/mandos/trunk : revision 416.1.2

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

61

60

import fcntl

62

61

import functools

63

62

import cPickle as pickle

64

import multiprocessing

63

import select

65

64

66

65

import dbus

67

66

import dbus.service

82

81

SO_BINDTODEVICE = None

83

82

84

83

85

version = "1.3.1"

84

version = "1.0.14"

86

85

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

86

logger = logging.Logger(u'mandos')

89

87

syslogger = (logging.handlers.SysLogHandler

90

88

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

address = str("/dev/log")))

89

address = "/dev/log"))

92

90

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

91

(u'Mandos [%(process)d]: %(levelname)s:'

92

u' %(message)s'))

95

93

logger.addHandler(syslogger)

96

94

97

95

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

96

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

97

u' %(levelname)s:'

98

u' %(message)s'))

101

99

logger.addHandler(console)

102

100

103

101

class AvahiError(Exception):

120

118

Attributes:

121

119

interface: integer; avahi.IF_UNSPEC or an interface index.

122

120

Used to optionally bind to the specified interface.

123

124

type: string; Example: '_mandos._tcp'.

121

122

type: string; Example: u'_mandos._tcp'.

125

123

See <http://www.dns-sd.org/ServiceTypes.html>

126

124

port: integer; what port to announce

127

125

TXT: list of strings; TXT record for the service

136

134

"""

137

135

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

138

136

servicetype = None, port = None, TXT = None,

139

domain = "", host = "", max_renames = 32768,

137

domain = u"", host = u"", max_renames = 32768,

140

138

protocol = avahi.PROTO_UNSPEC, bus = None):

141

139

self.interface = interface

142

140

self.name = name

151

149

self.group = None # our entry group

152

150

self.server = None

153

151

self.bus = bus

154

self.entry_group_state_changed_match = None

155

152

def rename(self):

156

153

"""Derived from the Avahi example code"""

157

154

if self.rename_count >= self.max_renames:

158

logger.critical("No suitable Zeroconf service name found"

159

" after %i retries, exiting.",

155

logger.critical(u"No suitable Zeroconf service name found"

156

u" after %i retries, exiting.",

160

157

self.rename_count)

161

raise AvahiServiceError("Too many renames")

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

163

logger.info("Changing Zeroconf service name to %r ...",

164

self.name)

158

raise AvahiServiceError(u"Too many renames")

159

self.name = self.server.GetAlternativeServiceName(self.name)

160

logger.info(u"Changing Zeroconf service name to %r ...",

161

unicode(self.name))

165

162

syslogger.setFormatter(logging.Formatter

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

163

(u'Mandos (%s) [%%(process)d]:'

164

u' %%(levelname)s: %%(message)s'

168

165

% self.name))

169

166

self.remove()

170

try:

171

self.add()

172

except dbus.exceptions.DBusException as error:

173

logger.critical("DBusException: %s", error)

174

self.cleanup()

175

os._exit(1)

167

self.add()

176

168

self.rename_count += 1

177

169

def remove(self):

178

170

"""Derived from the Avahi example code"""

179

if self.entry_group_state_changed_match is not None:

180

self.entry_group_state_changed_match.remove()

181

self.entry_group_state_changed_match = None

182

171

if self.group is not None:

183

172

self.group.Reset()

184

173

def add(self):

185

174

"""Derived from the Avahi example code"""

186

self.remove()

187

175

if self.group is None:

188

176

self.group = dbus.Interface(

189

177

self.bus.get_object(avahi.DBUS_NAME,

190

178

self.server.EntryGroupNew()),

191

179

avahi.DBUS_INTERFACE_ENTRY_GROUP)

192

self.entry_group_state_changed_match = (

193

self.group.connect_to_signal(

194

'StateChanged', self .entry_group_state_changed))

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

180

self.group.connect_to_signal('StateChanged',

181

self

182

.entry_group_state_changed)

183

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

196

184

self.name, self.type)

197

185

self.group.AddService(

198

186

self.interface,

205

193

self.group.Commit()

206

194

def entry_group_state_changed(self, state, error):

207

195

"""Derived from the Avahi example code"""

208

logger.debug("Avahi entry group state change: %i", state)

196

logger.debug(u"Avahi state change: %i", state)

209

197

210

198

if state == avahi.ENTRY_GROUP_ESTABLISHED:

211

logger.debug("Zeroconf service established.")

199

logger.debug(u"Zeroconf service established.")

212

200

elif state == avahi.ENTRY_GROUP_COLLISION:

213

logger.info("Zeroconf service name collision.")

201

logger.warning(u"Zeroconf service name collision.")

214

202

self.rename()

215

203

elif state == avahi.ENTRY_GROUP_FAILURE:

216

logger.critical("Avahi: Error in group state changed %s",

204

logger.critical(u"Avahi: Error in group state changed %s",

217

205

unicode(error))

218

raise AvahiGroupError("State changed: %s"

206

raise AvahiGroupError(u"State changed: %s"

219

207

% unicode(error))

220

208

def cleanup(self):

221

209

"""Derived from the Avahi example code"""

222

210

if self.group is not None:

223

try:

224

self.group.Free()

225

except (dbus.exceptions.UnknownMethodException,

226

dbus.exceptions.DBusException) as e:

227

pass

211

self.group.Free()

228

212

self.group = None

229

self.remove()

230

def server_state_changed(self, state, error=None):

213

def server_state_changed(self, state):

231

214

"""Derived from the Avahi example code"""

232

logger.debug("Avahi server state change: %i", state)

233

bad_states = { avahi.SERVER_INVALID:

234

"Zeroconf server invalid",

235

avahi.SERVER_REGISTERING: None,

236

avahi.SERVER_COLLISION:

237

"Zeroconf server name collision",

238

avahi.SERVER_FAILURE:

239

"Zeroconf server failure" }

240

if state in bad_states:

241

if bad_states[state] is not None:

242

if error is None:

243

logger.error(bad_states[state])

244

else:

245

logger.error(bad_states[state] + ": %r", error)

246

self.cleanup()

215

if state == avahi.SERVER_COLLISION:

216

logger.error(u"Zeroconf server name collision")

217

self.remove()

247

218

elif state == avahi.SERVER_RUNNING:

248

219

self.add()

249

else:

250

if error is None:

251

logger.debug("Unknown state: %r", state)

252

else:

253

logger.debug("Unknown state: %r: %r", state, error)

254

220

def activate(self):

255

221

"""Derived from the Avahi example code"""

256

222

if self.server is None:

257

223

self.server = dbus.Interface(

258

224

self.bus.get_object(avahi.DBUS_NAME,

259

avahi.DBUS_PATH_SERVER,

260

follow_name_owner_changes=True),

225

avahi.DBUS_PATH_SERVER),

261

226

avahi.DBUS_INTERFACE_SERVER)

262

self.server.connect_to_signal("StateChanged",

227

self.server.connect_to_signal(u"StateChanged",

263

228

self.server_state_changed)

264

229

self.server_state_changed(self.server.GetState())

265

230

266

231

267

def _timedelta_to_milliseconds(td):

268

"Convert a datetime.timedelta() to milliseconds"

269

return ((td.days * 24 * 60 * 60 * 1000)

270

+ (td.seconds * 1000)

271

+ (td.microseconds // 1000))

272

273

232

class Client(object):

274

233

"""A representation of a client host served by this server.

275

234

276

235

Attributes:

277

_approved: bool(); 'None' if not yet approved/disapproved

278

approval_delay: datetime.timedelta(); Time to wait for approval

279

approval_duration: datetime.timedelta(); Duration of one approval

236

237

D-Bus identifiers

238

fingerprint: string (40 or 32 hexadecimal digits); used to

239

uniquely identify the client

240

secret: bytestring; sent verbatim (over TLS) to client

241

host: string; available for use by the checker command

242

created: datetime.datetime(); (UTC) object creation

243

last_enabled: datetime.datetime(); (UTC)

244

enabled: bool()

245

last_checked_ok: datetime.datetime(); (UTC) or None

246

timeout: datetime.timedelta(); How long from last_checked_ok

247

until this client is disabled

248

interval: datetime.timedelta(); How often to start a new checker

249

disable_hook: If set, called by disable() as disable_hook(self)

280

250

checker: subprocess.Popen(); a running checker process used

281

251

to see if the client lives.

282

252

'None' if no process is running.

283

checker_callback_tag: a gobject event source tag, or None

284

checker_command: string; External command which is run to check

285

if client lives. %() expansions are done at

253

checker_initiator_tag: a gobject event source tag, or None

254

disable_initiator_tag: - '' -

255

checker_callback_tag: - '' -

256

checker_command: string; External command which is run to check if

257

client lives. %() expansions are done at

286

258

runtime with vars(self) as dict, so that for

287

259

instance %(name)s can be used in the command.

288

checker_initiator_tag: a gobject event source tag, or None

289

created: datetime.datetime(); (UTC) object creation

290

260

current_checker_command: string; current running checker_command

291

disable_hook: If set, called by disable() as disable_hook(self)

292

disable_initiator_tag: a gobject event source tag, or None

293

enabled: bool()

294

fingerprint: string (40 or 32 hexadecimal digits); used to

295

uniquely identify the client

296

host: string; available for use by the checker command

297

interval: datetime.timedelta(); How often to start a new checker

298

last_approval_request: datetime.datetime(); (UTC) or None

299

last_checked_ok: datetime.datetime(); (UTC) or None

300

last_enabled: datetime.datetime(); (UTC)

301

302

D-Bus identifiers

303

secret: bytestring; sent verbatim (over TLS) to client

304

timeout: datetime.timedelta(); How long from last_checked_ok

305

until this client is disabled

306

extended_timeout: extra long timeout when password has been sent

307

runtime_expansions: Allowed attributes for runtime expansion.

