="b",

1084

access="readwrite")

1085

def Enabled_dbus_property(self, value=None):

962

# enabled - property

963

@dbus_service_property(_interface, signature=u"b",

964

access=u"readwrite")

965

def enabled_dbus_property(self, value=None):

1086

966

if value is None: # get

1087

967

return dbus.Boolean(self.enabled)

1088

968

if value:

1090

970

else:

1091

971

self.disable()

1092

972

1093

# LastCheckedOK - property

1094

@dbus_service_property(_interface, signature="s",

1095

access="readwrite")

1096

def LastCheckedOK_dbus_property(self, value=None):

973

# last_checked_ok - property

974

@dbus_service_property(_interface, signature=u"s",

975

access=u"readwrite")

976

def last_checked_ok_dbus_property(self, value=None):

1097

977

if value is not None:

1098

978

self.checked_ok()

1099

979

return

1100

return self._datetime_to_dbus(self.last_checked_ok)

1101

1102

# Expires - property

1103

@dbus_service_property(_interface, signature="s", access="read")

1104

def Expires_dbus_property(self):

1105

return self._datetime_to_dbus(self.expires)

1106

1107

# LastApprovalRequest - property

1108

@dbus_service_property(_interface, signature="s", access="read")

1109

def LastApprovalRequest_dbus_property(self):

1110

return self._datetime_to_dbus(self.last_approval_request)

1111

1112

# Timeout - property

1113

@dbus_service_property(_interface, signature="t",

1114

access="readwrite")

1115

def Timeout_dbus_property(self, value=None):

980

if self.last_checked_ok is None:

981

return dbus.String(u"")

982

return dbus.String(self._datetime_to_dbus(self

983

.last_checked_ok))

984

985

# timeout - property

986

@dbus_service_property(_interface, signature=u"t",

987

access=u"readwrite")

988

def timeout_dbus_property(self, value=None):

1116

989

if value is None: # get

1117

990

return dbus.UInt64(self.timeout_milliseconds())

1118

old_value = self.timeout

1119

991

self.timeout = datetime.timedelta(0, 0, 0, value)

1120

992

# Emit D-Bus signal

1121

if old_value != self.timeout:

1122

self.PropertyChanged(dbus.String("Timeout"),

1123

dbus.UInt64(value, variant_level=1))

1124

if getattr(self, "disable_initiator_tag", None) is None:

993

self.PropertyChanged(dbus.String(u"timeout"),

994

dbus.UInt64(value, variant_level=1))

995

if getattr(self, u"disable_initiator_tag", None) is None:

1125

996

return

1126

997

# Reschedule timeout

1127

998

gobject.source_remove(self.disable_initiator_tag)

1128

999

self.disable_initiator_tag = None

1129

self.expires = None

1130

1000

time_to_die = (self.

1131

1001

_timedelta_to_milliseconds((self

1132

1002

.last_checked_ok

1137

1007

# The timeout has passed

1138

1008

self.disable()

1139

1009

else:

1140

self.expires = (datetime.datetime.utcnow()

1141

+ datetime.timedelta(milliseconds = time_to_die))

1142

1010

self.disable_initiator_tag = (gobject.timeout_add

1143

1011

(time_to_die, self.disable))

1144

1145

# ExtendedTimeout - property

1146

@dbus_service_property(_interface, signature="t",

1147

access="readwrite")

1148

def ExtendedTimeout_dbus_property(self, value=None):

1149

if value is None: # get

1150

return dbus.UInt64(self.extended_timeout_milliseconds())

1151

old_value = self.extended_timeout

1152

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1153

# Emit D-Bus signal

1154

if old_value != self.extended_timeout:

1155

self.PropertyChanged(dbus.String("ExtendedTimeout"),

1156

dbus.UInt64(value, variant_level=1))

1157

1158

# Interval - property

1159

@dbus_service_property(_interface, signature="t",

1160

access="readwrite")

1161

def Interval_dbus_property(self, value=None):

1012

1013

# interval - property

1014

@dbus_service_property(_interface, signature=u"t",

1015

access=u"readwrite")

1016

def interval_dbus_property(self, value=None):

1162

1017

if value is None: # get

1163

1018

return dbus.UInt64(self.interval_milliseconds())

1164

old_value = self.interval

1165

1019

self.interval = datetime.timedelta(0, 0, 0, value)

1166

1020

# Emit D-Bus signal

1167

if old_value != self.interval:

1168

self.PropertyChanged(dbus.String("Interval"),

1169

dbus.UInt64(value, variant_level=1))

1170

if getattr(self, "checker_initiator_tag", None) is None:

1021

self.PropertyChanged(dbus.String(u"interval"),

1022

dbus.UInt64(value, variant_level=1))

1023

if getattr(self, u"checker_initiator_tag", None) is None:

1171

1024

return

1172

1025

# Reschedule checker run

1173

1026

gobject.source_remove(self.checker_initiator_tag)

1175

1028

(value, self.start_checker))

1176

1029

self.start_checker() # Start one now, too

1177

1030

1178

# Checker - property

1179

@dbus_service_property(_interface, signature="s",

1180

access="readwrite")

1181

def Checker_dbus_property(self, value=None):

