/mandos/trunk : revision 502.1.1

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

81

82

SO_BINDTODEVICE = None

82

83

84

version = "1.0.14"

85

version = "1.3.1"

85

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

88

89

syslogger = (logging.handlers.SysLogHandler

89

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

90

address = "/dev/log"))

91

address = str("/dev/log")))

91

92

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

94

95

logger.addHandler(syslogger)

95

96

97

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

100

101

logger.addHandler(console)

101

102

103

class AvahiError(Exception):

119

120

Attributes:

120

121

interface: integer; avahi.IF_UNSPEC or an interface index.

121

122

Used to optionally bind to the specified interface.

122

123

type: string; Example: u'_mandos._tcp'.

123

124

type: string; Example: '_mandos._tcp'.

124

125

See <http://www.dns-sd.org/ServiceTypes.html>

125

126

port: integer; what port to announce

126

127

TXT: list of strings; TXT record for the service

135

136

"""

136

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

137

138

servicetype = None, port = None, TXT = None,

138

domain = u"", host = u"", max_renames = 32768,

139

domain = "", host = "", max_renames = 32768,

139

140

protocol = avahi.PROTO_UNSPEC, bus = None):

140

141

self.interface = interface

141

142

self.name = name

150

151

self.group = None # our entry group

151

152

self.server = None

152

153

self.bus = bus

154

self.entry_group_state_changed_match = None

153

155

def rename(self):

154

156

"""Derived from the Avahi example code"""

155

157

if self.rename_count >= self.max_renames:

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

158

logger.critical("No suitable Zeroconf service name found"

159

" after %i retries, exiting.",

158

160

self.rename_count)

159

raise AvahiServiceError(u"Too many renames")

161

raise AvahiServiceError("Too many renames")

160

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

163

logger.info("Changing Zeroconf service name to %r ...",

162

164

self.name)

163

165

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

166

168

% self.name))

167

169

self.remove()

168

self.add()

170

try:

171

self.add()

172

except dbus.exceptions.DBusException as error:

173

logger.critical("DBusException: %s", error)

174

self.cleanup()

175

os._exit(1)

169

176

self.rename_count += 1

170

177

def remove(self):

171

178

"""Derived from the Avahi example code"""

179

if self.entry_group_state_changed_match is not None:

180

self.entry_group_state_changed_match.remove()

181

self.entry_group_state_changed_match = None

172

182

if self.group is not None:

173

183

self.group.Reset()

174

184

def add(self):

175

185

"""Derived from the Avahi example code"""

186

self.remove()

176

187

if self.group is None:

177

188

self.group = dbus.Interface(

178

189

self.bus.get_object(avahi.DBUS_NAME,

179

190

self.server.EntryGroupNew()),

180

191

avahi.DBUS_INTERFACE_ENTRY_GROUP)

181

self.group.connect_to_signal('StateChanged',

182

self

183

.entry_group_state_changed)

184

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

192

self.entry_group_state_changed_match = (

193

self.group.connect_to_signal(

194

'StateChanged', self .entry_group_state_changed))

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

185

196

self.name, self.type)

186

197

self.group.AddService(

187

198

self.interface,

194

205

self.group.Commit()

195

206

def entry_group_state_changed(self, state, error):

196

207

"""Derived from the Avahi example code"""

197

logger.debug(u"Avahi state change: %i", state)

208

logger.debug("Avahi entry group state change: %i", state)

198

209

199

210

if state == avahi.ENTRY_GROUP_ESTABLISHED:

200

logger.debug(u"Zeroconf service established.")

211

logger.debug("Zeroconf service established.")

201

212

elif state == avahi.ENTRY_GROUP_COLLISION:

202

logger.warning(u"Zeroconf service name collision.")

213

logger.info("Zeroconf service name collision.")

203

214

self.rename()

204

215

elif state == avahi.ENTRY_GROUP_FAILURE:

205

logger.critical(u"Avahi: Error in group state changed %s",

216

logger.critical("Avahi: Error in group state changed %s",

206

217

unicode(error))

207

raise AvahiGroupError(u"State changed: %s"

218

raise AvahiGroupError("State changed: %s"

208

219

% unicode(error))

209

220

def cleanup(self):

210

221

"""Derived from the Avahi example code"""

211

222

if self.group is not None:

212

self.group.Free()

223

try:

224

self.group.Free()

225

except (dbus.exceptions.UnknownMethodException,

226

dbus.exceptions.DBusException) as e:

227

pass

213

228

self.group = None

214

def server_state_changed(self, state):

229

self.remove()

230

def server_state_changed(self, state, error=None):

215

231

"""Derived from the Avahi example code"""

216

if state == avahi.SERVER_COLLISION:

217

logger.error(u"Zeroconf server name collision")

218

self.remove()

232

logger.debug("Avahi server state change: %i", state)

233

bad_states = { avahi.SERVER_INVALID:

234

"Zeroconf server invalid",

235

avahi.SERVER_REGISTERING: None,

236

avahi.SERVER_COLLISION:

237

"Zeroconf server name collision",

238

avahi.SERVER_FAILURE:

239

"Zeroconf server failure" }

240

if state in bad_states:

241

if bad_states[state] is not None:

242

if error is None:

243

logger.error(bad_states[state])

244

else:

245

logger.error(bad_states[state] + ": %r", error)

246

self.cleanup()

219

247

elif state == avahi.SERVER_RUNNING:

220

248

self.add()

249

else:

250

if error is None:

251

logger.debug("Unknown state: %r", state)

252

else:

253

logger.debug("Unknown state: %r: %r", state, error)

221

254

def activate(self):

222

255

"""Derived from the Avahi example code"""

223

256

if self.server is None:

224

257

self.server = dbus.Interface(

225

258

self.bus.get_object(avahi.DBUS_NAME,

226

avahi.DBUS_PATH_SERVER),

259

avahi.DBUS_PATH_SERVER,

260

follow_name_owner_changes=True),

227

261

avahi.DBUS_INTERFACE_SERVER)

228

self.server.connect_to_signal(u"StateChanged",

262

self.server.connect_to_signal("StateChanged",

229

263

self.server_state_changed)

230

264

self.server_state_changed(self.server.GetState())

231

265

232

266

267

def _timedelta_to_milliseconds(td):

268

"Convert a datetime.timedelta() to milliseconds"

269

return ((td.days * 24 * 60 * 60 * 1000)

270

+ (td.seconds * 1000)

271

+ (td.microseconds // 1000))

272

233

273

class Client(object):

234

274

"""A representation of a client host served by this server.

235

275

236

276

Attributes:

237

238

D-Bus identifiers

277

_approved: bool(); 'None' if not yet approved/disapproved

278

approval_delay: datetime.timedelta(); Time to wait for approval

279

approval_duration: datetime.timedelta(); Duration of one approval

280

checker: subprocess.Popen(); a running checker process used

281

to see if the client lives.

282

'None' if no process is running.

283

checker_callback_tag: a gobject event source tag, or None

284

checker_command: string; External command which is run to check

285

if client lives. %() expansions are done at

286

runtime with vars(self) as dict, so that for

287

instance %(name)s can be used in the command.

288

checker_initiator_tag: a gobject event source tag, or None

289

created: datetime.datetime(); (UTC) object creation

290

current_checker_command: string; current running checker_command

291

disable_hook: If set, called by disable() as disable_hook(self)

292

disable_initiator_tag: a gobject event source tag, or None

293

enabled: bool()

239

294

fingerprint: string (40 or 32 hexadecimal digits); used to

240

295

uniquely identify the client

241

secret: bytestring; sent verbatim (over TLS) to client

242

296

host: string; available for use by the checker command

243

created: datetime.datetime(); (UTC) object creation

297

interval: datetime.timedelta(); How often to start a new checker

298

last_approval_request: datetime.datetime(); (UTC) or None

299

last_checked_ok: datetime.datetime(); (UTC) or None

244

300

last_enabled: datetime.datetime(); (UTC)

245

enabled: bool()

246

last_checked_ok: datetime.datetime(); (UTC) or None

301

302

D-Bus identifiers

303

secret: bytestring; sent verbatim (over TLS) to client

247

304

timeout: datetime.timedelta(); How long from last_checked_ok

248

305

until this client is disabled

249

interval: datetime.timedelta(); How often to start a new checker

250

disable_hook: If set, called by disable() as disable_hook(self)

251

checker: subprocess.Popen(); a running checker process used

252

to see if the client lives.

253

'None' if no process is running.

254

checker_initiator_tag: a gobject event source tag, or None

255

disable_initiator_tag: - '' -

256

checker_callback_tag: - '' -

257

checker_command: string; External command which is run to check if

258

client lives. %() expansions are done at

259

runtime with vars(self) as dict, so that for

260

instance %(name)s can be used in the command.

261

current_checker_command: string; current running checker_command

262

approved_delay: datetime.timedelta(); Time to wait for approval

263

_approved: bool(); 'None' if not yet approved/disapproved

264

approved_duration: datetime.timedelta(); Duration of one approval

306

extended_timeout: extra long timeout when password has been sent

307

runtime_expansions: Allowed attributes for runtime expansion.

