/mandos/trunk : revision 505.1.2

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

61

62

import functools

62

63

import cPickle as pickle

63

64

import multiprocessing

65

import types

64

66

65

67

import dbus

66

68

import dbus.service

81

83

SO_BINDTODEVICE = None

82

84

83

85

84

version = "1.0.14"

86

version = "1.3.1"

85

87

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

88

90

syslogger = (logging.handlers.SysLogHandler

89

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

90

address = "/dev/log"))

92

address = str("/dev/log")))

91

93

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

94

96

logger.addHandler(syslogger)

95

97

96

98

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

100

102

logger.addHandler(console)

101

103

102

104

class AvahiError(Exception):

119

121

Attributes:

120

122

interface: integer; avahi.IF_UNSPEC or an interface index.

121

123

Used to optionally bind to the specified interface.

122

123

type: string; Example: u'_mandos._tcp'.

124

125

type: string; Example: '_mandos._tcp'.

124

126

See <http://www.dns-sd.org/ServiceTypes.html>

125

127

port: integer; what port to announce

126

128

TXT: list of strings; TXT record for the service

135

137

"""

136

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

137

139

servicetype = None, port = None, TXT = None,

138

domain = u"", host = u"", max_renames = 32768,

140

domain = "", host = "", max_renames = 32768,

139

141

protocol = avahi.PROTO_UNSPEC, bus = None):

140

142

self.interface = interface

141

143

self.name = name

150

152

self.group = None # our entry group

151

153

self.server = None

152

154

self.bus = bus

155

self.entry_group_state_changed_match = None

153

156

def rename(self):

154

157

"""Derived from the Avahi example code"""

155

158

if self.rename_count >= self.max_renames:

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

158

161

self.rename_count)

159

raise AvahiServiceError(u"Too many renames")

162

raise AvahiServiceError("Too many renames")

160

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

164

logger.info("Changing Zeroconf service name to %r ...",

162

165

self.name)

163

166

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

166

169

% self.name))

167

170

self.remove()

168

171

try:

169

172

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

173

except dbus.exceptions.DBusException as error:

174

logger.critical("DBusException: %s", error)

172

175

self.cleanup()

173

176

os._exit(1)

174

177

self.rename_count += 1

175

178

def remove(self):

176

179

"""Derived from the Avahi example code"""

180

if self.entry_group_state_changed_match is not None:

181

self.entry_group_state_changed_match.remove()

182

self.entry_group_state_changed_match = None

177

183

if self.group is not None:

178

184

self.group.Reset()

179

185

def add(self):

180

186

"""Derived from the Avahi example code"""

187

self.remove()

181

188

if self.group is None:

182

189

self.group = dbus.Interface(

183

190

self.bus.get_object(avahi.DBUS_NAME,

184

191

self.server.EntryGroupNew()),

185

192

avahi.DBUS_INTERFACE_ENTRY_GROUP)

186

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

193

self.entry_group_state_changed_match = (

194

self.group.connect_to_signal(

195

'StateChanged', self .entry_group_state_changed))

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

190

197

self.name, self.type)

191

198

self.group.AddService(

192

199

self.interface,

199

206

self.group.Commit()

200

207

def entry_group_state_changed(self, state, error):

201

208

"""Derived from the Avahi example code"""

202

logger.debug(u"Avahi entry group state change: %i", state)

209

logger.debug("Avahi entry group state change: %i", state)

203

210

204

211

if state == avahi.ENTRY_GROUP_ESTABLISHED:

205

logger.debug(u"Zeroconf service established.")

212

logger.debug("Zeroconf service established.")

206

213

elif state == avahi.ENTRY_GROUP_COLLISION:

207

logger.warning(u"Zeroconf service name collision.")

214

logger.info("Zeroconf service name collision.")