1031

# checker - property

1032

@dbus_service_property(_interface, signature=u"s",

1033

access=u"readwrite")

1034

def checker_dbus_property(self, value=None):

1182

1035

if value is None: # get

1183

1036

return dbus.String(self.checker_command)

1184

old_value = self.checker_command

1185

1037

self.checker_command = value

1186

1038

# Emit D-Bus signal

1187

if old_value != self.checker_command:

1188

self.PropertyChanged(dbus.String("Checker"),

1189

dbus.String(self.checker_command,

1190

variant_level=1))

1039

self.PropertyChanged(dbus.String(u"checker"),

1040

dbus.String(self.checker_command,

1041

variant_level=1))

1191

1042

1192

# CheckerRunning - property

1193

@dbus_service_property(_interface, signature="b",

1194

access="readwrite")

1195

def CheckerRunning_dbus_property(self, value=None):

1043

# checker_running - property

1044

@dbus_service_property(_interface, signature=u"b",

1045

access=u"readwrite")

1046

def checker_running_dbus_property(self, value=None):

1196

1047

if value is None: # get

1197

1048

return dbus.Boolean(self.checker is not None)

1198

1049

if value:

1200

1051

else:

1201

1052

self.stop_checker()

1202

1053

1203

# ObjectPath - property

1204

@dbus_service_property(_interface, signature="o", access="read")

1205

def ObjectPath_dbus_property(self):

1054

# object_path - property

1055

@dbus_service_property(_interface, signature=u"o", access=u"read")

1056

def object_path_dbus_property(self):

1206

1057

return self.dbus_object_path # is already a dbus.ObjectPath

1207

1058

1208

# Secret = property

1209

@dbus_service_property(_interface, signature="ay",

1210

access="write", byte_arrays=True)

1211

def Secret_dbus_property(self, value):

1059

# secret = property

1060

@dbus_service_property(_interface, signature=u"ay",

1061

access=u"write", byte_arrays=True)

1062

def secret_dbus_property(self, value):

1212

1063

self.secret = str(value)

1213

1064

1214

1065

del _interface

1248

1099

1249

1100

def handle(self):

1250

1101

with contextlib.closing(self.server.child_pipe) as child_pipe:

1251

logger.info("TCP connection from: %s",

1102

logger.info(u"TCP connection from: %s",

1252

1103

unicode(self.client_address))

1253

logger.debug("Pipe FD: %d",

1104

logger.debug(u"Pipe FD: %d",

1254

1105

self.server.child_pipe.fileno())

1255

1106

1256

1107

session = (gnutls.connection

1263

1114

# no X.509 keys are added to it. Therefore, we can use it

1264

1115

# here despite using OpenPGP certificates.

1265

1116

1266

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1267

# "+AES-256-CBC", "+SHA1",

1268

# "+COMP-NULL", "+CTYPE-OPENPGP",

1269

# "+DHE-DSS"))

1117

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1118

# u"+AES-256-CBC", u"+SHA1",

1119

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1120

# u"+DHE-DSS"))

1270

1121

# Use a fallback default, since this MUST be set.

1271

1122

priority = self.server.gnutls_priority

1272

1123

if priority is None:

1273

priority = "NORMAL"

1124

priority = u"NORMAL"

1274

1125

(gnutls.library.functions

1275

1126

.gnutls_priority_set_direct(session._c_object,

1276

1127

priority, None))

1278

1129

# Start communication using the Mandos protocol

1279

1130

# Get protocol number

1280

1131

line = self.request.makefile().readline()

1281

logger.debug("Protocol version: %r", line)

1132

logger.debug(u"Protocol version: %r", line)

1282

1133

try:

1283

1134

if int(line.strip().split()[0]) > 1:

1284

1135

raise RuntimeError

1285

except (ValueError, IndexError, RuntimeError) as error:

1286

logger.error("Unknown protocol version: %s", error)

1136

except (ValueError, IndexError, RuntimeError), error:

1137

logger.error(u"Unknown protocol version: %s", error)

1287

1138

return

1288

1139

1289

1140

# Start GnuTLS connection

1290

1141

try:

1291

1142

session.handshake()

1292

except gnutls.errors.GNUTLSError as error:

1293

logger.warning("Handshake failed: %s", error)

1143

except gnutls.errors.GNUTLSError, error:

1144

logger.warning(u"Handshake failed: %s", error)

1294

1145

# Do not run session.bye() here: the session is not

1295

1146

# established. Just abandon the request.

1296

1147

return

1297

logger.debug("Handshake succeeded")

1148

logger.debug(u"Handshake succeeded")

1298

1149

1299

1150

approval_required = False

1300

1151

try:

1301

1152

try:

1302

1153

fpr = self.fingerprint(self.peer_certificate

1303

1154

(session))

1304

except (TypeError,

1305

gnutls.errors.GNUTLSError) as error:

1306

logger.warning("Bad certificate: %s", error)

1155

except (TypeError, gnutls.errors.GNUTLSError), error:

1156

logger.warning(u"Bad certificate: %s", error)

1307

1157

return

1308

logger.debug("Fingerprint: %s", fpr)

