/mandos/trunk : revision 502

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

81

82

SO_BINDTODEVICE = None

82

83

84

version = "1.0.14"

85

version = "1.3.1"

85

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

88

89

syslogger = (logging.handlers.SysLogHandler

89

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

90

address = "/dev/log"))

91

address = str("/dev/log")))

91

92

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

94

95

logger.addHandler(syslogger)

95

96

97

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

100

101

logger.addHandler(console)

101

102

103

class AvahiError(Exception):

119

120

Attributes:

120

121

interface: integer; avahi.IF_UNSPEC or an interface index.

121

122

Used to optionally bind to the specified interface.

122

123

type: string; Example: u'_mandos._tcp'.

123

124

type: string; Example: '_mandos._tcp'.

124

125

See <http://www.dns-sd.org/ServiceTypes.html>

125

126

port: integer; what port to announce

126

127

TXT: list of strings; TXT record for the service

135

136

"""

136

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

137

138

servicetype = None, port = None, TXT = None,

138

domain = u"", host = u"", max_renames = 32768,

139

domain = "", host = "", max_renames = 32768,

139

140

protocol = avahi.PROTO_UNSPEC, bus = None):

140

141

self.interface = interface

141

142

self.name = name

150

151

self.group = None # our entry group

151

152

self.server = None

152

153

self.bus = bus

154

self.entry_group_state_changed_match = None

153

155

def rename(self):

154

156

"""Derived from the Avahi example code"""

155

157

if self.rename_count >= self.max_renames:

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

158

logger.critical("No suitable Zeroconf service name found"

159

" after %i retries, exiting.",

158

160

self.rename_count)

159

raise AvahiServiceError(u"Too many renames")

161

raise AvahiServiceError("Too many renames")

160

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

163

logger.info("Changing Zeroconf service name to %r ...",

162

164

self.name)

163

165

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

166

168

% self.name))

167

169

self.remove()

168

self.add()

170

try:

171

self.add()

172

except dbus.exceptions.DBusException as error:

173

logger.critical("DBusException: %s", error)

174

self.cleanup()

175

os._exit(1)

169

176

self.rename_count += 1

170

177

def remove(self):

171

178

"""Derived from the Avahi example code"""

179

if self.entry_group_state_changed_match is not None:

180

self.entry_group_state_changed_match.remove()

181

self.entry_group_state_changed_match = None

172

182

if self.group is not None:

173

183

self.group.Reset()

174

184

def add(self):

175

185

"""Derived from the Avahi example code"""

186

self.remove()

176

187

if self.group is None:

177

188

self.group = dbus.Interface(

178

189

self.bus.get_object(avahi.DBUS_NAME,

179

190

self.server.EntryGroupNew()),

180

191

avahi.DBUS_INTERFACE_ENTRY_GROUP)

181

self.group.connect_to_signal('StateChanged',

182

self

183

.entry_group_state_changed)

184

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

192

self.entry_group_state_changed_match = (

193

self.group.connect_to_signal(

194

'StateChanged', self .entry_group_state_changed))

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

185

196

self.name, self.type)

186

197

self.group.AddService(

187

198

self.interface,

194

205

self.group.Commit()

195

206

def entry_group_state_changed(self, state, error):

196

207

"""Derived from the Avahi example code"""

197

logger.debug(u"Avahi state change: %i", state)

208

logger.debug("Avahi entry group state change: %i", state)

198

209

199

210

if state == avahi.ENTRY_GROUP_ESTABLISHED:

200

logger.debug(u"Zeroconf service established.")

211

logger.debug("Zeroconf service established.")

201

212

elif state == avahi.ENTRY_GROUP_COLLISION:

202

logger.warning(u"Zeroconf service name collision.")

213

logger.info("Zeroconf service name collision.")

203

214

self.rename()

204

215

elif state == avahi.ENTRY_GROUP_FAILURE:

205

logger.critical(u"Avahi: Error in group state changed %s",

216

logger.critical("Avahi: Error in group state changed %s",

206

217

unicode(error))

207

raise AvahiGroupError(u"State changed: %s"

218

raise AvahiGroupError("State changed: %s"

208

219

% unicode(error))

209

220

def cleanup(self):

210

221

"""Derived from the Avahi example code"""

211

222

if self.group is not None:

212

self.group.Free()

223

try:

224

self.group.Free()

225

except (dbus.exceptions.UnknownMethodException,

226

dbus.exceptions.DBusException) as e:

227

pass

213

228

self.group = None

214

def server_state_changed(self, state):

229

self.remove()

230

def server_state_changed(self, state, error=None):

215

231

"""Derived from the Avahi example code"""

216

if state == avahi.SERVER_COLLISION:

217

logger.error(u"Zeroconf server name collision")

218

self.remove()

232

logger.debug("Avahi server state change: %i", state)

233

bad_states = { avahi.SERVER_INVALID:

234

"Zeroconf server invalid",

235

avahi.SERVER_REGISTERING: None,

236

avahi.SERVER_COLLISION:

237

"Zeroconf server name collision",

238

avahi.SERVER_FAILURE:

239

"Zeroconf server failure" }

240

if state in bad_states:

241

if bad_states[state] is not None:

242

if error is None:

243

logger.error(bad_states[state])

244

else:

245

logger.error(bad_states[state] + ": %r", error)

246

self.cleanup()

219

247

elif state == avahi.SERVER_RUNNING:

220

248

self.add()

249

else:

250

if error is None:

251

logger.debug("Unknown state: %r", state)

252

else:

253

logger.debug("Unknown state: %r: %r", state, error)

221

254

def activate(self):

222

255

"""Derived from the Avahi example code"""

223

256

if self.server is None:

224

257

self.server = dbus.Interface(

225

258

self.bus.get_object(avahi.DBUS_NAME,

226

avahi.DBUS_PATH_SERVER),

259

avahi.DBUS_PATH_SERVER,

260

follow_name_owner_changes=True),

227

261

avahi.DBUS_INTERFACE_SERVER)

228

self.server.connect_to_signal(u"StateChanged",

262

self.server.connect_to_signal("StateChanged",

229

263

self.server_state_changed)

230

264

self.server_state_changed(self.server.GetState())

231

265

232

266

267

def _timedelta_to_milliseconds(td):

268

"Convert a datetime.timedelta() to milliseconds"

269

return ((td.days * 24 * 60 * 60 * 1000)

270

+ (td.seconds * 1000)

271

+ (td.microseconds // 1000))

272

233

273

class Client(object):

234

274

"""A representation of a client host served by this server.

235

275

236

276

Attributes:

237

238

D-Bus identifiers

277

_approved: bool(); 'None' if not yet approved/disapproved

278

approval_delay: datetime.timedelta(); Time to wait for approval

279

approval_duration: datetime.timedelta(); Duration of one approval

280

checker: subprocess.Popen(); a running checker process used

281

to see if the client lives.

282

'None' if no process is running.

283

checker_callback_tag: a gobject event source tag, or None

284

checker_command: string; External command which is run to check

285

if client lives. %() expansions are done at

286

runtime with vars(self) as dict, so that for

287

instance %(name)s can be used in the command.

288

checker_initiator_tag: a gobject event source tag, or None

289

created: datetime.datetime(); (UTC) object creation

290

current_checker_command: string; current running checker_command

291

disable_hook: If set, called by disable() as disable_hook(self)

292

disable_initiator_tag: a gobject event source tag, or None

293

enabled: bool()

239

294

fingerprint: string (40 or 32 hexadecimal digits); used to

240

295

uniquely identify the client

241

secret: bytestring; sent verbatim (over TLS) to client

242

296

host: string; available for use by the checker command

243

created: datetime.datetime(); (UTC) object creation

297

interval: datetime.timedelta(); How often to start a new checker

298

last_approval_request: datetime.datetime(); (UTC) or None

299

last_checked_ok: datetime.datetime(); (UTC) or None

244

300

last_enabled: datetime.datetime(); (UTC)

245

enabled: bool()

246

last_checked_ok: datetime.datetime(); (UTC) or None

301

302

D-Bus identifiers

303

secret: bytestring; sent verbatim (over TLS) to client

247

304

timeout: datetime.timedelta(); How long from last_checked_ok

248

305

until this client is disabled

249

interval: datetime.timedelta(); How often to start a new checker

250

disable_hook: If set, called by disable() as disable_hook(self)

251

checker: subprocess.Popen(); a running checker process used

252

to see if the client lives.

253

'None' if no process is running.

254

checker_initiator_tag: a gobject event source tag, or None

255

disable_initiator_tag: - '' -

256

checker_callback_tag: - '' -

257

checker_command: string; External command which is run to check if

258

client lives. %() expansions are done at

259

runtime with vars(self) as dict, so that for

260

instance %(name)s can be used in the command.

261

current_checker_command: string; current running checker_command

262

approved_delay: datetime.timedelta(); Time to wait for approval

263

_approved: bool(); 'None' if not yet approved/disapproved

264

approved_duration: datetime.timedelta(); Duration of one approval

306

extended_timeout: extra long timeout when password has been sent

307

runtime_expansions: Allowed attributes for runtime expansion.