208

215

self.rename()

209

216

elif state == avahi.ENTRY_GROUP_FAILURE:

210

logger.critical(u"Avahi: Error in group state changed %s",

217

logger.critical("Avahi: Error in group state changed %s",

211

218

unicode(error))

212

raise AvahiGroupError(u"State changed: %s"

219

raise AvahiGroupError("State changed: %s"

213

220

% unicode(error))

214

221

def cleanup(self):

215

222

"""Derived from the Avahi example code"""

216

223

if self.group is not None:

217

self.group.Free()

224

try:

225

self.group.Free()

226

except (dbus.exceptions.UnknownMethodException,

227

dbus.exceptions.DBusException) as e:

228

pass

218

229

self.group = None

219

def server_state_changed(self, state):

230

self.remove()

231

def server_state_changed(self, state, error=None):

220

232

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

222

if state == avahi.SERVER_COLLISION:

223

logger.error(u"Zeroconf server name collision")

224

self.remove()

233

logger.debug("Avahi server state change: %i", state)

234

bad_states = { avahi.SERVER_INVALID:

235

"Zeroconf server invalid",

236

avahi.SERVER_REGISTERING: None,

237

avahi.SERVER_COLLISION:

238

"Zeroconf server name collision",

239

avahi.SERVER_FAILURE:

240

"Zeroconf server failure" }

241

if state in bad_states:

242

if bad_states[state] is not None:

243

if error is None:

244

logger.error(bad_states[state])

245

else:

246

logger.error(bad_states[state] + ": %r", error)

247

self.cleanup()

225

248

elif state == avahi.SERVER_RUNNING:

226

249

self.add()

250

else:

251

if error is None:

252

logger.debug("Unknown state: %r", state)

253

else:

254

logger.debug("Unknown state: %r: %r", state, error)

227

255

def activate(self):

228

256

"""Derived from the Avahi example code"""

229

257

if self.server is None:

230

258

self.server = dbus.Interface(

231

259

self.bus.get_object(avahi.DBUS_NAME,

232

avahi.DBUS_PATH_SERVER),

260

avahi.DBUS_PATH_SERVER,

261

follow_name_owner_changes=True),

233

262

avahi.DBUS_INTERFACE_SERVER)

234

self.server.connect_to_signal(u"StateChanged",

263

self.server.connect_to_signal("StateChanged",

235

264

self.server_state_changed)

236

265

self.server_state_changed(self.server.GetState())

237

266

238

267

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

239

274

class Client(object):

240

275

"""A representation of a client host served by this server.

241

276

242

277

Attributes:

243

244

D-Bus identifiers

278

_approved: bool(); 'None' if not yet approved/disapproved

279

approval_delay: datetime.timedelta(); Time to wait for approval

280

approval_duration: datetime.timedelta(); Duration of one approval

281

checker: subprocess.Popen(); a running checker process used

282

to see if the client lives.

283

'None' if no process is running.

284

checker_callback_tag: a gobject event source tag, or None

285

checker_command: string; External command which is run to check

286

if client lives. %() expansions are done at

287

runtime with vars(self) as dict, so that for

288

instance %(name)s can be used in the command.

289

checker_initiator_tag: a gobject event source tag, or None

290

created: datetime.datetime(); (UTC) object creation

291

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

293

disable_initiator_tag: a gobject event source tag, or None

294

enabled: bool()

245

295

fingerprint: string (40 or 32 hexadecimal digits); used to

246

296

uniquely identify the client

247

secret: bytestring; sent verbatim (over TLS) to client

248

297

host: string; available for use by the checker command

249

created: datetime.datetime(); (UTC) object creation

298

interval: datetime.timedelta(); How often to start a new checker

299

last_approval_request: datetime.datetime(); (UTC) or None

300

last_checked_ok: datetime.datetime(); (UTC) or None

250

301

last_enabled: datetime.datetime(); (UTC)

251

enabled: bool()

252

last_checked_ok: datetime.datetime(); (UTC) or None

302

303

D-Bus identifiers

304

secret: bytestring; sent verbatim (over TLS) to client

253

305

timeout: datetime.timedelta(); How long from last_checked_ok

254

306

until this client is disabled

255

interval: datetime.timedelta(); How often to start a new checker

256

disable_hook: If set, called by disable() as disable_hook(self)

257

checker: subprocess.Popen(); a running checker process used

258

to see if the client lives.

259

'None' if no process is running.

260

checker_initiator_tag: a gobject event source tag, or None

261

disable_initiator_tag: - '' -

262

checker_callback_tag: - '' -

263

checker_command: string; External command which is run to check if

264

client lives. %() expansions are done at

265

runtime with vars(self) as dict, so that for

266

instance %(name)s can be used in the command.