1158

logger.debug(u"Fingerprint: %s", fpr)

1309

1159

1310

1160

try:

1311

1161

client = ProxyClient(child_pipe, fpr,

1313

1163

except KeyError:

1314

1164

return

1315

1165

1316

if client.approval_delay:

1317

delay = client.approval_delay

1166

if client.approved_delay:

1167

delay = client.approved_delay

1318

1168

client.approvals_pending += 1

1319

1169

approval_required = True

1320

1170

1321

1171

while True:

1322

1172

if not client.enabled:

1323

logger.info("Client %s is disabled",

1173

logger.warning(u"Client %s is disabled",

1324

1174

client.name)

1325

1175

if self.server.use_dbus:

1326

1176

# Emit D-Bus signal

1327

1177

client.Rejected("Disabled")

1328

1178

return

1329

1179

1330

if client._approved or not client.approval_delay:

1180

if client._approved or not client.approved_delay:

1331

1181

#We are approved or approval is disabled

1332

1182

break

1333

1183

elif client._approved is None:

1334

logger.info("Client %s needs approval",

1184

logger.info(u"Client %s need approval",

1335

1185

client.name)

1336

1186

if self.server.use_dbus:

1337

1187

# Emit D-Bus signal

1338

1188

client.NeedApproval(

1339

client.approval_delay_milliseconds(),

1189

client.approved_delay_milliseconds(),

1340

1190

client.approved_by_default)

1341

1191

else:

1342

logger.warning("Client %s was not approved",

1192

logger.warning(u"Client %s was not approved",

1343

1193

client.name)

1344

1194

if self.server.use_dbus:

1345

1195

# Emit D-Bus signal

1346

client.Rejected("Denied")

1196

client.Rejected("Disapproved")

1347

1197

return

1348

1198

1349

1199

#wait until timeout or approved

1360

1210

client.name)

1361

1211

if self.server.use_dbus:

1362

1212

# Emit D-Bus signal

1363

client.Rejected("Approval timed out")

1213

client.Rejected("Time out")

1364

1214

return

1365

1215

else:

1366

1216

break

1369

1219

1370

1220

sent_size = 0

1371

1221

while sent_size < len(client.secret):

1372

try:

1373

sent = session.send(client.secret[sent_size:])

1374

except gnutls.errors.GNUTLSError as error:

1375

logger.warning("gnutls send failed")

1376

return

1377

logger.debug("Sent: %d, remaining: %d",

1222

# XXX handle session exception

1223

sent = session.send(client.secret[sent_size:])

1224

logger.debug(u"Sent: %d, remaining: %d",

1378

1225

sent, len(client.secret)

1379

1226

- (sent_size + sent))

1380

1227

sent_size += sent

1381

1228

1382

logger.info("Sending secret to %s", client.name)

1229

logger.info(u"Sending secret to %s", client.name)

1383

1230

# bump the timeout as if seen

1384

client.checked_ok(client.extended_timeout)

1231

client.checked_ok()

1385

1232

if self.server.use_dbus:

1386

1233

# Emit D-Bus signal

1387

1234

client.GotSecret()

1389

1236

finally:

1390

1237

if approval_required:

1391

1238

client.approvals_pending -= 1

1392

try:

1393

session.bye()

1394

except gnutls.errors.GNUTLSError as error:

1395

logger.warning("GnuTLS bye failed")

1239

session.bye()

1396

1240

1397

1241

@staticmethod

1398

1242

def peer_certificate(session):

1408

1252

.gnutls_certificate_get_peers

1409

1253

(session._c_object, ctypes.byref(list_size)))

1410

1254

if not bool(cert_list) and list_size.value != 0:

1411

raise gnutls.errors.GNUTLSError("error getting peer"

1412

" certificate")

1255

raise gnutls.errors.GNUTLSError(u"error getting peer"

1256

u" certificate")

1413

1257

if list_size.value == 0:

1414

1258

return None

1415

1259

cert = cert_list[0]

1441

1285

if crtverify.value != 0:

1442

1286

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1443

1287

raise (gnutls.errors.CertificateSecurityError

1444

("Verify failed"))

1288

(u"Verify failed"))

1445

1289

# New buffer for the fingerprint

1446

1290

buf = ctypes.create_string_buffer(20)

1447

1291

buf_len = ctypes.c_size_t()

1454

1298

# Convert the buffer to a Python bytestring

1455

1299

fpr = ctypes.string_at(buf, buf_len.value)

1456

1300

# Convert the bytestring to hexadecimal notation

1457

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1301

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1458

1302

return hex_fpr

1459

1303

1460

1304

1483

1327

1484

1328

super(MultiprocessingMixInWithPipe,

1485

1329

self).process_request(request, client_address)

1486

self.child_pipe.close()

1487

1330

self.add_pipe(parent_pipe)

1488

1489

1331

def add_pipe(self, parent_pipe):

1490

1332

"""Dummy function; override as necessary"""

1491

raise NotImplementedError

1333

pass

1492

1334

1493

1335

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1494

1336

socketserver.TCPServer, object):

1512

1354

bind to an address or port if they were not specified."""

