/mandos/trunk : revision 505.1.2

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

55

56

import logging

56

57

import logging.handlers

57

58

import pwd

58

from contextlib import closing

59

import contextlib

59

60

import struct

60

61

import fcntl

61

62

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

62

66

63

67

import dbus

64

68

import dbus.service

79

83

SO_BINDTODEVICE = None

80

84

81

85

82

version = "1.0.12"

86

version = "1.3.1"

83

87

84

logger = logging.Logger(u'mandos')

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

85

90

syslogger = (logging.handlers.SysLogHandler

86

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

87

address = "/dev/log"))

92

address = str("/dev/log")))

88

93

syslogger.setFormatter(logging.Formatter

89

(u'Mandos [%(process)d]: %(levelname)s:'

90

u' %(message)s'))

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

91

96

logger.addHandler(syslogger)

92

97

93

98

console = logging.StreamHandler()

94

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

95

u' %(levelname)s:'

96

u' %(message)s'))

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

97

102

logger.addHandler(console)

98

103

99

104

class AvahiError(Exception):

116

121

Attributes:

117

122

interface: integer; avahi.IF_UNSPEC or an interface index.

118

123

Used to optionally bind to the specified interface.

119

120

type: string; Example: u'_mandos._tcp'.

124

125

type: string; Example: '_mandos._tcp'.

121

126

See <http://www.dns-sd.org/ServiceTypes.html>

122

127

port: integer; what port to announce

123

128

TXT: list of strings; TXT record for the service

132

137

"""

133

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

134

139

servicetype = None, port = None, TXT = None,

135

domain = u"", host = u"", max_renames = 32768,

140

domain = "", host = "", max_renames = 32768,

136

141

protocol = avahi.PROTO_UNSPEC, bus = None):

137

142

self.interface = interface

138

143

self.name = name

147

152

self.group = None # our entry group

148

153

self.server = None

149

154

self.bus = bus

155

self.entry_group_state_changed_match = None

150

156

def rename(self):

151

157

"""Derived from the Avahi example code"""

152

158

if self.rename_count >= self.max_renames:

153

logger.critical(u"No suitable Zeroconf service name found"

154

u" after %i retries, exiting.",

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

155

161

self.rename_count)

156

raise AvahiServiceError(u"Too many renames")

157

self.name = self.server.GetAlternativeServiceName(self.name)

158

logger.info(u"Changing Zeroconf service name to %r ...",

159

unicode(self.name))

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

164

logger.info("Changing Zeroconf service name to %r ...",

165

self.name)

160

166

syslogger.setFormatter(logging.Formatter

161

(u'Mandos (%s) [%%(process)d]:'

162

u' %%(levelname)s: %%(message)s'

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

163

169

% self.name))

164

170

self.remove()

165

self.add()

171

try:

172

self.add()

173

except dbus.exceptions.DBusException as error:

174

logger.critical("DBusException: %s", error)

175

self.cleanup()

176

os._exit(1)

166

177

self.rename_count += 1

167

178

def remove(self):

168

179

"""Derived from the Avahi example code"""

180

if self.entry_group_state_changed_match is not None:

181

self.entry_group_state_changed_match.remove()

182

self.entry_group_state_changed_match = None

169

183

if self.group is not None:

170

184

self.group.Reset()

171

185

def add(self):

172

186

"""Derived from the Avahi example code"""

187

self.remove()

173

188

if self.group is None:

174

189

self.group = dbus.Interface(

175

190

self.bus.get_object(avahi.DBUS_NAME,

176

191

self.server.EntryGroupNew()),

177

192

avahi.DBUS_INTERFACE_ENTRY_GROUP)

178

self.group.connect_to_signal('StateChanged',

179

self

180

.entry_group_state_changed)

181

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

193

self.entry_group_state_changed_match = (

194

self.group.connect_to_signal(

195

'StateChanged', self .entry_group_state_changed))

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

182

197

self.name, self.type)

183

198

self.group.AddService(

184

199

self.interface,

191

206

self.group.Commit()

192

207

def entry_group_state_changed(self, state, error):

193

208

"""Derived from the Avahi example code"""

194

logger.debug(u"Avahi state change: %i", state)

209

logger.debug("Avahi entry group state change: %i", state)

195

210

196

211

if state == avahi.ENTRY_GROUP_ESTABLISHED:

197

logger.debug(u"Zeroconf service established.")

212

logger.debug("Zeroconf service established.")

198

213

elif state == avahi.ENTRY_GROUP_COLLISION:

199

logger.warning(u"Zeroconf service name collision.")

214

logger.info("Zeroconf service name collision.")

200

215

self.rename()

201

216

elif state == avahi.ENTRY_GROUP_FAILURE:

202

logger.critical(u"Avahi: Error in group state changed %s",

217

logger.critical("Avahi: Error in group state changed %s",

203

218

unicode(error))

204

raise AvahiGroupError(u"State changed: %s"

219

raise AvahiGroupError("State changed: %s"

205

220

% unicode(error))

206

221

def cleanup(self):

207

222

"""Derived from the Avahi example code"""

208

223

if self.group is not None:

209

self.group.Free()

224

try:

225

self.group.Free()

226

except (dbus.exceptions.UnknownMethodException,

227

dbus.exceptions.DBusException) as e:

228

pass

210

229

self.group = None

211

def server_state_changed(self, state):

230

self.remove()

231

def server_state_changed(self, state, error=None):

212

232

"""Derived from the Avahi example code"""

213

if state == avahi.SERVER_COLLISION:

214

logger.error(u"Zeroconf server name collision")

215

self.remove()

233

logger.debug("Avahi server state change: %i", state)

234

bad_states = { avahi.SERVER_INVALID:

235

"Zeroconf server invalid",

236

avahi.SERVER_REGISTERING: None,

237

avahi.SERVER_COLLISION:

238

"Zeroconf server name collision",

239

avahi.SERVER_FAILURE:

240

"Zeroconf server failure" }

241

if state in bad_states:

242

if bad_states[state] is not None:

243

if error is None:

244

logger.error(bad_states[state])

245

else:

246

logger.error(bad_states[state] + ": %r", error)

247

self.cleanup()

216

248

elif state == avahi.SERVER_RUNNING:

217

249

self.add()

250

else:

251

if error is None:

252

logger.debug("Unknown state: %r", state)

253

else:

254

logger.debug("Unknown state: %r: %r", state, error)

218

255

def activate(self):

219

256

"""Derived from the Avahi example code"""

220

257

if self.server is None:

221

258

self.server = dbus.Interface(

222

259

self.bus.get_object(avahi.DBUS_NAME,

223

avahi.DBUS_PATH_SERVER),

260

avahi.DBUS_PATH_SERVER,

261

follow_name_owner_changes=True),

224

262

avahi.DBUS_INTERFACE_SERVER)

225

self.server.connect_to_signal(u"StateChanged",

263

self.server.connect_to_signal("StateChanged",

226

264

self.server_state_changed)

227

265

self.server_state_changed(self.server.GetState())

228

266

229

267

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

230

274

class Client(object):

231

275

"""A representation of a client host served by this server.

232

276

233

277

Attributes:

234

235

D-Bus identifiers

236

fingerprint: string (40 or 32 hexadecimal digits); used to

237

uniquely identify the client

238

secret: bytestring; sent verbatim (over TLS) to client

239

host: string; available for use by the checker command

240

created: datetime.datetime(); (UTC) object creation

241

last_enabled: datetime.datetime(); (UTC)

242

enabled: bool()

243

last_checked_ok: datetime.datetime(); (UTC) or None

244

timeout: datetime.timedelta(); How long from last_checked_ok

245

until this client is invalid

246

interval: datetime.timedelta(); How often to start a new checker

247

disable_hook: If set, called by disable() as disable_hook(self)

278

_approved: bool(); 'None' if not yet approved/disapproved

279

approval_delay: datetime.timedelta(); Time to wait for approval

280

approval_duration: datetime.timedelta(); Duration of one approval

248

281

checker: subprocess.Popen(); a running checker process used

249

282

to see if the client lives.

250

283

'None' if no process is running.

251

checker_initiator_tag: a gobject event source tag, or None

252

disable_initiator_tag: - '' -

253

checker_callback_tag: - '' -

254

checker_command: string; External command which is run to check if

255

client lives. %() expansions are done at

284

checker_callback_tag: a gobject event source tag, or None

285

checker_command: string; External command which is run to check

286

if client lives. %() expansions are done at

256

287

runtime with vars(self) as dict, so that for

257

288

instance %(name)s can be used in the command.

289

checker_initiator_tag: a gobject event source tag, or None

290

created: datetime.datetime(); (UTC) object creation

258

291

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

293

disable_initiator_tag: a gobject event source tag, or None

294

enabled: bool()

295

fingerprint: string (40 or 32 hexadecimal digits); used to

296

uniquely identify the client

297

host: string; available for use by the checker command

298

interval: datetime.timedelta(); How often to start a new checker

299

last_approval_request: datetime.datetime(); (UTC) or None

300

last_checked_ok: datetime.datetime(); (UTC) or None

301

last_enabled: datetime.datetime(); (UTC)

302

303

D-Bus identifiers

304

secret: bytestring; sent verbatim (over TLS) to client

305

timeout: datetime.timedelta(); How long from last_checked_ok

306

until this client is disabled

307

extended_timeout: extra long timeout when password has been sent

308

runtime_expansions: Allowed attributes for runtime expansion.

309

expires: datetime.datetime(); time (UTC) when a client will be

310

disabled, or None

259

311

"""

260

312

261

@staticmethod

262

def _timedelta_to_milliseconds(td):

263

"Convert a datetime.timedelta() to milliseconds"

264

return ((td.days * 24 * 60 * 60 * 1000)

265

+ (td.seconds * 1000)

266

+ (td.microseconds // 1000))

313

runtime_expansions = ("approval_delay", "approval_duration",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

316

"last_enabled", "name", "timeout")

267

317

268

318

def timeout_milliseconds(self):

269

319

"Return the 'timeout' attribute in milliseconds"

270

return self._timedelta_to_milliseconds(self.timeout)

320

return _timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

271

325

272

326

def interval_milliseconds(self):

273

327

"Return the 'interval' attribute in milliseconds"

274

return self._timedelta_to_milliseconds(self.interval)

328

return _timedelta_to_milliseconds(self.interval)

329

330

def approval_delay_milliseconds(self):

331

return _timedelta_to_milliseconds(self.approval_delay)

275

332

276

333

def __init__(self, name = None, disable_hook=None, config=None):

277

334

"""Note: the 'checker' key in 'config' sets the

280

337

self.name = name

281

338

if config is None:

282

339

config = {}

283

logger.debug(u"Creating client %r", self.name)

340

logger.debug("Creating client %r", self.name)

284

341

# Uppercase and remove spaces from fingerprint for later

285

342

# comparison purposes with return value from the fingerprint()

286

343

# function

287

self.fingerprint = (config[u"fingerprint"].upper()

288

.replace(u" ", u""))

289

logger.debug(u" Fingerprint: %s", self.fingerprint)

290

if u"secret" in config:

291

self.secret = config[u"secret"].decode(u"base64")

292

elif u"secfile" in config:

293

with closing(open(os.path.expanduser

294

(os.path.expandvars

295

(config[u"secfile"])))) as secfile:

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

350

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

352

"rb") as secfile:

296

353

self.secret = secfile.read()

297

354

else:

298

raise TypeError(u"No secret or secfile for client %s"

