/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2010-09-25 20:09:10 UTC
  • Revision ID: teddy@fukt.bsnet.se-20100925200910-8bxnasqkol93sj89
* mandos: Do not write pid file if --debug is passed.
* mandos.xml (FILES): Pid file only records pid of latest server.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
1
1
#!/usr/bin/python
2
 
 
3
 
import SocketServer
 
2
# -*- mode: python; coding: utf-8 -*-
 
3
# 
 
4
# Mandos server - give out binary blobs to connecting clients.
 
5
# 
 
6
# This program is partly derived from an example program for an Avahi
 
7
# service publisher, downloaded from
 
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
 
9
# methods "add", "remove", "server_state_changed",
 
10
# "entry_group_state_changed", "cleanup", and "activate" in the
 
11
# "AvahiService" class, and some lines in "main".
 
12
# 
 
13
# Everything else is
 
14
# Copyright © 2008,2009 Teddy Hogeborn
 
15
# Copyright © 2008,2009 Björn Påhlsson
 
16
# 
 
17
# This program is free software: you can redistribute it and/or modify
 
18
# it under the terms of the GNU General Public License as published by
 
19
# the Free Software Foundation, either version 3 of the License, or
 
20
# (at your option) any later version.
 
21
#
 
22
#     This program is distributed in the hope that it will be useful,
 
23
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
 
24
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 
25
#     GNU General Public License for more details.
 
26
# 
 
27
# You should have received a copy of the GNU General Public License
 
28
# along with this program.  If not, see
 
29
# <http://www.gnu.org/licenses/>.
 
30
# 
 
31
# Contact the authors at <mandos@fukt.bsnet.se>.
 
32
# 
 
33
 
 
34
from __future__ import division, with_statement, absolute_import
 
35
 
 
36
import SocketServer as socketserver
4
37
import socket
5
 
import select
6
 
from optparse import OptionParser
 
38
import optparse
7
39
import datetime
8
40
import errno
9
41
import gnutls.crypto
10
42
import gnutls.connection
11
43
import gnutls.errors
12
 
import ConfigParser
 
44
import gnutls.library.functions
 
45
import gnutls.library.constants
 
46
import gnutls.library.types
 
47
import ConfigParser as configparser
13
48
import sys
 
49
import re
 
50
import os
 
51
import signal
 
52
import subprocess
 
53
import atexit
 
54
import stat
 
55
import logging
 
56
import logging.handlers
 
57
import pwd
 
58
import contextlib
 
59
import struct
 
60
import fcntl
 
61
import functools
 
62
import cPickle as pickle
 
63
import multiprocessing
 
64
 
 
65
import dbus
 
66
import dbus.service
 
67
import gobject
 
68
import avahi
 
69
from dbus.mainloop.glib import DBusGMainLoop
 
70
import ctypes
 
71
import ctypes.util
 
72
import xml.dom.minidom
 
73
import inspect
 
74
 
 
75
try:
 
76
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
 
77
except AttributeError:
 
78
    try:
 
79
        from IN import SO_BINDTODEVICE
 
80
    except ImportError:
 
81
        SO_BINDTODEVICE = None
 
82
 
 
83
 
 
84
version = "1.0.14"
 
85
 
 
86
#logger = logging.getLogger(u'mandos')
 
87
logger = logging.Logger(u'mandos')
 
88
syslogger = (logging.handlers.SysLogHandler
 
89
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
 
90
              address = "/dev/log"))
 
91
syslogger.setFormatter(logging.Formatter
 
92
                       (u'Mandos [%(process)d]: %(levelname)s:'
 
93
                        u' %(message)s'))
 
94
logger.addHandler(syslogger)
 
95
 
 
96
console = logging.StreamHandler()
 
97
console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'
 
98
                                       u' %(levelname)s:'
 
99
                                       u' %(message)s'))
 
100
logger.addHandler(console)
 
101
 
 
102
class AvahiError(Exception):
 
103
    def __init__(self, value, *args, **kwargs):
 
104
        self.value = value
 
105
        super(AvahiError, self).__init__(value, *args, **kwargs)
 
106
    def __unicode__(self):
 
107
        return unicode(repr(self.value))
 
108
 
 
109
class AvahiServiceError(AvahiError):
 
110
    pass
 
111
 
 
112
class AvahiGroupError(AvahiError):
 
113
    pass
 
114
 
 
115
 
 
116
class AvahiService(object):
 
117
    """An Avahi (Zeroconf) service.
 
118
    
 
119
    Attributes:
 
120
    interface: integer; avahi.IF_UNSPEC or an interface index.
 
121
               Used to optionally bind to the specified interface.
 
122
    name: string; Example: u'Mandos'
 
123
    type: string; Example: u'_mandos._tcp'.
 
124
                  See <http://www.dns-sd.org/ServiceTypes.html>
 
125
    port: integer; what port to announce
 
126
    TXT: list of strings; TXT record for the service
 
127
    domain: string; Domain to publish on, default to .local if empty.
 
128
    host: string; Host to publish records for, default is localhost
 
129
    max_renames: integer; maximum number of renames
 
130
    rename_count: integer; counter so we only rename after collisions
 
131
                  a sensible number of times
 
132
    group: D-Bus Entry Group
 
133
    server: D-Bus Server
 
134
    bus: dbus.SystemBus()
 
135
    """
 
136
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
 
137
                 servicetype = None, port = None, TXT = None,
 
138
                 domain = u"", host = u"", max_renames = 32768,
 
139
                 protocol = avahi.PROTO_UNSPEC, bus = None):
 
140
        self.interface = interface
 
141
        self.name = name
 
142
        self.type = servicetype
 
143
        self.port = port
 
144
        self.TXT = TXT if TXT is not None else []
 
145
        self.domain = domain
 
146
        self.host = host
 
147
        self.rename_count = 0
 
148
        self.max_renames = max_renames
 
149
        self.protocol = protocol
 
150
        self.group = None       # our entry group
 
151
        self.server = None
 
152
        self.bus = bus
 
153
    def rename(self):
 
154
        """Derived from the Avahi example code"""
 
155
        if self.rename_count >= self.max_renames:
 
156
            logger.critical(u"No suitable Zeroconf service name found"
 
157
                            u" after %i retries, exiting.",
 
158
                            self.rename_count)
 
159
            raise AvahiServiceError(u"Too many renames")
 
160
        self.name = unicode(self.server.GetAlternativeServiceName(self.name))
 
161
        logger.info(u"Changing Zeroconf service name to %r ...",
 
162
                    self.name)
 
163
        syslogger.setFormatter(logging.Formatter
 
164
                               (u'Mandos (%s) [%%(process)d]:'
 
165
                                u' %%(levelname)s: %%(message)s'
 
166
                                % self.name))
 
167
        self.remove()
 
168
        try:
 
169
            self.add()
 
170
        except dbus.exceptions.DBusException, error:
 
171
            logger.critical(u"DBusException: %s", error)
 
172
            self.cleanup()
 
173
            os._exit(1)
 
174
        self.rename_count += 1
 
175
    def remove(self):
 
176
        """Derived from the Avahi example code"""
 
177
        if self.group is not None:
 
178
            self.group.Reset()
 
179
    def add(self):
 
180
        """Derived from the Avahi example code"""
 
181
        if self.group is None:
 
182
            self.group = dbus.Interface(
 
183
                self.bus.get_object(avahi.DBUS_NAME,
 
184
                                    self.server.EntryGroupNew()),
 
185
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
 
186
            self.group.connect_to_signal('StateChanged',
 
187
                                         self
 
188
                                         .entry_group_state_changed)
 
189
        logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",
 
190
                     self.name, self.type)
 
191
        self.group.AddService(
 
192
            self.interface,
 
193
            self.protocol,
 
194
            dbus.UInt32(0),     # flags
 
195
            self.name, self.type,
 
196
            self.domain, self.host,
 
197
            dbus.UInt16(self.port),
 
198
            avahi.string_array_to_txt_array(self.TXT))
 
199
        self.group.Commit()
 
200
    def entry_group_state_changed(self, state, error):
 
201
        """Derived from the Avahi example code"""
 
202
        logger.debug(u"Avahi entry group state change: %i", state)
 
203
        
 
204
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
 
205
            logger.debug(u"Zeroconf service established.")
 
206
        elif state == avahi.ENTRY_GROUP_COLLISION:
 
207
            logger.warning(u"Zeroconf service name collision.")
 
208
            self.rename()
 
209
        elif state == avahi.ENTRY_GROUP_FAILURE:
 
210
            logger.critical(u"Avahi: Error in group state changed %s",
 
211
                            unicode(error))
 
212
            raise AvahiGroupError(u"State changed: %s"
 
213
                                  % unicode(error))
 
214
    def cleanup(self):
 
215
        """Derived from the Avahi example code"""
 
216
        if self.group is not None:
 
217
            self.group.Free()
 
218
            self.group = None
 
219
    def server_state_changed(self, state):
 
220
        """Derived from the Avahi example code"""
 
221
        logger.debug(u"Avahi server state change: %i", state)
 
222
        if state == avahi.SERVER_COLLISION:
 
223
            logger.error(u"Zeroconf server name collision")
 
224
            self.remove()
 
225
        elif state == avahi.SERVER_RUNNING:
 
226
            self.add()
 
227
    def activate(self):
 
228
        """Derived from the Avahi example code"""
 
229
        if self.server is None:
 
230
            self.server = dbus.Interface(
 
231
                self.bus.get_object(avahi.DBUS_NAME,
 
232
                                    avahi.DBUS_PATH_SERVER),
 
233
                avahi.DBUS_INTERFACE_SERVER)
 
234
        self.server.connect_to_signal(u"StateChanged",
 
235
                                 self.server_state_changed)
 
236
        self.server_state_changed(self.server.GetState())
14
237
 
15
238
 
16
239
class Client(object):
17
 
    def __init__(self, name=None, options=None, dn=None,
18
 
                 password=None, passfile=None, fqdn=None,
19
 
                 timeout=None, interval=-1):
 
240
    """A representation of a client host served by this server.
 
241
    
 
242
    Attributes:
 
243
    _approved:   bool(); 'None' if not yet approved/disapproved
 
244
    approval_delay: datetime.timedelta(); Time to wait for approval
 
245
    approval_duration: datetime.timedelta(); Duration of one approval
 
246
    checker:    subprocess.Popen(); a running checker process used
 
247
                                    to see if the client lives.
 
248
                                    'None' if no process is running.
 
249
    checker_callback_tag:  - '' -
 
250
    checker_command: string; External command which is run to check
 
251
                     if client lives.  %() expansions are done at
 
252
                     runtime with vars(self) as dict, so that for
 
253
                     instance %(name)s can be used in the command.
 
254
    checker_initiator_tag: a gobject event source tag, or None
 
255
    created:    datetime.datetime(); (UTC) object creation
 
256
    current_checker_command: string; current running checker_command
 
257
    disable_hook:  If set, called by disable() as disable_hook(self)
 
258
    disable_initiator_tag: - '' -
 
259
    enabled:    bool()
 
260
    fingerprint: string (40 or 32 hexadecimal digits); used to
 
261
                 uniquely identify the client
 
262
    host:       string; available for use by the checker command
 
263
    interval:   datetime.timedelta(); How often to start a new checker
 
264
    last_checked_ok: datetime.datetime(); (UTC) or None
 
265
    last_enabled: datetime.datetime(); (UTC)
 
266
    name:       string; from the config file, used in log messages and
 
267
                        D-Bus identifiers
 
268
    secret:     bytestring; sent verbatim (over TLS) to client
 
269
    timeout:    datetime.timedelta(); How long from last_checked_ok
 
270
                                      until this client is disabled
 
271
    runtime_expansions: Allowed attributes for runtime expansion.
 