308

expires: datetime.datetime(); time (UTC) when a client will be

309

disabled, or None

265

310

"""

266

311

267

@staticmethod

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

312

runtime_expansions = ("approval_delay", "approval_duration",

313

"created", "enabled", "fingerprint",

314

"host", "interval", "last_checked_ok",

315

"last_enabled", "name", "timeout")

273

316

274

317

def timeout_milliseconds(self):

275

318

"Return the 'timeout' attribute in milliseconds"

276

return self._timedelta_to_milliseconds(self.timeout)

319

return _timedelta_to_milliseconds(self.timeout)

320

321

def extended_timeout_milliseconds(self):

322

"Return the 'extended_timeout' attribute in milliseconds"

323

return _timedelta_to_milliseconds(self.extended_timeout)

277

324

278

325

def interval_milliseconds(self):

279

326

"Return the 'interval' attribute in milliseconds"

280

return self._timedelta_to_milliseconds(self.interval)

281

282

def approved_delay_milliseconds(self):

283

return self._timedelta_to_milliseconds(self.approved_delay)

327

return _timedelta_to_milliseconds(self.interval)

328

329

def approval_delay_milliseconds(self):

330

return _timedelta_to_milliseconds(self.approval_delay)

284

331

285

332

def __init__(self, name = None, disable_hook=None, config=None):

286

333

"""Note: the 'checker' key in 'config' sets the

289

336

self.name = name

290

337

if config is None:

291

338

config = {}

292

logger.debug(u"Creating client %r", self.name)

339

logger.debug("Creating client %r", self.name)

293

340

# Uppercase and remove spaces from fingerprint for later

294

341

# comparison purposes with return value from the fingerprint()

295

342

# function

296

self.fingerprint = (config[u"fingerprint"].upper()

297

.replace(u" ", u""))

298

logger.debug(u" Fingerprint: %s", self.fingerprint)

299

if u"secret" in config:

300

self.secret = config[u"secret"].decode(u"base64")

301

elif u"secfile" in config:

343

self.fingerprint = (config["fingerprint"].upper()

344

.replace(" ", ""))

345

logger.debug(" Fingerprint: %s", self.fingerprint)

346

if "secret" in config:

347

self.secret = config["secret"].decode("base64")

348

elif "secfile" in config:

302

349

with open(os.path.expanduser(os.path.expandvars

303

(config[u"secfile"])),

350

(config["secfile"])),

304

351

"rb") as secfile:

305

352

self.secret = secfile.read()

306

353

else:

307

raise TypeError(u"No secret or secfile for client %s"

354

raise TypeError("No secret or secfile for client %s"

308

355

% self.name)

309

self.host = config.get(u"host", u"")

356

self.host = config.get("host", "")

310

357

self.created = datetime.datetime.utcnow()

311

358

self.enabled = False

359

self.last_approval_request = None

312

360

self.last_enabled = None

313

361

self.last_checked_ok = None

314

self.timeout = string_to_delta(config[u"timeout"])

315

self.interval = string_to_delta(config[u"interval"])

362

self.timeout = string_to_delta(config["timeout"])

363

self.extended_timeout = string_to_delta(config["extended_timeout"])

364

self.interval = string_to_delta(config["interval"])

316

365

self.disable_hook = disable_hook

317

366

self.checker = None

318

367

self.checker_initiator_tag = None

319

368

self.disable_initiator_tag = None

369

self.expires = None

320

370

self.checker_callback_tag = None

321

self.checker_command = config[u"checker"]

371

self.checker_command = config["checker"]

322

372

self.current_checker_command = None

323

373

self.last_connect = None

324

374

self._approved = None

325

self.approved_by_default = config.get(u"approved_by_default",

375

self.approved_by_default = config.get("approved_by_default",

326

376

True)

327

377

self.approvals_pending = 0

328

self.approved_delay = string_to_delta(

329

config[u"approved_delay"])

330

self.approved_duration = string_to_delta(

331

config[u"approved_duration"])

378

self.approval_delay = string_to_delta(

379

config["approval_delay"])

380

self.approval_duration = string_to_delta(

381

config["approval_duration"])

332

382

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

333

383

334

384

def send_changedstate(self):

338

388

339

389

def enable(self):

340

390

"""Start this client's checker and timeout hooks"""

341

if getattr(self, u"enabled", False):

391

if getattr(self, "enabled", False):

342

392

# Already enabled

343

393

return

344

394

self.send_changedstate()

345

self.last_enabled = datetime.datetime.utcnow()

346

395

# Schedule a new checker to be started an 'interval' from now,

347

396

# and every interval from then on.

348

397

self.checker_initiator_tag = (gobject.timeout_add

349

398

(self.interval_milliseconds(),

350

399

self.start_checker))

351

400

# Schedule a disable() when 'timeout' has passed

401

self.expires = datetime.datetime.utcnow() + self.timeout

352

402

self.disable_initiator_tag = (gobject.timeout_add

353

403

(self.timeout_milliseconds(),

354

404

self.disable))

355

405

self.enabled = True

406

self.last_enabled = datetime.datetime.utcnow()

356

407

# Also start a new checker *right now*.

357

408

self.start_checker()

358

409

363

414

if not quiet:

364

415

self.send_changedstate()

365

416

if not quiet:

366

logger.info(u"Disabling client %s", self.name)

367

if getattr(self, u"disable_initiator_tag", False):

417

logger.info("Disabling client %s", self.name)

418

if getattr(self, "disable_initiator_tag", False):

368

419

gobject.source_remove(self.disable_initiator_tag)

369

420

self.disable_initiator_tag = None

370

if getattr(self, u"checker_initiator_tag", False):

421

self.expires = None

422

if getattr(self, "checker_initiator_tag", False):

371

423

gobject.source_remove(self.checker_initiator_tag)

372

424

self.checker_initiator_tag = None

373

425

self.stop_checker()

388

440

if os.WIFEXITED(condition):

389

441

exitstatus = os.WEXITSTATUS(condition)

390

442

if exitstatus == 0:

391

logger.info(u"Checker for %(name)s succeeded",

443

logger.info("Checker for %(name)s succeeded",

392

444

vars(self))

393

445

self.checked_ok()

394

446

else:

395

logger.info(u"Checker for %(name)s failed",

447

logger.info("Checker for %(name)s failed",

396

448

vars(self))

397

449

else:

398

logger.warning(u"Checker for %(name)s crashed?",

450

logger.warning("Checker for %(name)s crashed?",

399

451

vars(self))

400

452

401

def checked_ok(self):

453

def checked_ok(self, timeout=None):

402

454

"""Bump up the timeout for this client.

403

455

404

456

This should only be called when the client has been seen,

405

457

alive and well.

406

458

"""

459

if timeout is None:

460

timeout = self.timeout

407

461

self.last_checked_ok = datetime.datetime.utcnow()

408

462

gobject.source_remove(self.disable_initiator_tag)

463

self.expires = datetime.datetime.utcnow() + timeout

409

464

self.disable_initiator_tag = (gobject.timeout_add

410

(self.timeout_milliseconds(),

465

(_timedelta_to_milliseconds(timeout),

411

466

self.disable))

412

467

468

def need_approval(self):

469

self.last_approval_request = datetime.datetime.utcnow()

470

413

471

def start_checker(self):

414

472

"""Start a new checker subprocess if one is not running.

415

473

427

485

# If a checker exists, make sure it is not a zombie

428

486

try:

429

487

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

430

except (AttributeError, OSError), error:

488

except (AttributeError, OSError) as error:

431

489

if (isinstance(error, OSError)

432

490

and error.errno != errno.ECHILD):

433

491

raise error

434

492

else:

435

493

if pid:

436

logger.warning(u"Checker was a zombie")

494

logger.warning("Checker was a zombie")

437

495

gobject.source_remove(self.checker_callback_tag)

438

496

self.checker_callback(pid, status,

439

497

self.current_checker_command)

444

502

command = self.checker_command % self.host

445

503

except TypeError:

446

504

# Escape attributes for the shell

447

escaped_attrs = dict((key,

448

re.escape(unicode(str(val),

449

errors=

450

u'replace')))

451

for key, val in

452

vars(self).iteritems())

505

escaped_attrs = dict(

506

(attr,

507

re.escape(unicode(str(getattr(self, attr, "")),

508

errors=

509

'replace')))

510

for attr in

511

self.runtime_expansions)

512

453

513

try:

454

514

command = self.checker_command % escaped_attrs

455

except TypeError, error:

456

logger.error(u'Could not format string "%s":'

457

u' %s', self.checker_command, error)

515

except TypeError as error:

516

logger.error('Could not format string "%s":'

517

' %s', self.checker_command, error)

458

518

return True # Try again later

459

519

self.current_checker_command = command

460

520

try:

461

logger.info(u"Starting checker %r for %s",

521

logger.info("Starting checker %r for %s",

462

522

command, self.name)

463

523

# We don't need to redirect stdout and stderr, since

464

524

# in normal mode, that is already done by daemon(),

466

526

# always replaced by /dev/null.)

467

527

self.checker = subprocess.Popen(command,

468

528

close_fds=True,

469

shell=True, cwd=u"/")

529

shell=True, cwd="/")

470

530

self.checker_callback_tag = (gobject.child_watch_add

471

531

(self.checker.pid,

472

532

self.checker_callback,

477

537

if pid:

478

538

gobject.source_remove(self.checker_callback_tag)

479

539

self.checker_callback(pid, status, command)

480

except OSError, error:

481

logger.error(u"Failed to start subprocess: %s",

540

except OSError as error:

541

logger.error("Failed to start subprocess: %s",

482

542

error)

483

543

# Re-run this periodically if run by gobject.timeout_add

484

544

return True

488

548

if self.checker_callback_tag:

489

549

gobject.source_remove(self.checker_callback_tag)

490

550

self.checker_callback_tag = None

491

if getattr(self, u"checker", None) is None:

551

if getattr(self, "checker", None) is None:

492

552

return

493

logger.debug(u"Stopping checker for %(name)s", vars(self))

553

logger.debug("Stopping checker for %(name)s", vars(self))

494

554

try:

495

555

os.kill(self.checker.pid, signal.SIGTERM)

496

556

#time.sleep(0.5)

497

557

#if self.checker.poll() is None:

498

558

# os.kill(self.checker.pid, signal.SIGKILL)

499

except OSError, error:

559

except OSError as error:

500

560

if error.errno != errno.ESRCH: # No such process

501

561

raise

502

562

self.checker = None

503

563

504

def dbus_service_property(dbus_interface, signature=u"v",

505

access=u"readwrite", byte_arrays=False):

564

565

def dbus_service_property(dbus_interface, signature="v",

566

access="readwrite", byte_arrays=False):

506

567

"""Decorators for marking methods of a DBusObjectWithProperties to

507

568

become properties on the D-Bus.

508

569

515

576

"""

516

577

# Encoding deeply encoded byte arrays is not supported yet by the

517

578

# "Set" method, so we fail early here:

518

if byte_arrays and signature != u"ay":

519

raise ValueError(u"Byte arrays not supported for non-'ay'"

520

u" signature %r" % signature)

579

if byte_arrays and signature != "ay":

580

raise ValueError("Byte arrays not supported for non-'ay'"

581

" signature %r" % signature)

521

582

def decorator(func):

522

583

func._dbus_is_property = True

523

584

func._dbus_interface = dbus_interface

524

585

func._dbus_signature = signature

525

586

func._dbus_access = access

526

587

func._dbus_name = func.__name__

527

if func._dbus_name.endswith(u"_dbus_property"):

588

if func._dbus_name.endswith("_dbus_property"):

528

589

func._dbus_name = func._dbus_name[:-14]

529

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

590

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

530

591

return func

531

592

return decorator

532

593

552

613

553

614

class DBusObjectWithProperties(dbus.service.Object):

554

615

"""A D-Bus object with properties.