355

raise TypeError("No secret or secfile for client %s"

299

356

% self.name)

300

self.host = config.get(u"host", u"")

357

self.host = config.get("host", "")

301

358

self.created = datetime.datetime.utcnow()

302

359

self.enabled = False

360

self.last_approval_request = None

303

361

self.last_enabled = None

304

362

self.last_checked_ok = None

305

self.timeout = string_to_delta(config[u"timeout"])

306

self.interval = string_to_delta(config[u"interval"])

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

307

366

self.disable_hook = disable_hook

308

367

self.checker = None

309

368

self.checker_initiator_tag = None

310

369

self.disable_initiator_tag = None

370

self.expires = None

311

371

self.checker_callback_tag = None

312

self.checker_command = config[u"checker"]

372

self.checker_command = config["checker"]

313

373

self.current_checker_command = None

314

374

self.last_connect = None

375

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

377

True)

378

self.approvals_pending = 0

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

315

384

385

def send_changedstate(self):

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

316

390

def enable(self):

317

391

"""Start this client's checker and timeout hooks"""

318

if getattr(self, u"enabled", False):

392

if getattr(self, "enabled", False):

319

393

# Already enabled

320

394

return

321

self.last_enabled = datetime.datetime.utcnow()

395

self.send_changedstate()

322

396

# Schedule a new checker to be started an 'interval' from now,

323

397

# and every interval from then on.

324

398

self.checker_initiator_tag = (gobject.timeout_add

325

399

(self.interval_milliseconds(),

326

400

self.start_checker))

327

# Also start a new checker *right now*.

328

self.start_checker()

329

401

# Schedule a disable() when 'timeout' has passed

402

self.expires = datetime.datetime.utcnow() + self.timeout

330

403

self.disable_initiator_tag = (gobject.timeout_add

331

404

(self.timeout_milliseconds(),

332

405

self.disable))

333

406

self.enabled = True

407

self.last_enabled = datetime.datetime.utcnow()

408

# Also start a new checker *right now*.

409

self.start_checker()

334

410

335

def disable(self):

411

def disable(self, quiet=True):

336

412

"""Disable this client."""

337

413

if not getattr(self, "enabled", False):

338

414

return False

339

logger.info(u"Disabling client %s", self.name)

340

if getattr(self, u"disable_initiator_tag", False):

415

if not quiet:

416

self.send_changedstate()

417

if not quiet:

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

341

420

gobject.source_remove(self.disable_initiator_tag)

342

421

self.disable_initiator_tag = None

343

if getattr(self, u"checker_initiator_tag", False):

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

344

424

gobject.source_remove(self.checker_initiator_tag)

345

425

self.checker_initiator_tag = None

346

426

self.stop_checker()

361

441

if os.WIFEXITED(condition):

362

442

exitstatus = os.WEXITSTATUS(condition)

363

443

if exitstatus == 0:

364

logger.info(u"Checker for %(name)s succeeded",

444

logger.info("Checker for %(name)s succeeded",

365

445

vars(self))

366

446

self.checked_ok()

367

447

else:

368

logger.info(u"Checker for %(name)s failed",

448

logger.info("Checker for %(name)s failed",

369

449

vars(self))

370

450

else:

371

logger.warning(u"Checker for %(name)s crashed?",

451

logger.warning("Checker for %(name)s crashed?",

372

452

vars(self))

373

453

374

def checked_ok(self):

454

def checked_ok(self, timeout=None):

375

455

"""Bump up the timeout for this client.

376

456

377

457

This should only be called when the client has been seen,

378

458

alive and well.

379

459

"""

460

if timeout is None:

461

timeout = self.timeout

380

462

self.last_checked_ok = datetime.datetime.utcnow()

381

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

382

465

self.disable_initiator_tag = (gobject.timeout_add

383

(self.timeout_milliseconds(),

466

(_timedelta_to_milliseconds(timeout),

384

467

self.disable))

385

468

469

def need_approval(self):

470

self.last_approval_request = datetime.datetime.utcnow()

471

386

472

def start_checker(self):

387

473

"""Start a new checker subprocess if one is not running.

388

474

394

480

# client would inevitably timeout, since no checker would get

395

481

# a chance to run to completion. If we instead leave running

396

482

# checkers alone, the checker would have to take more time

397

# than 'timeout' for the client to be declared invalid, which

398

# is as it should be.

483

# than 'timeout' for the client to be disabled, which is as it

484

# should be.

399

485

400

486

# If a checker exists, make sure it is not a zombie

401

if self.checker is not None:

487

try:

402

488

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

489

except (AttributeError, OSError) as error:

490

if (isinstance(error, OSError)

491

and error.errno != errno.ECHILD):

492

raise error

493

else:

403

494

if pid:

404

logger.warning(u"Checker was a zombie")

495

logger.warning("Checker was a zombie")

405

496

gobject.source_remove(self.checker_callback_tag)

406

497

self.checker_callback(pid, status,

407

498

self.current_checker_command)

412

503

command = self.checker_command % self.host

413

504

except TypeError:

414

505

# Escape attributes for the shell

415

escaped_attrs = dict((key,

416

re.escape(unicode(str(val),

417

errors=

418

u'replace')))

419

for key, val in

420

vars(self).iteritems())

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

421

514

try:

422

515

command = self.checker_command % escaped_attrs

423

except TypeError, error:

424

logger.error(u'Could not format string "%s":'

425

u' %s', self.checker_command, error)

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

426

519

return True # Try again later

427

520

self.current_checker_command = command

428

521

try:

429

logger.info(u"Starting checker %r for %s",

522

logger.info("Starting checker %r for %s",

430

523

command, self.name)

431

524

# We don't need to redirect stdout and stderr, since

432

525

# in normal mode, that is already done by daemon(),

434

527

# always replaced by /dev/null.)

435

528

self.checker = subprocess.Popen(command,

436

529

close_fds=True,

437

shell=True, cwd=u"/")

530

shell=True, cwd="/")

438

531

self.checker_callback_tag = (gobject.child_watch_add

439

532

(self.checker.pid,

440

533

self.checker_callback,

445

538

if pid:

446

539

gobject.source_remove(self.checker_callback_tag)

447

540

self.checker_callback(pid, status, command)

448

except OSError, error:

449

logger.error(u"Failed to start subprocess: %s",

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

450

543

error)

451

544

# Re-run this periodically if run by gobject.timeout_add

452

545

return True

456

549

if self.checker_callback_tag:

457

550

gobject.source_remove(self.checker_callback_tag)

458

551

self.checker_callback_tag = None

459

if getattr(self, u"checker", None) is None:

552

if getattr(self, "checker", None) is None:

460

553

return

461

logger.debug(u"Stopping checker for %(name)s", vars(self))

554

logger.debug("Stopping checker for %(name)s", vars(self))

462

555

try:

463

556

os.kill(self.checker.pid, signal.SIGTERM)

464

#os.sleep(0.5)

557

#time.sleep(0.5)

465

558

#if self.checker.poll() is None:

466

559

# os.kill(self.checker.pid, signal.SIGKILL)

467

except OSError, error:

560

except OSError as error:

468

561

if error.errno != errno.ESRCH: # No such process

469

562

raise

470

563

self.checker = None

471

472

def still_valid(self):

473

"""Has the timeout not yet passed for this client?"""

474

if not getattr(self, u"enabled", False):

475

return False

476

now = datetime.datetime.utcnow()

477

if self.last_checked_ok is None:

478

return now < (self.created + self.timeout)

479

else:

480

return now < (self.last_checked_ok + self.timeout)

481

482

483

def dbus_service_property(dbus_interface, signature=u"v",

484

access=u"readwrite", byte_arrays=False):

564

565

566

def dbus_service_property(dbus_interface, signature="v",

567

access="readwrite", byte_arrays=False):

485

568

"""Decorators for marking methods of a DBusObjectWithProperties to

486

569

become properties on the D-Bus.

487

570

492

575

dbus.service.method, except there is only "signature", since the

493

576

type from Get() and the type sent to Set() is the same.

494

577

"""

578

# Encoding deeply encoded byte arrays is not supported yet by the

579

# "Set" method, so we fail early here:

580

if byte_arrays and signature != "ay":

581

raise ValueError("Byte arrays not supported for non-'ay'"

582

" signature %r" % signature)

495

583

def decorator(func):

496

584

func._dbus_is_property = True

497

585

func._dbus_interface = dbus_interface

498

586

func._dbus_signature = signature

499

587

func._dbus_access = access

500

588

func._dbus_name = func.__name__

501

if func._dbus_name.endswith(u"_dbus_property"):

589

if func._dbus_name.endswith("_dbus_property"):

502

590

func._dbus_name = func._dbus_name[:-14]

503

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

591

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

504

592

return func

505

593

return decorator

506

594

526

614

527

615

class DBusObjectWithProperties(dbus.service.Object):

528

616

"""A D-Bus object with properties.

529

617

530

618

Classes inheriting from this can use the dbus_service_property

531

619

decorator to expose methods as D-Bus properties. It exposes the

532

620

standard Get(), Set(), and GetAll() methods on the D-Bus.

534

622

535

623

@staticmethod

536

624

def _is_dbus_property(obj):

537

return getattr(obj, u"_dbus_is_property", False)

625

return getattr(obj, "_dbus_is_property", False)

538

626

539

627

def _get_all_dbus_properties(self):

540

628

"""Returns a generator of (name, attribute) pairs

541

629

"""

542

return ((prop._dbus_name, prop)

543

for name, prop in

544

inspect.getmembers(self, self._is_dbus_property))

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

631

for cls in self.__class__.__mro__

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

545

633

546

634

def _get_dbus_property(self, interface_name, property_name):

547

635

"""Returns a bound method if one exists which is a D-Bus

548

636

property with the specified name and interface.

549

637

"""

550

for name in (property_name,

551

property_name + u"_dbus_property"):

552

prop = getattr(self, name, None)

553

if (prop is None

554

or not self._is_dbus_property(prop)

555

or prop._dbus_name != property_name

556

or (interface_name and prop._dbus_interface

557

and interface_name != prop._dbus_interface)):

558

continue

559

return prop

638

for cls in self.__class__.__mro__:

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

641

return value.__get__(self)

642

560

643

# No such property

561

raise DBusPropertyNotFound(self.dbus_object_path + u":"

562

+ interface_name + u"."

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

645

+ interface_name + "."

563

646

+ property_name)

564

647

565

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

566

out_signature=u"v")

648

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

649

out_signature="v")

567

650

def Get(self, interface_name, property_name):

568

651

"""Standard D-Bus property Get() method, see D-Bus standard.

569

652

"""

570

653

prop = self._get_dbus_property(interface_name, property_name)

571

if prop._dbus_access == u"write":

654

if prop._dbus_access == "write":

572

655

raise DBusPropertyAccessException(property_name)

573

656

value = prop()

574

if not hasattr(value, u"variant_level"):

657

if not hasattr(value, "variant_level"):

575

658

return value

576

659

return type(value)(value, variant_level=value.variant_level+1)

577

660

578

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

661

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

579

662

def Set(self, interface_name, property_name, value):

580

663

"""Standard D-Bus property Set() method, see D-Bus standard.