267

current_checker_command: string; current running checker_command

268

approved_delay: datetime.timedelta(); Time to wait for approval

269

_approved: bool(); 'None' if not yet approved/disapproved

270

approved_duration: datetime.timedelta(); Duration of one approval

307

extended_timeout: extra long timeout when password has been sent

308

runtime_expansions: Allowed attributes for runtime expansion.

309

expires: datetime.datetime(); time (UTC) when a client will be

310

disabled, or None

271

311

"""

272

312

273

@staticmethod

274

def _timedelta_to_milliseconds(td):

275

"Convert a datetime.timedelta() to milliseconds"

276

return ((td.days * 24 * 60 * 60 * 1000)

277

+ (td.seconds * 1000)

278

+ (td.microseconds // 1000))

313

runtime_expansions = ("approval_delay", "approval_duration",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

316

"last_enabled", "name", "timeout")

279

317

280

318

def timeout_milliseconds(self):

281

319

"Return the 'timeout' attribute in milliseconds"

282

return self._timedelta_to_milliseconds(self.timeout)

320

return _timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

283

325

284

326

def interval_milliseconds(self):

285

327

"Return the 'interval' attribute in milliseconds"

286

return self._timedelta_to_milliseconds(self.interval)

287

288

def approved_delay_milliseconds(self):

289

return self._timedelta_to_milliseconds(self.approved_delay)

328

return _timedelta_to_milliseconds(self.interval)

329

330

def approval_delay_milliseconds(self):

331

return _timedelta_to_milliseconds(self.approval_delay)

290

332

291

333

def __init__(self, name = None, disable_hook=None, config=None):

292

334

"""Note: the 'checker' key in 'config' sets the

295

337

self.name = name

296

338

if config is None:

297

339

config = {}

298

logger.debug(u"Creating client %r", self.name)

340

logger.debug("Creating client %r", self.name)

299

341

# Uppercase and remove spaces from fingerprint for later

300

342

# comparison purposes with return value from the fingerprint()

301

343

# function

302

self.fingerprint = (config[u"fingerprint"].upper()

303

.replace(u" ", u""))

304

logger.debug(u" Fingerprint: %s", self.fingerprint)

305

if u"secret" in config:

306

self.secret = config[u"secret"].decode(u"base64")

307

elif u"secfile" in config:

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

308

350

with open(os.path.expanduser(os.path.expandvars

309

(config[u"secfile"])),

351

(config["secfile"])),

310

352

"rb") as secfile:

311

353

self.secret = secfile.read()

312

354

else:

313

raise TypeError(u"No secret or secfile for client %s"

355

raise TypeError("No secret or secfile for client %s"

314

356

% self.name)

315

self.host = config.get(u"host", u"")

357

self.host = config.get("host", "")

316

358

self.created = datetime.datetime.utcnow()

317

359

self.enabled = False

360

self.last_approval_request = None

318

361

self.last_enabled = None

319

362

self.last_checked_ok = None

320

self.timeout = string_to_delta(config[u"timeout"])

321

self.interval = string_to_delta(config[u"interval"])

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

322

366

self.disable_hook = disable_hook

323

367

self.checker = None

324

368

self.checker_initiator_tag = None

325

369

self.disable_initiator_tag = None

370

self.expires = None

326

371

self.checker_callback_tag = None

327

self.checker_command = config[u"checker"]

372

self.checker_command = config["checker"]

328

373

self.current_checker_command = None

329

374

self.last_connect = None

330

375

self._approved = None

331

self.approved_by_default = config.get(u"approved_by_default",

376

self.approved_by_default = config.get("approved_by_default",

332

377

True)

333

378

self.approvals_pending = 0

334

self.approved_delay = string_to_delta(

335

config[u"approved_delay"])

336

self.approved_duration = string_to_delta(

337

config[u"approved_duration"])

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

338

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

339

384

340

385

def send_changedstate(self):

344

389

345

390

def enable(self):

346

391

"""Start this client's checker and timeout hooks"""

347

if getattr(self, u"enabled", False):

392

if getattr(self, "enabled", False):

348

393

# Already enabled

349

394

return

350

395

self.send_changedstate()