272
    """
 
273
    
 
274
    runtime_expansions = (u"approval_delay", u"approval_duration",
 
275
                          u"created", u"enabled", u"fingerprint",
 
276
                          u"host", u"interval", u"last_checked_ok",
 
277
                          u"last_enabled", u"name", u"timeout")
 
278
    
 
279
    @staticmethod
 
280
    def _timedelta_to_milliseconds(td):
 
281
        "Convert a datetime.timedelta() to milliseconds"
 
282
        return ((td.days * 24 * 60 * 60 * 1000)
 
283
                + (td.seconds * 1000)
 
284
                + (td.microseconds // 1000))
 
285
    
 
286
    def timeout_milliseconds(self):
 
287
        "Return the 'timeout' attribute in milliseconds"
 
288
        return self._timedelta_to_milliseconds(self.timeout)
 
289
    
 
290
    def interval_milliseconds(self):
 
291
        "Return the 'interval' attribute in milliseconds"
 
292
        return self._timedelta_to_milliseconds(self.interval)
 
293
 
 
294
    def approval_delay_milliseconds(self):
 
295
        return self._timedelta_to_milliseconds(self.approval_delay)
 
296
    
 
297
    def __init__(self, name = None, disable_hook=None, config=None):
 
298
        """Note: the 'checker' key in 'config' sets the
 
299
        'checker_command' attribute and *not* the 'checker'
 
300
        attribute."""
20
301
        self.name = name
21
 
        self.dn = dn
22
 
        if password:
23
 
            self.password = password
24
 
        elif passfile:
25
 
            self.password = open(passfile).readall()
26
 
        else:
27
 
            print "No Password or Passfile in client config file"
28
 
            # raise RuntimeError XXX
29
 
            self.password = "gazonk"
30
 
        self.fqdn = fqdn
31
 
        self.created = datetime.datetime.now()
32
 
        self.last_seen = None
33
 
        if timeout is None:
34
 
            timeout = options.timeout
35
 
        self.timeout = timeout
36
 
        if interval == -1:
37
 
            interval = options.interval
38
 
        self.interval = interval
39
 
        self.next_check = datetime.datetime.now()
40
 
 
41
 
 
42
 
class server_metaclass(type):
43
 
    "Common behavior for the UDP and TCP server classes"
44
 
    def __new__(cls, name, bases, attrs):
45
 
        attrs["address_family"] = socket.AF_INET6
46
 
        attrs["allow_reuse_address"] = True
47
 
        def server_bind(self):
48
 
            if self.options.interface:
49
 
                if not hasattr(socket, "SO_BINDTODEVICE"):
50
 
                    # From /usr/include/asm-i486/socket.h
51
 
                    socket.SO_BINDTODEVICE = 25
 
302
        if config is None:
 
303
            config = {}
 
304
        logger.debug(u"Creating client %r", self.name)
 
305
        # Uppercase and remove spaces from fingerprint for later
 
306
        # comparison purposes with return value from the fingerprint()
 
307
        # function
 
308
        self.fingerprint = (config[u"fingerprint"].upper()
 
309
                            .replace(u" ", u""))
 
310
        logger.debug(u"  Fingerprint: %s", self.fingerprint)
 
311
        if u"secret" in config:
 
312
            self.secret = config[u"secret"].decode(u"base64")
 
313
        elif u"secfile" in config:
 
314
            with open(os.path.expanduser(os.path.expandvars
 
315
                                         (config[u"secfile"])),
 
316
                      "rb") as secfile:
 
317
                self.secret = secfile.read()
 
318
        else:
 
319
            raise TypeError(u"No secret or secfile for client %s"
 
320
                            % self.name)
 
321
        self.host = config.get(u"host", u"")
 
322
        self.created = datetime.datetime.utcnow()
 
323
        self.enabled = False
 
324
        self.last_enabled = None
 
325
        self.last_checked_ok = None
 
326
        self.timeout = string_to_delta(config[u"timeout"])
 
327
        self.interval = string_to_delta(config[u"interval"])
 
328
        self.disable_hook = disable_hook
 
329
        self.checker = None
 
330
        self.checker_initiator_tag = None
 
331
        self.disable_initiator_tag = None
 
332
        self.checker_callback_tag = None
 
333
        self.checker_command = config[u"checker"]
 
334
        self.current_checker_command = None
 
335
        self.last_connect = None
 
336
        self._approved = None
 
337
        self.approved_by_default = config.get(u"approved_by_default",
 
338
                                              True)
 
339
        self.approvals_pending = 0
 
340
        self.approval_delay = string_to_delta(
 
341
            config[u"approval_delay"])
 
342
        self.approval_duration = string_to_delta(
 
343
            config[u"approval_duration"])
 
344
        self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())
 
345
    
 
346
    def send_changedstate(self):
 
347
        self.changedstate.acquire()
 
348
        self.changedstate.notify_all()
 
349
        self.changedstate.release()
 
350
        
 
351
    def enable(self):
 
352
        """Start this client's checker and timeout hooks"""
 
353
        if getattr(self, u"enabled", False):
 
354
            # Already enabled
 
355
            return
 
356
        self.send_changedstate()
 
357
        self.last_enabled = datetime.datetime.utcnow()
 
358
        # Schedule a new checker to be started an 'interval' from now,
 
359
        # and every interval from then on.
 
360
        self.checker_initiator_tag = (gobject.timeout_add
 
361
                                      (self.interval_milliseconds(),
 
362
                                       self.start_checker))
 
363
        # Schedule a disable() when 'timeout' has passed
 
364
        self.disable_initiator_tag = (gobject.timeout_add
 
365
                                   (self.timeout_milliseconds(),
 
366
                                    self.disable))
 
367
        self.enabled = True
 
368
        # Also start a new checker *right now*.
 
369
        self.start_checker()
 
370
    
 
371
    def disable(self, quiet=True):
 
372
        """Disable this client."""
 
373
        if not getattr(self, "enabled", False):
 
374
            return False
 
375
        if not quiet:
 
376
            self.send_changedstate()
 
377
        if not quiet:
 
378
            logger.info(u"Disabling client %s", self.name)
 
379
        if getattr(self, u"disable_initiator_tag", False):
 
380
            gobject.source_remove(self.disable_initiator_tag)
 
381
            self.disable_initiator_tag = None
 
382
        if getattr(self, u"checker_initiator_tag", False):
 
383
            gobject.source_remove(self.checker_initiator_tag)
 
384
            self.checker_initiator_tag = None
 
385
        self.stop_checker()
 
386
        if self.disable_hook:
 
387
            self.disable_hook(self)
 
388
        self.enabled = False
 
389
        # Do not run this again if called by a gobject.timeout_add
 
390
        return False
 
391
    
 
392
    def __del__(self):
 
393
        self.disable_hook = None
 
394
        self.disable()
 
395
    
 
396
    def checker_callback(self, pid, condition, command):
 
397
        """The checker has completed, so take appropriate actions."""
 
398
        self.checker_callback_tag = None
 
399
        self.checker = None
 
400
        if os.WIFEXITED(condition):
 
401
            exitstatus = os.WEXITSTATUS(condition)
 
402
            if exitstatus == 0:
 
403
                logger.info(u"Checker for %(name)s succeeded",
 
404
                            vars(self))
 
405
                self.checked_ok()
 
406
            else:
 
407
                logger.info(u"Checker for %(name)s failed",
 
408
                            vars(self))
 
409
        else:
 
410
            logger.warning(u"Checker for %(name)s crashed?",
 
411
                           vars(self))
 
412
    
 
413
    def checked_ok(self):
 
414
        """Bump up the timeout for this client.
 
415
        
 
416
        This should only be called when the client has been seen,
 
417
        alive and well.
 
418
        """
 
419
        self.last_checked_ok = datetime.datetime.utcnow()
 
420
        gobject.source_remove(self.disable_initiator_tag)
 
421
        self.disable_initiator_tag = (gobject.timeout_add
 
422
                                      (self.timeout_milliseconds(),
 
423
                                       self.disable))
 
424
    
 
425
    def start_checker(self):
 
426
        """Start a new checker subprocess if one is not running.
 
427
        
 
428
        If a checker already exists, leave it running and do
 
429
        nothing."""
 
430
        # The reason for not killing a running checker is that if we
 
431
        # did that, then if a checker (for some reason) started
 
432
        # running slowly and taking more than 'interval' time, the
 
433
        # client would inevitably timeout, since no checker would get
 
434
        # a chance to run to completion.  If we instead leave running
 
435
        # checkers alone, the checker would have to take more time
 
436
        # than 'timeout' for the client to be disabled, which is as it
 
437
        # should be.
 
438
        
 
439
        # If a checker exists, make sure it is not a zombie
 
440
        try:
 
441
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
442
        except (AttributeError, OSError), error:
 
443
            if (isinstance(error, OSError)
 
444
                and error.errno != errno.ECHILD):
 
445
                raise error
 
446
        else:
 
447
            if pid:
 
448
                logger.warning(u"Checker was a zombie")
 
449
                gobject.source_remove(self.checker_callback_tag)
 
450
                self.checker_callback(pid, status,
 
451
                                      self.current_checker_command)
 
452
        # Start a new checker if needed
 
453
        if self.checker is None:
 
454
            try:
 
455
                # In case checker_command has exactly one % operator
 
456
                command = self.checker_command % self.host
 
457
            except TypeError:
 
458
                # Escape attributes for the shell
 
459
                escaped_attrs = dict(
 
460
                    (attr,
 
461
                     re.escape(unicode(str(getattr(self, attr, u"")),
 
462
                                       errors=
 
463
                                       u'replace')))
 
464
                    for attr in
 
465
                    self.runtime_expansions)
 
466
 
 
467
                try:
 
468
                    command = self.checker_command % escaped_attrs
 
469
                except TypeError, error:
 
470
                    logger.error(u'Could not format string "%s":'
 
471
                                 u' %s', self.checker_command, error)
 
472
                    return True # Try again later
 
473
            self.current_checker_command = command
 
474
            try:
 
475
                logger.info(u"Starting checker %r for %s",
 
476
                            command, self.name)
 
477
                # We don't need to redirect stdout and stderr, since
 
478
                # in normal mode, that is already done by daemon(),
 
479
                # and in debug mode we don't want to.  (Stdin is
 
480
                # always replaced by /dev/null.)
 
481
                self.checker = subprocess.Popen(command,
 
482
                                                close_fds=True,
 
483
                                                shell=True, cwd=u"/")
 
484
                self.checker_callback_tag = (gobject.child_watch_add
 
485
                                             (self.checker.pid,
 
486
                                              self.checker_callback,
 
487
                                              data=command))
 
488
                # The checker may have completed before the gobject
 
489
                # watch was added.  Check for this.
 
490
                pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
 
491
                if pid:
 
492
                    gobject.source_remove(self.checker_callback_tag)
 
493
                    self.checker_callback(pid, status, command)
 
494
            except OSError, error:
 
495
                logger.error(u"Failed to start subprocess: %s",
 
496
                             error)
 
497
        # Re-run this periodically if run by gobject.timeout_add
 
498
        return True
 
499
    
 
500
    def stop_checker(self):
 
501
        """Force the checker process, if any, to stop."""
 
502
        if self.checker_callback_tag:
 
503
            gobject.source_remove(self.checker_callback_tag)
 
504
            self.checker_callback_tag = None
 
505
        if getattr(self, u"checker", None) is None:
 
506
            return
 
507
        logger.debug(u"Stopping checker for %(name)s", vars(self))
 
508
        try:
 
509
            os.kill(self.checker.pid, signal.SIGTERM)
 
510
            #time.sleep(0.5)
 
511
            #if self.checker.poll() is None:
 
512
            #    os.kill(self.checker.pid, signal.SIGKILL)
 
513
        except OSError, error:
 
514
            if error.errno != errno.ESRCH: # No such process
 
515
                raise
 
516
        self.checker = None
 
517
 
 
518
def dbus_service_property(dbus_interface, signature=u"v",
 
519
                          access=u"readwrite", byte_arrays=False):
 
520
    """Decorators for marking methods of a DBusObjectWithProperties to
 
521
    become properties on the D-Bus.
 
522
    
 
523
    The decorated method will be called with no arguments by "Get"
 
524
    and with one argument by "Set".
 