581

664

"""

582

665

prop = self._get_dbus_property(interface_name, property_name)

583

if prop._dbus_access == u"read":

666

if prop._dbus_access == "read":

584

667

raise DBusPropertyAccessException(property_name)

585

if prop._dbus_get_args_options[u"byte_arrays"]:

668

if prop._dbus_get_args_options["byte_arrays"]:

669

# The byte_arrays option is not supported yet on

670

# signatures other than "ay".

671

if prop._dbus_signature != "ay":

672

raise ValueError

586

673

value = dbus.ByteArray(''.join(unichr(byte)

587

674

for byte in value))

588

675

prop(value)

589

676

590

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

591

out_signature=u"a{sv}")

677

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

678

out_signature="a{sv}")

592

679

def GetAll(self, interface_name):

593

680

"""Standard D-Bus property GetAll() method, see D-Bus

594

681

standard.

595

682

596

683

Note: Will not include properties with access="write".

597

684

"""

598

685

all = {}

602

689

# Interface non-empty but did not match

603

690

continue

604

691

# Ignore write-only properties

605

if prop._dbus_access == u"write":

692

if prop._dbus_access == "write":

606

693

continue

607

694

value = prop()

608

if not hasattr(value, u"variant_level"):

695

if not hasattr(value, "variant_level"):

609

696

all[name] = value

610

697

continue

611

698

all[name] = type(value)(value, variant_level=

612

699

value.variant_level+1)

613

return dbus.Dictionary(all, signature=u"sv")

700

return dbus.Dictionary(all, signature="sv")

614

701

615

702

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

616

out_signature=u"s",

703

out_signature="s",

617

704

path_keyword='object_path',

618

705

connection_keyword='connection')

619

706

def Introspect(self, object_path, connection):

620

707

"""Standard D-Bus method, overloaded to insert property tags.

621

708

"""

622

709

xmlstring = dbus.service.Object.Introspect(self, object_path,

623

connection)

624

document = xml.dom.minidom.parseString(xmlstring)

625

del xmlstring

626

def make_tag(document, name, prop):

627

e = document.createElement(u"property")

628

e.setAttribute(u"name", name)

629

e.setAttribute(u"type", prop._dbus_signature)

630

e.setAttribute(u"access", prop._dbus_access)

631

return e

632

for if_tag in document.getElementsByTagName(u"interface"):

633

for tag in (make_tag(document, name, prop)

634

for name, prop

635

in self._get_all_dbus_properties()

636

if prop._dbus_interface

637

== if_tag.getAttribute(u"name")):

638

if_tag.appendChild(tag)

639

xmlstring = document.toxml(u"utf-8")

640

document.unlink()

710

connection)

711

try:

712

document = xml.dom.minidom.parseString(xmlstring)

713

def make_tag(document, name, prop):

714

e = document.createElement("property")

715

e.setAttribute("name", name)

716

e.setAttribute("type", prop._dbus_signature)

717

e.setAttribute("access", prop._dbus_access)

718

return e

719

for if_tag in document.getElementsByTagName("interface"):

720

for tag in (make_tag(document, name, prop)

721

for name, prop

722

in self._get_all_dbus_properties()

723

if prop._dbus_interface

724

== if_tag.getAttribute("name")):

725

if_tag.appendChild(tag)

726

# Add the names to the return values for the

727

# "org.freedesktop.DBus.Properties" methods

728

if (if_tag.getAttribute("name")

729

== "org.freedesktop.DBus.Properties"):

730

for cn in if_tag.getElementsByTagName("method"):

731

if cn.getAttribute("name") == "Get":

732

for arg in cn.getElementsByTagName("arg"):

733

if (arg.getAttribute("direction")

734

== "out"):

735

arg.setAttribute("name", "value")

736

elif cn.getAttribute("name") == "GetAll":

737

for arg in cn.getElementsByTagName("arg"):

738

if (arg.getAttribute("direction")

739

== "out"):

740

arg.setAttribute("name", "props")

741

xmlstring = document.toxml("utf-8")

742

document.unlink()

743

except (AttributeError, xml.dom.DOMException,

744

xml.parsers.expat.ExpatError) as error:

745

logger.error("Failed to override Introspection method",

746

error)

641

747

return xmlstring

642

748

643

749

750

def datetime_to_dbus (dt, variant_level=0):

751

"""Convert a UTC datetime.datetime() to a D-Bus type."""

752

if dt is None:

753

return dbus.String("", variant_level = variant_level)

754

return dbus.String(dt.isoformat(),

755

variant_level=variant_level)

756

757

class AlternateDBusNamesMetaclass(DBusObjectWithProperties.__metaclass__):

758

"""Applied to an empty subclass of a D-Bus object, this metaclass

759

will add additional D-Bus attributes matching a certain pattern.

760

"""

761

def __new__(mcs, name, bases, attr):

762

# Go through all the base classes which could have D-Bus

763

# methods, signals, or properties in them

764

for base in (b for b in bases

765

if issubclass(b, dbus.service.Object)):

766

# Go though all attributes of the base class

767

for attrname, attribute in inspect.getmembers(base):

768

# Ignore non-D-Bus attributes, and D-Bus attributes

769

# with the wrong interface name

770

if (not hasattr(attribute, "_dbus_interface")

771

or not attribute._dbus_interface

772

.startswith("se.recompile.Mandos")):

773

continue

774

# Create an alternate D-Bus interface name based on

775

# the current name

776

alt_interface = (attribute._dbus_interface

777

.replace("se.recompile.Mandos",

778

"se.bsnet.fukt.Mandos"))

779

# Is this a D-Bus signal?

780

if getattr(attribute, "_dbus_is_signal", False):

781

# Extract the original non-method function by

782

# black magic

783

nonmethod_func = (dict(

784

zip(attribute.func_code.co_freevars,

785

attribute.__closure__))["func"]

786

.cell_contents)

787

# Create a new, but exactly alike, function

788

# object, and decorate it to be a new D-Bus signal

789

# with the alternate D-Bus interface name

790

new_function = (dbus.service.signal

791

(alt_interface,

792

attribute._dbus_signature)

793

(types.FunctionType(

794

nonmethod_func.func_code,

795

nonmethod_func.func_globals,

796

nonmethod_func.func_name,

797

nonmethod_func.func_defaults,

798

nonmethod_func.func_closure)))

799

# Define a creator of a function to call both the

800

# old and new functions, so both the old and new

801

# signals gets sent when the function is called

802

def fixscope(func1, func2):

803

"""This function is a scope container to pass

804

func1 and func2 to the "call_both" function

805

outside of its arguments"""

806

def call_both(*args, **kwargs):

807

"""This function will emit two D-Bus

808

signals by calling func1 and func2"""

809

func1(*args, **kwargs)

810

func2(*args, **kwargs)

811

return call_both

812

# Create the "call_both" function and add it to

813

# the class

814

attr[attrname] = fixscope(attribute,

815

new_function)

816

# Is this a D-Bus method?

817

elif getattr(attribute, "_dbus_is_method", False):

818

# Create a new, but exactly alike, function

819

# object. Decorate it to be a new D-Bus method

820

# with the alternate D-Bus interface name. Add it

821

# to the class.

822

attr[attrname] = (dbus.service.method

823

(alt_interface,

824

attribute._dbus_in_signature,

825

attribute._dbus_out_signature)

826

(types.FunctionType

827

(attribute.func_code,

828

attribute.func_globals,

829

attribute.func_name,

830

attribute.func_defaults,

831

attribute.func_closure)))

832

# Is this a D-Bus property?

833

elif getattr(attribute, "_dbus_is_property", False):

834

# Create a new, but exactly alike, function

835

# object, and decorate it to be a new D-Bus

836

# property with the alternate D-Bus interface

837

# name. Add it to the class.

838

attr[attrname] = (dbus_service_property

839

(alt_interface,

840

attribute._dbus_signature,

841

attribute._dbus_access,

842

attribute

843

._dbus_get_args_options

844

["byte_arrays"])

845

(types.FunctionType

846

(attribute.func_code,

847

attribute.func_globals,

848

attribute.func_name,

849

attribute.func_defaults,

850

attribute.func_closure)))

851

return type.__new__(mcs, name, bases, attr)

852

644

853

class ClientDBus(Client, DBusObjectWithProperties):

645

854

"""A Client class using D-Bus

646

855

648

857

dbus_object_path: dbus.ObjectPath

649

858

bus: dbus.SystemBus()

650

859

"""

860

861

runtime_expansions = (Client.runtime_expansions

862

+ ("dbus_object_path",))

863

651

864

# dbus.service.Object doesn't use super(), so we can't either.

652

865

653

866

def __init__(self, bus = None, *args, **kwargs):

867

self._approvals_pending = 0

654

868

self.bus = bus

655

869

Client.__init__(self, *args, **kwargs)

656

870

# Only now, when this client is initialized, can it show up on

657

871

# the D-Bus

872

client_object_name = unicode(self.name).translate(

873

{ord("."): ord("_"),

874

ord("-"): ord("_")})

658

875

self.dbus_object_path = (dbus.ObjectPath

659

(u"/clients/"

660

+ self.name.replace(u".", u"_")))

876

("/clients/" + client_object_name))

661

877

DBusObjectWithProperties.__init__(self, self.bus,

662

878

self.dbus_object_path)

663

664

@staticmethod

665

def _datetime_to_dbus(dt, variant_level=0):

666

"""Convert a UTC datetime.datetime() to a D-Bus type."""

667

return dbus.String(dt.isoformat(),

668

variant_level=variant_level)

669

670

def enable(self):

671

oldstate = getattr(self, u"enabled", False)

672

r = Client.enable(self)

673

if oldstate != self.enabled:

674

# Emit D-Bus signals

675

self.PropertyChanged(dbus.String(u"enabled"),

676

dbus.Boolean(True, variant_level=1))

677

self.PropertyChanged(

678

dbus.String(u"last_enabled"),

679

self._datetime_to_dbus(self.last_enabled,

680

variant_level=1))

681

return r

682

683

def disable(self, signal = True):

684

oldstate = getattr(self, u"enabled", False)

685

r = Client.disable(self)

686

if signal and oldstate != self.enabled:

687

# Emit D-Bus signal

688

self.PropertyChanged(dbus.String(u"enabled"),

689

dbus.Boolean(False, variant_level=1))

690

return r

879

880

def notifychangeproperty(transform_func,

881

dbus_name, type_func=lambda x: x,

882

variant_level=1):

883

""" Modify a variable so that it's a property which announces

884

its changes to DBus.

885

886

transform_fun: Function that takes a value and transforms it

887

to a D-Bus type.