351

self.last_enabled = datetime.datetime.utcnow()

352

396

# Schedule a new checker to be started an 'interval' from now,

353

397

# and every interval from then on.

354

398

self.checker_initiator_tag = (gobject.timeout_add

355

399

(self.interval_milliseconds(),

356

400

self.start_checker))

357

401

# Schedule a disable() when 'timeout' has passed

402

self.expires = datetime.datetime.utcnow() + self.timeout

358

403

self.disable_initiator_tag = (gobject.timeout_add

359

404

(self.timeout_milliseconds(),

360

405

self.disable))

361

406

self.enabled = True

407

self.last_enabled = datetime.datetime.utcnow()

362

408

# Also start a new checker *right now*.

363

409

self.start_checker()

364

410

369

415

if not quiet:

370

416

self.send_changedstate()

371

417

if not quiet:

372

logger.info(u"Disabling client %s", self.name)

373

if getattr(self, u"disable_initiator_tag", False):

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

374

420

gobject.source_remove(self.disable_initiator_tag)

375

421

self.disable_initiator_tag = None

376

if getattr(self, u"checker_initiator_tag", False):

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

377

424

gobject.source_remove(self.checker_initiator_tag)

378

425

self.checker_initiator_tag = None

379

426

self.stop_checker()

394

441

if os.WIFEXITED(condition):

395

442

exitstatus = os.WEXITSTATUS(condition)

396

443

if exitstatus == 0:

397

logger.info(u"Checker for %(name)s succeeded",

444

logger.info("Checker for %(name)s succeeded",

398

445

vars(self))

399

446

self.checked_ok()

400

447

else:

401

logger.info(u"Checker for %(name)s failed",

448

logger.info("Checker for %(name)s failed",

402

449

vars(self))

403

450

else:

404

logger.warning(u"Checker for %(name)s crashed?",

451

logger.warning("Checker for %(name)s crashed?",

405

452

vars(self))

406

453

407

def checked_ok(self):

454

def checked_ok(self, timeout=None):

408

455

"""Bump up the timeout for this client.

409

456

410

457

This should only be called when the client has been seen,

411

458

alive and well.

412

459

"""

460

if timeout is None:

461

timeout = self.timeout

413

462

self.last_checked_ok = datetime.datetime.utcnow()

414

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

415

465

self.disable_initiator_tag = (gobject.timeout_add

416

(self.timeout_milliseconds(),

466

(_timedelta_to_milliseconds(timeout),

417

467

self.disable))

418

468

469

def need_approval(self):

470

self.last_approval_request = datetime.datetime.utcnow()

471

419

472

def start_checker(self):

420

473

"""Start a new checker subprocess if one is not running.

421

474

433

486

# If a checker exists, make sure it is not a zombie

434

487

try:

435

488

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

436

except (AttributeError, OSError), error:

489

except (AttributeError, OSError) as error:

437

490

if (isinstance(error, OSError)

438

491

and error.errno != errno.ECHILD):

439

492

raise error

440

493

else:

441

494

if pid:

442

logger.warning(u"Checker was a zombie")

495

logger.warning("Checker was a zombie")

443

496

gobject.source_remove(self.checker_callback_tag)

444

497

self.checker_callback(pid, status,

445

498

self.current_checker_command)

450

503

command = self.checker_command % self.host

451

504

except TypeError:

452

505

# Escape attributes for the shell

453

escaped_attrs = dict((key,

454

re.escape(unicode(str(val),

455

errors=

456

u'replace')))

457

for key, val in

458

vars(self).iteritems())

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

459

514

try:

460

515

command = self.checker_command % escaped_attrs

461

except TypeError, error:

462

logger.error(u'Could not format string "%s":'

463

u' %s', self.checker_command, error)

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

464

519

return True # Try again later

465

520

self.current_checker_command = command

466

521

try:

467

logger.info(u"Starting checker %r for %s",

522

logger.info("Starting checker %r for %s",

468

523

command, self.name)

469

524

# We don't need to redirect stdout and stderr, since

470

525

# in normal mode, that is already done by daemon(),

472

527

# always replaced by /dev/null.)

473

528

self.checker = subprocess.Popen(command,

474

529

close_fds=True,

475

shell=True, cwd=u"/")