308

expires: datetime.datetime(); time (UTC) when a client will be

309

disabled, or None

265

310

"""

266

311

267

@staticmethod

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

312

runtime_expansions = ("approval_delay", "approval_duration",

313

"created", "enabled", "fingerprint",

314

"host", "interval", "last_checked_ok",

315

"last_enabled", "name", "timeout")

316

274

317

def timeout_milliseconds(self):

275

318

"Return the 'timeout' attribute in milliseconds"

276

return self._timedelta_to_milliseconds(self.timeout)

319

return _timedelta_to_milliseconds(self.timeout)

320

321

def extended_timeout_milliseconds(self):

322

"Return the 'extended_timeout' attribute in milliseconds"

323

return _timedelta_to_milliseconds(self.extended_timeout)

277

324

278

325

def interval_milliseconds(self):

279

326

"Return the 'interval' attribute in milliseconds"

280

return self._timedelta_to_milliseconds(self.interval)

327

return _timedelta_to_milliseconds(self.interval)

281

328

282

def approved_delay_milliseconds(self):

283

return self._timedelta_to_milliseconds(self.approved_delay)

329

def approval_delay_milliseconds(self):

330

return _timedelta_to_milliseconds(self.approval_delay)

284

331

285

332

def __init__(self, name = None, disable_hook=None, config=None):

286

333

"""Note: the 'checker' key in 'config' sets the

289

336

self.name = name

290

337

if config is None:

291

338

config = {}

292

logger.debug(u"Creating client %r", self.name)

339

logger.debug("Creating client %r", self.name)

293

340

# Uppercase and remove spaces from fingerprint for later

294

341

# comparison purposes with return value from the fingerprint()

295

342

# function

296

self.fingerprint = (config[u"fingerprint"].upper()

297

.replace(u" ", u""))

298

logger.debug(u" Fingerprint: %s", self.fingerprint)

299

if u"secret" in config:

300

self.secret = config[u"secret"].decode(u"base64")

301

elif u"secfile" in config:

343

self.fingerprint = (config["fingerprint"].upper()

344

.replace(" ", ""))

345

logger.debug(" Fingerprint: %s", self.fingerprint)

346

if "secret" in config:

347

self.secret = config["secret"].decode("base64")

348

elif "secfile" in config:

302

349

with open(os.path.expanduser(os.path.expandvars

303

(config[u"secfile"])),

350

(config["secfile"])),

304

351

"rb") as secfile:

305

352

self.secret = secfile.read()

306

353

else:

307

raise TypeError(u"No secret or secfile for client %s"

354

raise TypeError("No secret or secfile for client %s"

308

355

% self.name)

309

self.host = config.get(u"host", u"")

356

self.host = config.get("host", "")

310

357

self.created = datetime.datetime.utcnow()

311

358

self.enabled = False

359

self.last_approval_request = None

312

360

self.last_enabled = None

313

361

self.last_checked_ok = None

314

self.timeout = string_to_delta(config[u"timeout"])

315

self.interval = string_to_delta(config[u"interval"])

362

self.timeout = string_to_delta(config["timeout"])

363

self.extended_timeout = string_to_delta(config["extended_timeout"])

364

self.interval = string_to_delta(config["interval"])

316

365

self.disable_hook = disable_hook

317

366

self.checker = None

318

367

self.checker_initiator_tag = None

319

368

self.disable_initiator_tag = None

369

self.expires = None

320

370

self.checker_callback_tag = None

321

self.checker_command = config[u"checker"]

371

self.checker_command = config["checker"]

322

372

self.current_checker_command = None

323

373

self.last_connect = None

324

374

self._approved = None

325

self.approved_by_default = config.get(u"approved_by_default",

375

self.approved_by_default = config.get("approved_by_default",

326

376

True)

327

377

self.approvals_pending = 0

328

self.approved_delay = string_to_delta(

329

config[u"approved_delay"])

330

self.approved_duration = string_to_delta(

331

config[u"approved_duration"])

378

self.approval_delay = string_to_delta(

379

config["approval_delay"])

380

self.approval_duration = string_to_delta(

381

config["approval_duration"])

332

382

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

333

383

334

384

def send_changedstate(self):

338

388

339

389

def enable(self):

340

390

"""Start this client's checker and timeout hooks"""

341

if getattr(self, u"enabled", False):

391

if getattr(self, "enabled", False):

342

392

# Already enabled

343

393

return

344

394

self.send_changedstate()

345

self.last_enabled = datetime.datetime.utcnow()

346

395

# Schedule a new checker to be started an 'interval' from now,

347

396

# and every interval from then on.

348

397

self.checker_initiator_tag = (gobject.timeout_add

349

398

(self.interval_milliseconds(),

350

399

self.start_checker))

351

400

# Schedule a disable() when 'timeout' has passed

401

self.expires = datetime.datetime.utcnow() + self.timeout

352

402

self.disable_initiator_tag = (gobject.timeout_add

353

403

(self.timeout_milliseconds(),

354

404

self.disable))

355

405

self.enabled = True

406

self.last_enabled = datetime.datetime.utcnow()

356

407

# Also start a new checker *right now*.

357

408

self.start_checker()

358

409

363

414

if not quiet:

364

415

self.send_changedstate()

365

416

if not quiet:

366

logger.info(u"Disabling client %s", self.name)

367

if getattr(self, u"disable_initiator_tag", False):

417

logger.info("Disabling client %s", self.name)

418

if getattr(self, "disable_initiator_tag", False):

368

419

gobject.source_remove(self.disable_initiator_tag)

369

420

self.disable_initiator_tag = None

370

if getattr(self, u"checker_initiator_tag", False):

421

self.expires = None

422

if getattr(self, "checker_initiator_tag", False):

371

423

gobject.source_remove(self.checker_initiator_tag)

372

424

self.checker_initiator_tag = None

373

425

self.stop_checker()

388

440

if os.WIFEXITED(condition):

389

441

exitstatus = os.WEXITSTATUS(condition)

390

442

if exitstatus == 0:

391

logger.info(u"Checker for %(name)s succeeded",

443

logger.info("Checker for %(name)s succeeded",

392

444

vars(self))

393

445

self.checked_ok()

394

446

else:

395

logger.info(u"Checker for %(name)s failed",

447

logger.info("Checker for %(name)s failed",

396

448

vars(self))

397

449

else:

398

logger.warning(u"Checker for %(name)s crashed?",

450

logger.warning("Checker for %(name)s crashed?",

399

451

vars(self))

400

452

401

def checked_ok(self):

453

def checked_ok(self, timeout=None):

402

454

"""Bump up the timeout for this client.

403

455

404

456

This should only be called when the client has been seen,

405

457

alive and well.

406

458

"""

459

if timeout is None:

460

timeout = self.timeout

407

461

self.last_checked_ok = datetime.datetime.utcnow()

408

462

gobject.source_remove(self.disable_initiator_tag)

463

self.expires = datetime.datetime.utcnow() + timeout

409

464

self.disable_initiator_tag = (gobject.timeout_add

410

(self.timeout_milliseconds(),

465

(_timedelta_to_milliseconds(timeout),

411

466

self.disable))

412

467

468

def need_approval(self):

469

self.last_approval_request = datetime.datetime.utcnow()

470

413

471

def start_checker(self):

414

472

"""Start a new checker subprocess if one is not running.

415

473

427

485

# If a checker exists, make sure it is not a zombie

428

486

try:

429

487

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

430

except (AttributeError, OSError), error:

488

except (AttributeError, OSError) as error:

431

489

if (isinstance(error, OSError)

432

490

and error.errno != errno.ECHILD):

433

491

raise error

434

492

else:

435

493

if pid:

436

logger.warning(u"Checker was a zombie")

494

logger.warning("Checker was a zombie")

437

495

gobject.source_remove(self.checker_callback_tag)

438

496

self.checker_callback(pid, status,

439

497

self.current_checker_command)

444

502

command = self.checker_command % self.host

445

503

except TypeError:

446

504

# Escape attributes for the shell

447

escaped_attrs = dict((key,

448

re.escape(unicode(str(val),

449

errors=

450

u'replace')))

451

for key, val in

452

vars(self).iteritems())

505

escaped_attrs = dict(

506

(attr,

507

re.escape(unicode(str(getattr(self, attr, "")),

508

errors=

509

'replace')))

510

for attr in

511

self.runtime_expansions)

512

453

513

try:

454

514

command = self.checker_command % escaped_attrs

455

except TypeError, error:

456

logger.error(u'Could not format string "%s":'

457

u' %s', self.checker_command, error)

515

except TypeError as error:

516

logger.error('Could not format string "%s":'

517

' %s', self.checker_command, error)

458

518

return True # Try again later

459

519

self.current_checker_command = command

460

520

try:

461

logger.info(u"Starting checker %r for %s",

521

logger.info("Starting checker %r for %s",

462

522

command, self.name)

463

523

# We don't need to redirect stdout and stderr, since

464

524

# in normal mode, that is already done by daemon(),

466

526

# always replaced by /dev/null.)

467

527

self.checker = subprocess.Popen(command,

468

528

close_fds=True,

469

shell=True, cwd=u"/")

529

shell=True, cwd="/")

470

530

self.checker_callback_tag = (gobject.child_watch_add

471

531

(self.checker.pid,

472

532

self.checker_callback,

477

537

if pid:

478

538

gobject.source_remove(self.checker_callback_tag)

479

539

self.checker_callback(pid, status, command)

480

except OSError, error:

481

logger.error(u"Failed to start subprocess: %s",

540

except OSError as error:

541

logger.error("Failed to start subprocess: %s",

482

542

error)

483

543

# Re-run this periodically if run by gobject.timeout_add

484

544

return True

488

548

if self.checker_callback_tag:

489

549

gobject.source_remove(self.checker_callback_tag)

490

550

self.checker_callback_tag = None

491

if getattr(self, u"checker", None) is None:

551

if getattr(self, "checker", None) is None:

492

552

return

493

logger.debug(u"Stopping checker for %(name)s", vars(self))

553

logger.debug("Stopping checker for %(name)s", vars(self))

494

554

try:

495

555

os.kill(self.checker.pid, signal.SIGTERM)

496

556

#time.sleep(0.5)

497

557

#if self.checker.poll() is None:

498

558

# os.kill(self.checker.pid, signal.SIGKILL)

499

except OSError, error:

559

except OSError as error:

500

560

if error.errno != errno.ESRCH: # No such process

501

561

raise

502

562

self.checker = None

503

563

504

def dbus_service_property(dbus_interface, signature=u"v",

505

access=u"readwrite", byte_arrays=False):

564

def dbus_service_property(dbus_interface, signature="v",

565

access="readwrite", byte_arrays=False):

506

566

"""Decorators for marking methods of a DBusObjectWithProperties to

507

567

become properties on the D-Bus.

