/mandos/trunk : revision 502

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

31

# Contact the authors at <mandos@fukt.bsnet.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

81

82

SO_BINDTODEVICE = None

82

83

84

version = "1.0.14"

85

version = "1.3.1"

85

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

87

#logger = logging.getLogger('mandos')

88

logger = logging.Logger('mandos')

88

89

syslogger = (logging.handlers.SysLogHandler

89

90

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

90

address = "/dev/log"))

91

address = str("/dev/log")))

91

92

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

93

('Mandos [%(process)d]: %(levelname)s:'

94

' %(message)s'))

94

95

logger.addHandler(syslogger)

95

96

97

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

98

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

99

' %(levelname)s:'

100

' %(message)s'))

100

101

logger.addHandler(console)

101

102

103

class AvahiError(Exception):

119

120

Attributes:

120

121

interface: integer; avahi.IF_UNSPEC or an interface index.

121

122

Used to optionally bind to the specified interface.

122

123

type: string; Example: u'_mandos._tcp'.

123

124

type: string; Example: '_mandos._tcp'.

124

125

See <http://www.dns-sd.org/ServiceTypes.html>

125

126

port: integer; what port to announce

126

127

TXT: list of strings; TXT record for the service

135

136

"""

136

137

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

137

138

servicetype = None, port = None, TXT = None,

138

domain = u"", host = u"", max_renames = 32768,

139

domain = "", host = "", max_renames = 32768,

139

140

protocol = avahi.PROTO_UNSPEC, bus = None):

140

141

self.interface = interface

141

142

self.name = name

150

151

self.group = None # our entry group

151

152

self.server = None

152

153

self.bus = bus

154

self.entry_group_state_changed_match = None

153

155

def rename(self):

154

156

"""Derived from the Avahi example code"""

155

157

if self.rename_count >= self.max_renames:

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

158

logger.critical("No suitable Zeroconf service name found"

159

" after %i retries, exiting.",

158

160

self.rename_count)

159

raise AvahiServiceError(u"Too many renames")

161

raise AvahiServiceError("Too many renames")

160

162

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

163

logger.info("Changing Zeroconf service name to %r ...",

162

164

self.name)

163

165

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

166

('Mandos (%s) [%%(process)d]:'

167

' %%(levelname)s: %%(message)s'

166

168

% self.name))

167

169

self.remove()

168

self.add()

170

try:

171

self.add()

172

except dbus.exceptions.DBusException as error:

173

logger.critical("DBusException: %s", error)

174

self.cleanup()

175

os._exit(1)

169

176

self.rename_count += 1

170

177

def remove(self):

171

178

"""Derived from the Avahi example code"""

179

if self.entry_group_state_changed_match is not None:

180

self.entry_group_state_changed_match.remove()

181

self.entry_group_state_changed_match = None

172

182

if self.group is not None:

173

183

self.group.Reset()

174

184

def add(self):

175

185

"""Derived from the Avahi example code"""

186

self.remove()

176

187

if self.group is None:

177

188

self.group = dbus.Interface(

178

189

self.bus.get_object(avahi.DBUS_NAME,

179

190

self.server.EntryGroupNew()),

180

191

avahi.DBUS_INTERFACE_ENTRY_GROUP)

181

self.group.connect_to_signal('StateChanged',

182

self

183

.entry_group_state_changed)

184

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

192

self.entry_group_state_changed_match = (

193

self.group.connect_to_signal(

194

'StateChanged', self .entry_group_state_changed))

195

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

185

196

self.name, self.type)

186

197

self.group.AddService(

187

198

self.interface,

194

205

self.group.Commit()

195

206

def entry_group_state_changed(self, state, error):

196

207

"""Derived from the Avahi example code"""

197

logger.debug(u"Avahi entry group state change: %i", state)

208

logger.debug("Avahi entry group state change: %i", state)

198

209

199

210

if state == avahi.ENTRY_GROUP_ESTABLISHED:

200

logger.debug(u"Zeroconf service established.")

211

logger.debug("Zeroconf service established.")

201

212

elif state == avahi.ENTRY_GROUP_COLLISION:

202

logger.warning(u"Zeroconf service name collision.")

213

logger.info("Zeroconf service name collision.")

203

214

self.rename()

204

215

elif state == avahi.ENTRY_GROUP_FAILURE:

205

logger.critical(u"Avahi: Error in group state changed %s",

216

logger.critical("Avahi: Error in group state changed %s",

206

217

unicode(error))

207

raise AvahiGroupError(u"State changed: %s"

218

raise AvahiGroupError("State changed: %s"

208

219

% unicode(error))

209

220

def cleanup(self):

210

221

"""Derived from the Avahi example code"""

211

222

if self.group is not None:

212

self.group.Free()

223

try:

224

self.group.Free()

225

except (dbus.exceptions.UnknownMethodException,

226

dbus.exceptions.DBusException) as e:

227

pass

213

228

self.group = None

214

def server_state_changed(self, state):

229

self.remove()

230

def server_state_changed(self, state, error=None):

215

231

"""Derived from the Avahi example code"""

216

logger.debug(u"Avahi server state change: %i", state)

217

if state == avahi.SERVER_COLLISION:

218

logger.error(u"Zeroconf server name collision")

219

self.remove()

232

logger.debug("Avahi server state change: %i", state)

233

bad_states = { avahi.SERVER_INVALID:

234

"Zeroconf server invalid",

235

avahi.SERVER_REGISTERING: None,

236

avahi.SERVER_COLLISION:

237

"Zeroconf server name collision",

238

avahi.SERVER_FAILURE:

239

"Zeroconf server failure" }

240

if state in bad_states:

241

if bad_states[state] is not None:

242

if error is None:

243

logger.error(bad_states[state])

244

else:

245

logger.error(bad_states[state] + ": %r", error)

246

self.cleanup()

220

247

elif state == avahi.SERVER_RUNNING:

221

248

self.add()

249

else:

250

if error is None:

251

logger.debug("Unknown state: %r", state)

252

else:

253

logger.debug("Unknown state: %r: %r", state, error)

222

254

def activate(self):

223

255

"""Derived from the Avahi example code"""

224

256

if self.server is None:

225

257

self.server = dbus.Interface(

226

258

self.bus.get_object(avahi.DBUS_NAME,

227

avahi.DBUS_PATH_SERVER),

259

avahi.DBUS_PATH_SERVER,

260

follow_name_owner_changes=True),

228

261

avahi.DBUS_INTERFACE_SERVER)

229

self.server.connect_to_signal(u"StateChanged",

262

self.server.connect_to_signal("StateChanged",

230

263

self.server_state_changed)

231

264

self.server_state_changed(self.server.GetState())

232

265

233

266

267

def _timedelta_to_milliseconds(td):

268

"Convert a datetime.timedelta() to milliseconds"

269

return ((td.days * 24 * 60 * 60 * 1000)

270

+ (td.seconds * 1000)

271

+ (td.microseconds // 1000))

272

234

273

class Client(object):

235

274

"""A representation of a client host served by this server.

236

275

237

276

Attributes:

238

239

D-Bus identifiers

277

_approved: bool(); 'None' if not yet approved/disapproved

278

approval_delay: datetime.timedelta(); Time to wait for approval

279

approval_duration: datetime.timedelta(); Duration of one approval

280

checker: subprocess.Popen(); a running checker process used

281

to see if the client lives.

282

'None' if no process is running.

283

checker_callback_tag: a gobject event source tag, or None

284

checker_command: string; External command which is run to check

285

if client lives. %() expansions are done at

286

runtime with vars(self) as dict, so that for

287

instance %(name)s can be used in the command.

288

checker_initiator_tag: a gobject event source tag, or None

289

created: datetime.datetime(); (UTC) object creation

290

current_checker_command: string; current running checker_command

291

disable_hook: If set, called by disable() as disable_hook(self)

292

disable_initiator_tag: a gobject event source tag, or None

293

enabled: bool()

240

294

fingerprint: string (40 or 32 hexadecimal digits); used to

241

295

uniquely identify the client

242

secret: bytestring; sent verbatim (over TLS) to client

243

296

host: string; available for use by the checker command

244

created: datetime.datetime(); (UTC) object creation

297

interval: datetime.timedelta(); How often to start a new checker

298

last_approval_request: datetime.datetime(); (UTC) or None

299

last_checked_ok: datetime.datetime(); (UTC) or None

245

300

last_enabled: datetime.datetime(); (UTC)

246

enabled: bool()

247

last_checked_ok: datetime.datetime(); (UTC) or None

301

302

D-Bus identifiers

303

secret: bytestring; sent verbatim (over TLS) to client

248

304

timeout: datetime.timedelta(); How long from last_checked_ok

249

305

until this client is disabled

250

interval: datetime.timedelta(); How often to start a new checker

251

disable_hook: If set, called by disable() as disable_hook(self)

252

checker: subprocess.Popen(); a running checker process used

253

to see if the client lives.

254

'None' if no process is running.

255

checker_initiator_tag: a gobject event source tag, or None

256

disable_initiator_tag: - '' -

257

checker_callback_tag: - '' -

258

checker_command: string; External command which is run to check if

259

client lives. %() expansions are done at

260

runtime with vars(self) as dict, so that for

261

instance %(name)s can be used in the command.

262

current_checker_command: string; current running checker_command

263

approved_delay: datetime.timedelta(); Time to wait for approval

264

_approved: bool(); 'None' if not yet approved/disapproved

265

approved_duration: datetime.timedelta(); Duration of one approval

306

extended_timeout: extra long timeout when password has been sent

307

runtime_expansions: Allowed attributes for runtime expansion.