525
    
 
526
    The parameters, where they are supported, are the same as
 
527
    dbus.service.method, except there is only "signature", since the
 
528
    type from Get() and the type sent to Set() is the same.
 
529
    """
 
530
    # Encoding deeply encoded byte arrays is not supported yet by the
 
531
    # "Set" method, so we fail early here:
 
532
    if byte_arrays and signature != u"ay":
 
533
        raise ValueError(u"Byte arrays not supported for non-'ay'"
 
534
                         u" signature %r" % signature)
 
535
    def decorator(func):
 
536
        func._dbus_is_property = True
 
537
        func._dbus_interface = dbus_interface
 
538
        func._dbus_signature = signature
 
539
        func._dbus_access = access
 
540
        func._dbus_name = func.__name__
 
541
        if func._dbus_name.endswith(u"_dbus_property"):
 
542
            func._dbus_name = func._dbus_name[:-14]
 
543
        func._dbus_get_args_options = {u'byte_arrays': byte_arrays }
 
544
        return func
 
545
    return decorator
 
546
 
 
547
 
 
548
class DBusPropertyException(dbus.exceptions.DBusException):
 
549
    """A base class for D-Bus property-related exceptions
 
550
    """
 
551
    def __unicode__(self):
 
552
        return unicode(str(self))
 
553
 
 
554
 
 
555
class DBusPropertyAccessException(DBusPropertyException):
 
556
    """A property's access permissions disallows an operation.
 
557
    """
 
558
    pass
 
559
 
 
560
 
 
561
class DBusPropertyNotFound(DBusPropertyException):
 
562
    """An attempt was made to access a non-existing property.
 
563
    """
 
564
    pass
 
565
 
 
566
 
 
567
class DBusObjectWithProperties(dbus.service.Object):
 
568
    """A D-Bus object with properties.
 
569
 
 
570
    Classes inheriting from this can use the dbus_service_property
 
571
    decorator to expose methods as D-Bus properties.  It exposes the
 
572
    standard Get(), Set(), and GetAll() methods on the D-Bus.
 
573
    """
 
574
    
 
575
    @staticmethod
 
576
    def _is_dbus_property(obj):
 
577
        return getattr(obj, u"_dbus_is_property", False)
 
578
    
 
579
    def _get_all_dbus_properties(self):
 
580
        """Returns a generator of (name, attribute) pairs
 
581
        """
 
582
        return ((prop._dbus_name, prop)
 
583
                for name, prop in
 
584
                inspect.getmembers(self, self._is_dbus_property))
 
585
    
 
586
    def _get_dbus_property(self, interface_name, property_name):
 
587
        """Returns a bound method if one exists which is a D-Bus
 
588
        property with the specified name and interface.
 
589
        """
 
590
        for name in (property_name,
 
591
                     property_name + u"_dbus_property"):
 
592
            prop = getattr(self, name, None)
 
593
            if (prop is None
 
594
                or not self._is_dbus_property(prop)
 
595
                or prop._dbus_name != property_name
 
596
                or (interface_name and prop._dbus_interface
 
597
                    and interface_name != prop._dbus_interface)):
 
598
                continue
 
599
            return prop
 
600
        # No such property
 
601
        raise DBusPropertyNotFound(self.dbus_object_path + u":"
 
602
                                   + interface_name + u"."
 
603
                                   + property_name)
 
604
    
 
605
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",
 
606
                         out_signature=u"v")
 
607
    def Get(self, interface_name, property_name):
 
608
        """Standard D-Bus property Get() method, see D-Bus standard.
 
609
        """
 
610
        prop = self._get_dbus_property(interface_name, property_name)
 
611
        if prop._dbus_access == u"write":
 
612
            raise DBusPropertyAccessException(property_name)
 
613
        value = prop()
 
614
        if not hasattr(value, u"variant_level"):
 
615
            return value
 
616
        return type(value)(value, variant_level=value.variant_level+1)
 
617
    
 
618
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")
 
619
    def Set(self, interface_name, property_name, value):
 
620
        """Standard D-Bus property Set() method, see D-Bus standard.
 
621
        """
 
622
        prop = self._get_dbus_property(interface_name, property_name)
 
623
        if prop._dbus_access == u"read":
 
624
            raise DBusPropertyAccessException(property_name)
 
625
        if prop._dbus_get_args_options[u"byte_arrays"]:
 
626
            # The byte_arrays option is not supported yet on
 
627
            # signatures other than "ay".
 
628
            if prop._dbus_signature != u"ay":
 
629
                raise ValueError
 
630
            value = dbus.ByteArray(''.join(unichr(byte)
 
631
                                           for byte in value))
 
632
        prop(value)
 
633
    
 
634
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",
 
635
                         out_signature=u"a{sv}")
 
636
    def GetAll(self, interface_name):
 
637
        """Standard D-Bus property GetAll() method, see D-Bus
 
638
        standard.
 
639
 
 
640
        Note: Will not include properties with access="write".
 
641
        """
 
642
        all = {}
 
643
        for name, prop in self._get_all_dbus_properties():
 
644
            if (interface_name
 
645
                and interface_name != prop._dbus_interface):
 
646
                # Interface non-empty but did not match
 
647
                continue
 
648
            # Ignore write-only properties
 
649
            if prop._dbus_access == u"write":
 
650
                continue
 
651
            value = prop()
 
652
            if not hasattr(value, u"variant_level"):
 
653
                all[name] = value
 
654
                continue
 
655
            all[name] = type(value)(value, variant_level=
 
656
                                    value.variant_level+1)
 
657
        return dbus.Dictionary(all, signature=u"sv")
 
658
    
 
659
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
 
660
                         out_signature=u"s",
 
661
                         path_keyword='object_path',
 
662
                         connection_keyword='connection')
 
663
    def Introspect(self, object_path, connection):
 
664
        """Standard D-Bus method, overloaded to insert property tags.
 
665
        """
 
666
        xmlstring = dbus.service.Object.Introspect(self, object_path,
 
667
                                                   connection)
 
668
        try:
 
669
            document = xml.dom.minidom.parseString(xmlstring)
 
670
            def make_tag(document, name, prop):
 
671
                e = document.createElement(u"property")
 
672
                e.setAttribute(u"name", name)
 
673
                e.setAttribute(u"type", prop._dbus_signature)
 
674
                e.setAttribute(u"access", prop._dbus_access)
 
675
                return e
 
676
            for if_tag in document.getElementsByTagName(u"interface"):
 
677
                for tag in (make_tag(document, name, prop)
 
678
                            for name, prop
 
679
                            in self._get_all_dbus_properties()
 
680
                            if prop._dbus_interface
 
681
                            == if_tag.getAttribute(u"name")):
 
682
                    if_tag.appendChild(tag)
 
683
                # Add the names to the return values for the
 
684
                # "org.freedesktop.DBus.Properties" methods
 
685
                if (if_tag.getAttribute(u"name")
 
686
                    == u"org.freedesktop.DBus.Properties"):
 
687
                    for cn in if_tag.getElementsByTagName(u"method"):
 
688
                        if cn.getAttribute(u"name") == u"Get":
 
689
                            for arg in cn.getElementsByTagName(u"arg"):
 
690
                                if (arg.getAttribute(u"direction")
 
691
                                    == u"out"):
 
692
                                    arg.setAttribute(u"name", u"value")
 
693
                        elif cn.getAttribute(u"name") == u"GetAll":
 
694
                            for arg in cn.getElementsByTagName(u"arg"):
 
695
                                if (arg.getAttribute(u"direction")
 
696
                                    == u"out"):
 
697
                                    arg.setAttribute(u"name", u"props")
 
698
            xmlstring = document.toxml(u"utf-8")
 
699
            document.unlink()
 
700
        except (AttributeError, xml.dom.DOMException,
 
701
                xml.parsers.expat.ExpatError), error:
 
702
            logger.error(u"Failed to override Introspection method",
 
703
                         error)
 
704
        return xmlstring
 
705
 
 
706
 
 
707
class ClientDBus(Client, DBusObjectWithProperties):
 
708
    """A Client class using D-Bus
 
709
    
 
710
    Attributes:
 
711
    dbus_object_path: dbus.ObjectPath
 
712
    bus: dbus.SystemBus()
 
713
    """
 
714
    
 
715
    runtime_expansions = (Client.runtime_expansions
 
716
                          + (u"dbus_object_path",))
 
717
    
 
718
    # dbus.service.Object doesn't use super(), so we can't either.
 
719
    
 
720
    def __init__(self, bus = None, *args, **kwargs):
 
721
        self._approvals_pending = 0
 
722
        self.bus = bus
 
723
        Client.__init__(self, *args, **kwargs)
 
724
        # Only now, when this client is initialized, can it show up on
 
725
        # the D-Bus
 
726
        self.dbus_object_path = (dbus.ObjectPath
 
727
                                 (u"/clients/"
 
728
                                  + self.name.replace(u".", u"_")))
 
729
        DBusObjectWithProperties.__init__(self, self.bus,
 
730
                                          self.dbus_object_path)
 
731
        
 
732
    def _get_approvals_pending(self):
 
733
        return self._approvals_pending
 
734
    def _set_approvals_pending(self, value):
 
735
        old_value = self._approvals_pending
 
736
        self._approvals_pending = value
 
737
        bval = bool(value)
 
738
        if (hasattr(self, "dbus_object_path")
 
739
            and bval is not bool(old_value)):
 
740
            dbus_bool = dbus.Boolean(bval, variant_level=1)
 
741
            self.PropertyChanged(dbus.String(u"ApprovalPending"),
 
742
                                 dbus_bool)
 
743
 
 
744
    approvals_pending = property(_get_approvals_pending,
 
745
                                 _set_approvals_pending)
 
746
    del _get_approvals_pending, _set_approvals_pending
 
747
    
 
748
    @staticmethod
 
749
    def _datetime_to_dbus(dt, variant_level=0):
 
750
        """Convert a UTC datetime.datetime() to a D-Bus type."""
 
751
        return dbus.String(dt.isoformat(),
 
752
                           variant_level=variant_level)
 
753
    
 
754
    def enable(self):
 
755
        oldstate = getattr(self, u"enabled", False)
 
756
        r = Client.enable(self)
 
757
        if oldstate != self.enabled:
 
758
            # Emit D-Bus signals
 
759
            self.PropertyChanged(dbus.String(u"Enabled"),
 
760
                                 dbus.Boolean(True, variant_level=1))
 
761
            self.PropertyChanged(
 
762
                dbus.String(u"LastEnabled"),
 
763
                self._datetime_to_dbus(self.last_enabled,
 
764
                                       variant_level=1))
 
765
        return r
 
766
    
 
767
    def disable(self, quiet = False):
 
768
        oldstate = getattr(self, u"enabled", False)
 
769
        r = Client.disable(self, quiet=quiet)
 
770
        if not quiet and oldstate != self.enabled:
 
771
            # Emit D-Bus signal
 
772
            self.PropertyChanged(dbus.String(u"Enabled"),
 
773
                                 dbus.Boolean(False, variant_level=1))
 
774
        return r
 
775
    
 
776
    def __del__(self, *args, **kwargs):
 
777
        try:
 
778
            self.remove_from_connection()
 
779
        except LookupError:
 
780
            pass
 
781
        if hasattr(DBusObjectWithProperties, u"__del__"):
 
782
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
 
783
        Client.__del__(self, *args, **kwargs)
 
784
    
 
785
    def checker_callback(self, pid, condition, command,
 
786
                         *args, **kwargs):
 
787
        self.checker_callback_tag = None
 
788
        self.checker = None
 
789
        # Emit D-Bus signal
 
790
        self.PropertyChanged(dbus.String(u"CheckerRunning"),
 
791
                             dbus.Boolean(False, variant_level=1))
 
792
        if os.WIFEXITED(condition):
 
793
            exitstatus = os.WEXITSTATUS(condition)
 
794
            # Emit D-Bus signal
 
795
            self.CheckerCompleted(dbus.Int16(exitstatus),
 
796
                                  dbus.Int64(condition),
 
797
                                  dbus.String(command))
 
798
        else:
 