555

616

556

617

Classes inheriting from this can use the dbus_service_property

557

618

decorator to expose methods as D-Bus properties. It exposes the

558

619

standard Get(), Set(), and GetAll() methods on the D-Bus.

560

621

561

622

@staticmethod

562

623

def _is_dbus_property(obj):

563

return getattr(obj, u"_dbus_is_property", False)

624

return getattr(obj, "_dbus_is_property", False)

564

625

565

626

def _get_all_dbus_properties(self):

566

627

"""Returns a generator of (name, attribute) pairs

574

635

property with the specified name and interface.

575

636

"""

576

637

for name in (property_name,

577

property_name + u"_dbus_property"):

638

property_name + "_dbus_property"):

578

639

prop = getattr(self, name, None)

579

640

if (prop is None

580

641

or not self._is_dbus_property(prop)

584

645

continue

585

646

return prop

586

647

# No such property

587

raise DBusPropertyNotFound(self.dbus_object_path + u":"

588

+ interface_name + u"."

648

raise DBusPropertyNotFound(self.dbus_object_path + ":"

649

+ interface_name + "."

589

650

+ property_name)

590

651

591

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

592

out_signature=u"v")

652

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

653

out_signature="v")

593

654

def Get(self, interface_name, property_name):

594

655

"""Standard D-Bus property Get() method, see D-Bus standard.

595

656

"""

596

657

prop = self._get_dbus_property(interface_name, property_name)

597

if prop._dbus_access == u"write":

658

if prop._dbus_access == "write":

598

659

raise DBusPropertyAccessException(property_name)

599

660

value = prop()

600

if not hasattr(value, u"variant_level"):

661

if not hasattr(value, "variant_level"):

601

662

return value

602

663

return type(value)(value, variant_level=value.variant_level+1)

603

664

604

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

665

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

605

666

def Set(self, interface_name, property_name, value):

606

667

"""Standard D-Bus property Set() method, see D-Bus standard.

607

668

"""

608

669

prop = self._get_dbus_property(interface_name, property_name)

609

if prop._dbus_access == u"read":

670

if prop._dbus_access == "read":

610

671

raise DBusPropertyAccessException(property_name)

611

if prop._dbus_get_args_options[u"byte_arrays"]:

672

if prop._dbus_get_args_options["byte_arrays"]:

612

673

# The byte_arrays option is not supported yet on

613

674

# signatures other than "ay".

614

if prop._dbus_signature != u"ay":

675

if prop._dbus_signature != "ay":

615

676

raise ValueError

616

677

value = dbus.ByteArray(''.join(unichr(byte)

617

678

for byte in value))

618

679

prop(value)

619

680

620

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

621

out_signature=u"a{sv}")

681

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

682

out_signature="a{sv}")

622

683

def GetAll(self, interface_name):

623

684

"""Standard D-Bus property GetAll() method, see D-Bus

624

685

standard.

625

686

626

687

Note: Will not include properties with access="write".

627

688

"""

628

689

all = {}

632

693

# Interface non-empty but did not match

633

694

continue

634

695

# Ignore write-only properties

635

if prop._dbus_access == u"write":

696

if prop._dbus_access == "write":

636

697

continue

637

698

value = prop()

638

if not hasattr(value, u"variant_level"):

699

if not hasattr(value, "variant_level"):

639

700

all[name] = value

640

701

continue

641

702

all[name] = type(value)(value, variant_level=

642

703

value.variant_level+1)

643

return dbus.Dictionary(all, signature=u"sv")

704

return dbus.Dictionary(all, signature="sv")

644

705

645

706

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

646

out_signature=u"s",

707

out_signature="s",

647

708

path_keyword='object_path',

648

709

connection_keyword='connection')

649

710

def Introspect(self, object_path, connection):

654

715

try:

655

716

document = xml.dom.minidom.parseString(xmlstring)

656

717

def make_tag(document, name, prop):

657

e = document.createElement(u"property")

658

e.setAttribute(u"name", name)

659

e.setAttribute(u"type", prop._dbus_signature)

660

e.setAttribute(u"access", prop._dbus_access)

718

e = document.createElement("property")

719

e.setAttribute("name", name)

720

e.setAttribute("type", prop._dbus_signature)

721

e.setAttribute("access", prop._dbus_access)

661

722

return e

662

for if_tag in document.getElementsByTagName(u"interface"):

723

for if_tag in document.getElementsByTagName("interface"):

663

724

for tag in (make_tag(document, name, prop)

664

725

for name, prop

665

726

in self._get_all_dbus_properties()

666

727

if prop._dbus_interface

667

== if_tag.getAttribute(u"name")):

728

== if_tag.getAttribute("name")):

668

729

if_tag.appendChild(tag)

669

730

# Add the names to the return values for the

670

731

# "org.freedesktop.DBus.Properties" methods

671

if (if_tag.getAttribute(u"name")

672

== u"org.freedesktop.DBus.Properties"):

673

for cn in if_tag.getElementsByTagName(u"method"):

674

if cn.getAttribute(u"name") == u"Get":

675

for arg in cn.getElementsByTagName(u"arg"):

676

if (arg.getAttribute(u"direction")

677

== u"out"):

678

arg.setAttribute(u"name", u"value")

679

elif cn.getAttribute(u"name") == u"GetAll":

680

for arg in cn.getElementsByTagName(u"arg"):

681

if (arg.getAttribute(u"direction")

682

== u"out"):

683

arg.setAttribute(u"name", u"props")

684

xmlstring = document.toxml(u"utf-8")

732

if (if_tag.getAttribute("name")

733

== "org.freedesktop.DBus.Properties"):

734

for cn in if_tag.getElementsByTagName("method"):

735

if cn.getAttribute("name") == "Get":

736

for arg in cn.getElementsByTagName("arg"):

737

if (arg.getAttribute("direction")

738

== "out"):

739

arg.setAttribute("name", "value")

740

elif cn.getAttribute("name") == "GetAll":

741

for arg in cn.getElementsByTagName("arg"):

742

if (arg.getAttribute("direction")

743

== "out"):

744

arg.setAttribute("name", "props")

745

xmlstring = document.toxml("utf-8")

685

746

document.unlink()

686

747

except (AttributeError, xml.dom.DOMException,

687

xml.parsers.expat.ExpatError), error:

688

logger.error(u"Failed to override Introspection method",

748

xml.parsers.expat.ExpatError) as error:

749

logger.error("Failed to override Introspection method",

689

750

error)

690

751

return xmlstring

691

752

692

753

754

def datetime_to_dbus (dt, variant_level=0):

755

"""Convert a UTC datetime.datetime() to a D-Bus type."""

756

if dt is None:

757

return dbus.String("", variant_level = variant_level)

758

return dbus.String(dt.isoformat(),

759

variant_level=variant_level)

760

761

693

762

class ClientDBus(Client, DBusObjectWithProperties):

694

763

"""A Client class using D-Bus

695

764

697

766

dbus_object_path: dbus.ObjectPath

698

767

bus: dbus.SystemBus()

699

768

"""

769

770

runtime_expansions = (Client.runtime_expansions

771

+ ("dbus_object_path",))

772

700

773

# dbus.service.Object doesn't use super(), so we can't either.

701

774

702

775

def __init__(self, bus = None, *args, **kwargs):

705

778

Client.__init__(self, *args, **kwargs)

706

779

# Only now, when this client is initialized, can it show up on

707

780

# the D-Bus

781

client_object_name = unicode(self.name).translate(

782

{ord("."): ord("_"),

783

ord("-"): ord("_")})

708

784

self.dbus_object_path = (dbus.ObjectPath

709

(u"/clients/"

710

+ self.name.replace(u".", u"_")))

785

("/clients/" + client_object_name))

711

786

DBusObjectWithProperties.__init__(self, self.bus,

712

787

self.dbus_object_path)

713

714

def _get_approvals_pending(self):

715

return self._approvals_pending

716

def _set_approvals_pending(self, value):

717

old_value = self._approvals_pending

718

self._approvals_pending = value

719

bval = bool(value)

720

if (hasattr(self, "dbus_object_path")

721

and bval is not bool(old_value)):

722

dbus_bool = dbus.Boolean(bval, variant_level=1)

723

self.PropertyChanged(dbus.String(u"approved_pending"),

724

dbus_bool)

725

726

approvals_pending = property(_get_approvals_pending,

727

_set_approvals_pending)

728

del _get_approvals_pending, _set_approvals_pending

729

730

@staticmethod

731

def _datetime_to_dbus(dt, variant_level=0):

732

"""Convert a UTC datetime.datetime() to a D-Bus type."""

733

return dbus.String(dt.isoformat(),

734

variant_level=variant_level)

735

736

def enable(self):

737

oldstate = getattr(self, u"enabled", False)

738

r = Client.enable(self)

739

if oldstate != self.enabled:

740

# Emit D-Bus signals

741

self.PropertyChanged(dbus.String(u"enabled"),

742

dbus.Boolean(True, variant_level=1))

743

self.PropertyChanged(

744

dbus.String(u"last_enabled"),

745

self._datetime_to_dbus(self.last_enabled,

746

variant_level=1))

747

return r

748

749

def disable(self, quiet = False):

750

oldstate = getattr(self, u"enabled", False)

751

r = Client.disable(self, quiet=quiet)

752

if not quiet and oldstate != self.enabled:

753

# Emit D-Bus signal

754

self.PropertyChanged(dbus.String(u"enabled"),

755

dbus.Boolean(False, variant_level=1))

756

return r

788

789

def notifychangeproperty(transform_func,

790

dbus_name, type_func=lambda x: x,

791

variant_level=1):

792

""" Modify a variable so that its a property that announce its

793

changes to DBus.

794

transform_fun: Function that takes a value and transform it to

795

DBus type.

