/mandos/trunk : revision 431

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

34

from __future__ import division, with_statement, absolute_import

36

35

37

36

import SocketServer as socketserver

38

37

import socket

39

import argparse

38

import optparse

40

39

import datetime

41

40

import errno

42

41

import gnutls.crypto

82

81

SO_BINDTODEVICE = None

83

82

84

83

85

version = "1.3.0"

84

version = "1.0.14"

86

85

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

89

88

syslogger = (logging.handlers.SysLogHandler

90

89

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

91

address = str("/dev/log")))

90

address = "/dev/log"))

92

91

syslogger.setFormatter(logging.Formatter

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

95

94

logger.addHandler(syslogger)

96

95

97

96

console = logging.StreamHandler()

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

101

100

logger.addHandler(console)

102

101

103

102

class AvahiError(Exception):

120

119

Attributes:

121

120

interface: integer; avahi.IF_UNSPEC or an interface index.

122

121

Used to optionally bind to the specified interface.

123

124

type: string; Example: '_mandos._tcp'.

122

123

type: string; Example: u'_mandos._tcp'.

125

124

See <http://www.dns-sd.org/ServiceTypes.html>

126

125

port: integer; what port to announce

127

126

TXT: list of strings; TXT record for the service

136

135

"""

137

136

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

138

137

servicetype = None, port = None, TXT = None,

139

domain = "", host = "", max_renames = 32768,

138

domain = u"", host = u"", max_renames = 32768,

140

139

protocol = avahi.PROTO_UNSPEC, bus = None):

141

140

self.interface = interface

142

141

self.name = name

154

153

def rename(self):

155

154

"""Derived from the Avahi example code"""

156

155

if self.rename_count >= self.max_renames:

157

logger.critical("No suitable Zeroconf service name found"

158

" after %i retries, exiting.",

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

159

158

self.rename_count)

160

raise AvahiServiceError("Too many renames")

159

raise AvahiServiceError(u"Too many renames")

161

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

162

logger.info("Changing Zeroconf service name to %r ...",

161

logger.info(u"Changing Zeroconf service name to %r ...",

163

162

self.name)

164

163

syslogger.setFormatter(logging.Formatter

165

('Mandos (%s) [%%(process)d]:'

166

' %%(levelname)s: %%(message)s'

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

167

166

% self.name))

168

167

self.remove()

169

168

try:

170

169

self.add()

171

170

except dbus.exceptions.DBusException, error:

172

logger.critical("DBusException: %s", error)

171

logger.critical(u"DBusException: %s", error)

173

172

self.cleanup()

174

173

os._exit(1)

175

174

self.rename_count += 1

187

186

self.group.connect_to_signal('StateChanged',

188

187

self

189

188

.entry_group_state_changed)

190

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

191

190

self.name, self.type)

192

191

self.group.AddService(

193

192

self.interface,

200

199

self.group.Commit()

201

200

def entry_group_state_changed(self, state, error):

202

201

"""Derived from the Avahi example code"""

203

logger.debug("Avahi entry group state change: %i", state)

202

logger.debug(u"Avahi entry group state change: %i", state)

204

203

205

204

if state == avahi.ENTRY_GROUP_ESTABLISHED:

206

logger.debug("Zeroconf service established.")

205

logger.debug(u"Zeroconf service established.")

207

206

elif state == avahi.ENTRY_GROUP_COLLISION:

208

logger.info("Zeroconf service name collision.")

207

logger.warning(u"Zeroconf service name collision.")

209

208

self.rename()

210

209

elif state == avahi.ENTRY_GROUP_FAILURE:

211

logger.critical("Avahi: Error in group state changed %s",

210

logger.critical(u"Avahi: Error in group state changed %s",

212

211

unicode(error))

213

raise AvahiGroupError("State changed: %s"

212

raise AvahiGroupError(u"State changed: %s"

214

213

% unicode(error))

215

214

def cleanup(self):

216

215

"""Derived from the Avahi example code"""

219

218

self.group = None

220

219

def server_state_changed(self, state):

221

220

"""Derived from the Avahi example code"""

222

logger.debug("Avahi server state change: %i", state)

221

logger.debug(u"Avahi server state change: %i", state)

223

222

if state == avahi.SERVER_COLLISION:

224

logger.error("Zeroconf server name collision")

223

logger.error(u"Zeroconf server name collision")

225

224

self.remove()

226

225

elif state == avahi.SERVER_RUNNING:

227

226

self.add()

232

231

self.bus.get_object(avahi.DBUS_NAME,

233

232

avahi.DBUS_PATH_SERVER),

234

233

avahi.DBUS_INTERFACE_SERVER)

235

self.server.connect_to_signal("StateChanged",

234

self.server.connect_to_signal(u"StateChanged",

236

235

self.server_state_changed)

237

236

self.server_state_changed(self.server.GetState())

238

237

241

240

"""A representation of a client host served by this server.

242

241

243

242

Attributes:

244

_approved: bool(); 'None' if not yet approved/disapproved

245

approval_delay: datetime.timedelta(); Time to wait for approval

246

approval_duration: datetime.timedelta(); Duration of one approval

243

244

D-Bus identifiers

245

fingerprint: string (40 or 32 hexadecimal digits); used to

246

uniquely identify the client

247

secret: bytestring; sent verbatim (over TLS) to client

248

host: string; available for use by the checker command

249

created: datetime.datetime(); (UTC) object creation

250

last_enabled: datetime.datetime(); (UTC)

251

enabled: bool()

252

last_checked_ok: datetime.datetime(); (UTC) or None

253

timeout: datetime.timedelta(); How long from last_checked_ok

254

until this client is disabled

255

interval: datetime.timedelta(); How often to start a new checker

256

disable_hook: If set, called by disable() as disable_hook(self)

247

257

checker: subprocess.Popen(); a running checker process used

248

258

to see if the client lives.

249

259

'None' if no process is running.

250

checker_callback_tag: a gobject event source tag, or None

251

checker_command: string; External command which is run to check

252

if client lives. %() expansions are done at

260

checker_initiator_tag: a gobject event source tag, or None

261

disable_initiator_tag: - '' -

262

checker_callback_tag: - '' -

263

checker_command: string; External command which is run to check if

264

client lives. %() expansions are done at

253

265

runtime with vars(self) as dict, so that for

254

266

instance %(name)s can be used in the command.

255

checker_initiator_tag: a gobject event source tag, or None

256

created: datetime.datetime(); (UTC) object creation

257

267

current_checker_command: string; current running checker_command

258

disable_hook: If set, called by disable() as disable_hook(self)

259

disable_initiator_tag: a gobject event source tag, or None

260

enabled: bool()

261

fingerprint: string (40 or 32 hexadecimal digits); used to

262

uniquely identify the client

263

host: string; available for use by the checker command

264

interval: datetime.timedelta(); How often to start a new checker

265

last_approval_request: datetime.datetime(); (UTC) or None

266

last_checked_ok: datetime.datetime(); (UTC) or None

267

last_enabled: datetime.datetime(); (UTC)

268

269

D-Bus identifiers

270

secret: bytestring; sent verbatim (over TLS) to client

271

timeout: datetime.timedelta(); How long from last_checked_ok

272

until this client is disabled

273

runtime_expansions: Allowed attributes for runtime expansion.