308

expires: datetime.datetime(); time (UTC) when a client will be

309

disabled, or None

310

261

"""

311

262

312

runtime_expansions = ("approval_delay", "approval_duration",

313

"created", "enabled", "fingerprint",

314

"host", "interval", "last_checked_ok",

315

"last_enabled", "name", "timeout")

263

@staticmethod

264

def _timedelta_to_milliseconds(td):

265

"Convert a datetime.timedelta() to milliseconds"

266

return ((td.days * 24 * 60 * 60 * 1000)

267

+ (td.seconds * 1000)

268

+ (td.microseconds // 1000))

316

269

317

270

def timeout_milliseconds(self):

318

271

"Return the 'timeout' attribute in milliseconds"

319

return _timedelta_to_milliseconds(self.timeout)

320

321

def extended_timeout_milliseconds(self):

322

"Return the 'extended_timeout' attribute in milliseconds"

323

return _timedelta_to_milliseconds(self.extended_timeout)

272

return self._timedelta_to_milliseconds(self.timeout)

324

273

325

274

def interval_milliseconds(self):

326

275

"Return the 'interval' attribute in milliseconds"

327

return _timedelta_to_milliseconds(self.interval)

328

329

def approval_delay_milliseconds(self):

330

return _timedelta_to_milliseconds(self.approval_delay)

276

return self._timedelta_to_milliseconds(self.interval)

331

277

332

278

def __init__(self, name = None, disable_hook=None, config=None):

333

279

"""Note: the 'checker' key in 'config' sets the

336

282

self.name = name

337

283

if config is None:

338

284

config = {}

339

logger.debug("Creating client %r", self.name)

285

logger.debug(u"Creating client %r", self.name)

340

286

# Uppercase and remove spaces from fingerprint for later

341

287

# comparison purposes with return value from the fingerprint()

342

288

# function

343

self.fingerprint = (config["fingerprint"].upper()

344

.replace(" ", ""))

345

logger.debug(" Fingerprint: %s", self.fingerprint)

346

if "secret" in config:

347

self.secret = config["secret"].decode("base64")

348

elif "secfile" in config:

289

self.fingerprint = (config[u"fingerprint"].upper()

290

.replace(u" ", u""))

291

logger.debug(u" Fingerprint: %s", self.fingerprint)

292

if u"secret" in config:

293

self.secret = config[u"secret"].decode(u"base64")

294

elif u"secfile" in config:

349

295

with open(os.path.expanduser(os.path.expandvars

350

(config["secfile"])),

296

(config[u"secfile"])),

351

297

"rb") as secfile:

352

298

self.secret = secfile.read()

353

299

else:

354

raise TypeError("No secret or secfile for client %s"

300

raise TypeError(u"No secret or secfile for client %s"

355

301

% self.name)

356

self.host = config.get("host", "")

302

self.host = config.get(u"host", u"")

357

303

self.created = datetime.datetime.utcnow()

358

304

self.enabled = False

359

self.last_approval_request = None

360

305

self.last_enabled = None

361

306

self.last_checked_ok = None

362

self.timeout = string_to_delta(config["timeout"])

363

self.extended_timeout = string_to_delta(config["extended_timeout"])

364

self.interval = string_to_delta(config["interval"])

307

self.timeout = string_to_delta(config[u"timeout"])

308

self.interval = string_to_delta(config[u"interval"])

365

309

self.disable_hook = disable_hook

366

310

self.checker = None

367

311

self.checker_initiator_tag = None

368

312

self.disable_initiator_tag = None

369

self.expires = None

370

313

self.checker_callback_tag = None

371

self.checker_command = config["checker"]

314

self.checker_command = config[u"checker"]

372

315

self.current_checker_command = None

373

316

self.last_connect = None

374

self._approved = None

375

self.approved_by_default = config.get("approved_by_default",

376

True)

377

self.approvals_pending = 0

378

self.approval_delay = string_to_delta(

379

config["approval_delay"])

380

self.approval_duration = string_to_delta(

381

config["approval_duration"])

382

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

383

317

384

def send_changedstate(self):

385

self.changedstate.acquire()

386

self.changedstate.notify_all()

387

self.changedstate.release()

388

389

318

def enable(self):

390

319

"""Start this client's checker and timeout hooks"""

391

if getattr(self, "enabled", False):

320

if getattr(self, u"enabled", False):

392

321

# Already enabled

393

322

return

394

self.send_changedstate()

323

self.last_enabled = datetime.datetime.utcnow()

395

324

# Schedule a new checker to be started an 'interval' from now,

396

325

# and every interval from then on.

397

326

self.checker_initiator_tag = (gobject.timeout_add

398

327

(self.interval_milliseconds(),

399

328

self.start_checker))

400

329

# Schedule a disable() when 'timeout' has passed

401

self.expires = datetime.datetime.utcnow() + self.timeout

402

330

self.disable_initiator_tag = (gobject.timeout_add

403

331

(self.timeout_milliseconds(),

404

332

self.disable))

405

333

self.enabled = True

406

self.last_enabled = datetime.datetime.utcnow()

407

334

# Also start a new checker *right now*.

408

335

self.start_checker()

409

336

412

339

if not getattr(self, "enabled", False):

413

340

return False

414

341

if not quiet:

415

self.send_changedstate()

416

if not quiet:

417

logger.info("Disabling client %s", self.name)

418

if getattr(self, "disable_initiator_tag", False):

342

logger.info(u"Disabling client %s", self.name)

343

if getattr(self, u"disable_initiator_tag", False):

419

344

gobject.source_remove(self.disable_initiator_tag)

420

345

self.disable_initiator_tag = None

421

self.expires = None

422

if getattr(self, "checker_initiator_tag", False):

346

if getattr(self, u"checker_initiator_tag", False):

423

347

gobject.source_remove(self.checker_initiator_tag)

424

348

self.checker_initiator_tag = None

425

349

self.stop_checker()

440

364

if os.WIFEXITED(condition):

441

365

exitstatus = os.WEXITSTATUS(condition)

442

366

if exitstatus == 0:

443

logger.info("Checker for %(name)s succeeded",

367

logger.info(u"Checker for %(name)s succeeded",

444

368

vars(self))

445

369

self.checked_ok()

446

370

else:

447

logger.info("Checker for %(name)s failed",

371

logger.info(u"Checker for %(name)s failed",

448

372

vars(self))

449

373

else:

450

logger.warning("Checker for %(name)s crashed?",

374

logger.warning(u"Checker for %(name)s crashed?",

451

375

vars(self))

452

376

453

def checked_ok(self, timeout=None):

377

def checked_ok(self):

454

378

"""Bump up the timeout for this client.

455

379

456

380

This should only be called when the client has been seen,

457

381

alive and well.

458

382

"""

459

if timeout is None:

460

timeout = self.timeout

461

383

self.last_checked_ok = datetime.datetime.utcnow()

462

384

gobject.source_remove(self.disable_initiator_tag)

463

self.expires = datetime.datetime.utcnow() + timeout

464

385

self.disable_initiator_tag = (gobject.timeout_add

465

(_timedelta_to_milliseconds(timeout),

386

(self.timeout_milliseconds(),

466

387

self.disable))

467

388

468

def need_approval(self):

469

self.last_approval_request = datetime.datetime.utcnow()

470

471

389

def start_checker(self):

472

390

"""Start a new checker subprocess if one is not running.

473

391

485

403

# If a checker exists, make sure it is not a zombie

486

404

try:

487

405

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

488

except (AttributeError, OSError) as error:

406

except (AttributeError, OSError), error:

489

407

if (isinstance(error, OSError)

490

408

and error.errno != errno.ECHILD):

491

409

raise error

492

410

else:

493

411

if pid:

494

logger.warning("Checker was a zombie")

412

logger.warning(u"Checker was a zombie")

495

413

gobject.source_remove(self.checker_callback_tag)

496

414

self.checker_callback(pid, status,

497

415

self.current_checker_command)

502

420

command = self.checker_command % self.host

503

421

except TypeError:

504

422

# Escape attributes for the shell

505

escaped_attrs = dict(

506

(attr,

507

re.escape(unicode(str(getattr(self, attr, "")),

508

errors=

509

'replace')))

510

for attr in

511

self.runtime_expansions)

512

423

escaped_attrs = dict((key,

424

re.escape(unicode(str(val),

425

errors=

426

u'replace')))

427

for key, val in

428

vars(self).iteritems())

513

429

try:

514

430

command = self.checker_command % escaped_attrs

515

except TypeError as error:

516

logger.error('Could not format string "%s":'

517

' %s', self.checker_command, error)

431

except TypeError, error:

432

logger.error(u'Could not format string "%s":'

433

u' %s', self.checker_command, error)

518

434

return True # Try again later

519

435

self.current_checker_command = command

520

436

try:

521

logger.info("Starting checker %r for %s",

437

logger.info(u"Starting checker %r for %s",

522

438

command, self.name)

523

439

# We don't need to redirect stdout and stderr, since

524

440

# in normal mode, that is already done by daemon(),

526

442

# always replaced by /dev/null.)

527

443

self.checker = subprocess.Popen(command,

528

444

close_fds=True,

529

shell=True, cwd="/")

445

shell=True, cwd=u"/")

530

446

self.checker_callback_tag = (gobject.child_watch_add

531

447

(self.checker.pid,

532

448

self.checker_callback,

537

453

if pid:

538

454

gobject.source_remove(self.checker_callback_tag)

539

455

self.checker_callback(pid, status, command)

540

except OSError as error:

541

logger.error("Failed to start subprocess: %s",

456

except OSError, error:

457

logger.error(u"Failed to start subprocess: %s",

542

458

error)

543

459

# Re-run this periodically if run by gobject.timeout_add

544

460

return True

548

464

if self.checker_callback_tag:

549

465

gobject.source_remove(self.checker_callback_tag)

550

466

self.checker_callback_tag = None

551

if getattr(self, "checker", None) is None:

467

if getattr(self, u"checker", None) is None:

552

468

return

553

logger.debug("Stopping checker for %(name)s", vars(self))

469

logger.debug(u"Stopping checker for %(name)s", vars(self))

554

470

try:

555

471

os.kill(self.checker.pid, signal.SIGTERM)

556

472

#time.sleep(0.5)

557

473

#if self.checker.poll() is None:

558

474

# os.kill(self.checker.pid, signal.SIGKILL)

559

except OSError as error:

475

except OSError, error:

560

476

if error.errno != errno.ESRCH: # No such process

561

477

raise

562

478

self.checker = None

563

479

564

480

565

def dbus_service_property(dbus_interface, signature="v",

566

access="readwrite", byte_arrays=False):

481

def dbus_service_property(dbus_interface, signature=u"v",

482

access=u"readwrite", byte_arrays=False):

567

483

"""Decorators for marking methods of a DBusObjectWithProperties to

568

484

become properties on the D-Bus.

569

485

576

492

"""

577

493

# Encoding deeply encoded byte arrays is not supported yet by the

578

494

# "Set" method, so we fail early here:

579

if byte_arrays and signature != "ay":

580

raise ValueError("Byte arrays not supported for non-'ay'"

581

" signature %r" % signature)

495

if byte_arrays and signature != u"ay":

496

raise ValueError(u"Byte arrays not supported for non-'ay'"

497

u" signature %r" % signature)

582

498

def decorator(func):

583

499

func._dbus_is_property = True

584

500

func._dbus_interface = dbus_interface

585

501

func._dbus_signature = signature

586

502

func._dbus_access = access

587

503

func._dbus_name = func.__name__

588

if func._dbus_name.endswith("_dbus_property"):

504

if func._dbus_name.endswith(u"_dbus_property"):

589

505

func._dbus_name = func._dbus_name[:-14]

590

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

506

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

591

507

return func

592

508

return decorator

593

509

613

529

614

530

class DBusObjectWithProperties(dbus.service.Object):

615

531

"""A D-Bus object with properties.

616

532

617

533

Classes inheriting from this can use the dbus_service_property

618

534

decorator to expose methods as D-Bus properties. It exposes the

619

535

standard Get(), Set(), and GetAll() methods on the D-Bus.