799
            # Emit D-Bus signal
 
800
            self.CheckerCompleted(dbus.Int16(-1),
 
801
                                  dbus.Int64(condition),
 
802
                                  dbus.String(command))
 
803
        
 
804
        return Client.checker_callback(self, pid, condition, command,
 
805
                                       *args, **kwargs)
 
806
    
 
807
    def checked_ok(self, *args, **kwargs):
 
808
        r = Client.checked_ok(self, *args, **kwargs)
 
809
        # Emit D-Bus signal
 
810
        self.PropertyChanged(
 
811
            dbus.String(u"LastCheckedOK"),
 
812
            (self._datetime_to_dbus(self.last_checked_ok,
 
813
                                    variant_level=1)))
 
814
        return r
 
815
    
 
816
    def start_checker(self, *args, **kwargs):
 
817
        old_checker = self.checker
 
818
        if self.checker is not None:
 
819
            old_checker_pid = self.checker.pid
 
820
        else:
 
821
            old_checker_pid = None
 
822
        r = Client.start_checker(self, *args, **kwargs)
 
823
        # Only if new checker process was started
 
824
        if (self.checker is not None
 
825
            and old_checker_pid != self.checker.pid):
 
826
            # Emit D-Bus signal
 
827
            self.CheckerStarted(self.current_checker_command)
 
828
            self.PropertyChanged(
 
829
                dbus.String(u"CheckerRunning"),
 
830
                dbus.Boolean(True, variant_level=1))
 
831
        return r
 
832
    
 
833
    def stop_checker(self, *args, **kwargs):
 
834
        old_checker = getattr(self, u"checker", None)
 
835
        r = Client.stop_checker(self, *args, **kwargs)
 
836
        if (old_checker is not None
 
837
            and getattr(self, u"checker", None) is None):
 
838
            self.PropertyChanged(dbus.String(u"CheckerRunning"),
 
839
                                 dbus.Boolean(False, variant_level=1))
 
840
        return r
 
841
 
 
842
    def _reset_approved(self):
 
843
        self._approved = None
 
844
        return False
 
845
    
 
846
    def approve(self, value=True):
 
847
        self.send_changedstate()
 
848
        self._approved = value
 
849
        gobject.timeout_add(self._timedelta_to_milliseconds
 
850
                            (self.approval_duration),
 
851
                            self._reset_approved)
 
852
    
 
853
    
 
854
    ## D-Bus methods, signals & properties
 
855
    _interface = u"se.bsnet.fukt.Mandos.Client"
 
856
    
 
857
    ## Signals
 
858
    
 
859
    # CheckerCompleted - signal
 
860
    @dbus.service.signal(_interface, signature=u"nxs")
 
861
    def CheckerCompleted(self, exitcode, waitstatus, command):
 
862
        "D-Bus signal"
 
863
        pass
 
864
    
 
865
    # CheckerStarted - signal
 
866
    @dbus.service.signal(_interface, signature=u"s")
 
867
    def CheckerStarted(self, command):
 
868
        "D-Bus signal"
 
869
        pass
 
870
    
 
871
    # PropertyChanged - signal
 
872
    @dbus.service.signal(_interface, signature=u"sv")
 
873
    def PropertyChanged(self, property, value):
 
874
        "D-Bus signal"
 
875
        pass
 
876
    
 
877
    # GotSecret - signal
 
878
    @dbus.service.signal(_interface)
 
879
    def GotSecret(self):
 
880
        """D-Bus signal
 
881
        Is sent after a successful transfer of secret from the Mandos
 
882
        server to mandos-client
 
883
        """
 
884
        pass
 
885
    
 
886
    # Rejected - signal
 
887
    @dbus.service.signal(_interface, signature=u"s")
 
888
    def Rejected(self, reason):
 
889
        "D-Bus signal"
 
890
        pass
 
891
    
 
892
    # NeedApproval - signal
 
893
    @dbus.service.signal(_interface, signature=u"tb")
 
894
    def NeedApproval(self, timeout, default):
 
895
        "D-Bus signal"
 
896
        pass
 
897
    
 
898
    ## Methods
 
899
 
 
900
    # Approve - method
 
901
    @dbus.service.method(_interface, in_signature=u"b")
 
902
    def Approve(self, value):
 
903
        self.approve(value)
 
904
 
 
905
    # CheckedOK - method
 
906
    @dbus.service.method(_interface)
 
907
    def CheckedOK(self):
 
908
        return self.checked_ok()
 
909
    
 
910
    # Enable - method
 
911
    @dbus.service.method(_interface)
 
912
    def Enable(self):
 
913
        "D-Bus method"
 
914
        self.enable()
 
915
    
 
916
    # StartChecker - method
 
917
    @dbus.service.method(_interface)
 
918
    def StartChecker(self):
 
919
        "D-Bus method"
 
920
        self.start_checker()
 
921
    
 
922
    # Disable - method
 
923
    @dbus.service.method(_interface)
 
924
    def Disable(self):
 
925
        "D-Bus method"
 
926
        self.disable()
 
927
    
 
928
    # StopChecker - method
 
929
    @dbus.service.method(_interface)
 
930
    def StopChecker(self):
 
931
        self.stop_checker()
 
932
    
 
933
    ## Properties
 
934
    
 
935
    # ApprovalPending - property
 
936
    @dbus_service_property(_interface, signature=u"b", access=u"read")
 
937
    def ApprovalPending_dbus_property(self):
 
938
        return dbus.Boolean(bool(self.approvals_pending))
 
939
    
 
940
    # ApprovedByDefault - property
 
941
    @dbus_service_property(_interface, signature=u"b",
 
942
                           access=u"readwrite")
 
943
    def ApprovedByDefault_dbus_property(self, value=None):
 
944
        if value is None:       # get
 
945
            return dbus.Boolean(self.approved_by_default)
 
946
        self.approved_by_default = bool(value)
 
947
        # Emit D-Bus signal
 
948
        self.PropertyChanged(dbus.String(u"ApprovedByDefault"),
 
949
                             dbus.Boolean(value, variant_level=1))
 
950
    
 
951
    # ApprovalDelay - property
 
952
    @dbus_service_property(_interface, signature=u"t",
 
953
                           access=u"readwrite")
 
954
    def ApprovalDelay_dbus_property(self, value=None):
 
955
        if value is None:       # get
 
956
            return dbus.UInt64(self.approval_delay_milliseconds())
 
957
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
 
958
        # Emit D-Bus signal
 
959
        self.PropertyChanged(dbus.String(u"ApprovalDelay"),
 
960
                             dbus.UInt64(value, variant_level=1))
 
961
    
 
962
    # ApprovalDuration - property
 
963
    @dbus_service_property(_interface, signature=u"t",
 
964
                           access=u"readwrite")
 
965
    def ApprovalDuration_dbus_property(self, value=None):
 
966
        if value is None:       # get
 
967
            return dbus.UInt64(self._timedelta_to_milliseconds(
 
968
                    self.approval_duration))
 
969
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
 
970
        # Emit D-Bus signal
 
971
        self.PropertyChanged(dbus.String(u"ApprovalDuration"),
 
972
                             dbus.UInt64(value, variant_level=1))
 
973
    
 
974
    # Name - property
 
975
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
976
    def Name_dbus_property(self):
 
977
        return dbus.String(self.name)
 
978
    
 
979
    # Fingerprint - property
 
980
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
981
    def Fingerprint_dbus_property(self):
 
982
        return dbus.String(self.fingerprint)
 
983
    
 
984
    # Host - property
 
985
    @dbus_service_property(_interface, signature=u"s",
 
986
                           access=u"readwrite")
 
987
    def Host_dbus_property(self, value=None):
 
988
        if value is None:       # get
 
989
            return dbus.String(self.host)
 
990
        self.host = value
 
991
        # Emit D-Bus signal
 
992
        self.PropertyChanged(dbus.String(u"Host"),
 
993
                             dbus.String(value, variant_level=1))
 
994
    
 
995
    # Created - property
 
996
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
997
    def Created_dbus_property(self):
 
998
        return dbus.String(self._datetime_to_dbus(self.created))
 
999
    
 
1000
    # LastEnabled - property
 
1001
    @dbus_service_property(_interface, signature=u"s", access=u"read")
 
1002
    def LastEnabled_dbus_property(self):
 
1003
        if self.last_enabled is None:
 
1004
            return dbus.String(u"")
 
1005
        return dbus.String(self._datetime_to_dbus(self.last_enabled))
 
1006
    
 
1007
    # Enabled - property
 
1008
    @dbus_service_property(_interface, signature=u"b",
 
1009
                           access=u"readwrite")
 
1010
    def Enabled_dbus_property(self, value=None):
 
1011
        if value is None:       # get
 
1012
            return dbus.Boolean(self.enabled)
 
1013
        if value:
 
1014
            self.enable()
 
1015
        else:
 
1016
            self.disable()
 
1017
    
 
1018
    # LastCheckedOK - property
 
1019
    @dbus_service_property(_interface, signature=u"s",
 
1020
                           access=u"readwrite")
 
1021
    def LastCheckedOK_dbus_property(self, value=None):
 
1022
        if value is not None:
 
1023
            self.checked_ok()
 
1024
            return
 
1025
        if self.last_checked_ok is None:
 
1026
            return dbus.String(u"")
 
1027
        return dbus.String(self._datetime_to_dbus(self
 
1028
                                                  .last_checked_ok))
 
1029
    
 
1030
    # Timeout - property
 
1031
    @dbus_service_property(_interface, signature=u"t",
 
1032
                           access=u"readwrite")
 
1033
    def Timeout_dbus_property(self, value=None):
 
1034
        if value is None:       # get
 
1035
            return dbus.UInt64(self.timeout_milliseconds())
 
1036
        self.timeout = datetime.timedelta(0, 0, 0, value)
 
1037
        # Emit D-Bus signal
 
1038
        self.PropertyChanged(dbus.String(u"Timeout"),
 
1039
                             dbus.UInt64(value, variant_level=1))
 
1040
        if getattr(self, u"disable_initiator_tag", None) is None:
 
1041
            return
 
1042
        # Reschedule timeout
 
1043
        gobject.source_remove(self.disable_initiator_tag)
 
1044
        self.disable_initiator_tag = None
 
1045
        time_to_die = (self.
 
1046
                       _timedelta_to_milliseconds((self
 
1047
                                                   .last_checked_ok
 
1048
                                                   + self.timeout)
 
1049
                                                  - datetime.datetime
 
1050
                                                  .utcnow()))
 
1051
        if time_to_die <= 0:
 
1052
            # The timeout has passed
 
1053
            self.disable()
 
1054
        else:
 
1055
            self.disable_initiator_tag = (gobject.timeout_add
 
1056
                                          (time_to_die, self.disable))
 
1057
    
 
1058
    # Interval - property
 
1059
    @dbus_service_property(_interface, signature=u"t",
 
1060
                           access=u"readwrite")
 
1061
    def Interval_dbus_property(self, value=None):
 
1062
        if value is None:       # get
 
1063
            return dbus.UInt64(self.interval_milliseconds())
 
1064
        self.interval = datetime.timedelta(0, 0, 0, value)
 
1065
        # Emit D-Bus signal
 
1066
        self.PropertyChanged(dbus.String(u"Interval"),
 
1067
                             dbus.UInt64(value, variant_level=1))
 
1068
        if getattr(self, u"checker_initiator_tag", None) is None:
 
1069
            return
 
1070
        # Reschedule checker run
 
1071
        gobject.source_remove(self.checker_initiator_tag)
 
1072
        self.checker_initiator_tag = (gobject.timeout_add
 
1073
                                      (value, self.start_checker))
 
1074
        self.start_checker()    # Start one now, too
 
1075
 
 
1076
    # Checker - property
 
1077
    @dbus_service_property(_interface, signature=u"s",
 
1078
                           access=u"readwrite")
 
1079
    def Checker_dbus_property(self, value=None):
 
1080
        if value is None:       # get
 
1081
            return dbus.String(self.checker_command)
 