308

expires: datetime.datetime(); time (UTC) when a client will be

309

disabled, or None

266

310

"""

267

311

268

@staticmethod

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

274

312

runtime_expansions = ("approval_delay", "approval_duration",

313

"created", "enabled", "fingerprint",

314

"host", "interval", "last_checked_ok",

315

"last_enabled", "name", "timeout")

316

275

317

def timeout_milliseconds(self):

276

318

"Return the 'timeout' attribute in milliseconds"

277

return self._timedelta_to_milliseconds(self.timeout)

319

return _timedelta_to_milliseconds(self.timeout)

320

321

def extended_timeout_milliseconds(self):

322

"Return the 'extended_timeout' attribute in milliseconds"

323

return _timedelta_to_milliseconds(self.extended_timeout)

278

324

279

325

def interval_milliseconds(self):

280

326

"Return the 'interval' attribute in milliseconds"

281

return self._timedelta_to_milliseconds(self.interval)

327

return _timedelta_to_milliseconds(self.interval)

282

328

283

def approved_delay_milliseconds(self):

284

return self._timedelta_to_milliseconds(self.approved_delay)

329

def approval_delay_milliseconds(self):

330

return _timedelta_to_milliseconds(self.approval_delay)

285

331

286

332

def __init__(self, name = None, disable_hook=None, config=None):

287

333

"""Note: the 'checker' key in 'config' sets the

290

336

self.name = name

291

337

if config is None:

292

338

config = {}

293

logger.debug(u"Creating client %r", self.name)

339

logger.debug("Creating client %r", self.name)

294

340

# Uppercase and remove spaces from fingerprint for later

295

341

# comparison purposes with return value from the fingerprint()

296

342

# function

297

self.fingerprint = (config[u"fingerprint"].upper()

298

.replace(u" ", u""))

299

logger.debug(u" Fingerprint: %s", self.fingerprint)

300

if u"secret" in config:

301

self.secret = config[u"secret"].decode(u"base64")

302

elif u"secfile" in config:

343

self.fingerprint = (config["fingerprint"].upper()

344

.replace(" ", ""))

345

logger.debug(" Fingerprint: %s", self.fingerprint)

346

if "secret" in config:

347

self.secret = config["secret"].decode("base64")

348

elif "secfile" in config:

303

349

with open(os.path.expanduser(os.path.expandvars

304

(config[u"secfile"])),

350

(config["secfile"])),

305

351

"rb") as secfile:

306

352

self.secret = secfile.read()

307

353

else:

308

raise TypeError(u"No secret or secfile for client %s"

354

raise TypeError("No secret or secfile for client %s"

309

355

% self.name)

310

self.host = config.get(u"host", u"")

356

self.host = config.get("host", "")

311

357

self.created = datetime.datetime.utcnow()

312

358

self.enabled = False

359

self.last_approval_request = None

313

360

self.last_enabled = None

314

361

self.last_checked_ok = None

315

self.timeout = string_to_delta(config[u"timeout"])

316

self.interval = string_to_delta(config[u"interval"])

362

self.timeout = string_to_delta(config["timeout"])

363

self.extended_timeout = string_to_delta(config["extended_timeout"])

364

self.interval = string_to_delta(config["interval"])

317

365

self.disable_hook = disable_hook

318

366

self.checker = None

319

367

self.checker_initiator_tag = None

320

368

self.disable_initiator_tag = None

369

self.expires = None

321

370

self.checker_callback_tag = None

322

self.checker_command = config[u"checker"]

371

self.checker_command = config["checker"]

323

372

self.current_checker_command = None

324

373

self.last_connect = None

325

374

self._approved = None

326

self.approved_by_default = config.get(u"approved_by_default",

375

self.approved_by_default = config.get("approved_by_default",

327

376

True)

328

377

self.approvals_pending = 0

329

self.approved_delay = string_to_delta(

330

config[u"approved_delay"])

331

self.approved_duration = string_to_delta(

332

config[u"approved_duration"])

378

self.approval_delay = string_to_delta(

379

config["approval_delay"])

380

self.approval_duration = string_to_delta(

381

config["approval_duration"])

333

382

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

334

383

335

384

def send_changedstate(self):

339

388

340

389

def enable(self):

341

390

"""Start this client's checker and timeout hooks"""

342

if getattr(self, u"enabled", False):

391

if getattr(self, "enabled", False):

343

392

# Already enabled

344

393

return

345

394

self.send_changedstate()

346

self.last_enabled = datetime.datetime.utcnow()

347

395

# Schedule a new checker to be started an 'interval' from now,

348

396

# and every interval from then on.

349

397

self.checker_initiator_tag = (gobject.timeout_add

350

398

(self.interval_milliseconds(),

351

399

self.start_checker))

352

400

# Schedule a disable() when 'timeout' has passed

401

self.expires = datetime.datetime.utcnow() + self.timeout

353

402

self.disable_initiator_tag = (gobject.timeout_add

354

403

(self.timeout_milliseconds(),

355

404

self.disable))

356

405

self.enabled = True

406

self.last_enabled = datetime.datetime.utcnow()

357

407

# Also start a new checker *right now*.

358

408

self.start_checker()

359

409

364

414

if not quiet:

365

415

self.send_changedstate()

366

416

if not quiet:

367

logger.info(u"Disabling client %s", self.name)

368

if getattr(self, u"disable_initiator_tag", False):

417

logger.info("Disabling client %s", self.name)

418

if getattr(self, "disable_initiator_tag", False):

369

419

gobject.source_remove(self.disable_initiator_tag)

370

420

self.disable_initiator_tag = None

371

if getattr(self, u"checker_initiator_tag", False):

421

self.expires = None

422

if getattr(self, "checker_initiator_tag", False):

372

423

gobject.source_remove(self.checker_initiator_tag)

373

424

self.checker_initiator_tag = None

374

425

self.stop_checker()

389

440

if os.WIFEXITED(condition):

390

441

exitstatus = os.WEXITSTATUS(condition)

391

442

if exitstatus == 0:

392

logger.info(u"Checker for %(name)s succeeded",

443

logger.info("Checker for %(name)s succeeded",

393

444

vars(self))

394

445

self.checked_ok()

395

446

else:

396

logger.info(u"Checker for %(name)s failed",

447

logger.info("Checker for %(name)s failed",

397

448

vars(self))

398

449

else:

399

logger.warning(u"Checker for %(name)s crashed?",

450

logger.warning("Checker for %(name)s crashed?",

400

451

vars(self))

401

452

402

def checked_ok(self):

453

def checked_ok(self, timeout=None):

403

454

"""Bump up the timeout for this client.

404

455

405

456

This should only be called when the client has been seen,

406

457

alive and well.

407

458

"""

459

if timeout is None:

460

timeout = self.timeout

408

461

self.last_checked_ok = datetime.datetime.utcnow()

409

462

gobject.source_remove(self.disable_initiator_tag)

463

self.expires = datetime.datetime.utcnow() + timeout

410

464

self.disable_initiator_tag = (gobject.timeout_add

411

(self.timeout_milliseconds(),

465

(_timedelta_to_milliseconds(timeout),

412

466

self.disable))

413

467

468

def need_approval(self):

469

self.last_approval_request = datetime.datetime.utcnow()

470

414

471

def start_checker(self):

415

472

"""Start a new checker subprocess if one is not running.

416

473

428

485

# If a checker exists, make sure it is not a zombie

429

486

try:

430

487

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

431

except (AttributeError, OSError), error:

488

except (AttributeError, OSError) as error:

432

489

if (isinstance(error, OSError)

433

490

and error.errno != errno.ECHILD):

434

491

raise error

435

492

else:

436

493

if pid:

437

logger.warning(u"Checker was a zombie")

494

logger.warning("Checker was a zombie")

438

495

gobject.source_remove(self.checker_callback_tag)

439

496

self.checker_callback(pid, status,

440

497

self.current_checker_command)

445

502

command = self.checker_command % self.host

446

503

except TypeError:

447

504

# Escape attributes for the shell

448

escaped_attrs = dict((key,

449

re.escape(unicode(str(val),

450

errors=

451

u'replace')))

452

for key, val in

453

vars(self).iteritems())

505

escaped_attrs = dict(

506

(attr,

507

re.escape(unicode(str(getattr(self, attr, "")),

508

errors=

509

'replace')))

510

for attr in

511

self.runtime_expansions)

512

454

513

try:

455

514

command = self.checker_command % escaped_attrs

456

except TypeError, error:

457

logger.error(u'Could not format string "%s":'

458

u' %s', self.checker_command, error)

515

except TypeError as error:

516

logger.error('Could not format string "%s":'

517

' %s', self.checker_command, error)

459

518

return True # Try again later

460

519

self.current_checker_command = command

461

520

try:

462

logger.info(u"Starting checker %r for %s",

521

logger.info("Starting checker %r for %s",

463

522

command, self.name)

464

523

# We don't need to redirect stdout and stderr, since

465

524

# in normal mode, that is already done by daemon(),

467

526

# always replaced by /dev/null.)

468

527

self.checker = subprocess.Popen(command,

469

528

close_fds=True,

470

shell=True, cwd=u"/")

529

shell=True, cwd="/")

471

530

self.checker_callback_tag = (gobject.child_watch_add

472

531

(self.checker.pid,

473

532

self.checker_callback,

478

537

if pid:

479

538

gobject.source_remove(self.checker_callback_tag)

480

539

self.checker_callback(pid, status, command)

481

except OSError, error:

482

logger.error(u"Failed to start subprocess: %s",

540

except OSError as error:

541

logger.error("Failed to start subprocess: %s",

483

542

error)

484

543

# Re-run this periodically if run by gobject.timeout_add

485

544

return True

489

548

if self.checker_callback_tag:

490

549

gobject.source_remove(self.checker_callback_tag)

491

550

self.checker_callback_tag = None

492

if getattr(self, u"checker", None) is None:

551

if getattr(self, "checker", None) is None:

493

552

return

494

logger.debug(u"Stopping checker for %(name)s", vars(self))

553

logger.debug("Stopping checker for %(name)s", vars(self))

495

554

try:

496

555

os.kill(self.checker.pid, signal.SIGTERM)

497

556

#time.sleep(0.5)

498

557

#if self.checker.poll() is None:

499

558

# os.kill(self.checker.pid, signal.SIGKILL)

500

except OSError, error:

559

except OSError as error:

501

560

if error.errno != errno.ESRCH: # No such process

502

561

raise

503

562

self.checker = None

504

563

505

def dbus_service_property(dbus_interface, signature=u"v",

506

access=u"readwrite", byte_arrays=False):

564

def dbus_service_property(dbus_interface, signature="v",

565

access="readwrite", byte_arrays=False):

507

566

"""Decorators for marking methods of a DBusObjectWithProperties to

508

567

become properties on the D-Bus.