621

537

622

538

@staticmethod

623

539

def _is_dbus_property(obj):

624

return getattr(obj, "_dbus_is_property", False)

540

return getattr(obj, u"_dbus_is_property", False)

625

541

626

542

def _get_all_dbus_properties(self):

627

543

"""Returns a generator of (name, attribute) pairs

635

551

property with the specified name and interface.

636

552

"""

637

553

for name in (property_name,

638

property_name + "_dbus_property"):

554

property_name + u"_dbus_property"):

639

555

prop = getattr(self, name, None)

640

556

if (prop is None

641

557

or not self._is_dbus_property(prop)

645

561

continue

646

562

return prop

647

563

# No such property

648

raise DBusPropertyNotFound(self.dbus_object_path + ":"

649

+ interface_name + "."

564

raise DBusPropertyNotFound(self.dbus_object_path + u":"

565

+ interface_name + u"."

650

566

+ property_name)

651

567

652

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

653

out_signature="v")

568

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

569

out_signature=u"v")

654

570

def Get(self, interface_name, property_name):

655

571

"""Standard D-Bus property Get() method, see D-Bus standard.

656

572

"""

657

573

prop = self._get_dbus_property(interface_name, property_name)

658

if prop._dbus_access == "write":

574

if prop._dbus_access == u"write":

659

575

raise DBusPropertyAccessException(property_name)

660

576

value = prop()

661

if not hasattr(value, "variant_level"):

577

if not hasattr(value, u"variant_level"):

662

578

return value

663

579

return type(value)(value, variant_level=value.variant_level+1)

664

580

665

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

581

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

666

582

def Set(self, interface_name, property_name, value):

667

583

"""Standard D-Bus property Set() method, see D-Bus standard.

668

584

"""

669

585

prop = self._get_dbus_property(interface_name, property_name)

670

if prop._dbus_access == "read":

586

if prop._dbus_access == u"read":

671

587

raise DBusPropertyAccessException(property_name)

672

if prop._dbus_get_args_options["byte_arrays"]:

588

if prop._dbus_get_args_options[u"byte_arrays"]:

673

589

# The byte_arrays option is not supported yet on

674

590

# signatures other than "ay".

675

if prop._dbus_signature != "ay":

591

if prop._dbus_signature != u"ay":

676

592

raise ValueError

677

593

value = dbus.ByteArray(''.join(unichr(byte)

678

594

for byte in value))

679

595

prop(value)

680

596

681

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

682

out_signature="a{sv}")

597

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

598

out_signature=u"a{sv}")

683

599

def GetAll(self, interface_name):

684

600

"""Standard D-Bus property GetAll() method, see D-Bus

685

601

standard.

686

602

687

603

Note: Will not include properties with access="write".

688

604

"""

689

605

all = {}

693

609

# Interface non-empty but did not match

694

610

continue

695

611

# Ignore write-only properties

696

if prop._dbus_access == "write":

612

if prop._dbus_access == u"write":

697

613

continue

698

614

value = prop()

699

if not hasattr(value, "variant_level"):

615

if not hasattr(value, u"variant_level"):

700

616

all[name] = value

701

617

continue

702

618

all[name] = type(value)(value, variant_level=

703

619

value.variant_level+1)

704

return dbus.Dictionary(all, signature="sv")

620

return dbus.Dictionary(all, signature=u"sv")

705

621

706

622

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

707

out_signature="s",

623

out_signature=u"s",

708

624

path_keyword='object_path',

709

625

connection_keyword='connection')

710

626

def Introspect(self, object_path, connection):

715

631

try:

716

632

document = xml.dom.minidom.parseString(xmlstring)

717

633

def make_tag(document, name, prop):

718

e = document.createElement("property")

719

e.setAttribute("name", name)

720

e.setAttribute("type", prop._dbus_signature)

721

e.setAttribute("access", prop._dbus_access)

634

e = document.createElement(u"property")

635

e.setAttribute(u"name", name)

636

e.setAttribute(u"type", prop._dbus_signature)

637

e.setAttribute(u"access", prop._dbus_access)

722

638

return e

723

for if_tag in document.getElementsByTagName("interface"):

639

for if_tag in document.getElementsByTagName(u"interface"):

724

640

for tag in (make_tag(document, name, prop)

725

641

for name, prop

726

642

in self._get_all_dbus_properties()

727

643

if prop._dbus_interface

728

== if_tag.getAttribute("name")):

644

== if_tag.getAttribute(u"name")):

729

645

if_tag.appendChild(tag)

730

646

# Add the names to the return values for the

731

647

# "org.freedesktop.DBus.Properties" methods

732

if (if_tag.getAttribute("name")

733

== "org.freedesktop.DBus.Properties"):

734

for cn in if_tag.getElementsByTagName("method"):

735

if cn.getAttribute("name") == "Get":

736

for arg in cn.getElementsByTagName("arg"):

737

if (arg.getAttribute("direction")

738

== "out"):

739

arg.setAttribute("name", "value")

740

elif cn.getAttribute("name") == "GetAll":

741

for arg in cn.getElementsByTagName("arg"):

742

if (arg.getAttribute("direction")

743

== "out"):

744

arg.setAttribute("name", "props")

745

xmlstring = document.toxml("utf-8")

648

if (if_tag.getAttribute(u"name")

649

== u"org.freedesktop.DBus.Properties"):

650

for cn in if_tag.getElementsByTagName(u"method"):

651

if cn.getAttribute(u"name") == u"Get":

652

for arg in cn.getElementsByTagName(u"arg"):

653

if (arg.getAttribute(u"direction")

654

== u"out"):

655

arg.setAttribute(u"name", u"value")

656

elif cn.getAttribute(u"name") == u"GetAll":

657

for arg in cn.getElementsByTagName(u"arg"):

658

if (arg.getAttribute(u"direction")

659

== u"out"):

660

arg.setAttribute(u"name", u"props")

661

xmlstring = document.toxml(u"utf-8")

746

662

document.unlink()

747

663

except (AttributeError, xml.dom.DOMException,

748

xml.parsers.expat.ExpatError) as error:

749

logger.error("Failed to override Introspection method",

664

xml.parsers.expat.ExpatError), error:

665

logger.error(u"Failed to override Introspection method",

750

666

error)

751

667

return xmlstring

752

668

753

669

754

def datetime_to_dbus (dt, variant_level=0):

755

"""Convert a UTC datetime.datetime() to a D-Bus type."""

756

if dt is None:

757

return dbus.String("", variant_level = variant_level)

758

return dbus.String(dt.isoformat(),

759

variant_level=variant_level)

760

761

762

670

class ClientDBus(Client, DBusObjectWithProperties):

763

671

"""A Client class using D-Bus

764

672

766

674

dbus_object_path: dbus.ObjectPath

767

675

bus: dbus.SystemBus()

768

676

"""

769

770

runtime_expansions = (Client.runtime_expansions

771

+ ("dbus_object_path",))

772

773

677

# dbus.service.Object doesn't use super(), so we can't either.

774

678

775

679

def __init__(self, bus = None, *args, **kwargs):

776

self._approvals_pending = 0

777

680

self.bus = bus

778

681

Client.__init__(self, *args, **kwargs)

779

682

# Only now, when this client is initialized, can it show up on

780

683

# the D-Bus

781

client_object_name = unicode(self.name).translate(

782

{ord("."): ord("_"),

783

ord("-"): ord("_")})

784

684

self.dbus_object_path = (dbus.ObjectPath

785

("/clients/" + client_object_name))

685

(u"/clients/"

686

+ self.name.replace(u".", u"_")))

786

687

DBusObjectWithProperties.__init__(self, self.bus,

787

688

self.dbus_object_path)

788

789

def notifychangeproperty(transform_func,

790

dbus_name, type_func=lambda x: x,

791

variant_level=1):

792

""" Modify a variable so that its a property that announce its

793

changes to DBus.

794

transform_fun: Function that takes a value and transform it to

795

DBus type.

796

dbus_name: DBus name of the variable

797

type_func: Function that transform the value before sending it

798

to DBus

799

variant_level: DBus variant level. default: 1

800

"""

801

real_value = [None,]

802

def setter(self, value):

803

old_value = real_value[0]

804

real_value[0] = value

805

if hasattr(self, "dbus_object_path"):

806

if type_func(old_value) != type_func(real_value[0]):

807

dbus_value = transform_func(type_func(real_value[0]),

808

variant_level)

809

self.PropertyChanged(dbus.String(dbus_name),

810

dbus_value)

811

812

return property(lambda self: real_value[0], setter)

813

814

815

expires = notifychangeproperty(datetime_to_dbus, "Expires")

816

approvals_pending = notifychangeproperty(dbus.Boolean,

817

"ApprovalPending",

818

type_func = bool)

819

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

820

last_enabled = notifychangeproperty(datetime_to_dbus,

821

"LastEnabled")

822

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

823

type_func = lambda checker: checker is not None)

824

last_checked_ok = notifychangeproperty(datetime_to_dbus,

825

"LastCheckedOK")

826

last_approval_request = notifychangeproperty(datetime_to_dbus,

827

"LastApprovalRequest")

828

approved_by_default = notifychangeproperty(dbus.Boolean,

829

"ApprovedByDefault")

830

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

831

type_func = _timedelta_to_milliseconds)

832

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

833

type_func = _timedelta_to_milliseconds)

834

host = notifychangeproperty(dbus.String, "Host")

835

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

836

type_func = _timedelta_to_milliseconds)

837

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

838

type_func = _timedelta_to_milliseconds)

839

interval = notifychangeproperty(dbus.UInt16, "Interval",

840

type_func = _timedelta_to_milliseconds)

841

checker_command = notifychangeproperty(dbus.String, "Checker")

842

843

del notifychangeproperty

689

690

@staticmethod

691

def _datetime_to_dbus(dt, variant_level=0):

692

"""Convert a UTC datetime.datetime() to a D-Bus type."""