1513

1355

if self.interface is not None:

1514

1356

if SO_BINDTODEVICE is None:

1515

logger.error("SO_BINDTODEVICE does not exist;"

1516

" cannot bind to interface %s",

1357

logger.error(u"SO_BINDTODEVICE does not exist;"

1358

u" cannot bind to interface %s",

1517

1359

self.interface)

1518

1360

else:

1519

1361

try:

1520

1362

self.socket.setsockopt(socket.SOL_SOCKET,

1521

1363

SO_BINDTODEVICE,

1522

1364

str(self.interface

1523

+ '\0'))

1524

except socket.error as error:

1365

+ u'\0'))

1366

except socket.error, error:

1525

1367

if error[0] == errno.EPERM:

1526

logger.error("No permission to"

1527

" bind to interface %s",

1368

logger.error(u"No permission to"

1369

u" bind to interface %s",

1528

1370

self.interface)

1529

1371

elif error[0] == errno.ENOPROTOOPT:

1530

logger.error("SO_BINDTODEVICE not available;"

1531

" cannot bind to interface %s",

1372

logger.error(u"SO_BINDTODEVICE not available;"

1373

u" cannot bind to interface %s",

1532

1374

self.interface)

1533

1375

else:

1534

1376

raise

1536

1378

if self.server_address[0] or self.server_address[1]:

1537

1379

if not self.server_address[0]:

1538

1380

if self.address_family == socket.AF_INET6:

1539

any_address = "::" # in6addr_any

1381

any_address = u"::" # in6addr_any

1540

1382

else:

1541

1383

any_address = socket.INADDR_ANY

1542

1384

self.server_address = (any_address,

1591

1433

def handle_ipc(self, source, condition, parent_pipe=None,

1592

1434

client_object=None):

1593

1435

condition_names = {

1594

gobject.IO_IN: "IN", # There is data to read.

1595

gobject.IO_OUT: "OUT", # Data can be written (without

1436

gobject.IO_IN: u"IN", # There is data to read.

1437

gobject.IO_OUT: u"OUT", # Data can be written (without

1596

1438

# blocking).

1597

gobject.IO_PRI: "PRI", # There is urgent data to read.

1598

gobject.IO_ERR: "ERR", # Error condition.

1599

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1439

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1440

gobject.IO_ERR: u"ERR", # Error condition.

1441

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1600

1442

# broken, usually for pipes and

1601

1443

# sockets).

1602

1444

}

1604

1446

for cond, name in

1605

1447

condition_names.iteritems()

1606

1448

if cond & condition)

1607

# error or the other end of multiprocessing.Pipe has closed

1608

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1609

return False

1449

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1450

conditions_string)

1610

1451

1611

1452

# Read a request from the child

1612

1453

request = parent_pipe.recv()

1621

1462

client = c

1622

1463

break

1623

1464

else:

1624

logger.info("Client not found for fingerprint: %s, ad"

1625

"dress: %s", fpr, address)

1465

logger.warning(u"Client not found for fingerprint: %s, ad"

1466

u"dress: %s", fpr, address)

1626

1467

if self.use_dbus:

1627

1468

# Emit D-Bus signal

1628

mandos_dbus_service.ClientNotFound(fpr, address[0])

1469

mandos_dbus_service.ClientNotFound(fpr, address)

1629

1470

parent_pipe.send(False)

1630

1471

return False

1631

1472

1650

1491

parent_pipe.send(('function',))

1651

1492

else:

1652

1493

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1653

1494

1654

1495

if command == 'setattr':

1655

1496

attrname = request[1]

1656

1497

value = request[2]

1657

1498

setattr(client_object, attrname, value)

1658

1499

1659

1500

return True

1660

1501

1661

1502

1662

1503

def string_to_delta(interval):

1663

1504

"""Parse a string and return a datetime.timedelta

1664

1505

1665

>>> string_to_delta('7d')

1506

>>> string_to_delta(u'7d')

1666

1507

datetime.timedelta(7)

1667

>>> string_to_delta('60s')

1508

>>> string_to_delta(u'60s')

1668

1509

datetime.timedelta(0, 60)

1669

>>> string_to_delta('60m')

1510

>>> string_to_delta(u'60m')

1670

1511

datetime.timedelta(0, 3600)

1671

>>> string_to_delta('24h')

1512

>>> string_to_delta(u'24h')

1672

1513

datetime.timedelta(1)

1673

>>> string_to_delta('1w')

1514

>>> string_to_delta(u'1w')

1674

1515

datetime.timedelta(7)

1675

>>> string_to_delta('5m 30s')

1516

>>> string_to_delta(u'5m 30s')

1676

1517

datetime.timedelta(0, 330)

1677

1518

"""

1678

1519

timevalue = datetime.timedelta(0)

1680

1521

try:

1681

1522

suffix = unicode(s[-1])

1682

1523

value = int(s[:-1])

1683

if suffix == "d":

1524

if suffix == u"d":

1684

1525

delta = datetime.timedelta(value)

1685

elif suffix == "s":

1526

elif suffix == u"s":

1686

1527

delta = datetime.timedelta(0, value)

1687

elif suffix == "m":

1528

elif suffix == u"m":

1688

1529

delta = datetime.timedelta(0, 0, 0, 0, value)