530

shell=True, cwd="/")

476

531

self.checker_callback_tag = (gobject.child_watch_add

477

532

(self.checker.pid,

478

533

self.checker_callback,

483

538

if pid:

484

539

gobject.source_remove(self.checker_callback_tag)

485

540

self.checker_callback(pid, status, command)

486

except OSError, error:

487

logger.error(u"Failed to start subprocess: %s",

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

488

543

error)

489

544

# Re-run this periodically if run by gobject.timeout_add

490

545

return True

494

549

if self.checker_callback_tag:

495

550

gobject.source_remove(self.checker_callback_tag)

496

551

self.checker_callback_tag = None

497

if getattr(self, u"checker", None) is None:

552

if getattr(self, "checker", None) is None:

498

553

return

499

logger.debug(u"Stopping checker for %(name)s", vars(self))

554

logger.debug("Stopping checker for %(name)s", vars(self))

500

555

try:

501

556

os.kill(self.checker.pid, signal.SIGTERM)

502

557

#time.sleep(0.5)

503

558

#if self.checker.poll() is None:

504

559

# os.kill(self.checker.pid, signal.SIGKILL)

505

except OSError, error:

560

except OSError as error:

506

561

if error.errno != errno.ESRCH: # No such process

507

562

raise

508

563

self.checker = None

509

564

510

def dbus_service_property(dbus_interface, signature=u"v",

511

access=u"readwrite", byte_arrays=False):

565

566

def dbus_service_property(dbus_interface, signature="v",

567

access="readwrite", byte_arrays=False):

512

568

"""Decorators for marking methods of a DBusObjectWithProperties to

513

569

become properties on the D-Bus.

514

570

521

577

"""

522

578

# Encoding deeply encoded byte arrays is not supported yet by the

523

579

# "Set" method, so we fail early here:

524

if byte_arrays and signature != u"ay":

525

raise ValueError(u"Byte arrays not supported for non-'ay'"

526

u" signature %r" % signature)

580

if byte_arrays and signature != "ay":

581

raise ValueError("Byte arrays not supported for non-'ay'"

582

" signature %r" % signature)

527

583

def decorator(func):

528

584

func._dbus_is_property = True

529

585

func._dbus_interface = dbus_interface

530

586

func._dbus_signature = signature

531

587

func._dbus_access = access

532

588

func._dbus_name = func.__name__

533

if func._dbus_name.endswith(u"_dbus_property"):

589

if func._dbus_name.endswith("_dbus_property"):

534

590

func._dbus_name = func._dbus_name[:-14]

535

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

591

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

536

592

return func

537

593

return decorator

538

594

558

614

559

615

class DBusObjectWithProperties(dbus.service.Object):

560

616

"""A D-Bus object with properties.

561

617

562

618

Classes inheriting from this can use the dbus_service_property

563

619

decorator to expose methods as D-Bus properties. It exposes the

564

620

standard Get(), Set(), and GetAll() methods on the D-Bus.

566

622

567

623

@staticmethod

568

624

def _is_dbus_property(obj):

569

return getattr(obj, u"_dbus_is_property", False)

625

return getattr(obj, "_dbus_is_property", False)

570

626

571

627

def _get_all_dbus_properties(self):

572

628

"""Returns a generator of (name, attribute) pairs

573

629

"""

574

return ((prop._dbus_name, prop)

575

for name, prop in

576

inspect.getmembers(self, self._is_dbus_property))

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

631

for cls in self.__class__.__mro__

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

577

633

578

634

def _get_dbus_property(self, interface_name, property_name):

579

635

"""Returns a bound method if one exists which is a D-Bus

580

636

property with the specified name and interface.

581

637

"""

582

for name in (property_name,

583

property_name + u"_dbus_property"):

584

prop = getattr(self, name, None)

585

if (prop is None

586

or not self._is_dbus_property(prop)

587

or prop._dbus_name != property_name

588

or (interface_name and prop._dbus_interface

589

and interface_name != prop._dbus_interface)):

590

continue

591

return prop

638

for cls in self.__class__.__mro__:

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

641

return value.__get__(self)

642

592

643

# No such property

593

raise DBusPropertyNotFound(self.dbus_object_path + u":"

594

+ interface_name + u"."