693

return dbus.String(dt.isoformat(),

694

variant_level=variant_level)

695

696

def enable(self):

697

oldstate = getattr(self, u"enabled", False)

698

r = Client.enable(self)

699

if oldstate != self.enabled:

700

# Emit D-Bus signals

701

self.PropertyChanged(dbus.String(u"enabled"),

702

dbus.Boolean(True, variant_level=1))

703

self.PropertyChanged(

704

dbus.String(u"last_enabled"),

705

self._datetime_to_dbus(self.last_enabled,

706

variant_level=1))

707

return r

708

709

def disable(self, quiet = False):

710

oldstate = getattr(self, u"enabled", False)

711

r = Client.disable(self, quiet=quiet)

712

if not quiet and oldstate != self.enabled:

713

# Emit D-Bus signal

714

self.PropertyChanged(dbus.String(u"enabled"),

715

dbus.Boolean(False, variant_level=1))

716

return r

844

717

845

718

def __del__(self, *args, **kwargs):

846

719

try:

847

720

self.remove_from_connection()

848

721

except LookupError:

849

722

pass

850

if hasattr(DBusObjectWithProperties, "__del__"):

723

if hasattr(DBusObjectWithProperties, u"__del__"):

851

724

DBusObjectWithProperties.__del__(self, *args, **kwargs)

852

725

Client.__del__(self, *args, **kwargs)

853

726

855

728

*args, **kwargs):

856

729

self.checker_callback_tag = None

857

730

self.checker = None

731

# Emit D-Bus signal

732

self.PropertyChanged(dbus.String(u"checker_running"),

733

dbus.Boolean(False, variant_level=1))

858

734

if os.WIFEXITED(condition):

859

735

exitstatus = os.WEXITSTATUS(condition)

860

736

# Emit D-Bus signal

870

746

return Client.checker_callback(self, pid, condition, command,

871

747

*args, **kwargs)

872

748

749

def checked_ok(self, *args, **kwargs):

750

r = Client.checked_ok(self, *args, **kwargs)

751

# Emit D-Bus signal

752

self.PropertyChanged(

753

dbus.String(u"last_checked_ok"),

754

(self._datetime_to_dbus(self.last_checked_ok,

755

variant_level=1)))

756

return r

757

873

758

def start_checker(self, *args, **kwargs):

874

759

old_checker = self.checker

875

760

if self.checker is not None:

882

767

and old_checker_pid != self.checker.pid):

883

768

# Emit D-Bus signal

884

769

self.CheckerStarted(self.current_checker_command)

885

return r

886

887

def _reset_approved(self):

888

self._approved = None

889

return False

890

891

def approve(self, value=True):

892

self.send_changedstate()

893

self._approved = value

894

gobject.timeout_add(_timedelta_to_milliseconds

895

(self.approval_duration),

896

self._reset_approved)

897

770

self.PropertyChanged(

771

dbus.String(u"checker_running"),

772

dbus.Boolean(True, variant_level=1))

773

return r

774

775

def stop_checker(self, *args, **kwargs):

776

old_checker = getattr(self, u"checker", None)

777

r = Client.stop_checker(self, *args, **kwargs)

778

if (old_checker is not None

779

and getattr(self, u"checker", None) is None):

780

self.PropertyChanged(dbus.String(u"checker_running"),

781

dbus.Boolean(False, variant_level=1))

782

return r

898

783

899

784

## D-Bus methods, signals & properties

900

_interface = "se.bsnet.fukt.Mandos.Client"

785

_interface = u"se.bsnet.fukt.Mandos.Client"

901

786

902

787

## Signals

903

788

904

789

# CheckerCompleted - signal

905

@dbus.service.signal(_interface, signature="nxs")

790

@dbus.service.signal(_interface, signature=u"nxs")

906

791

def CheckerCompleted(self, exitcode, waitstatus, command):

907

792

"D-Bus signal"

908

793

pass

909

794

910

795

# CheckerStarted - signal

911

@dbus.service.signal(_interface, signature="s")

796

@dbus.service.signal(_interface, signature=u"s")

912

797

def CheckerStarted(self, command):

913

798

"D-Bus signal"

914

799

pass

915

800

916

801

# PropertyChanged - signal

917

@dbus.service.signal(_interface, signature="sv")

802

@dbus.service.signal(_interface, signature=u"sv")

918

803

def PropertyChanged(self, property, value):

919

804

"D-Bus signal"

920

805

pass

922

807

# GotSecret - signal

923

808

@dbus.service.signal(_interface)

924

809

def GotSecret(self):

925

"""D-Bus signal

926

Is sent after a successful transfer of secret from the Mandos

927

server to mandos-client

928

"""

810

"D-Bus signal"

929

811

pass

930

812

931

813

# Rejected - signal

932

@dbus.service.signal(_interface, signature="s")

933

def Rejected(self, reason):

814

@dbus.service.signal(_interface)

815

def Rejected(self):

934

816

"D-Bus signal"

935

817

pass

936

818

937

# NeedApproval - signal

938

@dbus.service.signal(_interface, signature="tb")

939

def NeedApproval(self, timeout, default):

940

"D-Bus signal"

941

return self.need_approval()

942

943

819

## Methods

944

820

945

# Approve - method

946

@dbus.service.method(_interface, in_signature="b")

947

def Approve(self, value):

948

self.approve(value)

949

950

821

# CheckedOK - method

951

822

@dbus.service.method(_interface)

952

823

def CheckedOK(self):

953

self.checked_ok()

824

return self.checked_ok()

954

825

955

826

# Enable - method

956

827

@dbus.service.method(_interface)

977

848

978

849

## Properties

979

850

980

# ApprovalPending - property

981

@dbus_service_property(_interface, signature="b", access="read")

982

def ApprovalPending_dbus_property(self):

983

return dbus.Boolean(bool(self.approvals_pending))

984

985

# ApprovedByDefault - property

986

@dbus_service_property(_interface, signature="b",

987

access="readwrite")

988

def ApprovedByDefault_dbus_property(self, value=None):

989

if value is None: # get

990

return dbus.Boolean(self.approved_by_default)

991

self.approved_by_default = bool(value)

992

993

# ApprovalDelay - property

994

@dbus_service_property(_interface, signature="t",

995

access="readwrite")

996

def ApprovalDelay_dbus_property(self, value=None):

997

if value is None: # get

998

return dbus.UInt64(self.approval_delay_milliseconds())

999

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1000

1001

# ApprovalDuration - property

1002

@dbus_service_property(_interface, signature="t",

1003

access="readwrite")

1004

def ApprovalDuration_dbus_property(self, value=None):

1005

if value is None: # get

1006

return dbus.UInt64(_timedelta_to_milliseconds(

1007

self.approval_duration))

1008

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1009

1010

# Name - property

1011

@dbus_service_property(_interface, signature="s", access="read")

1012

def Name_dbus_property(self):

851

# name - property

852

@dbus_service_property(_interface, signature=u"s", access=u"read")

853

def name_dbus_property(self):

1013

854

return dbus.String(self.name)

1014

855

1015

# Fingerprint - property

1016

@dbus_service_property(_interface, signature="s", access="read")

1017

def Fingerprint_dbus_property(self):

856

# fingerprint - property

857

@dbus_service_property(_interface, signature=u"s", access=u"read")

858

def fingerprint_dbus_property(self):

1018

859

return dbus.String(self.fingerprint)

1019

860

1020

# Host - property

1021

@dbus_service_property(_interface, signature="s",

1022

access="readwrite")

1023

def Host_dbus_property(self, value=None):

861

# host - property

862

@dbus_service_property(_interface, signature=u"s",

863

access=u"readwrite")

864

def host_dbus_property(self, value=None):

1024

865

if value is None: # get

1025

866

return dbus.String(self.host)

1026

867

self.host = value

1027

1028

# Created - property

1029

@dbus_service_property(_interface, signature="s", access="read")

1030

def Created_dbus_property(self):

1031

return dbus.String(datetime_to_dbus(self.created))

1032

1033

# LastEnabled - property

1034

@dbus_service_property(_interface, signature="s", access="read")

1035

def LastEnabled_dbus_property(self):

1036

return datetime_to_dbus(self.last_enabled)

1037

1038

# Enabled - property

1039

@dbus_service_property(_interface, signature="b",

1040

access="readwrite")

1041

def Enabled_dbus_property(self, value=None):

868

# Emit D-Bus signal

869

self.PropertyChanged(dbus.String(u"host"),

870

dbus.String(value, variant_level=1))

871

872

# created - property

873

@dbus_service_property(_interface, signature=u"s", access=u"read")

874

def created_dbus_property(self):

875

return dbus.String(self._datetime_to_dbus(self.created))

876

877

# last_enabled - property

878

@dbus_service_property(_interface, signature=u"s", access=u"read")

879

def last_enabled_dbus_property(self):

880

if self.last_enabled is None:

881

return dbus.String(u"")

882

return dbus.String(self._datetime_to_dbus(self.last_enabled))

883

884

# enabled - property

885

@dbus_service_property(_interface, signature=u"b",

886

access=u"readwrite")

887

def enabled_dbus_property(self, value=None):

1042

888

if value is None: # get

1043

889

return dbus.Boolean(self.enabled)

1044

890

if value:

1046

892

else:

1047

893

self.disable()

1048

894

1049

# LastCheckedOK - property

1050

@dbus_service_property(_interface, signature="s",

1051

access="readwrite")

1052

def LastCheckedOK_dbus_property(self, value=None):

895

# last_checked_ok - property

896

@dbus_service_property(_interface, signature=u"s",

897

access=u"readwrite")

898

def last_checked_ok_dbus_property(self, value=None):

1053

899

if value is not None:

1054

900

self.checked_ok()

1055

901

return

1056

return datetime_to_dbus(self.last_checked_ok)

1057

1058

# Expires - property

1059

@dbus_service_property(_interface, signature="s", access="read")

1060

def Expires_dbus_property(self):

1061

return datetime_to_dbus(self.expires)

1062

1063

# LastApprovalRequest - property

1064

@dbus_service_property(_interface, signature="s", access="read")

1065

def LastApprovalRequest_dbus_property(self):

1066

return datetime_to_dbus(self.last_approval_request)

1067

1068

# Timeout - property

1069

@dbus_service_property(_interface, signature="t",

1070

access="readwrite")

1071

def Timeout_dbus_property(self, value=None):

902

if self.last_checked_ok is None:

903

return dbus.String(u"")

904

return dbus.String(self._datetime_to_dbus(self

905

.last_checked_ok))

906

907

# timeout - property

908

@dbus_service_property(_interface, signature=u"t",

909

access=u"readwrite")

910

def timeout_dbus_property(self, value=None):

1072

911

if value is None: # get

1073

912

return dbus.UInt64(self.timeout_milliseconds())

1074

913

self.timeout = datetime.timedelta(0, 0, 0, value)

1075

if getattr(self, "disable_initiator_tag", None) is None:

914

# Emit D-Bus signal

915

self.PropertyChanged(dbus.String(u"timeout"),

916

dbus.UInt64(value, variant_level=1))

917

if getattr(self, u"disable_initiator_tag", None) is None:

1076

918

return

1077

919

# Reschedule timeout

1078

920

gobject.source_remove(self.disable_initiator_tag)

1079

921

self.disable_initiator_tag = None

1080

self.expires = None

1081

922

time_to_die = (self.