268

approval_delay: datetime.timedelta(); Time to wait for approval

269

_approved: bool(); 'None' if not yet approved/disapproved

270

approval_duration: datetime.timedelta(); Duration of one approval

274

271

"""

275

272

276

runtime_expansions = ("approval_delay", "approval_duration",

277

"created", "enabled", "fingerprint",

278

"host", "interval", "last_checked_ok",

279

"last_enabled", "name", "timeout")

280

281

273

@staticmethod

282

274

def _timedelta_to_milliseconds(td):

283

275

"Convert a datetime.timedelta() to milliseconds"

303

295

self.name = name

304

296

if config is None:

305

297

config = {}

306

logger.debug("Creating client %r", self.name)

298

logger.debug(u"Creating client %r", self.name)

307

299

# Uppercase and remove spaces from fingerprint for later

308

300

# comparison purposes with return value from the fingerprint()

309

301

# function

310

self.fingerprint = (config["fingerprint"].upper()

311

.replace(" ", ""))

312

logger.debug(" Fingerprint: %s", self.fingerprint)

313

if "secret" in config:

314

self.secret = config["secret"].decode("base64")

315

elif "secfile" in config:

302

self.fingerprint = (config[u"fingerprint"].upper()

303

.replace(u" ", u""))

304

logger.debug(u" Fingerprint: %s", self.fingerprint)

305

if u"secret" in config:

306

self.secret = config[u"secret"].decode(u"base64")

307

elif u"secfile" in config:

316

308

with open(os.path.expanduser(os.path.expandvars

317

(config["secfile"])),

309

(config[u"secfile"])),

318

310

"rb") as secfile:

319

311

self.secret = secfile.read()

320

312

else:

321

raise TypeError("No secret or secfile for client %s"

313

raise TypeError(u"No secret or secfile for client %s"

322

314

% self.name)

323

self.host = config.get("host", "")

315

self.host = config.get(u"host", u"")

324

316

self.created = datetime.datetime.utcnow()

325

317

self.enabled = False

326

self.last_approval_request = None

327

318

self.last_enabled = None

328

319

self.last_checked_ok = None

329

self.timeout = string_to_delta(config["timeout"])

330

self.interval = string_to_delta(config["interval"])

320

self.timeout = string_to_delta(config[u"timeout"])

321

self.interval = string_to_delta(config[u"interval"])

331

322

self.disable_hook = disable_hook

332

323

self.checker = None

333

324

self.checker_initiator_tag = None

334

325

self.disable_initiator_tag = None

335

326

self.checker_callback_tag = None

336

self.checker_command = config["checker"]

327

self.checker_command = config[u"checker"]

337

328

self.current_checker_command = None

338

329

self.last_connect = None

339

330

self._approved = None

340

self.approved_by_default = config.get("approved_by_default",

331

self.approved_by_default = config.get(u"approved_by_default",

341

332

True)

342

333

self.approvals_pending = 0

343

334

self.approval_delay = string_to_delta(

344

config["approval_delay"])

335

config[u"approval_delay"])

345

336

self.approval_duration = string_to_delta(

346

config["approval_duration"])

337

config[u"approval_duration"])

347

338

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

348

339

349

340

def send_changedstate(self):

353

344

354

345

def enable(self):

355

346

"""Start this client's checker and timeout hooks"""

356

if getattr(self, "enabled", False):

347

if getattr(self, u"enabled", False):

357

348

# Already enabled

358

349

return

359

350

self.send_changedstate()

378

369

if not quiet:

379

370

self.send_changedstate()

380

371

if not quiet:

381

logger.info("Disabling client %s", self.name)

382

if getattr(self, "disable_initiator_tag", False):

372

logger.info(u"Disabling client %s", self.name)

373

if getattr(self, u"disable_initiator_tag", False):

383

374

gobject.source_remove(self.disable_initiator_tag)

384

375

self.disable_initiator_tag = None

385

if getattr(self, "checker_initiator_tag", False):

376

if getattr(self, u"checker_initiator_tag", False):

386

377

gobject.source_remove(self.checker_initiator_tag)

387

378

self.checker_initiator_tag = None

388

379

self.stop_checker()

403

394

if os.WIFEXITED(condition):

404

395

exitstatus = os.WEXITSTATUS(condition)

405

396

if exitstatus == 0:

406

logger.info("Checker for %(name)s succeeded",

397

logger.info(u"Checker for %(name)s succeeded",

407

398

vars(self))

408

399

self.checked_ok()

409

400

else:

410

logger.info("Checker for %(name)s failed",

401

logger.info(u"Checker for %(name)s failed",

411

402

vars(self))

412

403

else:

413

logger.warning("Checker for %(name)s crashed?",

404

logger.warning(u"Checker for %(name)s crashed?",

414

405

vars(self))

415

406

416

407

def checked_ok(self):

425

416

(self.timeout_milliseconds(),

426

417

self.disable))

427

418

428

def need_approval(self):

429

self.last_approval_request = datetime.datetime.utcnow()

430

431

419

def start_checker(self):

432

420

"""Start a new checker subprocess if one is not running.

433

421

451

439

raise error

452

440

else:

453

441

if pid:

454

logger.warning("Checker was a zombie")

442

logger.warning(u"Checker was a zombie")

455

443

gobject.source_remove(self.checker_callback_tag)

456

444

self.checker_callback(pid, status,

457

445

self.current_checker_command)

462

450

command = self.checker_command % self.host

463

451

except TypeError:

464

452

# Escape attributes for the shell

465

escaped_attrs = dict(

466

(attr,

467

re.escape(unicode(str(getattr(self, attr, "")),

468

errors=

469

'replace')))

470

for attr in

471

self.runtime_expansions)

472

453

escaped_attrs = dict((key,

454

re.escape(unicode(str(val),

455

errors=

456

u'replace')))

457

for key, val in

458

vars(self).iteritems())

473

459

try:

474

460

command = self.checker_command % escaped_attrs

475

461

except TypeError, error:

476

logger.error('Could not format string "%s":'

477

' %s', self.checker_command, error)

462

logger.error(u'Could not format string "%s":'

463

u' %s', self.checker_command, error)

478

464

return True # Try again later

479

465

self.current_checker_command = command

480

466

try:

481

logger.info("Starting checker %r for %s",

467

logger.info(u"Starting checker %r for %s",

482

468

command, self.name)

483

469

# We don't need to redirect stdout and stderr, since

484

470

# in normal mode, that is already done by daemon(),

486

472

# always replaced by /dev/null.)

487

473

self.checker = subprocess.Popen(command,

488

474

close_fds=True,

489

shell=True, cwd="/")

475

shell=True, cwd=u"/")

490

476

self.checker_callback_tag = (gobject.child_watch_add

491

477

(self.checker.pid,

492

478

self.checker_callback,

498

484

gobject.source_remove(self.checker_callback_tag)

499

485

self.checker_callback(pid, status, command)

500

486

except OSError, error:

501

logger.error("Failed to start subprocess: %s",

487

logger.error(u"Failed to start subprocess: %s",

502

488

error)

503

489

# Re-run this periodically if run by gobject.timeout_add

504

490

return True

508

494

if self.checker_callback_tag:

509

495

gobject.source_remove(self.checker_callback_tag)

510

496

self.checker_callback_tag = None

511

if getattr(self, "checker", None) is None:

497

if getattr(self, u"checker", None) is None:

512

498

return

513

logger.debug("Stopping checker for %(name)s", vars(self))

499

logger.debug(u"Stopping checker for %(name)s", vars(self))

514

500

try:

515

501

os.kill(self.checker.pid, signal.SIGTERM)

516

502

#time.sleep(0.5)

521

507

raise

522

508

self.checker = None

523

509

524

def dbus_service_property(dbus_interface, signature="v",

525

access="readwrite", byte_arrays=False):

510

def dbus_service_property(dbus_interface, signature=u"v",

511

access=u"readwrite", byte_arrays=False):

526

512

"""Decorators for marking methods of a DBusObjectWithProperties to

527

513

become properties on the D-Bus.

528

514

535

521

"""

536

522

# Encoding deeply encoded byte arrays is not supported yet by the

537

523

# "Set" method, so we fail early here:

538

if byte_arrays and signature != "ay":

539

raise ValueError("Byte arrays not supported for non-'ay'"

540

" signature %r" % signature)

524

if byte_arrays and signature != u"ay":

525

raise ValueError(u"Byte arrays not supported for non-'ay'"

526

u" signature %r" % signature)

541

527

def decorator(func):

542

528

func._dbus_is_property = True

543

529

func._dbus_interface = dbus_interface

544

530

func._dbus_signature = signature

545

531

func._dbus_access = access

546

532

func._dbus_name = func.__name__

547

if func._dbus_name.endswith("_dbus_property"):

533

if func._dbus_name.endswith(u"_dbus_property"):

548

534

func._dbus_name = func._dbus_name[:-14]

549

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

535

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

550

536

return func

551

537

return decorator

552

538

580

566

581

567

@staticmethod

582

568

def _is_dbus_property(obj):

583

return getattr(obj, "_dbus_is_property", False)

569

return getattr(obj, u"_dbus_is_property", False)

584

570

585

571

def _get_all_dbus_properties(self):

586

572

"""Returns a generator of (name, attribute) pairs

594

580

property with the specified name and interface.

595

581

"""

596

582

for name in (property_name,

597

property_name + "_dbus_property"):

583

property_name + u"_dbus_property"):

598

584

prop = getattr(self, name, None)

599

585

if (prop is None

600

586

or not self._is_dbus_property(prop)

604

590

continue

605

591

return prop

606

592

# No such property

607

raise DBusPropertyNotFound(self.dbus_object_path + ":"

608

+ interface_name + "."