508

568

515

575

"""

516

576

# Encoding deeply encoded byte arrays is not supported yet by the

517

577

# "Set" method, so we fail early here:

518

if byte_arrays and signature != u"ay":

519

raise ValueError(u"Byte arrays not supported for non-'ay'"

520

u" signature %r" % signature)

578

if byte_arrays and signature != "ay":

579

raise ValueError("Byte arrays not supported for non-'ay'"

580

" signature %r" % signature)

521

581

def decorator(func):

522

582

func._dbus_is_property = True

523

583

func._dbus_interface = dbus_interface

524

584

func._dbus_signature = signature

525

585

func._dbus_access = access

526

586

func._dbus_name = func.__name__

527

if func._dbus_name.endswith(u"_dbus_property"):

587

if func._dbus_name.endswith("_dbus_property"):

528

588

func._dbus_name = func._dbus_name[:-14]

529

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

589

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

530

590

return func

531

591

return decorator

532

592

560

620

561

621

@staticmethod

562

622

def _is_dbus_property(obj):

563

return getattr(obj, u"_dbus_is_property", False)

623

return getattr(obj, "_dbus_is_property", False)

564

624

565

625

def _get_all_dbus_properties(self):

566

626

"""Returns a generator of (name, attribute) pairs

574

634

property with the specified name and interface.

575

635

"""

576

636

for name in (property_name,

577

property_name + u"_dbus_property"):

637

property_name + "_dbus_property"):

578

638

prop = getattr(self, name, None)

579

639

if (prop is None

580

640

or not self._is_dbus_property(prop)

584

644

continue

585

645

return prop

586

646

# No such property

587

raise DBusPropertyNotFound(self.dbus_object_path + u":"

588

+ interface_name + u"."

647

raise DBusPropertyNotFound(self.dbus_object_path + ":"

648

+ interface_name + "."

589

649

+ property_name)

590

650

591

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

592

out_signature=u"v")

651

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

652

out_signature="v")

593

653

def Get(self, interface_name, property_name):

594

654

"""Standard D-Bus property Get() method, see D-Bus standard.

595

655

"""

596

656

prop = self._get_dbus_property(interface_name, property_name)

597

if prop._dbus_access == u"write":

657

if prop._dbus_access == "write":

598

658

raise DBusPropertyAccessException(property_name)

599

659

value = prop()

600

if not hasattr(value, u"variant_level"):

660

if not hasattr(value, "variant_level"):

601

661

return value

602

662

return type(value)(value, variant_level=value.variant_level+1)

603

663

604

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

664

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

605

665

def Set(self, interface_name, property_name, value):

606

666

"""Standard D-Bus property Set() method, see D-Bus standard.

607

667

"""

608

668

prop = self._get_dbus_property(interface_name, property_name)

609

if prop._dbus_access == u"read":

669

if prop._dbus_access == "read":

610

670

raise DBusPropertyAccessException(property_name)

611

if prop._dbus_get_args_options[u"byte_arrays"]:

671

if prop._dbus_get_args_options["byte_arrays"]:

612

672

# The byte_arrays option is not supported yet on

613

673

# signatures other than "ay".

614

if prop._dbus_signature != u"ay":

674

if prop._dbus_signature != "ay":

615

675

raise ValueError

616

676

value = dbus.ByteArray(''.join(unichr(byte)

617

677

for byte in value))

618

678

prop(value)

619

679

620

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

621

out_signature=u"a{sv}")

680

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

681

out_signature="a{sv}")

622

682

def GetAll(self, interface_name):

623

683

"""Standard D-Bus property GetAll() method, see D-Bus

624

684

standard.

632

692

# Interface non-empty but did not match

633

693

continue

634

694

# Ignore write-only properties

635

if prop._dbus_access == u"write":

695

if prop._dbus_access == "write":

636

696

continue

637

697

value = prop()

638

if not hasattr(value, u"variant_level"):

698

if not hasattr(value, "variant_level"):

639

699

all[name] = value

640

700

continue

641

701

all[name] = type(value)(value, variant_level=

642

702

value.variant_level+1)

643

return dbus.Dictionary(all, signature=u"sv")

703

return dbus.Dictionary(all, signature="sv")

644

704

645

705

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

646

out_signature=u"s",

706

out_signature="s",

647

707

path_keyword='object_path',

648

708

connection_keyword='connection')

649

709

def Introspect(self, object_path, connection):

654

714

try:

655

715

document = xml.dom.minidom.parseString(xmlstring)

656

716

def make_tag(document, name, prop):

657

e = document.createElement(u"property")

658

e.setAttribute(u"name", name)

659

e.setAttribute(u"type", prop._dbus_signature)

660

e.setAttribute(u"access", prop._dbus_access)

717

e = document.createElement("property")

718

e.setAttribute("name", name)

719

e.setAttribute("type", prop._dbus_signature)

720

e.setAttribute("access", prop._dbus_access)

661

721

return e

662

for if_tag in document.getElementsByTagName(u"interface"):

722

for if_tag in document.getElementsByTagName("interface"):

663

723

for tag in (make_tag(document, name, prop)

664

724

for name, prop

665

725

in self._get_all_dbus_properties()

666

726

if prop._dbus_interface

667

== if_tag.getAttribute(u"name")):

727

== if_tag.getAttribute("name")):

668

728

if_tag.appendChild(tag)

669

729

# Add the names to the return values for the

670

730

# "org.freedesktop.DBus.Properties" methods

671

if (if_tag.getAttribute(u"name")

672

== u"org.freedesktop.DBus.Properties"):

673

for cn in if_tag.getElementsByTagName(u"method"):

674

if cn.getAttribute(u"name") == u"Get":

675

for arg in cn.getElementsByTagName(u"arg"):

676

if (arg.getAttribute(u"direction")

677

== u"out"):

678

arg.setAttribute(u"name", u"value")

679

elif cn.getAttribute(u"name") == u"GetAll":

680

for arg in cn.getElementsByTagName(u"arg"):

681

if (arg.getAttribute(u"direction")

682

== u"out"):

683

arg.setAttribute(u"name", u"props")

684

xmlstring = document.toxml(u"utf-8")

731

if (if_tag.getAttribute("name")

732

== "org.freedesktop.DBus.Properties"):

733

for cn in if_tag.getElementsByTagName("method"):

734

if cn.getAttribute("name") == "Get":

735

for arg in cn.getElementsByTagName("arg"):

736

if (arg.getAttribute("direction")

737

== "out"):

738

arg.setAttribute("name", "value")

739

elif cn.getAttribute("name") == "GetAll":

740

for arg in cn.getElementsByTagName("arg"):

741

if (arg.getAttribute("direction")

742

== "out"):

743

arg.setAttribute("name", "props")

744

xmlstring = document.toxml("utf-8")

685

745

document.unlink()

686

746

except (AttributeError, xml.dom.DOMException,

687

xml.parsers.expat.ExpatError), error:

688

logger.error(u"Failed to override Introspection method",

747

xml.parsers.expat.ExpatError) as error:

748

logger.error("Failed to override Introspection method",

689

749

error)

690

750

return xmlstring

691

751

692

752

753

def datetime_to_dbus (dt, variant_level=0):

754

"""Convert a UTC datetime.datetime() to a D-Bus type."""

755

if dt is None:

756

return dbus.String("", variant_level = variant_level)

757

return dbus.String(dt.isoformat(),

758

variant_level=variant_level)

759

693

760

class ClientDBus(Client, DBusObjectWithProperties):

694

761

"""A Client class using D-Bus

695

762

697

764

dbus_object_path: dbus.ObjectPath

698

765

bus: dbus.SystemBus()

699

766

"""

767

768

runtime_expansions = (Client.runtime_expansions

769

+ ("dbus_object_path",))

770

700

771

# dbus.service.Object doesn't use super(), so we can't either.

701

772

702

773

def __init__(self, bus = None, *args, **kwargs):

705

776

Client.__init__(self, *args, **kwargs)

706

777

# Only now, when this client is initialized, can it show up on

707

778

# the D-Bus

779

client_object_name = unicode(self.name).translate(

780

{ord("."): ord("_"),

781

ord("-"): ord("_")})

708

782

self.dbus_object_path = (dbus.ObjectPath

709

(u"/clients/"

710

+ self.name.replace(u".", u"_")))

783

("/clients/" + client_object_name))

711

784

DBusObjectWithProperties.__init__(self, self.bus,

712

785

self.dbus_object_path)

713

714

def _get_approvals_pending(self):

715

return self._approvals_pending

716

def _set_approvals_pending(self, value):

717

old_value = self._approvals_pending

718

self._approvals_pending = value

719

bval = bool(value)

720

if (hasattr(self, "dbus_object_path")

721

and bval is not bool(old_value)):

722

dbus_bool = dbus.Boolean(bval, variant_level=1)

723

self.PropertyChanged(dbus.String(u"approved_pending"),

724

dbus_bool)

725

726

approvals_pending = property(_get_approvals_pending,

727

_set_approvals_pending)

728

del _get_approvals_pending, _set_approvals_pending

729

730

@staticmethod

731

def _datetime_to_dbus(dt, variant_level=0):

732

"""Convert a UTC datetime.datetime() to a D-Bus type."""

733

return dbus.String(dt.isoformat(),

734

variant_level=variant_level)

735

736

def enable(self):

737

oldstate = getattr(self, u"enabled", False)

738

r = Client.enable(self)

739

if oldstate != self.enabled:

740

# Emit D-Bus signals

741

self.PropertyChanged(dbus.String(u"enabled"),

742

dbus.Boolean(True, variant_level=1))

743

self.PropertyChanged(

744

dbus.String(u"last_enabled"),

745

self._datetime_to_dbus(self.last_enabled,

746

variant_level=1))

747

return r

748

749

def disable(self, quiet = False):

750

oldstate = getattr(self, u"enabled", False)

751

r = Client.disable(self, quiet=quiet)

752

if not quiet and oldstate != self.enabled:

753

# Emit D-Bus signal

754

self.PropertyChanged(dbus.String(u"enabled"),

755

dbus.Boolean(False, variant_level=1))

756

return r

786

787

def notifychangeproperty(transform_func,

788

dbus_name, type_func=lambda x: x,

789

variant_level=1):

790

""" Modify a variable so that its a property that announce its

791

changes to DBus.