1082

923

_timedelta_to_milliseconds((self

1083

924

.last_checked_ok

1088

929

# The timeout has passed

1089

930

self.disable()

1090

931

else:

1091

self.expires = (datetime.datetime.utcnow()

1092

+ datetime.timedelta(milliseconds = time_to_die))

1093

932

self.disable_initiator_tag = (gobject.timeout_add

1094

933

(time_to_die, self.disable))

1095

934

1096

# ExtendedTimeout - property

1097

@dbus_service_property(_interface, signature="t",

1098

access="readwrite")

1099

def ExtendedTimeout_dbus_property(self, value=None):

1100

if value is None: # get

1101

return dbus.UInt64(self.extended_timeout_milliseconds())

1102

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1103

1104

# Interval - property

1105

@dbus_service_property(_interface, signature="t",

1106

access="readwrite")

1107

def Interval_dbus_property(self, value=None):

935

# interval - property

936

@dbus_service_property(_interface, signature=u"t",

937

access=u"readwrite")

938

def interval_dbus_property(self, value=None):

1108

939

if value is None: # get

1109

940

return dbus.UInt64(self.interval_milliseconds())

1110

941

self.interval = datetime.timedelta(0, 0, 0, value)

1111

if getattr(self, "checker_initiator_tag", None) is None:

942

# Emit D-Bus signal

943

self.PropertyChanged(dbus.String(u"interval"),

944

dbus.UInt64(value, variant_level=1))

945

if getattr(self, u"checker_initiator_tag", None) is None:

1112

946

return

1113

947

# Reschedule checker run

1114

948

gobject.source_remove(self.checker_initiator_tag)

1115

949

self.checker_initiator_tag = (gobject.timeout_add

1116

950

(value, self.start_checker))

1117

951

self.start_checker() # Start one now, too

1118

1119

# Checker - property

1120

@dbus_service_property(_interface, signature="s",

1121

access="readwrite")

1122

def Checker_dbus_property(self, value=None):

952

953

# checker - property

954

@dbus_service_property(_interface, signature=u"s",

955

access=u"readwrite")

956

def checker_dbus_property(self, value=None):

1123

957

if value is None: # get

1124

958

return dbus.String(self.checker_command)

1125

959

self.checker_command = value

960

# Emit D-Bus signal

961

self.PropertyChanged(dbus.String(u"checker"),

962

dbus.String(self.checker_command,

963

variant_level=1))

1126

964

1127

# CheckerRunning - property

1128

@dbus_service_property(_interface, signature="b",

1129

access="readwrite")

1130

def CheckerRunning_dbus_property(self, value=None):

965

# checker_running - property

966

@dbus_service_property(_interface, signature=u"b",

967

access=u"readwrite")

968

def checker_running_dbus_property(self, value=None):

1131

969

if value is None: # get

1132

970

return dbus.Boolean(self.checker is not None)

1133

971

if value:

1135

973

else:

1136

974

self.stop_checker()

1137

975

1138

# ObjectPath - property

1139

@dbus_service_property(_interface, signature="o", access="read")

1140

def ObjectPath_dbus_property(self):

976

# object_path - property

977

@dbus_service_property(_interface, signature=u"o", access=u"read")

978

def object_path_dbus_property(self):

1141

979

return self.dbus_object_path # is already a dbus.ObjectPath

1142

980

1143

# Secret = property

1144

@dbus_service_property(_interface, signature="ay",

1145

access="write", byte_arrays=True)

1146

def Secret_dbus_property(self, value):

981

# secret = property

982

@dbus_service_property(_interface, signature=u"ay",

983

access=u"write", byte_arrays=True)

984

def secret_dbus_property(self, value):

1147

985

self.secret = str(value)

1148

986

1149

987

del _interface

1150

988

1151

989

1152

class ProxyClient(object):

1153

def __init__(self, child_pipe, fpr, address):

1154

self._pipe = child_pipe

1155

self._pipe.send(('init', fpr, address))

1156

if not self._pipe.recv():

1157

raise KeyError()

1158

1159

def __getattribute__(self, name):

1160

if(name == '_pipe'):

1161

return super(ProxyClient, self).__getattribute__(name)

1162

self._pipe.send(('getattr', name))

1163

data = self._pipe.recv()

1164

if data[0] == 'data':

1165

return data[1]

1166

if data[0] == 'function':

1167

def func(*args, **kwargs):

1168

self._pipe.send(('funcall', name, args, kwargs))

1169

return self._pipe.recv()[1]

1170

return func

1171

1172

def __setattr__(self, name, value):

1173

if(name == '_pipe'):

1174

return super(ProxyClient, self).__setattr__(name, value)

1175

self._pipe.send(('setattr', name, value))

1176

1177

1178

990

class ClientHandler(socketserver.BaseRequestHandler, object):

1179

991

"""A class to handle client connections.

1180

992

1182

994

Note: This will run in its own forked process."""

1183

995

1184

996

def handle(self):

1185

with contextlib.closing(self.server.child_pipe) as child_pipe:

1186

logger.info("TCP connection from: %s",

1187

unicode(self.client_address))

1188

logger.debug("Pipe FD: %d",

1189

self.server.child_pipe.fileno())

1190

997

logger.info(u"TCP connection from: %s",

998

unicode(self.client_address))

999

logger.debug(u"IPC Pipe FD: %d",

1000

self.server.child_pipe[1].fileno())

1001

# Open IPC pipe to parent process

1002

with contextlib.nested(self.server.child_pipe[1],

1003

self.server.parent_pipe[0]

1004

) as (ipc, ipc_return):

1191

1005

session = (gnutls.connection

1192

1006

.ClientSession(self.request,

1193

1007

gnutls.connection

1198

1012

# no X.509 keys are added to it. Therefore, we can use it

1199

1013

# here despite using OpenPGP certificates.

1200

1014

1201

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1202

# "+AES-256-CBC", "+SHA1",

1203

# "+COMP-NULL", "+CTYPE-OPENPGP",

1204

# "+DHE-DSS"))

1015

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1016

# u"+AES-256-CBC", u"+SHA1",

1017

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1018

# u"+DHE-DSS"))

1205

1019

# Use a fallback default, since this MUST be set.

1206

1020

priority = self.server.gnutls_priority

1207

1021

if priority is None:

1208

priority = "NORMAL"

1022

priority = u"NORMAL"

1209

1023

(gnutls.library.functions

1210

1024

.gnutls_priority_set_direct(session._c_object,

1211

1025

priority, None))

1213

1027

# Start communication using the Mandos protocol

1214

1028

# Get protocol number

1215

1029

line = self.request.makefile().readline()

1216

logger.debug("Protocol version: %r", line)

1030

logger.debug(u"Protocol version: %r", line)

1217

1031

try:

1218

1032

if int(line.strip().split()[0]) > 1:

1219

1033

raise RuntimeError

1220

except (ValueError, IndexError, RuntimeError) as error:

1221

logger.error("Unknown protocol version: %s", error)

1034

except (ValueError, IndexError, RuntimeError), error:

1035

logger.error(u"Unknown protocol version: %s", error)

1222

1036

return

1223

1037

1224

1038

# Start GnuTLS connection

1225

1039

try:

1226

1040

session.handshake()

1227

except gnutls.errors.GNUTLSError as error:

1228

logger.warning("Handshake failed: %s", error)

1041

except gnutls.errors.GNUTLSError, error:

1042

logger.warning(u"Handshake failed: %s", error)

1229

1043

# Do not run session.bye() here: the session is not

1230

1044

# established. Just abandon the request.

1231

1045

return

1232

logger.debug("Handshake succeeded")

1233

1234

approval_required = False

1046

logger.debug(u"Handshake succeeded")

1235

1047

try:

1236

1048

try:

1237

1049

fpr = self.fingerprint(self.peer_certificate

1238

1050

(session))

1239

except (TypeError,

1240

gnutls.errors.GNUTLSError) as error:

1241

logger.warning("Bad certificate: %s", error)

1242

return

1243

logger.debug("Fingerprint: %s", fpr)

1244

1245

try:

1246

client = ProxyClient(child_pipe, fpr,

1247

self.client_address)

1248

except KeyError:

1249

return

1250

1251

if client.approval_delay:

1252

delay = client.approval_delay

1253

client.approvals_pending += 1

1254

approval_required = True

1255

1256

while True:

1257

if not client.enabled:

1258

logger.info("Client %s is disabled",

1259

client.name)

1260

if self.server.use_dbus:

1261

# Emit D-Bus signal

1262

client.Rejected("Disabled")

1263

return

1264

1265

if client._approved or not client.approval_delay:

1266

#We are approved or approval is disabled

1051

except (TypeError, gnutls.errors.GNUTLSError), error:

1052

logger.warning(u"Bad certificate: %s", error)

1053

return

1054

logger.debug(u"Fingerprint: %s", fpr)

1055

1056

for c in self.server.clients:

1057

if c.fingerprint == fpr:

1058

client = c

1267

1059

break

1268

elif client._approved is None:

1269

logger.info("Client %s needs approval",

1270

client.name)

1271

if self.server.use_dbus:

1272

# Emit D-Bus signal

1273

client.NeedApproval(

1274

client.approval_delay_milliseconds(),

1275

client.approved_by_default)

1276

else:

1277

logger.warning("Client %s was not approved",

1278

client.name)

1279

if self.server.use_dbus:

1280

# Emit D-Bus signal

1281

client.Rejected("Denied")

1282

return

1283

1284

#wait until timeout or approved

1285

#x = float(client._timedelta_to_milliseconds(delay))

1286

time = datetime.datetime.now()

1287

client.changedstate.acquire()

1288

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1289

client.changedstate.release()

1290

time2 = datetime.datetime.now()

1291

if (time2 - time) >= delay:

1292

if not client.approved_by_default:

1293

logger.warning("Client %s timed out while"

1294

" waiting for approval",

1295

client.name)

1296

if self.server.use_dbus:

1297

# Emit D-Bus signal

1298

client.Rejected("Approval timed out")

1299

return

1300

else:

1301

break

1302

else:

1303

delay -= time2 - time

1304

1060

else:

1061

ipc.write(u"NOTFOUND %s %s\n"

1062

% (fpr, unicode(self.client_address)))

1063

return

1064

1065

class ClientProxy(object):

1066

"""Client proxy object. Not for calling methods."""

