/mandos/trunk : revision 24.2.1

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

82

81

SO_BINDTODEVICE = None

83

82

84

83

85

version = "1.3.1"

84

version = "1.0.14"

86

85

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

86

logger = logging.Logger(u'mandos')

89

87

syslogger = (logging.handlers.SysLogHandler

90

88

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

address = str("/dev/log")))

89

address = "/dev/log"))

92

90

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

91

(u'Mandos [%(process)d]: %(levelname)s:'

92

u' %(message)s'))

95

93

logger.addHandler(syslogger)

96

94

97

95

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

96

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

97

u' %(levelname)s:'

98

u' %(message)s'))

101

99

logger.addHandler(console)

102

100

101

multiprocessing_manager = multiprocessing.Manager()

102

103

class AvahiError(Exception):

104

def __init__(self, value, *args, **kwargs):

105

self.value = value

120

Attributes:

121

interface: integer; avahi.IF_UNSPEC or an interface index.

122

Used to optionally bind to the specified interface.

123

124

type: string; Example: '_mandos._tcp'.

123

124

type: string; Example: u'_mandos._tcp'.

125

See <http://www.dns-sd.org/ServiceTypes.html>

126

port: integer; what port to announce

127

TXT: list of strings; TXT record for the service

136

"""

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

138

servicetype = None, port = None, TXT = None,

139

domain = "", host = "", max_renames = 32768,

139

domain = u"", host = u"", max_renames = 32768,

140

protocol = avahi.PROTO_UNSPEC, bus = None):

141

self.interface = interface

142

self.name = name

151

self.group = None # our entry group

152

self.server = None

153

self.bus = bus

154

self.entry_group_state_changed_match = None

155

154

def rename(self):

156

155

"""Derived from the Avahi example code"""

157

156

if self.rename_count >= self.max_renames:

158

logger.critical("No suitable Zeroconf service name found"

159

" after %i retries, exiting.",

157

logger.critical(u"No suitable Zeroconf service name found"

158

u" after %i retries, exiting.",

160

159

self.rename_count)

161

raise AvahiServiceError("Too many renames")

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

163

logger.info("Changing Zeroconf service name to %r ...",

164

self.name)

160

raise AvahiServiceError(u"Too many renames")

161

self.name = self.server.GetAlternativeServiceName(self.name)

162

logger.info(u"Changing Zeroconf service name to %r ...",

163

unicode(self.name))

165

164

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

165

(u'Mandos (%s) [%%(process)d]:'

166

u' %%(levelname)s: %%(message)s'

168

167

% self.name))

169

168

self.remove()

170

try:

171

self.add()

172

except dbus.exceptions.DBusException as error:

173

logger.critical("DBusException: %s", error)

174

self.cleanup()

175

os._exit(1)

169

self.add()

176

170

self.rename_count += 1

177

171

def remove(self):

178

172

"""Derived from the Avahi example code"""

179

if self.entry_group_state_changed_match is not None:

180

self.entry_group_state_changed_match.remove()

181

self.entry_group_state_changed_match = None

182

173

if self.group is not None:

183

174

self.group.Reset()

184

175

def add(self):

185

176

"""Derived from the Avahi example code"""

186

self.remove()

187

177

if self.group is None:

188

178

self.group = dbus.Interface(

189

179

self.bus.get_object(avahi.DBUS_NAME,

190

180

self.server.EntryGroupNew()),

191

181

avahi.DBUS_INTERFACE_ENTRY_GROUP)

192

self.entry_group_state_changed_match = (

193

self.group.connect_to_signal(

194

'StateChanged', self .entry_group_state_changed))

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

182

self.group.connect_to_signal('StateChanged',

183

self

184

.entry_group_state_changed)

185

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

196

186

self.name, self.type)

197

187

self.group.AddService(

198

188

self.interface,

205

195

self.group.Commit()

206

196

def entry_group_state_changed(self, state, error):

207

197

"""Derived from the Avahi example code"""

208

logger.debug("Avahi entry group state change: %i", state)

198

logger.debug(u"Avahi state change: %i", state)

209

199

210

200

if state == avahi.ENTRY_GROUP_ESTABLISHED:

211

logger.debug("Zeroconf service established.")

201

logger.debug(u"Zeroconf service established.")

212

202

elif state == avahi.ENTRY_GROUP_COLLISION:

213

logger.info("Zeroconf service name collision.")

203

logger.warning(u"Zeroconf service name collision.")

214

204

self.rename()

215

205

elif state == avahi.ENTRY_GROUP_FAILURE:

216

logger.critical("Avahi: Error in group state changed %s",

206

logger.critical(u"Avahi: Error in group state changed %s",

217

207

unicode(error))

218

raise AvahiGroupError("State changed: %s"

208

raise AvahiGroupError(u"State changed: %s"

219

209

% unicode(error))

220

210

def cleanup(self):

221

211

"""Derived from the Avahi example code"""

222

212

if self.group is not None:

223

try:

224

self.group.Free()

225

except (dbus.exceptions.UnknownMethodException,

226

dbus.exceptions.DBusException) as e:

227

pass

213

self.group.Free()

228

214

self.group = None

229

self.remove()

230

def server_state_changed(self, state, error=None):

215

def server_state_changed(self, state):

231

216

"""Derived from the Avahi example code"""

232

logger.debug("Avahi server state change: %i", state)

233

bad_states = { avahi.SERVER_INVALID:

234

"Zeroconf server invalid",

235

avahi.SERVER_REGISTERING: None,

236

avahi.SERVER_COLLISION:

237

"Zeroconf server name collision",

238

avahi.SERVER_FAILURE:

239

"Zeroconf server failure" }

240

if state in bad_states:

241

if bad_states[state] is not None:

242

if error is None:

243

logger.error(bad_states[state])

244

else:

245

logger.error(bad_states[state] + ": %r", error)

246

self.cleanup()

217

if state == avahi.SERVER_COLLISION:

218

logger.error(u"Zeroconf server name collision")

219

self.remove()

247

220

elif state == avahi.SERVER_RUNNING:

248

221

self.add()

249

else:

250

if error is None:

251

logger.debug("Unknown state: %r", state)

252

else:

253

logger.debug("Unknown state: %r: %r", state, error)

254

222

def activate(self):

255

223

"""Derived from the Avahi example code"""

256

224

if self.server is None:

257

225

self.server = dbus.Interface(

258

226

self.bus.get_object(avahi.DBUS_NAME,

259

avahi.DBUS_PATH_SERVER,

260

follow_name_owner_changes=True),

227

avahi.DBUS_PATH_SERVER),

261

228

avahi.DBUS_INTERFACE_SERVER)

262

self.server.connect_to_signal("StateChanged",

229

self.server.connect_to_signal(u"StateChanged",

263

230

self.server_state_changed)

264

231

self.server_state_changed(self.server.GetState())

265

232

266

233

267

def _timedelta_to_milliseconds(td):

268

"Convert a datetime.timedelta() to milliseconds"

269

return ((td.days * 24 * 60 * 60 * 1000)

270

+ (td.seconds * 1000)

271

+ (td.microseconds // 1000))

272

273

234

class Client(object):

274

235

"""A representation of a client host served by this server.

275

236

276

237

Attributes:

277

_approved: bool(); 'None' if not yet approved/disapproved

278

approval_delay: datetime.timedelta(); Time to wait for approval

279

approval_duration: datetime.timedelta(); Duration of one approval

238

239

D-Bus identifiers

240

fingerprint: string (40 or 32 hexadecimal digits); used to

241

uniquely identify the client

242

secret: bytestring; sent verbatim (over TLS) to client

243

host: string; available for use by the checker command

244

created: datetime.datetime(); (UTC) object creation

245

last_enabled: datetime.datetime(); (UTC)

246

enabled: bool()

247

last_checked_ok: datetime.datetime(); (UTC) or None

248

timeout: datetime.timedelta(); How long from last_checked_ok

249

until this client is disabled

250

interval: datetime.timedelta(); How often to start a new checker

251

disable_hook: If set, called by disable() as disable_hook(self)

280

252

checker: subprocess.Popen(); a running checker process used

281

253

to see if the client lives.

282

254

'None' if no process is running.

283

checker_callback_tag: a gobject event source tag, or None

284

checker_command: string; External command which is run to check

285

if client lives. %() expansions are done at

255

checker_initiator_tag: a gobject event source tag, or None

256

disable_initiator_tag: - '' -

257

checker_callback_tag: - '' -

258

checker_command: string; External command which is run to check if

259

client lives. %() expansions are done at

286

260

runtime with vars(self) as dict, so that for

287

261

instance %(name)s can be used in the command.

288

checker_initiator_tag: a gobject event source tag, or None

289

created: datetime.datetime(); (UTC) object creation

290

262

current_checker_command: string; current running checker_command

291

disable_hook: If set, called by disable() as disable_hook(self)

292

disable_initiator_tag: a gobject event source tag, or None

293

enabled: bool()

294

fingerprint: string (40 or 32 hexadecimal digits); used to

295

uniquely identify the client

296

host: string; available for use by the checker command

297

interval: datetime.timedelta(); How often to start a new checker

298

last_approval_request: datetime.datetime(); (UTC) or None

299

last_checked_ok: datetime.datetime(); (UTC) or None

300

last_enabled: datetime.datetime(); (UTC)

301

302

D-Bus identifiers

303

secret: bytestring; sent verbatim (over TLS) to client

304

timeout: datetime.timedelta(); How long from last_checked_ok

305

until this client is disabled

306

extended_timeout: extra long timeout when password has been sent

307

runtime_expansions: Allowed attributes for runtime expansion.