796

dbus_name: DBus name of the variable

797

type_func: Function that transform the value before sending it

798

to DBus

799

variant_level: DBus variant level. default: 1

800

"""

801

real_value = [None,]

802

def setter(self, value):

803

old_value = real_value[0]

804

real_value[0] = value

805

if hasattr(self, "dbus_object_path"):

806

if type_func(old_value) != type_func(real_value[0]):

807

dbus_value = transform_func(type_func(real_value[0]),

808

variant_level)

809

self.PropertyChanged(dbus.String(dbus_name),

810

dbus_value)

811

812

return property(lambda self: real_value[0], setter)

813

814

815

expires = notifychangeproperty(datetime_to_dbus, "Expires")

816

approvals_pending = notifychangeproperty(dbus.Boolean,

817

"ApprovalPending",

818

type_func = bool)

819

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

820

last_enabled = notifychangeproperty(datetime_to_dbus,

821

"LastEnabled")

822

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

823

type_func = lambda checker: checker is not None)

824

last_checked_ok = notifychangeproperty(datetime_to_dbus,

825

"LastCheckedOK")

826

last_approval_request = notifychangeproperty(datetime_to_dbus,

827

"LastApprovalRequest")

828

approved_by_default = notifychangeproperty(dbus.Boolean,

829

"ApprovedByDefault")

830

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

831

type_func = _timedelta_to_milliseconds)

832

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

833

type_func = _timedelta_to_milliseconds)

834

host = notifychangeproperty(dbus.String, "Host")

835

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

836

type_func = _timedelta_to_milliseconds)

837

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

838

type_func = _timedelta_to_milliseconds)

839

interval = notifychangeproperty(dbus.UInt16, "Interval",

840

type_func = _timedelta_to_milliseconds)

841

checker_command = notifychangeproperty(dbus.String, "Checker")

842

843

del notifychangeproperty

757

844

758

845

def __del__(self, *args, **kwargs):

759

846

try:

760

847

self.remove_from_connection()

761

848

except LookupError:

762

849

pass

763

if hasattr(DBusObjectWithProperties, u"__del__"):

850

if hasattr(DBusObjectWithProperties, "__del__"):

764

851

DBusObjectWithProperties.__del__(self, *args, **kwargs)

765

852

Client.__del__(self, *args, **kwargs)

766

853

768

855

*args, **kwargs):

769

856

self.checker_callback_tag = None

770

857

self.checker = None

771

# Emit D-Bus signal

772

self.PropertyChanged(dbus.String(u"checker_running"),

773

dbus.Boolean(False, variant_level=1))

774

858

if os.WIFEXITED(condition):

775

859

exitstatus = os.WEXITSTATUS(condition)

776

860

# Emit D-Bus signal

786

870

return Client.checker_callback(self, pid, condition, command,

787

871

*args, **kwargs)

788

872

789

def checked_ok(self, *args, **kwargs):

790

r = Client.checked_ok(self, *args, **kwargs)

791

# Emit D-Bus signal

792

self.PropertyChanged(

793

dbus.String(u"last_checked_ok"),

794

(self._datetime_to_dbus(self.last_checked_ok,

795

variant_level=1)))

796

return r

797

798

873

def start_checker(self, *args, **kwargs):

799

874

old_checker = self.checker

800

875

if self.checker is not None:

807

882

and old_checker_pid != self.checker.pid):

808

883

# Emit D-Bus signal

809

884

self.CheckerStarted(self.current_checker_command)

810

self.PropertyChanged(

811

dbus.String(u"checker_running"),

812

dbus.Boolean(True, variant_level=1))

813

885

return r

814

886

815

def stop_checker(self, *args, **kwargs):

816

old_checker = getattr(self, u"checker", None)

817

r = Client.stop_checker(self, *args, **kwargs)

818

if (old_checker is not None

819

and getattr(self, u"checker", None) is None):

820

self.PropertyChanged(dbus.String(u"checker_running"),

821

dbus.Boolean(False, variant_level=1))

822

return r

823

824

887

def _reset_approved(self):

825

888

self._approved = None

826

889

return False

828

891

def approve(self, value=True):

829

892

self.send_changedstate()

830

893

self._approved = value

831

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),

894

gobject.timeout_add(_timedelta_to_milliseconds

895

(self.approval_duration),

832

896

self._reset_approved)

833

897

834

898

835

899

## D-Bus methods, signals & properties

836

_interface = u"se.bsnet.fukt.Mandos.Client"

900

_interface = "se.bsnet.fukt.Mandos.Client"

837

901

838

902

## Signals

839

903

840

904

# CheckerCompleted - signal

841

@dbus.service.signal(_interface, signature=u"nxs")

905

@dbus.service.signal(_interface, signature="nxs")

842

906

def CheckerCompleted(self, exitcode, waitstatus, command):

843

907

"D-Bus signal"

844

908

pass

845

909

846

910

# CheckerStarted - signal

847

@dbus.service.signal(_interface, signature=u"s")

911

@dbus.service.signal(_interface, signature="s")

848

912

def CheckerStarted(self, command):

849

913

"D-Bus signal"

850

914

pass

851

915

852

916

# PropertyChanged - signal

853

@dbus.service.signal(_interface, signature=u"sv")

917

@dbus.service.signal(_interface, signature="sv")

854

918

def PropertyChanged(self, property, value):

855

919

"D-Bus signal"

856

920

pass

865

929

pass

866

930

867

931

# Rejected - signal

868

@dbus.service.signal(_interface, signature=u"s")

932

@dbus.service.signal(_interface, signature="s")

869

933

def Rejected(self, reason):

870

934

"D-Bus signal"

871

935

pass

872

936

873

937

# NeedApproval - signal

874

@dbus.service.signal(_interface, signature=u"db")

938

@dbus.service.signal(_interface, signature="tb")

875

939

def NeedApproval(self, timeout, default):

876

940

"D-Bus signal"

877

pass

941

return self.need_approval()

878

942

879

943

## Methods

880

944

881

945

# Approve - method

882

@dbus.service.method(_interface, in_signature=u"b")

946

@dbus.service.method(_interface, in_signature="b")

883

947

def Approve(self, value):

884

948

self.approve(value)

885

949

886

950

# CheckedOK - method

887

951

@dbus.service.method(_interface)

888

952

def CheckedOK(self):

889

return self.checked_ok()

953

self.checked_ok()

890

954

891

955

# Enable - method

892

956

@dbus.service.method(_interface)

913

977

914

978

## Properties

915

979

916

# approved_pending - property

917

@dbus_service_property(_interface, signature=u"b", access=u"read")

918

def approved_pending_dbus_property(self):

980

# ApprovalPending - property

981

@dbus_service_property(_interface, signature="b", access="read")

982

def ApprovalPending_dbus_property(self):

919

983

return dbus.Boolean(bool(self.approvals_pending))

920

984

921

# approved_by_default - property

922

@dbus_service_property(_interface, signature=u"b",

923

access=u"readwrite")

924

def approved_by_default_dbus_property(self):

925

return dbus.Boolean(self.approved_by_default)

926

927

# approved_delay - property

928

@dbus_service_property(_interface, signature=u"t",

929

access=u"readwrite")

930

def approved_delay_dbus_property(self):

931

return dbus.UInt64(self.approved_delay_milliseconds())

932

933

# approved_duration - property

934

@dbus_service_property(_interface, signature=u"t",

935

access=u"readwrite")

936

def approved_duration_dbus_property(self):

937

return dbus.UInt64(self._timedelta_to_milliseconds(

938

self.approved_duration))

939

940

# name - property

941

@dbus_service_property(_interface, signature=u"s", access=u"read")

942

def name_dbus_property(self):

985

# ApprovedByDefault - property

986

@dbus_service_property(_interface, signature="b",

987

access="readwrite")

988

def ApprovedByDefault_dbus_property(self, value=None):

989

if value is None: # get

990

return dbus.Boolean(self.approved_by_default)

991

self.approved_by_default = bool(value)

992

993

# ApprovalDelay - property

994

@dbus_service_property(_interface, signature="t",

995

access="readwrite")

996

def ApprovalDelay_dbus_property(self, value=None):

997

if value is None: # get

998

return dbus.UInt64(self.approval_delay_milliseconds())

999

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1000

1001

# ApprovalDuration - property

1002

@dbus_service_property(_interface, signature="t",

1003

access="readwrite")

1004

def ApprovalDuration_dbus_property(self, value=None):

1005

if value is None: # get

1006

return dbus.UInt64(_timedelta_to_milliseconds(

1007

self.approval_duration))

1008

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1009

1010

# Name - property

1011

@dbus_service_property(_interface, signature="s", access="read")

1012

def Name_dbus_property(self):

943

1013

return dbus.String(self.name)

944

1014

945

# fingerprint - property

946

@dbus_service_property(_interface, signature=u"s", access=u"read")

947

def fingerprint_dbus_property(self):

1015

# Fingerprint - property

1016

@dbus_service_property(_interface, signature="s", access="read")

1017

def Fingerprint_dbus_property(self):

948

1018

return dbus.String(self.fingerprint)

949

1019

950

# host - property

951

@dbus_service_property(_interface, signature=u"s",

952

access=u"readwrite")

953

def host_dbus_property(self, value=None):

1020

# Host - property

1021

@dbus_service_property(_interface, signature="s",

1022

access="readwrite")

1023

def Host_dbus_property(self, value=None):

954

1024

if value is None: # get

955

1025

return dbus.String(self.host)

956

1026

self.host = value

957

# Emit D-Bus signal

958

self.PropertyChanged(dbus.String(u"host"),

959

dbus.String(value, variant_level=1))

960

961

# created - property

962

@dbus_service_property(_interface, signature=u"s", access=u"read")

963

def created_dbus_property(self):

964

return dbus.String(self._datetime_to_dbus(self.created))

965

966

# last_enabled - property

967

@dbus_service_property(_interface, signature=u"s", access=u"read")

968

def last_enabled_dbus_property(self):

969

if self.last_enabled is None:

970

return dbus.String(u"")

971

return dbus.String(self._datetime_to_dbus(self.last_enabled))

972

973

# enabled - property

974

@dbus_service_property(_interface, signature=u"b",

975

access=u"readwrite")

976

def enabled_dbus_property(self, value=None):

1027

1028

# Created - property

1029

@dbus_service_property(_interface, signature="s", access="read")

1030

def Created_dbus_property(self):

1031

return dbus.String(datetime_to_dbus(self.created))

1032

1033

# LastEnabled - property

1034

@dbus_service_property(_interface, signature="s", access="read")

1035

def LastEnabled_dbus_property(self):