792

transform_fun: Function that takes a value and transform it to

793

DBus type.

794

dbus_name: DBus name of the variable

795

type_func: Function that transform the value before sending it

796

to DBus

797

variant_level: DBus variant level. default: 1

798

"""

799

real_value = [None,]

800

def setter(self, value):

801

old_value = real_value[0]

802

real_value[0] = value

803

if hasattr(self, "dbus_object_path"):

804

if type_func(old_value) != type_func(real_value[0]):

805

dbus_value = transform_func(type_func(real_value[0]),

806

variant_level)

807

self.PropertyChanged(dbus.String(dbus_name),

808

dbus_value)

809

810

return property(lambda self: real_value[0], setter)

811

812

813

expires = notifychangeproperty(datetime_to_dbus, "Expires")

814

approvals_pending = notifychangeproperty(dbus.Boolean,

815

"ApprovalPending",

816

type_func = bool)

817

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

818

last_enabled = notifychangeproperty(datetime_to_dbus,

819

"LastEnabled")

820

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

821

type_func = lambda checker: checker is not None)

822

last_checked_ok = notifychangeproperty(datetime_to_dbus,

823

"LastCheckedOK")

824

last_approval_request = notifychangeproperty(datetime_to_dbus,

825

"LastApprovalRequest")

826

approved_by_default = notifychangeproperty(dbus.Boolean,

827

"ApprovedByDefault")

828

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

829

type_func = _timedelta_to_milliseconds)

830

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

831

type_func = _timedelta_to_milliseconds)

832

host = notifychangeproperty(dbus.String, "Host")

833

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

834

type_func = _timedelta_to_milliseconds)

835

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

836

type_func = _timedelta_to_milliseconds)

837

interval = notifychangeproperty(dbus.UInt16, "Interval",

838

type_func = _timedelta_to_milliseconds)

839

checker_command = notifychangeproperty(dbus.String, "Checker")

840

841

del notifychangeproperty

757

842

758

843

def __del__(self, *args, **kwargs):

759

844

try:

760

845

self.remove_from_connection()

761

846

except LookupError:

762

847

pass

763

if hasattr(DBusObjectWithProperties, u"__del__"):

848

if hasattr(DBusObjectWithProperties, "__del__"):

764

849

DBusObjectWithProperties.__del__(self, *args, **kwargs)

765

850

Client.__del__(self, *args, **kwargs)

766

851

768

853

*args, **kwargs):

769

854

self.checker_callback_tag = None

770

855

self.checker = None

771

# Emit D-Bus signal

772

self.PropertyChanged(dbus.String(u"checker_running"),

773

dbus.Boolean(False, variant_level=1))

774

856

if os.WIFEXITED(condition):

775

857

exitstatus = os.WEXITSTATUS(condition)

776

858

# Emit D-Bus signal

785

867

786

868

return Client.checker_callback(self, pid, condition, command,

787

869

*args, **kwargs)

788

789

def checked_ok(self, *args, **kwargs):

790

r = Client.checked_ok(self, *args, **kwargs)

791

# Emit D-Bus signal

792

self.PropertyChanged(

793

dbus.String(u"last_checked_ok"),

794

(self._datetime_to_dbus(self.last_checked_ok,

795

variant_level=1)))

796

return r

797

870

798

871

def start_checker(self, *args, **kwargs):

799

872

old_checker = self.checker

800

873

if self.checker is not None:

807

880

and old_checker_pid != self.checker.pid):

808

881

# Emit D-Bus signal

809

882

self.CheckerStarted(self.current_checker_command)

810

self.PropertyChanged(

811

dbus.String(u"checker_running"),

812

dbus.Boolean(True, variant_level=1))

813

883

return r

814

884

815

def stop_checker(self, *args, **kwargs):

816

old_checker = getattr(self, u"checker", None)

817

r = Client.stop_checker(self, *args, **kwargs)

818

if (old_checker is not None

819

and getattr(self, u"checker", None) is None):

820

self.PropertyChanged(dbus.String(u"checker_running"),

821

dbus.Boolean(False, variant_level=1))

822

return r

823

824

885

def _reset_approved(self):

825

886

self._approved = None

826

887

return False

828

889

def approve(self, value=True):

829

890

self.send_changedstate()

830

891

self._approved = value

831

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),

892

gobject.timeout_add(_timedelta_to_milliseconds

893

(self.approval_duration),

832

894

self._reset_approved)

833

895

834

896

835

897

## D-Bus methods, signals & properties

836

_interface = u"se.bsnet.fukt.Mandos.Client"

898

_interface = "se.bsnet.fukt.Mandos.Client"

837

899

838

900

## Signals

839

901

840

902

# CheckerCompleted - signal

841

@dbus.service.signal(_interface, signature=u"nxs")

903

@dbus.service.signal(_interface, signature="nxs")

842

904

def CheckerCompleted(self, exitcode, waitstatus, command):

843

905

"D-Bus signal"

844

906

pass

845

907

846

908

# CheckerStarted - signal

847

@dbus.service.signal(_interface, signature=u"s")

909

@dbus.service.signal(_interface, signature="s")

848

910

def CheckerStarted(self, command):

849

911

"D-Bus signal"

850

912

pass

851

913

852

914

# PropertyChanged - signal

853

@dbus.service.signal(_interface, signature=u"sv")

915

@dbus.service.signal(_interface, signature="sv")

854

916

def PropertyChanged(self, property, value):

855

917

"D-Bus signal"

856

918

pass

865

927

pass

866

928

867

929

# Rejected - signal

868

@dbus.service.signal(_interface, signature=u"s")

930

@dbus.service.signal(_interface, signature="s")

869

931

def Rejected(self, reason):

870

932

"D-Bus signal"

871

933

pass

872

934

873

935

# NeedApproval - signal

874

@dbus.service.signal(_interface, signature=u"db")

936

@dbus.service.signal(_interface, signature="tb")

875

937

def NeedApproval(self, timeout, default):

876

938

"D-Bus signal"

877

pass

939

return self.need_approval()

878

940

879

941

## Methods

880

942

881

943

# Approve - method

882

@dbus.service.method(_interface, in_signature=u"b")

944

@dbus.service.method(_interface, in_signature="b")

883

945

def Approve(self, value):

884

946

self.approve(value)

885

947

886

948

# CheckedOK - method

887

949

@dbus.service.method(_interface)

888

950

def CheckedOK(self):

889

return self.checked_ok()

951

self.checked_ok()

890

952

891

953

# Enable - method

892

954

@dbus.service.method(_interface)

913

975

914

976

## Properties

915

977

916

# approved_pending - property

917

@dbus_service_property(_interface, signature=u"b", access=u"read")

918

def approved_pending_dbus_property(self):

978

# ApprovalPending - property

979

@dbus_service_property(_interface, signature="b", access="read")

980

def ApprovalPending_dbus_property(self):

919

981

return dbus.Boolean(bool(self.approvals_pending))

920

982

921

# approved_by_default - property

922

@dbus_service_property(_interface, signature=u"b",

923

access=u"readwrite")

924

def approved_by_default_dbus_property(self):

925

return dbus.Boolean(self.approved_by_default)

926

927

# approved_delay - property

928

@dbus_service_property(_interface, signature=u"t",

929

access=u"readwrite")

930

def approved_delay_dbus_property(self):

931

return dbus.UInt64(self.approved_delay_milliseconds())

932

933

# approved_duration - property

934

@dbus_service_property(_interface, signature=u"t",

935

access=u"readwrite")

936

def approved_duration_dbus_property(self):

937

return dbus.UInt64(self._timedelta_to_milliseconds(

938

self.approved_duration))

939

940

# name - property

941

@dbus_service_property(_interface, signature=u"s", access=u"read")

942

def name_dbus_property(self):

983

# ApprovedByDefault - property

984

@dbus_service_property(_interface, signature="b",

985

access="readwrite")

986

def ApprovedByDefault_dbus_property(self, value=None):

987

if value is None: # get

988

return dbus.Boolean(self.approved_by_default)

989

self.approved_by_default = bool(value)

990

991

# ApprovalDelay - property

992

@dbus_service_property(_interface, signature="t",

993

access="readwrite")

994

def ApprovalDelay_dbus_property(self, value=None):

995

if value is None: # get

996

return dbus.UInt64(self.approval_delay_milliseconds())

997

self.approval_delay = datetime.timedelta(0, 0, 0, value)

998

999

# ApprovalDuration - property

1000

@dbus_service_property(_interface, signature="t",

1001

access="readwrite")

1002

def ApprovalDuration_dbus_property(self, value=None):

1003

if value is None: # get

1004

return dbus.UInt64(_timedelta_to_milliseconds(

1005

self.approval_duration))

1006

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1007

1008

# Name - property

1009

@dbus_service_property(_interface, signature="s", access="read")

1010

def Name_dbus_property(self):

943

1011

return dbus.String(self.name)

944

1012

945

# fingerprint - property

946

@dbus_service_property(_interface, signature=u"s", access=u"read")

947

def fingerprint_dbus_property(self):

1013

# Fingerprint - property

1014

@dbus_service_property(_interface, signature="s", access="read")

1015

def Fingerprint_dbus_property(self):

948

1016

return dbus.String(self.fingerprint)

949

1017

950

# host - property

951

@dbus_service_property(_interface, signature=u"s",

952

access=u"readwrite")

953

def host_dbus_property(self, value=None):

1018

# Host - property

1019

@dbus_service_property(_interface, signature="s",

1020

access="readwrite")

1021

def Host_dbus_property(self, value=None):

954

1022

if value is None: # get

955

1023

return dbus.String(self.host)

956

1024

self.host = value

957

# Emit D-Bus signal

958

self.PropertyChanged(dbus.String(u"host"),

959

dbus.String(value, variant_level=1))

960

961

# created - property

962

@dbus_service_property(_interface, signature=u"s", access=u"read")