509

568

516

575

"""

517

576

# Encoding deeply encoded byte arrays is not supported yet by the

518

577

# "Set" method, so we fail early here:

519

if byte_arrays and signature != u"ay":

520

raise ValueError(u"Byte arrays not supported for non-'ay'"

521

u" signature %r" % signature)

578

if byte_arrays and signature != "ay":

579

raise ValueError("Byte arrays not supported for non-'ay'"

580

" signature %r" % signature)

522

581

def decorator(func):

523

582

func._dbus_is_property = True

524

583

func._dbus_interface = dbus_interface

525

584

func._dbus_signature = signature

526

585

func._dbus_access = access

527

586

func._dbus_name = func.__name__

528

if func._dbus_name.endswith(u"_dbus_property"):

587

if func._dbus_name.endswith("_dbus_property"):

529

588

func._dbus_name = func._dbus_name[:-14]

530

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

589

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

531

590

return func

532

591

return decorator

533

592

561

620

562

621

@staticmethod

563

622

def _is_dbus_property(obj):

564

return getattr(obj, u"_dbus_is_property", False)

623

return getattr(obj, "_dbus_is_property", False)

565

624

566

625

def _get_all_dbus_properties(self):

567

626

"""Returns a generator of (name, attribute) pairs

575

634

property with the specified name and interface.

576

635

"""

577

636

for name in (property_name,

578

property_name + u"_dbus_property"):

637

property_name + "_dbus_property"):

579

638

prop = getattr(self, name, None)

580

639

if (prop is None

581

640

or not self._is_dbus_property(prop)

585

644

continue

586

645

return prop

587

646

# No such property

588

raise DBusPropertyNotFound(self.dbus_object_path + u":"

589

+ interface_name + u"."

647

raise DBusPropertyNotFound(self.dbus_object_path + ":"

648

+ interface_name + "."

590

649

+ property_name)

591

650

592

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

593

out_signature=u"v")

651

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

652

out_signature="v")

594

653

def Get(self, interface_name, property_name):

595

654

"""Standard D-Bus property Get() method, see D-Bus standard.

596

655

"""

597

656

prop = self._get_dbus_property(interface_name, property_name)

598

if prop._dbus_access == u"write":

657

if prop._dbus_access == "write":

599

658

raise DBusPropertyAccessException(property_name)

600

659

value = prop()

601

if not hasattr(value, u"variant_level"):

660

if not hasattr(value, "variant_level"):

602

661

return value

603

662

return type(value)(value, variant_level=value.variant_level+1)

604

663

605

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

664

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

606

665

def Set(self, interface_name, property_name, value):

607

666

"""Standard D-Bus property Set() method, see D-Bus standard.

608

667

"""

609

668

prop = self._get_dbus_property(interface_name, property_name)

610

if prop._dbus_access == u"read":

669

if prop._dbus_access == "read":

611

670

raise DBusPropertyAccessException(property_name)

612

if prop._dbus_get_args_options[u"byte_arrays"]:

671

if prop._dbus_get_args_options["byte_arrays"]:

613

672

# The byte_arrays option is not supported yet on

614

673

# signatures other than "ay".

615

if prop._dbus_signature != u"ay":

674

if prop._dbus_signature != "ay":

616

675

raise ValueError

617

676

value = dbus.ByteArray(''.join(unichr(byte)

618

677

for byte in value))

619

678

prop(value)

620

679

621

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

622

out_signature=u"a{sv}")

680

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

681

out_signature="a{sv}")

623

682

def GetAll(self, interface_name):

624

683

"""Standard D-Bus property GetAll() method, see D-Bus

625

684

standard.

633

692

# Interface non-empty but did not match

634

693

continue

635

694

# Ignore write-only properties

636

if prop._dbus_access == u"write":

695

if prop._dbus_access == "write":

637

696

continue

638

697

value = prop()

639

if not hasattr(value, u"variant_level"):

698

if not hasattr(value, "variant_level"):

640

699

all[name] = value

641

700

continue

642

701

all[name] = type(value)(value, variant_level=

643

702

value.variant_level+1)

644

return dbus.Dictionary(all, signature=u"sv")

703

return dbus.Dictionary(all, signature="sv")

645

704

646

705

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

647

out_signature=u"s",

706

out_signature="s",

648

707

path_keyword='object_path',

649

708

connection_keyword='connection')

650

709

def Introspect(self, object_path, connection):

655

714

try:

656

715

document = xml.dom.minidom.parseString(xmlstring)

657

716

def make_tag(document, name, prop):

658

e = document.createElement(u"property")

659

e.setAttribute(u"name", name)

660

e.setAttribute(u"type", prop._dbus_signature)

661

e.setAttribute(u"access", prop._dbus_access)

717

e = document.createElement("property")

718

e.setAttribute("name", name)

719

e.setAttribute("type", prop._dbus_signature)

720

e.setAttribute("access", prop._dbus_access)

662

721

return e

663

for if_tag in document.getElementsByTagName(u"interface"):

722

for if_tag in document.getElementsByTagName("interface"):

664

723

for tag in (make_tag(document, name, prop)

665

724

for name, prop

666

725

in self._get_all_dbus_properties()

667

726

if prop._dbus_interface

668

== if_tag.getAttribute(u"name")):

727

== if_tag.getAttribute("name")):

669

728

if_tag.appendChild(tag)

670

729

# Add the names to the return values for the

671

730

# "org.freedesktop.DBus.Properties" methods

672

if (if_tag.getAttribute(u"name")

673

== u"org.freedesktop.DBus.Properties"):

674

for cn in if_tag.getElementsByTagName(u"method"):

675

if cn.getAttribute(u"name") == u"Get":

676

for arg in cn.getElementsByTagName(u"arg"):

677

if (arg.getAttribute(u"direction")

678

== u"out"):

679

arg.setAttribute(u"name", u"value")

680

elif cn.getAttribute(u"name") == u"GetAll":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"props")

685

xmlstring = document.toxml(u"utf-8")

731

if (if_tag.getAttribute("name")

732

== "org.freedesktop.DBus.Properties"):

733

for cn in if_tag.getElementsByTagName("method"):

734

if cn.getAttribute("name") == "Get":

735

for arg in cn.getElementsByTagName("arg"):

736

if (arg.getAttribute("direction")

737

== "out"):

738

arg.setAttribute("name", "value")

739

elif cn.getAttribute("name") == "GetAll":

740

for arg in cn.getElementsByTagName("arg"):

741

if (arg.getAttribute("direction")

742

== "out"):

743

arg.setAttribute("name", "props")

744

xmlstring = document.toxml("utf-8")

686

745

document.unlink()

687

746

except (AttributeError, xml.dom.DOMException,

688

xml.parsers.expat.ExpatError), error:

689

logger.error(u"Failed to override Introspection method",

747

xml.parsers.expat.ExpatError) as error:

748

logger.error("Failed to override Introspection method",

690

749

error)

691

750

return xmlstring

692

751

693

752

753

def datetime_to_dbus (dt, variant_level=0):

754

"""Convert a UTC datetime.datetime() to a D-Bus type."""

755

if dt is None:

756

return dbus.String("", variant_level = variant_level)

757

return dbus.String(dt.isoformat(),

758

variant_level=variant_level)

759

694

760

class ClientDBus(Client, DBusObjectWithProperties):

695

761

"""A Client class using D-Bus

696

762

698

764

dbus_object_path: dbus.ObjectPath

699

765

bus: dbus.SystemBus()

700

766

"""

767

768

runtime_expansions = (Client.runtime_expansions

769

+ ("dbus_object_path",))

770

701

771

# dbus.service.Object doesn't use super(), so we can't either.

702

772

703

773

def __init__(self, bus = None, *args, **kwargs):

706

776

Client.__init__(self, *args, **kwargs)

707

777

# Only now, when this client is initialized, can it show up on

708

778

# the D-Bus

779

client_object_name = unicode(self.name).translate(

780

{ord("."): ord("_"),

781

ord("-"): ord("_")})

709

782

self.dbus_object_path = (dbus.ObjectPath

710

(u"/clients/"

711

+ self.name.replace(u".", u"_")))

783

("/clients/" + client_object_name))

712

784

DBusObjectWithProperties.__init__(self, self.bus,

713

785

self.dbus_object_path)

714

715

def _get_approvals_pending(self):

716

return self._approvals_pending

717

def _set_approvals_pending(self, value):

718

old_value = self._approvals_pending

719

self._approvals_pending = value

720

bval = bool(value)

721

if (hasattr(self, "dbus_object_path")

722

and bval is not bool(old_value)):

723

dbus_bool = dbus.Boolean(bval, variant_level=1)

724

self.PropertyChanged(dbus.String(u"approved_pending"),

725

dbus_bool)

726

727

approvals_pending = property(_get_approvals_pending,

728

_set_approvals_pending)

729

del _get_approvals_pending, _set_approvals_pending

730

731

@staticmethod

732

def _datetime_to_dbus(dt, variant_level=0):

733

"""Convert a UTC datetime.datetime() to a D-Bus type."""

734

return dbus.String(dt.isoformat(),

735

variant_level=variant_level)

736

737

def enable(self):

738

oldstate = getattr(self, u"enabled", False)

739

r = Client.enable(self)

740

if oldstate != self.enabled:

741

# Emit D-Bus signals

742

self.PropertyChanged(dbus.String(u"enabled"),

743

dbus.Boolean(True, variant_level=1))

744

self.PropertyChanged(

745

dbus.String(u"last_enabled"),

746

self._datetime_to_dbus(self.last_enabled,

747

variant_level=1))

748

return r

749

750

def disable(self, quiet = False):

751

oldstate = getattr(self, u"enabled", False)

752

r = Client.disable(self, quiet=quiet)

753

if not quiet and oldstate != self.enabled:

754

# Emit D-Bus signal

755

self.PropertyChanged(dbus.String(u"enabled"),

756

dbus.Boolean(False, variant_level=1))

757

return r

786

787

def notifychangeproperty(transform_func,

788

dbus_name, type_func=lambda x: x,

789

variant_level=1):

790

""" Modify a variable so that its a property that announce its

791

changes to DBus.