888

dbus_name: D-Bus name of the variable

889

type_func: Function that transform the value before sending it

890

to the D-Bus. Default: no transform

891

variant_level: D-Bus variant level. Default: 1

892

"""

893

real_value = [None,]

894

def setter(self, value):

895

old_value = real_value[0]

896

real_value[0] = value

897

if hasattr(self, "dbus_object_path"):

898

if type_func(old_value) != type_func(real_value[0]):

899

dbus_value = transform_func(type_func(real_value[0]),

900

variant_level)

901

self.PropertyChanged(dbus.String(dbus_name),

902

dbus_value)

903

904

return property(lambda self: real_value[0], setter)

905

906

907

expires = notifychangeproperty(datetime_to_dbus, "Expires")

908

approvals_pending = notifychangeproperty(dbus.Boolean,

909

"ApprovalPending",

910

type_func = bool)

911

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

912

last_enabled = notifychangeproperty(datetime_to_dbus,

913

"LastEnabled")

914

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

915

type_func = lambda checker: checker is not None)

916

last_checked_ok = notifychangeproperty(datetime_to_dbus,

917

"LastCheckedOK")

918

last_approval_request = notifychangeproperty(datetime_to_dbus,

919

"LastApprovalRequest")

920

approved_by_default = notifychangeproperty(dbus.Boolean,

921

"ApprovedByDefault")

922

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

923

type_func = _timedelta_to_milliseconds)

924

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

925

type_func = _timedelta_to_milliseconds)

926

host = notifychangeproperty(dbus.String, "Host")

927

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

928

type_func = _timedelta_to_milliseconds)

929

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

930

type_func = _timedelta_to_milliseconds)

931

interval = notifychangeproperty(dbus.UInt16, "Interval",

932

type_func = _timedelta_to_milliseconds)

933

checker_command = notifychangeproperty(dbus.String, "Checker")

934

935

del notifychangeproperty

691

936

692

937

def __del__(self, *args, **kwargs):

693

938

try:

694

939

self.remove_from_connection()

695

940

except LookupError:

696

941

pass

697

if hasattr(DBusObjectWithProperties, u"__del__"):

942

if hasattr(DBusObjectWithProperties, "__del__"):

698

943

DBusObjectWithProperties.__del__(self, *args, **kwargs)

699

944

Client.__del__(self, *args, **kwargs)

700

945

702

947

*args, **kwargs):

703

948

self.checker_callback_tag = None

704

949

self.checker = None

705

# Emit D-Bus signal

706

self.PropertyChanged(dbus.String(u"checker_running"),

707

dbus.Boolean(False, variant_level=1))

708

950

if os.WIFEXITED(condition):

709

951

exitstatus = os.WEXITSTATUS(condition)

710

952

# Emit D-Bus signal

720

962

return Client.checker_callback(self, pid, condition, command,

721

963

*args, **kwargs)

722

964

723

def checked_ok(self, *args, **kwargs):

724

r = Client.checked_ok(self, *args, **kwargs)

725

# Emit D-Bus signal

726

self.PropertyChanged(

727

dbus.String(u"last_checked_ok"),

728

(self._datetime_to_dbus(self.last_checked_ok,

729

variant_level=1)))

730

return r

731

732

965

def start_checker(self, *args, **kwargs):

733

966

old_checker = self.checker

734

967

if self.checker is not None:

741

974

and old_checker_pid != self.checker.pid):

742

975

# Emit D-Bus signal

743

976

self.CheckerStarted(self.current_checker_command)

744

self.PropertyChanged(

745

dbus.String(u"checker_running"),

746

dbus.Boolean(True, variant_level=1))

747

return r

748

749

def stop_checker(self, *args, **kwargs):

750

old_checker = getattr(self, u"checker", None)

751

r = Client.stop_checker(self, *args, **kwargs)

752

if (old_checker is not None

753

and getattr(self, u"checker", None) is None):

754

self.PropertyChanged(dbus.String(u"checker_running"),

755

dbus.Boolean(False, variant_level=1))

756

return r

757

758

## D-Bus methods & signals

759

_interface = u"se.bsnet.fukt.Mandos.Client"

977

return r

978

979

def _reset_approved(self):

980

self._approved = None

981

return False

982

983

def approve(self, value=True):

984

self.send_changedstate()

985

self._approved = value

986

gobject.timeout_add(_timedelta_to_milliseconds

987

(self.approval_duration),

988

self._reset_approved)

989

990

991

## D-Bus methods, signals & properties

992

_interface = "se.recompile.Mandos.Client"

993

994

## Signals

760

995

761

996

# CheckerCompleted - signal

762

@dbus.service.signal(_interface, signature=u"nxs")

997

@dbus.service.signal(_interface, signature="nxs")

763

998

def CheckerCompleted(self, exitcode, waitstatus, command):

764

999

"D-Bus signal"

765

1000

pass

766

1001

767

1002

# CheckerStarted - signal

768

@dbus.service.signal(_interface, signature=u"s")

1003

@dbus.service.signal(_interface, signature="s")

769

1004

def CheckerStarted(self, command):

770

1005

"D-Bus signal"

771

1006

pass

772

1007

773

1008

# PropertyChanged - signal

774

@dbus.service.signal(_interface, signature=u"sv")

1009

@dbus.service.signal(_interface, signature="sv")

775

1010

def PropertyChanged(self, property, value):

776

1011

"D-Bus signal"

777

1012

pass

778

1013

779

# ReceivedSecret - signal

1014

# GotSecret - signal

780

1015

@dbus.service.signal(_interface)

781

def ReceivedSecret(self):

782

"D-Bus signal"

1016

def GotSecret(self):

1017

"""D-Bus signal

1018

Is sent after a successful transfer of secret from the Mandos

1019

server to mandos-client

1020

"""

783

1021

pass

784

1022

785

1023

# Rejected - signal

786

@dbus.service.signal(_interface)

787

def Rejected(self):

1024

@dbus.service.signal(_interface, signature="s")

1025

def Rejected(self, reason):

788

1026

"D-Bus signal"

789

1027

pass

790

1028

791

# name - property

792

@dbus_service_property(_interface, signature=u"s", access=u"read")

793

def name_dbus_property(self):

1029

# NeedApproval - signal

1030

@dbus.service.signal(_interface, signature="tb")

1031

def NeedApproval(self, timeout, default):

1032

"D-Bus signal"

1033

return self.need_approval()

1034

1035

## Methods

1036

1037

# Approve - method

1038

@dbus.service.method(_interface, in_signature="b")

1039

def Approve(self, value):

1040

self.approve(value)

1041

1042

# CheckedOK - method

1043

@dbus.service.method(_interface)

1044

def CheckedOK(self):

1045

self.checked_ok()

1046

1047

# Enable - method

1048

@dbus.service.method(_interface)

1049

def Enable(self):

1050

"D-Bus method"

1051

self.enable()

1052

1053

# StartChecker - method

1054

@dbus.service.method(_interface)

1055

def StartChecker(self):

1056

"D-Bus method"

1057

self.start_checker()

1058

1059

# Disable - method

1060

@dbus.service.method(_interface)

1061

def Disable(self):

1062

"D-Bus method"

1063

self.disable()

1064

1065

# StopChecker - method

1066

@dbus.service.method(_interface)

1067

def StopChecker(self):

1068

self.stop_checker()

1069

1070

## Properties

1071

1072

# ApprovalPending - property

1073

@dbus_service_property(_interface, signature="b", access="read")

1074

def ApprovalPending_dbus_property(self):

1075

return dbus.Boolean(bool(self.approvals_pending))

1076

1077

# ApprovedByDefault - property

1078

@dbus_service_property(_interface, signature="b",

1079

access="readwrite")

1080

def ApprovedByDefault_dbus_property(self, value=None):

1081

if value is None: # get

1082

return dbus.Boolean(self.approved_by_default)

1083

self.approved_by_default = bool(value)

1084

1085

# ApprovalDelay - property

1086

@dbus_service_property(_interface, signature="t",

1087

access="readwrite")

1088

def ApprovalDelay_dbus_property(self, value=None):

1089

if value is None: # get

1090

return dbus.UInt64(self.approval_delay_milliseconds())

1091

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1092

1093

# ApprovalDuration - property

1094

@dbus_service_property(_interface, signature="t",

1095

access="readwrite")

1096

def ApprovalDuration_dbus_property(self, value=None):

1097

if value is None: # get

1098

return dbus.UInt64(_timedelta_to_milliseconds(

1099

self.approval_duration))

1100

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1101

1102

# Name - property

1103

@dbus_service_property(_interface, signature="s", access="read")

1104

def Name_dbus_property(self):

794

1105

return dbus.String(self.name)

795

1106

796

# fingerprint - property

797

@dbus_service_property(_interface, signature=u"s", access=u"read")

798

def fingerprint_dbus_property(self):

1107

# Fingerprint - property

1108

@dbus_service_property(_interface, signature="s", access="read")

1109

def Fingerprint_dbus_property(self):

799

1110

return dbus.String(self.fingerprint)

800

1111

801

# host - property

802

@dbus_service_property(_interface, signature=u"s",

803

access=u"readwrite")

804

def host_dbus_property(self, value=None):

1112

# Host - property

1113

@dbus_service_property(_interface, signature="s",

1114

access="readwrite")

1115

def Host_dbus_property(self, value=None):

805

1116

if value is None: # get

806

1117

return dbus.String(self.host)

807

1118

self.host = value

808

# Emit D-Bus signal

809

self.PropertyChanged(dbus.String(u"host"),

810

dbus.String(value, variant_level=1))

811

812

# created - property

813

@dbus_service_property(_interface, signature=u"s", access=u"read")

814

def created_dbus_property(self):

815

return dbus.String(self._datetime_to_dbus(self.created))

816

817

# last_enabled - property

818

@dbus_service_property(_interface, signature=u"s", access=u"read")

819

def last_enabled_dbus_property(self):

820

if self.last_enabled is None:

821

return dbus.String(u"")

822

return dbus.String(self._datetime_to_dbus(self.last_enabled))

823

824

# enabled - property

825

@dbus_service_property(_interface, signature=u"b",

826

access=u"readwrite")

827

def enabled_dbus_property(self, value=None):

1119

1120

# Created - property

1121

@dbus_service_property(_interface, signature="s", access="read")

1122

def Created_dbus_property(self):

1123

return dbus.String(datetime_to_dbus(self.created))

1124

1125

# LastEnabled - property

1126

@dbus_service_property(_interface, signature="s", access="read")

1127

def LastEnabled_dbus_property(self):

1128

return datetime_to_dbus(self.last_enabled)

1129

1130

# Enabled - property

1131

@dbus_service_property(_interface, signature="b",

1132

access="readwrite")

1133

def Enabled_dbus_property(self, value=None):

828

1134

if value is None: # get

829

1135

return dbus.Boolean(self.enabled)

830

1136

if value:

832

1138

else:

833

1139

self.disable()

834

1140

835

# last_checked_ok - property

836

@dbus_service_property(_interface, signature=u"s", access=u"read")

837

def last_checked_ok_dbus_property(self):

838

if self.last_checked_ok is None:

839

return dbus.String(u"")

840

return dbus.String(self._datetime_to_dbus(self

841

.last_checked_ok))

842

843

# timeout - property

844

@dbus_service_property(_interface, signature=u"t",

845

access=u"readwrite")

846

def timeout_dbus_property(self, value=None):

1141

# LastCheckedOK - property

1142

@dbus_service_property(_interface, signature="s",

1143

access="readwrite")

1144

def LastCheckedOK_dbus_property(self, value=None):

1145

if value is not None:

1146

self.checked_ok()

1147

return

1148

return datetime_to_dbus(self.last_checked_ok)

1149

1150

# Expires - property

1151

@dbus_service_property(_interface, signature="s", access="read")

1152

def Expires_dbus_property(self):

1153

return datetime_to_dbus(self.expires)

1154

1155

# LastApprovalRequest - property

1156

@dbus_service_property(_interface, signature="s", access="read")

1157

def LastApprovalRequest_dbus_property(self):

1158

return datetime_to_dbus(self.last_approval_request)

1159

1160

# Timeout - property

1161

@dbus_service_property(_interface, signature="t",

1162

access="readwrite")

1163

def Timeout_dbus_property(self, value=None):

847

1164

if value is None: # get

848

1165

return dbus.UInt64(self.timeout_milliseconds())

849

1166

self.timeout = datetime.timedelta(0, 0, 0, value)

850

# Emit D-Bus signal

851

self.PropertyChanged(dbus.String(u"timeout"),

852

dbus.UInt64(value, variant_level=1))

853

if getattr(self, u"disable_initiator_tag", None) is None:

1167

if getattr(self, "disable_initiator_tag", None) is None:

854

1168

return

855

1169

# Reschedule timeout

856

1170

gobject.source_remove(self.disable_initiator_tag)

857

1171

self.disable_initiator_tag = None

1172

self.expires = None

858

1173

time_to_die = (self.