593

raise DBusPropertyNotFound(self.dbus_object_path + u":"

594

+ interface_name + u"."

609

595

+ property_name)

610

596

611

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

612

out_signature="v")

597

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

598

out_signature=u"v")

613

599

def Get(self, interface_name, property_name):

614

600

"""Standard D-Bus property Get() method, see D-Bus standard.

615

601

"""

616

602

prop = self._get_dbus_property(interface_name, property_name)

617

if prop._dbus_access == "write":

603

if prop._dbus_access == u"write":

618

604

raise DBusPropertyAccessException(property_name)

619

605

value = prop()

620

if not hasattr(value, "variant_level"):

606

if not hasattr(value, u"variant_level"):

621

607

return value

622

608

return type(value)(value, variant_level=value.variant_level+1)

623

609

624

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

625

611

def Set(self, interface_name, property_name, value):

626

612

"""Standard D-Bus property Set() method, see D-Bus standard.

627

613

"""

628

614

prop = self._get_dbus_property(interface_name, property_name)

629

if prop._dbus_access == "read":

615

if prop._dbus_access == u"read":

630

616

raise DBusPropertyAccessException(property_name)

631

if prop._dbus_get_args_options["byte_arrays"]:

617

if prop._dbus_get_args_options[u"byte_arrays"]:

632

618

# The byte_arrays option is not supported yet on

633

619

# signatures other than "ay".

634

if prop._dbus_signature != "ay":

620

if prop._dbus_signature != u"ay":

635

621

raise ValueError

636

622

value = dbus.ByteArray(''.join(unichr(byte)

637

623

for byte in value))

638

624

prop(value)

639

625

640

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

641

out_signature="a{sv}")

626

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

627

out_signature=u"a{sv}")

642

628

def GetAll(self, interface_name):

643

629

"""Standard D-Bus property GetAll() method, see D-Bus

644

630

standard.

652

638

# Interface non-empty but did not match

653

639

continue

654

640

# Ignore write-only properties

655

if prop._dbus_access == "write":

641

if prop._dbus_access == u"write":

656

642

continue

657

643

value = prop()

658

if not hasattr(value, "variant_level"):

644

if not hasattr(value, u"variant_level"):

659

645

all[name] = value

660

646

continue

661

647

all[name] = type(value)(value, variant_level=

662

648

value.variant_level+1)

663

return dbus.Dictionary(all, signature="sv")

649

return dbus.Dictionary(all, signature=u"sv")

664

650

665

651

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

666

out_signature="s",

652

out_signature=u"s",

667

653

path_keyword='object_path',

668

654

connection_keyword='connection')

669

655

def Introspect(self, object_path, connection):

674

660

try:

675

661

document = xml.dom.minidom.parseString(xmlstring)

676

662

def make_tag(document, name, prop):

677

e = document.createElement("property")

678

e.setAttribute("name", name)

679

e.setAttribute("type", prop._dbus_signature)

680

e.setAttribute("access", prop._dbus_access)

663

e = document.createElement(u"property")

664

e.setAttribute(u"name", name)

665

e.setAttribute(u"type", prop._dbus_signature)

666

e.setAttribute(u"access", prop._dbus_access)

681

667

return e

682

for if_tag in document.getElementsByTagName("interface"):

668

for if_tag in document.getElementsByTagName(u"interface"):

683

669

for tag in (make_tag(document, name, prop)

684

670

for name, prop

685

671

in self._get_all_dbus_properties()

686

672

if prop._dbus_interface

687

== if_tag.getAttribute("name")):

673

== if_tag.getAttribute(u"name")):

688

674

if_tag.appendChild(tag)

689

675

# Add the names to the return values for the

690

676

# "org.freedesktop.DBus.Properties" methods

691

if (if_tag.getAttribute("name")

692

== "org.freedesktop.DBus.Properties"):

693

for cn in if_tag.getElementsByTagName("method"):

694

if cn.getAttribute("name") == "Get":

695

for arg in cn.getElementsByTagName("arg"):

696

if (arg.getAttribute("direction")

697

== "out"):

698

arg.setAttribute("name", "value")

699

elif cn.getAttribute("name") == "GetAll":

700

for arg in cn.getElementsByTagName("arg"):

701

if (arg.getAttribute("direction")

702

== "out"):

703

arg.setAttribute("name", "props")

704

xmlstring = document.toxml("utf-8")

677

if (if_tag.getAttribute(u"name")

678

== u"org.freedesktop.DBus.Properties"):

679

for cn in if_tag.getElementsByTagName(u"method"):

680

if cn.getAttribute(u"name") == u"Get":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"value")

685

elif cn.getAttribute(u"name") == u"GetAll":

686

for arg in cn.getElementsByTagName(u"arg"):

687

if (arg.getAttribute(u"direction")

688

== u"out"):

689

arg.setAttribute(u"name", u"props")

690

xmlstring = document.toxml(u"utf-8")

705

691

document.unlink()

706

692

except (AttributeError, xml.dom.DOMException,

707

693

xml.parsers.expat.ExpatError), error:

708

logger.error("Failed to override Introspection method",

694

logger.error(u"Failed to override Introspection method",

709

695

error)

710

696

return xmlstring

711

697

717

703

dbus_object_path: dbus.ObjectPath

718

704

bus: dbus.SystemBus()

719

705

"""

720

721

runtime_expansions = (Client.runtime_expansions

722

+ ("dbus_object_path",))

723

724

706

# dbus.service.Object doesn't use super(), so we can't either.

725

707

726

708

def __init__(self, bus = None, *args, **kwargs):

729

711

Client.__init__(self, *args, **kwargs)

730

712

# Only now, when this client is initialized, can it show up on

731

713

# the D-Bus

732

client_object_name = unicode(self.name).translate(

733

{ord("."): ord("_"),

734

ord("-"): ord("_")})

735

714

self.dbus_object_path = (dbus.ObjectPath

736

("/clients/" + client_object_name))

715

(u"/clients/"

716

+ self.name.replace(u".", u"_")))

737

717

DBusObjectWithProperties.__init__(self, self.bus,

738

718

self.dbus_object_path)

739

719

746

726

if (hasattr(self, "dbus_object_path")

747

727

and bval is not bool(old_value)):

748

728

dbus_bool = dbus.Boolean(bval, variant_level=1)

749

self.PropertyChanged(dbus.String("ApprovalPending"),

729

self.PropertyChanged(dbus.String(u"ApprovalPending"),

750

730

dbus_bool)

751

731

752

732

approvals_pending = property(_get_approvals_pending,

760

740

variant_level=variant_level)

761

741

762

742

def enable(self):

763

oldstate = getattr(self, "enabled", False)

743

oldstate = getattr(self, u"enabled", False)

764

744

r = Client.enable(self)

765

745

if oldstate != self.enabled:

766

746

# Emit D-Bus signals

767

self.PropertyChanged(dbus.String("Enabled"),

747

self.PropertyChanged(dbus.String(u"Enabled"),

768

748

dbus.Boolean(True, variant_level=1))

769

749

self.PropertyChanged(

770

dbus.String("LastEnabled"),

750

dbus.String(u"LastEnabled"),

771

751

self._datetime_to_dbus(self.last_enabled,

772

752

variant_level=1))

773

753

return r

774

754

775

755

def disable(self, quiet = False):

776

oldstate = getattr(self, "enabled", False)

756

oldstate = getattr(self, u"enabled", False)

777

757

r = Client.disable(self, quiet=quiet)

778

758

if not quiet and oldstate != self.enabled:

779

759

# Emit D-Bus signal

780

self.PropertyChanged(dbus.String("Enabled"),

760

self.PropertyChanged(dbus.String(u"Enabled"),

781

761

dbus.Boolean(False, variant_level=1))

782

762

return r

783

763

786

766

self.remove_from_connection()

787

767

except LookupError:

788

768

pass

789

if hasattr(DBusObjectWithProperties, "__del__"):

769

if hasattr(DBusObjectWithProperties, u"__del__"):

790

770

DBusObjectWithProperties.__del__(self, *args, **kwargs)

791

771

Client.__del__(self, *args, **kwargs)

792

772

795

775

self.checker_callback_tag = None

796

776

self.checker = None

797

777

# Emit D-Bus signal

798

self.PropertyChanged(dbus.String("CheckerRunning"),

778

self.PropertyChanged(dbus.String(u"CheckerRunning"),

799

779

dbus.Boolean(False, variant_level=1))