1689

elif suffix == "h":

1530

elif suffix == u"h":

1690

1531

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1691

elif suffix == "w":

1532

elif suffix == u"w":

1692

1533

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1693

1534

else:

1694

raise ValueError("Unknown suffix %r" % suffix)

1695

except (ValueError, IndexError) as e:

1696

raise ValueError(*(e.args))

1535

raise ValueError(u"Unknown suffix %r" % suffix)

1536

except (ValueError, IndexError), e:

1537

raise ValueError(e.message)

1697

1538

timevalue += delta

1698

1539

return timevalue

1699

1540

1705

1546

global if_nametoindex

1706

1547

try:

1707

1548

if_nametoindex = (ctypes.cdll.LoadLibrary

1708

(ctypes.util.find_library("c"))

1549

(ctypes.util.find_library(u"c"))

1709

1550

.if_nametoindex)

1710

1551

except (OSError, AttributeError):

1711

logger.warning("Doing if_nametoindex the hard way")

1552

logger.warning(u"Doing if_nametoindex the hard way")

1712

1553

def if_nametoindex(interface):

1713

1554

"Get an interface index the hard way, i.e. using fcntl()"

1714

1555

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1715

1556

with contextlib.closing(socket.socket()) as s:

1716

1557

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1717

struct.pack(str("16s16x"),

1558

struct.pack(str(u"16s16x"),

1718

1559

interface))

1719

interface_index = struct.unpack(str("I"),

1560

interface_index = struct.unpack(str(u"I"),

1720

1561

ifreq[16:20])[0]

1721

1562

return interface_index

1722

1563

return if_nametoindex(interface)

1730

1571

sys.exit()

1731

1572

os.setsid()

1732

1573

if not nochdir:

1733

os.chdir("/")

1574

os.chdir(u"/")

1734

1575

if os.fork():

1735

1576

sys.exit()

1736

1577

if not noclose:

1738

1579

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1739

1580

if not stat.S_ISCHR(os.fstat(null).st_mode):

1740

1581

raise OSError(errno.ENODEV,

1741

"%s not a character device"

1582

u"%s not a character device"

1742

1583

% os.path.devnull)

1743

1584

os.dup2(null, sys.stdin.fileno())

1744

1585

os.dup2(null, sys.stdout.fileno())

1752

1593

##################################################################

1753

1594

# Parsing of options, both command line and config file

1754

1595

1755

parser = argparse.ArgumentParser()

1756

parser.add_argument("-v", "--version", action="version",

1757

version = "%%(prog)s %s" % version,

1758

help="show version number and exit")

1759

parser.add_argument("-i", "--interface", metavar="IF",

1760

help="Bind to interface IF")

1761

parser.add_argument("-a", "--address",

1762

help="Address to listen for requests on")

1763

parser.add_argument("-p", "--port", type=int,

1764

help="Port number to receive requests on")

1765

parser.add_argument("--check", action="store_true",

1766

help="Run self-test")

1767

parser.add_argument("--debug", action="store_true",

1768

help="Debug mode; run in foreground and log"

1769

" to terminal")

1770

parser.add_argument("--debuglevel", metavar="LEVEL",

1771

help="Debug level for stdout output")

1772

parser.add_argument("--priority", help="GnuTLS"

1773

" priority string (see GnuTLS documentation)")

1774

parser.add_argument("--servicename",

1775

metavar="NAME", help="Zeroconf service name")

1776

parser.add_argument("--configdir",

1777

default="/etc/mandos", metavar="DIR",

1778

help="Directory to search for configuration"

1779

" files")

1780

parser.add_argument("--no-dbus", action="store_false",

1781

dest="use_dbus", help="Do not provide D-Bus"

1782

" system bus interface")

1783

parser.add_argument("--no-ipv6", action="store_false",

1784

dest="use_ipv6", help="Do not use IPv6")

1785

options = parser.parse_args()

1596

parser = optparse.OptionParser(version = "%%prog %s" % version)

1597

parser.add_option("-i", u"--interface", type=u"string",

1598

metavar="IF", help=u"Bind to interface IF")

1599

parser.add_option("-a", u"--address", type=u"string",

1600

help=u"Address to listen for requests on")

1601

parser.add_option("-p", u"--port", type=u"int",

1602

help=u"Port number to receive requests on")

1603

parser.add_option("--check", action=u"store_true",

1604

help=u"Run self-test")

1605

parser.add_option("--debug", action=u"store_true",

1606

help=u"Debug mode; run in foreground and log to"

1607

u" terminal")

1608

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1609

u" priority string (see GnuTLS documentation)")

1610

parser.add_option("--servicename", type=u"string",

1611

metavar=u"NAME", help=u"Zeroconf service name")

1612

parser.add_option("--configdir", type=u"string",

1613

default=u"/etc/mandos", metavar=u"DIR",

1614

help=u"Directory to search for configuration"

1615

u" files")

1616

parser.add_option("--no-dbus", action=u"store_false",

1617

dest=u"use_dbus", help=u"Do not provide D-Bus"

1618

u" system bus interface")

1619

parser.add_option("--no-ipv6", action=u"store_false",

1620

dest=u"use_ipv6", help=u"Do not use IPv6")