792

transform_fun: Function that takes a value and transform it to

793

DBus type.

794

dbus_name: DBus name of the variable

795

type_func: Function that transform the value before sending it

796

to DBus

797

variant_level: DBus variant level. default: 1

798

"""

799

real_value = [None,]

800

def setter(self, value):

801

old_value = real_value[0]

802

real_value[0] = value

803

if hasattr(self, "dbus_object_path"):

804

if type_func(old_value) != type_func(real_value[0]):

805

dbus_value = transform_func(type_func(real_value[0]),

806

variant_level)

807

self.PropertyChanged(dbus.String(dbus_name),

808

dbus_value)

809

810

return property(lambda self: real_value[0], setter)

811

812

813

expires = notifychangeproperty(datetime_to_dbus, "Expires")

814

approvals_pending = notifychangeproperty(dbus.Boolean,

815

"ApprovalPending",

816

type_func = bool)

817

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

818

last_enabled = notifychangeproperty(datetime_to_dbus,

819

"LastEnabled")

820

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

821

type_func = lambda checker: checker is not None)

822

last_checked_ok = notifychangeproperty(datetime_to_dbus,

823

"LastCheckedOK")

824

last_approval_request = notifychangeproperty(datetime_to_dbus,

825

"LastApprovalRequest")

826

approved_by_default = notifychangeproperty(dbus.Boolean,

827

"ApprovedByDefault")

828

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

829

type_func = _timedelta_to_milliseconds)

830

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

831

type_func = _timedelta_to_milliseconds)

832

host = notifychangeproperty(dbus.String, "Host")

833

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

834

type_func = _timedelta_to_milliseconds)

835

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

836

type_func = _timedelta_to_milliseconds)

837

interval = notifychangeproperty(dbus.UInt16, "Interval",

838

type_func = _timedelta_to_milliseconds)

839

checker_command = notifychangeproperty(dbus.String, "Checker")

840

841

del notifychangeproperty

758

842

759

843

def __del__(self, *args, **kwargs):

760

844

try:

761

845

self.remove_from_connection()

762

846

except LookupError:

763

847

pass

764

if hasattr(DBusObjectWithProperties, u"__del__"):

848

if hasattr(DBusObjectWithProperties, "__del__"):

765

849

DBusObjectWithProperties.__del__(self, *args, **kwargs)

766

850

Client.__del__(self, *args, **kwargs)

767

851

769

853

*args, **kwargs):

770

854

self.checker_callback_tag = None

771

855

self.checker = None

772

# Emit D-Bus signal

773

self.PropertyChanged(dbus.String(u"checker_running"),

774

dbus.Boolean(False, variant_level=1))

775

856

if os.WIFEXITED(condition):

776

857

exitstatus = os.WEXITSTATUS(condition)

777

858

# Emit D-Bus signal

786

867

787

868

return Client.checker_callback(self, pid, condition, command,

788

869

*args, **kwargs)

789

790

def checked_ok(self, *args, **kwargs):

791

r = Client.checked_ok(self, *args, **kwargs)

792

# Emit D-Bus signal

793

self.PropertyChanged(

794

dbus.String(u"last_checked_ok"),

795

(self._datetime_to_dbus(self.last_checked_ok,

796

variant_level=1)))

797

return r

798

870

799

871

def start_checker(self, *args, **kwargs):

800

872

old_checker = self.checker

801

873

if self.checker is not None:

808

880

and old_checker_pid != self.checker.pid):

809

881

# Emit D-Bus signal

810

882

self.CheckerStarted(self.current_checker_command)

811

self.PropertyChanged(

812

dbus.String(u"checker_running"),

813

dbus.Boolean(True, variant_level=1))

814

883

return r

815

884

816

def stop_checker(self, *args, **kwargs):

817

old_checker = getattr(self, u"checker", None)

818

r = Client.stop_checker(self, *args, **kwargs)

819

if (old_checker is not None

820

and getattr(self, u"checker", None) is None):

821

self.PropertyChanged(dbus.String(u"checker_running"),

822

dbus.Boolean(False, variant_level=1))

823

return r

824

825

885

def _reset_approved(self):

826

886

self._approved = None

827

887

return False

829

889

def approve(self, value=True):

830

890

self.send_changedstate()

831

891

self._approved = value

832

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),

892

gobject.timeout_add(_timedelta_to_milliseconds

893

(self.approval_duration),

833

894

self._reset_approved)

834

895

835

896

836

897

## D-Bus methods, signals & properties

837

_interface = u"se.bsnet.fukt.Mandos.Client"

898

_interface = "se.bsnet.fukt.Mandos.Client"

838

899

839

900

## Signals

840

901

841

902

# CheckerCompleted - signal

842

@dbus.service.signal(_interface, signature=u"nxs")

903

@dbus.service.signal(_interface, signature="nxs")

843

904

def CheckerCompleted(self, exitcode, waitstatus, command):

844

905

"D-Bus signal"

845

906

pass

846

907

847

908

# CheckerStarted - signal

848

@dbus.service.signal(_interface, signature=u"s")

909

@dbus.service.signal(_interface, signature="s")

849

910

def CheckerStarted(self, command):

850

911

"D-Bus signal"

851

912

pass

852

913

853

914

# PropertyChanged - signal

854

@dbus.service.signal(_interface, signature=u"sv")

915

@dbus.service.signal(_interface, signature="sv")

855

916

def PropertyChanged(self, property, value):

856

917

"D-Bus signal"

857

918

pass

866

927

pass

867

928

868

929

# Rejected - signal

869

@dbus.service.signal(_interface, signature=u"s")

930

@dbus.service.signal(_interface, signature="s")

870

931

def Rejected(self, reason):

871

932

"D-Bus signal"

872

933

pass

873

934

874

935

# NeedApproval - signal

875

@dbus.service.signal(_interface, signature=u"db")

936

@dbus.service.signal(_interface, signature="tb")

876

937

def NeedApproval(self, timeout, default):

877

938

"D-Bus signal"

878

pass

939

return self.need_approval()

879

940

880

941

## Methods

881

942

882

943

# Approve - method

883

@dbus.service.method(_interface, in_signature=u"b")

944

@dbus.service.method(_interface, in_signature="b")

884

945

def Approve(self, value):

885

946

self.approve(value)

886

947

887

948

# CheckedOK - method

888

949

@dbus.service.method(_interface)

889

950

def CheckedOK(self):

890

return self.checked_ok()

951

self.checked_ok()

891

952

892

953

# Enable - method

893

954

@dbus.service.method(_interface)

914

975

915

976

## Properties

916

977

917

# approved_pending - property

918

@dbus_service_property(_interface, signature=u"b", access=u"read")

919

def approved_pending_dbus_property(self):

978

# ApprovalPending - property

979

@dbus_service_property(_interface, signature="b", access="read")

980

def ApprovalPending_dbus_property(self):

920

981

return dbus.Boolean(bool(self.approvals_pending))

921

982

922

# approved_by_default - property

923

@dbus_service_property(_interface, signature=u"b",

924

access=u"readwrite")

925

def approved_by_default_dbus_property(self):

926

return dbus.Boolean(self.approved_by_default)

927

928

# approved_delay - property

929

@dbus_service_property(_interface, signature=u"t",

930

access=u"readwrite")

931

def approved_delay_dbus_property(self):

932

return dbus.UInt64(self.approved_delay_milliseconds())

933

934

# approved_duration - property

935

@dbus_service_property(_interface, signature=u"t",

936

access=u"readwrite")

937

def approved_duration_dbus_property(self):

938

return dbus.UInt64(self._timedelta_to_milliseconds(

939

self.approved_duration))

940

941

# name - property

942

@dbus_service_property(_interface, signature=u"s", access=u"read")

943

def name_dbus_property(self):

983

# ApprovedByDefault - property

984

@dbus_service_property(_interface, signature="b",

985

access="readwrite")

986

def ApprovedByDefault_dbus_property(self, value=None):

987

if value is None: # get

988

return dbus.Boolean(self.approved_by_default)

989

self.approved_by_default = bool(value)

990

991

# ApprovalDelay - property

992

@dbus_service_property(_interface, signature="t",

993

access="readwrite")

994

def ApprovalDelay_dbus_property(self, value=None):

995

if value is None: # get

996

return dbus.UInt64(self.approval_delay_milliseconds())

997

self.approval_delay = datetime.timedelta(0, 0, 0, value)

998

999

# ApprovalDuration - property

1000

@dbus_service_property(_interface, signature="t",

1001

access="readwrite")

1002

def ApprovalDuration_dbus_property(self, value=None):

1003

if value is None: # get

1004

return dbus.UInt64(_timedelta_to_milliseconds(

1005

self.approval_duration))

1006

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1007

1008

# Name - property

1009

@dbus_service_property(_interface, signature="s", access="read")

1010

def Name_dbus_property(self):

944

1011

return dbus.String(self.name)

945

1012

946

# fingerprint - property

947

@dbus_service_property(_interface, signature=u"s", access=u"read")

948

def fingerprint_dbus_property(self):

1013

# Fingerprint - property

1014

@dbus_service_property(_interface, signature="s", access="read")

1015

def Fingerprint_dbus_property(self):

949

1016

return dbus.String(self.fingerprint)

950

1017

951

# host - property

952

@dbus_service_property(_interface, signature=u"s",

953

access=u"readwrite")

954

def host_dbus_property(self, value=None):

1018

# Host - property

1019

@dbus_service_property(_interface, signature="s",

1020

access="readwrite")

1021

def Host_dbus_property(self, value=None):

955

1022

if value is None: # get

956

1023

return dbus.String(self.host)