963

def created_dbus_property(self):

964

return dbus.String(self._datetime_to_dbus(self.created))

965

966

# last_enabled - property

967

@dbus_service_property(_interface, signature=u"s", access=u"read")

968

def last_enabled_dbus_property(self):

969

if self.last_enabled is None:

970

return dbus.String(u"")

971

return dbus.String(self._datetime_to_dbus(self.last_enabled))

972

973

# enabled - property

974

@dbus_service_property(_interface, signature=u"b",

975

access=u"readwrite")

976

def enabled_dbus_property(self, value=None):

1025

1026

# Created - property

1027

@dbus_service_property(_interface, signature="s", access="read")

1028

def Created_dbus_property(self):

1029

return dbus.String(datetime_to_dbus(self.created))

1030

1031

# LastEnabled - property

1032

@dbus_service_property(_interface, signature="s", access="read")

1033

def LastEnabled_dbus_property(self):

1034

return datetime_to_dbus(self.last_enabled)

1035

1036

# Enabled - property

1037

@dbus_service_property(_interface, signature="b",

1038

access="readwrite")

1039

def Enabled_dbus_property(self, value=None):

977

1040

if value is None: # get

978

1041

return dbus.Boolean(self.enabled)

979

1042

if value:

981

1044

else:

982

1045

self.disable()

983

1046

984

# last_checked_ok - property

985

@dbus_service_property(_interface, signature=u"s",

986

access=u"readwrite")

987

def last_checked_ok_dbus_property(self, value=None):

1047

# LastCheckedOK - property

1048

@dbus_service_property(_interface, signature="s",

1049

access="readwrite")

1050

def LastCheckedOK_dbus_property(self, value=None):

988

1051

if value is not None:

989

1052

self.checked_ok()

990

1053

return

991

if self.last_checked_ok is None:

992

return dbus.String(u"")

993

return dbus.String(self._datetime_to_dbus(self

994

.last_checked_ok))

995

996

# timeout - property

997

@dbus_service_property(_interface, signature=u"t",

998

access=u"readwrite")

999

def timeout_dbus_property(self, value=None):

1054

return datetime_to_dbus(self.last_checked_ok)

1055

1056

# Expires - property

1057

@dbus_service_property(_interface, signature="s", access="read")

1058

def Expires_dbus_property(self):

1059

return datetime_to_dbus(self.expires)

1060

1061

# LastApprovalRequest - property

1062

@dbus_service_property(_interface, signature="s", access="read")

1063

def LastApprovalRequest_dbus_property(self):

1064

return datetime_to_dbus(self.last_approval_request)

1065

1066

# Timeout - property

1067

@dbus_service_property(_interface, signature="t",

1068

access="readwrite")

1069

def Timeout_dbus_property(self, value=None):

1000

1070

if value is None: # get

1001

1071

return dbus.UInt64(self.timeout_milliseconds())

1002

1072

self.timeout = datetime.timedelta(0, 0, 0, value)

1003

# Emit D-Bus signal

1004

self.PropertyChanged(dbus.String(u"timeout"),

1005

dbus.UInt64(value, variant_level=1))

1006

if getattr(self, u"disable_initiator_tag", None) is None:

1073

if getattr(self, "disable_initiator_tag", None) is None:

1007

1074

return

1008

1075

# Reschedule timeout

1009

1076

gobject.source_remove(self.disable_initiator_tag)

1010

1077

self.disable_initiator_tag = None

1078

self.expires = None

1011

1079

time_to_die = (self.

1012

1080

_timedelta_to_milliseconds((self

1013

1081

.last_checked_ok

1018

1086

# The timeout has passed

1019

1087

self.disable()

1020

1088

else:

1089

self.expires = (datetime.datetime.utcnow()

1090

+ datetime.timedelta(milliseconds = time_to_die))

1021

1091

self.disable_initiator_tag = (gobject.timeout_add

1022

1092

(time_to_die, self.disable))

1023

1024

# interval - property

1025

@dbus_service_property(_interface, signature=u"t",

1026

access=u"readwrite")

1027

def interval_dbus_property(self, value=None):

1093

1094

# ExtendedTimeout - property

1095

@dbus_service_property(_interface, signature="t",

1096

access="readwrite")

1097

def ExtendedTimeout_dbus_property(self, value=None):

1098

if value is None: # get

1099

return dbus.UInt64(self.extended_timeout_milliseconds())

1100

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1101

1102

# Interval - property

1103

@dbus_service_property(_interface, signature="t",

1104

access="readwrite")

1105

def Interval_dbus_property(self, value=None):

1028

1106

if value is None: # get

1029

1107

return dbus.UInt64(self.interval_milliseconds())

1030

1108

self.interval = datetime.timedelta(0, 0, 0, value)

1031

# Emit D-Bus signal

1032

self.PropertyChanged(dbus.String(u"interval"),

1033

dbus.UInt64(value, variant_level=1))

1034

if getattr(self, u"checker_initiator_tag", None) is None:

1109

if getattr(self, "checker_initiator_tag", None) is None:

1035

1110

return

1036

1111

# Reschedule checker run

1037

1112

gobject.source_remove(self.checker_initiator_tag)

1039

1114

(value, self.start_checker))

1040

1115

self.start_checker() # Start one now, too

1041

1116

1042

# checker - property

1043

@dbus_service_property(_interface, signature=u"s",

1044

access=u"readwrite")

1045

def checker_dbus_property(self, value=None):

1117

# Checker - property

1118

@dbus_service_property(_interface, signature="s",

1119

access="readwrite")

1120

def Checker_dbus_property(self, value=None):

1046

1121

if value is None: # get

1047

1122

return dbus.String(self.checker_command)

1048

1123

self.checker_command = value

1049

# Emit D-Bus signal

1050

self.PropertyChanged(dbus.String(u"checker"),

1051

dbus.String(self.checker_command,

1052

variant_level=1))

1053

1124

1054

# checker_running - property

1055

@dbus_service_property(_interface, signature=u"b",

1056

access=u"readwrite")

1057

def checker_running_dbus_property(self, value=None):

1125

# CheckerRunning - property

1126

@dbus_service_property(_interface, signature="b",

1127

access="readwrite")

1128

def CheckerRunning_dbus_property(self, value=None):

1058

1129

if value is None: # get

1059

1130

return dbus.Boolean(self.checker is not None)

1060

1131

if value:

1062

1133

else:

1063

1134

self.stop_checker()

1064

1135

1065

# object_path - property

1066

@dbus_service_property(_interface, signature=u"o", access=u"read")

1067

def object_path_dbus_property(self):

1136

# ObjectPath - property

1137

@dbus_service_property(_interface, signature="o", access="read")

1138

def ObjectPath_dbus_property(self):

1068

1139

return self.dbus_object_path # is already a dbus.ObjectPath

1069

1140

1070

# secret = property

1071

@dbus_service_property(_interface, signature=u"ay",

1072

access=u"write", byte_arrays=True)

1073

def secret_dbus_property(self, value):

1141

# Secret = property

1142

@dbus_service_property(_interface, signature="ay",

1143

access="write", byte_arrays=True)

1144

def Secret_dbus_property(self, value):

1074

1145

self.secret = str(value)

1075

1146

1076

1147

del _interface

1110

1181

1111

1182

def handle(self):

1112

1183

with contextlib.closing(self.server.child_pipe) as child_pipe:

1113

logger.info(u"TCP connection from: %s",

1184

logger.info("TCP connection from: %s",

1114

1185

unicode(self.client_address))

1115

logger.debug(u"Pipe FD: %d",

1186

logger.debug("Pipe FD: %d",

1116

1187

self.server.child_pipe.fileno())

1117

1188

1118

1189

session = (gnutls.connection

1125

1196

# no X.509 keys are added to it. Therefore, we can use it

1126

1197

# here despite using OpenPGP certificates.

1127

1198

1128

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1129

# u"+AES-256-CBC", u"+SHA1",

1130

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1131

# u"+DHE-DSS"))

1199

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1200

# "+AES-256-CBC", "+SHA1",

1201

# "+COMP-NULL", "+CTYPE-OPENPGP",

1202

# "+DHE-DSS"))

1132

1203

# Use a fallback default, since this MUST be set.

1133

1204

priority = self.server.gnutls_priority

1134

1205

if priority is None:

1135

priority = u"NORMAL"

1206

priority = "NORMAL"

1136

1207

(gnutls.library.functions

1137

1208

.gnutls_priority_set_direct(session._c_object,

1138

1209

priority, None))

1140

1211

# Start communication using the Mandos protocol

1141

1212

# Get protocol number

1142

1213

line = self.request.makefile().readline()

1143

logger.debug(u"Protocol version: %r", line)

1214

logger.debug("Protocol version: %r", line)

1144

1215

try:

1145

1216

if int(line.strip().split()[0]) > 1:

1146

1217

raise RuntimeError

1147

except (ValueError, IndexError, RuntimeError), error:

1148

logger.error(u"Unknown protocol version: %s", error)

1218

except (ValueError, IndexError, RuntimeError) as error:

1219

logger.error("Unknown protocol version: %s", error)

1149

1220

return

1150

1221

1151

1222

# Start GnuTLS connection

1152

1223

try:

1153

1224

session.handshake()

1154

except gnutls.errors.GNUTLSError, error:

1155

logger.warning(u"Handshake failed: %s", error)

1225

except gnutls.errors.GNUTLSError as error:

1226

logger.warning("Handshake failed: %s", error)

1156

1227

# Do not run session.bye() here: the session is not

1157

1228

# established. Just abandon the request.

1158

1229

return

1159

logger.debug(u"Handshake succeeded")

1230

logger.debug("Handshake succeeded")

1160

1231

1161

1232

approval_required = False

1162

1233

try:

1163

1234

try:

1164

1235

fpr = self.fingerprint(self.peer_certificate

1165

1236

(session))

1166

except (TypeError, gnutls.errors.GNUTLSError), error:

1167

logger.warning(u"Bad certificate: %s", error)