1621

options = parser.parse_args()[0]

1786

1622

1787

1623

if options.check:

1788

1624

import doctest

1790

1626

sys.exit()

1791

1627

1792

1628

# Default values for config file for server-global settings

1793

server_defaults = { "interface": "",

1794

"address": "",

1795

"port": "",

1796

"debug": "False",

1797

"priority":

1798

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1799

"servicename": "Mandos",

1800

"use_dbus": "True",

1801

"use_ipv6": "True",

1802

"debuglevel": "",

1629

server_defaults = { u"interface": u"",

1630

u"address": u"",

1631

u"port": u"",

1632

u"debug": u"False",

1633

u"priority":

1634

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1635

u"servicename": u"Mandos",

1636

u"use_dbus": u"True",

1637

u"use_ipv6": u"True",

1803

1638

}

1804

1639

1805

1640

# Parse config file for server-global settings

1806

1641

server_config = configparser.SafeConfigParser(server_defaults)

1807

1642

del server_defaults

1808

1643

server_config.read(os.path.join(options.configdir,

1809

"mandos.conf"))

1644

u"mandos.conf"))

1810

1645

# Convert the SafeConfigParser object to a dict

1811

1646

server_settings = server_config.defaults()

1812

1647

# Use the appropriate methods on the non-string config options

1813

for option in ("debug", "use_dbus", "use_ipv6"):

1814

server_settings[option] = server_config.getboolean("DEFAULT",

1648

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1649

server_settings[option] = server_config.getboolean(u"DEFAULT",

1815

1650

option)

1816

1651

if server_settings["port"]:

1817

server_settings["port"] = server_config.getint("DEFAULT",

1818

"port")

1652

server_settings["port"] = server_config.getint(u"DEFAULT",

1653

u"port")

1819

1654

del server_config

1820

1655

1821

1656

# Override the settings from the config file with command line

1822

1657

# options, if set.

1823

for option in ("interface", "address", "port", "debug",

1824

"priority", "servicename", "configdir",

1825

"use_dbus", "use_ipv6", "debuglevel"):

1658

for option in (u"interface", u"address", u"port", u"debug",

1659

u"priority", u"servicename", u"configdir",

1660

u"use_dbus", u"use_ipv6"):

1826

1661

value = getattr(options, option)

1827

1662

if value is not None:

1828

1663

server_settings[option] = value

1836

1671

##################################################################

1837

1672

1838

1673

# For convenience

1839

debug = server_settings["debug"]

1840

debuglevel = server_settings["debuglevel"]

1841

use_dbus = server_settings["use_dbus"]

1842

use_ipv6 = server_settings["use_ipv6"]

1843

1844

if server_settings["servicename"] != "Mandos":

1674

debug = server_settings[u"debug"]

1675

use_dbus = server_settings[u"use_dbus"]

1676

use_ipv6 = server_settings[u"use_ipv6"]

1677

1678

if not debug:

1679

syslogger.setLevel(logging.WARNING)

1680

console.setLevel(logging.WARNING)

1681

1682

if server_settings[u"servicename"] != u"Mandos":

1845

1683

syslogger.setFormatter(logging.Formatter

1846

('Mandos (%s) [%%(process)d]:'

1847

' %%(levelname)s: %%(message)s'

1848

% server_settings["servicename"]))

1684

(u'Mandos (%s) [%%(process)d]:'

1685

u' %%(levelname)s: %%(message)s'

1686

% server_settings[u"servicename"]))

1849

1687

1850

1688

# Parse config file with clients

1851

client_defaults = { "timeout": "5m",

1852

"extended_timeout": "15m",

1853

"interval": "2m",

1854

"checker": "fping -q -- %%(host)s",

1855

"host": "",

1856

"approval_delay": "0s",

1857

"approval_duration": "1s",

1689

client_defaults = { u"timeout": u"1h",

1690

u"interval": u"5m",

1691

u"checker": u"fping -q -- %%(host)s",

1692

u"host": u"",

1693

u"approved_delay": u"0s",

1694

u"approved_duration": u"1s",

1858

1695

}

1859

1696

client_config = configparser.SafeConfigParser(client_defaults)

1860

client_config.read(os.path.join(server_settings["configdir"],

1861

"clients.conf"))

1697

client_config.read(os.path.join(server_settings[u"configdir"],

1698

u"clients.conf"))

1862

1699

1863

1700

global mandos_dbus_service

1864

1701

mandos_dbus_service = None

1865

1702

1866

tcp_server = MandosServer((server_settings["address"],

1867

server_settings["port"]),

1703

tcp_server = MandosServer((server_settings[u"address"],

1704

server_settings[u"port"]),

1868

1705

ClientHandler,

1869

interface=(server_settings["interface"]

1870

or None),

1706

interface=server_settings[u"interface"],

1871

1707

use_ipv6=use_ipv6,

1872

1708

gnutls_priority=

1873

server_settings["priority"],

1709

server_settings[u"priority"],

1874

1710

use_dbus=use_dbus)

1875

if not debug:

1876

pidfilename = "/var/run/mandos.pid"

1877

try:

1878

pidfile = open(pidfilename, "w")

1879

except IOError:

1880

logger.error("Could not open file %r", pidfilename)

1711

pidfilename = u"/var/run/mandos.pid"

1712

try:

1713

pidfile = open(pidfilename, u"w")

1714

except IOError:

1715

logger.error(u"Could not open file %r", pidfilename)

1881

1716

1882

1717

try:

1883

uid = pwd.getpwnam("_mandos").pw_uid

1884

gid = pwd.getpwnam("_mandos").pw_gid

1718

uid = pwd.getpwnam(u"_mandos").pw_uid

1719

gid = pwd.getpwnam(u"_mandos").pw_gid

1885

1720

except KeyError:

1886

1721

try:

1887

uid = pwd.getpwnam("mandos").pw_uid

1888

gid = pwd.getpwnam("mandos").pw_gid

1722

uid = pwd.getpwnam(u"mandos").pw_uid

1723

gid = pwd.getpwnam(u"mandos").pw_gid

1889

1724

except KeyError:

1890

1725

try:

1891

uid = pwd.getpwnam("nobody").pw_uid

1892

gid = pwd.getpwnam("nobody").pw_gid

1726

uid = pwd.getpwnam(u"nobody").pw_uid

1727

gid = pwd.getpwnam(u"nobody").pw_gid

1893

1728

except KeyError:

1894

1729

uid = 65534

1895

1730

gid = 65534

1896

1731

try:

1897

1732

os.setgid(gid)

1898

1733

os.setuid(uid)

1899

except OSError as error:

1734

except OSError, error:

1900

1735

if error[0] != errno.EPERM:

1901

1736

raise error

1902

1737

1903

if not debug and not debuglevel:

1904

syslogger.setLevel(logging.WARNING)

1905

console.setLevel(logging.WARNING)

1906

if debuglevel:

1907

level = getattr(logging, debuglevel.upper())

1908

syslogger.setLevel(level)

1909

console.setLevel(level)

1910

1738

# Enable all possible GnuTLS debugging

1911

1739

if debug:

1912

# Enable all possible GnuTLS debugging

1913

1914

1740

# "Use a log level over 10 to enable all debugging options."

1915

1741

# - GnuTLS manual

1916

1742

gnutls.library.functions.gnutls_global_set_log_level(11)

1917

1743

1918

1744

@gnutls.library.types.gnutls_log_func

1919

1745

def debug_gnutls(level, string):

1920

logger.debug("GnuTLS: %s", string[:-1])

1746

logger.debug(u"GnuTLS: %s", string[:-1])

1921

1747

1922

1748

(gnutls.library.functions

1923

1749

.gnutls_global_set_log_function(debug_gnutls))

1924

1925

# Redirect stdin so all checkers get /dev/null

1926

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1927

os.dup2(null, sys.stdin.fileno())

1928

if null > 2:

1929

os.close(null)

1930

else:

1931

# No console logging

1932

logger.removeHandler(console)

1933

1934

# Need to fork before connecting to D-Bus

1935

if not debug:

1936

# Close all input and output, do double fork, etc.

1937

daemon()

1938

1750

1939

1751

global main_loop

1940

1752

# From the Avahi example code

1944

1756

# End of Avahi example code

1945

1757

if use_dbus:

1946

1758

try:

1947

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1759

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1948

1760

bus, do_not_queue=True)

1949

except dbus.exceptions.NameExistsException as e:

1950

logger.error(unicode(e) + ", disabling D-Bus")

1761

except dbus.exceptions.NameExistsException, e:

1762

logger.error(unicode(e) + u", disabling D-Bus")

1951

1763

use_dbus = False

1952

server_settings["use_dbus"] = False

1764

server_settings[u"use_dbus"] = False

1953

1765

tcp_server.use_dbus = False

1954

1766

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1955

service = AvahiService(name = server_settings["servicename"],

1956

servicetype = "_mandos._tcp",

1767

service = AvahiService(name = server_settings[u"servicename"],

1768

servicetype = u"_mandos._tcp",

1957

1769

protocol = protocol, bus = bus)

1958

1770

if server_settings["interface"]:

1959

1771

service.interface = (if_nametoindex

1960

(str(server_settings["interface"])))

1961

1962

global multiprocessing_manager

1963

multiprocessing_manager = multiprocessing.Manager()

1772

(str(server_settings[u"interface"])))

1964

1773

1965

1774

client_class = Client

1966

1775

if use_dbus:

1983

1792

client_config, section)))

1984

1793

for section in client_config.sections()))

1985

1794

if not tcp_server.clients:

1986

logger.warning("No clients defined")

1987

1795

logger.warning(u"No clients defined")

1796

1797

if debug:

1798

# Redirect stdin so all checkers get /dev/null

1799

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1800

os.dup2(null, sys.stdin.fileno())

1801

if null > 2:

1802

os.close(null)

1803

else:

1804

# No console logging

1805

logger.removeHandler(console)

1806

# Close all input and output, do double fork, etc.

1807

daemon()

1808

1809

try:

1810

with pidfile:

1811

pid = os.getpid()

1812

pidfile.write(str(pid) + "\n")

1813

del pidfile

1814

except IOError:

1815

logger.error(u"Could not write to file %r with PID %d",

1816

pidfilename, pid)

1817

except NameError:

1818

# "pidfile" was never created

1819

pass

1820

del pidfilename

1821

1988

1822

if not debug:

1989

try:

1990

with pidfile:

1991

pid = os.getpid()

1992

pidfile.write(str(pid) + "\n".encode("utf-8"))

1993

del pidfile

1994

except IOError:

1995

logger.error("Could not write to file %r with PID %d",

1996

pidfilename, pid)

1997

except NameError:

1998

# "pidfile" was never created

1999

pass

2000

del pidfilename

2001

2002

1823

signal.signal(signal.SIGINT, signal.SIG_IGN)

2003

2004

1824

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

2005

1825

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

2006

1826

2008

1828

class MandosDBusService(dbus.service.Object):

2009

1829

"""A D-Bus proxy object"""

2010

1830

def __init__(self):

2011

dbus.service.Object.__init__(self, bus, "/")

2012

_interface = "se.bsnet.fukt.Mandos"

1831

dbus.service.Object.__init__(self, bus, u"/")

1832

_interface = u"se.bsnet.fukt.Mandos"

2013

1833

2014

@dbus.service.signal(_interface, signature="o")

1834

@dbus.service.signal(_interface, signature=u"o")

2015

1835

def ClientAdded(self, objpath):

2016

1836

"D-Bus signal"

2017

1837

pass

2018

1838

2019

@dbus.service.signal(_interface, signature="ss")

1839

@dbus.service.signal(_interface, signature=u"ss")

2020

1840

def ClientNotFound(self, fingerprint, address):

2021

1841

"D-Bus signal"

2022

1842

pass

2023

1843

2024

@dbus.service.signal(_interface, signature="os")

1844

@dbus.service.signal(_interface, signature=u"os")

2025

1845

def ClientRemoved(self, objpath, name):

2026

1846

"D-Bus signal"

2027

1847

pass

2028

1848

2029

@dbus.service.method(_interface, out_signature="ao")

1849

@dbus.service.method(_interface, out_signature=u"ao")

2030

1850

def GetAllClients(self):

2031

1851

"D-Bus method"

2032

1852

return dbus.Array(c.dbus_object_path

2033

1853

for c in tcp_server.clients)

2034

1854

2035

1855

@dbus.service.method(_interface,

2036

out_signature="a{oa{sv}}")

1856

out_signature=u"a{oa{sv}}")

2037

1857

def GetAllClientsWithProperties(self):

2038

1858

"D-Bus method"

2039

1859

return dbus.Dictionary(

2040

((c.dbus_object_path, c.GetAll(""))

1860

((c.dbus_object_path, c.GetAll(u""))

2041

1861

for c in tcp_server.clients),

2042

signature="oa{sv}")

1862

signature=u"oa{sv}")

2043

1863

2044

@dbus.service.method(_interface, in_signature="o")

1864

@dbus.service.method(_interface, in_signature=u"o")

2045

1865

def RemoveClient(self, object_path):

2046

1866

"D-Bus method"

2047

1867

for c in tcp_server.clients:

2089

1909

# Find out what port we got

2090

1910

service.port = tcp_server.socket.getsockname()[1]

2091

1911

if use_ipv6:

2092

logger.info("Now listening on address %r, port %d,"

1912

logger.info(u"Now listening on address %r, port %d,"

2093

1913

" flowinfo %d, scope_id %d"

2094

1914

% tcp_server.socket.getsockname())

2095

1915

else: # IPv4

2096

logger.info("Now listening on address %r, port %d"

1916

logger.info(u"Now listening on address %r, port %d"

2097

1917

% tcp_server.socket.getsockname())

2098

1918

2099

1919

#service.interface = tcp_server.socket.getsockname()[3]

2102

1922

# From the Avahi example code

2103

1923

try:

2104

1924

service.activate()

2105

except dbus.exceptions.DBusException as error:

2106

logger.critical("DBusException: %s", error)

1925

except dbus.exceptions.DBusException, error:

1926

logger.critical(u"DBusException: %s", error)

2107

1927

cleanup()

2108

1928

sys.exit(1)

2109

1929

# End of Avahi example code

2113

1933

(tcp_server.handle_request

2114

1934

(*args[2:], **kwargs) or True))

2115

1935

2116

logger.debug("Starting main loop")

1936

logger.debug(u"Starting main loop")

2117

1937

main_loop.run()

2118

except AvahiError as error:

2119

logger.critical("AvahiError: %s", error)

1938

except AvahiError, error:

1939

logger.critical(u"AvahiError: %s", error)

2120

1940

cleanup()

2121

1941

sys.exit(1)

2122

1942

except KeyboardInterrupt:

2123

1943

if debug:

2124

print("", file=sys.stderr)

2125

logger.debug("Server received KeyboardInterrupt")

2126

logger.debug("Server exiting")

1944

print >> sys.stderr

1945

logger.debug(u"Server received KeyboardInterrupt")

1946

logger.debug(u"Server exiting")

2127

1947

# Must run before the D-Bus bus name gets deregistered

2128

1948

cleanup()

2129

1949