1067

def __init__(self, client):

1068

self.client = client

1069

def __getattr__(self, name):

1070

if name.startswith("ipc_"):

1071

def tempfunc():

1072

ipc.write("%s %s\n" % (name[4:].upper(),

1073

self.client.name))

1074

return tempfunc

1075

if not hasattr(self.client, name):

1076

raise AttributeError

1077

ipc.write(u"GETATTR %s %s\n"

1078

% (name, self.client.fingerprint))

1079

return pickle.load(ipc_return)

1080

clientproxy = ClientProxy(client)

1081

# Have to check if client.enabled, since it is

1082

# possible that the client was disabled since the

1083

# GnuTLS session was established.

1084

if not clientproxy.enabled:

1085

clientproxy.ipc_disabled()

1086

return

1087

1088

clientproxy.ipc_sending()

1305

1089

sent_size = 0

1306

1090

while sent_size < len(client.secret):

1307

try:

1308

sent = session.send(client.secret[sent_size:])

1309

except gnutls.errors.GNUTLSError as error:

1310

logger.warning("gnutls send failed")

1311

return

1312

logger.debug("Sent: %d, remaining: %d",

1091

sent = session.send(client.secret[sent_size:])

1092

logger.debug(u"Sent: %d, remaining: %d",

1313

1093

sent, len(client.secret)

1314

1094

- (sent_size + sent))

1315

1095

sent_size += sent

1316

1317

logger.info("Sending secret to %s", client.name)

1318

# bump the timeout as if seen

1319

client.checked_ok(client.extended_timeout)

1320

if self.server.use_dbus:

1321

# Emit D-Bus signal

1322

client.GotSecret()

1323

1324

1096

finally:

1325

if approval_required:

1326

client.approvals_pending -= 1

1327

try:

1328

session.bye()

1329

except gnutls.errors.GNUTLSError as error:

1330

logger.warning("GnuTLS bye failed")

1097

session.bye()

1331

1098

1332

1099

@staticmethod

1333

1100

def peer_certificate(session):

1343

1110

.gnutls_certificate_get_peers

1344

1111

(session._c_object, ctypes.byref(list_size)))

1345

1112

if not bool(cert_list) and list_size.value != 0:

1346

raise gnutls.errors.GNUTLSError("error getting peer"

1347

" certificate")

1113

raise gnutls.errors.GNUTLSError(u"error getting peer"

1114

u" certificate")

1348

1115

if list_size.value == 0:

1349

1116

return None

1350

1117

cert = cert_list[0]

1376

1143

if crtverify.value != 0:

1377

1144

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1378

1145

raise (gnutls.errors.CertificateSecurityError

1379

("Verify failed"))

1146

(u"Verify failed"))

1380

1147

# New buffer for the fingerprint

1381

1148

buf = ctypes.create_string_buffer(20)

1382

1149

buf_len = ctypes.c_size_t()

1389

1156

# Convert the buffer to a Python bytestring

1390

1157

fpr = ctypes.string_at(buf, buf_len.value)

1391

1158

# Convert the bytestring to hexadecimal notation

1392

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1159

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1393

1160

return hex_fpr

1394

1161

1395

1162

1396

class MultiprocessingMixIn(object):

1397

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1398

def sub_process_main(self, request, address):

1399

try:

1400

self.finish_request(request, address)

1401

except:

1402

self.handle_error(request, address)

1403

self.close_request(request)

1404

1405

def process_request(self, request, address):

1406

"""Start a new process to process the request."""

1407

multiprocessing.Process(target = self.sub_process_main,

1408

args = (request, address)).start()

1409

1410

1411

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1412

""" adds a pipe to the MixIn """

1163

class ForkingMixInWithPipes(socketserver.ForkingMixIn, object):

1164

"""Like socketserver.ForkingMixIn, but also pass a pipe pair."""

1413

1165

def process_request(self, request, client_address):

1414

1166

"""Overrides and wraps the original process_request().

1415

1167

1416

1168

This function creates a new pipe in self.pipe

1417

1169

"""

1418

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1419

1420

super(MultiprocessingMixInWithPipe,

1170

# Child writes to child_pipe

1171

self.child_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))

1172

# Parent writes to parent_pipe

1173

self.parent_pipe = map(os.fdopen, os.pipe(), u"rw", (1, 0))

1174

super(ForkingMixInWithPipes,

1421

1175

self).process_request(request, client_address)

1422

self.child_pipe.close()

1423

self.add_pipe(parent_pipe)

1424

1425

def add_pipe(self, parent_pipe):

1176

# Close unused ends for parent

1177

self.parent_pipe[0].close() # close read end

1178

self.child_pipe[1].close() # close write end

1179

self.add_pipe_fds(self.child_pipe[0], self.parent_pipe[1])

1180

def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):

1426

1181

"""Dummy function; override as necessary"""

1427

raise NotImplementedError

1428

1429

1430

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1182

child_pipe_fd.close()

1183

parent_pipe_fd.close()

1184

1185

1186

class IPv6_TCPServer(ForkingMixInWithPipes,

1431

1187

socketserver.TCPServer, object):

1432

1188

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1433

1189

1449

1205

bind to an address or port if they were not specified."""

1450

1206

if self.interface is not None:

1451

1207

if SO_BINDTODEVICE is None:

1452

logger.error("SO_BINDTODEVICE does not exist;"

1453

" cannot bind to interface %s",

1208

logger.error(u"SO_BINDTODEVICE does not exist;"

1209

u" cannot bind to interface %s",

1454

1210

self.interface)

1455

1211

else:

1456

1212

try:

1457

1213

self.socket.setsockopt(socket.SOL_SOCKET,

1458

1214

SO_BINDTODEVICE,

1459

1215

str(self.interface

1460

+ '\0'))

1461

except socket.error as error:

1216

+ u'\0'))

1217

except socket.error, error:

1462

1218

if error[0] == errno.EPERM:

1463

logger.error("No permission to"

1464

" bind to interface %s",

1219

logger.error(u"No permission to"

1220

u" bind to interface %s",

1465

1221

self.interface)

1466

1222

elif error[0] == errno.ENOPROTOOPT:

1467

logger.error("SO_BINDTODEVICE not available;"

1468

" cannot bind to interface %s",

1223

logger.error(u"SO_BINDTODEVICE not available;"

1224

u" cannot bind to interface %s",

1469

1225

self.interface)

1470

1226

else:

1471

1227

raise

1473

1229

if self.server_address[0] or self.server_address[1]:

1474

1230

if not self.server_address[0]:

1475

1231

if self.address_family == socket.AF_INET6:

1476

any_address = "::" # in6addr_any

1232

any_address = u"::" # in6addr_any

1477

1233

else:

1478

1234

any_address = socket.INADDR_ANY

1479

1235

self.server_address = (any_address,

1518

1274

return socketserver.TCPServer.server_activate(self)

1519

1275

def enable(self):

1520

1276

self.enabled = True

1521

def add_pipe(self, parent_pipe):

1277

def add_pipe_fds(self, child_pipe_fd, parent_pipe_fd):

1522

1278

# Call "handle_ipc" for both data and EOF events

1523

gobject.io_add_watch(parent_pipe.fileno(),

1279

gobject.io_add_watch(child_pipe_fd.fileno(),

1524

1280

gobject.IO_IN | gobject.IO_HUP,

1525

1281

functools.partial(self.handle_ipc,

1526

parent_pipe = parent_pipe))

1527

1528

def handle_ipc(self, source, condition, parent_pipe=None,

1529

client_object=None):

1282

reply = parent_pipe_fd,

1283

sender= child_pipe_fd))

1284

def handle_ipc(self, source, condition, reply=None, sender=None):

1530

1285

condition_names = {

1531

gobject.IO_IN: "IN", # There is data to read.

1532

gobject.IO_OUT: "OUT", # Data can be written (without

1286

gobject.IO_IN: u"IN", # There is data to read.

1287

gobject.IO_OUT: u"OUT", # Data can be written (without

1533

1288

# blocking).

1534

gobject.IO_PRI: "PRI", # There is urgent data to read.

1535

gobject.IO_ERR: "ERR", # Error condition.

1536

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1289

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1290

gobject.IO_ERR: u"ERR", # Error condition.

1291

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1537

1292

# broken, usually for pipes and

1538

1293

# sockets).

1539

1294

}

1541

1296

for cond, name in

1542

1297

condition_names.iteritems()

1543

1298

if cond & condition)

1544

# error or the other end of multiprocessing.Pipe has closed

1545

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1546

return False

1547

1548

# Read a request from the child

1549

request = parent_pipe.recv()

1550

command = request[0]

1551

1552

if command == 'init':

1553

fpr = request[1]

1554

address = request[2]

1555

1556

for c in self.clients:

1557

if c.fingerprint == fpr:

1558

client = c

1559

break

1560

else:

1561

logger.info("Client not found for fingerprint: %s, ad"

1562

"dress: %s", fpr, address)

1563

if self.use_dbus:

1564

# Emit D-Bus signal

1565

mandos_dbus_service.ClientNotFound(fpr, address[0])

1566

parent_pipe.send(False)

1567

return False

1568

1569

gobject.io_add_watch(parent_pipe.fileno(),

1570

gobject.IO_IN | gobject.IO_HUP,

1571

functools.partial(self.handle_ipc,

1572

parent_pipe = parent_pipe,

1573

client_object = client))

1574

parent_pipe.send(True)

1575

# remove the old hook in favor of the new above hook on same fileno

1576

return False

1577

if command == 'funcall':

1578

funcname = request[1]

1579

args = request[2]

1580

kwargs = request[3]

1581

1582

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1583

1584

if command == 'getattr':

1585

attrname = request[1]

1586

if callable(client_object.__getattribute__(attrname)):

1587

parent_pipe.send(('function',))

1588

else:

1589

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1590

1591

if command == 'setattr':

1592

attrname = request[1]

1593

value = request[2]

1594

setattr(client_object, attrname, value)

1595

1299

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1300

conditions_string)

1301

1302

# Read a line from the file object

1303

cmdline = sender.readline()

1304

if not cmdline: # Empty line means end of file

1305

# close the IPC pipes

1306

sender.close()

1307

reply.close()

1308

1309

# Stop calling this function

1310

return False

1311

1312

logger.debug(u"IPC command: %r", cmdline)

1313

1314

# Parse and act on command

1315

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1316

1317

if cmd == u"NOTFOUND":

1318

fpr, address = args.split(None, 1)

1319

logger.warning(u"Client not found for fingerprint: %s, ad"

1320

u"dress: %s", fpr, address)

1321

if self.use_dbus:

1322

# Emit D-Bus signal

1323

mandos_dbus_service.ClientNotFound(fpr, address)

1324

elif cmd == u"DISABLED":

1325

for client in self.clients:

1326

if client.name == args:

1327

logger.warning(u"Client %s is disabled", args)

1328

if self.use_dbus:

1329

# Emit D-Bus signal

1330

client.Rejected()

1331

break

1332

else:

1333

logger.error(u"Unknown client %s is disabled", args)

1334

elif cmd == u"SENDING":

1335

for client in self.clients:

1336

if client.name == args:

1337

logger.info(u"Sending secret to %s", client.name)

1338

client.checked_ok()

1339

if self.use_dbus:

1340

# Emit D-Bus signal

1341

client.GotSecret()

1342

break

1343

else:

1344

logger.error(u"Sending secret to unknown client %s",

1345

args)

1346

elif cmd == u"GETATTR":

1347

attr_name, fpr = args.split(None, 1)

1348

for client in self.clients:

1349

if client.fingerprint == fpr:

1350

attr_value = getattr(client, attr_name, None)

1351

logger.debug("IPC reply: %r", attr_value)

1352

pickle.dump(attr_value, reply)

1353

break

1354

else:

1355

logger.error(u"Client %s on address %s requesting "

1356

u"attribute %s not found", fpr, address,

1357

attr_name)

1358

pickle.dump(None, reply)

1359

else:

1360

logger.error(u"Unknown IPC command: %r", cmdline)

1361

1362

# Keep calling this function

1596

1363

return True

1597

1364

1598

1365

1599

1366

def string_to_delta(interval):

1600

1367

"""Parse a string and return a datetime.timedelta

1601

1368

1602

>>> string_to_delta('7d')

1369

>>> string_to_delta(u'7d')

1603

1370

datetime.timedelta(7)

1604

>>> string_to_delta('60s')

1371

>>> string_to_delta(u'60s')

1605

1372

datetime.timedelta(0, 60)