1082
        self.checker_command = value
 
1083
        # Emit D-Bus signal
 
1084
        self.PropertyChanged(dbus.String(u"Checker"),
 
1085
                             dbus.String(self.checker_command,
 
1086
                                         variant_level=1))
 
1087
    
 
1088
    # CheckerRunning - property
 
1089
    @dbus_service_property(_interface, signature=u"b",
 
1090
                           access=u"readwrite")
 
1091
    def CheckerRunning_dbus_property(self, value=None):
 
1092
        if value is None:       # get
 
1093
            return dbus.Boolean(self.checker is not None)
 
1094
        if value:
 
1095
            self.start_checker()
 
1096
        else:
 
1097
            self.stop_checker()
 
1098
    
 
1099
    # ObjectPath - property
 
1100
    @dbus_service_property(_interface, signature=u"o", access=u"read")
 
1101
    def ObjectPath_dbus_property(self):
 
1102
        return self.dbus_object_path # is already a dbus.ObjectPath
 
1103
    
 
1104
    # Secret = property
 
1105
    @dbus_service_property(_interface, signature=u"ay",
 
1106
                           access=u"write", byte_arrays=True)
 
1107
    def Secret_dbus_property(self, value):
 
1108
        self.secret = str(value)
 
1109
    
 
1110
    del _interface
 
1111
 
 
1112
 
 
1113
class ProxyClient(object):
 
1114
    def __init__(self, child_pipe, fpr, address):
 
1115
        self._pipe = child_pipe
 
1116
        self._pipe.send(('init', fpr, address))
 
1117
        if not self._pipe.recv():
 
1118
            raise KeyError()
 
1119
 
 
1120
    def __getattribute__(self, name):
 
1121
        if(name == '_pipe'):
 
1122
            return super(ProxyClient, self).__getattribute__(name)
 
1123
        self._pipe.send(('getattr', name))
 
1124
        data = self._pipe.recv()
 
1125
        if data[0] == 'data':
 
1126
            return data[1]
 
1127
        if data[0] == 'function':
 
1128
            def func(*args, **kwargs):
 
1129
                self._pipe.send(('funcall', name, args, kwargs))
 
1130
                return self._pipe.recv()[1]
 
1131
            return func
 
1132
 
 
1133
    def __setattr__(self, name, value):
 
1134
        if(name == '_pipe'):
 
1135
            return super(ProxyClient, self).__setattr__(name, value)
 
1136
        self._pipe.send(('setattr', name, value))
 
1137
 
 
1138
 
 
1139
class ClientHandler(socketserver.BaseRequestHandler, object):
 
1140
    """A class to handle client connections.
 
1141
    
 
1142
    Instantiated once for each connection to handle it.
 
1143
    Note: This will run in its own forked process."""
 
1144
    
 
1145
    def handle(self):
 
1146
        with contextlib.closing(self.server.child_pipe) as child_pipe:
 
1147
            logger.info(u"TCP connection from: %s",
 
1148
                        unicode(self.client_address))
 
1149
            logger.debug(u"Pipe FD: %d",
 
1150
                         self.server.child_pipe.fileno())
 
1151
 
 
1152
            session = (gnutls.connection
 
1153
                       .ClientSession(self.request,
 
1154
                                      gnutls.connection
 
1155
                                      .X509Credentials()))
 
1156
 
 
1157
            # Note: gnutls.connection.X509Credentials is really a
 
1158
            # generic GnuTLS certificate credentials object so long as
 
1159
            # no X.509 keys are added to it.  Therefore, we can use it
 
1160
            # here despite using OpenPGP certificates.
 
1161
 
 
1162
            #priority = u':'.join((u"NONE", u"+VERS-TLS1.1",
 
1163
            #                      u"+AES-256-CBC", u"+SHA1",
 
1164
            #                      u"+COMP-NULL", u"+CTYPE-OPENPGP",
 
1165
            #                      u"+DHE-DSS"))
 
1166
            # Use a fallback default, since this MUST be set.
 
1167
            priority = self.server.gnutls_priority
 
1168
            if priority is None:
 
1169
                priority = u"NORMAL"
 
1170
            (gnutls.library.functions
 
1171
             .gnutls_priority_set_direct(session._c_object,
 
1172
                                         priority, None))
 
1173
 
 
1174
            # Start communication using the Mandos protocol
 
1175
            # Get protocol number
 
1176
            line = self.request.makefile().readline()
 
1177
            logger.debug(u"Protocol version: %r", line)
 
1178
            try:
 
1179
                if int(line.strip().split()[0]) > 1:
 
1180
                    raise RuntimeError
 
1181
            except (ValueError, IndexError, RuntimeError), error:
 
1182
                logger.error(u"Unknown protocol version: %s", error)
 
1183
                return
 
1184
 
 
1185
            # Start GnuTLS connection
 
1186
            try:
 
1187
                session.handshake()
 
1188
            except gnutls.errors.GNUTLSError, error:
 
1189
                logger.warning(u"Handshake failed: %s", error)
 
1190
                # Do not run session.bye() here: the session is not
 
1191
                # established.  Just abandon the request.
 
1192
                return
 
1193
            logger.debug(u"Handshake succeeded")
 
1194
 
 
1195
            approval_required = False
 
1196
            try:
 
1197
                try:
 
1198
                    fpr = self.fingerprint(self.peer_certificate
 
1199
                                           (session))
 
1200
                except (TypeError, gnutls.errors.GNUTLSError), error:
 
1201
                    logger.warning(u"Bad certificate: %s", error)
 
1202
                    return
 
1203
                logger.debug(u"Fingerprint: %s", fpr)
 
1204
 
 
1205
                try:
 
1206
                    client = ProxyClient(child_pipe, fpr,
 
1207
                                         self.client_address)
 
1208
                except KeyError:
 
1209
                    return
 
1210
                
 
1211
                if client.approval_delay:
 
1212
                    delay = client.approval_delay
 
1213
                    client.approvals_pending += 1
 
1214
                    approval_required = True
 
1215
                
 
1216
                while True:
 
1217
                    if not client.enabled:
 
1218
                        logger.warning(u"Client %s is disabled",
 
1219
                                       client.name)
 
1220
                        if self.server.use_dbus:
 
1221
                            # Emit D-Bus signal
 
1222
                            client.Rejected("Disabled")                    
 
1223
                        return
 
1224
                    
 
1225
                    if client._approved or not client.approval_delay:
 
1226
                        #We are approved or approval is disabled
 
1227
                        break
 
1228
                    elif client._approved is None:
 
1229
                        logger.info(u"Client %s needs approval",
 
1230
                                    client.name)
 
1231
                        if self.server.use_dbus:
 
1232
                            # Emit D-Bus signal
 
1233
                            client.NeedApproval(
 
1234
                                client.approval_delay_milliseconds(),
 
1235
                                client.approved_by_default)
 
1236
                    else:
 
1237
                        logger.warning(u"Client %s was not approved",
 
1238
                                       client.name)
 
1239
                        if self.server.use_dbus:
 
1240
                            # Emit D-Bus signal
 
1241
                            client.Rejected("Denied")
 
1242
                        return
 
1243
                    
 
1244
                    #wait until timeout or approved
 
1245
                    #x = float(client._timedelta_to_milliseconds(delay))
 
1246
                    time = datetime.datetime.now()
 
1247
                    client.changedstate.acquire()
 
1248
                    client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))
 
1249
                    client.changedstate.release()
 
1250
                    time2 = datetime.datetime.now()
 
1251
                    if (time2 - time) >= delay:
 
1252
                        if not client.approved_by_default:
 
1253
                            logger.warning("Client %s timed out while"
 
1254
                                           " waiting for approval",
 
1255
                                           client.name)
 
1256
                            if self.server.use_dbus:
 
1257
                                # Emit D-Bus signal
 
1258
                                client.Rejected("Approval timed out")
 
1259
                            return
 
1260
                        else:
 
1261
                            break
 
1262
                    else:
 
1263
                        delay -= time2 - time
 
1264
                
 
1265
                sent_size = 0
 
1266
                while sent_size < len(client.secret):
 
1267
                    try:
 
1268
                        sent = session.send(client.secret[sent_size:])
 
1269
                    except (gnutls.errors.GNUTLSError), error:
 
1270
                        logger.warning("gnutls send failed")
 
1271
                        return
 
1272
                    logger.debug(u"Sent: %d, remaining: %d",
 
1273
                                 sent, len(client.secret)
 
1274
                                 - (sent_size + sent))
 
1275
                    sent_size += sent
 
1276
 
 
1277
                logger.info(u"Sending secret to %s", client.name)
 
1278
                # bump the timeout as if seen
 
1279
                client.checked_ok()
 
1280
                if self.server.use_dbus:
 
1281
                    # Emit D-Bus signal
 
1282
                    client.GotSecret()
 
1283
            
 
1284
            finally:
 
1285
                if approval_required:
 
1286
                    client.approvals_pending -= 1
 
1287
                try:
 
1288
                    session.bye()
 
1289
                except (gnutls.errors.GNUTLSError), error:
 
1290
                    logger.warning("GnuTLS bye failed")
 
1291
    
 
1292
    @staticmethod
 
1293
    def peer_certificate(session):
 
1294
        "Return the peer's OpenPGP certificate as a bytestring"
 
1295
        # If not an OpenPGP certificate...
 
1296
        if (gnutls.library.functions
 
1297
            .gnutls_certificate_type_get(session._c_object)
 
1298
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
 
1299
            # ...do the normal thing
 
1300
            return session.peer_certificate
 
1301
        list_size = ctypes.c_uint(1)
 
1302
        cert_list = (gnutls.library.functions
 
1303
                     .gnutls_certificate_get_peers
 
1304
                     (session._c_object, ctypes.byref(list_size)))
 
1305
        if not bool(cert_list) and list_size.value != 0:
 
1306
            raise gnutls.errors.GNUTLSError(u"error getting peer"
 
1307
                                            u" certificate")
 
1308
        if list_size.value == 0:
 
1309
            return None
 
1310
        cert = cert_list[0]
 
1311
        return ctypes.string_at(cert.data, cert.size)
 
1312
    
 
1313
    @staticmethod
 
1314
    def fingerprint(openpgp):
 
1315
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
 
1316
        # New GnuTLS "datum" with the OpenPGP public key
 
1317
        datum = (gnutls.library.types
 
1318
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
 
1319
                                             ctypes.POINTER
 
1320
                                             (ctypes.c_ubyte)),
 
1321
                                 ctypes.c_uint(len(openpgp))))
 
1322
        # New empty GnuTLS certificate
 
1323
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
 
1324
        (gnutls.library.functions
 
1325
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
 
1326
        # Import the OpenPGP public key into the certificate
 
1327
        (gnutls.library.functions
 
1328
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
 
1329
                                    gnutls.library.constants
 
1330
                                    .GNUTLS_OPENPGP_FMT_RAW))
 
1331
        # Verify the self signature in the key
 
1332
        crtverify = ctypes.c_uint()
 
1333
        (gnutls.library.functions
 
1334
         .gnutls_openpgp_crt_verify_self(crt, 0,
 
1335
                                         ctypes.byref(crtverify)))
 
1336
        if crtverify.value != 0:
 
1337
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1338
            raise (gnutls.errors.CertificateSecurityError
 
1339
                   (u"Verify failed"))
 
1340
        # New buffer for the fingerprint
 
1341
        buf = ctypes.create_string_buffer(20)
 
1342
        buf_len = ctypes.c_size_t()
 
1343
        # Get the fingerprint from the certificate into the buffer
 
1344
        (gnutls.library.functions
 
1345
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
 
1346
                                             ctypes.byref(buf_len)))
 
1347
        # Deinit the certificate
 
1348
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
 
1349
        # Convert the buffer to a Python bytestring
 
1350
        fpr = ctypes.string_at(buf, buf_len.value)
 
1351
        # Convert the bytestring to hexadecimal notation
 
1352
        hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)
 
1353
        return hex_fpr
 
1354
 
 
1355
 
 
1356
class MultiprocessingMixIn(object):
 
1357
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
 
1358
    def sub_process_main(self, request, address):
 
1359
        try:
 
1360
            self.finish_request(request, address)
 
1361
        except:
 
1362
            self.handle_error(request, address)
 
1363
        self.close_request(request)
 
1364
            
 
1365
    def process_request(self, request, address):
 
1366
        """Start a new process to process the request."""
 