800

780

if os.WIFEXITED(condition):

801

781

exitstatus = os.WEXITSTATUS(condition)

816

796

r = Client.checked_ok(self, *args, **kwargs)

817

797

# Emit D-Bus signal

818

798

self.PropertyChanged(

819

dbus.String("LastCheckedOK"),

799

dbus.String(u"LastCheckedOK"),

820

800

(self._datetime_to_dbus(self.last_checked_ok,

821

801

variant_level=1)))

822

802

return r

823

803

824

def need_approval(self, *args, **kwargs):

825

r = Client.need_approval(self, *args, **kwargs)

826

# Emit D-Bus signal

827

self.PropertyChanged(

828

dbus.String("LastApprovalRequest"),

829

(self._datetime_to_dbus(self.last_approval_request,

830

variant_level=1)))

831

return r

832

833

804

def start_checker(self, *args, **kwargs):

834

805

old_checker = self.checker

835

806

if self.checker is not None:

843

814

# Emit D-Bus signal

844

815

self.CheckerStarted(self.current_checker_command)

845

816

self.PropertyChanged(

846

dbus.String("CheckerRunning"),

817

dbus.String(u"CheckerRunning"),

847

818

dbus.Boolean(True, variant_level=1))

848

819

return r

849

820

850

821

def stop_checker(self, *args, **kwargs):

851

old_checker = getattr(self, "checker", None)

822

old_checker = getattr(self, u"checker", None)

852

823

r = Client.stop_checker(self, *args, **kwargs)

853

824

if (old_checker is not None

854

and getattr(self, "checker", None) is None):

855

self.PropertyChanged(dbus.String("CheckerRunning"),

825

and getattr(self, u"checker", None) is None):

826

self.PropertyChanged(dbus.String(u"CheckerRunning"),

856

827

dbus.Boolean(False, variant_level=1))

857

828

return r

858

829

869

840

870

841

871

842

## D-Bus methods, signals & properties

872

_interface = "se.bsnet.fukt.Mandos.Client"

843

_interface = u"se.bsnet.fukt.Mandos.Client"

873

844

874

845

## Signals

875

846

876

847

# CheckerCompleted - signal

877

@dbus.service.signal(_interface, signature="nxs")

848

@dbus.service.signal(_interface, signature=u"nxs")

878

849

def CheckerCompleted(self, exitcode, waitstatus, command):

879

850

"D-Bus signal"

880

851

pass

881

852

882

853

# CheckerStarted - signal

883

@dbus.service.signal(_interface, signature="s")

854

@dbus.service.signal(_interface, signature=u"s")

884

855

def CheckerStarted(self, command):

885

856

"D-Bus signal"

886

857

pass

887

858

888

859

# PropertyChanged - signal

889

@dbus.service.signal(_interface, signature="sv")

860

@dbus.service.signal(_interface, signature=u"sv")

890

861

def PropertyChanged(self, property, value):

891

862

"D-Bus signal"

892

863

pass

901

872

pass

902

873

903

874

# Rejected - signal

904

@dbus.service.signal(_interface, signature="s")

875

@dbus.service.signal(_interface, signature=u"s")

905

876

def Rejected(self, reason):

906

877

"D-Bus signal"

907

878

pass

908

879

909

880

# NeedApproval - signal

910

@dbus.service.signal(_interface, signature="tb")

881

@dbus.service.signal(_interface, signature=u"tb")

911

882

def NeedApproval(self, timeout, default):

912

883

"D-Bus signal"

913

return self.need_approval()

884

pass

914

885

915

886

## Methods

916

887

917

888

# Approve - method

918

@dbus.service.method(_interface, in_signature="b")

889

@dbus.service.method(_interface, in_signature=u"b")

919

890

def Approve(self, value):

920

891

self.approve(value)

921

892

922

893

# CheckedOK - method

923

894

@dbus.service.method(_interface)

924

895

def CheckedOK(self):

950

921

## Properties

951

922

952

923

# ApprovalPending - property

953

@dbus_service_property(_interface, signature="b", access="read")

924

@dbus_service_property(_interface, signature=u"b", access=u"read")

954

925

def ApprovalPending_dbus_property(self):

955

926

return dbus.Boolean(bool(self.approvals_pending))

956

927

957

928

# ApprovedByDefault - property

958

@dbus_service_property(_interface, signature="b",

959

access="readwrite")

929

@dbus_service_property(_interface, signature=u"b",

930

access=u"readwrite")

960

931

def ApprovedByDefault_dbus_property(self, value=None):

961

932

if value is None: # get

962

933

return dbus.Boolean(self.approved_by_default)

963

934

self.approved_by_default = bool(value)

964

935

# Emit D-Bus signal

965

self.PropertyChanged(dbus.String("ApprovedByDefault"),

936

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

966

937

dbus.Boolean(value, variant_level=1))

967

938

968

939

# ApprovalDelay - property

969

@dbus_service_property(_interface, signature="t",

970

access="readwrite")

940

@dbus_service_property(_interface, signature=u"t",

941

access=u"readwrite")

971

942

def ApprovalDelay_dbus_property(self, value=None):

972

943

if value is None: # get

973

944

return dbus.UInt64(self.approval_delay_milliseconds())

974

945

self.approval_delay = datetime.timedelta(0, 0, 0, value)

975

946

# Emit D-Bus signal

976

self.PropertyChanged(dbus.String("ApprovalDelay"),

947

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

977

948

dbus.UInt64(value, variant_level=1))

978

949

979

950

# ApprovalDuration - property

980

@dbus_service_property(_interface, signature="t",

981

access="readwrite")

951

@dbus_service_property(_interface, signature=u"t",

952

access=u"readwrite")

982

953

def ApprovalDuration_dbus_property(self, value=None):

983

954

if value is None: # get

984

955

return dbus.UInt64(self._timedelta_to_milliseconds(

985

956

self.approval_duration))

986

957

self.approval_duration = datetime.timedelta(0, 0, 0, value)

987

958

# Emit D-Bus signal

988

self.PropertyChanged(dbus.String("ApprovalDuration"),

959

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

989

960

dbus.UInt64(value, variant_level=1))

990

961

991

962

# Name - property

992

@dbus_service_property(_interface, signature="s", access="read")

963

@dbus_service_property(_interface, signature=u"s", access=u"read")

993

964

def Name_dbus_property(self):

994

965

return dbus.String(self.name)

995

966

996

967

# Fingerprint - property

997

@dbus_service_property(_interface, signature="s", access="read")

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

998

969

def Fingerprint_dbus_property(self):

999

970

return dbus.String(self.fingerprint)

1000

971

1001

972

# Host - property

1002

@dbus_service_property(_interface, signature="s",

1003

access="readwrite")

973

@dbus_service_property(_interface, signature=u"s",

974

access=u"readwrite")

1004

975

def Host_dbus_property(self, value=None):

1005

976

if value is None: # get

1006

977

return dbus.String(self.host)

1007

978

self.host = value

1008

979

# Emit D-Bus signal

1009

self.PropertyChanged(dbus.String("Host"),

980

self.PropertyChanged(dbus.String(u"Host"),

1010

981

dbus.String(value, variant_level=1))

1011

982

1012

983

# Created - property

1013

@dbus_service_property(_interface, signature="s", access="read")

984

@dbus_service_property(_interface, signature=u"s", access=u"read")

1014

985

def Created_dbus_property(self):

1015

986

return dbus.String(self._datetime_to_dbus(self.created))

1016

987

1017

988

# LastEnabled - property

1018

@dbus_service_property(_interface, signature="s", access="read")

989

@dbus_service_property(_interface, signature=u"s", access=u"read")

1019

990

def LastEnabled_dbus_property(self):

1020

991

if self.last_enabled is None:

1021

return dbus.String("")

992

return dbus.String(u"")

1022

993

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1023

994

1024

995

# Enabled - property

1025

@dbus_service_property(_interface, signature="b",

1026

access="readwrite")

996

@dbus_service_property(_interface, signature=u"b",

997

access=u"readwrite")

1027

998

def Enabled_dbus_property(self, value=None):

1028

999

if value is None: # get

1029

1000

return dbus.Boolean(self.enabled)

1033

1004

self.disable()

1034

1005

1035

1006

# LastCheckedOK - property

1036

@dbus_service_property(_interface, signature="s",

1037

access="readwrite")

1007

@dbus_service_property(_interface, signature=u"s",

1008

access=u"readwrite")

1038

1009

def LastCheckedOK_dbus_property(self, value=None):

1039

1010

if value is not None:

1040

1011

self.checked_ok()

1041

1012

return

1042

1013

if self.last_checked_ok is None:

1043

return dbus.String("")

1014

return dbus.String(u"")

1044

1015

return dbus.String(self._datetime_to_dbus(self

1045

1016

.last_checked_ok))

1046

1017

1047

# LastApprovalRequest - property

1048

@dbus_service_property(_interface, signature="s", access="read")

1049

def LastApprovalRequest_dbus_property(self):

1050

if self.last_approval_request is None:

1051

return dbus.String("")

1052

return dbus.String(self.