1237

except (TypeError,

1238

gnutls.errors.GNUTLSError) as error:

1239

logger.warning("Bad certificate: %s", error)

1168

1240

return

1169

logger.debug(u"Fingerprint: %s", fpr)

1241

logger.debug("Fingerprint: %s", fpr)

1170

1242

1171

1243

try:

1172

1244

client = ProxyClient(child_pipe, fpr,

1174

1246

except KeyError:

1175

1247

return

1176

1248

1177

if client.approved_delay:

1178

delay = client.approved_delay

1249

if client.approval_delay:

1250

delay = client.approval_delay

1179

1251

client.approvals_pending += 1

1180

1252

approval_required = True

1181

1253

1182

1254

while True:

1183

1255

if not client.enabled:

1184

logger.warning(u"Client %s is disabled",

1256

logger.info("Client %s is disabled",

1185

1257

client.name)

1186

1258

if self.server.use_dbus:

1187

1259

# Emit D-Bus signal

1188

1260

client.Rejected("Disabled")

1189

1261

return

1190

1262

1191

if client._approved or not client.approved_delay:

1263

if client._approved or not client.approval_delay:

1192

1264

#We are approved or approval is disabled

1193

1265

break

1194

1266

elif client._approved is None:

1195

logger.info(u"Client %s need approval",

1267

logger.info("Client %s needs approval",

1196

1268

client.name)

1197

1269

if self.server.use_dbus:

1198

1270

# Emit D-Bus signal

1199

1271

client.NeedApproval(

1200

client.approved_delay_milliseconds(),

1272

client.approval_delay_milliseconds(),

1201

1273

client.approved_by_default)

1202

1274

else:

1203

logger.warning(u"Client %s was not approved",

1275

logger.warning("Client %s was not approved",

1204

1276

client.name)

1205

1277

if self.server.use_dbus:

1206

1278

# Emit D-Bus signal

1207

client.Rejected("Disapproved")

1279

client.Rejected("Denied")

1208

1280

return

1209

1281

1210

1282

#wait until timeout or approved

1221

1293

client.name)

1222

1294

if self.server.use_dbus:

1223

1295

# Emit D-Bus signal

1224

client.Rejected("Time out")

1296

client.Rejected("Approval timed out")

1225

1297

return

1226

1298

else:

1227

1299

break

1232

1304

while sent_size < len(client.secret):

1233

1305

try:

1234

1306

sent = session.send(client.secret[sent_size:])

1235

except (gnutls.errors.GNUTLSError), error:

1307

except gnutls.errors.GNUTLSError as error:

1236

1308

logger.warning("gnutls send failed")

1237

1309

return

1238

logger.debug(u"Sent: %d, remaining: %d",

1310

logger.debug("Sent: %d, remaining: %d",

1239

1311

sent, len(client.secret)

1240

1312

- (sent_size + sent))

1241

1313

sent_size += sent

1242

1314

1243

logger.info(u"Sending secret to %s", client.name)

1315

logger.info("Sending secret to %s", client.name)

1244

1316

# bump the timeout as if seen

1245

client.checked_ok()

1317

client.checked_ok(client.extended_timeout)

1246

1318

if self.server.use_dbus:

1247

1319

# Emit D-Bus signal

1248

1320

client.GotSecret()

1252

1324

client.approvals_pending -= 1

1253

1325

try:

1254

1326

session.bye()

1255

except (gnutls.errors.GNUTLSError), error:

1256

logger.warning("gnutls bye failed")

1327

except gnutls.errors.GNUTLSError as error:

1328

logger.warning("GnuTLS bye failed")

1257

1329

1258

1330

@staticmethod

1259

1331

def peer_certificate(session):

1269

1341

.gnutls_certificate_get_peers

1270

1342

(session._c_object, ctypes.byref(list_size)))

1271

1343

if not bool(cert_list) and list_size.value != 0:

1272

raise gnutls.errors.GNUTLSError(u"error getting peer"

1273

u" certificate")

1344

raise gnutls.errors.GNUTLSError("error getting peer"

1345

" certificate")

1274

1346

if list_size.value == 0:

1275

1347

return None

1276

1348

cert = cert_list[0]

1302

1374

if crtverify.value != 0:

1303

1375

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1304

1376

raise (gnutls.errors.CertificateSecurityError

1305

(u"Verify failed"))

1377

("Verify failed"))

1306

1378

# New buffer for the fingerprint

1307

1379

buf = ctypes.create_string_buffer(20)

1308

1380

buf_len = ctypes.c_size_t()

1315

1387

# Convert the buffer to a Python bytestring

1316

1388

fpr = ctypes.string_at(buf, buf_len.value)

1317

1389

# Convert the bytestring to hexadecimal notation

1318

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1390

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1319

1391

return hex_fpr

1320

1392

1321

1393

1349

1421

1350

1422

def add_pipe(self, parent_pipe):

1351

1423

"""Dummy function; override as necessary"""

1352

pass

1424

raise NotImplementedError

1353

1425

1354

1426

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1355

1427

socketserver.TCPServer, object):

1373

1445

bind to an address or port if they were not specified."""

1374

1446

if self.interface is not None:

1375

1447

if SO_BINDTODEVICE is None:

1376

logger.error(u"SO_BINDTODEVICE does not exist;"

1377

u" cannot bind to interface %s",

1448

logger.error("SO_BINDTODEVICE does not exist;"

1449

" cannot bind to interface %s",

1378

1450

self.interface)

1379

1451

else:

1380

1452

try:

1381

1453

self.socket.setsockopt(socket.SOL_SOCKET,

1382

1454

SO_BINDTODEVICE,

1383

1455

str(self.interface

1384

+ u'\0'))

1385

except socket.error, error:

1456

+ '\0'))

1457

except socket.error as error:

1386

1458

if error[0] == errno.EPERM:

1387

logger.error(u"No permission to"

1388

u" bind to interface %s",

1459

logger.error("No permission to"

1460

" bind to interface %s",

1389

1461

self.interface)

1390

1462

elif error[0] == errno.ENOPROTOOPT:

1391

logger.error(u"SO_BINDTODEVICE not available;"

1392

u" cannot bind to interface %s",

1463

logger.error("SO_BINDTODEVICE not available;"

1464

" cannot bind to interface %s",

1393

1465

self.interface)

1394

1466

else:

1395

1467

raise

1397

1469

if self.server_address[0] or self.server_address[1]:

1398

1470

if not self.server_address[0]:

1399

1471

if self.address_family == socket.AF_INET6:

1400

any_address = u"::" # in6addr_any

1472

any_address = "::" # in6addr_any

1401

1473

else:

1402

1474

any_address = socket.INADDR_ANY

1403

1475

self.server_address = (any_address,

1452

1524

def handle_ipc(self, source, condition, parent_pipe=None,

1453

1525

client_object=None):

1454

1526

condition_names = {

1455

gobject.IO_IN: u"IN", # There is data to read.

1456

gobject.IO_OUT: u"OUT", # Data can be written (without

1527

gobject.IO_IN: "IN", # There is data to read.

1528

gobject.IO_OUT: "OUT", # Data can be written (without

1457

1529

# blocking).

1458

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1459

gobject.IO_ERR: u"ERR", # Error condition.

1460

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1530

gobject.IO_PRI: "PRI", # There is urgent data to read.

1531

gobject.IO_ERR: "ERR", # Error condition.

1532

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1461

1533

# broken, usually for pipes and

1462

1534

# sockets).

1463

1535

}

1465

1537

for cond, name in

1466

1538

condition_names.iteritems()

1467

1539

if cond & condition)

1468

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1469

conditions_string)

1470

1471

1540

# error or the other end of multiprocessing.Pipe has closed

1472

1541

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1473

1542

return False

1474

1543

1475

1544

# Read a request from the child

1476

1545

request = parent_pipe.recv()

1477

logger.debug(u"IPC request: %s", repr(request))

1478

1546

command = request[0]

1479

1547

1480

1548

if command == 'init':

1486

1554

client = c

1487

1555

break

1488

1556

else:

1489

logger.warning(u"Client not found for fingerprint: %s, ad"

1490

u"dress: %s", fpr, address)

1557

logger.info("Client not found for fingerprint: %s, ad"

1558

"dress: %s", fpr, address)

1491

1559

if self.use_dbus:

1492

1560

# Emit D-Bus signal

1493

mandos_dbus_service.ClientNotFound(fpr, address)

1561

mandos_dbus_service.ClientNotFound(fpr, address[0])

1494

1562

parent_pipe.send(False)

1495

1563

return False

1496

1564

1527

1595

def string_to_delta(interval):

1528

1596

"""Parse a string and return a datetime.timedelta

1529

1597

1530

>>> string_to_delta(u'7d')

1598

>>> string_to_delta('7d')

1531

1599

datetime.timedelta(7)

1532

>>> string_to_delta(u'60s')

1600

>>> string_to_delta('60s')

1533

1601

datetime.timedelta(0, 60)

1534

>>> string_to_delta(u'60m')

1602

>>> string_to_delta('60m')

1535

1603

datetime.timedelta(0, 3600)

1536

>>> string_to_delta(u'24h')

1604

>>> string_to_delta('24h')

1537

1605

datetime.timedelta(1)

1538

>>> string_to_delta(u'1w')

1606

>>> string_to_delta('1w')

1539

1607

datetime.timedelta(7)

1540

>>> string_to_delta(u'5m 30s')

1608

>>> string_to_delta('5m 30s')

1541

1609

datetime.timedelta(0, 330)

1542

1610

"""

1543

1611

timevalue = datetime.timedelta(0)

1545

1613

try:

1546

1614

suffix = unicode(s[-1])

1547

1615

value = int(s[:-1])

1548

if suffix == u"d":

1616

if suffix == "d":

1549

1617

delta = datetime.timedelta(value)

1550

elif suffix == u"s":

1618

elif suffix == "s":

1551

1619

delta = datetime.timedelta(0, value)

1552

elif suffix == u"m":

1620

elif suffix == "m":

1553

1621

delta = datetime.timedelta(0, 0, 0, 0, value)