1606

>>> string_to_delta('60m')

1373

>>> string_to_delta(u'60m')

1607

1374

datetime.timedelta(0, 3600)

1608

>>> string_to_delta('24h')

1375

>>> string_to_delta(u'24h')

1609

1376

datetime.timedelta(1)

1610

>>> string_to_delta('1w')

1377

>>> string_to_delta(u'1w')

1611

1378

datetime.timedelta(7)

1612

>>> string_to_delta('5m 30s')

1379

>>> string_to_delta(u'5m 30s')

1613

1380

datetime.timedelta(0, 330)

1614

1381

"""

1615

1382

timevalue = datetime.timedelta(0)

1617

1384

try:

1618

1385

suffix = unicode(s[-1])

1619

1386

value = int(s[:-1])

1620

if suffix == "d":

1387

if suffix == u"d":

1621

1388

delta = datetime.timedelta(value)

1622

elif suffix == "s":

1389

elif suffix == u"s":

1623

1390

delta = datetime.timedelta(0, value)

1624

elif suffix == "m":

1391

elif suffix == u"m":

1625

1392

delta = datetime.timedelta(0, 0, 0, 0, value)

1626

elif suffix == "h":

1393

elif suffix == u"h":

1627

1394

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1628

elif suffix == "w":

1395

elif suffix == u"w":

1629

1396

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1630

1397

else:

1631

raise ValueError("Unknown suffix %r" % suffix)

1632

except (ValueError, IndexError) as e:

1633

raise ValueError(*(e.args))

1398

raise ValueError(u"Unknown suffix %r" % suffix)

1399

except (ValueError, IndexError), e:

1400

raise ValueError(e.message)

1634

1401

timevalue += delta

1635

1402

return timevalue

1636

1403

1642

1409

global if_nametoindex

1643

1410

try:

1644

1411

if_nametoindex = (ctypes.cdll.LoadLibrary

1645

(ctypes.util.find_library("c"))

1412

(ctypes.util.find_library(u"c"))

1646

1413

.if_nametoindex)

1647

1414

except (OSError, AttributeError):

1648

logger.warning("Doing if_nametoindex the hard way")

1415

logger.warning(u"Doing if_nametoindex the hard way")

1649

1416

def if_nametoindex(interface):

1650

1417

"Get an interface index the hard way, i.e. using fcntl()"

1651

1418

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1652

1419

with contextlib.closing(socket.socket()) as s:

1653

1420

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1654

struct.pack(str("16s16x"),

1421

struct.pack(str(u"16s16x"),

1655

1422

interface))

1656

interface_index = struct.unpack(str("I"),

1423

interface_index = struct.unpack(str(u"I"),

1657

1424

ifreq[16:20])[0]

1658

1425

return interface_index

1659

1426

return if_nametoindex(interface)

1667

1434

sys.exit()

1668

1435

os.setsid()

1669

1436

if not nochdir:

1670

os.chdir("/")

1437

os.chdir(u"/")

1671

1438

if os.fork():

1672

1439

sys.exit()

1673

1440

if not noclose:

1675

1442

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1676

1443

if not stat.S_ISCHR(os.fstat(null).st_mode):

1677

1444

raise OSError(errno.ENODEV,

1678

"%s not a character device"

1445

u"%s not a character device"

1679

1446

% os.path.devnull)

1680

1447

os.dup2(null, sys.stdin.fileno())

1681

1448

os.dup2(null, sys.stdout.fileno())

1689

1456

##################################################################

1690

1457

# Parsing of options, both command line and config file

1691

1458

1692

parser = argparse.ArgumentParser()

1693

parser.add_argument("-v", "--version", action="version",

1694

version = "%%(prog)s %s" % version,

1695

help="show version number and exit")

1696

parser.add_argument("-i", "--interface", metavar="IF",

1697

help="Bind to interface IF")

1698

parser.add_argument("-a", "--address",

1699

help="Address to listen for requests on")

1700

parser.add_argument("-p", "--port", type=int,

1701

help="Port number to receive requests on")

1702

parser.add_argument("--check", action="store_true",

1703

help="Run self-test")

1704

parser.add_argument("--debug", action="store_true",

1705

help="Debug mode; run in foreground and log"

1706

" to terminal")

1707

parser.add_argument("--debuglevel", metavar="LEVEL",

1708

help="Debug level for stdout output")

1709

parser.add_argument("--priority", help="GnuTLS"

1710

" priority string (see GnuTLS documentation)")

1711

parser.add_argument("--servicename",

1712

metavar="NAME", help="Zeroconf service name")

1713

parser.add_argument("--configdir",

1714

default="/etc/mandos", metavar="DIR",

1715

help="Directory to search for configuration"

1716

" files")

1717

parser.add_argument("--no-dbus", action="store_false",

1718

dest="use_dbus", help="Do not provide D-Bus"

1719

" system bus interface")

1720

parser.add_argument("--no-ipv6", action="store_false",

1721

dest="use_ipv6", help="Do not use IPv6")

1722

options = parser.parse_args()

1459

parser = optparse.OptionParser(version = "%%prog %s" % version)

1460

parser.add_option("-i", u"--interface", type=u"string",

1461

metavar="IF", help=u"Bind to interface IF")

1462

parser.add_option("-a", u"--address", type=u"string",

1463

help=u"Address to listen for requests on")

1464

parser.add_option("-p", u"--port", type=u"int",

1465

help=u"Port number to receive requests on")

1466

parser.add_option("--check", action=u"store_true",

1467

help=u"Run self-test")

1468

parser.add_option("--debug", action=u"store_true",

1469

help=u"Debug mode; run in foreground and log to"

1470

u" terminal")

1471

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1472

u" priority string (see GnuTLS documentation)")

1473

parser.add_option("--servicename", type=u"string",

1474

metavar=u"NAME", help=u"Zeroconf service name")

1475

parser.add_option("--configdir", type=u"string",

1476

default=u"/etc/mandos", metavar=u"DIR",

1477

help=u"Directory to search for configuration"

1478

u" files")

1479

parser.add_option("--no-dbus", action=u"store_false",

1480

dest=u"use_dbus", help=u"Do not provide D-Bus"

1481

u" system bus interface")

1482

parser.add_option("--no-ipv6", action=u"store_false",

1483

dest=u"use_ipv6", help=u"Do not use IPv6")

1484

options = parser.parse_args()[0]

1723

1485

1724

1486

if options.check:

1725

1487

import doctest

1727

1489

sys.exit()

1728

1490

1729

1491

# Default values for config file for server-global settings

1730

server_defaults = { "interface": "",

1731

"address": "",

1732

"port": "",

1733

"debug": "False",

1734

"priority":

1735

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1736

"servicename": "Mandos",

1737

"use_dbus": "True",

1738

"use_ipv6": "True",

1739

"debuglevel": "",

1492

server_defaults = { u"interface": u"",

1493

u"address": u"",

1494

u"port": u"",

1495

u"debug": u"False",

1496

u"priority":

1497

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1498

u"servicename": u"Mandos",

1499

u"use_dbus": u"True",

1500

u"use_ipv6": u"True",

1740

1501

}

1741

1502

1742

1503

# Parse config file for server-global settings

1743

1504

server_config = configparser.SafeConfigParser(server_defaults)

1744

1505

del server_defaults

1745

1506

server_config.read(os.path.join(options.configdir,

1746

"mandos.conf"))

1507

u"mandos.conf"))

1747

1508

# Convert the SafeConfigParser object to a dict

1748

1509

server_settings = server_config.defaults()

1749

1510

# Use the appropriate methods on the non-string config options

1750

for option in ("debug", "use_dbus", "use_ipv6"):

1751

server_settings[option] = server_config.getboolean("DEFAULT",

1511

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1512

server_settings[option] = server_config.getboolean(u"DEFAULT",

1752

1513

option)

1753

1514

if server_settings["port"]:

1754

server_settings["port"] = server_config.getint("DEFAULT",

1755

"port")

1515

server_settings["port"] = server_config.getint(u"DEFAULT",

1516

u"port")

1756

1517

del server_config

1757

1518

1758

1519

# Override the settings from the config file with command line

1759

1520

# options, if set.

1760

for option in ("interface", "address", "port", "debug",

1761

"priority", "servicename", "configdir",

1762

"use_dbus", "use_ipv6", "debuglevel"):

1521

for option in (u"interface", u"address", u"port", u"debug",

1522

u"priority", u"servicename", u"configdir",

1523

u"use_dbus", u"use_ipv6"):

1763

1524

value = getattr(options, option)

1764

1525

if value is not None:

1765

1526

server_settings[option] = value

1773

1534

##################################################################

1774

1535

1775

1536

# For convenience

1776

debug = server_settings["debug"]

1777

debuglevel = server_settings["debuglevel"]

1778

use_dbus = server_settings["use_dbus"]

1779

use_ipv6 = server_settings["use_ipv6"]

1780

1781

if server_settings["servicename"] != "Mandos":

1537

debug = server_settings[u"debug"]

1538

use_dbus = server_settings[u"use_dbus"]

1539

use_ipv6 = server_settings[u"use_ipv6"]

1540

1541

if not debug:

1542

syslogger.setLevel(logging.WARNING)

1543

console.setLevel(logging.WARNING)

1544

1545

if server_settings[u"servicename"] != u"Mandos":

1782

1546

syslogger.setFormatter(logging.Formatter

1783

('Mandos (%s) [%%(process)d]:'

1784

' %%(levelname)s: %%(message)s'

1785

% server_settings["servicename"]))

1547

(u'Mandos (%s) [%%(process)d]:'

1548

u' %%(levelname)s: %%(message)s'

1549

% server_settings[u"servicename"]))

1786

1550

1787

1551

# Parse config file with clients

1788

client_defaults = { "timeout": "5m",

1789

"extended_timeout": "15m",

1790

"interval": "2m",

1791

"checker": "fping -q -- %%(host)s",

1792

"host": "",

1793

"approval_delay": "0s",

1794

"approval_duration": "1s",

1552

client_defaults = { u"timeout": u"1h",

1553

u"interval": u"5m",

1554

u"checker": u"fping -q -- %%(host)s",

1555

u"host": u"",

1795

1556

}

1796

1557

client_config = configparser.SafeConfigParser(client_defaults)

1797

client_config.read(os.path.join(server_settings["configdir"],

1798

"clients.conf"))

1558

client_config.read(os.path.join(server_settings[u"configdir"],

1559

u"clients.conf"))

1799

1560

1800

1561

global mandos_dbus_service

1801

1562

mandos_dbus_service = None

1802

1563

1803

tcp_server = MandosServer((server_settings["address"],

1804

server_settings["port"]),

1564

tcp_server = MandosServer((server_settings[u"address"],

1565

server_settings[u"port"]),

1805

1566

ClientHandler,

1806

interface=(server_settings["interface"]

1807

or None),

1567

interface=server_settings[u"interface"],

1808

1568

use_ipv6=use_ipv6,

1809

1569

gnutls_priority=

1810

server_settings["priority"],

1570

server_settings[u"priority"],

1811

1571

use_dbus=use_dbus)