1053

_datetime_to_dbus(self

1054

.last_approval_request))

1055

1056

1018

# Timeout - property

1057

@dbus_service_property(_interface, signature="t",

1058

access="readwrite")

1019

@dbus_service_property(_interface, signature=u"t",

1020

access=u"readwrite")

1059

1021

def Timeout_dbus_property(self, value=None):

1060

1022

if value is None: # get

1061

1023

return dbus.UInt64(self.timeout_milliseconds())

1062

1024

self.timeout = datetime.timedelta(0, 0, 0, value)

1063

1025

# Emit D-Bus signal

1064

self.PropertyChanged(dbus.String("Timeout"),

1026

self.PropertyChanged(dbus.String(u"Timeout"),

1065

1027

dbus.UInt64(value, variant_level=1))

1066

if getattr(self, "disable_initiator_tag", None) is None:

1028

if getattr(self, u"disable_initiator_tag", None) is None:

1067

1029

return

1068

1030

# Reschedule timeout

1069

1031

gobject.source_remove(self.disable_initiator_tag)

1082

1044

(time_to_die, self.disable))

1083

1045

1084

1046

# Interval - property

1085

@dbus_service_property(_interface, signature="t",

1086

access="readwrite")

1047

@dbus_service_property(_interface, signature=u"t",

1048

access=u"readwrite")

1087

1049

def Interval_dbus_property(self, value=None):

1088

1050

if value is None: # get

1089

1051

return dbus.UInt64(self.interval_milliseconds())

1090

1052

self.interval = datetime.timedelta(0, 0, 0, value)

1091

1053

# Emit D-Bus signal

1092

self.PropertyChanged(dbus.String("Interval"),

1054

self.PropertyChanged(dbus.String(u"Interval"),

1093

1055

dbus.UInt64(value, variant_level=1))

1094

if getattr(self, "checker_initiator_tag", None) is None:

1056

if getattr(self, u"checker_initiator_tag", None) is None:

1095

1057

return

1096

1058

# Reschedule checker run

1097

1059

gobject.source_remove(self.checker_initiator_tag)

1100

1062

self.start_checker() # Start one now, too

1101

1063

1102

1064

# Checker - property

1103

@dbus_service_property(_interface, signature="s",

1104

access="readwrite")

1065

@dbus_service_property(_interface, signature=u"s",

1066

access=u"readwrite")

1105

1067

def Checker_dbus_property(self, value=None):

1106

1068

if value is None: # get

1107

1069

return dbus.String(self.checker_command)

1108

1070

self.checker_command = value

1109

1071

# Emit D-Bus signal

1110

self.PropertyChanged(dbus.String("Checker"),

1072

self.PropertyChanged(dbus.String(u"Checker"),

1111

1073

dbus.String(self.checker_command,

1112

1074

variant_level=1))

1113

1075

1114

1076

# CheckerRunning - property

1115

@dbus_service_property(_interface, signature="b",

1116

access="readwrite")

1077

@dbus_service_property(_interface, signature=u"b",

1078

access=u"readwrite")

1117

1079

def CheckerRunning_dbus_property(self, value=None):

1118

1080

if value is None: # get

1119

1081

return dbus.Boolean(self.checker is not None)

1123

1085

self.stop_checker()

1124

1086

1125

1087

# ObjectPath - property

1126

@dbus_service_property(_interface, signature="o", access="read")

1088

@dbus_service_property(_interface, signature=u"o", access=u"read")

1127

1089

def ObjectPath_dbus_property(self):

1128

1090

return self.dbus_object_path # is already a dbus.ObjectPath

1129

1091

1130

1092

# Secret = property

1131

@dbus_service_property(_interface, signature="ay",

1132

access="write", byte_arrays=True)

1093

@dbus_service_property(_interface, signature=u"ay",

1094

access=u"write", byte_arrays=True)

1133

1095

def Secret_dbus_property(self, value):

1134

1096

self.secret = str(value)

1135

1097

1170

1132

1171

1133

def handle(self):

1172

1134

with contextlib.closing(self.server.child_pipe) as child_pipe:

1173

logger.info("TCP connection from: %s",

1135

logger.info(u"TCP connection from: %s",

1174

1136

unicode(self.client_address))

1175

logger.debug("Pipe FD: %d",

1137

logger.debug(u"Pipe FD: %d",

1176

1138

self.server.child_pipe.fileno())

1177

1139

1178

1140

session = (gnutls.connection

1185

1147

# no X.509 keys are added to it. Therefore, we can use it

1186

1148

# here despite using OpenPGP certificates.

1187

1149

1188

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1189

# "+AES-256-CBC", "+SHA1",

1190

# "+COMP-NULL", "+CTYPE-OPENPGP",

1191

# "+DHE-DSS"))

1150

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1151

# u"+AES-256-CBC", u"+SHA1",

1152

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1153

# u"+DHE-DSS"))

1192

1154

# Use a fallback default, since this MUST be set.

1193

1155

priority = self.server.gnutls_priority

1194

1156

if priority is None:

1195

priority = "NORMAL"

1157

priority = u"NORMAL"

1196

1158

(gnutls.library.functions

1197

1159

.gnutls_priority_set_direct(session._c_object,

1198

1160

priority, None))

1200

1162

# Start communication using the Mandos protocol

1201

1163

# Get protocol number

1202

1164

line = self.request.makefile().readline()

1203

logger.debug("Protocol version: %r", line)

1165

logger.debug(u"Protocol version: %r", line)

1204

1166

try:

1205

1167

if int(line.strip().split()[0]) > 1:

1206

1168

raise RuntimeError

1207

1169

except (ValueError, IndexError, RuntimeError), error:

1208

logger.error("Unknown protocol version: %s", error)

1170

logger.error(u"Unknown protocol version: %s", error)

1209

1171

return

1210

1172

1211

1173

# Start GnuTLS connection

1212

1174

try:

1213

1175

session.handshake()

1214

1176

except gnutls.errors.GNUTLSError, error:

1215

logger.warning("Handshake failed: %s", error)

1177

logger.warning(u"Handshake failed: %s", error)

1216

1178

# Do not run session.bye() here: the session is not

1217

1179

# established. Just abandon the request.

1218

1180

return

1219

logger.debug("Handshake succeeded")

1181

logger.debug(u"Handshake succeeded")

1220

1182

1221

1183

approval_required = False

1222

1184

try:

1224

1186

fpr = self.fingerprint(self.peer_certificate

1225

1187

(session))

1226

1188

except (TypeError, gnutls.errors.GNUTLSError), error:

1227

logger.warning("Bad certificate: %s", error)

1189

logger.warning(u"Bad certificate: %s", error)

1228

1190

return

1229

logger.debug("Fingerprint: %s", fpr)

1191

logger.debug(u"Fingerprint: %s", fpr)

1230

1192

1231

1193

try:

1232

1194

client = ProxyClient(child_pipe, fpr,

1241

1203

1242

1204

while True:

1243

1205

if not client.enabled:

1244

logger.warning("Client %s is disabled",

1206

logger.warning(u"Client %s is disabled",

1245

1207

client.name)

1246

1208

if self.server.use_dbus:

1247

1209

# Emit D-Bus signal

1252

1214

#We are approved or approval is disabled

1253

1215

break

1254

1216

elif client._approved is None:

1255

logger.info("Client %s needs approval",

1217

logger.info(u"Client %s needs approval",

1256

1218

client.name)

1257

1219

if self.server.use_dbus:

1258

1220

# Emit D-Bus signal

1260

1222

client.approval_delay_milliseconds(),

1261

1223

client.approved_by_default)

1262

1224

else:

1263

logger.warning("Client %s was not approved",

1225

logger.warning(u"Client %s was not approved",

1264

1226

client.name)

1265

1227

if self.server.use_dbus:

1266

1228

# Emit D-Bus signal

1295

1257

except (gnutls.errors.GNUTLSError), error:

1296

1258

logger.warning("gnutls send failed")

1297

1259

return

1298

logger.debug("Sent: %d, remaining: %d",

1260

logger.debug(u"Sent: %d, remaining: %d",

1299

1261

sent, len(client.secret)

1300

1262

- (sent_size + sent))

1301

1263

sent_size += sent

1302

1264

1303

logger.info("Sending secret to %s", client.name)

1265

logger.info(u"Sending secret to %s", client.name)

1304

1266

# bump the timeout as if seen

1305

1267

client.checked_ok()

1306

1268

if self.server.use_dbus:

1329

1291

.gnutls_certificate_get_peers

1330

1292

(session._c_object, ctypes.byref(list_size)))

1331

1293

if not bool(cert_list) and list_size.value != 0:

1332

raise gnutls.errors.GNUTLSError("error getting peer"

1333

" certificate")

1294

raise gnutls.errors.GNUTLSError(u"error getting peer"

1295

u" certificate")

1334

1296

if list_size.value == 0:

1335

1297

return None

1336

1298

cert = cert_list[0]

1362

1324

if crtverify.value != 0:

1363

1325

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1364

1326

raise (gnutls.errors.CertificateSecurityError

1365

("Verify failed"))

1327

(u"Verify failed"))

1366

1328

# New buffer for the fingerprint

1367

1329

buf = ctypes.create_string_buffer(20)

1368

1330

buf_len = ctypes.c_size_t()

1375

1337

# Convert the buffer to a Python bytestring

1376

1338

fpr = ctypes.string_at(buf, buf_len.value)

1377

1339

# Convert the bytestring to hexadecimal notation

1378

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1340

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1379

1341

return hex_fpr

1380

1342

1381

1343

1409

1371

1410

1372

def add_pipe(self, parent_pipe):

1411

1373

"""Dummy function; override as necessary"""

1412

raise NotImplementedError

1374

pass

1413

1375

1414

1376

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1415

1377

socketserver.TCPServer, object):

1433

1395

bind to an address or port if they were not specified."""

1434

1396

if self.interface is not None:

1435

1397

if SO_BINDTODEVICE is None:

1436

logger.error("SO_BINDTODEVICE does not exist;"

1437

" cannot bind to interface %s",

1398

logger.error(u"SO_BINDTODEVICE does not exist;"

1399

u" cannot bind to interface %s",

1438

1400

self.interface)

1439

1401

else:

1440

1402

try:

1441

1403

self.socket.setsockopt(socket.SOL_SOCKET,

1442

1404

SO_BINDTODEVICE,

1443

1405

str(self.interface

1444

+ '\0'))

1406

+ u'\0'))

1445

1407

except socket.error, error:

1446

1408

if error[0] == errno.EPERM:

1447

logger.error("No permission to"

1448

" bind to interface %s",

1409

logger.error(u"No permission to"

1410

u" bind to interface %s",

1449

1411

self.interface)

1450

1412

elif error[0] == errno.ENOPROTOOPT:

1451

logger.error("SO_BINDTODEVICE not available;"

1452

" cannot bind to interface %s",

1413

logger.error(u"SO_BINDTODEVICE not available;"

1414

u" cannot bind to interface %s",

1453

1415

self.interface)

1454

1416

else:

1455

1417

raise

1457

1419

if self.server_address[0] or self.server_address[1]:

1458

1420

if not self.server_address[0]:

1459

1421

if self.address_family == socket.AF_INET6:

1460

any_address = "::" # in6addr_any

1422

any_address = u"::" # in6addr_any

1461

1423

else:

1462

1424

any_address = socket.INADDR_ANY

1463

1425

self.server_address = (any_address,

1512

1474

def handle_ipc(self, source, condition, parent_pipe=None,

1513

1475

client_object=None):

1514

1476

condition_names = {

1515

gobject.IO_IN: "IN", # There is data to read.

1516

gobject.IO_OUT: "OUT", # Data can be written (without

1477

gobject.IO_IN: u"IN", # There is data to read.

1478

gobject.IO_OUT: u"OUT", # Data can be written (without

1517

1479

# blocking).

1518

gobject.IO_PRI: "PRI", # There is urgent data to read.

1519

gobject.IO_ERR: "ERR", # Error condition.

1520

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1480

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1481

gobject.IO_ERR: u"ERR", # Error condition.

1482

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1521

1483

# broken, usually for pipes and

1522

1484

# sockets).

1523

1485

}

1542

1504

client = c

1543

1505

break

1544

1506

else:

1545

logger.warning("Client not found for fingerprint: %s, ad"

1546

"dress: %s", fpr, address)

1507

logger.warning(u"Client not found for fingerprint: %s, ad"

1508

u"dress: %s", fpr, address)

1547

1509

if self.use_dbus:

1548

1510

# Emit D-Bus signal

1549

mandos_dbus_service.ClientNotFound(fpr, address[0])

1511

mandos_dbus_service.ClientNotFound(fpr, address)

1550

1512

parent_pipe.send(False)

1551

1513

return False

1552

1514

1583

1545

def string_to_delta(interval):

1584

1546

"""Parse a string and return a datetime.timedelta

1585

1547

1586

>>> string_to_delta('7d')

1548

>>> string_to_delta(u'7d')

1587

1549

datetime.timedelta(7)

1588

>>> string_to_delta('60s')

1550

>>> string_to_delta(u'60s')

1589

1551

datetime.timedelta(0, 60)

1590

>>> string_to_delta('60m')

1552

>>> string_to_delta(u'60m')

1591

1553

datetime.timedelta(0, 3600)

1592

>>> string_to_delta('24h')

1554

>>> string_to_delta(u'24h')

1593

1555

datetime.timedelta(1)

1594

>>> string_to_delta('1w')

1556

>>> string_to_delta(u'1w')

1595

1557

datetime.timedelta(7)

1596

>>> string_to_delta('5m 30s')

1558

>>> string_to_delta(u'5m 30s')

1597

1559

datetime.timedelta(0, 330)

1598

1560

"""

1599

1561

timevalue = datetime.timedelta(0)

1601

1563

try:

1602

1564

suffix = unicode(s[-1])

1603

1565

value = int(s[:-1])

1604

if suffix == "d":

1566

if suffix == u"d":

1605

1567

delta = datetime.timedelta(value)

1606

elif suffix == "s":

1568

elif suffix == u"s":

1607

1569

delta = datetime.timedelta(0, value)

1608

elif suffix == "m":

1570

elif suffix == u"m":

1609

1571

delta = datetime.timedelta(0, 0, 0, 0, value)

1610

elif suffix == "h":

1572

elif suffix == u"h":

1611

1573

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1612

elif suffix == "w":

1574

elif suffix == u"w":

1613

1575

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1614

1576

else:

1615

raise ValueError("Unknown suffix %r" % suffix)

1577

raise ValueError(u"Unknown suffix %r" % suffix)

1616

1578

except (ValueError, IndexError), e:

1617

raise ValueError(*(e.args))

1579

raise ValueError(e.message)

1618

1580

timevalue += delta

1619

1581

return timevalue

1620

1582

1626

1588

global if_nametoindex

1627

1589

try:

1628

1590

if_nametoindex = (ctypes.cdll.LoadLibrary

1629

(ctypes.util.find_library("c"))

1591

(ctypes.util.find_library(u"c"))

1630

1592

.if_nametoindex)

1631

1593

except (OSError, AttributeError):

1632

logger.warning("Doing if_nametoindex the hard way")

1594

logger.warning(u"Doing if_nametoindex the hard way")

1633

1595

def if_nametoindex(interface):

1634

1596

"Get an interface index the hard way, i.e. using fcntl()"

1635

1597

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1636

1598

with contextlib.closing(socket.socket()) as s:

1637

1599

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1638

struct.pack(str("16s16x"),

1600

struct.pack(str(u"16s16x"),

1639

1601

interface))

1640

interface_index = struct.unpack(str("I"),

1602

interface_index = struct.unpack(str(u"I"),

1641

1603

ifreq[16:20])[0]

1642

1604

return interface_index

1643

1605

return if_nametoindex(interface)

1651

1613

sys.exit()

1652

1614

os.setsid()

1653

1615

if not nochdir:

1654

os.chdir("/")

1616

os.chdir(u"/")

1655

1617

if os.fork():

1656

1618

sys.exit()

1657

1619

if not noclose:

1659

1621

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1660

1622

if not stat.S_ISCHR(os.fstat(null).st_mode):