1554

elif suffix == u"h":

1622

elif suffix == "h":

1555

1623

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1556

elif suffix == u"w":

1624

elif suffix == "w":

1557

1625

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1558

1626

else:

1559

raise ValueError(u"Unknown suffix %r" % suffix)

1560

except (ValueError, IndexError), e:

1561

raise ValueError(e.message)

1627

raise ValueError("Unknown suffix %r" % suffix)

1628

except (ValueError, IndexError) as e:

1629

raise ValueError(*(e.args))

1562

1630

timevalue += delta

1563

1631

return timevalue

1564

1632

1570

1638

global if_nametoindex

1571

1639

try:

1572

1640

if_nametoindex = (ctypes.cdll.LoadLibrary

1573

(ctypes.util.find_library(u"c"))

1641

(ctypes.util.find_library("c"))

1574

1642

.if_nametoindex)

1575

1643

except (OSError, AttributeError):

1576

logger.warning(u"Doing if_nametoindex the hard way")

1644

logger.warning("Doing if_nametoindex the hard way")

1577

1645

def if_nametoindex(interface):

1578

1646

"Get an interface index the hard way, i.e. using fcntl()"

1579

1647

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1580

1648

with contextlib.closing(socket.socket()) as s:

1581

1649

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1582

struct.pack(str(u"16s16x"),

1650

struct.pack(str("16s16x"),

1583

1651

interface))

1584

interface_index = struct.unpack(str(u"I"),

1652

interface_index = struct.unpack(str("I"),

1585

1653

ifreq[16:20])[0]

1586

1654

return interface_index

1587

1655

return if_nametoindex(interface)

1595

1663

sys.exit()

1596

1664

os.setsid()

1597

1665

if not nochdir:

1598

os.chdir(u"/")

1666

os.chdir("/")

1599

1667

if os.fork():

1600

1668

sys.exit()

1601

1669

if not noclose:

1603

1671

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1604

1672

if not stat.S_ISCHR(os.fstat(null).st_mode):

1605

1673

raise OSError(errno.ENODEV,

1606

u"%s not a character device"

1674

"%s not a character device"

1607

1675

% os.path.devnull)

1608

1676

os.dup2(null, sys.stdin.fileno())

1609

1677

os.dup2(null, sys.stdout.fileno())

1617

1685

##################################################################

1618

1686

# Parsing of options, both command line and config file

1619

1687

1620

parser = optparse.OptionParser(version = "%%prog %s" % version)

1621

parser.add_option("-i", u"--interface", type=u"string",

1622

metavar="IF", help=u"Bind to interface IF")

1623

parser.add_option("-a", u"--address", type=u"string",

1624

help=u"Address to listen for requests on")

1625

parser.add_option("-p", u"--port", type=u"int",

1626

help=u"Port number to receive requests on")

1627

parser.add_option("--check", action=u"store_true",

1628

help=u"Run self-test")

1629

parser.add_option("--debug", action=u"store_true",

1630

help=u"Debug mode; run in foreground and log to"

1631

u" terminal")

1632

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1633

help=u"Debug level for stdout output")

1634

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1635

u" priority string (see GnuTLS documentation)")

1636

parser.add_option("--servicename", type=u"string",

1637

metavar=u"NAME", help=u"Zeroconf service name")

1638

parser.add_option("--configdir", type=u"string",

1639

default=u"/etc/mandos", metavar=u"DIR",

1640

help=u"Directory to search for configuration"

1641

u" files")

1642

parser.add_option("--no-dbus", action=u"store_false",

1643

dest=u"use_dbus", help=u"Do not provide D-Bus"

1644

u" system bus interface")

1645

parser.add_option("--no-ipv6", action=u"store_false",

1646

dest=u"use_ipv6", help=u"Do not use IPv6")

1647

options = parser.parse_args()[0]

1688

parser = argparse.ArgumentParser()

1689

parser.add_argument("-v", "--version", action="version",

1690

version = "%%(prog)s %s" % version,

1691

help="show version number and exit")

1692

parser.add_argument("-i", "--interface", metavar="IF",

1693

help="Bind to interface IF")

1694

parser.add_argument("-a", "--address",

1695

help="Address to listen for requests on")

1696

parser.add_argument("-p", "--port", type=int,

1697

help="Port number to receive requests on")

1698

parser.add_argument("--check", action="store_true",

1699

help="Run self-test")

1700

parser.add_argument("--debug", action="store_true",

1701

help="Debug mode; run in foreground and log"

1702

" to terminal")

1703

parser.add_argument("--debuglevel", metavar="LEVEL",

1704

help="Debug level for stdout output")

1705

parser.add_argument("--priority", help="GnuTLS"

1706

" priority string (see GnuTLS documentation)")

1707

parser.add_argument("--servicename",

1708

metavar="NAME", help="Zeroconf service name")

1709

parser.add_argument("--configdir",

1710

default="/etc/mandos", metavar="DIR",

1711

help="Directory to search for configuration"

1712

" files")

1713

parser.add_argument("--no-dbus", action="store_false",

1714

dest="use_dbus", help="Do not provide D-Bus"

1715

" system bus interface")

1716

parser.add_argument("--no-ipv6", action="store_false",

1717

dest="use_ipv6", help="Do not use IPv6")

1718

options = parser.parse_args()

1648

1719

1649

1720

if options.check:

1650

1721

import doctest

1652

1723

sys.exit()

1653

1724

1654

1725

# Default values for config file for server-global settings

1655

server_defaults = { u"interface": u"",

1656

u"address": u"",

1657

u"port": u"",

1658

u"debug": u"False",

1659

u"priority":

1660

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1661

u"servicename": u"Mandos",

1662

u"use_dbus": u"True",

1663

u"use_ipv6": u"True",

1664

u"debuglevel": u"",

1726

server_defaults = { "interface": "",

1727

"address": "",

1728

"port": "",

1729

"debug": "False",

1730

"priority":

1731

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1732

"servicename": "Mandos",

1733

"use_dbus": "True",

1734

"use_ipv6": "True",

1735

"debuglevel": "",

1665

1736

}

1666

1737

1667

1738

# Parse config file for server-global settings

1668

1739

server_config = configparser.SafeConfigParser(server_defaults)

1669

1740

del server_defaults

1670

1741

server_config.read(os.path.join(options.configdir,

1671

u"mandos.conf"))

1742

"mandos.conf"))

1672

1743

# Convert the SafeConfigParser object to a dict

1673

1744

server_settings = server_config.defaults()

1674

1745

# Use the appropriate methods on the non-string config options

1675

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1676

server_settings[option] = server_config.getboolean(u"DEFAULT",

1746

for option in ("debug", "use_dbus", "use_ipv6"):

1747

server_settings[option] = server_config.getboolean("DEFAULT",

1677

1748

option)

1678

1749

if server_settings["port"]:

1679

server_settings["port"] = server_config.getint(u"DEFAULT",

1680

u"port")

1750

server_settings["port"] = server_config.getint("DEFAULT",

1751

"port")

1681

1752

del server_config

1682

1753

1683

1754

# Override the settings from the config file with command line

1684

1755

# options, if set.

1685

for option in (u"interface", u"address", u"port", u"debug",

1686

u"priority", u"servicename", u"configdir",

1687

u"use_dbus", u"use_ipv6", u"debuglevel"):

1756

for option in ("interface", "address", "port", "debug",

1757

"priority", "servicename", "configdir",

1758

"use_dbus", "use_ipv6", "debuglevel"):

1688

1759

value = getattr(options, option)

1689

1760

if value is not None:

1690

1761

server_settings[option] = value

1698

1769

##################################################################

1699

1770

1700

1771

# For convenience

1701

debug = server_settings[u"debug"]

1702

debuglevel = server_settings[u"debuglevel"]

1703

use_dbus = server_settings[u"use_dbus"]

1704

use_ipv6 = server_settings[u"use_ipv6"]

1772

debug = server_settings["debug"]

1773

debuglevel = server_settings["debuglevel"]

1774

use_dbus = server_settings["use_dbus"]

1775

use_ipv6 = server_settings["use_ipv6"]

1705

1776

1706

if server_settings[u"servicename"] != u"Mandos":

1777

if server_settings["servicename"] != "Mandos":

1707

1778

syslogger.setFormatter(logging.Formatter

1708

(u'Mandos (%s) [%%(process)d]:'

1709

u' %%(levelname)s: %%(message)s'

1710

% server_settings[u"servicename"]))

1779

('Mandos (%s) [%%(process)d]:'

1780

' %%(levelname)s: %%(message)s'

1781

% server_settings["servicename"]))

1711

1782

1712

1783

# Parse config file with clients

1713

client_defaults = { u"timeout": u"1h",

1714

u"interval": u"5m",

1715

u"checker": u"fping -q -- %%(host)s",

1716

u"host": u"",

1717

u"approved_delay": u"0s",

1718

u"approved_duration": u"1s",

1784

client_defaults = { "timeout": "5m",

1785

"extended_timeout": "15m",

1786

"interval": "2m",

1787

"checker": "fping -q -- %%(host)s",

1788

"host": "",

1789

"approval_delay": "0s",

1790

"approval_duration": "1s",

1719

1791

}

1720

1792

client_config = configparser.SafeConfigParser(client_defaults)

1721

client_config.read(os.path.join(server_settings[u"configdir"],

1722

u"clients.conf"))

1793

client_config.read(os.path.join(server_settings["configdir"],

1794

"clients.conf"))

1723

1795

1724

1796

global mandos_dbus_service

1725

1797

mandos_dbus_service = None

1726

1798

1727

tcp_server = MandosServer((server_settings[u"address"],

1728

server_settings[u"port"]),

1799

tcp_server = MandosServer((server_settings["address"],

1800

server_settings["port"]),

1729

1801

ClientHandler,

1730

interface=server_settings[u"interface"],

1802

interface=(server_settings["interface"]

1803

or None),

1731

1804

use_ipv6=use_ipv6,

1732

1805

gnutls_priority=

1733

server_settings[u"priority"],

1806

server_settings["priority"],

1734

1807

use_dbus=use_dbus)