308

expires: datetime.datetime(); time (UTC) when a client will be

309

disabled, or None

263

approved_delay: datetime.timedelta(); Time to wait for approval

264

_approved: bool(); 'None' if not yet approved/disapproved

265

approved_duration: datetime.timedelta(); Duration of one approval

310

266

"""

311

267

312

runtime_expansions = ("approval_delay", "approval_duration",

313

"created", "enabled", "fingerprint",

314

"host", "interval", "last_checked_ok",

315

"last_enabled", "name", "timeout")

268

@staticmethod

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

316

274

317

275

def timeout_milliseconds(self):

318

276

"Return the 'timeout' attribute in milliseconds"

319

return _timedelta_to_milliseconds(self.timeout)

320

321

def extended_timeout_milliseconds(self):

322

"Return the 'extended_timeout' attribute in milliseconds"

323

return _timedelta_to_milliseconds(self.extended_timeout)

277

return self._timedelta_to_milliseconds(self.timeout)

324

278

325

279

def interval_milliseconds(self):

326

280

"Return the 'interval' attribute in milliseconds"

327

return _timedelta_to_milliseconds(self.interval)

328

329

def approval_delay_milliseconds(self):

330

return _timedelta_to_milliseconds(self.approval_delay)

281

return self._timedelta_to_milliseconds(self.interval)

282

283

def approved_delay_milliseconds(self):

284

return self._timedelta_to_milliseconds(self.approved_delay)

331

285

332

286

def __init__(self, name = None, disable_hook=None, config=None):

333

287

"""Note: the 'checker' key in 'config' sets the

336

290

self.name = name

337

291

if config is None:

338

292

config = {}

339

logger.debug("Creating client %r", self.name)

293

logger.debug(u"Creating client %r", self.name)

340

294

# Uppercase and remove spaces from fingerprint for later

341

295

# comparison purposes with return value from the fingerprint()

342

296

# function

343

self.fingerprint = (config["fingerprint"].upper()

344

.replace(" ", ""))

345

logger.debug(" Fingerprint: %s", self.fingerprint)

346

if "secret" in config:

347

self.secret = config["secret"].decode("base64")

348

elif "secfile" in config:

297

self.fingerprint = (config[u"fingerprint"].upper()

298

.replace(u" ", u""))

299

logger.debug(u" Fingerprint: %s", self.fingerprint)

300

if u"secret" in config:

301

self.secret = config[u"secret"].decode(u"base64")

302

elif u"secfile" in config:

349

303

with open(os.path.expanduser(os.path.expandvars

350

(config["secfile"])),

304

(config[u"secfile"])),

351

305

"rb") as secfile:

352

306

self.secret = secfile.read()

353

307

else:

354

raise TypeError("No secret or secfile for client %s"

308

#XXX Need to allow secret on demand!

309

raise TypeError(u"No secret or secfile for client %s"

355

310

% self.name)

356

self.host = config.get("host", "")

311

self.host = config.get(u"host", u"")

357

312

self.created = datetime.datetime.utcnow()

358

313

self.enabled = False

359

self.last_approval_request = None

360

314

self.last_enabled = None

361

315

self.last_checked_ok = None

362

self.timeout = string_to_delta(config["timeout"])

363

self.extended_timeout = string_to_delta(config["extended_timeout"])

364

self.interval = string_to_delta(config["interval"])

316

self.timeout = string_to_delta(config[u"timeout"])

317

self.interval = string_to_delta(config[u"interval"])

365

318

self.disable_hook = disable_hook

366

319

self.checker = None

367

320

self.checker_initiator_tag = None

368

321

self.disable_initiator_tag = None

369

self.expires = None

370

322

self.checker_callback_tag = None

371

self.checker_command = config["checker"]

323

self.checker_command = config[u"checker"]

372

324

self.current_checker_command = None

373

325

self.last_connect = None

326

self.approvals_pending = 0

374

327

self._approved = None

375

self.approved_by_default = config.get("approved_by_default",

328

self.approved_by_default = config.get(u"approved_by_default",

376

329

True)

377

self.approvals_pending = 0

378

self.approval_delay = string_to_delta(

379

config["approval_delay"])

380

self.approval_duration = string_to_delta(

381

config["approval_duration"])

330

self.approved_delay = string_to_delta(

331

config[u"approved_delay"])

332

self.approved_duration = string_to_delta(

333

config[u"approved_duration"])

382

334

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

383

335

384

336

def send_changedstate(self):

385

337

self.changedstate.acquire()

386

338

self.changedstate.notify_all()

388

340

389

341

def enable(self):

390

342

"""Start this client's checker and timeout hooks"""

391

if getattr(self, "enabled", False):

343

if getattr(self, u"enabled", False):

392

344

# Already enabled

393

345

return

394

346

self.send_changedstate()

347

self.last_enabled = datetime.datetime.utcnow()

395

348

# Schedule a new checker to be started an 'interval' from now,

396

349

# and every interval from then on.

397

350

self.checker_initiator_tag = (gobject.timeout_add

398

351

(self.interval_milliseconds(),

399

352

self.start_checker))

400

353

# Schedule a disable() when 'timeout' has passed

401

self.expires = datetime.datetime.utcnow() + self.timeout

402

354

self.disable_initiator_tag = (gobject.timeout_add

403

355

(self.timeout_milliseconds(),

404

356

self.disable))

405

357

self.enabled = True

406

self.last_enabled = datetime.datetime.utcnow()

407

358

# Also start a new checker *right now*.

408

359

self.start_checker()

409

360

414

365

if not quiet:

415

366

self.send_changedstate()

416

367

if not quiet:

417

logger.info("Disabling client %s", self.name)

418

if getattr(self, "disable_initiator_tag", False):

368

logger.info(u"Disabling client %s", self.name)

369

if getattr(self, u"disable_initiator_tag", False):

419

370

gobject.source_remove(self.disable_initiator_tag)

420

371

self.disable_initiator_tag = None

421

self.expires = None

422

if getattr(self, "checker_initiator_tag", False):

372

if getattr(self, u"checker_initiator_tag", False):

423

373

gobject.source_remove(self.checker_initiator_tag)

424

374

self.checker_initiator_tag = None

425

375

self.stop_checker()

440

390

if os.WIFEXITED(condition):

441

391

exitstatus = os.WEXITSTATUS(condition)

442

392

if exitstatus == 0:

443

logger.info("Checker for %(name)s succeeded",

393

logger.info(u"Checker for %(name)s succeeded",

444

394

vars(self))

445

395

self.checked_ok()

446

396

else:

447

logger.info("Checker for %(name)s failed",

397

logger.info(u"Checker for %(name)s failed",

448

398

vars(self))

449

399

else:

450

logger.warning("Checker for %(name)s crashed?",

400

logger.warning(u"Checker for %(name)s crashed?",

451

401

vars(self))

452

402

453

def checked_ok(self, timeout=None):

403

def checked_ok(self):

454

404

"""Bump up the timeout for this client.

455

405

456

406

This should only be called when the client has been seen,

457

407

alive and well.

458

408

"""

459

if timeout is None:

460

timeout = self.timeout

461

409

self.last_checked_ok = datetime.datetime.utcnow()

462

410

gobject.source_remove(self.disable_initiator_tag)

463

self.expires = datetime.datetime.utcnow() + timeout

464

411

self.disable_initiator_tag = (gobject.timeout_add

465

(_timedelta_to_milliseconds(timeout),

412

(self.timeout_milliseconds(),

466

413

self.disable))

467

414

468

def need_approval(self):

469

self.last_approval_request = datetime.datetime.utcnow()

470

471

415

def start_checker(self):

472

416

"""Start a new checker subprocess if one is not running.

473

417

485

429

# If a checker exists, make sure it is not a zombie

486

430

try:

487

431

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

488

except (AttributeError, OSError) as error:

432

except (AttributeError, OSError), error:

489

433

if (isinstance(error, OSError)

490

434

and error.errno != errno.ECHILD):

491

435

raise error

492

436

else:

493

437

if pid:

494

logger.warning("Checker was a zombie")

438

logger.warning(u"Checker was a zombie")

495

439

gobject.source_remove(self.checker_callback_tag)

496

440

self.checker_callback(pid, status,

497

441

self.current_checker_command)

502

446

command = self.checker_command % self.host

503

447

except TypeError:

504

448

# Escape attributes for the shell

505

escaped_attrs = dict(

506

(attr,

507

re.escape(unicode(str(getattr(self, attr, "")),

508

errors=

509

'replace')))

510

for attr in

511

self.runtime_expansions)

512

449

escaped_attrs = dict((key,

450

re.escape(unicode(str(val),

451

errors=

452

u'replace')))

453

for key, val in

454

vars(self).iteritems())

513

455

try:

514

456

command = self.checker_command % escaped_attrs

515

except TypeError as error:

516

logger.error('Could not format string "%s":'

517

' %s', self.checker_command, error)

457

except TypeError, error:

458

logger.error(u'Could not format string "%s":'

459

u' %s', self.checker_command, error)

518

460

return True # Try again later

519

461

self.current_checker_command = command

520

462

try:

521

logger.info("Starting checker %r for %s",

463

logger.info(u"Starting checker %r for %s",

522

464

command, self.name)

523

465

# We don't need to redirect stdout and stderr, since

524

466

# in normal mode, that is already done by daemon(),

526

468

# always replaced by /dev/null.)

527

469

self.checker = subprocess.Popen(command,

528

470

close_fds=True,

529

shell=True, cwd="/")

471

shell=True, cwd=u"/")

530

472

self.checker_callback_tag = (gobject.child_watch_add

531

473

(self.checker.pid,

532

474

self.checker_callback,

537

479

if pid:

538

480

gobject.source_remove(self.checker_callback_tag)

539

481

self.checker_callback(pid, status, command)

540

except OSError as error:

541

logger.error("Failed to start subprocess: %s",

482

except OSError, error:

483

logger.error(u"Failed to start subprocess: %s",

542

484

error)

543

485

# Re-run this periodically if run by gobject.timeout_add

544

486

return True

548

490

if self.checker_callback_tag:

549

491

gobject.source_remove(self.checker_callback_tag)

550

492

self.checker_callback_tag = None

551

if getattr(self, "checker", None) is None:

493

if getattr(self, u"checker", None) is None:

552

494

return

553

logger.debug("Stopping checker for %(name)s", vars(self))

495

logger.debug(u"Stopping checker for %(name)s", vars(self))

554

496

try:

555

497

os.kill(self.checker.pid, signal.SIGTERM)

556

498

#time.sleep(0.5)

557

499

#if self.checker.poll() is None:

558

500

# os.kill(self.checker.pid, signal.SIGKILL)

559

except OSError as error:

501

except OSError, error:

560

502

if error.errno != errno.ESRCH: # No such process

561

503

raise

562

504

self.checker = None

563

505

564

565

def dbus_service_property(dbus_interface, signature="v",

566

access="readwrite", byte_arrays=False):

506

def dbus_service_property(dbus_interface, signature=u"v",

507

access=u"readwrite", byte_arrays=False):

567

508

"""Decorators for marking methods of a DBusObjectWithProperties to

568

509

become properties on the D-Bus.