1661

1623

raise OSError(errno.ENODEV,

1662

"%s not a character device"

1624

u"%s not a character device"

1663

1625

% os.path.devnull)

1664

1626

os.dup2(null, sys.stdin.fileno())

1665

1627

os.dup2(null, sys.stdout.fileno())

1673

1635

##################################################################

1674

1636

# Parsing of options, both command line and config file

1675

1637

1676

parser = argparse.ArgumentParser()

1677

parser.add_argument("-v", "--version", action="version",

1678

version = "%%(prog)s %s" % version,

1679

help="show version number and exit")

1680

parser.add_argument("-i", "--interface", metavar="IF",

1681

help="Bind to interface IF")

1682

parser.add_argument("-a", "--address",

1683

help="Address to listen for requests on")

1684

parser.add_argument("-p", "--port", type=int,

1685

help="Port number to receive requests on")

1686

parser.add_argument("--check", action="store_true",

1687

help="Run self-test")

1688

parser.add_argument("--debug", action="store_true",

1689

help="Debug mode; run in foreground and log"

1690

" to terminal")

1691

parser.add_argument("--debuglevel", metavar="LEVEL",

1692

help="Debug level for stdout output")

1693

parser.add_argument("--priority", help="GnuTLS"

1694

" priority string (see GnuTLS documentation)")

1695

parser.add_argument("--servicename",

1696

metavar="NAME", help="Zeroconf service name")

1697

parser.add_argument("--configdir",

1698

default="/etc/mandos", metavar="DIR",

1699

help="Directory to search for configuration"

1700

" files")

1701

parser.add_argument("--no-dbus", action="store_false",

1702

dest="use_dbus", help="Do not provide D-Bus"

1703

" system bus interface")

1704

parser.add_argument("--no-ipv6", action="store_false",

1705

dest="use_ipv6", help="Do not use IPv6")

1706

options = parser.parse_args()

1638

parser = optparse.OptionParser(version = "%%prog %s" % version)

1639

parser.add_option("-i", u"--interface", type=u"string",

1640

metavar="IF", help=u"Bind to interface IF")

1641

parser.add_option("-a", u"--address", type=u"string",

1642

help=u"Address to listen for requests on")

1643

parser.add_option("-p", u"--port", type=u"int",

1644

help=u"Port number to receive requests on")

1645

parser.add_option("--check", action=u"store_true",

1646

help=u"Run self-test")

1647

parser.add_option("--debug", action=u"store_true",

1648

help=u"Debug mode; run in foreground and log to"

1649

u" terminal")

1650

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1651

help=u"Debug level for stdout output")

1652

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1653

u" priority string (see GnuTLS documentation)")

1654

parser.add_option("--servicename", type=u"string",

1655

metavar=u"NAME", help=u"Zeroconf service name")

1656

parser.add_option("--configdir", type=u"string",

1657

default=u"/etc/mandos", metavar=u"DIR",

1658

help=u"Directory to search for configuration"

1659

u" files")

1660

parser.add_option("--no-dbus", action=u"store_false",

1661

dest=u"use_dbus", help=u"Do not provide D-Bus"

1662

u" system bus interface")

1663

parser.add_option("--no-ipv6", action=u"store_false",

1664

dest=u"use_ipv6", help=u"Do not use IPv6")

1665

options = parser.parse_args()[0]

1707

1666

1708

1667

if options.check:

1709

1668

import doctest

1711

1670

sys.exit()

1712

1671

1713

1672

# Default values for config file for server-global settings

1714

server_defaults = { "interface": "",

1715

"address": "",

1716

"port": "",

1717

"debug": "False",

1718

"priority":

1719

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1720

"servicename": "Mandos",

1721

"use_dbus": "True",

1722

"use_ipv6": "True",

1723

"debuglevel": "",

1673

server_defaults = { u"interface": u"",

1674

u"address": u"",

1675

u"port": u"",

1676

u"debug": u"False",

1677

u"priority":

1678

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1679

u"servicename": u"Mandos",

1680

u"use_dbus": u"True",

1681

u"use_ipv6": u"True",

1682

u"debuglevel": u"",

1724

1683

}

1725

1684

1726

1685

# Parse config file for server-global settings

1727

1686

server_config = configparser.SafeConfigParser(server_defaults)

1728

1687

del server_defaults

1729

1688

server_config.read(os.path.join(options.configdir,

1730

"mandos.conf"))

1689

u"mandos.conf"))

1731

1690

# Convert the SafeConfigParser object to a dict

1732

1691

server_settings = server_config.defaults()

1733

1692

# Use the appropriate methods on the non-string config options

1734

for option in ("debug", "use_dbus", "use_ipv6"):

1735

server_settings[option] = server_config.getboolean("DEFAULT",

1693

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1694

server_settings[option] = server_config.getboolean(u"DEFAULT",

1736

1695

option)

1737

1696

if server_settings["port"]:

1738

server_settings["port"] = server_config.getint("DEFAULT",

1739

"port")

1697

server_settings["port"] = server_config.getint(u"DEFAULT",

1698

u"port")

1740

1699

del server_config

1741

1700

1742

1701

# Override the settings from the config file with command line

1743

1702

# options, if set.

1744

for option in ("interface", "address", "port", "debug",

1745

"priority", "servicename", "configdir",

1746

"use_dbus", "use_ipv6", "debuglevel"):

1703

for option in (u"interface", u"address", u"port", u"debug",

1704

u"priority", u"servicename", u"configdir",

1705

u"use_dbus", u"use_ipv6", u"debuglevel"):

1747

1706

value = getattr(options, option)

1748

1707

if value is not None:

1749

1708

server_settings[option] = value

1757

1716

##################################################################

1758

1717

1759

1718

# For convenience

1760

debug = server_settings["debug"]

1761

debuglevel = server_settings["debuglevel"]

1762

use_dbus = server_settings["use_dbus"]

1763

use_ipv6 = server_settings["use_ipv6"]

1719

debug = server_settings[u"debug"]

1720

debuglevel = server_settings[u"debuglevel"]

1721

use_dbus = server_settings[u"use_dbus"]

1722

use_ipv6 = server_settings[u"use_ipv6"]

1764

1723

1765

if server_settings["servicename"] != "Mandos":

1724

if server_settings[u"servicename"] != u"Mandos":

1766

1725

syslogger.setFormatter(logging.Formatter

1767

('Mandos (%s) [%%(process)d]:'

1768

' %%(levelname)s: %%(message)s'

1769

% server_settings["servicename"]))

1726

(u'Mandos (%s) [%%(process)d]:'

1727

u' %%(levelname)s: %%(message)s'

1728

% server_settings[u"servicename"]))

1770

1729

1771

1730

# Parse config file with clients

1772

client_defaults = { "timeout": "1h",

1773

"interval": "5m",

1774

"checker": "fping -q -- %%(host)s",

1775

"host": "",

1776

"approval_delay": "0s",

1777

"approval_duration": "1s",

1731

client_defaults = { u"timeout": u"1h",

1732

u"interval": u"5m",

1733

u"checker": u"fping -q -- %%(host)s",

1734

u"host": u"",

1735

u"approval_delay": u"0s",

1736

u"approval_duration": u"1s",

1778

1737

}

1779

1738

client_config = configparser.SafeConfigParser(client_defaults)

1780

client_config.read(os.path.join(server_settings["configdir"],

1781

"clients.conf"))

1739

client_config.read(os.path.join(server_settings[u"configdir"],

1740

u"clients.conf"))

1782

1741

1783

1742

global mandos_dbus_service

1784

1743

mandos_dbus_service = None

1785

1744

1786

tcp_server = MandosServer((server_settings["address"],

1787

server_settings["port"]),

1745

tcp_server = MandosServer((server_settings[u"address"],

1746

server_settings[u"port"]),

1788

1747

ClientHandler,

1789

interface=(server_settings["interface"]

1748

interface=(server_settings[u"interface"]

1790

1749

or None),

1791

1750

use_ipv6=use_ipv6,

1792

1751

gnutls_priority=

1793

server_settings["priority"],

1752

server_settings[u"priority"],

1794

1753

use_dbus=use_dbus)

1795

if not debug:

1796

pidfilename = "/var/run/mandos.pid"

1797

try:

1798

pidfile = open(pidfilename, "w")

1799

except IOError:

1800

logger.error("Could not open file %r", pidfilename)

1754

pidfilename = u"/var/run/mandos.pid"

1755

try:

1756

pidfile = open(pidfilename, u"w")