859

1174

_timedelta_to_milliseconds((self

860

1175

.last_checked_ok

865

1180

# The timeout has passed

866

1181

self.disable()

867

1182

else:

1183

self.expires = (datetime.datetime.utcnow()

1184

+ datetime.timedelta(milliseconds = time_to_die))

868

1185

self.disable_initiator_tag = (gobject.timeout_add

869

1186

(time_to_die, self.disable))

870

1187

871

# interval - property

872

@dbus_service_property(_interface, signature=u"t",

873

access=u"readwrite")

874

def interval_dbus_property(self, value=None):

1188

# ExtendedTimeout - property

1189

@dbus_service_property(_interface, signature="t",

1190

access="readwrite")

1191

def ExtendedTimeout_dbus_property(self, value=None):

1192

if value is None: # get

1193

return dbus.UInt64(self.extended_timeout_milliseconds())

1194

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1195

1196

# Interval - property

1197

@dbus_service_property(_interface, signature="t",

1198

access="readwrite")

1199

def Interval_dbus_property(self, value=None):

875

1200

if value is None: # get

876

1201

return dbus.UInt64(self.interval_milliseconds())

877

1202

self.interval = datetime.timedelta(0, 0, 0, value)

878

# Emit D-Bus signal

879

self.PropertyChanged(dbus.String(u"interval"),

880

dbus.UInt64(value, variant_level=1))

881

if getattr(self, u"checker_initiator_tag", None) is None:

1203

if getattr(self, "checker_initiator_tag", None) is None:

882

1204

return

883

1205

# Reschedule checker run

884

1206

gobject.source_remove(self.checker_initiator_tag)

885

1207

self.checker_initiator_tag = (gobject.timeout_add

886

1208

(value, self.start_checker))

887

1209

self.start_checker() # Start one now, too

888

889

# checker - property

890

@dbus_service_property(_interface, signature=u"s",

891

access=u"readwrite")

892

def checker_dbus_property(self, value=None):

1210

1211

# Checker - property

1212

@dbus_service_property(_interface, signature="s",

1213

access="readwrite")

1214

def Checker_dbus_property(self, value=None):

893

1215

if value is None: # get

894

1216

return dbus.String(self.checker_command)

895

1217

self.checker_command = value

896

# Emit D-Bus signal

897

self.PropertyChanged(dbus.String(u"checker"),

898

dbus.String(self.checker_command,

899

variant_level=1))

900

1218

901

# checker_running - property

902

@dbus_service_property(_interface, signature=u"b",

903

access=u"readwrite")

904

def checker_running_dbus_property(self, value=None):

1219

# CheckerRunning - property

1220

@dbus_service_property(_interface, signature="b",

1221

access="readwrite")

1222

def CheckerRunning_dbus_property(self, value=None):

905

1223

if value is None: # get

906

1224

return dbus.Boolean(self.checker is not None)

907

1225

if value:

909

1227

else:

910

1228

self.stop_checker()

911

1229

912

# object_path - property

913

@dbus_service_property(_interface, signature=u"o", access=u"read")

914

def object_path_dbus_property(self):

1230

# ObjectPath - property

1231

@dbus_service_property(_interface, signature="o", access="read")

1232

def ObjectPath_dbus_property(self):

915

1233

return self.dbus_object_path # is already a dbus.ObjectPath

916

1234

917

# secret = property xxx

918

@dbus_service_property(_interface, signature=u"ay",

919

access=u"write", byte_arrays=True)

920

def secret_dbus_property(self, value):

1235

# Secret = property

1236

@dbus_service_property(_interface, signature="ay",

1237

access="write", byte_arrays=True)

1238

def Secret_dbus_property(self, value):

921

1239

self.secret = str(value)

922

1240

923

1241

del _interface

924

1242

925

1243

1244

class ProxyClient(object):

1245

def __init__(self, child_pipe, fpr, address):

1246

self._pipe = child_pipe

1247

self._pipe.send(('init', fpr, address))

1248

if not self._pipe.recv():

1249

raise KeyError()

1250

1251

def __getattribute__(self, name):

1252

if(name == '_pipe'):

1253

return super(ProxyClient, self).__getattribute__(name)

1254

self._pipe.send(('getattr', name))

1255

data = self._pipe.recv()

1256

if data[0] == 'data':

1257

return data[1]

1258

if data[0] == 'function':

1259

def func(*args, **kwargs):

1260

self._pipe.send(('funcall', name, args, kwargs))

1261

return self._pipe.recv()[1]

1262

return func

1263

1264

def __setattr__(self, name, value):

1265

if(name == '_pipe'):

1266

return super(ProxyClient, self).__setattr__(name, value)

1267

self._pipe.send(('setattr', name, value))

1268

1269

class ClientDBusTransitional(ClientDBus):

1270

__metaclass__ = AlternateDBusNamesMetaclass

1271

926

1272

class ClientHandler(socketserver.BaseRequestHandler, object):

927

1273

"""A class to handle client connections.

928

1274

930

1276

Note: This will run in its own forked process."""

931

1277

932

1278

def handle(self):

933

logger.info(u"TCP connection from: %s",

934

unicode(self.client_address))

935

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

936

# Open IPC pipe to parent process

937

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

1279

with contextlib.closing(self.server.child_pipe) as child_pipe:

1280

logger.info("TCP connection from: %s",

1281

unicode(self.client_address))

1282

logger.debug("Pipe FD: %d",

1283

self.server.child_pipe.fileno())

1284

938

1285

session = (gnutls.connection

939

1286

.ClientSession(self.request,

940

1287

gnutls.connection

941

1288

.X509Credentials()))

942

1289

943

line = self.request.makefile().readline()

944

logger.debug(u"Protocol version: %r", line)

945

try:

946

if int(line.strip().split()[0]) > 1:

947

raise RuntimeError

948

except (ValueError, IndexError, RuntimeError), error:

949

logger.error(u"Unknown protocol version: %s", error)

950

return

951

952

1290

# Note: gnutls.connection.X509Credentials is really a

953

1291

# generic GnuTLS certificate credentials object so long as

954

1292

# no X.509 keys are added to it. Therefore, we can use it

955

1293

# here despite using OpenPGP certificates.

956

1294

957

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

958

# u"+AES-256-CBC", u"+SHA1",

959

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

960

# u"+DHE-DSS"))

1295

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1296

# "+AES-256-CBC", "+SHA1",

1297

# "+COMP-NULL", "+CTYPE-OPENPGP",

1298

# "+DHE-DSS"))

961

1299

# Use a fallback default, since this MUST be set.

962

1300

priority = self.server.gnutls_priority

963

1301

if priority is None:

964

priority = u"NORMAL"

1302

priority = "NORMAL"

965

1303

(gnutls.library.functions

966

1304

.gnutls_priority_set_direct(session._c_object,

967

1305

priority, None))

968

1306

1307

# Start communication using the Mandos protocol

1308

# Get protocol number

1309

line = self.request.makefile().readline()

1310

logger.debug("Protocol version: %r", line)

1311

try:

1312

if int(line.strip().split()[0]) > 1:

1313

raise RuntimeError

1314

except (ValueError, IndexError, RuntimeError) as error:

1315

logger.error("Unknown protocol version: %s", error)

1316

return

1317

1318

# Start GnuTLS connection

969

1319

try:

970

1320

session.handshake()

971

except gnutls.errors.GNUTLSError, error:

972

logger.warning(u"Handshake failed: %s", error)

1321

except gnutls.errors.GNUTLSError as error:

1322

logger.warning("Handshake failed: %s", error)

973

1323

# Do not run session.bye() here: the session is not

974

1324

# established. Just abandon the request.

975

1325

return

976

logger.debug(u"Handshake succeeded")

1326

logger.debug("Handshake succeeded")

1327

1328

approval_required = False

977

1329

try:

978

fpr = self.fingerprint(self.peer_certificate(session))

979

except (TypeError, gnutls.errors.GNUTLSError), error:

980

logger.warning(u"Bad certificate: %s", error)

981

session.bye()

982

return

983

logger.debug(u"Fingerprint: %s", fpr)

1330

try:

1331

fpr = self.fingerprint(self.peer_certificate

1332

(session))

1333

except (TypeError,

1334

gnutls.errors.GNUTLSError) as error:

1335

logger.warning("Bad certificate: %s", error)

1336

return

1337

logger.debug("Fingerprint: %s", fpr)

1338

1339

try:

1340

client = ProxyClient(child_pipe, fpr,

1341

self.client_address)

1342

except KeyError:

1343

return

1344

1345

if client.approval_delay:

1346

delay = client.approval_delay

1347

client.approvals_pending += 1

1348

approval_required = True

1349

1350

while True:

1351

if not client.enabled:

1352

logger.info("Client %s is disabled",

1353

client.name)

1354

if self.server.use_dbus:

1355

# Emit D-Bus signal

1356

client.Rejected("Disabled")

1357

return

1358

1359

if client._approved or not client.approval_delay:

1360

#We are approved or approval is disabled

1361

break

1362

elif client._approved is None:

1363

logger.info("Client %s needs approval",

1364

client.name)

1365

if self.server.use_dbus:

1366

# Emit D-Bus signal

1367

client.NeedApproval(

1368

client.approval_delay_milliseconds(),

1369

client.approved_by_default)

1370

else:

1371

logger.warning("Client %s was not approved",

1372

client.name)

1373

if self.server.use_dbus:

1374

# Emit D-Bus signal

1375

client.Rejected("Denied")

1376

return

1377

1378

#wait until timeout or approved

1379

#x = float(client._timedelta_to_milliseconds(delay))

1380

time = datetime.datetime.now()

1381

client.changedstate.acquire()

1382

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1383

client.changedstate.release()

1384

time2 = datetime.datetime.now()

1385

if (time2 - time) >= delay:

1386

if not client.approved_by_default:

1387

logger.warning("Client %s timed out while"

1388

" waiting for approval",

1389

client.name)

1390

if self.server.use_dbus:

1391

# Emit D-Bus signal

1392

client.Rejected("Approval timed out")

1393

return

1394

else:

1395

break

1396

else:

1397

delay -= time2 - time

1398

1399

sent_size = 0

1400

while sent_size < len(client.secret):

1401

try:

1402

sent = session.send(client.secret[sent_size:])

1403

except gnutls.errors.GNUTLSError as error:

1404

logger.warning("gnutls send failed")

1405

return

1406

logger.debug("Sent: %d, remaining: %d",

1407

sent, len(client.secret)

1408

- (sent_size + sent))

1409

sent_size += sent

1410

1411

logger.info("Sending secret to %s", client.name)

1412

# bump the timeout as if seen

1413

client.checked_ok(client.extended_timeout)

1414

if self.server.use_dbus:

1415

# Emit D-Bus signal

1416

client.GotSecret()

984

1417

985

for c in self.server.clients:

986

if c.fingerprint == fpr:

987

client = c

988

break

989

else:

990

ipc.write(u"NOTFOUND %s %s\n"

991

% (fpr, unicode(self.client_address)))

992

session.bye()

993

return

994

# Have to check if client.still_valid(), since it is

995

# possible that the client timed out while establishing

996

# the GnuTLS session.

997

if not client.still_valid():