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

645

+ interface_name + "."

595

646

+ property_name)

596

647

597

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

598

out_signature=u"v")

648

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

649

out_signature="v")

599

650

def Get(self, interface_name, property_name):

600

651

"""Standard D-Bus property Get() method, see D-Bus standard.

601

652

"""

602

653

prop = self._get_dbus_property(interface_name, property_name)

603

if prop._dbus_access == u"write":

654

if prop._dbus_access == "write":

604

655

raise DBusPropertyAccessException(property_name)

605

656

value = prop()

606

if not hasattr(value, u"variant_level"):

657

if not hasattr(value, "variant_level"):

607

658

return value

608

659

return type(value)(value, variant_level=value.variant_level+1)

609

660

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

661

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

611

662

def Set(self, interface_name, property_name, value):

612

663

"""Standard D-Bus property Set() method, see D-Bus standard.

613

664

"""

614

665

prop = self._get_dbus_property(interface_name, property_name)

615

if prop._dbus_access == u"read":

666

if prop._dbus_access == "read":

616

667

raise DBusPropertyAccessException(property_name)

617

if prop._dbus_get_args_options[u"byte_arrays"]:

668

if prop._dbus_get_args_options["byte_arrays"]:

618

669

# The byte_arrays option is not supported yet on

619

670

# signatures other than "ay".

620

if prop._dbus_signature != u"ay":

671

if prop._dbus_signature != "ay":

621

672

raise ValueError

622

673

value = dbus.ByteArray(''.join(unichr(byte)

623

674

for byte in value))

624

675

prop(value)

625

676

626

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

627

out_signature=u"a{sv}")

677

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

678

out_signature="a{sv}")

628

679

def GetAll(self, interface_name):

629

680

"""Standard D-Bus property GetAll() method, see D-Bus

630

681

standard.

631

682

632

683

Note: Will not include properties with access="write".

633

684

"""

634

685

all = {}

638

689

# Interface non-empty but did not match

639

690

continue

640

691

# Ignore write-only properties

641

if prop._dbus_access == u"write":

692

if prop._dbus_access == "write":

642

693

continue

643

694

value = prop()

644

if not hasattr(value, u"variant_level"):

695

if not hasattr(value, "variant_level"):

645

696

all[name] = value

646

697

continue

647

698

all[name] = type(value)(value, variant_level=

648

699

value.variant_level+1)

649

return dbus.Dictionary(all, signature=u"sv")

700

return dbus.Dictionary(all, signature="sv")

650

701

651

702

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

652

out_signature=u"s",

703

out_signature="s",

653

704

path_keyword='object_path',

654

705

connection_keyword='connection')

655

706

def Introspect(self, object_path, connection):

660

711

try:

661

712

document = xml.dom.minidom.parseString(xmlstring)

662

713

def make_tag(document, name, prop):

663

e = document.createElement(u"property")

664

e.setAttribute(u"name", name)

665

e.setAttribute(u"type", prop._dbus_signature)

666

e.setAttribute(u"access", prop._dbus_access)

714

e = document.createElement("property")

715

e.setAttribute("name", name)

716

e.setAttribute("type", prop._dbus_signature)

717

e.setAttribute("access", prop._dbus_access)

667

718

return e

668

for if_tag in document.getElementsByTagName(u"interface"):

719

for if_tag in document.getElementsByTagName("interface"):

669

720

for tag in (make_tag(document, name, prop)

670

721

for name, prop

671

722

in self._get_all_dbus_properties()

672

723

if prop._dbus_interface

673

== if_tag.getAttribute(u"name")):

724

== if_tag.getAttribute("name")):

674

725

if_tag.appendChild(tag)

675

726

# Add the names to the return values for the

676

727

# "org.freedesktop.DBus.Properties" methods

677

if (if_tag.getAttribute(u"name")

678

== u"org.freedesktop.DBus.Properties"):

679

for cn in if_tag.getElementsByTagName(u"method"):

680

if cn.getAttribute(u"name") == u"Get":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"value")

685

elif cn.getAttribute(u"name") == u"GetAll":

686

for arg in cn.getElementsByTagName(u"arg"):

687

if (arg.getAttribute(u"direction")

688

== u"out"):