569

510

576

517

"""

577

518

# Encoding deeply encoded byte arrays is not supported yet by the

578

519

# "Set" method, so we fail early here:

579

if byte_arrays and signature != "ay":

580

raise ValueError("Byte arrays not supported for non-'ay'"

581

" signature %r" % signature)

520

if byte_arrays and signature != u"ay":

521

raise ValueError(u"Byte arrays not supported for non-'ay'"

522

u" signature %r" % signature)

582

523

def decorator(func):

583

524

func._dbus_is_property = True

584

525

func._dbus_interface = dbus_interface

585

526

func._dbus_signature = signature

586

527

func._dbus_access = access

587

528

func._dbus_name = func.__name__

588

if func._dbus_name.endswith("_dbus_property"):

529

if func._dbus_name.endswith(u"_dbus_property"):

589

530

func._dbus_name = func._dbus_name[:-14]

590

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

531

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

591

532

return func

592

533

return decorator

593

534

613

554

614

555

class DBusObjectWithProperties(dbus.service.Object):

615

556

"""A D-Bus object with properties.

616

557

617

558

Classes inheriting from this can use the dbus_service_property

618

559

decorator to expose methods as D-Bus properties. It exposes the

619

560

standard Get(), Set(), and GetAll() methods on the D-Bus.

621

562

622

563

@staticmethod

623

564

def _is_dbus_property(obj):

624

return getattr(obj, "_dbus_is_property", False)

565

return getattr(obj, u"_dbus_is_property", False)

625

566

626

567

def _get_all_dbus_properties(self):

627

568

"""Returns a generator of (name, attribute) pairs

635

576

property with the specified name and interface.

636

577

"""

637

578

for name in (property_name,

638

property_name + "_dbus_property"):

579

property_name + u"_dbus_property"):

639

580

prop = getattr(self, name, None)

640

581

if (prop is None

641

582

or not self._is_dbus_property(prop)

645

586

continue

646

587

return prop

647

588

# No such property

648

raise DBusPropertyNotFound(self.dbus_object_path + ":"

649

+ interface_name + "."

589

raise DBusPropertyNotFound(self.dbus_object_path + u":"

590

+ interface_name + u"."

650

591

+ property_name)

651

592

652

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

653

out_signature="v")

593

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

594

out_signature=u"v")

654

595

def Get(self, interface_name, property_name):

655

596

"""Standard D-Bus property Get() method, see D-Bus standard.

656

597

"""

657

598

prop = self._get_dbus_property(interface_name, property_name)

658

if prop._dbus_access == "write":

599

if prop._dbus_access == u"write":

659

600

raise DBusPropertyAccessException(property_name)

660

601

value = prop()

661

if not hasattr(value, "variant_level"):

602

if not hasattr(value, u"variant_level"):

662

603

return value

663

604

return type(value)(value, variant_level=value.variant_level+1)

664

605

665

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

606

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

666

607

def Set(self, interface_name, property_name, value):

667

608

"""Standard D-Bus property Set() method, see D-Bus standard.

668

609

"""

669

610

prop = self._get_dbus_property(interface_name, property_name)

670

if prop._dbus_access == "read":

611

if prop._dbus_access == u"read":

671

612

raise DBusPropertyAccessException(property_name)

672

if prop._dbus_get_args_options["byte_arrays"]:

613

if prop._dbus_get_args_options[u"byte_arrays"]:

673

614

# The byte_arrays option is not supported yet on

674

615

# signatures other than "ay".

675

if prop._dbus_signature != "ay":

616

if prop._dbus_signature != u"ay":

676

617

raise ValueError

677

618

value = dbus.ByteArray(''.join(unichr(byte)

678

619

for byte in value))

679

620

prop(value)

680

621

681

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

682

out_signature="a{sv}")

622

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

623

out_signature=u"a{sv}")

683

624

def GetAll(self, interface_name):

684

625

"""Standard D-Bus property GetAll() method, see D-Bus

685

626

standard.

686

627

687

628

Note: Will not include properties with access="write".

688

629

"""

689

630

all = {}

693

634

# Interface non-empty but did not match

694

635

continue

695

636

# Ignore write-only properties

696

if prop._dbus_access == "write":

637

if prop._dbus_access == u"write":

697

638

continue

698

639

value = prop()

699

if not hasattr(value, "variant_level"):

640

if not hasattr(value, u"variant_level"):

700

641

all[name] = value

701

642

continue

702

643

all[name] = type(value)(value, variant_level=

703

644

value.variant_level+1)

704

return dbus.Dictionary(all, signature="sv")

645

return dbus.Dictionary(all, signature=u"sv")

705

646

706

647

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

707

out_signature="s",

648

out_signature=u"s",

708

649

path_keyword='object_path',

709

650

connection_keyword='connection')

710

651

def Introspect(self, object_path, connection):

715

656

try:

716

657

document = xml.dom.minidom.parseString(xmlstring)

717

658

def make_tag(document, name, prop):

718

e = document.createElement("property")

719

e.setAttribute("name", name)

720

e.setAttribute("type", prop._dbus_signature)

721

e.setAttribute("access", prop._dbus_access)

659

e = document.createElement(u"property")

660

e.setAttribute(u"name", name)

661

e.setAttribute(u"type", prop._dbus_signature)

662

e.setAttribute(u"access", prop._dbus_access)

722

663

return e

723

for if_tag in document.getElementsByTagName("interface"):

664

for if_tag in document.getElementsByTagName(u"interface"):

724

665

for tag in (make_tag(document, name, prop)

725

666

for name, prop

726

667

in self._get_all_dbus_properties()

727

668

if prop._dbus_interface

728

== if_tag.getAttribute("name")):

669

== if_tag.getAttribute(u"name")):

729

670

if_tag.appendChild(tag)

730

671

# Add the names to the return values for the

731

672

# "org.freedesktop.DBus.Properties" methods

732

if (if_tag.getAttribute("name")

733

== "org.freedesktop.DBus.Properties"):

734

for cn in if_tag.getElementsByTagName("method"):

735

if cn.getAttribute("name") == "Get":

736

for arg in cn.getElementsByTagName("arg"):

737

if (arg.getAttribute("direction")

738

== "out"):

739

arg.setAttribute("name", "value")

740

elif cn.getAttribute("name") == "GetAll":

741

for arg in cn.getElementsByTagName("arg"):

742

if (arg.getAttribute("direction")

743

== "out"):

744

arg.setAttribute("name", "props")

745

xmlstring = document.toxml("utf-8")

673

if (if_tag.getAttribute(u"name")

674

== u"org.freedesktop.DBus.Properties"):

675

for cn in if_tag.getElementsByTagName(u"method"):

676

if cn.getAttribute(u"name") == u"Get":

677

for arg in cn.getElementsByTagName(u"arg"):

678

if (arg.getAttribute(u"direction")

679

== u"out"):

680

arg.setAttribute(u"name", u"value")

681

elif cn.getAttribute(u"name") == u"GetAll":

682

for arg in cn.getElementsByTagName(u"arg"):

683

if (arg.getAttribute(u"direction")

684

== u"out"):

685

arg.setAttribute(u"name", u"props")

686

xmlstring = document.toxml(u"utf-8")

746

687

document.unlink()

747

688

except (AttributeError, xml.dom.DOMException,

748

xml.parsers.expat.ExpatError) as error:

749

logger.error("Failed to override Introspection method",

689

xml.parsers.expat.ExpatError), error:

690

logger.error(u"Failed to override Introspection method",

750

691

error)

751

692

return xmlstring

752

693

753

694

754

def datetime_to_dbus (dt, variant_level=0):

755

"""Convert a UTC datetime.datetime() to a D-Bus type."""

756

if dt is None:

757

return dbus.String("", variant_level = variant_level)

758

return dbus.String(dt.isoformat(),

759

variant_level=variant_level)

760

761

762

695

class ClientDBus(Client, DBusObjectWithProperties):

763

696

"""A Client class using D-Bus

764

697

766

699

dbus_object_path: dbus.ObjectPath

767

700

bus: dbus.SystemBus()

768

701

"""

769

770

runtime_expansions = (Client.runtime_expansions

771

+ ("dbus_object_path",))

772

773

702

# dbus.service.Object doesn't use super(), so we can't either.

774

703

775

704

def __init__(self, bus = None, *args, **kwargs):

776

self._approvals_pending = 0

777

705

self.bus = bus

778

706

Client.__init__(self, *args, **kwargs)

779

707

# Only now, when this client is initialized, can it show up on

780

708

# the D-Bus

781

client_object_name = unicode(self.name).translate(

782

{ord("."): ord("_"),

783

ord("-"): ord("_")})

784

709

self.dbus_object_path = (dbus.ObjectPath

785

("/clients/" + client_object_name))

710

(u"/clients/"

711

+ self.name.replace(u".", u"_")))

786

712

DBusObjectWithProperties.__init__(self, self.bus,

787

713

self.dbus_object_path)

788

789

def notifychangeproperty(transform_func,

790

dbus_name, type_func=lambda x: x,

791

variant_level=1):

792

""" Modify a variable so that its a property that announce its

793

changes to DBus.

794

transform_fun: Function that takes a value and transform it to

795

DBus type.

796

dbus_name: DBus name of the variable

797

type_func: Function that transform the value before sending it

798

to DBus

799

variant_level: DBus variant level. default: 1

800

"""

801

real_value = [None,]

802

def setter(self, value):

803

old_value = real_value[0]

804

real_value[0] = value

805

if hasattr(self, "dbus_object_path"):

806

if type_func(old_value) != type_func(real_value[0]):

807

dbus_value = transform_func(type_func(real_value[0]),

808

variant_level)

809

self.PropertyChanged(dbus.String(dbus_name),

810

dbus_value)

811

812

return property(lambda self: real_value[0], setter)

813

814

815

expires = notifychangeproperty(datetime_to_dbus, "Expires")

816

approvals_pending = notifychangeproperty(dbus.Boolean,

817

"ApprovalPending",

818

type_func = bool)

819

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

820

last_enabled = notifychangeproperty(datetime_to_dbus,

821

"LastEnabled")

822

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

823

type_func = lambda checker: checker is not None)

824

last_checked_ok = notifychangeproperty(datetime_to_dbus,

825

"LastCheckedOK")

826

last_approval_request = notifychangeproperty(datetime_to_dbus,

827

"LastApprovalRequest")

828

approved_by_default = notifychangeproperty(dbus.Boolean,

829

"ApprovedByDefault")

830

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

831

type_func = _timedelta_to_milliseconds)

832

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

833

type_func = _timedelta_to_milliseconds)

834

host = notifychangeproperty(dbus.String, "Host")

835

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

836

type_func = _timedelta_to_milliseconds)

837

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

838

type_func = _timedelta_to_milliseconds)

839

interval = notifychangeproperty(dbus.UInt16, "Interval",

840

type_func = _timedelta_to_milliseconds)

841

checker_command = notifychangeproperty(dbus.String, "Checker")

842

843

del notifychangeproperty

714

715

@staticmethod

716

def _datetime_to_dbus(dt, variant_level=0):

717

"""Convert a UTC datetime.datetime() to a D-Bus type."""