998

ipc.write(u"INVALID %s\n" % client.name)

999

session.bye()

1000

return

1001

ipc.write(u"SENDING %s\n" % client.name)

1002

sent_size = 0

1003

while sent_size < len(client.secret):

1004

sent = session.send(client.secret[sent_size:])

1005

logger.debug(u"Sent: %d, remaining: %d",

1006

sent, len(client.secret)

1007

- (sent_size + sent))

1008

sent_size += sent

1009

session.bye()

1418

finally:

1419

if approval_required:

1420

client.approvals_pending -= 1

1421

try:

1422

session.bye()

1423

except gnutls.errors.GNUTLSError as error:

1424

logger.warning("GnuTLS bye failed")

1010

1425

1011

1426

@staticmethod

1012

1427

def peer_certificate(session):

1022

1437

.gnutls_certificate_get_peers

1023

1438

(session._c_object, ctypes.byref(list_size)))

1024

1439

if not bool(cert_list) and list_size.value != 0:

1025

raise gnutls.errors.GNUTLSError(u"error getting peer"

1026

u" certificate")

1440

raise gnutls.errors.GNUTLSError("error getting peer"

1441

" certificate")

1027

1442

if list_size.value == 0:

1028

1443

return None

1029

1444

cert = cert_list[0]

1055

1470

if crtverify.value != 0:

1056

1471

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1057

1472

raise (gnutls.errors.CertificateSecurityError

1058

(u"Verify failed"))

1473

("Verify failed"))

1059

1474

# New buffer for the fingerprint

1060

1475

buf = ctypes.create_string_buffer(20)

1061

1476

buf_len = ctypes.c_size_t()

1068

1483

# Convert the buffer to a Python bytestring

1069

1484

fpr = ctypes.string_at(buf, buf_len.value)

1070

1485

# Convert the bytestring to hexadecimal notation

1071

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1486

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1072

1487

return hex_fpr

1073

1488

1074

1489

1075

class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):

1076

"""Like socketserver.ForkingMixIn, but also pass a pipe."""

1490

class MultiprocessingMixIn(object):

1491

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1492

def sub_process_main(self, request, address):

1493

try:

1494

self.finish_request(request, address)

1495

except:

1496

self.handle_error(request, address)

1497

self.close_request(request)

1498

1499

def process_request(self, request, address):

1500

"""Start a new process to process the request."""

1501

multiprocessing.Process(target = self.sub_process_main,

1502

args = (request, address)).start()

1503

1504

1505

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1506

""" adds a pipe to the MixIn """

1077

1507

def process_request(self, request, client_address):

1078

1508

"""Overrides and wraps the original process_request().

1079

1509

1080

1510

This function creates a new pipe in self.pipe

1081

1511

"""

1082

self.pipe = os.pipe()

1083

super(ForkingMixInWithPipe,

1512

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1513

1514

super(MultiprocessingMixInWithPipe,

1084

1515

self).process_request(request, client_address)

1085

os.close(self.pipe[1]) # close write end

1086

self.add_pipe(self.pipe[0])

1087

def add_pipe(self, pipe):

1516

self.child_pipe.close()

1517

self.add_pipe(parent_pipe)

1518

1519

def add_pipe(self, parent_pipe):

1088

1520

"""Dummy function; override as necessary"""

1089

os.close(pipe)

1090

1091

1092

class IPv6_TCPServer(ForkingMixInWithPipe,

1521

raise NotImplementedError

1522

1523

1524

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1093

1525

socketserver.TCPServer, object):

1094

1526

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1095

1527

1111

1543

bind to an address or port if they were not specified."""

1112

1544

if self.interface is not None:

1113

1545

if SO_BINDTODEVICE is None:

1114

logger.error(u"SO_BINDTODEVICE does not exist;"

1115

u" cannot bind to interface %s",

1546

logger.error("SO_BINDTODEVICE does not exist;"

1547

" cannot bind to interface %s",

1116

1548

self.interface)

1117

1549

else:

1118

1550

try:

1119

1551

self.socket.setsockopt(socket.SOL_SOCKET,

1120

1552

SO_BINDTODEVICE,

1121

1553

str(self.interface

1122

+ u'\0'))

1123

except socket.error, error:

1554

+ '\0'))

1555

except socket.error as error:

1124

1556

if error[0] == errno.EPERM:

1125

logger.error(u"No permission to"

1126

u" bind to interface %s",

1557

logger.error("No permission to"

1558

" bind to interface %s",

1127

1559

self.interface)

1128

1560

elif error[0] == errno.ENOPROTOOPT:

1129

logger.error(u"SO_BINDTODEVICE not available;"

1130

u" cannot bind to interface %s",

1561

logger.error("SO_BINDTODEVICE not available;"

1562

" cannot bind to interface %s",

1131

1563

self.interface)

1132

1564

else:

1133

1565

raise

1135

1567

if self.server_address[0] or self.server_address[1]:

1136

1568

if not self.server_address[0]:

1137

1569

if self.address_family == socket.AF_INET6:

1138

any_address = u"::" # in6addr_any

1570

any_address = "::" # in6addr_any

1139

1571

else:

1140

1572

any_address = socket.INADDR_ANY

1141

1573

self.server_address = (any_address,

1180

1612

return socketserver.TCPServer.server_activate(self)

1181

1613

def enable(self):

1182

1614

self.enabled = True

1183

def add_pipe(self, pipe):

1615

def add_pipe(self, parent_pipe):

1184

1616

# Call "handle_ipc" for both data and EOF events

1185

gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,

1186

self.handle_ipc)

1187

def handle_ipc(self, source, condition, file_objects={}):

1617

gobject.io_add_watch(parent_pipe.fileno(),

1618

gobject.IO_IN | gobject.IO_HUP,

1619

functools.partial(self.handle_ipc,

1620

parent_pipe = parent_pipe))

1621

1622

def handle_ipc(self, source, condition, parent_pipe=None,

1623

client_object=None):

1188

1624

condition_names = {

1189

gobject.IO_IN: u"IN", # There is data to read.

1190

gobject.IO_OUT: u"OUT", # Data can be written (without

1625

gobject.IO_IN: "IN", # There is data to read.

1626

gobject.IO_OUT: "OUT", # Data can be written (without

1191

1627

# blocking).

1192

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1193

gobject.IO_ERR: u"ERR", # Error condition.

1194

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1628

gobject.IO_PRI: "PRI", # There is urgent data to read.

1629

gobject.IO_ERR: "ERR", # Error condition.

1630

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1195

1631

# broken, usually for pipes and

1196

1632

# sockets).

1197

1633

}

1199

1635

for cond, name in

1200

1636

condition_names.iteritems()

1201

1637

if cond & condition)

1202

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1203

conditions_string)

1204

1205

# Turn the pipe file descriptor into a Python file object

1206

if source not in file_objects:

1207

file_objects[source] = os.fdopen(source, u"r", 1)

1208

1209

# Read a line from the file object

1210

cmdline = file_objects[source].readline()

1211

if not cmdline: # Empty line means end of file

1212

# close the IPC pipe

1213

file_objects[source].close()

1214

del file_objects[source]

1215

1216

# Stop calling this function

1217

return False

1218

1219

logger.debug(u"IPC command: %r", cmdline)

1220

1221

# Parse and act on command

1222

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1223

1224

if cmd == u"NOTFOUND":

1225

logger.warning(u"Client not found for fingerprint: %s",

1226

args)

1227

if self.use_dbus:

1228

# Emit D-Bus signal

1229

mandos_dbus_service.ClientNotFound(args)

1230

elif cmd == u"INVALID":

1231

for client in self.clients:

1232

if client.name == args:

1233

logger.warning(u"Client %s is invalid", args)

1234

if self.use_dbus:

1235

# Emit D-Bus signal

1236

client.Rejected()

1237

break

1238

else:

1239

logger.error(u"Unknown client %s is invalid", args)

1240

elif cmd == u"SENDING":

1241

for client in self.clients:

1242

if client.name == args:

1243

logger.info(u"Sending secret to %s", client.name)

1244

client.checked_ok()

1245

if self.use_dbus:

1246

# Emit D-Bus signal

1247

client.ReceivedSecret()

1248

break

1249

else:

1250

logger.error(u"Sending secret to unknown client %s",

1251

args)

1252

else:

1253

logger.error(u"Unknown IPC command: %r", cmdline)

1254

1255

# Keep calling this function

1638

# error or the other end of multiprocessing.Pipe has closed

1639

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1640

return False

1641

1642

# Read a request from the child

1643

request = parent_pipe.recv()

1644

command = request[0]

1645

1646

if command == 'init':

1647

fpr = request[1]

1648

address = request[2]

1649

1650

for c in self.clients:

1651

if c.fingerprint == fpr:

1652

client = c

1653

break

1654

else:

1655

logger.info("Client not found for fingerprint: %s, ad"

1656

"dress: %s", fpr, address)

1657

if self.use_dbus:

1658

# Emit D-Bus signal

1659

mandos_dbus_service.ClientNotFound(fpr, address[0])

1660

parent_pipe.send(False)

1661

return False

1662

1663

gobject.io_add_watch(parent_pipe.fileno(),

1664

gobject.IO_IN | gobject.IO_HUP,

1665

functools.partial(self.handle_ipc,

1666

parent_pipe = parent_pipe,

1667

client_object = client))

1668

parent_pipe.send(True)

1669

# remove the old hook in favor of the new above hook on same fileno

1670

return False

1671

if command == 'funcall':

1672

funcname = request[1]

1673

args = request[2]

1674

kwargs = request[3]

1675

1676

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1677

1678

if command == 'getattr':

1679

attrname = request[1]

1680

if callable(client_object.__getattribute__(attrname)):

1681

parent_pipe.send(('function',))

1682

else:

1683

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1684

1685

if command == 'setattr':

1686

attrname = request[1]

1687

value = request[2]

1688

setattr(client_object, attrname, value)

1689

1256

1690

return True

1257

1691

1258

1692

1259

1693

def string_to_delta(interval):

1260

1694

"""Parse a string and return a datetime.timedelta

1261

1695

1262

>>> string_to_delta(u'7d')

1696

>>> string_to_delta('7d')

1263

1697

datetime.timedelta(7)

1264

>>> string_to_delta(u'60s')

1698

>>> string_to_delta('60s')

1265

1699

datetime.timedelta(0, 60)

1266

>>> string_to_delta(u'60m')

1700

>>> string_to_delta('60m')

1267

1701

datetime.timedelta(0, 3600)

1268

>>> string_to_delta(u'24h')

1702

>>> string_to_delta('24h')

1269

1703

datetime.timedelta(1)

1270

>>> string_to_delta(u'1w')

1704

>>> string_to_delta('1w')

1271

1705

datetime.timedelta(7)

1272

>>> string_to_delta(u'5m 30s')

1706

>>> string_to_delta('5m 30s')

1273

1707

datetime.timedelta(0, 330)

1274

1708

"""

1275

1709

timevalue = datetime.timedelta(0)

1277

1711

try:

1278

1712

suffix = unicode(s[-1])

1279

1713

value = int(s[:-1])

1280

if suffix == u"d":

1714

if suffix == "d":

1281

1715

delta = datetime.timedelta(value)

1282

elif suffix == u"s":

1716

elif suffix == "s":

1283

1717

delta = datetime.timedelta(0, value)

1284

elif suffix == u"m":

1718

elif suffix == "m":