957

1024

self.host = value

958

# Emit D-Bus signal

959

self.PropertyChanged(dbus.String(u"host"),

960

dbus.String(value, variant_level=1))

961

962

# created - property

963

@dbus_service_property(_interface, signature=u"s", access=u"read")

964

def created_dbus_property(self):

965

return dbus.String(self._datetime_to_dbus(self.created))

966

967

# last_enabled - property

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

969

def last_enabled_dbus_property(self):

970

if self.last_enabled is None:

971

return dbus.String(u"")

972

return dbus.String(self._datetime_to_dbus(self.last_enabled))

973

974

# enabled - property

975

@dbus_service_property(_interface, signature=u"b",

976

access=u"readwrite")

977

def enabled_dbus_property(self, value=None):

1025

1026

# Created - property

1027

@dbus_service_property(_interface, signature="s", access="read")

1028

def Created_dbus_property(self):

1029

return dbus.String(datetime_to_dbus(self.created))

1030

1031

# LastEnabled - property

1032

@dbus_service_property(_interface, signature="s", access="read")

1033

def LastEnabled_dbus_property(self):

1034

return datetime_to_dbus(self.last_enabled)

1035

1036

# Enabled - property

1037

@dbus_service_property(_interface, signature="b",

1038

access="readwrite")

1039

def Enabled_dbus_property(self, value=None):

978

1040

if value is None: # get

979

1041

return dbus.Boolean(self.enabled)

980

1042

if value:

982

1044

else:

983

1045

self.disable()

984

1046

985

# last_checked_ok - property

986

@dbus_service_property(_interface, signature=u"s",

987

access=u"readwrite")

988

def last_checked_ok_dbus_property(self, value=None):

1047

# LastCheckedOK - property

1048

@dbus_service_property(_interface, signature="s",

1049

access="readwrite")

1050

def LastCheckedOK_dbus_property(self, value=None):

989

1051

if value is not None:

990

1052

self.checked_ok()

991

1053

return

992

if self.last_checked_ok is None:

993

return dbus.String(u"")

994

return dbus.String(self._datetime_to_dbus(self

995

.last_checked_ok))

996

997

# timeout - property

998

@dbus_service_property(_interface, signature=u"t",

999

access=u"readwrite")

1000

def timeout_dbus_property(self, value=None):

1054

return datetime_to_dbus(self.last_checked_ok)

1055

1056

# Expires - property

1057

@dbus_service_property(_interface, signature="s", access="read")

1058

def Expires_dbus_property(self):

1059

return datetime_to_dbus(self.expires)

1060

1061

# LastApprovalRequest - property

1062

@dbus_service_property(_interface, signature="s", access="read")

1063

def LastApprovalRequest_dbus_property(self):

1064

return datetime_to_dbus(self.last_approval_request)

1065

1066

# Timeout - property

1067

@dbus_service_property(_interface, signature="t",

1068

access="readwrite")

1069

def Timeout_dbus_property(self, value=None):

1001

1070

if value is None: # get

1002

1071

return dbus.UInt64(self.timeout_milliseconds())

1003

1072

self.timeout = datetime.timedelta(0, 0, 0, value)

1004

# Emit D-Bus signal

1005

self.PropertyChanged(dbus.String(u"timeout"),

1006

dbus.UInt64(value, variant_level=1))

1007

if getattr(self, u"disable_initiator_tag", None) is None:

1073

if getattr(self, "disable_initiator_tag", None) is None:

1008

1074

return

1009

1075

# Reschedule timeout

1010

1076

gobject.source_remove(self.disable_initiator_tag)

1011

1077

self.disable_initiator_tag = None

1078

self.expires = None

1012

1079

time_to_die = (self.

1013

1080

_timedelta_to_milliseconds((self

1014

1081

.last_checked_ok

1019

1086

# The timeout has passed

1020

1087

self.disable()

1021

1088

else:

1089

self.expires = (datetime.datetime.utcnow()

1090

+ datetime.timedelta(milliseconds = time_to_die))

1022

1091

self.disable_initiator_tag = (gobject.timeout_add

1023

1092

(time_to_die, self.disable))

1024

1025

# interval - property

1026

@dbus_service_property(_interface, signature=u"t",

1027

access=u"readwrite")

1028

def interval_dbus_property(self, value=None):

1093

1094

# ExtendedTimeout - property

1095

@dbus_service_property(_interface, signature="t",

1096

access="readwrite")

1097

def ExtendedTimeout_dbus_property(self, value=None):

1098

if value is None: # get

1099

return dbus.UInt64(self.extended_timeout_milliseconds())

1100

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1101

1102

# Interval - property

1103

@dbus_service_property(_interface, signature="t",

1104

access="readwrite")

1105

def Interval_dbus_property(self, value=None):

1029

1106

if value is None: # get

1030

1107

return dbus.UInt64(self.interval_milliseconds())

1031

1108

self.interval = datetime.timedelta(0, 0, 0, value)

1032

# Emit D-Bus signal

1033

self.PropertyChanged(dbus.String(u"interval"),

1034

dbus.UInt64(value, variant_level=1))

1035

if getattr(self, u"checker_initiator_tag", None) is None:

1109

if getattr(self, "checker_initiator_tag", None) is None:

1036

1110

return

1037

1111

# Reschedule checker run

1038

1112

gobject.source_remove(self.checker_initiator_tag)

1040

1114

(value, self.start_checker))

1041

1115

self.start_checker() # Start one now, too

1042

1116

1043

# checker - property

1044

@dbus_service_property(_interface, signature=u"s",

1045

access=u"readwrite")

1046

def checker_dbus_property(self, value=None):

1117

# Checker - property

1118

@dbus_service_property(_interface, signature="s",

1119

access="readwrite")

1120

def Checker_dbus_property(self, value=None):

1047

1121

if value is None: # get

1048

1122

return dbus.String(self.checker_command)

1049

1123

self.checker_command = value

1050

# Emit D-Bus signal

1051

self.PropertyChanged(dbus.String(u"checker"),

1052

dbus.String(self.checker_command,

1053

variant_level=1))

1054

1124

1055

# checker_running - property

1056

@dbus_service_property(_interface, signature=u"b",

1057

access=u"readwrite")

1058

def checker_running_dbus_property(self, value=None):

1125

# CheckerRunning - property

1126

@dbus_service_property(_interface, signature="b",

1127

access="readwrite")

1128

def CheckerRunning_dbus_property(self, value=None):

1059

1129

if value is None: # get

1060

1130

return dbus.Boolean(self.checker is not None)

1061

1131

if value:

1063

1133

else:

1064

1134

self.stop_checker()

1065

1135

1066

# object_path - property

1067

@dbus_service_property(_interface, signature=u"o", access=u"read")

1068

def object_path_dbus_property(self):

1136

# ObjectPath - property

1137

@dbus_service_property(_interface, signature="o", access="read")

1138

def ObjectPath_dbus_property(self):

1069

1139

return self.dbus_object_path # is already a dbus.ObjectPath

1070

1140

1071

# secret = property

1072

@dbus_service_property(_interface, signature=u"ay",

1073

access=u"write", byte_arrays=True)

1074

def secret_dbus_property(self, value):

1141

# Secret = property

1142

@dbus_service_property(_interface, signature="ay",

1143

access="write", byte_arrays=True)

1144

def Secret_dbus_property(self, value):

1075

1145

self.secret = str(value)

1076

1146

1077

1147

del _interface

1111

1181

1112

1182

def handle(self):

1113

1183

with contextlib.closing(self.server.child_pipe) as child_pipe:

1114

logger.info(u"TCP connection from: %s",

1184

logger.info("TCP connection from: %s",

1115

1185

unicode(self.client_address))

1116

logger.debug(u"Pipe FD: %d",

1186

logger.debug("Pipe FD: %d",

1117

1187

self.server.child_pipe.fileno())

1118

1188

1119

1189

session = (gnutls.connection

1126

1196

# no X.509 keys are added to it. Therefore, we can use it

1127

1197

# here despite using OpenPGP certificates.

1128

1198

1129

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1130

# u"+AES-256-CBC", u"+SHA1",

1131

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1132

# u"+DHE-DSS"))

1199

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1200

# "+AES-256-CBC", "+SHA1",

1201

# "+COMP-NULL", "+CTYPE-OPENPGP",

1202

# "+DHE-DSS"))

1133

1203

# Use a fallback default, since this MUST be set.

1134

1204

priority = self.server.gnutls_priority

1135

1205

if priority is None:

1136

priority = u"NORMAL"

1206

priority = "NORMAL"

1137

1207

(gnutls.library.functions

1138

1208

.gnutls_priority_set_direct(session._c_object,

1139

1209

priority, None))

1141

1211

# Start communication using the Mandos protocol

1142

1212

# Get protocol number

1143

1213

line = self.request.makefile().readline()

1144

logger.debug(u"Protocol version: %r", line)

1214

logger.debug("Protocol version: %r", line)

1145

1215

try:

1146

1216

if int(line.strip().split()[0]) > 1:

1147

1217

raise RuntimeError

1148

except (ValueError, IndexError, RuntimeError), error:

1149

logger.error(u"Unknown protocol version: %s", error)

1218

except (ValueError, IndexError, RuntimeError) as error:

1219

logger.error("Unknown protocol version: %s", error)

1150

1220

return

1151

1221

1152

1222

# Start GnuTLS connection

1153

1223

try:

1154

1224

session.handshake()

1155

except gnutls.errors.GNUTLSError, error:

1156

logger.warning(u"Handshake failed: %s", error)

1225

except gnutls.errors.GNUTLSError as error:

1226

logger.warning("Handshake failed: %s", error)

1157

1227

# Do not run session.bye() here: the session is not

1158

1228

# established. Just abandon the request.

1159

1229

return

1160

logger.debug(u"Handshake succeeded")

1230

logger.debug("Handshake succeeded")

1161

1231

1162

1232

approval_required = False

1163

1233

try:

1164

1234

try:

1165

1235

fpr = self.fingerprint(self.peer_certificate

1166

1236

(session))

1167

except (TypeError, gnutls.errors.GNUTLSError), error:

1168

logger.warning(u"Bad certificate: %s", error)

1237

except (TypeError,

1238

gnutls.errors.GNUTLSError) as error:

1239

logger.warning("Bad certificate: %s", error)

1169

1240

return

1170

logger.debug(u"Fingerprint: %s", fpr)

1241

logger.debug("Fingerprint: %s", fpr)

1171

1242

1172

1243

try:

1173

1244

client = ProxyClient(child_pipe, fpr,

1175

1246

except KeyError:

1176

1247

return

1177

1248

1178

if client.approved_delay:

1179

delay = client.approved_delay

1249

if client.approval_delay:

1250

delay = client.approval_delay

1180

1251

client.approvals_pending += 1

1181

1252

approval_required = True

1182

1253

1183

1254

while True:

1184

1255

if not client.enabled:

1185

logger.warning(u"Client %s is disabled",

1256

logger.info("Client %s is disabled",

1186

1257

client.name)

1187

1258

if self.server.use_dbus:

1188

1259

# Emit D-Bus signal

1189

1260

client.Rejected("Disabled")

1190

1261

return

1191

1262

1192

if client._approved or not client.approved_delay:

1263

if client._approved or not client.approval_delay:

1193

1264

#We are approved or approval is disabled

1194

1265

break

1195

1266

elif client._approved is None:

1196

logger.info(u"Client %s need approval",

1267

logger.info("Client %s needs approval",

1197

1268

client.name)

1198

1269

if self.server.use_dbus:

1199

1270

# Emit D-Bus signal

1200

1271

client.NeedApproval(

1201

client.approved_delay_milliseconds(),

1272

client.approval_delay_milliseconds(),

1202

1273

client.approved_by_default)

1203

1274

else:

1204

logger.warning(u"Client %s was not approved",

1275

logger.warning("Client %s was not approved",

1205

1276

client.name)

1206

1277

if self.server.use_dbus:

1207

1278

# Emit D-Bus signal

1208

client.Rejected("Disapproved")

1279

client.Rejected("Denied")

1209

1280

return

1210

1281

1211

1282

#wait until timeout or approved

1222

1293

client.name)

1223

1294

if self.server.use_dbus:

1224

1295

# Emit D-Bus signal

1225

client.Rejected("Time out")

1296

client.Rejected("Approval timed out")

1226

1297

return

1227

1298

else:

1228

1299

break

1233

1304

while sent_size < len(client.secret):

1234

1305

try:

1235

1306

sent = session.send(client.secret[sent_size:])

1236

except (gnutls.errors.GNUTLSError), error:

1307

except gnutls.errors.GNUTLSError as error:

1237

1308

logger.warning("gnutls send failed")

1238

1309

return

1239

logger.debug(u"Sent: %d, remaining: %d",

1310

logger.debug("Sent: %d, remaining: %d",

1240

1311

sent, len(client.secret)

1241

1312

- (sent_size + sent))

1242

1313

sent_size += sent

1243

1314

1244

logger.info(u"Sending secret to %s", client.name)

1315

logger.info("Sending secret to %s", client.name)

1245

1316

# bump the timeout as if seen

1246

client.checked_ok()

1317

client.checked_ok(client.extended_timeout)

1247

1318

if self.server.use_dbus:

1248

1319

# Emit D-Bus signal

1249

1320

client.GotSecret()

1253

1324

client.approvals_pending -= 1

1254

1325

try:

1255

1326

session.bye()

1256

except (gnutls.errors.GNUTLSError), error:

1257

logger.warning("gnutls bye failed")

1327

except gnutls.errors.GNUTLSError as error:

1328

logger.warning("GnuTLS bye failed")

1258

1329

1259

1330

@staticmethod

1260

1331

def peer_certificate(session):

1270

1341

.gnutls_certificate_get_peers

1271

1342

(session._c_object, ctypes.byref(list_size)))

1272

1343

if not bool(cert_list) and list_size.value != 0:

1273

raise gnutls.errors.GNUTLSError(u"error getting peer"

1274

u" certificate")

1344

raise gnutls.errors.GNUTLSError("error getting peer"

1345

" certificate")

1275

1346

if list_size.value == 0:

1276

1347

return None

1277

1348

cert = cert_list[0]

1303

1374

if crtverify.value != 0:

1304

1375

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1305

1376

raise (gnutls.errors.CertificateSecurityError

1306

(u"Verify failed"))

1377

("Verify failed"))

1307

1378

# New buffer for the fingerprint

1308

1379

buf = ctypes.create_string_buffer(20)

1309

1380

buf_len = ctypes.c_size_t()

1316

1387

# Convert the buffer to a Python bytestring

1317

1388

fpr = ctypes.string_at(buf, buf_len.value)

1318

1389

# Convert the bytestring to hexadecimal notation

1319

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1390

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1320

1391

return hex_fpr

1321

1392

1322

1393

1350

1421

1351

1422

def add_pipe(self, parent_pipe):

1352

1423

"""Dummy function; override as necessary"""

1353

pass

1424

raise NotImplementedError

1354

1425

1355

1426

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1356

1427

socketserver.TCPServer, object):

1374

1445

bind to an address or port if they were not specified."""

1375

1446

if self.interface is not None:

1376

1447

if SO_BINDTODEVICE is None:

1377

logger.error(u"SO_BINDTODEVICE does not exist;"

1378

u" cannot bind to interface %s",

1448

logger.error("SO_BINDTODEVICE does not exist;"

1449

" cannot bind to interface %s",

1379

1450

self.interface)

1380

1451

else:

1381

1452

try:

1382

1453

self.socket.setsockopt(socket.SOL_SOCKET,

1383

1454

SO_BINDTODEVICE,

1384

1455

str(self.interface

1385

+ u'\0'))

1386

except socket.error, error:

1456

+ '\0'))

1457

except socket.error as error:

1387

1458

if error[0] == errno.EPERM:

1388

logger.error(u"No permission to"

1389

u" bind to interface %s",

1459

logger.error("No permission to"

1460

" bind to interface %s",

1390

1461

self.interface)

1391

1462

elif error[0] == errno.ENOPROTOOPT:

1392

logger.error(u"SO_BINDTODEVICE not available;"

1393

u" cannot bind to interface %s",

1463

logger.error("SO_BINDTODEVICE not available;"

1464

" cannot bind to interface %s",

1394

1465

self.interface)

1395

1466

else:

1396

1467

raise

1398

1469

if self.server_address[0] or self.server_address[1]:

1399

1470

if not self.server_address[0]:

1400

1471

if self.address_family == socket.AF_INET6:

1401

any_address = u"::" # in6addr_any

1472

any_address = "::" # in6addr_any

1402

1473

else:

1403

1474

any_address = socket.INADDR_ANY

1404

1475

self.server_address = (any_address,

1453

1524

def handle_ipc(self, source, condition, parent_pipe=None,

1454

1525

client_object=None):

1455

1526

condition_names = {

1456

gobject.IO_IN: u"IN", # There is data to read.

1457

gobject.IO_OUT: u"OUT", # Data can be written (without

1527

gobject.IO_IN: "IN", # There is data to read.

1528

gobject.IO_OUT: "OUT", # Data can be written (without

1458

1529

# blocking).

1459

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1460

gobject.IO_ERR: u"ERR", # Error condition.

1461

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1530

gobject.IO_PRI: "PRI", # There is urgent data to read.

1531

gobject.IO_ERR: "ERR", # Error condition.

1532

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1462

1533

# broken, usually for pipes and

1463

1534

# sockets).

1464

1535

}

1466

1537

for cond, name in

1467

1538

condition_names.iteritems()

1468

1539

if cond & condition)

1469

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1470

conditions_string)

1471

1472

1540

# error or the other end of multiprocessing.Pipe has closed

1473

1541

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1474

1542

return False

1475

1543

1476

1544

# Read a request from the child

1477

1545

request = parent_pipe.recv()

1478

logger.debug(u"IPC request: %s", repr(request))

1479

1546

command = request[0]

1480

1547

1481

1548

if command == 'init':

1487

1554

client = c

1488

1555

break

1489

1556

else:

1490

logger.warning(u"Client not found for fingerprint: %s, ad"

1491

u"dress: %s", fpr, address)

1557

logger.info("Client not found for fingerprint: %s, ad"

1558

"dress: %s", fpr, address)

1492

1559

if self.use_dbus:

1493

1560

# Emit D-Bus signal

1494

mandos_dbus_service.ClientNotFound(fpr, address)

1561

mandos_dbus_service.ClientNotFound(fpr, address[0])

1495

1562

parent_pipe.send(False)

1496

1563

return False

1497

1564

1528

1595

def string_to_delta(interval):

1529

1596

"""Parse a string and return a datetime.timedelta

1530

1597

1531

>>> string_to_delta(u'7d')

1598

>>> string_to_delta('7d')

1532

1599

datetime.timedelta(7)

1533

>>> string_to_delta(u'60s')

1600

>>> string_to_delta('60s')

1534

1601

datetime.timedelta(0, 60)

1535

>>> string_to_delta(u'60m')

1602

>>> string_to_delta('60m')

1536

1603

datetime.timedelta(0, 3600)

1537

>>> string_to_delta(u'24h')

1604

>>> string_to_delta('24h')

1538

1605

datetime.timedelta(1)

1539

>>> string_to_delta(u'1w')

1606

>>> string_to_delta('1w')

1540

1607

datetime.timedelta(7)

1541

>>> string_to_delta(u'5m 30s')

1608

>>> string_to_delta('5m 30s')

1542

1609

datetime.timedelta(0, 330)

1543

1610

"""

1544

1611

timevalue = datetime.timedelta(0)

1546

1613

try:

1547

1614

suffix = unicode(s[-1])

1548

1615

value = int(s[:-1])

1549

if suffix == u"d":

1616

if suffix == "d":

1550

1617

delta = datetime.timedelta(value)

1551

elif suffix == u"s":

1618

elif suffix == "s":

1552

1619

delta = datetime.timedelta(0, value)

1553

elif suffix == u"m":

1620

elif suffix == "m":