1735

pidfilename = u"/var/run/mandos.pid"

1736

try:

1737

pidfile = open(pidfilename, u"w")

1738

except IOError:

1739

logger.error(u"Could not open file %r", pidfilename)

1808

if not debug:

1809

pidfilename = "/var/run/mandos.pid"

1810

try:

1811

pidfile = open(pidfilename, "w")

1812

except IOError:

1813

logger.error("Could not open file %r", pidfilename)

1740

1814

1741

1815

try:

1742

uid = pwd.getpwnam(u"_mandos").pw_uid

1743

gid = pwd.getpwnam(u"_mandos").pw_gid

1816

uid = pwd.getpwnam("_mandos").pw_uid

1817

gid = pwd.getpwnam("_mandos").pw_gid

1744

1818

except KeyError:

1745

1819

try:

1746

uid = pwd.getpwnam(u"mandos").pw_uid

1747

gid = pwd.getpwnam(u"mandos").pw_gid

1820

uid = pwd.getpwnam("mandos").pw_uid

1821

gid = pwd.getpwnam("mandos").pw_gid

1748

1822

except KeyError:

1749

1823

try:

1750

uid = pwd.getpwnam(u"nobody").pw_uid

1751

gid = pwd.getpwnam(u"nobody").pw_gid

1824

uid = pwd.getpwnam("nobody").pw_uid

1825

gid = pwd.getpwnam("nobody").pw_gid

1752

1826

except KeyError:

1753

1827

uid = 65534

1754

1828

gid = 65534

1755

1829

try:

1756

1830

os.setgid(gid)

1757

1831

os.setuid(uid)

1758

except OSError, error:

1832

except OSError as error:

1759

1833

if error[0] != errno.EPERM:

1760

1834

raise error

1761

1835

1762

# Enable all possible GnuTLS debugging

1763

1764

1765

1836

if not debug and not debuglevel:

1766

1837

syslogger.setLevel(logging.WARNING)

1767

1838

console.setLevel(logging.WARNING)

1771

1842

console.setLevel(level)

1772

1843

1773

1844

if debug:

1845

# Enable all possible GnuTLS debugging

1846

1774

1847

# "Use a log level over 10 to enable all debugging options."

1775

1848

# - GnuTLS manual

1776

1849

gnutls.library.functions.gnutls_global_set_log_level(11)

1777

1850

1778

1851

@gnutls.library.types.gnutls_log_func

1779

1852

def debug_gnutls(level, string):

1780

logger.debug(u"GnuTLS: %s", string[:-1])

1853

logger.debug("GnuTLS: %s", string[:-1])

1781

1854

1782

1855

(gnutls.library.functions

1783

1856

.gnutls_global_set_log_function(debug_gnutls))

1784

1857

1785

1858

# Redirect stdin so all checkers get /dev/null

1786

1859

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1787

1860

os.dup2(null, sys.stdin.fileno())

1790

1863

else:

1791

1864

# No console logging

1792

1865

logger.removeHandler(console)

1793

1866

1867

# Need to fork before connecting to D-Bus

1868

if not debug:

1869

# Close all input and output, do double fork, etc.

1870

daemon()

1794

1871

1795

1872

global main_loop

1796

1873

# From the Avahi example code

1800

1877

# End of Avahi example code

1801

1878

if use_dbus:

1802

1879

try:

1803

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1880

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1804

1881

bus, do_not_queue=True)

1805

except dbus.exceptions.NameExistsException, e:

1806

logger.error(unicode(e) + u", disabling D-Bus")

1882

except dbus.exceptions.NameExistsException as e:

1883

logger.error(unicode(e) + ", disabling D-Bus")

1807

1884

use_dbus = False

1808

server_settings[u"use_dbus"] = False

1885

server_settings["use_dbus"] = False

1809

1886

tcp_server.use_dbus = False

1810

1887

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1811

service = AvahiService(name = server_settings[u"servicename"],

1812

servicetype = u"_mandos._tcp",

1888

service = AvahiService(name = server_settings["servicename"],

1889

servicetype = "_mandos._tcp",

1813

1890

protocol = protocol, bus = bus)

1814

1891

if server_settings["interface"]:

1815

1892

service.interface = (if_nametoindex

1816

(str(server_settings[u"interface"])))

1817

1818

if not debug:

1819

# Close all input and output, do double fork, etc.

1820

daemon()

1821

1893

(str(server_settings["interface"])))

1894

1822

1895

global multiprocessing_manager

1823

1896

multiprocessing_manager = multiprocessing.Manager()

1824

1897

1843

1916

client_config, section)))

1844

1917

for section in client_config.sections()))

1845

1918

if not tcp_server.clients:

1846

logger.warning(u"No clients defined")

1919

logger.warning("No clients defined")

1847

1920

1848

try:

1849

with pidfile:

1850

pid = os.getpid()

1851

pidfile.write(str(pid) + "\n")

1852

del pidfile

1853

except IOError:

1854

logger.error(u"Could not write to file %r with PID %d",

1855

pidfilename, pid)

1856

except NameError:

1857

# "pidfile" was never created

1858

pass

1859

del pidfilename

1860

1861

1921

if not debug:

1922

try:

1923

with pidfile:

1924

pid = os.getpid()

1925

pidfile.write(str(pid) + "\n".encode("utf-8"))

1926

del pidfile

1927

except IOError:

1928

logger.error("Could not write to file %r with PID %d",

1929

pidfilename, pid)

1930

except NameError:

1931

# "pidfile" was never created

1932

pass

1933

del pidfilename

1934

1862

1935

signal.signal(signal.SIGINT, signal.SIG_IGN)

1936

1863

1937

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1864

1938

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1865

1939

1867

1941

class MandosDBusService(dbus.service.Object):

1868

1942

"""A D-Bus proxy object"""

1869

1943

def __init__(self):

1870

dbus.service.Object.__init__(self, bus, u"/")

1871

_interface = u"se.bsnet.fukt.Mandos"

1944

dbus.service.Object.__init__(self, bus, "/")

1945

_interface = "se.bsnet.fukt.Mandos"

1872

1946

1873

@dbus.service.signal(_interface, signature=u"o")

1947

@dbus.service.signal(_interface, signature="o")

1874

1948

def ClientAdded(self, objpath):

1875

1949

"D-Bus signal"

1876

1950

pass

1877

1951

1878

@dbus.service.signal(_interface, signature=u"ss")

1952

@dbus.service.signal(_interface, signature="ss")

1879

1953

def ClientNotFound(self, fingerprint, address):

1880

1954

"D-Bus signal"

1881

1955

pass

1882

1956

1883

@dbus.service.signal(_interface, signature=u"os")

1957

@dbus.service.signal(_interface, signature="os")

1884

1958

def ClientRemoved(self, objpath, name):

1885

1959

"D-Bus signal"

1886

1960

pass

1887

1961

1888

@dbus.service.method(_interface, out_signature=u"ao")

1962

@dbus.service.method(_interface, out_signature="ao")

1889

1963

def GetAllClients(self):

1890

1964

"D-Bus method"

1891

1965

return dbus.Array(c.dbus_object_path

1892

1966

for c in tcp_server.clients)

1893

1967

1894

1968

@dbus.service.method(_interface,

1895

out_signature=u"a{oa{sv}}")

1969

out_signature="a{oa{sv}}")

1896

1970

def GetAllClientsWithProperties(self):

1897

1971

"D-Bus method"

1898

1972

return dbus.Dictionary(

1899

((c.dbus_object_path, c.GetAll(u""))

1973

((c.dbus_object_path, c.GetAll(""))

1900

1974

for c in tcp_server.clients),

1901

signature=u"oa{sv}")

1975

signature="oa{sv}")

1902

1976

1903

@dbus.service.method(_interface, in_signature=u"o")

1977

@dbus.service.method(_interface, in_signature="o")

1904

1978

def RemoveClient(self, object_path):

1905

1979

"D-Bus method"

1906

1980

for c in tcp_server.clients:

1948

2022

# Find out what port we got

1949

2023

service.port = tcp_server.socket.getsockname()[1]

1950

2024

if use_ipv6:

1951

logger.info(u"Now listening on address %r, port %d,"

2025

logger.info("Now listening on address %r, port %d,"

1952

2026

" flowinfo %d, scope_id %d"

1953

2027

% tcp_server.socket.getsockname())

1954

2028

else: # IPv4

1955

logger.info(u"Now listening on address %r, port %d"

2029

logger.info("Now listening on address %r, port %d"

1956

2030

% tcp_server.socket.getsockname())

1957

2031

1958

2032

#service.interface = tcp_server.socket.getsockname()[3]

1961

2035

# From the Avahi example code

1962

2036

try:

1963

2037

service.activate()

1964

except dbus.exceptions.DBusException, error:

1965

logger.critical(u"DBusException: %s", error)

2038

except dbus.exceptions.DBusException as error:

2039

logger.critical("DBusException: %s", error)

1966

2040

cleanup()

1967

2041

sys.exit(1)

1968

2042

# End of Avahi example code

1972

2046

(tcp_server.handle_request

1973

2047

(*args[2:], **kwargs) or True))

1974

2048

1975

logger.debug(u"Starting main loop")

2049

logger.debug("Starting main loop")

1976

2050

main_loop.run()

1977

except AvahiError, error:

1978

logger.critical(u"AvahiError: %s", error)

2051

except AvahiError as error:

2052

logger.critical("AvahiError: %s", error)

1979

2053

cleanup()

1980

2054

sys.exit(1)

1981

2055

except KeyboardInterrupt:

1982

2056

if debug:

1983

print >> sys.stderr

1984

logger.debug(u"Server received KeyboardInterrupt")

1985

logger.debug(u"Server exiting")

2057

print("", file=sys.stderr)

2058

logger.debug("Server received KeyboardInterrupt")

2059

logger.debug("Server exiting")

1986

2060

# Must run before the D-Bus bus name gets deregistered

1987

2061

cleanup()

1988

2062