1285

1719

delta = datetime.timedelta(0, 0, 0, 0, value)

1286

elif suffix == u"h":

1720

elif suffix == "h":

1287

1721

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1288

elif suffix == u"w":

1722

elif suffix == "w":

1289

1723

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1290

1724

else:

1291

raise ValueError

1292

except (ValueError, IndexError):

1293

raise ValueError

1725

raise ValueError("Unknown suffix %r" % suffix)

1726

except (ValueError, IndexError) as e:

1727

raise ValueError(*(e.args))

1294

1728

timevalue += delta

1295

1729

return timevalue

1296

1730

1302

1736

global if_nametoindex

1303

1737

try:

1304

1738

if_nametoindex = (ctypes.cdll.LoadLibrary

1305

(ctypes.util.find_library(u"c"))

1739

(ctypes.util.find_library("c"))

1306

1740

.if_nametoindex)

1307

1741

except (OSError, AttributeError):

1308

logger.warning(u"Doing if_nametoindex the hard way")

1742

logger.warning("Doing if_nametoindex the hard way")

1309

1743

def if_nametoindex(interface):

1310

1744

"Get an interface index the hard way, i.e. using fcntl()"

1311

1745

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1312

with closing(socket.socket()) as s:

1746

with contextlib.closing(socket.socket()) as s:

1313

1747

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1314

struct.pack(str(u"16s16x"),

1748

struct.pack(str("16s16x"),

1315

1749

interface))

1316

interface_index = struct.unpack(str(u"I"),

1750

interface_index = struct.unpack(str("I"),

1317

1751

ifreq[16:20])[0]

1318

1752

return interface_index

1319

1753

return if_nametoindex(interface)

1327

1761

sys.exit()

1328

1762

os.setsid()

1329

1763

if not nochdir:

1330

os.chdir(u"/")

1764

os.chdir("/")

1331

1765

if os.fork():

1332

1766

sys.exit()

1333

1767

if not noclose:

1335

1769

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1336

1770

if not stat.S_ISCHR(os.fstat(null).st_mode):

1337

1771

raise OSError(errno.ENODEV,

1338

u"/dev/null not a character device")

1772

"%s not a character device"

1773

% os.path.devnull)

1339

1774

os.dup2(null, sys.stdin.fileno())

1340

1775

os.dup2(null, sys.stdout.fileno())

1341

1776

os.dup2(null, sys.stderr.fileno())

1348

1783

##################################################################

1349

1784

# Parsing of options, both command line and config file

1350

1785

1351

parser = optparse.OptionParser(version = "%%prog %s" % version)

1352

parser.add_option("-i", u"--interface", type=u"string",

1353

metavar="IF", help=u"Bind to interface IF")

1354

parser.add_option("-a", u"--address", type=u"string",

1355

help=u"Address to listen for requests on")

1356

parser.add_option("-p", u"--port", type=u"int",

1357

help=u"Port number to receive requests on")

1358

parser.add_option("--check", action=u"store_true",

1359

help=u"Run self-test")

1360

parser.add_option("--debug", action=u"store_true",

1361

help=u"Debug mode; run in foreground and log to"

1362

u" terminal")

1363

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1364

u" priority string (see GnuTLS documentation)")

1365

parser.add_option("--servicename", type=u"string",

1366

metavar=u"NAME", help=u"Zeroconf service name")

1367

parser.add_option("--configdir", type=u"string",

1368

default=u"/etc/mandos", metavar=u"DIR",

1369

help=u"Directory to search for configuration"

1370

u" files")

1371

parser.add_option("--no-dbus", action=u"store_false",

1372

dest=u"use_dbus", help=u"Do not provide D-Bus"

1373

u" system bus interface")

1374

parser.add_option("--no-ipv6", action=u"store_false",

1375

dest=u"use_ipv6", help=u"Do not use IPv6")

1376

options = parser.parse_args()[0]

1786

parser = argparse.ArgumentParser()

1787

parser.add_argument("-v", "--version", action="version",

1788

version = "%%(prog)s %s" % version,

1789

help="show version number and exit")

1790

parser.add_argument("-i", "--interface", metavar="IF",

1791

help="Bind to interface IF")

1792

parser.add_argument("-a", "--address",

1793

help="Address to listen for requests on")

1794

parser.add_argument("-p", "--port", type=int,

1795

help="Port number to receive requests on")

1796

parser.add_argument("--check", action="store_true",

1797

help="Run self-test")

1798

parser.add_argument("--debug", action="store_true",

1799

help="Debug mode; run in foreground and log"

1800

" to terminal")

1801

parser.add_argument("--debuglevel", metavar="LEVEL",

1802

help="Debug level for stdout output")

1803

parser.add_argument("--priority", help="GnuTLS"

1804

" priority string (see GnuTLS documentation)")

1805

parser.add_argument("--servicename",

1806

metavar="NAME", help="Zeroconf service name")

1807

parser.add_argument("--configdir",

1808

default="/etc/mandos", metavar="DIR",

1809

help="Directory to search for configuration"

1810

" files")

1811

parser.add_argument("--no-dbus", action="store_false",

1812

dest="use_dbus", help="Do not provide D-Bus"

1813

" system bus interface")

1814

parser.add_argument("--no-ipv6", action="store_false",

1815

dest="use_ipv6", help="Do not use IPv6")

1816

options = parser.parse_args()

1377

1817

1378

1818

if options.check:

1379

1819

import doctest

1381

1821

sys.exit()

1382

1822

1383

1823

# Default values for config file for server-global settings

1384

server_defaults = { u"interface": u"",

1385

u"address": u"",

1386

u"port": u"",

1387

u"debug": u"False",

1388

u"priority":

1389

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1390

u"servicename": u"Mandos",

1391

u"use_dbus": u"True",

1392

u"use_ipv6": u"True",

1824

server_defaults = { "interface": "",

1825

"address": "",

1826

"port": "",

1827

"debug": "False",

1828

"priority":

1829

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1830

"servicename": "Mandos",

1831

"use_dbus": "True",

1832

"use_ipv6": "True",

1833

"debuglevel": "",

1393

1834

}

1394

1835

1395

1836

# Parse config file for server-global settings

1396

1837

server_config = configparser.SafeConfigParser(server_defaults)

1397

1838

del server_defaults

1398

1839

server_config.read(os.path.join(options.configdir,

1399

u"mandos.conf"))

1840

"mandos.conf"))

1400

1841

# Convert the SafeConfigParser object to a dict

1401

1842

server_settings = server_config.defaults()

1402

1843

# Use the appropriate methods on the non-string config options

1403

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1404

server_settings[option] = server_config.getboolean(u"DEFAULT",

1844

for option in ("debug", "use_dbus", "use_ipv6"):

1845

server_settings[option] = server_config.getboolean("DEFAULT",

1405

1846

option)

1406

1847

if server_settings["port"]:

1407

server_settings["port"] = server_config.getint(u"DEFAULT",

1408

u"port")

1848

server_settings["port"] = server_config.getint("DEFAULT",

1849

"port")

1409

1850

del server_config

1410

1851

1411

1852

# Override the settings from the config file with command line

1412

1853

# options, if set.

1413

for option in (u"interface", u"address", u"port", u"debug",

1414

u"priority", u"servicename", u"configdir",

1415

u"use_dbus", u"use_ipv6"):

1854

for option in ("interface", "address", "port", "debug",

1855

"priority", "servicename", "configdir",

1856

"use_dbus", "use_ipv6", "debuglevel"):

1416

1857

value = getattr(options, option)

1417

1858

if value is not None:

1418

1859

server_settings[option] = value

1426

1867

##################################################################

1427

1868

1428

1869

# For convenience

1429

debug = server_settings[u"debug"]

1430

use_dbus = server_settings[u"use_dbus"]

1431

use_ipv6 = server_settings[u"use_ipv6"]

1432

1433

if not debug:

1434

syslogger.setLevel(logging.WARNING)

1435

console.setLevel(logging.WARNING)

1436

1437

if server_settings[u"servicename"] != u"Mandos":

1870

debug = server_settings["debug"]

1871

debuglevel = server_settings["debuglevel"]

1872

use_dbus = server_settings["use_dbus"]

1873

use_ipv6 = server_settings["use_ipv6"]

1874

1875

if server_settings["servicename"] != "Mandos":

1438

1876

syslogger.setFormatter(logging.Formatter

1439

(u'Mandos (%s) [%%(process)d]:'

1440

u' %%(levelname)s: %%(message)s'

1441

% server_settings[u"servicename"]))

1877

('Mandos (%s) [%%(process)d]:'

1878

' %%(levelname)s: %%(message)s'

1879

% server_settings["servicename"]))

1442

1880

1443

1881

# Parse config file with clients

1444

client_defaults = { u"timeout": u"1h",

1445

u"interval": u"5m",

1446

u"checker": u"fping -q -- %%(host)s",

1447

u"host": u"",

1882

client_defaults = { "timeout": "5m",

1883

"extended_timeout": "15m",

1884

"interval": "2m",

1885

"checker": "fping -q -- %%(host)s",

1886

"host": "",

1887

"approval_delay": "0s",

1888

"approval_duration": "1s",

1448

1889

}

1449

1890

client_config = configparser.SafeConfigParser(client_defaults)

1450

client_config.read(os.path.join(server_settings[u"configdir"],

1451

u"clients.conf"))

1891

client_config.read(os.path.join(server_settings["configdir"],

1892

"clients.conf"))

1452

1893

1453

1894

global mandos_dbus_service

1454

1895

mandos_dbus_service = None

1455

1896

1456

tcp_server = MandosServer((server_settings[u"address"],

1457

server_settings[u"port"]),

1897

tcp_server = MandosServer((server_settings["address"],

1898

server_settings["port"]),

1458

1899

ClientHandler,

1459

interface=server_settings[u"interface"],

1900

interface=(server_settings["interface"]

1901

or None),

1460

1902

use_ipv6=use_ipv6,

1461

1903

gnutls_priority=

1462

server_settings[u"priority"],

1904

server_settings["priority"],

1463

1905

use_dbus=use_dbus)

1464

pidfilename = u"/var/run/mandos.pid"

1465

try:

1466

pidfile = open(pidfilename, u"w")

1467

except IOError:

1468

logger.error(u"Could not open file %r", pidfilename)

1906

if not debug:

1907

pidfilename = "/var/run/mandos.pid"

1908

try:

1909

pidfile = open(pidfilename, "w")

1910

except IOError:

1911

logger.error("Could not open file %r", pidfilename)

1469

1912

1470

1913

try:

1471

uid = pwd.getpwnam(u"_mandos").pw_uid

1472

gid = pwd.getpwnam(u"_mandos").pw_gid

1914

uid = pwd.getpwnam("_mandos").pw_uid

1915

gid = pwd.getpwnam("_mandos").pw_gid

1473

1916

except KeyError:

1474

1917

try:

1475

uid = pwd.getpwnam(u"mandos").pw_uid

1476

gid = pwd.getpwnam(u"mandos").pw_gid

1918

uid = pwd.getpwnam("mandos").pw_uid

1919

gid = pwd.getpwnam("mandos").pw_gid

1477

1920

except KeyError:

1478

1921

try:

1479

uid = pwd.getpwnam(u"nobody").pw_uid

1480

gid = pwd.getpwnam(u"nobody").pw_gid

1922

uid = pwd.getpwnam("nobody").pw_uid

1923

gid = pwd.getpwnam("nobody").pw_gid

1481

1924

except KeyError:

1482

1925

uid = 65534

1483

1926

gid = 65534

1484

1927

try:

1485

1928

os.setgid(gid)

1486

1929

os.setuid(uid)

1487

except OSError, error:

1930

except OSError as error:

1488

1931

if error[0] != errno.EPERM:

1489

1932

raise error

1490

1933

1491

# Enable all possible GnuTLS debugging

1934

if not debug and not debuglevel:

1935

syslogger.setLevel(logging.WARNING)

1936

console.setLevel(logging.WARNING)

1937

if debuglevel:

1938

level = getattr(logging, debuglevel.upper())

1939

syslogger.setLevel(level)

1940

console.setLevel(level)

1941

1492

1942

if debug:

1943

# Enable all possible GnuTLS debugging

1944

1493

1945

# "Use a log level over 10 to enable all debugging options."

1494

1946

# - GnuTLS manual

1495

1947

gnutls.library.functions.gnutls_global_set_log_level(11)

1496

1948

1497

1949

@gnutls.library.types.gnutls_log_func

1498

1950

def debug_gnutls(level, string):

1499

logger.debug(u"GnuTLS: %s", string[:-1])

1951

logger.debug("GnuTLS: %s", string[:-1])

1500

1952

1501

1953

(gnutls.library.functions

1502

1954

.gnutls_global_set_log_function(debug_gnutls))

1955

1956

# Redirect stdin so all checkers get /dev/null

1957

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1958

os.dup2(null, sys.stdin.fileno())

1959

if null > 2:

1960

os.close(null)

1961

else:

1962

# No console logging

1963

logger.removeHandler(console)

1964

1965

# Need to fork before connecting to D-Bus

1966

if not debug:

1967

# Close all input and output, do double fork, etc.

1968

daemon()

1503

1969

1504

1970

global main_loop

1505

1971

# From the Avahi example code

1508

1974

bus = dbus.SystemBus()

1509

1975

# End of Avahi example code

1510

1976

if use_dbus:

1511

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1977

try:

1978

bus_name = dbus.service.BusName("se.recompile.Mandos",

1979

bus, do_not_queue=True)

1980

old_bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1981

bus, do_not_queue=True)

1982

except dbus.exceptions.NameExistsException as e:

1983

logger.error(unicode(e) + ", disabling D-Bus")

1984

use_dbus = False

1985

server_settings["use_dbus"] = False

1986

tcp_server.use_dbus = False

1512

1987

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1513

service = AvahiService(name = server_settings[u"servicename"],

1514

servicetype = u"_mandos._tcp",

1988

service = AvahiService(name = server_settings["servicename"],

1989

servicetype = "_mandos._tcp",

1515

1990

protocol = protocol, bus = bus)

1516

1991

if server_settings["interface"]:

1517

1992

service.interface = (if_nametoindex

1518

(str(server_settings[u"interface"])))

1993

(str(server_settings["interface"])))

1994

1995

global multiprocessing_manager

1996

multiprocessing_manager = multiprocessing.Manager()

1519

1997

1520

1998

client_class = Client

1521

1999

if use_dbus:

1522

client_class = functools.partial(ClientDBus, bus = bus)

2000

client_class = functools.partial(ClientDBusTransitional, bus = bus)

2001

def client_config_items(config, section):

2002

special_settings = {

2003

"approved_by_default":

2004

lambda: config.getboolean(section,

2005

"approved_by_default"),

2006

}

2007

for name, value in config.items(section):

2008

try:

2009

yield (name, special_settings[name]())

2010

except KeyError:

2011

yield (name, value)

2012

1523

2013

tcp_server.clients.update(set(

1524

2014

client_class(name = section,

1525

config= dict(client_config.items(section)))

2015

config= dict(client_config_items(

2016

client_config, section)))

1526

2017

for section in client_config.sections()))

1527

2018

if not tcp_server.clients:

1528

logger.warning(u"No clients defined")

1529

1530

if debug:

1531

# Redirect stdin so all checkers get /dev/null

1532

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1533

os.dup2(null, sys.stdin.fileno())

1534

if null > 2:

1535

os.close(null)

1536

else:

1537

# No console logging

1538

logger.removeHandler(console)

1539

# Close all input and output, do double fork, etc.

1540

daemon()

1541

1542

try:

1543

with closing(pidfile):

1544

pid = os.getpid()

1545

pidfile.write(str(pid) + "\n")

1546

del pidfile

1547

except IOError:

1548

logger.error(u"Could not write to file %r with PID %d",

1549

pidfilename, pid)

1550

except NameError:

1551

# "pidfile" was never created

1552

pass

1553

del pidfilename

1554

1555

def cleanup():

1556

"Cleanup function; run on exit"

1557

service.cleanup()

2019

logger.warning("No clients defined")

1558

2020

1559

while tcp_server.clients:

1560

client = tcp_server.clients.pop()

1561

client.disable_hook = None

1562

client.disable()

1563

1564

atexit.register(cleanup)

1565

1566

2021

if not debug:

2022

try:

2023

with pidfile:

2024

pid = os.getpid()

2025

pidfile.write(str(pid) + "\n".encode("utf-8"))

2026

del pidfile

2027

except IOError:

2028

logger.error("Could not write to file %r with PID %d",

2029

pidfilename, pid)

2030

except NameError:

2031

# "pidfile" was never created

2032

pass

2033

del pidfilename

2034

1567

2035

signal.signal(signal.SIGINT, signal.SIG_IGN)

2036

1568

2037

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1569

2038

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1570

2039

1572

2041

class MandosDBusService(dbus.service.Object):

1573

2042

"""A D-Bus proxy object"""

1574

2043

def __init__(self):

1575

dbus.service.Object.__init__(self, bus, u"/")

1576

_interface = u"se.bsnet.fukt.Mandos"

1577

1578

@dbus.service.signal(_interface, signature=u"oa{sv}")

1579

def ClientAdded(self, objpath, properties):

1580

"D-Bus signal"

1581

pass

1582

1583

@dbus.service.signal(_interface, signature=u"s")

1584

def ClientNotFound(self, fingerprint):

1585

"D-Bus signal"

1586

pass

1587

1588

@dbus.service.signal(_interface, signature=u"os")

2044

dbus.service.Object.__init__(self, bus, "/")

2045

_interface = "se.recompile.Mandos"

2046

2047

@dbus.service.signal(_interface, signature="o")

2048

def ClientAdded(self, objpath):

2049

"D-Bus signal"

2050

pass

2051

2052

@dbus.service.signal(_interface, signature="ss")

2053

def ClientNotFound(self, fingerprint, address):

2054

"D-Bus signal"

2055

pass

2056

2057

@dbus.service.signal(_interface, signature="os")

1589

2058

def ClientRemoved(self, objpath, name):

1590

2059

"D-Bus signal"

1591

2060

pass

1592

2061

1593

@dbus.service.method(_interface, out_signature=u"ao")

2062

@dbus.service.method(_interface, out_signature="ao")

1594

2063

def GetAllClients(self):

1595

2064

"D-Bus method"

1596

2065

return dbus.Array(c.dbus_object_path

1597

2066

for c in tcp_server.clients)

1598

2067

1599

2068

@dbus.service.method(_interface,

1600

out_signature=u"a{oa{sv}}")

2069

out_signature="a{oa{sv}}")

1601

2070

def GetAllClientsWithProperties(self):

1602

2071

"D-Bus method"

1603

2072

return dbus.Dictionary(

1604

((c.dbus_object_path, c.GetAll(u""))

2073

((c.dbus_object_path, c.GetAll(""))

1605

2074

for c in tcp_server.clients),

1606

signature=u"oa{sv}")

2075

signature="oa{sv}")

1607

2076

1608

@dbus.service.method(_interface, in_signature=u"o")

2077

@dbus.service.method(_interface, in_signature="o")

1609

2078

def RemoveClient(self, object_path):

1610

2079

"D-Bus method"

1611

2080

for c in tcp_server.clients:

1613

2082

tcp_server.clients.remove(c)

1614

2083

c.remove_from_connection()

1615

2084

# Don't signal anything except ClientRemoved

1616

c.disable(signal=False)

2085

c.disable(quiet=True)

1617

2086

# Emit D-Bus signal

1618

2087

self.ClientRemoved(object_path, c.name)

1619

2088

return

1620

raise KeyError

2089

raise KeyError(object_path)

1621

2090

1622

2091

del _interface

1623

2092

1624

mandos_dbus_service = MandosDBusService()

2093

class MandosDBusServiceTransitional(MandosDBusService):

2094

__metaclass__ = AlternateDBusNamesMetaclass

2095

mandos_dbus_service = MandosDBusServiceTransitional()

2096

2097

def cleanup():

2098

"Cleanup function; run on exit"

2099

service.cleanup()

2100

2101

while tcp_server.clients:

2102

client = tcp_server.clients.pop()

2103

if use_dbus:

2104

client.remove_from_connection()

2105

client.disable_hook = None

2106

# Don't signal anything except ClientRemoved

2107

client.disable(quiet=True)

2108

if use_dbus:

2109

# Emit D-Bus signal

2110

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2111

client.name)

2112

2113

atexit.register(cleanup)

1625

2114

1626

2115

for client in tcp_server.clients:

1627

2116

if use_dbus:

1628

2117

# Emit D-Bus signal

1629

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1630

client.GetAll(u""))

2118

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1631

2119

client.enable()

1632

2120

1633

2121

tcp_server.enable()

1636

2124

# Find out what port we got

1637

2125

service.port = tcp_server.socket.getsockname()[1]

1638

2126

if use_ipv6:

1639

logger.info(u"Now listening on address %r, port %d,"

2127

logger.info("Now listening on address %r, port %d,"

1640

2128

" flowinfo %d, scope_id %d"

1641

2129

% tcp_server.socket.getsockname())

1642

2130

else: # IPv4

1643

logger.info(u"Now listening on address %r, port %d"

2131

logger.info("Now listening on address %r, port %d"

1644

2132

% tcp_server.socket.getsockname())

1645

2133

1646

2134

#service.interface = tcp_server.socket.getsockname()[3]

1649

2137

# From the Avahi example code

1650

2138

try:

1651

2139

service.activate()

1652

except dbus.exceptions.DBusException, error:

1653

logger.critical(u"DBusException: %s", error)

2140

except dbus.exceptions.DBusException as error:

2141

logger.critical("DBusException: %s", error)

2142

cleanup()

1654

2143

sys.exit(1)

1655

2144

# End of Avahi example code

1656

2145

1659

2148

(tcp_server.handle_request

1660

2149

(*args[2:], **kwargs) or True))

1661

2150

1662

logger.debug(u"Starting main loop")

2151

logger.debug("Starting main loop")

1663

2152

main_loop.run()

1664

except AvahiError, error:

1665

logger.critical(u"AvahiError: %s", error)

2153

except AvahiError as error:

2154

logger.critical("AvahiError: %s", error)

2155

cleanup()

1666

2156

sys.exit(1)

1667

2157

except KeyboardInterrupt:

1668

2158

if debug:

1669

print >> sys.stderr

1670

logger.debug(u"Server received KeyboardInterrupt")

1671

logger.debug(u"Server exiting")

2159

print("", file=sys.stderr)

2160

logger.debug("Server received KeyboardInterrupt")

2161

logger.debug("Server exiting")

2162

# Must run before the D-Bus bus name gets deregistered

2163

cleanup()

2164

1672

2165

1673

2166

if __name__ == '__main__':

1674

2167

main()