718

return dbus.String(dt.isoformat(),

719

variant_level=variant_level)

720

721

def enable(self):

722

oldstate = getattr(self, u"enabled", False)

723

r = Client.enable(self)

724

if oldstate != self.enabled:

725

# Emit D-Bus signals

726

self.PropertyChanged(dbus.String(u"enabled"),

727

dbus.Boolean(True, variant_level=1))

728

self.PropertyChanged(

729

dbus.String(u"last_enabled"),

730

self._datetime_to_dbus(self.last_enabled,

731

variant_level=1))

732

return r

733

734

def disable(self, quiet = False):

735

oldstate = getattr(self, u"enabled", False)

736

r = Client.disable(self, quiet=quiet)

737

if not quiet and oldstate != self.enabled:

738

# Emit D-Bus signal

739

self.PropertyChanged(dbus.String(u"enabled"),

740

dbus.Boolean(False, variant_level=1))

741

return r

844

742

845

743

def __del__(self, *args, **kwargs):

846

744

try:

847

745

self.remove_from_connection()

848

746

except LookupError:

849

747

pass

850

if hasattr(DBusObjectWithProperties, "__del__"):

748

if hasattr(DBusObjectWithProperties, u"__del__"):

851

749

DBusObjectWithProperties.__del__(self, *args, **kwargs)

852

750

Client.__del__(self, *args, **kwargs)

853

751

855

753

*args, **kwargs):

856

754

self.checker_callback_tag = None

857

755

self.checker = None

756

# Emit D-Bus signal

757

self.PropertyChanged(dbus.String(u"checker_running"),

758

dbus.Boolean(False, variant_level=1))

858

759

if os.WIFEXITED(condition):

859

760

exitstatus = os.WEXITSTATUS(condition)

860

761

# Emit D-Bus signal

870

771

return Client.checker_callback(self, pid, condition, command,

871

772

*args, **kwargs)

872

773

774

def checked_ok(self, *args, **kwargs):

775

r = Client.checked_ok(self, *args, **kwargs)

776

# Emit D-Bus signal

777

self.PropertyChanged(

778

dbus.String(u"last_checked_ok"),

779

(self._datetime_to_dbus(self.last_checked_ok,

780

variant_level=1)))

781

return r

782

873

783

def start_checker(self, *args, **kwargs):

874

784

old_checker = self.checker

875

785

if self.checker is not None:

882

792

and old_checker_pid != self.checker.pid):

883

793

# Emit D-Bus signal

884

794

self.CheckerStarted(self.current_checker_command)

795

self.PropertyChanged(

796

dbus.String(u"checker_running"),

797

dbus.Boolean(True, variant_level=1))

885

798

return r

886

799

800

def stop_checker(self, *args, **kwargs):

801

old_checker = getattr(self, u"checker", None)

802

r = Client.stop_checker(self, *args, **kwargs)

803

if (old_checker is not None

804

and getattr(self, u"checker", None) is None):

805

self.PropertyChanged(dbus.String(u"checker_running"),

806

dbus.Boolean(False, variant_level=1))

807

return r

808

887

809

def _reset_approved(self):

888

810

self._approved = None

889

811

return False

890

812

891

813

def approve(self, value=True):

892

self.send_changedstate()

893

814

self._approved = value

894

gobject.timeout_add(_timedelta_to_milliseconds

895

(self.approval_duration),

896

self._reset_approved)

815

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration, self._reset_approved))

816

817

def approved_pending(self):

818

return self.approvals_pending > 0

897

819

898

820

899

821

## D-Bus methods, signals & properties

900

_interface = "se.bsnet.fukt.Mandos.Client"

822

_interface = u"se.bsnet.fukt.Mandos.Client"

901

823

902

824

## Signals

903

825

904

826

# CheckerCompleted - signal

905

@dbus.service.signal(_interface, signature="nxs")

827

@dbus.service.signal(_interface, signature=u"nxs")

906

828

def CheckerCompleted(self, exitcode, waitstatus, command):

907

829

"D-Bus signal"

908

830

pass

909

831

910

832

# CheckerStarted - signal

911

@dbus.service.signal(_interface, signature="s")

833

@dbus.service.signal(_interface, signature=u"s")

912

834

def CheckerStarted(self, command):

913

835

"D-Bus signal"

914

836

pass

915

837

916

838

# PropertyChanged - signal

917

@dbus.service.signal(_interface, signature="sv")

839

@dbus.service.signal(_interface, signature=u"sv")

918

840

def PropertyChanged(self, property, value):

919

841

"D-Bus signal"

920

842

pass

922

844

# GotSecret - signal

923

845

@dbus.service.signal(_interface)

924

846

def GotSecret(self):

925

"""D-Bus signal

926

Is sent after a successful transfer of secret from the Mandos

927

server to mandos-client

928

"""

929

pass

847

"D-Bus signal"

848

if self.approved_pending():

849

self.PropertyChanged(dbus.String(u"checker_running"),

850

dbus.Boolean(False, variant_level=1))

930

851

931

852

# Rejected - signal

932

@dbus.service.signal(_interface, signature="s")

853

@dbus.service.signal(_interface, signature=u"s")

933

854

def Rejected(self, reason):

934

855

"D-Bus signal"

935

pass

856

if self.approved_pending():

857

self.PropertyChanged(dbus.String(u"checker_running"),

858

dbus.Boolean(False, variant_level=1))

936

859

937

860

# NeedApproval - signal

938

@dbus.service.signal(_interface, signature="tb")

861

@dbus.service.signal(_interface, signature=u"db")

939

862

def NeedApproval(self, timeout, default):

940

863

"D-Bus signal"

941

return self.need_approval()

864

if not self.approved_pending():

865

self.PropertyChanged(dbus.String(u"approved_pending"),

866

dbus.Boolean(True, variant_level=1))

942

867

943

868

## Methods

944

869

945

870

# Approve - method

946

@dbus.service.method(_interface, in_signature="b")

871

@dbus.service.method(_interface, in_signature=u"b")

947

872

def Approve(self, value):

948

873

self.approve(value)

949

874

950

875

# CheckedOK - method

951

876

@dbus.service.method(_interface)

952

877

def CheckedOK(self):

953

self.checked_ok()

878

return self.checked_ok()

954

879

955

880

# Enable - method

956

881

@dbus.service.method(_interface)

977

902

978

903

## Properties

979

904

980

# ApprovalPending - property

981

@dbus_service_property(_interface, signature="b", access="read")

982

def ApprovalPending_dbus_property(self):

983

return dbus.Boolean(bool(self.approvals_pending))

984

985

# ApprovedByDefault - property

986

@dbus_service_property(_interface, signature="b",

987

access="readwrite")

988

def ApprovedByDefault_dbus_property(self, value=None):

989

if value is None: # get

990

return dbus.Boolean(self.approved_by_default)

991

self.approved_by_default = bool(value)

992

993

# ApprovalDelay - property

994

@dbus_service_property(_interface, signature="t",

995

access="readwrite")

996

def ApprovalDelay_dbus_property(self, value=None):

997

if value is None: # get

998

return dbus.UInt64(self.approval_delay_milliseconds())

999

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1000

1001

# ApprovalDuration - property

1002

@dbus_service_property(_interface, signature="t",

1003

access="readwrite")

1004

def ApprovalDuration_dbus_property(self, value=None):

1005

if value is None: # get

1006

return dbus.UInt64(_timedelta_to_milliseconds(

1007

self.approval_duration))

1008

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1009

1010

# Name - property

1011

@dbus_service_property(_interface, signature="s", access="read")

1012

def Name_dbus_property(self):

905

# approved_pending - property

906

@dbus_service_property(_interface, signature=u"b", access=u"read")

907

def approved_pending_dbus_property(self):

908

return dbus.Boolean(self.approved_pending())

909

910

# approved_by_default - property

911

@dbus_service_property(_interface, signature=u"b",

912

access=u"readwrite")

913

def approved_by_default_dbus_property(self):

914

return dbus.Boolean(self.approved_by_default)

915

916

# approved_delay - property

917

@dbus_service_property(_interface, signature=u"t",

918

access=u"readwrite")

919

def approved_delay_dbus_property(self):

920

return dbus.UInt64(self.approved_delay_milliseconds())

921

922

# approved_duration - property

923

@dbus_service_property(_interface, signature=u"t",

924

access=u"readwrite")

925

def approved_duration_dbus_property(self):

926

return dbus.UInt64(self._timedelta_to_milliseconds(

927

self.approved_duration))

928

929

# name - property

930

@dbus_service_property(_interface, signature=u"s", access=u"read")

931

def name_dbus_property(self):

1013

932

return dbus.String(self.name)

1014

933

1015

# Fingerprint - property

1016

@dbus_service_property(_interface, signature="s", access="read")

1017

def Fingerprint_dbus_property(self):

934

# fingerprint - property

935

@dbus_service_property(_interface, signature=u"s", access=u"read")

936

def fingerprint_dbus_property(self):

1018

937

return dbus.String(self.fingerprint)

1019

938

1020

# Host - property

1021

@dbus_service_property(_interface, signature="s",

1022

access="readwrite")

1023

def Host_dbus_property(self, value=None):

939

# host - property

940

@dbus_service_property(_interface, signature=u"s",

941

access=u"readwrite")

942

def host_dbus_property(self, value=None):

1024

943

if value is None: # get

1025

944

return dbus.String(self.host)

1026

945

self.host = value

1027

1028

# Created - property

1029

@dbus_service_property(_interface, signature="s", access="read")

1030

def Created_dbus_property(self):

1031

return dbus.String(datetime_to_dbus(self.created))

1032

1033

# LastEnabled - property

1034

@dbus_service_property(_interface, signature="s", access="read")

1035

def LastEnabled_dbus_property(self):

1036

return datetime_to_dbus(self.last_enabled)

1037

1038

# Enabled - property

1039

@dbus_service_property(_interface, signature="b",

1040

access="readwrite")

1041

def Enabled_dbus_property(self, value=None):