1036

return datetime_to_dbus(self.last_enabled)

1037

1038

# Enabled - property

1039

@dbus_service_property(_interface, signature="b",

1040

access="readwrite")

1041

def Enabled_dbus_property(self, value=None):

977

1042

if value is None: # get

978

1043

return dbus.Boolean(self.enabled)

979

1044

if value:

981

1046

else:

982

1047

self.disable()

983

1048

984

# last_checked_ok - property

985

@dbus_service_property(_interface, signature=u"s",

986

access=u"readwrite")

987

def last_checked_ok_dbus_property(self, value=None):

1049

# LastCheckedOK - property

1050

@dbus_service_property(_interface, signature="s",

1051

access="readwrite")

1052

def LastCheckedOK_dbus_property(self, value=None):

988

1053

if value is not None:

989

1054

self.checked_ok()

990

1055

return

991

if self.last_checked_ok is None:

992

return dbus.String(u"")

993

return dbus.String(self._datetime_to_dbus(self

994

.last_checked_ok))

995

996

# timeout - property

997

@dbus_service_property(_interface, signature=u"t",

998

access=u"readwrite")

999

def timeout_dbus_property(self, value=None):

1056

return datetime_to_dbus(self.last_checked_ok)

1057

1058

# Expires - property

1059

@dbus_service_property(_interface, signature="s", access="read")

1060

def Expires_dbus_property(self):

1061

return datetime_to_dbus(self.expires)

1062

1063

# LastApprovalRequest - property

1064

@dbus_service_property(_interface, signature="s", access="read")

1065

def LastApprovalRequest_dbus_property(self):

1066

return datetime_to_dbus(self.last_approval_request)

1067

1068

# Timeout - property

1069

@dbus_service_property(_interface, signature="t",

1070

access="readwrite")

1071

def Timeout_dbus_property(self, value=None):

1000

1072

if value is None: # get

1001

1073

return dbus.UInt64(self.timeout_milliseconds())

1002

1074

self.timeout = datetime.timedelta(0, 0, 0, value)

1003

# Emit D-Bus signal

1004

self.PropertyChanged(dbus.String(u"timeout"),

1005

dbus.UInt64(value, variant_level=1))

1006

if getattr(self, u"disable_initiator_tag", None) is None:

1075

if getattr(self, "disable_initiator_tag", None) is None:

1007

1076

return

1008

1077

# Reschedule timeout

1009

1078

gobject.source_remove(self.disable_initiator_tag)

1010

1079

self.disable_initiator_tag = None

1080

self.expires = None

1011

1081

time_to_die = (self.

1012

1082

_timedelta_to_milliseconds((self

1013

1083

.last_checked_ok

1018

1088

# The timeout has passed

1019

1089

self.disable()

1020

1090

else:

1091

self.expires = (datetime.datetime.utcnow()

1092

+ datetime.timedelta(milliseconds = time_to_die))

1021

1093

self.disable_initiator_tag = (gobject.timeout_add

1022

1094

(time_to_die, self.disable))

1023

1095

1024

# interval - property

1025

@dbus_service_property(_interface, signature=u"t",

1026

access=u"readwrite")

1027

def interval_dbus_property(self, value=None):

1096

# ExtendedTimeout - property

1097

@dbus_service_property(_interface, signature="t",

1098

access="readwrite")

1099

def ExtendedTimeout_dbus_property(self, value=None):

1100

if value is None: # get

1101

return dbus.UInt64(self.extended_timeout_milliseconds())

1102

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1103

1104

# Interval - property

1105

@dbus_service_property(_interface, signature="t",

1106

access="readwrite")

1107

def Interval_dbus_property(self, value=None):

1028

1108

if value is None: # get

1029

1109

return dbus.UInt64(self.interval_milliseconds())

1030

1110

self.interval = datetime.timedelta(0, 0, 0, value)

1031

# Emit D-Bus signal

1032

self.PropertyChanged(dbus.String(u"interval"),

1033

dbus.UInt64(value, variant_level=1))

1034

if getattr(self, u"checker_initiator_tag", None) is None:

1111

if getattr(self, "checker_initiator_tag", None) is None:

1035

1112

return

1036

1113

# Reschedule checker run

1037

1114

gobject.source_remove(self.checker_initiator_tag)

1038

1115

self.checker_initiator_tag = (gobject.timeout_add

1039

1116

(value, self.start_checker))

1040

1117

self.start_checker() # Start one now, too

1041

1042

# checker - property

1043

@dbus_service_property(_interface, signature=u"s",

1044

access=u"readwrite")

1045

def checker_dbus_property(self, value=None):

1118

1119

# Checker - property

1120

@dbus_service_property(_interface, signature="s",

1121

access="readwrite")

1122

def Checker_dbus_property(self, value=None):

1046

1123

if value is None: # get

1047

1124

return dbus.String(self.checker_command)

1048

1125

self.checker_command = value

1049

# Emit D-Bus signal

1050

self.PropertyChanged(dbus.String(u"checker"),

1051

dbus.String(self.checker_command,

1052

variant_level=1))

1053

1126

1054

# checker_running - property

1055

@dbus_service_property(_interface, signature=u"b",

1056

access=u"readwrite")

1057

def checker_running_dbus_property(self, value=None):

1127

# CheckerRunning - property

1128

@dbus_service_property(_interface, signature="b",

1129

access="readwrite")

1130

def CheckerRunning_dbus_property(self, value=None):

1058

1131

if value is None: # get

1059

1132

return dbus.Boolean(self.checker is not None)

1060

1133

if value:

1062

1135

else:

1063

1136

self.stop_checker()

1064

1137

1065

# object_path - property

1066

@dbus_service_property(_interface, signature=u"o", access=u"read")

1067

def object_path_dbus_property(self):

1138

# ObjectPath - property

1139

@dbus_service_property(_interface, signature="o", access="read")

1140

def ObjectPath_dbus_property(self):

1068

1141

return self.dbus_object_path # is already a dbus.ObjectPath

1069

1142

1070

# secret = property

1071

@dbus_service_property(_interface, signature=u"ay",

1072

access=u"write", byte_arrays=True)

1073

def secret_dbus_property(self, value):

1143

# Secret = property

1144

@dbus_service_property(_interface, signature="ay",

1145

access="write", byte_arrays=True)

1146

def Secret_dbus_property(self, value):

1074

1147

self.secret = str(value)

1075

1148

1076

1149

del _interface

1082

1155

self._pipe.send(('init', fpr, address))

1083

1156

if not self._pipe.recv():

1084

1157

raise KeyError()

1085

1158

1086

1159

def __getattribute__(self, name):

1087

1160

if(name == '_pipe'):

1088

1161

return super(ProxyClient, self).__getattribute__(name)

1095

1168

self._pipe.send(('funcall', name, args, kwargs))

1096

1169

return self._pipe.recv()[1]

1097

1170

return func

1098

1171

1099

1172

def __setattr__(self, name, value):

1100

1173

if(name == '_pipe'):

1101

1174

return super(ProxyClient, self).__setattr__(name, value)

1110

1183

1111

1184

def handle(self):

1112

1185

with contextlib.closing(self.server.child_pipe) as child_pipe:

1113

logger.info(u"TCP connection from: %s",

1186

logger.info("TCP connection from: %s",

1114

1187

unicode(self.client_address))

1115

logger.debug(u"Pipe FD: %d",

1188

logger.debug("Pipe FD: %d",

1116

1189

self.server.child_pipe.fileno())

1117

1190

1118

1191

session = (gnutls.connection

1119

1192

.ClientSession(self.request,

1120

1193

gnutls.connection

1121

1194

.X509Credentials()))

1122

1195

1123

1196

# Note: gnutls.connection.X509Credentials is really a

1124

1197

# generic GnuTLS certificate credentials object so long as

1125

1198

# no X.509 keys are added to it. Therefore, we can use it

1126

1199

# here despite using OpenPGP certificates.

1127

1128

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1129

# u"+AES-256-CBC", u"+SHA1",

1130

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1131

# u"+DHE-DSS"))

1200

1201

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1202

# "+AES-256-CBC", "+SHA1",

1203

# "+COMP-NULL", "+CTYPE-OPENPGP",

1204

# "+DHE-DSS"))

1132

1205

# Use a fallback default, since this MUST be set.

1133

1206

priority = self.server.gnutls_priority

1134

1207

if priority is None:

1135

priority = u"NORMAL"

1208

priority = "NORMAL"

1136

1209

(gnutls.library.functions

1137

1210

.gnutls_priority_set_direct(session._c_object,

1138

1211

priority, None))

1139

1212

1140

1213

# Start communication using the Mandos protocol

1141

1214

# Get protocol number

1142

1215

line = self.request.makefile().readline()

1143

logger.debug(u"Protocol version: %r", line)

1216

logger.debug("Protocol version: %r", line)

1144

1217

try:

1145

1218

if int(line.strip().split()[0]) > 1:

1146

1219

raise RuntimeError

1147

except (ValueError, IndexError, RuntimeError), error:

1148

logger.error(u"Unknown protocol version: %s", error)

1220

except (ValueError, IndexError, RuntimeError) as error:

1221

logger.error("Unknown protocol version: %s", error)

1149

1222

return

1150

1223

1151

1224

# Start GnuTLS connection

1152

1225

try:

1153

1226

session.handshake()

1154

except gnutls.errors.GNUTLSError, error:

1155

logger.warning(u"Handshake failed: %s", error)

1227

except gnutls.errors.GNUTLSError as error:

1228

logger.warning("Handshake failed: %s", error)

1156

1229

# Do not run session.bye() here: the session is not

1157

1230

# established. Just abandon the request.

1158

1231

return

1159

logger.debug(u"Handshake succeeded")

1160

1232

logger.debug("Handshake succeeded")

1233

1161

1234

approval_required = False

1162

1235

try:

1163

1236

try:

1164

1237

fpr = self.fingerprint(self.peer_certificate

1165

1238

(session))

1166

except (TypeError, gnutls.errors.GNUTLSError), error:

1167

logger.warning(u"Bad certificate: %s", error)

1239

except (TypeError,

1240

gnutls.errors.GNUTLSError) as error:

1241

logger.warning("Bad certificate: %s", error)

1168

1242

return

1169

logger.debug(u"Fingerprint: %s", fpr)

1170

1243

logger.debug("Fingerprint: %s", fpr)