1554

1621

delta = datetime.timedelta(0, 0, 0, 0, value)

1555

elif suffix == u"h":

1622

elif suffix == "h":

1556

1623

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1557

elif suffix == u"w":

1624

elif suffix == "w":

1558

1625

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1559

1626

else:

1560

raise ValueError(u"Unknown suffix %r" % suffix)

1561

except (ValueError, IndexError), e:

1562

raise ValueError(e.message)

1627

raise ValueError("Unknown suffix %r" % suffix)

1628

except (ValueError, IndexError) as e:

1629

raise ValueError(*(e.args))

1563

1630

timevalue += delta

1564

1631

return timevalue

1565

1632

1571

1638

global if_nametoindex

1572

1639

try:

1573

1640

if_nametoindex = (ctypes.cdll.LoadLibrary

1574

(ctypes.util.find_library(u"c"))

1641

(ctypes.util.find_library("c"))

1575

1642

.if_nametoindex)

1576

1643

except (OSError, AttributeError):

1577

logger.warning(u"Doing if_nametoindex the hard way")

1644

logger.warning("Doing if_nametoindex the hard way")

1578

1645

def if_nametoindex(interface):

1579

1646

"Get an interface index the hard way, i.e. using fcntl()"

1580

1647

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1581

1648

with contextlib.closing(socket.socket()) as s:

1582

1649

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1583

struct.pack(str(u"16s16x"),

1650

struct.pack(str("16s16x"),

1584

1651

interface))

1585

interface_index = struct.unpack(str(u"I"),

1652

interface_index = struct.unpack(str("I"),

1586

1653

ifreq[16:20])[0]

1587

1654

return interface_index

1588

1655

return if_nametoindex(interface)

1596

1663

sys.exit()

1597

1664

os.setsid()

1598

1665

if not nochdir:

1599

os.chdir(u"/")

1666

os.chdir("/")

1600

1667

if os.fork():

1601

1668

sys.exit()

1602

1669

if not noclose:

1604

1671

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1605

1672

if not stat.S_ISCHR(os.fstat(null).st_mode):

1606

1673

raise OSError(errno.ENODEV,

1607

u"%s not a character device"

1674

"%s not a character device"

1608

1675

% os.path.devnull)

1609

1676

os.dup2(null, sys.stdin.fileno())

1610

1677

os.dup2(null, sys.stdout.fileno())

1618

1685

##################################################################

1619

1686

# Parsing of options, both command line and config file

1620

1687

1621

parser = optparse.OptionParser(version = "%%prog %s" % version)

1622

parser.add_option("-i", u"--interface", type=u"string",

1623

metavar="IF", help=u"Bind to interface IF")

1624

parser.add_option("-a", u"--address", type=u"string",

1625

help=u"Address to listen for requests on")

1626

parser.add_option("-p", u"--port", type=u"int",

1627

help=u"Port number to receive requests on")

1628

parser.add_option("--check", action=u"store_true",

1629

help=u"Run self-test")

1630

parser.add_option("--debug", action=u"store_true",

1631

help=u"Debug mode; run in foreground and log to"

1632

u" terminal")

1633

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1634

help=u"Debug level for stdout output")

1635

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1636

u" priority string (see GnuTLS documentation)")

1637

parser.add_option("--servicename", type=u"string",

1638

metavar=u"NAME", help=u"Zeroconf service name")

1639

parser.add_option("--configdir", type=u"string",

1640

default=u"/etc/mandos", metavar=u"DIR",

1641

help=u"Directory to search for configuration"

1642

u" files")

1643

parser.add_option("--no-dbus", action=u"store_false",

1644

dest=u"use_dbus", help=u"Do not provide D-Bus"

1645

u" system bus interface")

1646

parser.add_option("--no-ipv6", action=u"store_false",

1647

dest=u"use_ipv6", help=u"Do not use IPv6")

1648

options = parser.parse_args()[0]

1688

parser = argparse.ArgumentParser()

1689

parser.add_argument("-v", "--version", action="version",

1690

version = "%%(prog)s %s" % version,

1691

help="show version number and exit")

1692

parser.add_argument("-i", "--interface", metavar="IF",

1693

help="Bind to interface IF")

1694

parser.add_argument("-a", "--address",

1695

help="Address to listen for requests on")

1696

parser.add_argument("-p", "--port", type=int,

1697

help="Port number to receive requests on")

1698

parser.add_argument("--check", action="store_true",

1699

help="Run self-test")

1700

parser.add_argument("--debug", action="store_true",

1701

help="Debug mode; run in foreground and log"

1702

" to terminal")

1703

parser.add_argument("--debuglevel", metavar="LEVEL",

1704

help="Debug level for stdout output")

1705

parser.add_argument("--priority", help="GnuTLS"

1706

" priority string (see GnuTLS documentation)")

1707

parser.add_argument("--servicename",

1708

metavar="NAME", help="Zeroconf service name")

1709

parser.add_argument("--configdir",

1710

default="/etc/mandos", metavar="DIR",

1711

help="Directory to search for configuration"

1712

" files")

1713

parser.add_argument("--no-dbus", action="store_false",

1714

dest="use_dbus", help="Do not provide D-Bus"

1715

" system bus interface")

1716

parser.add_argument("--no-ipv6", action="store_false",

1717

dest="use_ipv6", help="Do not use IPv6")

1718

options = parser.parse_args()

1649

1719

1650

1720

if options.check:

1651

1721

import doctest

1653

1723

sys.exit()

1654

1724

1655

1725

# Default values for config file for server-global settings

1656

server_defaults = { u"interface": u"",

1657

u"address": u"",

1658

u"port": u"",

1659

u"debug": u"False",

1660

u"priority":

1661

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1662

u"servicename": u"Mandos",

1663

u"use_dbus": u"True",

1664

u"use_ipv6": u"True",

1665

u"debuglevel": u"",

1726

server_defaults = { "interface": "",

1727

"address": "",

1728

"port": "",

1729

"debug": "False",

1730

"priority":

1731

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1732

"servicename": "Mandos",

1733

"use_dbus": "True",

1734

"use_ipv6": "True",

1735

"debuglevel": "",

1666

1736

}

1667

1737

1668

1738

# Parse config file for server-global settings

1669

1739

server_config = configparser.SafeConfigParser(server_defaults)

1670

1740

del server_defaults

1671

1741

server_config.read(os.path.join(options.configdir,

1672

u"mandos.conf"))

1742

"mandos.conf"))

1673

1743

# Convert the SafeConfigParser object to a dict

1674

1744

server_settings = server_config.defaults()

1675

1745

# Use the appropriate methods on the non-string config options

1676

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1677

server_settings[option] = server_config.getboolean(u"DEFAULT",

1746

for option in ("debug", "use_dbus", "use_ipv6"):

1747

server_settings[option] = server_config.getboolean("DEFAULT",

1678

1748

option)

1679

1749

if server_settings["port"]:

1680

server_settings["port"] = server_config.getint(u"DEFAULT",

1681

u"port")

1750

server_settings["port"] = server_config.getint("DEFAULT",

1751

"port")

1682

1752

del server_config

1683

1753

1684

1754

# Override the settings from the config file with command line

1685

1755

# options, if set.

1686

for option in (u"interface", u"address", u"port", u"debug",

1687

u"priority", u"servicename", u"configdir",

1688

u"use_dbus", u"use_ipv6", u"debuglevel"):

1756

for option in ("interface", "address", "port", "debug",

1757

"priority", "servicename", "configdir",

1758

"use_dbus", "use_ipv6", "debuglevel"):

1689

1759

value = getattr(options, option)

1690

1760

if value is not None:

1691

1761

server_settings[option] = value

1699

1769

##################################################################

1700

1770

1701

1771

# For convenience

1702

debug = server_settings[u"debug"]

1703

debuglevel = server_settings[u"debuglevel"]

1704

use_dbus = server_settings[u"use_dbus"]

1705

use_ipv6 = server_settings[u"use_ipv6"]

1772

debug = server_settings["debug"]

1773

debuglevel = server_settings["debuglevel"]

1774

use_dbus = server_settings["use_dbus"]

1775

use_ipv6 = server_settings["use_ipv6"]

1706

1776

1707

if server_settings[u"servicename"] != u"Mandos":

1777

if server_settings["servicename"] != "Mandos":

1708

1778

syslogger.setFormatter(logging.Formatter

1709

(u'Mandos (%s) [%%(process)d]:'

1710

u' %%(levelname)s: %%(message)s'

1711

% server_settings[u"servicename"]))

1779

('Mandos (%s) [%%(process)d]:'

1780

' %%(levelname)s: %%(message)s'

1781

% server_settings["servicename"]))

1712

1782

1713

1783

# Parse config file with clients

1714

client_defaults = { u"timeout": u"1h",

1715

u"interval": u"5m",

1716

u"checker": u"fping -q -- %%(host)s",

1717

u"host": u"",

1718

u"approved_delay": u"0s",

1719

u"approved_duration": u"1s",

1784

client_defaults = { "timeout": "5m",

1785

"extended_timeout": "15m",

1786

"interval": "2m",

1787

"checker": "fping -q -- %%(host)s",

1788

"host": "",

1789

"approval_delay": "0s",

1790

"approval_duration": "1s",

1720

1791

}

1721

1792

client_config = configparser.SafeConfigParser(client_defaults)

1722

client_config.read(os.path.join(server_settings[u"configdir"],

1723

u"clients.conf"))

1793

client_config.read(os.path.join(server_settings["configdir"],

1794

"clients.conf"))

1724

1795

1725

1796

global mandos_dbus_service

1726

1797

mandos_dbus_service = None

1727

1798

1728

tcp_server = MandosServer((server_settings[u"address"],

1729

server_settings[u"port"]),

1799

tcp_server = MandosServer((server_settings["address"],

1800

server_settings["port"]),

1730

1801

ClientHandler,

1731

interface=server_settings[u"interface"],

1802

interface=(server_settings["interface"]

1803

or None),

1732

1804

use_ipv6=use_ipv6,

1733

1805

gnutls_priority=

1734

server_settings[u"priority"],

1806

server_settings["priority"],

1735

1807

use_dbus=use_dbus)