946

# Emit D-Bus signal

947

self.PropertyChanged(dbus.String(u"host"),

948

dbus.String(value, variant_level=1))

949

950

# created - property

951

@dbus_service_property(_interface, signature=u"s", access=u"read")

952

def created_dbus_property(self):

953

return dbus.String(self._datetime_to_dbus(self.created))

954

955

# last_enabled - property

956

@dbus_service_property(_interface, signature=u"s", access=u"read")

957

def last_enabled_dbus_property(self):

958

if self.last_enabled is None:

959

return dbus.String(u"")

960

return dbus.String(self._datetime_to_dbus(self.last_enabled))

961

962

# enabled - property

963

@dbus_service_property(_interface, signature=u"b",

964

access=u"readwrite")

965

def enabled_dbus_property(self, value=None):

1042

966

if value is None: # get

1043

967

return dbus.Boolean(self.enabled)

1044

968

if value:

1046

970

else:

1047

971

self.disable()

1048

972

1049

# LastCheckedOK - property

1050

@dbus_service_property(_interface, signature="s",

1051

access="readwrite")

1052

def LastCheckedOK_dbus_property(self, value=None):

973

# last_checked_ok - property

974

@dbus_service_property(_interface, signature=u"s",

975

access=u"readwrite")

976

def last_checked_ok_dbus_property(self, value=None):

1053

977

if value is not None:

1054

978

self.checked_ok()

1055

979

return

1056

return datetime_to_dbus(self.last_checked_ok)

1057

1058

# Expires - property

1059

@dbus_service_property(_interface, signature="s", access="read")

1060

def Expires_dbus_property(self):

1061

return datetime_to_dbus(self.expires)

1062

1063

# LastApprovalRequest - property

1064

@dbus_service_property(_interface, signature="s", access="read")

1065

def LastApprovalRequest_dbus_property(self):

1066

return datetime_to_dbus(self.last_approval_request)

1067

1068

# Timeout - property

1069

@dbus_service_property(_interface, signature="t",

1070

access="readwrite")

1071

def Timeout_dbus_property(self, value=None):

980

if self.last_checked_ok is None:

981

return dbus.String(u"")

982

return dbus.String(self._datetime_to_dbus(self

983

.last_checked_ok))

984

985

# timeout - property

986

@dbus_service_property(_interface, signature=u"t",

987

access=u"readwrite")

988

def timeout_dbus_property(self, value=None):

1072

989

if value is None: # get

1073

990

return dbus.UInt64(self.timeout_milliseconds())

1074

991

self.timeout = datetime.timedelta(0, 0, 0, value)

1075

if getattr(self, "disable_initiator_tag", None) is None:

992

# Emit D-Bus signal

993

self.PropertyChanged(dbus.String(u"timeout"),

994

dbus.UInt64(value, variant_level=1))

995

if getattr(self, u"disable_initiator_tag", None) is None:

1076

996

return

1077

997

# Reschedule timeout

1078

998

gobject.source_remove(self.disable_initiator_tag)

1079

999

self.disable_initiator_tag = None

1080

self.expires = None

1081

1000

time_to_die = (self.

1082

1001

_timedelta_to_milliseconds((self

1083

1002

.last_checked_ok

1088

1007

# The timeout has passed

1089

1008

self.disable()

1090

1009

else:

1091

self.expires = (datetime.datetime.utcnow()

1092

+ datetime.timedelta(milliseconds = time_to_die))

1093

1010

self.disable_initiator_tag = (gobject.timeout_add

1094

1011

(time_to_die, self.disable))

1095

1012

1096

# ExtendedTimeout - property

1097

@dbus_service_property(_interface, signature="t",

1098

access="readwrite")

1099

def ExtendedTimeout_dbus_property(self, value=None):

1100

if value is None: # get

1101

return dbus.UInt64(self.extended_timeout_milliseconds())

1102

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1103

1104

# Interval - property

1105

@dbus_service_property(_interface, signature="t",

1106

access="readwrite")

1107

def Interval_dbus_property(self, value=None):

1013

# interval - property

1014

@dbus_service_property(_interface, signature=u"t",

1015

access=u"readwrite")

1016

def interval_dbus_property(self, value=None):

1108

1017

if value is None: # get

1109

1018

return dbus.UInt64(self.interval_milliseconds())

1110

1019

self.interval = datetime.timedelta(0, 0, 0, value)

1111

if getattr(self, "checker_initiator_tag", None) is None:

1020

# Emit D-Bus signal

1021

self.PropertyChanged(dbus.String(u"interval"),

1022

dbus.UInt64(value, variant_level=1))

1023

if getattr(self, u"checker_initiator_tag", None) is None:

1112

1024

return

1113

1025

# Reschedule checker run

1114

1026

gobject.source_remove(self.checker_initiator_tag)

1115

1027

self.checker_initiator_tag = (gobject.timeout_add

1116

1028

(value, self.start_checker))

1117

1029

self.start_checker() # Start one now, too

1118

1119

# Checker - property

1120

@dbus_service_property(_interface, signature="s",

1121

access="readwrite")

1122

def Checker_dbus_property(self, value=None):

1030

1031

# checker - property

1032

@dbus_service_property(_interface, signature=u"s",

1033

access=u"readwrite")

1034

def checker_dbus_property(self, value=None):

1123

1035

if value is None: # get

1124

1036

return dbus.String(self.checker_command)

1125

1037

self.checker_command = value

1038

# Emit D-Bus signal

1039

self.PropertyChanged(dbus.String(u"checker"),

1040

dbus.String(self.checker_command,

1041

variant_level=1))

1126

1042

1127

# CheckerRunning - property

1128

@dbus_service_property(_interface, signature="b",

1129

access="readwrite")

1130

def CheckerRunning_dbus_property(self, value=None):

1043

# checker_running - property

1044

@dbus_service_property(_interface, signature=u"b",

1045

access=u"readwrite")

1046

def checker_running_dbus_property(self, value=None):

1131

1047

if value is None: # get

1132

1048

return dbus.Boolean(self.checker is not None)

1133

1049

if value:

1135

1051

else:

1136

1052

self.stop_checker()

1137

1053

1138

# ObjectPath - property

1139

@dbus_service_property(_interface, signature="o", access="read")

1140

def ObjectPath_dbus_property(self):

1054

# object_path - property

1055

@dbus_service_property(_interface, signature=u"o", access=u"read")

1056

def object_path_dbus_property(self):

1141

1057

return self.dbus_object_path # is already a dbus.ObjectPath

1142

1058

1143

# Secret = property

1144

@dbus_service_property(_interface, signature="ay",

1145

access="write", byte_arrays=True)

1146

def Secret_dbus_property(self, value):

1059

# secret = property

1060

@dbus_service_property(_interface, signature=u"ay",

1061

access=u"write", byte_arrays=True)

1062

def secret_dbus_property(self, value):

1147

1063

self.secret = str(value)

1148

1064

1149

1065

del _interface

1155

1071

self._pipe.send(('init', fpr, address))

1156

1072

if not self._pipe.recv():

1157

1073

raise KeyError()

1158

1074

1159

1075

def __getattribute__(self, name):

1160

1076

if(name == '_pipe'):

1161

1077

return super(ProxyClient, self).__getattribute__(name)

1168

1084

self._pipe.send(('funcall', name, args, kwargs))

1169

1085

return self._pipe.recv()[1]

1170

1086

return func

1171

1087

1172

1088

def __setattr__(self, name, value):

1173

1089

if(name == '_pipe'):

1174

1090

return super(ProxyClient, self).__setattr__(name, value)

1183

1099

1184

1100

def handle(self):

1185

1101

with contextlib.closing(self.server.child_pipe) as child_pipe:

1186

logger.info("TCP connection from: %s",

1102

logger.info(u"TCP connection from: %s",

1187

1103

unicode(self.client_address))

1188

logger.debug("Pipe FD: %d",

1104

logger.debug(u"Pipe FD: %d",

1189

1105

self.server.child_pipe.fileno())

1190

1106

1191

1107

session = (gnutls.connection

1192

1108

.ClientSession(self.request,

1193

1109

gnutls.connection

1194

1110

.X509Credentials()))

1195

1111

1196

1112

# Note: gnutls.connection.X509Credentials is really a

1197

1113

# generic GnuTLS certificate credentials object so long as

1198

1114

# no X.509 keys are added to it. Therefore, we can use it

1199

1115

# here despite using OpenPGP certificates.

1200

1201

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1202

# "+AES-256-CBC", "+SHA1",

1203

# "+COMP-NULL", "+CTYPE-OPENPGP",

1204

# "+DHE-DSS"))

1116

1117

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1118

# u"+AES-256-CBC", u"+SHA1",

1119

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1120

# u"+DHE-DSS"))

1205

1121

# Use a fallback default, since this MUST be set.

1206

1122

priority = self.server.gnutls_priority

1207

1123

if priority is None:

1208

priority = "NORMAL"

1124

priority = u"NORMAL"

1209

1125

(gnutls.library.functions

1210

1126

.gnutls_priority_set_direct(session._c_object,

1211

1127

priority, None))

1212

1128

1213

1129

# Start communication using the Mandos protocol

1214

1130

# Get protocol number

1215

1131

line = self.request.makefile().readline()

1216

logger.debug("Protocol version: %r", line)

1132

logger.debug(u"Protocol version: %r", line)

1217

1133

try:

1218

1134

if int(line.strip().split()[0]) > 1:

1219

1135

raise RuntimeError

1220

except (ValueError, IndexError, RuntimeError) as error:

1221

logger.error("Unknown protocol version: %s", error)

1136

except (ValueError, IndexError, RuntimeError), error:

1137

logger.error(u"Unknown protocol version: %s", error)

1222

1138

return

1223

1139

1224

1140

# Start GnuTLS connection

1225

1141

try:

1226

1142

session.handshake()

1227

except gnutls.errors.GNUTLSError as error:

1228

logger.warning("Handshake failed: %s", error)

1143

except gnutls.errors.GNUTLSError, error:

1144

logger.warning(u"Handshake failed: %s", error)

1229

1145

# Do not run session.bye() here: the session is not

1230

1146

# established. Just abandon the request.

1231

1147

return

1232

logger.debug("Handshake succeeded")

1233

1148

logger.debug(u"Handshake succeeded")

1149

1234

1150

approval_required = False

1235

1151

try:

1236

1152

try:

1237

1153

fpr = self.fingerprint(self.peer_certificate

1238

1154

(session))

1239

except (TypeError,

1240

gnutls.errors.GNUTLSError) as error:

1241

logger.warning("Bad certificate: %s", error)

1155

except (TypeError, gnutls.errors.GNUTLSError), error:

1156

logger.warning(u"Bad certificate: %s", error)

1242

1157

return

1243

logger.debug("Fingerprint: %s", fpr)

1244

1158

logger.debug(u"Fingerprint: %s", fpr)

1159

1245

1160

try:

1246

1161

client = ProxyClient(child_pipe, fpr,

1247

1162

self.client_address)

1248

1163

except KeyError:

1249

1164

return

1250

1165

1251

if client.approval_delay:

1252

delay = client.approval_delay

1166

if client.approved_delay:

1167

delay = client.approved_delay

1253

1168

client.approvals_pending += 1

1254

1169

approval_required = True

1255

1170

1256

1171

while True:

1257

1172

if not client.enabled:

1258

logger.info("Client %s is disabled",

1173

logger.warning(u"Client %s is disabled",

1259

1174

client.name)

1260

1175

if self.server.use_dbus:

1261

1176

# Emit D-Bus signal

1262

1177

client.Rejected("Disabled")

1263

1178

return

1264

1179

1265

if client._approved or not client.approval_delay:

1180

if client._approved or not client.approved_delay:

1266

1181

#We are approved or approval is disabled

1267

1182

break

1268

1183

elif client._approved is None:

1269

logger.info("Client %s needs approval",

1184

logger.info(u"Client %s need approval",

1270

1185

client.name)

1271

1186

if self.server.use_dbus:

1272

1187

# Emit D-Bus signal

1273

1188

client.NeedApproval(

1274

client.approval_delay_milliseconds(),

1189

client.approved_delay_milliseconds(),

1275

1190

client.approved_by_default)

1276

1191

else:

1277

logger.warning("Client %s was not approved",

1192

logger.warning(u"Client %s was not approved",

1278

1193

client.name)

1279

1194

if self.server.use_dbus:

1280

1195

# Emit D-Bus signal

1281

client.Rejected("Denied")

1196

client.Rejected("Disapproved")

1282

1197

return

1283

1198

1284

1199

#wait until timeout or approved

1295

1210

client.name)

1296

1211

if self.server.use_dbus:

1297

1212

# Emit D-Bus signal

1298

client.Rejected("Approval timed out")

1213

client.Rejected("Time out")

1299

1214

return

1300

1215

else:

1301

1216

break

1304

1219

1305

1220

sent_size = 0

1306

1221

while sent_size < len(client.secret):

1307

try:

1308

sent = session.send(client.secret[sent_size:])

1309

except gnutls.errors.GNUTLSError as error:

1310

logger.warning("gnutls send failed")

1311

return

1312

logger.debug("Sent: %d, remaining: %d",

1222

# XXX handle session exception

1223

sent = session.send(client.secret[sent_size:])

1224

logger.debug(u"Sent: %d, remaining: %d",

1313

1225

sent, len(client.secret)

1314

1226

- (sent_size + sent))

1315

1227

sent_size += sent

1316

1317

logger.info("Sending secret to %s", client.name)

1228

1229

logger.info(u"Sending secret to %s", client.name)

1318

1230

# bump the timeout as if seen

1319

client.checked_ok(client.extended_timeout)

1231

client.checked_ok()

1320

1232

if self.server.use_dbus:

1321

1233

# Emit D-Bus signal

1322

1234

client.GotSecret()

1324

1236

finally:

1325

1237

if approval_required:

1326

1238

client.approvals_pending -= 1

1327

try:

1328

session.bye()

1329

except gnutls.errors.GNUTLSError as error:

1330

logger.warning("GnuTLS bye failed")

1239

session.bye()

1331

1240

1332

1241

@staticmethod

1333

1242

def peer_certificate(session):

1343

1252

.gnutls_certificate_get_peers

1344

1253

(session._c_object, ctypes.byref(list_size)))

1345

1254

if not bool(cert_list) and list_size.value != 0:

1346

raise gnutls.errors.GNUTLSError("error getting peer"

1347

" certificate")

1255

raise gnutls.errors.GNUTLSError(u"error getting peer"

1256

u" certificate")

1348

1257

if list_size.value == 0:

1349

1258

return None

1350

1259

cert = cert_list[0]

1376

1285

if crtverify.value != 0:

1377

1286

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1378

1287

raise (gnutls.errors.CertificateSecurityError

1379

("Verify failed"))

1288

(u"Verify failed"))

1380

1289

# New buffer for the fingerprint

1381

1290

buf = ctypes.create_string_buffer(20)

1382

1291

buf_len = ctypes.c_size_t()

1389

1298

# Convert the buffer to a Python bytestring

1390

1299

fpr = ctypes.string_at(buf, buf_len.value)

1391

1300

# Convert the bytestring to hexadecimal notation

1392

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1301

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1393

1302

return hex_fpr

1394

1303

1395

1304

1407

1316

multiprocessing.Process(target = self.sub_process_main,

1408

1317

args = (request, address)).start()

1409

1318

1410

1411

1319

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1412

1320

""" adds a pipe to the MixIn """

1413

1321

def process_request(self, request, client_address):

1416

1324

This function creates a new pipe in self.pipe

1417

1325

"""

1418

1326

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1419

1327

1420

1328

super(MultiprocessingMixInWithPipe,

1421

1329

self).process_request(request, client_address)

1422

self.child_pipe.close()

1423

1330

self.add_pipe(parent_pipe)

1424

1425

1331

def add_pipe(self, parent_pipe):

1426

1332

"""Dummy function; override as necessary"""

1427

raise NotImplementedError

1428

1333

pass

1429

1334

1430

1335

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1431

1336

socketserver.TCPServer, object):

1449

1354

bind to an address or port if they were not specified."""

1450

1355

if self.interface is not None:

1451

1356

if SO_BINDTODEVICE is None:

1452

logger.error("SO_BINDTODEVICE does not exist;"

1453

" cannot bind to interface %s",

1357

logger.error(u"SO_BINDTODEVICE does not exist;"

1358

u" cannot bind to interface %s",

1454

1359

self.interface)

1455

1360

else:

1456

1361

try:

1457

1362

self.socket.setsockopt(socket.SOL_SOCKET,

1458

1363

SO_BINDTODEVICE,

1459

1364

str(self.interface

1460

+ '\0'))

1461

except socket.error as error:

1365

+ u'\0'))

1366

except socket.error, error:

1462

1367

if error[0] == errno.EPERM:

1463

logger.error("No permission to"

1464

" bind to interface %s",

1368

logger.error(u"No permission to"

1369

u" bind to interface %s",

1465

1370

self.interface)

1466

1371

elif error[0] == errno.ENOPROTOOPT:

1467

logger.error("SO_BINDTODEVICE not available;"

1468

" cannot bind to interface %s",

1372

logger.error(u"SO_BINDTODEVICE not available;"

1373

u" cannot bind to interface %s",

1469

1374

self.interface)

1470

1375

else:

1471

1376

raise

1473

1378

if self.server_address[0] or self.server_address[1]:

1474

1379

if not self.server_address[0]:

1475

1380

if self.address_family == socket.AF_INET6:

1476

any_address = "::" # in6addr_any

1381

any_address = u"::" # in6addr_any

1477

1382

else:

1478

1383

any_address = socket.INADDR_ANY

1479

1384

self.server_address = (any_address,

1528

1433

def handle_ipc(self, source, condition, parent_pipe=None,

1529

1434

client_object=None):

1530

1435

condition_names = {

1531

gobject.IO_IN: "IN", # There is data to read.

1532

gobject.IO_OUT: "OUT", # Data can be written (without

1436

gobject.IO_IN: u"IN", # There is data to read.

1437

gobject.IO_OUT: u"OUT", # Data can be written (without

1533

1438

# blocking).

1534

gobject.IO_PRI: "PRI", # There is urgent data to read.

1535

gobject.IO_ERR: "ERR", # Error condition.

1536

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1439

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1440

gobject.IO_ERR: u"ERR", # Error condition.

1441

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1537

1442

# broken, usually for pipes and

1538

1443

# sockets).

1539

1444

}

1541

1446

for cond, name in

1542

1447

condition_names.iteritems()

1543

1448

if cond & condition)

1544

# error or the other end of multiprocessing.Pipe has closed

1545

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1546

return False

1449

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1450

conditions_string)

1547

1451

1548

1452

# Read a request from the child

1549

1453

request = parent_pipe.recv()

1558

1462

client = c

1559

1463

break

1560

1464

else:

1561

logger.info("Client not found for fingerprint: %s, ad"

1562

"dress: %s", fpr, address)

1465

logger.warning(u"Client not found for fingerprint: %s, ad"

1466

u"dress: %s", fpr, address)

1563

1467

if self.use_dbus:

1564

1468

# Emit D-Bus signal

1565

mandos_dbus_service.ClientNotFound(fpr, address[0])

1469

mandos_dbus_service.ClientNotFound(fpr, address)

1566

1470

parent_pipe.send(False)

1567

1471

return False

1568

1472

1580

1484

kwargs = request[3]

1581

1485

1582

1486

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1583

1487

1584

1488

if command == 'getattr':

1585

1489

attrname = request[1]

1586

1490

if callable(client_object.__getattribute__(attrname)):

1587

1491

parent_pipe.send(('function',))

1588

1492

else:

1589

1493

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1590

1494

1591

1495

if command == 'setattr':

1592

1496

attrname = request[1]

1593

1497

value = request[2]

1594

1498

setattr(client_object, attrname, value)

1595

1499

1596

1500

return True

1597

1501

1598

1502

1599

1503

def string_to_delta(interval):

1600

1504

"""Parse a string and return a datetime.timedelta

1601

1505

1602

>>> string_to_delta('7d')

1506

>>> string_to_delta(u'7d')

1603

1507

datetime.timedelta(7)

1604

>>> string_to_delta('60s')

1508

>>> string_to_delta(u'60s')

1605

1509

datetime.timedelta(0, 60)

1606

>>> string_to_delta('60m')

1510

>>> string_to_delta(u'60m')

1607

1511

datetime.timedelta(0, 3600)

1608

>>> string_to_delta('24h')

1512

>>> string_to_delta(u'24h')

1609

1513

datetime.timedelta(1)

1610

>>> string_to_delta('1w')

1514

>>> string_to_delta(u'1w')

1611

1515

datetime.timedelta(7)

1612

>>> string_to_delta('5m 30s')

1516

>>> string_to_delta(u'5m 30s')

1613

1517

datetime.timedelta(0, 330)