1244

1171

1245

try:

1172

1246

client = ProxyClient(child_pipe, fpr,

1173

1247

self.client_address)

1174

1248

except KeyError:

1175

1249

return

1176

1250

1177

if client.approved_delay:

1178

delay = client.approved_delay

1251

if client.approval_delay:

1252

delay = client.approval_delay

1179

1253

client.approvals_pending += 1

1180

1254

approval_required = True

1181

1255

1182

1256

while True:

1183

1257

if not client.enabled:

1184

logger.warning(u"Client %s is disabled",

1258

logger.info("Client %s is disabled",

1185

1259

client.name)

1186

1260

if self.server.use_dbus:

1187

1261

# Emit D-Bus signal

1188

1262

client.Rejected("Disabled")

1189

1263

return

1190

1264

1191

if client._approved or not client.approved_delay:

1265

if client._approved or not client.approval_delay:

1192

1266

#We are approved or approval is disabled

1193

1267

break

1194

1268

elif client._approved is None:

1195

logger.info(u"Client %s need approval",

1269

logger.info("Client %s needs approval",

1196

1270

client.name)

1197

1271

if self.server.use_dbus:

1198

1272

# Emit D-Bus signal

1199

1273

client.NeedApproval(

1200

client.approved_delay_milliseconds(),

1274

client.approval_delay_milliseconds(),

1201

1275

client.approved_by_default)

1202

1276

else:

1203

logger.warning(u"Client %s was not approved",

1277

logger.warning("Client %s was not approved",

1204

1278

client.name)

1205

1279

if self.server.use_dbus:

1206

1280

# Emit D-Bus signal

1207

client.Rejected("Disapproved")

1281

client.Rejected("Denied")

1208

1282

return

1209

1283

1210

1284

#wait until timeout or approved

1221

1295

client.name)

1222

1296

if self.server.use_dbus:

1223

1297

# Emit D-Bus signal

1224

client.Rejected("Time out")

1298

client.Rejected("Approval timed out")

1225

1299

return

1226

1300

else:

1227

1301

break

1232

1306

while sent_size < len(client.secret):

1233

1307

try:

1234

1308

sent = session.send(client.secret[sent_size:])

1235

except (gnutls.errors.GNUTLSError), error:

1309

except gnutls.errors.GNUTLSError as error:

1236

1310

logger.warning("gnutls send failed")

1237

1311

return

1238

logger.debug(u"Sent: %d, remaining: %d",

1312

logger.debug("Sent: %d, remaining: %d",

1239

1313

sent, len(client.secret)

1240

1314

- (sent_size + sent))

1241

1315

sent_size += sent

1242

1243

logger.info(u"Sending secret to %s", client.name)

1316

1317

logger.info("Sending secret to %s", client.name)

1244

1318

# bump the timeout as if seen

1245

client.checked_ok()

1319

client.checked_ok(client.extended_timeout)

1246

1320

if self.server.use_dbus:

1247

1321

# Emit D-Bus signal

1248

1322

client.GotSecret()

1252

1326

client.approvals_pending -= 1

1253

1327

try:

1254

1328

session.bye()

1255

except (gnutls.errors.GNUTLSError), error:

1256

logger.warning("gnutls bye failed")

1329

except gnutls.errors.GNUTLSError as error:

1330

logger.warning("GnuTLS bye failed")

1257

1331

1258

1332

@staticmethod

1259

1333

def peer_certificate(session):

1269

1343

.gnutls_certificate_get_peers

1270

1344

(session._c_object, ctypes.byref(list_size)))

1271

1345

if not bool(cert_list) and list_size.value != 0:

1272

raise gnutls.errors.GNUTLSError(u"error getting peer"

1273

u" certificate")

1346

raise gnutls.errors.GNUTLSError("error getting peer"

1347

" certificate")

1274

1348

if list_size.value == 0:

1275

1349

return None

1276

1350

cert = cert_list[0]

1302

1376

if crtverify.value != 0:

1303

1377

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1304

1378

raise (gnutls.errors.CertificateSecurityError

1305

(u"Verify failed"))

1379

("Verify failed"))

1306

1380

# New buffer for the fingerprint

1307

1381

buf = ctypes.create_string_buffer(20)

1308

1382

buf_len = ctypes.c_size_t()

1315

1389

# Convert the buffer to a Python bytestring

1316

1390

fpr = ctypes.string_at(buf, buf_len.value)

1317

1391

# Convert the bytestring to hexadecimal notation

1318

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1392

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1319

1393

return hex_fpr

1320

1394

1321

1395

1333

1407

multiprocessing.Process(target = self.sub_process_main,

1334

1408

args = (request, address)).start()

1335

1409

1410

1336

1411

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1337

1412

""" adds a pipe to the MixIn """

1338

1413

def process_request(self, request, client_address):

1341

1416

This function creates a new pipe in self.pipe

1342

1417

"""

1343

1418

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1344

1419

1345

1420

super(MultiprocessingMixInWithPipe,

1346

1421

self).process_request(request, client_address)

1347

1422

self.child_pipe.close()

1348

1423

self.add_pipe(parent_pipe)

1349

1424

1350

1425

def add_pipe(self, parent_pipe):

1351

1426

"""Dummy function; override as necessary"""

1352

pass

1427

raise NotImplementedError

1428

1353

1429

1354

1430

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1355

1431

socketserver.TCPServer, object):

1373

1449

bind to an address or port if they were not specified."""

1374

1450

if self.interface is not None:

1375

1451

if SO_BINDTODEVICE is None:

1376

logger.error(u"SO_BINDTODEVICE does not exist;"

1377

u" cannot bind to interface %s",

1452

logger.error("SO_BINDTODEVICE does not exist;"

1453

" cannot bind to interface %s",

1378

1454

self.interface)

1379

1455

else:

1380

1456

try:

1381

1457

self.socket.setsockopt(socket.SOL_SOCKET,

1382

1458

SO_BINDTODEVICE,

1383

1459

str(self.interface

1384

+ u'\0'))

1385

except socket.error, error:

1460

+ '\0'))

1461

except socket.error as error:

1386

1462

if error[0] == errno.EPERM:

1387

logger.error(u"No permission to"

1388

u" bind to interface %s",

1463

logger.error("No permission to"

1464

" bind to interface %s",

1389

1465

self.interface)

1390

1466

elif error[0] == errno.ENOPROTOOPT:

1391

logger.error(u"SO_BINDTODEVICE not available;"

1392

u" cannot bind to interface %s",

1467

logger.error("SO_BINDTODEVICE not available;"

1468

" cannot bind to interface %s",

1393

1469

self.interface)

1394

1470

else:

1395

1471

raise

1397

1473

if self.server_address[0] or self.server_address[1]:

1398

1474

if not self.server_address[0]:

1399

1475

if self.address_family == socket.AF_INET6:

1400

any_address = u"::" # in6addr_any

1476

any_address = "::" # in6addr_any

1401

1477

else:

1402

1478

any_address = socket.INADDR_ANY

1403

1479

self.server_address = (any_address,

1452

1528

def handle_ipc(self, source, condition, parent_pipe=None,

1453

1529

client_object=None):

1454

1530

condition_names = {

1455

gobject.IO_IN: u"IN", # There is data to read.

1456

gobject.IO_OUT: u"OUT", # Data can be written (without

1531

gobject.IO_IN: "IN", # There is data to read.

1532

gobject.IO_OUT: "OUT", # Data can be written (without

1457

1533

# blocking).

1458

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1459

gobject.IO_ERR: u"ERR", # Error condition.

1460

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1534

gobject.IO_PRI: "PRI", # There is urgent data to read.

1535

gobject.IO_ERR: "ERR", # Error condition.

1536

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1461

1537

# broken, usually for pipes and

1462

1538

# sockets).

1463

1539

}

1465

1541

for cond, name in

1466

1542

condition_names.iteritems()

1467

1543

if cond & condition)

1468

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1469

conditions_string)

1470

1471

1544

# error or the other end of multiprocessing.Pipe has closed

1472

1545

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1473

1546

return False

1474

1547

1475

1548

# Read a request from the child

1476

1549

request = parent_pipe.recv()

1477

logger.debug(u"IPC request: %s", repr(request))

1478

1550

command = request[0]

1479

1551

1480

1552

if command == 'init':

1486

1558

client = c

1487

1559

break

1488

1560

else:

1489

logger.warning(u"Client not found for fingerprint: %s, ad"

1490

u"dress: %s", fpr, address)

1561

logger.info("Client not found for fingerprint: %s, ad"

1562

"dress: %s", fpr, address)

1491

1563

if self.use_dbus:

1492

1564

# Emit D-Bus signal

1493

mandos_dbus_service.ClientNotFound(fpr, address)

1565

mandos_dbus_service.ClientNotFound(fpr, address[0])

1494

1566

parent_pipe.send(False)

1495

1567

return False

1496

1568

1508

1580

kwargs = request[3]

1509

1581

1510

1582

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1511

1583

1512

1584

if command == 'getattr':

1513

1585

attrname = request[1]

1514

1586

if callable(client_object.__getattribute__(attrname)):

1520

1592

attrname = request[1]

1521

1593

value = request[2]

1522

1594

setattr(client_object, attrname, value)

1523

1595

1524

1596

return True

1525

1597

1526

1598

1527

1599

def string_to_delta(interval):

1528

1600

"""Parse a string and return a datetime.timedelta

1529

1601

1530

>>> string_to_delta(u'7d')

1602

>>> string_to_delta('7d')

1531

1603

datetime.timedelta(7)

1532

>>> string_to_delta(u'60s')

1604

>>> string_to_delta('60s')

1533

1605

datetime.timedelta(0, 60)

1534

>>> string_to_delta(u'60m')

1606

>>> string_to_delta('60m')

1535

1607

datetime.timedelta(0, 3600)

1536

>>> string_to_delta(u'24h')

1608

>>> string_to_delta('24h')

1537

1609

datetime.timedelta(1)

1538

>>> string_to_delta(u'1w')

1610

>>> string_to_delta('1w')

1539

1611

datetime.timedelta(7)

1540

>>> string_to_delta(u'5m 30s')

1612

>>> string_to_delta('5m 30s')

1541

1613

datetime.timedelta(0, 330)

1542

1614

"""

1543

1615

timevalue = datetime.timedelta(0)

1545

1617

try:

1546

1618

suffix = unicode(s[-1])

1547

1619

value = int(s[:-1])

1548

if suffix == u"d":

1620

if suffix == "d":

1549

1621

delta = datetime.timedelta(value)

1550

elif suffix == u"s":

1622

elif suffix == "s":

1551

1623

delta = datetime.timedelta(0, value)

1552

elif suffix == u"m":

1624

elif suffix == "m":

1553

1625

delta = datetime.timedelta(0, 0, 0, 0, value)

1554

elif suffix == u"h":

1626

elif suffix == "h":

1555

1627

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1556

elif suffix == u"w":

1628

elif suffix == "w":

1557

1629

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1558

1630

else:

1559

raise ValueError(u"Unknown suffix %r" % suffix)

1560

except (ValueError, IndexError), e:

1561

raise ValueError(e.message)

1631

raise ValueError("Unknown suffix %r" % suffix)

1632

except (ValueError, IndexError) as e:

1633

raise ValueError(*(e.args))

1562

1634

timevalue += delta

1563

1635

return timevalue

1564

1636

1570

1642

global if_nametoindex

1571

1643

try:

1572

1644

if_nametoindex = (ctypes.cdll.LoadLibrary

1573

(ctypes.util.find_library(u"c"))

1645

(ctypes.util.find_library("c"))

1574

1646

.if_nametoindex)

1575

1647

except (OSError, AttributeError):

1576

logger.warning(u"Doing if_nametoindex the hard way")

1648

logger.warning("Doing if_nametoindex the hard way")

1577

1649

def if_nametoindex(interface):

1578

1650

"Get an interface index the hard way, i.e. using fcntl()"

1579

1651

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1580

1652

with contextlib.closing(socket.socket()) as s:

1581

1653

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1582

struct.pack(str(u"16s16x"),

1654

struct.pack(str("16s16x"),

1583

1655

interface))

1584

interface_index = struct.unpack(str(u"I"),

1656

interface_index = struct.unpack(str("I"),

1585

1657

ifreq[16:20])[0]

1586

1658

return interface_index

1587

1659

return if_nametoindex(interface)

1595

1667

sys.exit()

1596

1668

os.setsid()

1597

1669

if not nochdir:

1598

os.chdir(u"/")

1670

os.chdir("/")

1599

1671

if os.fork():

1600

1672

sys.exit()

1601

1673

if not noclose:

1603

1675

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1604

1676

if not stat.S_ISCHR(os.fstat(null).st_mode):

1605

1677

raise OSError(errno.ENODEV,

1606

u"%s not a character device"

1678

"%s not a character device"

1607

1679

% os.path.devnull)

1608

1680

os.dup2(null, sys.stdin.fileno())

1609

1681

os.dup2(null, sys.stdout.fileno())

1617

1689

##################################################################

1618

1690

# Parsing of options, both command line and config file

1619

1691

1620

parser = optparse.OptionParser(version = "%%prog %s" % version)

1621

parser.add_option("-i", u"--interface", type=u"string",

1622

metavar="IF", help=u"Bind to interface IF")

1623

parser.add_option("-a", u"--address", type=u"string",

1624

help=u"Address to listen for requests on")

1625

parser.add_option("-p", u"--port", type=u"int",

1626

help=u"Port number to receive requests on")

1627

parser.add_option("--check", action=u"store_true",

1628

help=u"Run self-test")

1629

parser.add_option("--debug", action=u"store_true",

1630

help=u"Debug mode; run in foreground and log to"

1631

u" terminal")

1632

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1633

help=u"Debug level for stdout output")

1634

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1635

u" priority string (see GnuTLS documentation)")

1636

parser.add_option("--servicename", type=u"string",

1637

metavar=u"NAME", help=u"Zeroconf service name")

1638

parser.add_option("--configdir", type=u"string",

1639

default=u"/etc/mandos", metavar=u"DIR",

1640

help=u"Directory to search for configuration"

1641

u" files")

1642

parser.add_option("--no-dbus", action=u"store_false",

1643

dest=u"use_dbus", help=u"Do not provide D-Bus"

1644

u" system bus interface")

1645

parser.add_option("--no-ipv6", action=u"store_false",

1646

dest=u"use_ipv6", help=u"Do not use IPv6")

1647

options = parser.parse_args()[0]

1692

parser = argparse.ArgumentParser()

1693

parser.add_argument("-v", "--version", action="version",

1694

version = "%%(prog)s %s" % version,

1695

help="show version number and exit")

1696

parser.add_argument("-i", "--interface", metavar="IF",

1697

help="Bind to interface IF")

1698

parser.add_argument("-a", "--address",

1699

help="Address to listen for requests on")

1700

parser.add_argument("-p", "--port", type=int,

1701

help="Port number to receive requests on")

1702

parser.add_argument("--check", action="store_true",

1703

help="Run self-test")

1704

parser.add_argument("--debug", action="store_true",

1705

help="Debug mode; run in foreground and log"

1706

" to terminal")

1707

parser.add_argument("--debuglevel", metavar="LEVEL",

1708

help="Debug level for stdout output")

1709

parser.add_argument("--priority", help="GnuTLS"

1710

" priority string (see GnuTLS documentation)")

1711

parser.add_argument("--servicename",

1712

metavar="NAME", help="Zeroconf service name")

1713

parser.add_argument("--configdir",

1714

default="/etc/mandos", metavar="DIR",

1715

help="Directory to search for configuration"

1716

" files")

1717

parser.add_argument("--no-dbus", action="store_false",

1718

dest="use_dbus", help="Do not provide D-Bus"

1719

" system bus interface")

1720

parser.add_argument("--no-ipv6", action="store_false",

1721

dest="use_ipv6", help="Do not use IPv6")

1722

options = parser.parse_args()

1648

1723

1649

1724

if options.check:

1650

1725

import doctest

1652

1727

sys.exit()

1653

1728

1654

1729

# Default values for config file for server-global settings

1655

server_defaults = { u"interface": u"",

1656

u"address": u"",

1657

u"port": u"",

1658

u"debug": u"False",

1659

u"priority":

1660

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1661

u"servicename": u"Mandos",

1662

u"use_dbus": u"True",

1663

u"use_ipv6": u"True",

1664

u"debuglevel": u"",

1730

server_defaults = { "interface": "",

1731

"address": "",

1732

"port": "",

1733

"debug": "False",

1734

"priority":

1735

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1736

"servicename": "Mandos",

1737

"use_dbus": "True",

1738

"use_ipv6": "True",

1739

"debuglevel": "",

1665

1740

}

1666

1741

1667

1742

# Parse config file for server-global settings

1668

1743

server_config = configparser.SafeConfigParser(server_defaults)

1669

1744

del server_defaults

1670

1745

server_config.read(os.path.join(options.configdir,

1671

u"mandos.conf"))

1746

"mandos.conf"))

1672

1747

# Convert the SafeConfigParser object to a dict

1673

1748

server_settings = server_config.defaults()

1674

1749

# Use the appropriate methods on the non-string config options

1675

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1676

server_settings[option] = server_config.getboolean(u"DEFAULT",

1750

for option in ("debug", "use_dbus", "use_ipv6"):

1751

server_settings[option] = server_config.getboolean("DEFAULT",

1677

1752

option)

1678

1753

if server_settings["port"]:

1679

server_settings["port"] = server_config.getint(u"DEFAULT",

1680

u"port")

1754

server_settings["port"] = server_config.getint("DEFAULT",

1755

"port")

1681

1756

del server_config

1682

1757

1683

1758

# Override the settings from the config file with command line

1684

1759

# options, if set.

1685

for option in (u"interface", u"address", u"port", u"debug",

1686

u"priority", u"servicename", u"configdir",

1687

u"use_dbus", u"use_ipv6", u"debuglevel"):

1760

for option in ("interface", "address", "port", "debug",

1761

"priority", "servicename", "configdir",

1762

"use_dbus", "use_ipv6", "debuglevel"):

1688

1763

value = getattr(options, option)

1689

1764

if value is not None:

1690

1765

server_settings[option] = value

1698

1773

##################################################################

1699

1774

1700

1775

# For convenience

1701

debug = server_settings[u"debug"]

1702

debuglevel = server_settings[u"debuglevel"]

1703

use_dbus = server_settings[u"use_dbus"]

1704

use_ipv6 = server_settings[u"use_ipv6"]

1705

1706

if server_settings[u"servicename"] != u"Mandos":

1776

debug = server_settings["debug"]

1777

debuglevel = server_settings["debuglevel"]

1778

use_dbus = server_settings["use_dbus"]

1779

use_ipv6 = server_settings["use_ipv6"]

1780

1781

if server_settings["servicename"] != "Mandos":

1707

1782

syslogger.setFormatter(logging.Formatter

1708

(u'Mandos (%s) [%%(process)d]:'

1709

u' %%(levelname)s: %%(message)s'

1710

% server_settings[u"servicename"]))

1783

('Mandos (%s) [%%(process)d]:'

1784

' %%(levelname)s: %%(message)s'

1785

% server_settings["servicename"]))

1711

1786

1712

1787

# Parse config file with clients

1713

client_defaults = { u"timeout": u"1h",

1714

u"interval": u"5m",

1715

u"checker": u"fping -q -- %%(host)s",

1716

u"host": u"",

1717

u"approved_delay": u"0s",

1718

u"approved_duration": u"1s",

1788

client_defaults = { "timeout": "5m",

1789

"extended_timeout": "15m",

1790

"interval": "2m",

1791

"checker": "fping -q -- %%(host)s",

1792

"host": "",

1793

"approval_delay": "0s",

1794

"approval_duration": "1s",

1719

1795

}

1720

1796

client_config = configparser.SafeConfigParser(client_defaults)

1721

client_config.read(os.path.join(server_settings[u"configdir"],

1722

u"clients.conf"))

1797

client_config.read(os.path.join(server_settings["configdir"],

1798

"clients.conf"))

1723

1799

1724

1800

global mandos_dbus_service

1725

1801

mandos_dbus_service = None

1726

1802

1727

tcp_server = MandosServer((server_settings[u"address"],

1728

server_settings[u"port"]),

1803

tcp_server = MandosServer((server_settings["address"],

1804

server_settings["port"]),

1729

1805

ClientHandler,

1730

interface=server_settings[u"interface"],

1806

interface=(server_settings["interface"]