1367
        multiprocessing.Process(target = self.sub_process_main,
 
1368
                                args = (request, address)).start()
 
1369
 
 
1370
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
 
1371
    """ adds a pipe to the MixIn """
 
1372
    def process_request(self, request, client_address):
 
1373
        """Overrides and wraps the original process_request().
 
1374
        
 
1375
        This function creates a new pipe in self.pipe
 
1376
        """
 
1377
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
 
1378
 
 
1379
        super(MultiprocessingMixInWithPipe,
 
1380
              self).process_request(request, client_address)
 
1381
        self.child_pipe.close()
 
1382
        self.add_pipe(parent_pipe)
 
1383
 
 
1384
    def add_pipe(self, parent_pipe):
 
1385
        """Dummy function; override as necessary"""
 
1386
        pass
 
1387
 
 
1388
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
 
1389
                     socketserver.TCPServer, object):
 
1390
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
 
1391
    
 
1392
    Attributes:
 
1393
        enabled:        Boolean; whether this server is activated yet
 
1394
        interface:      None or a network interface name (string)
 
1395
        use_ipv6:       Boolean; to use IPv6 or not
 
1396
    """
 
1397
    def __init__(self, server_address, RequestHandlerClass,
 
1398
                 interface=None, use_ipv6=True):
 
1399
        self.interface = interface
 
1400
        if use_ipv6:
 
1401
            self.address_family = socket.AF_INET6
 
1402
        socketserver.TCPServer.__init__(self, server_address,
 
1403
                                        RequestHandlerClass)
 
1404
    def server_bind(self):
 
1405
        """This overrides the normal server_bind() function
 
1406
        to bind to an interface if one was specified, and also NOT to
 
1407
        bind to an address or port if they were not specified."""
 
1408
        if self.interface is not None:
 
1409
            if SO_BINDTODEVICE is None:
 
1410
                logger.error(u"SO_BINDTODEVICE does not exist;"
 
1411
                             u" cannot bind to interface %s",
 
1412
                             self.interface)
 
1413
            else:
52
1414
                try:
53
1415
                    self.socket.setsockopt(socket.SOL_SOCKET,
54
 
                                           socket.SO_BINDTODEVICE,
55
 
                                           self.options.interface)
 
1416
                                           SO_BINDTODEVICE,
 
1417
                                           str(self.interface
 
1418
                                               + u'\0'))
56
1419
                except socket.error, error:
57
1420
                    if error[0] == errno.EPERM:
58
 
                        print "Warning: No permission to bind to interface", \
59
 
                              self.options.interface
 
1421
                        logger.error(u"No permission to"
 
1422
                                     u" bind to interface %s",
 
1423
                                     self.interface)
 
1424
                    elif error[0] == errno.ENOPROTOOPT:
 
1425
                        logger.error(u"SO_BINDTODEVICE not available;"
 
1426
                                     u" cannot bind to interface %s",
 
1427
                                     self.interface)
60
1428
                    else:
61
 
                        raise error
62
 
            return super(type(self), self).server_bind()
63
 
        attrs["server_bind"] = server_bind
64
 
        def init(self, *args, **kwargs):
65
 
            if "options" in kwargs:
66
 
                self.options = kwargs["options"]
67
 
                del kwargs["options"]
68
 
            if "clients" in kwargs:
69
 
                self.clients = kwargs["clients"]
70
 
                del kwargs["clients"]
71
 
            if "credentials" in kwargs:
72
 
                self.credentials = kwargs["credentials"]
73
 
                del kwargs["credentials"]
74
 
            return super(type(self), self).__init__(*args, **kwargs)
75
 
        attrs["__init__"] = init
76
 
        return type.__new__(cls, name, bases, attrs)
77
 
 
78
 
 
79
 
class udp_handler(SocketServer.DatagramRequestHandler, object):
80
 
    def handle(self):
81
 
        self.wfile.write("Polo")
82
 
        print "UDP request answered"
83
 
 
84
 
 
85
 
class IPv6_UDPServer(SocketServer.UDPServer, object):
86
 
    __metaclass__ = server_metaclass
87
 
    def verify_request(self, request, client_address):
88
 
        print "UDP request came"
89
 
        return request[0] == "Marco"
90
 
 
91
 
 
92
 
class tcp_handler(SocketServer.BaseRequestHandler, object):
93
 
    def handle(self):
94
 
        print "TCP request came"
95
 
        print "Request:", self.request
96
 
        print "Client Address:", self.client_address
97
 
        print "Server:", self.server
98
 
        session = gnutls.connection.ServerSession(self.request,
99
 
                                                  self.server.credentials)
100
 
        session.handshake()
101
 
        if session.peer_certificate:
102
 
            print "DN:", session.peer_certificate.subject
103
 
        try:
104
 
            session.verify_peer()
105
 
        except gnutls.errors.CertificateError, error:
106
 
            print "Verify failed", error
107
 
            session.bye()
108
 
            return
109
 
        try:
110
 
            session.send(dict((client.dn, client.password)
111
 
                              for client in self.server.clients)
112
 
                         [session.peer_certificate.subject])
113
 
        except KeyError:
114
 
            session.send("gazonk")
115
 
            # Log maybe? XXX
116
 
        session.bye()
117
 
 
118
 
 
119
 
class IPv6_TCPServer(SocketServer.ForkingTCPServer, object):
120
 
    __metaclass__ = server_metaclass
121
 
    request_queue_size = 1024
122
 
 
123
 
 
124
 
in6addr_any = "::"
125
 
 
126
 
cred = None
 
1429
                        raise
 
1430
        # Only bind(2) the socket if we really need to.
 
1431
        if self.server_address[0] or self.server_address[1]:
 
1432
            if not self.server_address[0]:
 
1433
                if self.address_family == socket.AF_INET6:
 
1434
                    any_address = u"::" # in6addr_any
 
1435
                else:
 
1436
                    any_address = socket.INADDR_ANY
 
1437
                self.server_address = (any_address,
 
1438
                                       self.server_address[1])
 
1439
            elif not self.server_address[1]:
 
1440
                self.server_address = (self.server_address[0],
 
1441
                                       0)
 
1442
#                 if self.interface:
 
1443
#                     self.server_address = (self.server_address[0],
 
1444
#                                            0, # port
 
1445
#                                            0, # flowinfo
 
1446
#                                            if_nametoindex
 
1447
#                                            (self.interface))
 
1448
            return socketserver.TCPServer.server_bind(self)
 
1449
 
 
1450
 
 
1451
class MandosServer(IPv6_TCPServer):
 
1452
    """Mandos server.
 
1453
    
 
1454
    Attributes:
 
1455
        clients:        set of Client objects
 
1456
        gnutls_priority GnuTLS priority string
 
1457
        use_dbus:       Boolean; to emit D-Bus signals or not
 
1458
    
 
1459
    Assumes a gobject.MainLoop event loop.
 
1460
    """
 
1461
    def __init__(self, server_address, RequestHandlerClass,
 
1462
                 interface=None, use_ipv6=True, clients=None,
 
1463
                 gnutls_priority=None, use_dbus=True):
 
1464
        self.enabled = False
 
1465
        self.clients = clients
 
1466
        if self.clients is None:
 
1467
            self.clients = set()
 
1468
        self.use_dbus = use_dbus
 
1469
        self.gnutls_priority = gnutls_priority
 
1470
        IPv6_TCPServer.__init__(self, server_address,
 
1471
                                RequestHandlerClass,
 
1472
                                interface = interface,
 
1473
                                use_ipv6 = use_ipv6)
 
1474
    def server_activate(self):
 
1475
        if self.enabled:
 
1476
            return socketserver.TCPServer.server_activate(self)
 
1477
    def enable(self):
 
1478
        self.enabled = True
 
1479
    def add_pipe(self, parent_pipe):
 
1480
        # Call "handle_ipc" for both data and EOF events
 
1481
        gobject.io_add_watch(parent_pipe.fileno(),
 
1482
                             gobject.IO_IN | gobject.IO_HUP,
 
1483
                             functools.partial(self.handle_ipc,
 
1484
                                               parent_pipe = parent_pipe))
 
1485
        
 
1486
    def handle_ipc(self, source, condition, parent_pipe=None,
 
1487
                   client_object=None):
 
1488
        condition_names = {
 
1489
            gobject.IO_IN: u"IN",   # There is data to read.
 
1490
            gobject.IO_OUT: u"OUT", # Data can be written (without
 
1491
                                    # blocking).
 
1492
            gobject.IO_PRI: u"PRI", # There is urgent data to read.
 
1493
            gobject.IO_ERR: u"ERR", # Error condition.
 
1494
            gobject.IO_HUP: u"HUP"  # Hung up (the connection has been
 
1495
                                    # broken, usually for pipes and
 
1496
                                    # sockets).
 
1497
            }
 
1498
        conditions_string = ' | '.join(name
 
1499
                                       for cond, name in
 
1500
                                       condition_names.iteritems()
 
1501
                                       if cond & condition)
 
1502
        # error or the other end of multiprocessing.Pipe has closed
 
1503
        if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):
 
1504
            return False
 
1505
        
 
1506
        # Read a request from the child
 
1507
        request = parent_pipe.recv()
 
1508
        command = request[0]
 
1509
        
 
1510
        if command == 'init':
 
1511
            fpr = request[1]
 
1512
            address = request[2]
 
1513
            
 
1514
            for c in self.clients:
 
1515
                if c.fingerprint == fpr:
 
1516
                    client = c
 
1517
                    break
 
1518
            else:
 
1519
                logger.warning(u"Client not found for fingerprint: %s, ad"
 
1520
                               u"dress: %s", fpr, address)
 
1521
                if self.use_dbus:
 
1522
                    # Emit D-Bus signal
 
1523
                    mandos_dbus_service.ClientNotFound(fpr, address)
 
1524
                parent_pipe.send(False)
 
1525
                return False
 
1526
            
 
1527
            gobject.io_add_watch(parent_pipe.fileno(),
 
1528
                                 gobject.IO_IN | gobject.IO_HUP,
 
1529
                                 functools.partial(self.handle_ipc,
 
1530
                                                   parent_pipe = parent_pipe,
 
1531
                                                   client_object = client))
 
1532
            parent_pipe.send(True)
 
1533
            # remove the old hook in favor of the new above hook on same fileno
 
1534
            return False
 
1535
        if command == 'funcall':
 
1536
            funcname = request[1]
 
1537
            args = request[2]
 
1538
            kwargs = request[3]
 
1539
            
 
1540
            parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))
 
1541
 
 
1542
        if command == 'getattr':
 
1543
            attrname = request[1]
 
1544
            if callable(client_object.__getattribute__(attrname)):
 
1545
                parent_pipe.send(('function',))
 
1546
            else:
 
1547
                parent_pipe.send(('data', client_object.__getattribute__(attrname)))
 
1548
        
 
1549
        if command == 'setattr':
 
1550
            attrname = request[1]
 
1551
            value = request[2]
 
1552
            setattr(client_object, attrname, value)
 
1553
 
 
1554
        return True
 
1555
 
127
1556
 
128
1557
def string_to_delta(interval):
129
1558
    """Parse a string and return a datetime.timedelta
130
 
 
131
 
    >>> string_to_delta('7d')
 
1559
    
 
1560
    >>> string_to_delta(u'7d')
132
1561
    datetime.timedelta(7)
133
 
    >>> string_to_delta('60s')
 
1562
    >>> string_to_delta(u'60s')
134
1563
    datetime.timedelta(0, 60)
135
 
    >>> string_to_delta('60m')
 
1564
    >>> string_to_delta(u'60m')
136
1565
    datetime.timedelta(0, 3600)
137
 
    >>> string_to_delta('24h')
 