1614

1518

"""

1615

1519

timevalue = datetime.timedelta(0)

1617

1521

try:

1618

1522

suffix = unicode(s[-1])

1619

1523

value = int(s[:-1])

1620

if suffix == "d":

1524

if suffix == u"d":

1621

1525

delta = datetime.timedelta(value)

1622

elif suffix == "s":

1526

elif suffix == u"s":

1623

1527

delta = datetime.timedelta(0, value)

1624

elif suffix == "m":

1528

elif suffix == u"m":

1625

1529

delta = datetime.timedelta(0, 0, 0, 0, value)

1626

elif suffix == "h":

1530

elif suffix == u"h":

1627

1531

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1628

elif suffix == "w":

1532

elif suffix == u"w":

1629

1533

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1630

1534

else:

1631

raise ValueError("Unknown suffix %r" % suffix)

1632

except (ValueError, IndexError) as e:

1633

raise ValueError(*(e.args))

1535

raise ValueError(u"Unknown suffix %r" % suffix)

1536

except (ValueError, IndexError), e:

1537

raise ValueError(e.message)

1634

1538

timevalue += delta

1635

1539

return timevalue

1636

1540

1642

1546

global if_nametoindex

1643

1547

try:

1644

1548

if_nametoindex = (ctypes.cdll.LoadLibrary

1645

(ctypes.util.find_library("c"))

1549

(ctypes.util.find_library(u"c"))

1646

1550

.if_nametoindex)

1647

1551

except (OSError, AttributeError):

1648

logger.warning("Doing if_nametoindex the hard way")

1552

logger.warning(u"Doing if_nametoindex the hard way")

1649

1553

def if_nametoindex(interface):

1650

1554

"Get an interface index the hard way, i.e. using fcntl()"

1651

1555

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1652

1556

with contextlib.closing(socket.socket()) as s:

1653

1557

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1654

struct.pack(str("16s16x"),

1558

struct.pack(str(u"16s16x"),

1655

1559

interface))

1656

interface_index = struct.unpack(str("I"),

1560

interface_index = struct.unpack(str(u"I"),

1657

1561

ifreq[16:20])[0]

1658

1562

return interface_index

1659

1563

return if_nametoindex(interface)

1667

1571

sys.exit()

1668

1572

os.setsid()

1669

1573

if not nochdir:

1670

os.chdir("/")

1574

os.chdir(u"/")

1671

1575

if os.fork():

1672

1576

sys.exit()

1673

1577

if not noclose:

1675

1579

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1676

1580

if not stat.S_ISCHR(os.fstat(null).st_mode):

1677

1581

raise OSError(errno.ENODEV,

1678

"%s not a character device"

1582

u"%s not a character device"

1679

1583

% os.path.devnull)

1680

1584

os.dup2(null, sys.stdin.fileno())

1681

1585

os.dup2(null, sys.stdout.fileno())

1689

1593

##################################################################

1690

1594

# Parsing of options, both command line and config file

1691

1595

1692

parser = argparse.ArgumentParser()

1693

parser.add_argument("-v", "--version", action="version",

1694

version = "%%(prog)s %s" % version,

1695

help="show version number and exit")

1696

parser.add_argument("-i", "--interface", metavar="IF",

1697

help="Bind to interface IF")

1698

parser.add_argument("-a", "--address",

1699

help="Address to listen for requests on")

1700

parser.add_argument("-p", "--port", type=int,

1701

help="Port number to receive requests on")

1702

parser.add_argument("--check", action="store_true",

1703

help="Run self-test")

1704

parser.add_argument("--debug", action="store_true",

1705

help="Debug mode; run in foreground and log"

1706

" to terminal")

1707

parser.add_argument("--debuglevel", metavar="LEVEL",

1708

help="Debug level for stdout output")

1709

parser.add_argument("--priority", help="GnuTLS"

1710

" priority string (see GnuTLS documentation)")

1711

parser.add_argument("--servicename",

1712

metavar="NAME", help="Zeroconf service name")

1713

parser.add_argument("--configdir",

1714

default="/etc/mandos", metavar="DIR",

1715

help="Directory to search for configuration"

1716

" files")

1717

parser.add_argument("--no-dbus", action="store_false",

1718

dest="use_dbus", help="Do not provide D-Bus"

1719

" system bus interface")

1720

parser.add_argument("--no-ipv6", action="store_false",

1721

dest="use_ipv6", help="Do not use IPv6")

1722

options = parser.parse_args()

1596

parser = optparse.OptionParser(version = "%%prog %s" % version)

1597

parser.add_option("-i", u"--interface", type=u"string",

1598

metavar="IF", help=u"Bind to interface IF")

1599

parser.add_option("-a", u"--address", type=u"string",

1600

help=u"Address to listen for requests on")

1601

parser.add_option("-p", u"--port", type=u"int",

1602

help=u"Port number to receive requests on")

1603

parser.add_option("--check", action=u"store_true",

1604

help=u"Run self-test")

1605

parser.add_option("--debug", action=u"store_true",

1606

help=u"Debug mode; run in foreground and log to"

1607

u" terminal")

1608

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1609

u" priority string (see GnuTLS documentation)")

1610

parser.add_option("--servicename", type=u"string",

1611

metavar=u"NAME", help=u"Zeroconf service name")

1612

parser.add_option("--configdir", type=u"string",

1613

default=u"/etc/mandos", metavar=u"DIR",

1614

help=u"Directory to search for configuration"

1615

u" files")

1616

parser.add_option("--no-dbus", action=u"store_false",

1617

dest=u"use_dbus", help=u"Do not provide D-Bus"

1618

u" system bus interface")

1619

parser.add_option("--no-ipv6", action=u"store_false",

1620

dest=u"use_ipv6", help=u"Do not use IPv6")

1621

options = parser.parse_args()[0]

1723

1622

1724

1623

if options.check:

1725

1624

import doctest

1727

1626

sys.exit()

1728

1627

1729

1628

# Default values for config file for server-global settings

1730

server_defaults = { "interface": "",

1731

"address": "",

1732

"port": "",

1733

"debug": "False",

1734

"priority":

1735

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1736

"servicename": "Mandos",

1737

"use_dbus": "True",

1738

"use_ipv6": "True",

1739

"debuglevel": "",

1629

server_defaults = { u"interface": u"",

1630

u"address": u"",

1631

u"port": u"",

1632

u"debug": u"False",

1633

u"priority":

1634

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1635

u"servicename": u"Mandos",

1636

u"use_dbus": u"True",

1637

u"use_ipv6": u"True",

1740

1638

}

1741

1639

1742

1640

# Parse config file for server-global settings

1743

1641

server_config = configparser.SafeConfigParser(server_defaults)

1744

1642

del server_defaults

1745

1643

server_config.read(os.path.join(options.configdir,

1746

"mandos.conf"))

1644

u"mandos.conf"))

1747

1645

# Convert the SafeConfigParser object to a dict

1748

1646

server_settings = server_config.defaults()

1749

1647

# Use the appropriate methods on the non-string config options

1750

for option in ("debug", "use_dbus", "use_ipv6"):

1751

server_settings[option] = server_config.getboolean("DEFAULT",

1648

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1649

server_settings[option] = server_config.getboolean(u"DEFAULT",

1752

1650

option)

1753

1651

if server_settings["port"]:

1754

server_settings["port"] = server_config.getint("DEFAULT",

1755

"port")

1652

server_settings["port"] = server_config.getint(u"DEFAULT",

1653

u"port")

1756

1654

del server_config

1757

1655

1758

1656

# Override the settings from the config file with command line

1759

1657

# options, if set.

1760

for option in ("interface", "address", "port", "debug",

1761

"priority", "servicename", "configdir",

1762

"use_dbus", "use_ipv6", "debuglevel"):

1658

for option in (u"interface", u"address", u"port", u"debug",

1659

u"priority", u"servicename", u"configdir",

1660

u"use_dbus", u"use_ipv6"):

1763

1661

value = getattr(options, option)

1764

1662

if value is not None:

1765

1663

server_settings[option] = value

1773

1671

##################################################################

1774

1672

1775

1673

# For convenience

1776

debug = server_settings["debug"]

1777

debuglevel = server_settings["debuglevel"]

1778

use_dbus = server_settings["use_dbus"]

1779

use_ipv6 = server_settings["use_ipv6"]

1780

1781

if server_settings["servicename"] != "Mandos":

1674

debug = server_settings[u"debug"]

1675

use_dbus = server_settings[u"use_dbus"]

1676

use_ipv6 = server_settings[u"use_ipv6"]

1677

1678

if not debug:

1679

syslogger.setLevel(logging.WARNING)

1680

console.setLevel(logging.WARNING)

1681

1682

if server_settings[u"servicename"] != u"Mandos":

1782

1683

syslogger.setFormatter(logging.Formatter

1783

('Mandos (%s) [%%(process)d]:'

1784

' %%(levelname)s: %%(message)s'

1785

% server_settings["servicename"]))

1684

(u'Mandos (%s) [%%(process)d]:'

1685

u' %%(levelname)s: %%(message)s'

1686

% server_settings[u"servicename"]))

1786

1687

1787

1688

# Parse config file with clients

1788

client_defaults = { "timeout": "5m",

1789

"extended_timeout": "15m",

1790

"interval": "2m",

1791

"checker": "fping -q -- %%(host)s",

1792

"host": "",

1793

"approval_delay": "0s",

1794

"approval_duration": "1s",

1689

client_defaults = { u"timeout": u"1h",

1690

u"interval": u"5m",

1691

u"checker": u"fping -q -- %%(host)s",

1692

u"host": u"",

1693

u"approved_delay": u"0s",

1694

u"approved_duration": u"1s",

1795

1695

}

1796

1696

client_config = configparser.SafeConfigParser(client_defaults)

1797

client_config.read(os.path.join(server_settings["configdir"],

1798

"clients.conf"))

1697

client_config.read(os.path.join(server_settings[u"configdir"],

1698

u"clients.conf"))

1799

1699

1800

1700

global mandos_dbus_service

1801

1701

mandos_dbus_service = None

1802

1702

1803

tcp_server = MandosServer((server_settings["address"],

1804

server_settings["port"]),

1703

tcp_server = MandosServer((server_settings[u"address"],

1704

server_settings[u"port"]),

1805

1705

ClientHandler,

1806

interface=(server_settings["interface"]