1807

or None),

1731

1808

use_ipv6=use_ipv6,

1732

1809

gnutls_priority=

1733

server_settings[u"priority"],

1810

server_settings["priority"],

1734

1811

use_dbus=use_dbus)

1735

pidfilename = u"/var/run/mandos.pid"

1736

try:

1737

pidfile = open(pidfilename, u"w")

1738

except IOError:

1739

logger.error(u"Could not open file %r", pidfilename)

1812

if not debug:

1813

pidfilename = "/var/run/mandos.pid"

1814

try:

1815

pidfile = open(pidfilename, "w")

1816

except IOError:

1817

logger.error("Could not open file %r", pidfilename)

1740

1818

1741

1819

try:

1742

uid = pwd.getpwnam(u"_mandos").pw_uid

1743

gid = pwd.getpwnam(u"_mandos").pw_gid

1820

uid = pwd.getpwnam("_mandos").pw_uid

1821

gid = pwd.getpwnam("_mandos").pw_gid

1744

1822

except KeyError:

1745

1823

try:

1746

uid = pwd.getpwnam(u"mandos").pw_uid

1747

gid = pwd.getpwnam(u"mandos").pw_gid

1824

uid = pwd.getpwnam("mandos").pw_uid

1825

gid = pwd.getpwnam("mandos").pw_gid

1748

1826

except KeyError:

1749

1827

try:

1750

uid = pwd.getpwnam(u"nobody").pw_uid

1751

gid = pwd.getpwnam(u"nobody").pw_gid

1828

uid = pwd.getpwnam("nobody").pw_uid

1829

gid = pwd.getpwnam("nobody").pw_gid

1752

1830

except KeyError:

1753

1831

uid = 65534

1754

1832

gid = 65534

1755

1833

try:

1756

1834

os.setgid(gid)

1757

1835

os.setuid(uid)

1758

except OSError, error:

1836

except OSError as error:

1759

1837

if error[0] != errno.EPERM:

1760

1838

raise error

1761

1839

1762

# Enable all possible GnuTLS debugging

1763

1764

1765

1840

if not debug and not debuglevel:

1766

1841

syslogger.setLevel(logging.WARNING)

1767

1842

console.setLevel(logging.WARNING)

1769

1844

level = getattr(logging, debuglevel.upper())

1770

1845

syslogger.setLevel(level)

1771

1846

console.setLevel(level)

1772

1847

1773

1848

if debug:

1849

# Enable all possible GnuTLS debugging

1850

1774

1851

# "Use a log level over 10 to enable all debugging options."

1775

1852

# - GnuTLS manual

1776

1853

gnutls.library.functions.gnutls_global_set_log_level(11)

1777

1854

1778

1855

@gnutls.library.types.gnutls_log_func

1779

1856

def debug_gnutls(level, string):

1780

logger.debug(u"GnuTLS: %s", string[:-1])

1857

logger.debug("GnuTLS: %s", string[:-1])

1781

1858

1782

1859

(gnutls.library.functions

1783

1860

.gnutls_global_set_log_function(debug_gnutls))

1784

1861

1785

1862

# Redirect stdin so all checkers get /dev/null

1786

1863

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1787

1864

os.dup2(null, sys.stdin.fileno())

1790

1867

else:

1791

1868

# No console logging

1792

1869

logger.removeHandler(console)

1793

1870

1871

# Need to fork before connecting to D-Bus

1872

if not debug:

1873

# Close all input and output, do double fork, etc.

1874

daemon()

1794

1875

1795

1876

global main_loop

1796

1877

# From the Avahi example code

1800

1881

# End of Avahi example code

1801

1882

if use_dbus:

1802

1883

try:

1803

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1884

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1804

1885

bus, do_not_queue=True)

1805

except dbus.exceptions.NameExistsException, e:

1806

logger.error(unicode(e) + u", disabling D-Bus")

1886

except dbus.exceptions.NameExistsException as e:

1887

logger.error(unicode(e) + ", disabling D-Bus")

1807

1888

use_dbus = False

1808

server_settings[u"use_dbus"] = False

1889

server_settings["use_dbus"] = False

1809

1890

tcp_server.use_dbus = False

1810

1891

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1811

service = AvahiService(name = server_settings[u"servicename"],

1812

servicetype = u"_mandos._tcp",

1892

service = AvahiService(name = server_settings["servicename"],

1893

servicetype = "_mandos._tcp",

1813

1894

protocol = protocol, bus = bus)

1814

1895

if server_settings["interface"]:

1815

1896

service.interface = (if_nametoindex

1816

(str(server_settings[u"interface"])))

1817

1818

if not debug:

1819

# Close all input and output, do double fork, etc.

1820

daemon()

1821

1897

(str(server_settings["interface"])))

1898

1822

1899

global multiprocessing_manager

1823

1900

multiprocessing_manager = multiprocessing.Manager()

1824

1901

1843

1920

client_config, section)))

1844

1921

for section in client_config.sections()))

1845

1922

if not tcp_server.clients:

1846

logger.warning(u"No clients defined")

1923

logger.warning("No clients defined")

1847

1924

1848

try:

1849

with pidfile:

1850

pid = os.getpid()

1851

pidfile.write(str(pid) + "\n")

1852

del pidfile

1853

except IOError:

1854

logger.error(u"Could not write to file %r with PID %d",

1855

pidfilename, pid)

1856

except NameError:

1857

# "pidfile" was never created

1858

pass

1859

del pidfilename

1860

1861

1925

if not debug:

1926

try:

1927

with pidfile:

1928

pid = os.getpid()

1929

pidfile.write(str(pid) + "\n".encode("utf-8"))

1930

del pidfile

1931

except IOError:

1932

logger.error("Could not write to file %r with PID %d",

1933

pidfilename, pid)

1934

except NameError:

1935

# "pidfile" was never created

1936

pass

1937

del pidfilename

1938

1862

1939

signal.signal(signal.SIGINT, signal.SIG_IGN)

1940

1863

1941

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1864

1942

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1865

1943

1867

1945

class MandosDBusService(dbus.service.Object):

1868

1946

"""A D-Bus proxy object"""

1869

1947

def __init__(self):

1870

dbus.service.Object.__init__(self, bus, u"/")

1871

_interface = u"se.bsnet.fukt.Mandos"

1948

dbus.service.Object.__init__(self, bus, "/")

1949

_interface = "se.bsnet.fukt.Mandos"

1872

1950

1873

@dbus.service.signal(_interface, signature=u"o")

1951

@dbus.service.signal(_interface, signature="o")

1874

1952

def ClientAdded(self, objpath):

1875

1953

"D-Bus signal"

1876

1954

pass

1877

1955

1878

@dbus.service.signal(_interface, signature=u"ss")

1956

@dbus.service.signal(_interface, signature="ss")

1879

1957

def ClientNotFound(self, fingerprint, address):

1880

1958

"D-Bus signal"

1881

1959

pass

1882

1960

1883

@dbus.service.signal(_interface, signature=u"os")

1961

@dbus.service.signal(_interface, signature="os")

1884

1962

def ClientRemoved(self, objpath, name):

1885

1963

"D-Bus signal"

1886

1964

pass

1887

1965

1888

@dbus.service.method(_interface, out_signature=u"ao")

1966

@dbus.service.method(_interface, out_signature="ao")

1889

1967

def GetAllClients(self):

1890

1968

"D-Bus method"

1891

1969

return dbus.Array(c.dbus_object_path

1892

1970

for c in tcp_server.clients)

1893

1971

1894

1972

@dbus.service.method(_interface,

1895

out_signature=u"a{oa{sv}}")

1973

out_signature="a{oa{sv}}")

1896

1974

def GetAllClientsWithProperties(self):

1897

1975

"D-Bus method"

1898

1976

return dbus.Dictionary(

1899

((c.dbus_object_path, c.GetAll(u""))

1977

((c.dbus_object_path, c.GetAll(""))

1900

1978

for c in tcp_server.clients),

1901

signature=u"oa{sv}")

1979

signature="oa{sv}")

1902

1980

1903

@dbus.service.method(_interface, in_signature=u"o")

1981

@dbus.service.method(_interface, in_signature="o")

1904

1982

def RemoveClient(self, object_path):

1905

1983

"D-Bus method"

1906

1984

for c in tcp_server.clients:

1948

2026

# Find out what port we got

1949

2027

service.port = tcp_server.socket.getsockname()[1]

1950

2028

if use_ipv6:

1951

logger.info(u"Now listening on address %r, port %d,"

2029

logger.info("Now listening on address %r, port %d,"

1952

2030

" flowinfo %d, scope_id %d"

1953

2031

% tcp_server.socket.getsockname())

1954

2032

else: # IPv4

1955

logger.info(u"Now listening on address %r, port %d"

2033

logger.info("Now listening on address %r, port %d"

1956

2034

% tcp_server.socket.getsockname())

1957

2035

1958

2036

#service.interface = tcp_server.socket.getsockname()[3]

1961

2039

# From the Avahi example code

1962

2040

try:

1963

2041

service.activate()

1964

except dbus.exceptions.DBusException, error:

1965

logger.critical(u"DBusException: %s", error)

2042

except dbus.exceptions.DBusException as error:

2043

logger.critical("DBusException: %s", error)

1966

2044

cleanup()

1967

2045

sys.exit(1)

1968

2046

# End of Avahi example code

1972

2050

(tcp_server.handle_request

1973

2051

(*args[2:], **kwargs) or True))

1974

2052

1975

logger.debug(u"Starting main loop")

2053

logger.debug("Starting main loop")

1976

2054

main_loop.run()

1977

except AvahiError, error:

1978

logger.critical(u"AvahiError: %s", error)

2055

except AvahiError as error:

2056

logger.critical("AvahiError: %s", error)

1979

2057

cleanup()

1980

2058

sys.exit(1)

1981

2059

except KeyboardInterrupt:

1982

2060

if debug:

1983

print >> sys.stderr

1984

logger.debug(u"Server received KeyboardInterrupt")

1985

logger.debug(u"Server exiting")

2061

print("", file=sys.stderr)

2062

logger.debug("Server received KeyboardInterrupt")

2063

logger.debug("Server exiting")

1986

2064

# Must run before the D-Bus bus name gets deregistered

1987

2065

cleanup()

1988

2066

2067

1989

2068

if __name__ == '__main__':

1990

2069

main()