1757

except IOError:

1758

logger.error(u"Could not open file %r", pidfilename)

1801

1759

1802

1760

try:

1803

uid = pwd.getpwnam("_mandos").pw_uid

1804

gid = pwd.getpwnam("_mandos").pw_gid

1761

uid = pwd.getpwnam(u"_mandos").pw_uid

1762

gid = pwd.getpwnam(u"_mandos").pw_gid

1805

1763

except KeyError:

1806

1764

try:

1807

uid = pwd.getpwnam("mandos").pw_uid

1808

gid = pwd.getpwnam("mandos").pw_gid

1765

uid = pwd.getpwnam(u"mandos").pw_uid

1766

gid = pwd.getpwnam(u"mandos").pw_gid

1809

1767

except KeyError:

1810

1768

try:

1811

uid = pwd.getpwnam("nobody").pw_uid

1812

gid = pwd.getpwnam("nobody").pw_gid

1769

uid = pwd.getpwnam(u"nobody").pw_uid

1770

gid = pwd.getpwnam(u"nobody").pw_gid

1813

1771

except KeyError:

1814

1772

uid = 65534

1815

1773

gid = 65534

1837

1795

1838

1796

@gnutls.library.types.gnutls_log_func

1839

1797

def debug_gnutls(level, string):

1840

logger.debug("GnuTLS: %s", string[:-1])

1798

logger.debug(u"GnuTLS: %s", string[:-1])

1841

1799

1842

1800

(gnutls.library.functions

1843

1801

.gnutls_global_set_log_function(debug_gnutls))

1851

1809

# No console logging

1852

1810

logger.removeHandler(console)

1853

1811

1854

# Need to fork before connecting to D-Bus

1855

if not debug:

1856

# Close all input and output, do double fork, etc.

1857

daemon()

1858

1812

1859

1813

global main_loop

1860

1814

# From the Avahi example code

1864

1818

# End of Avahi example code

1865

1819

if use_dbus:

1866

1820

try:

1867

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1821

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1868

1822

bus, do_not_queue=True)

1869

1823

except dbus.exceptions.NameExistsException, e:

1870

logger.error(unicode(e) + ", disabling D-Bus")

1824

logger.error(unicode(e) + u", disabling D-Bus")

1871

1825

use_dbus = False

1872

server_settings["use_dbus"] = False

1826

server_settings[u"use_dbus"] = False

1873

1827

tcp_server.use_dbus = False

1874

1828

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1875

service = AvahiService(name = server_settings["servicename"],

1876

servicetype = "_mandos._tcp",

1829

service = AvahiService(name = server_settings[u"servicename"],

1830

servicetype = u"_mandos._tcp",

1877

1831

protocol = protocol, bus = bus)

1878

1832

if server_settings["interface"]:

1879

1833

service.interface = (if_nametoindex

1880

(str(server_settings["interface"])))

1881

1834

(str(server_settings[u"interface"])))

1835

1836

if not debug:

1837

# Close all input and output, do double fork, etc.

1838

daemon()

1839

1882

1840

global multiprocessing_manager

1883

1841

multiprocessing_manager = multiprocessing.Manager()

1884

1842

1903

1861

client_config, section)))

1904

1862

for section in client_config.sections()))

1905

1863

if not tcp_server.clients:

1906

logger.warning("No clients defined")

1864

logger.warning(u"No clients defined")

1907

1865

1866

try:

1867

with pidfile:

1868

pid = os.getpid()

1869

pidfile.write(str(pid) + "\n")

1870

del pidfile

1871

except IOError:

1872

logger.error(u"Could not write to file %r with PID %d",

1873

pidfilename, pid)

1874

except NameError:

1875

# "pidfile" was never created

1876

pass

1877

del pidfilename

1878

1908

1879

if not debug:

1909

try:

1910

with pidfile:

1911

pid = os.getpid()

1912

pidfile.write(str(pid) + "\n".encode("utf-8"))

1913

del pidfile

1914

except IOError:

1915

logger.error("Could not write to file %r with PID %d",

1916

pidfilename, pid)

1917

except NameError:

1918

# "pidfile" was never created

1919

pass

1920

del pidfilename

1921

1922

1880

signal.signal(signal.SIGINT, signal.SIG_IGN)

1923

1924

1881

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1925

1882

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1926

1883

1928

1885

class MandosDBusService(dbus.service.Object):

1929

1886

"""A D-Bus proxy object"""

1930

1887

def __init__(self):

1931

dbus.service.Object.__init__(self, bus, "/")

1932

_interface = "se.bsnet.fukt.Mandos"

1888

dbus.service.Object.__init__(self, bus, u"/")

1889

_interface = u"se.bsnet.fukt.Mandos"

1933

1890

1934

@dbus.service.signal(_interface, signature="o")

1891

@dbus.service.signal(_interface, signature=u"o")

1935

1892

def ClientAdded(self, objpath):

1936

1893

"D-Bus signal"

1937

1894

pass

1938

1895

1939

@dbus.service.signal(_interface, signature="ss")

1896

@dbus.service.signal(_interface, signature=u"ss")

1940

1897

def ClientNotFound(self, fingerprint, address):

1941

1898

"D-Bus signal"

1942

1899

pass

1943

1900

1944

@dbus.service.signal(_interface, signature="os")

1901

@dbus.service.signal(_interface, signature=u"os")

1945

1902

def ClientRemoved(self, objpath, name):

1946

1903

"D-Bus signal"

1947

1904

pass

1948

1905

1949

@dbus.service.method(_interface, out_signature="ao")

1906

@dbus.service.method(_interface, out_signature=u"ao")

1950

1907

def GetAllClients(self):

1951

1908

"D-Bus method"

1952

1909

return dbus.Array(c.dbus_object_path

1953

1910

for c in tcp_server.clients)

1954

1911

1955

1912

@dbus.service.method(_interface,

1956

out_signature="a{oa{sv}}")

1913

out_signature=u"a{oa{sv}}")

1957

1914

def GetAllClientsWithProperties(self):

1958

1915

"D-Bus method"

1959

1916

return dbus.Dictionary(

1960

((c.dbus_object_path, c.GetAll(""))

1917

((c.dbus_object_path, c.GetAll(u""))

1961

1918

for c in tcp_server.clients),

1962

signature="oa{sv}")

1919

signature=u"oa{sv}")

1963

1920

1964

@dbus.service.method(_interface, in_signature="o")

1921

@dbus.service.method(_interface, in_signature=u"o")

1965

1922

def RemoveClient(self, object_path):

1966

1923

"D-Bus method"

1967

1924

for c in tcp_server.clients:

2009

1966

# Find out what port we got

2010

1967

service.port = tcp_server.socket.getsockname()[1]

2011

1968

if use_ipv6:

2012

logger.info("Now listening on address %r, port %d,"

1969

logger.info(u"Now listening on address %r, port %d,"

2013

1970

" flowinfo %d, scope_id %d"

2014

1971

% tcp_server.socket.getsockname())

2015

1972

else: # IPv4

2016

logger.info("Now listening on address %r, port %d"

1973

logger.info(u"Now listening on address %r, port %d"

2017

1974

% tcp_server.socket.getsockname())

2018

1975

2019

1976

#service.interface = tcp_server.socket.getsockname()[3]

2023

1980

try:

2024

1981

service.activate()

2025

1982

except dbus.exceptions.DBusException, error:

2026

logger.critical("DBusException: %s", error)

1983

logger.critical(u"DBusException: %s", error)

2027

1984

cleanup()

2028

1985

sys.exit(1)

2029

1986

# End of Avahi example code

2033

1990

(tcp_server.handle_request

2034

1991

(*args[2:], **kwargs) or True))

2035

1992

2036

logger.debug("Starting main loop")

1993

logger.debug(u"Starting main loop")

2037

1994

main_loop.run()

2038

1995

except AvahiError, error:

2039

logger.critical("AvahiError: %s", error)

1996

logger.critical(u"AvahiError: %s", error)

2040

1997

cleanup()

2041

1998

sys.exit(1)

2042

1999

except KeyboardInterrupt:

2043

2000

if debug:

2044

print("", file=sys.stderr)

2045

logger.debug("Server received KeyboardInterrupt")

2046

logger.debug("Server exiting")

2001

print >> sys.stderr

2002

logger.debug(u"Server received KeyboardInterrupt")

2003

logger.debug(u"Server exiting")

2047

2004

# Must run before the D-Bus bus name gets deregistered

2048

2005

cleanup()

2049

2006