1736

pidfilename = u"/var/run/mandos.pid"

1737

try:

1738

pidfile = open(pidfilename, u"w")

1739

except IOError:

1740

logger.error(u"Could not open file %r", pidfilename)

1808

if not debug:

1809

pidfilename = "/var/run/mandos.pid"

1810

try:

1811

pidfile = open(pidfilename, "w")

1812

except IOError:

1813

logger.error("Could not open file %r", pidfilename)

1741

1814

1742

1815

try:

1743

uid = pwd.getpwnam(u"_mandos").pw_uid

1744

gid = pwd.getpwnam(u"_mandos").pw_gid

1816

uid = pwd.getpwnam("_mandos").pw_uid

1817

gid = pwd.getpwnam("_mandos").pw_gid

1745

1818

except KeyError:

1746

1819

try:

1747

uid = pwd.getpwnam(u"mandos").pw_uid

1748

gid = pwd.getpwnam(u"mandos").pw_gid

1820

uid = pwd.getpwnam("mandos").pw_uid

1821

gid = pwd.getpwnam("mandos").pw_gid

1749

1822

except KeyError:

1750

1823

try:

1751

uid = pwd.getpwnam(u"nobody").pw_uid

1752

gid = pwd.getpwnam(u"nobody").pw_gid

1824

uid = pwd.getpwnam("nobody").pw_uid

1825

gid = pwd.getpwnam("nobody").pw_gid

1753

1826

except KeyError:

1754

1827

uid = 65534

1755

1828

gid = 65534

1756

1829

try:

1757

1830

os.setgid(gid)

1758

1831

os.setuid(uid)

1759

except OSError, error:

1832

except OSError as error:

1760

1833

if error[0] != errno.EPERM:

1761

1834

raise error

1762

1835

1763

# Enable all possible GnuTLS debugging

1764

1765

1766

1836

if not debug and not debuglevel:

1767

1837

syslogger.setLevel(logging.WARNING)

1768

1838

console.setLevel(logging.WARNING)

1772

1842

console.setLevel(level)

1773

1843

1774

1844

if debug:

1845

# Enable all possible GnuTLS debugging

1846

1775

1847

# "Use a log level over 10 to enable all debugging options."

1776

1848

# - GnuTLS manual

1777

1849

gnutls.library.functions.gnutls_global_set_log_level(11)

1778

1850

1779

1851

@gnutls.library.types.gnutls_log_func

1780

1852

def debug_gnutls(level, string):

1781

logger.debug(u"GnuTLS: %s", string[:-1])

1853

logger.debug("GnuTLS: %s", string[:-1])

1782

1854

1783

1855

(gnutls.library.functions

1784

1856

.gnutls_global_set_log_function(debug_gnutls))

1785

1857

1786

1858

# Redirect stdin so all checkers get /dev/null

1787

1859

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1788

1860

os.dup2(null, sys.stdin.fileno())

1791

1863

else:

1792

1864

# No console logging

1793

1865

logger.removeHandler(console)

1794

1866

1867

# Need to fork before connecting to D-Bus

1868

if not debug:

1869

# Close all input and output, do double fork, etc.

1870

daemon()

1795

1871

1796

1872

global main_loop

1797

1873

# From the Avahi example code

1801

1877

# End of Avahi example code

1802

1878

if use_dbus:

1803

1879

try:

1804

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1880

bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1805

1881

bus, do_not_queue=True)

1806

except dbus.exceptions.NameExistsException, e:

1807

logger.error(unicode(e) + u", disabling D-Bus")

1882

except dbus.exceptions.NameExistsException as e:

1883

logger.error(unicode(e) + ", disabling D-Bus")

1808

1884

use_dbus = False

1809

server_settings[u"use_dbus"] = False

1885

server_settings["use_dbus"] = False

1810

1886

tcp_server.use_dbus = False

1811

1887

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1812

service = AvahiService(name = server_settings[u"servicename"],

1813

servicetype = u"_mandos._tcp",

1888

service = AvahiService(name = server_settings["servicename"],

1889

servicetype = "_mandos._tcp",

1814

1890

protocol = protocol, bus = bus)

1815

1891

if server_settings["interface"]:

1816

1892

service.interface = (if_nametoindex

1817

(str(server_settings[u"interface"])))

1818

1819

if not debug:

1820

# Close all input and output, do double fork, etc.

1821

daemon()

1822

1893

(str(server_settings["interface"])))

1894

1823

1895

global multiprocessing_manager

1824

1896

multiprocessing_manager = multiprocessing.Manager()

1825

1897

1844

1916

client_config, section)))

1845

1917

for section in client_config.sections()))

1846

1918

if not tcp_server.clients:

1847

logger.warning(u"No clients defined")

1919

logger.warning("No clients defined")

1848

1920

1849

try:

1850

with pidfile:

1851

pid = os.getpid()

1852

pidfile.write(str(pid) + "\n")

1853

del pidfile

1854

except IOError:

1855

logger.error(u"Could not write to file %r with PID %d",

1856

pidfilename, pid)

1857

except NameError:

1858

# "pidfile" was never created

1859

pass

1860

del pidfilename

1861

1862

1921

if not debug:

1922

try:

1923

with pidfile:

1924

pid = os.getpid()

1925

pidfile.write(str(pid) + "\n".encode("utf-8"))

1926

del pidfile

1927

except IOError:

1928

logger.error("Could not write to file %r with PID %d",

1929

pidfilename, pid)

1930

except NameError:

1931

# "pidfile" was never created

1932

pass

1933

del pidfilename

1934

1863

1935

signal.signal(signal.SIGINT, signal.SIG_IGN)

1936

1864

1937

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1865

1938

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1866

1939

1868

1941

class MandosDBusService(dbus.service.Object):

1869

1942

"""A D-Bus proxy object"""

1870

1943

def __init__(self):

1871

dbus.service.Object.__init__(self, bus, u"/")

1872

_interface = u"se.bsnet.fukt.Mandos"

1944

dbus.service.Object.__init__(self, bus, "/")

1945

_interface = "se.bsnet.fukt.Mandos"

1873

1946

1874

@dbus.service.signal(_interface, signature=u"o")

1947

@dbus.service.signal(_interface, signature="o")

1875

1948

def ClientAdded(self, objpath):

1876

1949

"D-Bus signal"

1877

1950

pass

1878

1951

1879

@dbus.service.signal(_interface, signature=u"ss")

1952

@dbus.service.signal(_interface, signature="ss")

1880

1953

def ClientNotFound(self, fingerprint, address):

1881

1954

"D-Bus signal"

1882

1955

pass

1883

1956

1884

@dbus.service.signal(_interface, signature=u"os")

1957

@dbus.service.signal(_interface, signature="os")

1885

1958

def ClientRemoved(self, objpath, name):

1886

1959

"D-Bus signal"

1887

1960

pass

1888

1961

1889

@dbus.service.method(_interface, out_signature=u"ao")

1962

@dbus.service.method(_interface, out_signature="ao")

1890

1963

def GetAllClients(self):

1891

1964

"D-Bus method"

1892

1965

return dbus.Array(c.dbus_object_path

1893

1966

for c in tcp_server.clients)

1894

1967

1895

1968

@dbus.service.method(_interface,

1896

out_signature=u"a{oa{sv}}")

1969

out_signature="a{oa{sv}}")

1897

1970

def GetAllClientsWithProperties(self):

1898

1971

"D-Bus method"

1899

1972

return dbus.Dictionary(

1900

((c.dbus_object_path, c.GetAll(u""))

1973

((c.dbus_object_path, c.GetAll(""))

1901

1974

for c in tcp_server.clients),

1902

signature=u"oa{sv}")

1975

signature="oa{sv}")

1903

1976

1904

@dbus.service.method(_interface, in_signature=u"o")

1977

@dbus.service.method(_interface, in_signature="o")

1905

1978

def RemoveClient(self, object_path):

1906

1979

"D-Bus method"

1907

1980

for c in tcp_server.clients:

1949

2022

# Find out what port we got

1950

2023

service.port = tcp_server.socket.getsockname()[1]

1951

2024

if use_ipv6:

1952

logger.info(u"Now listening on address %r, port %d,"

2025

logger.info("Now listening on address %r, port %d,"

1953

2026

" flowinfo %d, scope_id %d"

1954

2027

% tcp_server.socket.getsockname())

1955

2028

else: # IPv4

1956

logger.info(u"Now listening on address %r, port %d"

2029

logger.info("Now listening on address %r, port %d"

1957

2030

% tcp_server.socket.getsockname())

1958

2031

1959

2032

#service.interface = tcp_server.socket.getsockname()[3]

1962

2035

# From the Avahi example code

1963

2036

try:

1964

2037

service.activate()

1965

except dbus.exceptions.DBusException, error:

1966

logger.critical(u"DBusException: %s", error)

2038

except dbus.exceptions.DBusException as error:

2039

logger.critical("DBusException: %s", error)

1967

2040

cleanup()

1968

2041

sys.exit(1)

1969

2042

# End of Avahi example code

1973

2046

(tcp_server.handle_request

1974

2047

(*args[2:], **kwargs) or True))

1975

2048

1976

logger.debug(u"Starting main loop")

2049

logger.debug("Starting main loop")

1977

2050

main_loop.run()

1978

except AvahiError, error:

1979

logger.critical(u"AvahiError: %s", error)

2051

except AvahiError as error:

2052

logger.critical("AvahiError: %s", error)

1980

2053

cleanup()

1981

2054

sys.exit(1)

1982

2055

except KeyboardInterrupt:

1983

2056

if debug:

1984

print >> sys.stderr

1985

logger.debug(u"Server received KeyboardInterrupt")

1986

logger.debug(u"Server exiting")

2057

print("", file=sys.stderr)

2058

logger.debug("Server received KeyboardInterrupt")

2059

logger.debug("Server exiting")

1987

2060

# Must run before the D-Bus bus name gets deregistered

1988

2061

cleanup()

1989

2062