1807

or None),

1706

interface=server_settings[u"interface"],

1808

1707

use_ipv6=use_ipv6,

1809

1708

gnutls_priority=

1810

server_settings["priority"],

1709

server_settings[u"priority"],

1811

1710

use_dbus=use_dbus)

1812

if not debug:

1813

pidfilename = "/var/run/mandos.pid"

1814

try:

1815

pidfile = open(pidfilename, "w")

1816

except IOError:

1817

logger.error("Could not open file %r", pidfilename)

1711

pidfilename = u"/var/run/mandos.pid"

1712

try:

1713

pidfile = open(pidfilename, u"w")

1714

except IOError:

1715

logger.error(u"Could not open file %r", pidfilename)

1818

1716

1819

1717

try:

1820

uid = pwd.getpwnam("_mandos").pw_uid

1821

gid = pwd.getpwnam("_mandos").pw_gid

1718

uid = pwd.getpwnam(u"_mandos").pw_uid

1719

gid = pwd.getpwnam(u"_mandos").pw_gid

1822

1720

except KeyError:

1823

1721

try:

1824

uid = pwd.getpwnam("mandos").pw_uid

1825

gid = pwd.getpwnam("mandos").pw_gid

1722

uid = pwd.getpwnam(u"mandos").pw_uid

1723

gid = pwd.getpwnam(u"mandos").pw_gid

1826

1724

except KeyError:

1827

1725

try:

1828

uid = pwd.getpwnam("nobody").pw_uid

1829

gid = pwd.getpwnam("nobody").pw_gid

1726

uid = pwd.getpwnam(u"nobody").pw_uid

1727

gid = pwd.getpwnam(u"nobody").pw_gid

1830

1728

except KeyError:

1831

1729

uid = 65534

1832

1730

gid = 65534

1833

1731

try:

1834

1732

os.setgid(gid)

1835

1733

os.setuid(uid)

1836

except OSError as error:

1734

except OSError, error:

1837

1735

if error[0] != errno.EPERM:

1838

1736

raise error

1839

1737

1840

if not debug and not debuglevel:

1841

syslogger.setLevel(logging.WARNING)

1842

console.setLevel(logging.WARNING)

1843

if debuglevel:

1844

level = getattr(logging, debuglevel.upper())

1845

syslogger.setLevel(level)

1846

console.setLevel(level)

1847

1738

# Enable all possible GnuTLS debugging

1848

1739

if debug:

1849

# Enable all possible GnuTLS debugging

1850

1851

1740

# "Use a log level over 10 to enable all debugging options."

1852

1741

# - GnuTLS manual

1853

1742

gnutls.library.functions.gnutls_global_set_log_level(11)

1854

1743

1855

1744

@gnutls.library.types.gnutls_log_func

1856

1745

def debug_gnutls(level, string):

1857

logger.debug("GnuTLS: %s", string[:-1])

1746

logger.debug(u"GnuTLS: %s", string[:-1])

1858

1747

1859

1748

(gnutls.library.functions

1860

1749

.gnutls_global_set_log_function(debug_gnutls))

1861

1862

# Redirect stdin so all checkers get /dev/null

1863

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1864

os.dup2(null, sys.stdin.fileno())

1865

if null > 2:

1866

os.close(null)

1867

else:

1868

# No console logging

1869

logger.removeHandler(console)

1870

1871

# Need to fork before connecting to D-Bus

1872

if not debug:

1873

# Close all input and output, do double fork, etc.

1874

daemon()

1875

1750

1876

1751

global main_loop

1877

1752

# From the Avahi example code

1881

1756

# End of Avahi example code

1882

1757

if use_dbus:

1883

1758

try:

1884

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1759

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1885

1760

bus, do_not_queue=True)

1886

except dbus.exceptions.NameExistsException as e:

1887

logger.error(unicode(e) + ", disabling D-Bus")

1761

except dbus.exceptions.NameExistsException, e:

1762

logger.error(unicode(e) + u", disabling D-Bus")

1888

1763

use_dbus = False

1889

server_settings["use_dbus"] = False

1764

server_settings[u"use_dbus"] = False

1890

1765

tcp_server.use_dbus = False

1891

1766

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1892

service = AvahiService(name = server_settings["servicename"],

1893

servicetype = "_mandos._tcp",

1767

service = AvahiService(name = server_settings[u"servicename"],

1768

servicetype = u"_mandos._tcp",

1894

1769

protocol = protocol, bus = bus)

1895

1770

if server_settings["interface"]:

1896

1771

service.interface = (if_nametoindex

1897

(str(server_settings["interface"])))

1898

1899

global multiprocessing_manager

1900

multiprocessing_manager = multiprocessing.Manager()

1772

(str(server_settings[u"interface"])))

1901

1773

1902

1774

client_class = Client

1903

1775

if use_dbus:

1920

1792

client_config, section)))

1921

1793

for section in client_config.sections()))

1922

1794

if not tcp_server.clients:

1923

logger.warning("No clients defined")

1924

1795

logger.warning(u"No clients defined")

1796

1797

if debug:

1798

# Redirect stdin so all checkers get /dev/null

1799

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1800

os.dup2(null, sys.stdin.fileno())

1801

if null > 2:

1802

os.close(null)

1803

else:

1804

# No console logging

1805

logger.removeHandler(console)

1806

# Close all input and output, do double fork, etc.

1807

daemon()

1808

1809

try:

1810

with pidfile:

1811

pid = os.getpid()

1812

pidfile.write(str(pid) + "\n")

1813

del pidfile

1814

except IOError:

1815

logger.error(u"Could not write to file %r with PID %d",

1816

pidfilename, pid)

1817

except NameError:

1818

# "pidfile" was never created

1819

pass

1820

del pidfilename

1821

1925

1822

if not debug:

1926

try:

1927

with pidfile:

1928

pid = os.getpid()

1929

pidfile.write(str(pid) + "\n".encode("utf-8"))

1930

del pidfile

1931

except IOError:

1932

logger.error("Could not write to file %r with PID %d",

1933

pidfilename, pid)

1934

except NameError:

1935

# "pidfile" was never created

1936

pass

1937

del pidfilename

1938

1939

1823

signal.signal(signal.SIGINT, signal.SIG_IGN)

1940

1941

1824

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1942

1825

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1943

1826

1945

1828

class MandosDBusService(dbus.service.Object):

1946

1829

"""A D-Bus proxy object"""

1947

1830

def __init__(self):

1948

dbus.service.Object.__init__(self, bus, "/")

1949

_interface = "se.bsnet.fukt.Mandos"

1831

dbus.service.Object.__init__(self, bus, u"/")

1832

_interface = u"se.bsnet.fukt.Mandos"

1950

1833

1951

@dbus.service.signal(_interface, signature="o")

1834

@dbus.service.signal(_interface, signature=u"o")

1952

1835

def ClientAdded(self, objpath):

1953

1836

"D-Bus signal"

1954

1837

pass

1955

1838

1956

@dbus.service.signal(_interface, signature="ss")

1839

@dbus.service.signal(_interface, signature=u"ss")

1957

1840

def ClientNotFound(self, fingerprint, address):

1958

1841

"D-Bus signal"

1959

1842

pass

1960

1843

1961

@dbus.service.signal(_interface, signature="os")

1844

@dbus.service.signal(_interface, signature=u"os")

1962

1845

def ClientRemoved(self, objpath, name):

1963

1846

"D-Bus signal"

1964

1847

pass

1965

1848

1966

@dbus.service.method(_interface, out_signature="ao")

1849

@dbus.service.method(_interface, out_signature=u"ao")

1967

1850

def GetAllClients(self):

1968

1851

"D-Bus method"

1969

1852

return dbus.Array(c.dbus_object_path

1970

1853

for c in tcp_server.clients)

1971

1854

1972

1855

@dbus.service.method(_interface,

1973

out_signature="a{oa{sv}}")

1856

out_signature=u"a{oa{sv}}")

1974

1857

def GetAllClientsWithProperties(self):

1975

1858

"D-Bus method"

1976

1859

return dbus.Dictionary(

1977

((c.dbus_object_path, c.GetAll(""))

1860

((c.dbus_object_path, c.GetAll(u""))

1978

1861

for c in tcp_server.clients),

1979

signature="oa{sv}")

1862

signature=u"oa{sv}")

1980

1863

1981

@dbus.service.method(_interface, in_signature="o")

1864

@dbus.service.method(_interface, in_signature=u"o")

1982

1865

def RemoveClient(self, object_path):

1983

1866

"D-Bus method"

1984

1867

for c in tcp_server.clients:

2026

1909

# Find out what port we got

2027

1910

service.port = tcp_server.socket.getsockname()[1]

2028

1911

if use_ipv6:

2029

logger.info("Now listening on address %r, port %d,"

1912

logger.info(u"Now listening on address %r, port %d,"

2030

1913

" flowinfo %d, scope_id %d"

2031

1914

% tcp_server.socket.getsockname())

2032

1915

else: # IPv4

2033

logger.info("Now listening on address %r, port %d"

1916

logger.info(u"Now listening on address %r, port %d"

2034

1917

% tcp_server.socket.getsockname())

2035

1918

2036

1919

#service.interface = tcp_server.socket.getsockname()[3]

2039

1922

# From the Avahi example code

2040

1923

try:

2041

1924

service.activate()

2042

except dbus.exceptions.DBusException as error:

2043

logger.critical("DBusException: %s", error)

1925

except dbus.exceptions.DBusException, error:

1926

logger.critical(u"DBusException: %s", error)

2044

1927

cleanup()

2045

1928

sys.exit(1)

2046

1929

# End of Avahi example code

2050

1933

(tcp_server.handle_request

2051

1934

(*args[2:], **kwargs) or True))

2052

1935

2053

logger.debug("Starting main loop")

1936

logger.debug(u"Starting main loop")

2054

1937

main_loop.run()

2055

except AvahiError as error:

2056

logger.critical("AvahiError: %s", error)

1938

except AvahiError, error:

1939

logger.critical(u"AvahiError: %s", error)

2057

1940

cleanup()

2058

1941

sys.exit(1)

2059

1942

except KeyboardInterrupt:

2060

1943

if debug:

2061

print("", file=sys.stderr)

2062

logger.debug("Server received KeyboardInterrupt")

2063

logger.debug("Server exiting")

1944

print >> sys.stderr

1945

logger.debug(u"Server received KeyboardInterrupt")

1946

logger.debug(u"Server exiting")

2064

1947

# Must run before the D-Bus bus name gets deregistered

2065

1948

cleanup()

2066

1949

2067

2068

1950

if __name__ == '__main__':

2069

1951

main()