1566
    >>> string_to_delta(u'24h')
138
1567
    datetime.timedelta(1)
139
1568
    >>> string_to_delta(u'1w')
140
1569
    datetime.timedelta(7)
 
1570
    >>> string_to_delta(u'5m 30s')
 
1571
    datetime.timedelta(0, 330)
141
1572
    """
 
1573
    timevalue = datetime.timedelta(0)
 
1574
    for s in interval.split():
 
1575
        try:
 
1576
            suffix = unicode(s[-1])
 
1577
            value = int(s[:-1])
 
1578
            if suffix == u"d":
 
1579
                delta = datetime.timedelta(value)
 
1580
            elif suffix == u"s":
 
1581
                delta = datetime.timedelta(0, value)
 
1582
            elif suffix == u"m":
 
1583
                delta = datetime.timedelta(0, 0, 0, 0, value)
 
1584
            elif suffix == u"h":
 
1585
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
 
1586
            elif suffix == u"w":
 
1587
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
 
1588
            else:
 
1589
                raise ValueError(u"Unknown suffix %r" % suffix)
 
1590
        except (ValueError, IndexError), e:
 
1591
            raise ValueError(e.message)
 
1592
        timevalue += delta
 
1593
    return timevalue
 
1594
 
 
1595
 
 
1596
def if_nametoindex(interface):
 
1597
    """Call the C function if_nametoindex(), or equivalent
 
1598
    
 
1599
    Note: This function cannot accept a unicode string."""
 
1600
    global if_nametoindex
142
1601
    try:
143
 
        suffix=unicode(interval[-1])
144
 
        value=int(interval[:-1])
145
 
        if suffix == u"d":
146
 
            delta = datetime.timedelta(value)
147
 
        elif suffix == u"s":
148
 
            delta = datetime.timedelta(0, value)
149
 
        elif suffix == u"m":
150
 
            delta = datetime.timedelta(0, 0, 0, 0, value)
151
 
        elif suffix == u"h":
152
 
            delta = datetime.timedelta(0, 0, 0, 0, 0, value)
153
 
        elif suffix == u"w":
154
 
            delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
155
 
        else:
156
 
            raise ValueError
157
 
    except (ValueError, IndexError):
158
 
        raise ValueError
159
 
    return delta
 
1602
        if_nametoindex = (ctypes.cdll.LoadLibrary
 
1603
                          (ctypes.util.find_library(u"c"))
 
1604
                          .if_nametoindex)
 
1605
    except (OSError, AttributeError):
 
1606
        logger.warning(u"Doing if_nametoindex the hard way")
 
1607
        def if_nametoindex(interface):
 
1608
            "Get an interface index the hard way, i.e. using fcntl()"
 
1609
            SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
 
1610
            with contextlib.closing(socket.socket()) as s:
 
1611
                ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
 
1612
                                    struct.pack(str(u"16s16x"),
 
1613
                                                interface))
 
1614
            interface_index = struct.unpack(str(u"I"),
 
1615
                                            ifreq[16:20])[0]
 
1616
            return interface_index
 
1617
    return if_nametoindex(interface)
 
1618
 
 
1619
 
 
1620
def daemon(nochdir = False, noclose = False):
 
1621
    """See daemon(3).  Standard BSD Unix function.
 
1622
    
 
1623
    This should really exist as os.daemon, but it doesn't (yet)."""
 
1624
    if os.fork():
 
1625
        sys.exit()
 
1626
    os.setsid()
 
1627
    if not nochdir:
 
1628
        os.chdir(u"/")
 
1629
    if os.fork():
 
1630
        sys.exit()
 
1631
    if not noclose:
 
1632
        # Close all standard open file descriptors
 
1633
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1634
        if not stat.S_ISCHR(os.fstat(null).st_mode):
 
1635
            raise OSError(errno.ENODEV,
 
1636
                          u"%s not a character device"
 
1637
                          % os.path.devnull)
 
1638
        os.dup2(null, sys.stdin.fileno())
 
1639
        os.dup2(null, sys.stdout.fileno())
 
1640
        os.dup2(null, sys.stderr.fileno())
 
1641
        if null > 2:
 
1642
            os.close(null)
 
1643
 
160
1644
 
161
1645
def main():
162
 
    parser = OptionParser()
163
 
    parser.add_option("-i", "--interface", type="string",
164
 
                      default="eth0", metavar="IF",
165
 
                      help="Interface to bind to")
166
 
    parser.add_option("--cert", type="string", default="cert.pem",
167
 
                      metavar="FILE",
168
 
                      help="Public key certificate to use")
169
 
    parser.add_option("--key", type="string", default="key.pem",
170
 
                      metavar="FILE",
171
 
                      help="Private key to use")
172
 
    parser.add_option("--ca", type="string", default="ca.pem",
173
 
                      metavar="FILE",
174
 
                      help="Certificate Authority certificate to use")
175
 
    parser.add_option("--crl", type="string", default="crl.pem",
176
 
                      metavar="FILE",
177
 
                      help="Certificate Revokation List to use")
178
 
    parser.add_option("-p", "--port", type="int", default=49001,
179
 
                      help="Port number to receive requests on")
180
 
    parser.add_option("--dh", type="int", metavar="BITS",
181
 
                      help="DH group to use")
182
 
    parser.add_option("-t", "--timeout", type="string", # Parsed later
183
 
                      default="15m",
184
 
                      help="Amount of downtime allowed for clients")
185
 
    parser.add_option("--interval", type="string", # Parsed later
186
 
                      default="5m",
187
 
                      help="How often to check that a client is up")
188
 
    parser.add_option("--check", action="store_true", default=False,
189
 
                      help="Run self-test")
190
 
    (options, args) = parser.parse_args()
191
 
 
 
1646
    
 
1647
    ##################################################################
 
1648
    # Parsing of options, both command line and config file
 
1649
    
 
1650
    parser = optparse.OptionParser(version = "%%prog %s" % version)
 
1651
    parser.add_option("-i", u"--interface", type=u"string",
 
1652
                      metavar="IF", help=u"Bind to interface IF")
 
1653
    parser.add_option("-a", u"--address", type=u"string",
 
1654
                      help=u"Address to listen for requests on")
 
1655
    parser.add_option("-p", u"--port", type=u"int",
 
1656
                      help=u"Port number to receive requests on")
 
1657
    parser.add_option("--check", action=u"store_true",
 
1658
                      help=u"Run self-test")
 
1659
    parser.add_option("--debug", action=u"store_true",
 
1660
                      help=u"Debug mode; run in foreground and log to"
 
1661
                      u" terminal")
 
1662
    parser.add_option("--debuglevel", type=u"string", metavar="Level",
 
1663
                      help=u"Debug level for stdout output")
 
1664
    parser.add_option("--priority", type=u"string", help=u"GnuTLS"
 
1665
                      u" priority string (see GnuTLS documentation)")
 
1666
    parser.add_option("--servicename", type=u"string",
 
1667
                      metavar=u"NAME", help=u"Zeroconf service name")
 
1668
    parser.add_option("--configdir", type=u"string",
 
1669
                      default=u"/etc/mandos", metavar=u"DIR",
 
1670
                      help=u"Directory to search for configuration"
 
1671
                      u" files")
 
1672
    parser.add_option("--no-dbus", action=u"store_false",
 
1673
                      dest=u"use_dbus", help=u"Do not provide D-Bus"
 
1674
                      u" system bus interface")
 
1675
    parser.add_option("--no-ipv6", action=u"store_false",
 
1676
                      dest=u"use_ipv6", help=u"Do not use IPv6")
 
1677
    options = parser.parse_args()[0]
 
1678
    
192
1679
    if options.check:
193
1680
        import doctest
194
1681
        doctest.testmod()
195
1682
        sys.exit()
196
1683
    
197
 
    # Parse the time arguments
198
 
    try:
199
 
        options.timeout = string_to_delta(options.timeout)
200
 
    except ValueError:
201
 
        parser.error("option --timeout: Unparseable time")
202
 
    
203
 
    try:
204
 
        options.interval = string_to_delta(options.interval)
205
 
    except ValueError:
206
 
        parser.error("option --interval: Unparseable time")
207
 
    
208
 
    cert = gnutls.crypto.X509Certificate(open(options.cert).read())
209
 
    key = gnutls.crypto.X509PrivateKey(open(options.key).read())
210
 
    ca = gnutls.crypto.X509Certificate(open(options.ca).read())
211
 
    crl = gnutls.crypto.X509CRL(open(options.crl).read())
212
 
    cred = gnutls.connection.X509Credentials(cert, key, [ca], [crl])
213
 
    
214
 
    # Parse config file
215
 
    defaults = {}
216
 
    client_config_object = ConfigParser.SafeConfigParser(defaults)
217
 
    client_config_object.read("mandos-clients.conf")
218
 
    clients = [Client(name=section, options=options,
219
 
                      **(dict(client_config_object.items(section))))
220
 
               for section in client_config_object.sections()]
221
 
    
222
 
    udp_server = IPv6_UDPServer((in6addr_any, options.port),
223
 
                                udp_handler,
224
 
                                options=options)
225
 
    
226
 
    tcp_server = IPv6_TCPServer((in6addr_any, options.port),
227
 
                                tcp_handler,
228
 
                                options=options,
229
 
                                clients=clients,
230
 
                                credentials=cred)
231
 
    
232
 
    while True:
233
 
        in_, out, err = select.select((udp_server,
234
 
                                       tcp_server), (), ())
235
 
        for server in in_:
236
 
            server.handle_request()
237
 
 
238
 
 
239
 
if __name__ == "__main__":
 
1684
    # Default values for config file for server-global settings
 
1685
    server_defaults = { u"interface": u"",
 
1686
                        u"address": u"",
 
1687
                        u"port": u"",
 
1688
                        u"debug": u"False",
 
1689
                        u"priority":
 
1690
                        u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
 
1691
                        u"servicename": u"Mandos",
 
1692
                        u"use_dbus": u"True",
 
1693
                        u"use_ipv6": u"True",
 
1694
                        u"debuglevel": u"",
 
1695
                        }
 
1696
    
 
1697
    # Parse config file for server-global settings
 
1698
    server_config = configparser.SafeConfigParser(server_defaults)
 
1699
    del server_defaults
 
1700
    server_config.read(os.path.join(options.configdir,
 
1701
                                    u"mandos.conf"))
 
1702
    # Convert the SafeConfigParser object to a dict
 
1703
    server_settings = server_config.defaults()
 
1704
    # Use the appropriate methods on the non-string config options
 
1705
    for option in (u"debug", u"use_dbus", u"use_ipv6"):
 
1706
        server_settings[option] = server_config.getboolean(u"DEFAULT",
 
1707
                                                           option)
 
1708
    if server_settings["port"]:
 
1709
        server_settings["port"] = server_config.getint(u"DEFAULT",
 
1710
                                                       u"port")
 
1711
    del server_config
 
1712
    
 
1713
    # Override the settings from the config file with command line
 
1714
    # options, if set.
 