1812

if not debug:

1813

pidfilename = "/var/run/mandos.pid"

1814

try:

1815

pidfile = open(pidfilename, "w")

1816

except IOError:

1817

logger.error("Could not open file %r", pidfilename)

1572

pidfilename = u"/var/run/mandos.pid"

1573

try:

1574

pidfile = open(pidfilename, u"w")

1575

except IOError:

1576

logger.error(u"Could not open file %r", pidfilename)

1818

1577

1819

1578

try:

1820

uid = pwd.getpwnam("_mandos").pw_uid

1821

gid = pwd.getpwnam("_mandos").pw_gid

1579

uid = pwd.getpwnam(u"_mandos").pw_uid

1580

gid = pwd.getpwnam(u"_mandos").pw_gid

1822

1581

except KeyError:

1823

1582

try:

1824

uid = pwd.getpwnam("mandos").pw_uid

1825

gid = pwd.getpwnam("mandos").pw_gid

1583

uid = pwd.getpwnam(u"mandos").pw_uid

1584

gid = pwd.getpwnam(u"mandos").pw_gid

1826

1585

except KeyError:

1827

1586

try:

1828

uid = pwd.getpwnam("nobody").pw_uid

1829

gid = pwd.getpwnam("nobody").pw_gid

1587

uid = pwd.getpwnam(u"nobody").pw_uid

1588

gid = pwd.getpwnam(u"nobody").pw_gid

1830

1589

except KeyError:

1831

1590

uid = 65534

1832

1591

gid = 65534

1833

1592

try:

1834

1593

os.setgid(gid)

1835

1594

os.setuid(uid)

1836

except OSError as error:

1595

except OSError, error:

1837

1596

if error[0] != errno.EPERM:

1838

1597

raise error

1839

1598

1840

if not debug and not debuglevel:

1841

syslogger.setLevel(logging.WARNING)

1842

console.setLevel(logging.WARNING)

1843

if debuglevel:

1844

level = getattr(logging, debuglevel.upper())

1845

syslogger.setLevel(level)

1846

console.setLevel(level)

1847

1599

# Enable all possible GnuTLS debugging

1848

1600

if debug:

1849

# Enable all possible GnuTLS debugging

1850

1851

1601

# "Use a log level over 10 to enable all debugging options."

1852

1602

# - GnuTLS manual

1853

1603

gnutls.library.functions.gnutls_global_set_log_level(11)

1854

1604

1855

1605

@gnutls.library.types.gnutls_log_func

1856

1606

def debug_gnutls(level, string):

1857

logger.debug("GnuTLS: %s", string[:-1])

1607

logger.debug(u"GnuTLS: %s", string[:-1])

1858

1608

1859

1609

(gnutls.library.functions

1860

1610

.gnutls_global_set_log_function(debug_gnutls))

1861

1862

# Redirect stdin so all checkers get /dev/null

1863

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1864

os.dup2(null, sys.stdin.fileno())

1865

if null > 2:

1866

os.close(null)

1867

else:

1868

# No console logging

1869

logger.removeHandler(console)

1870

1871

# Need to fork before connecting to D-Bus

1872

if not debug:

1873

# Close all input and output, do double fork, etc.

1874

daemon()

1875

1611

1876

1612

global main_loop

1877

1613

# From the Avahi example code

1881

1617

# End of Avahi example code

1882

1618

if use_dbus:

1883

1619

try:

1884

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1620

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1885

1621

bus, do_not_queue=True)

1886

except dbus.exceptions.NameExistsException as e:

1887

logger.error(unicode(e) + ", disabling D-Bus")

1622

except dbus.exceptions.NameExistsException, e:

1623

logger.error(unicode(e) + u", disabling D-Bus")

1888

1624

use_dbus = False

1889

server_settings["use_dbus"] = False

1625

server_settings[u"use_dbus"] = False

1890

1626

tcp_server.use_dbus = False

1891

1627

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1892

service = AvahiService(name = server_settings["servicename"],

1893

servicetype = "_mandos._tcp",

1628

service = AvahiService(name = server_settings[u"servicename"],

1629

servicetype = u"_mandos._tcp",

1894

1630

protocol = protocol, bus = bus)

1895

1631

if server_settings["interface"]:

1896

1632

service.interface = (if_nametoindex

1897

(str(server_settings["interface"])))

1898

1899

global multiprocessing_manager

1900

multiprocessing_manager = multiprocessing.Manager()

1633

(str(server_settings[u"interface"])))

1901

1634

1902

1635

client_class = Client

1903

1636

if use_dbus:

1904

1637

client_class = functools.partial(ClientDBus, bus = bus)

1905

def client_config_items(config, section):

1906

special_settings = {

1907

"approved_by_default":

1908

lambda: config.getboolean(section,

1909

"approved_by_default"),

1910

}

1911

for name, value in config.items(section):

1912

try:

1913

yield (name, special_settings[name]())

1914

except KeyError:

1915

yield (name, value)

1916

1917

1638

tcp_server.clients.update(set(

1918

1639

client_class(name = section,

1919

config= dict(client_config_items(

1920

client_config, section)))

1640

config= dict(client_config.items(section)))

1921

1641

for section in client_config.sections()))

1922

1642

if not tcp_server.clients:

1923

logger.warning("No clients defined")

1924

1643

logger.warning(u"No clients defined")

1644

1645

if debug:

1646

# Redirect stdin so all checkers get /dev/null

1647

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1648

os.dup2(null, sys.stdin.fileno())

1649

if null > 2:

1650

os.close(null)

1651

else:

1652

# No console logging

1653

logger.removeHandler(console)

1654

# Close all input and output, do double fork, etc.

1655

daemon()

1656

1657

try:

1658

with pidfile:

1659

pid = os.getpid()

1660

pidfile.write(str(pid) + "\n")

1661

del pidfile

1662

except IOError:

1663

logger.error(u"Could not write to file %r with PID %d",

1664

pidfilename, pid)

1665

except NameError:

1666

# "pidfile" was never created

1667

pass

1668

del pidfilename

1669

1925

1670

if not debug:

1926

try:

1927

with pidfile:

1928

pid = os.getpid()

1929

pidfile.write(str(pid) + "\n".encode("utf-8"))

1930

del pidfile

1931

except IOError:

1932

logger.error("Could not write to file %r with PID %d",

1933

pidfilename, pid)

1934

except NameError:

1935

# "pidfile" was never created

1936

pass

1937

del pidfilename

1938

1939

1671

signal.signal(signal.SIGINT, signal.SIG_IGN)

1940

1941

1672

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1942

1673

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1943

1674

1945

1676

class MandosDBusService(dbus.service.Object):

1946

1677

"""A D-Bus proxy object"""

1947

1678

def __init__(self):

1948

dbus.service.Object.__init__(self, bus, "/")

1949

_interface = "se.bsnet.fukt.Mandos"

1679

dbus.service.Object.__init__(self, bus, u"/")

1680

_interface = u"se.bsnet.fukt.Mandos"

1950

1681

1951

@dbus.service.signal(_interface, signature="o")

1682

@dbus.service.signal(_interface, signature=u"o")

1952

1683

def ClientAdded(self, objpath):

1953

1684

"D-Bus signal"

1954

1685

pass

1955

1686

1956

@dbus.service.signal(_interface, signature="ss")

1687

@dbus.service.signal(_interface, signature=u"ss")

1957

1688

def ClientNotFound(self, fingerprint, address):

1958

1689

"D-Bus signal"

1959

1690

pass

1960

1691

1961

@dbus.service.signal(_interface, signature="os")

1692

@dbus.service.signal(_interface, signature=u"os")

1962

1693

def ClientRemoved(self, objpath, name):

1963

1694

"D-Bus signal"

1964

1695

pass

1965

1696

1966

@dbus.service.method(_interface, out_signature="ao")

1697

@dbus.service.method(_interface, out_signature=u"ao")

1967

1698

def GetAllClients(self):

1968

1699

"D-Bus method"

1969

1700

return dbus.Array(c.dbus_object_path

1970

1701

for c in tcp_server.clients)

1971

1702

1972

1703

@dbus.service.method(_interface,

1973

out_signature="a{oa{sv}}")

1704

out_signature=u"a{oa{sv}}")

1974

1705

def GetAllClientsWithProperties(self):

1975

1706

"D-Bus method"

1976

1707

return dbus.Dictionary(

1977

((c.dbus_object_path, c.GetAll(""))

1708

((c.dbus_object_path, c.GetAll(u""))

1978

1709

for c in tcp_server.clients),

1979

signature="oa{sv}")

1710

signature=u"oa{sv}")

1980

1711

1981

@dbus.service.method(_interface, in_signature="o")

1712

@dbus.service.method(_interface, in_signature=u"o")

1982

1713

def RemoveClient(self, object_path):

1983

1714

"D-Bus method"

1984

1715

for c in tcp_server.clients:

2026

1757

# Find out what port we got

2027

1758

service.port = tcp_server.socket.getsockname()[1]

2028

1759

if use_ipv6:

2029

logger.info("Now listening on address %r, port %d,"

1760

logger.info(u"Now listening on address %r, port %d,"

2030

1761

" flowinfo %d, scope_id %d"

2031

1762

% tcp_server.socket.getsockname())

2032

1763

else: # IPv4

2033

logger.info("Now listening on address %r, port %d"

1764

logger.info(u"Now listening on address %r, port %d"

2034

1765

% tcp_server.socket.getsockname())

2035

1766

2036

1767

#service.interface = tcp_server.socket.getsockname()[3]

2039

1770

# From the Avahi example code

2040

1771

try:

2041

1772

service.activate()

2042

except dbus.exceptions.DBusException as error:

2043

logger.critical("DBusException: %s", error)

1773

except dbus.exceptions.DBusException, error:

1774

logger.critical(u"DBusException: %s", error)

2044

1775

cleanup()

2045

1776

sys.exit(1)

2046

1777

# End of Avahi example code

2050

1781

(tcp_server.handle_request

2051

1782

(*args[2:], **kwargs) or True))

2052

1783

2053

logger.debug("Starting main loop")

1784

logger.debug(u"Starting main loop")

2054

1785

main_loop.run()

2055

except AvahiError as error:

2056

logger.critical("AvahiError: %s", error)

1786

except AvahiError, error:

1787

logger.critical(u"AvahiError: %s", error)

2057

1788

cleanup()

2058

1789

sys.exit(1)

2059

1790

except KeyboardInterrupt:

2060

1791

if debug:

2061

print("", file=sys.stderr)

2062

logger.debug("Server received KeyboardInterrupt")

2063

logger.debug("Server exiting")

1792

print >> sys.stderr

1793

logger.debug(u"Server received KeyboardInterrupt")

1794

logger.debug(u"Server exiting")

2064

1795

# Must run before the D-Bus bus name gets deregistered

2065

1796

cleanup()

2066

1797

2067

2068

1798

if __name__ == '__main__':

2069

1799

main()