1715
    for option in (u"interface", u"address", u"port", u"debug",
 
1716
                   u"priority", u"servicename", u"configdir",
 
1717
                   u"use_dbus", u"use_ipv6", u"debuglevel"):
 
1718
        value = getattr(options, option)
 
1719
        if value is not None:
 
1720
            server_settings[option] = value
 
1721
    del options
 
1722
    # Force all strings to be unicode
 
1723
    for option in server_settings.keys():
 
1724
        if type(server_settings[option]) is str:
 
1725
            server_settings[option] = unicode(server_settings[option])
 
1726
    # Now we have our good server settings in "server_settings"
 
1727
    
 
1728
    ##################################################################
 
1729
    
 
1730
    # For convenience
 
1731
    debug = server_settings[u"debug"]
 
1732
    debuglevel = server_settings[u"debuglevel"]
 
1733
    use_dbus = server_settings[u"use_dbus"]
 
1734
    use_ipv6 = server_settings[u"use_ipv6"]
 
1735
 
 
1736
    if server_settings[u"servicename"] != u"Mandos":
 
1737
        syslogger.setFormatter(logging.Formatter
 
1738
                               (u'Mandos (%s) [%%(process)d]:'
 
1739
                                u' %%(levelname)s: %%(message)s'
 
1740
                                % server_settings[u"servicename"]))
 
1741
    
 
1742
    # Parse config file with clients
 
1743
    client_defaults = { u"timeout": u"1h",
 
1744
                        u"interval": u"5m",
 
1745
                        u"checker": u"fping -q -- %%(host)s",
 
1746
                        u"host": u"",
 
1747
                        u"approval_delay": u"0s",
 
1748
                        u"approval_duration": u"1s",
 
1749
                        }
 
1750
    client_config = configparser.SafeConfigParser(client_defaults)
 
1751
    client_config.read(os.path.join(server_settings[u"configdir"],
 
1752
                                    u"clients.conf"))
 
1753
    
 
1754
    global mandos_dbus_service
 
1755
    mandos_dbus_service = None
 
1756
    
 
1757
    tcp_server = MandosServer((server_settings[u"address"],
 
1758
                               server_settings[u"port"]),
 
1759
                              ClientHandler,
 
1760
                              interface=(server_settings[u"interface"]
 
1761
                                         or None),
 
1762
                              use_ipv6=use_ipv6,
 
1763
                              gnutls_priority=
 
1764
                              server_settings[u"priority"],
 
1765
                              use_dbus=use_dbus)
 
1766
    if not debug:
 
1767
        pidfilename = u"/var/run/mandos.pid"
 
1768
        try:
 
1769
            pidfile = open(pidfilename, u"w")
 
1770
        except IOError:
 
1771
            logger.error(u"Could not open file %r", pidfilename)
 
1772
    
 
1773
    try:
 
1774
        uid = pwd.getpwnam(u"_mandos").pw_uid
 
1775
        gid = pwd.getpwnam(u"_mandos").pw_gid
 
1776
    except KeyError:
 
1777
        try:
 
1778
            uid = pwd.getpwnam(u"mandos").pw_uid
 
1779
            gid = pwd.getpwnam(u"mandos").pw_gid
 
1780
        except KeyError:
 
1781
            try:
 
1782
                uid = pwd.getpwnam(u"nobody").pw_uid
 
1783
                gid = pwd.getpwnam(u"nobody").pw_gid
 
1784
            except KeyError:
 
1785
                uid = 65534
 
1786
                gid = 65534
 
1787
    try:
 
1788
        os.setgid(gid)
 
1789
        os.setuid(uid)
 
1790
    except OSError, error:
 
1791
        if error[0] != errno.EPERM:
 
1792
            raise error
 
1793
    
 
1794
    if not debug and not debuglevel:
 
1795
        syslogger.setLevel(logging.WARNING)
 
1796
        console.setLevel(logging.WARNING)
 
1797
    if debuglevel:
 
1798
        level = getattr(logging, debuglevel.upper())
 
1799
        syslogger.setLevel(level)
 
1800
        console.setLevel(level)
 
1801
 
 
1802
    if debug:
 
1803
        # Enable all possible GnuTLS debugging
 
1804
        
 
1805
        # "Use a log level over 10 to enable all debugging options."
 
1806
        # - GnuTLS manual
 
1807
        gnutls.library.functions.gnutls_global_set_log_level(11)
 
1808
        
 
1809
        @gnutls.library.types.gnutls_log_func
 
1810
        def debug_gnutls(level, string):
 
1811
            logger.debug(u"GnuTLS: %s", string[:-1])
 
1812
        
 
1813
        (gnutls.library.functions
 
1814
         .gnutls_global_set_log_function(debug_gnutls))
 
1815
        
 
1816
        # Redirect stdin so all checkers get /dev/null
 
1817
        null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)
 
1818
        os.dup2(null, sys.stdin.fileno())
 
1819
        if null > 2:
 
1820
            os.close(null)
 
1821
    else:
 
1822
        # No console logging
 
1823
        logger.removeHandler(console)
 
1824
    
 
1825
    
 
1826
    global main_loop
 
1827
    # From the Avahi example code
 
1828
    DBusGMainLoop(set_as_default=True )
 
1829
    main_loop = gobject.MainLoop()
 
1830
    bus = dbus.SystemBus()
 
1831
    # End of Avahi example code
 
1832
    if use_dbus:
 
1833
        try:
 
1834
            bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",
 
1835
                                            bus, do_not_queue=True)
 
1836
        except dbus.exceptions.NameExistsException, e:
 
1837
            logger.error(unicode(e) + u", disabling D-Bus")
 
1838
            use_dbus = False
 
1839
            server_settings[u"use_dbus"] = False
 
1840
            tcp_server.use_dbus = False
 
1841
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
 
1842
    service = AvahiService(name = server_settings[u"servicename"],
 
1843
                           servicetype = u"_mandos._tcp",
 
1844
                           protocol = protocol, bus = bus)
 
1845
    if server_settings["interface"]:
 
1846
        service.interface = (if_nametoindex
 
1847
                             (str(server_settings[u"interface"])))
 
1848
 
 
1849
    if not debug:
 
1850
        # Close all input and output, do double fork, etc.
 
1851
        daemon()
 
1852
        
 
1853
    global multiprocessing_manager
 
1854
    multiprocessing_manager = multiprocessing.Manager()
 
1855
    
 
1856
    client_class = Client
 
1857
    if use_dbus:
 
1858
        client_class = functools.partial(ClientDBus, bus = bus)
 
1859
    def client_config_items(config, section):
 
1860
        special_settings = {
 
1861
            "approved_by_default":
 
1862
                lambda: config.getboolean(section,
 
1863
                                          "approved_by_default"),
 
1864
            }
 
1865
        for name, value in config.items(section):
 
1866
            try:
 
1867
                yield (name, special_settings[name]())
 
1868
            except KeyError:
 
1869
                yield (name, value)
 
1870
    
 
1871
    tcp_server.clients.update(set(
 
1872
            client_class(name = section,
 
1873
                         config= dict(client_config_items(
 
1874
                        client_config, section)))
 
1875
            for section in client_config.sections()))
 
1876
    if not tcp_server.clients:
 
1877
        logger.warning(u"No clients defined")
 
1878
        
 
1879
    if not debug:
 
1880
        try:
 
1881
            with pidfile:
 
1882
                pid = os.getpid()
 
1883
                pidfile.write(str(pid) + "\n")
 
1884
            del pidfile
 
1885
        except IOError:
 
1886
            logger.error(u"Could not write to file %r with PID %d",
 
1887
                         pidfilename, pid)
 
1888
        except NameError:
 
1889
            # "pidfile" was never created
 
1890
            pass
 
1891
        del pidfilename
 
1892
        
 
1893
        signal.signal(signal.SIGINT, signal.SIG_IGN)
 
1894
 
 
1895
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
 
1896
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
 
1897
    
 
1898
    if use_dbus:
 
1899
        class MandosDBusService(dbus.service.Object):
 
1900
            """A D-Bus proxy object"""
 
1901
            def __init__(self):
 
1902
                dbus.service.Object.__init__(self, bus, u"/")
 
1903
            _interface = u"se.bsnet.fukt.Mandos"
 
1904
            
 
1905
            @dbus.service.signal(_interface, signature=u"o")
 
1906
            def ClientAdded(self, objpath):
 
1907
                "D-Bus signal"
 
1908
                pass
 
1909
            
 
1910
            @dbus.service.signal(_interface, signature=u"ss")
 
1911
            def ClientNotFound(self, fingerprint, address):
 
1912
                "D-Bus signal"
 
1913
                pass
 
1914
            
 
1915
            @dbus.service.signal(_interface, signature=u"os")
 
1916
            def ClientRemoved(self, objpath, name):
 
1917
                "D-Bus signal"
 
1918
                pass
 
1919
            
 
1920
            @dbus.service.method(_interface, out_signature=u"ao")
 
1921
            def GetAllClients(self):
 
1922
                "D-Bus method"
 
1923
                return dbus.Array(c.dbus_object_path
 
1924
                                  for c in tcp_server.clients)
 
1925
            
 
1926
            @dbus.service.method(_interface,
 
1927
                                 out_signature=u"a{oa{sv}}")
 
1928
            def GetAllClientsWithProperties(self):
 
1929
                "D-Bus method"
 
1930
                return dbus.Dictionary(
 
1931
                    ((c.dbus_object_path, c.GetAll(u""))
 
1932
                     for c in tcp_server.clients),
 
1933
                    signature=u"oa{sv}")
 
1934
            
 
1935
            @dbus.service.method(_interface, in_signature=u"o")
 
1936
            def RemoveClient(self, object_path):
 
1937
                "D-Bus method"
 
1938
                for c in tcp_server.clients:
 
1939
                    if c.dbus_object_path == object_path:
 
1940
                        tcp_server.clients.remove(c)
 
1941
                        c.remove_from_connection()
 
1942
                        # Don't signal anything except ClientRemoved
 
1943
                        c.disable(quiet=True)
 
1944
                        # Emit D-Bus signal
 
1945
                        self.ClientRemoved(object_path, c.name)
 
1946
                        return
 
1947
                raise KeyError(object_path)
 
1948
            
 
1949
            del _interface
 
1950
        
 
1951
        mandos_dbus_service = MandosDBusService()
 
1952
    
 
1953
    def cleanup():
 
1954
        "Cleanup function; run on exit"
 
1955
        service.cleanup()
 
1956
        
 
1957
        while tcp_server.clients:
 
1958
            client = tcp_server.clients.pop()
 
1959
            if use_dbus:
 
1960
                client.remove_from_connection()
 
1961
            client.disable_hook = None
 
1962
            # Don't signal anything except ClientRemoved
 
1963
            client.disable(quiet=True)
 
1964
            if use_dbus:
 
1965
                # Emit D-Bus signal
 
1966
                mandos_dbus_service.ClientRemoved(client.dbus_object_path,
 
1967
                                                  client.name)
 
1968
    
 
1969
    atexit.register(cleanup)
 
1970
    
 
1971
    for client in tcp_server.clients:
 
1972
        if use_dbus:
 
1973
            # Emit D-Bus signal
 
1974
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
 
1975
        client.enable()
 
1976
    
 
1977
    tcp_server.enable()
 
1978
    tcp_server.server_activate()
 
1979
    
 
1980
    # Find out what port we got
 
1981
    service.port = tcp_server.socket.getsockname()[1]
 
1982
    if use_ipv6:
 
1983
        logger.info(u"Now listening on address %r, port %d,"
 
1984
                    " flowinfo %d, scope_id %d"
 
1985
                    % tcp_server.socket.getsockname())
 
1986
    else:                       # IPv4
 
1987
        logger.info(u"Now listening on address %r, port %d"
 
1988
                    % tcp_server.socket.getsockname())
 
1989
    
 
1990
    #service.interface = tcp_server.socket.getsockname()[3]
 
1991
    
 
1992
    try:
 
1993
        # From the Avahi example code
 
1994
        try:
 
1995
            service.activate()
 
1996
        except dbus.exceptions.DBusException, error:
 
1997
            logger.critical(u"DBusException: %s", error)
 
1998
            cleanup()
 
1999
            sys.exit(1)
 
2000
        # End of Avahi example code
 
2001
        
 
2002
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
 
2003
                             lambda *args, **kwargs:
 
2004
                             (tcp_server.handle_request
 
2005
                              (*args[2:], **kwargs) or True))
 
2006
        
 
2007
        logger.debug(u"Starting main loop")
 
2008
        main_loop.run()
 
2009
    except AvahiError, error:
 
2010
        logger.critical(u"AvahiError: %s", error)
 
2011
        cleanup()
 
2012
        sys.exit(1)
 
2013
    except KeyboardInterrupt:
 
2014
        if debug:
 
2015
            print >> sys.stderr
 
2016
        logger.debug(u"Server received KeyboardInterrupt")
 
2017
    logger.debug(u"Server exiting")
 
2018
    # Must run before the D-Bus bus name gets deregistered
 
2019
    cleanup()
 
2020
 
 
2021
if __name__ == '__main__':
240
2022
    main()
241