689

arg.setAttribute(u"name", u"props")

690

xmlstring = document.toxml(u"utf-8")

728

if (if_tag.getAttribute("name")

729

== "org.freedesktop.DBus.Properties"):

730

for cn in if_tag.getElementsByTagName("method"):

731

if cn.getAttribute("name") == "Get":

732

for arg in cn.getElementsByTagName("arg"):

733

if (arg.getAttribute("direction")

734

== "out"):

735

arg.setAttribute("name", "value")

736

elif cn.getAttribute("name") == "GetAll":

737

for arg in cn.getElementsByTagName("arg"):

738

if (arg.getAttribute("direction")

739

== "out"):

740

arg.setAttribute("name", "props")

741

xmlstring = document.toxml("utf-8")

691

742

document.unlink()

692

743

except (AttributeError, xml.dom.DOMException,

693

xml.parsers.expat.ExpatError), error:

694

logger.error(u"Failed to override Introspection method",

744

xml.parsers.expat.ExpatError) as error:

745

logger.error("Failed to override Introspection method",

695

746

error)

696

747

return xmlstring

697

748

698

749

750

def datetime_to_dbus (dt, variant_level=0):

751

"""Convert a UTC datetime.datetime() to a D-Bus type."""

752

if dt is None:

753

return dbus.String("", variant_level = variant_level)

754

return dbus.String(dt.isoformat(),

755

variant_level=variant_level)

756

757

class AlternateDBusNamesMetaclass(DBusObjectWithProperties.__metaclass__):

758

"""Applied to an empty subclass of a D-Bus object, this metaclass

759

will add additional D-Bus attributes matching a certain pattern.

760

"""

761

def __new__(mcs, name, bases, attr):

762

# Go through all the base classes which could have D-Bus

763

# methods, signals, or properties in them

764

for base in (b for b in bases

765

if issubclass(b, dbus.service.Object)):

766

# Go though all attributes of the base class

767

for attrname, attribute in inspect.getmembers(base):

768

# Ignore non-D-Bus attributes, and D-Bus attributes

769

# with the wrong interface name

770

if (not hasattr(attribute, "_dbus_interface")

771

or not attribute._dbus_interface

772

.startswith("se.recompile.Mandos")):

773

continue

774

# Create an alternate D-Bus interface name based on

775

# the current name

776

alt_interface = (attribute._dbus_interface

777

.replace("se.recompile.Mandos",

778

"se.bsnet.fukt.Mandos"))

779

# Is this a D-Bus signal?

780

if getattr(attribute, "_dbus_is_signal", False):

781

# Extract the original non-method function by

782

# black magic

783

nonmethod_func = (dict(

784

zip(attribute.func_code.co_freevars,

785

attribute.__closure__))["func"]

786

.cell_contents)

787

# Create a new, but exactly alike, function

788

# object, and decorate it to be a new D-Bus signal

789

# with the alternate D-Bus interface name

790

new_function = (dbus.service.signal

791

(alt_interface,

792

attribute._dbus_signature)

793

(types.FunctionType(

794

nonmethod_func.func_code,

795

nonmethod_func.func_globals,

796

nonmethod_func.func_name,

797

nonmethod_func.func_defaults,

798

nonmethod_func.func_closure)))

799

# Define a creator of a function to call both the

800

# old and new functions, so both the old and new

801

# signals gets sent when the function is called

802

def fixscope(func1, func2):

803

"""This function is a scope container to pass

804

func1 and func2 to the "call_both" function

805

outside of its arguments"""

806

def call_both(*args, **kwargs):

807

"""This function will emit two D-Bus

808

signals by calling func1 and func2"""

809

func1(*args, **kwargs)

810

func2(*args, **kwargs)

811

return call_both

812

# Create the "call_both" function and add it to

813

# the class

814

attr[attrname] = fixscope(attribute,

815

new_function)

816

# Is this a D-Bus method?

817

elif getattr(attribute, "_dbus_is_method", False):

818

# Create a new, but exactly alike, function

819

# object. Decorate it to be a new D-Bus method

820

# with the alternate D-Bus interface name. Add it

821

# to the class.

822

attr[attrname] = (dbus.service.method

823

(alt_interface,

824

attribute._dbus_in_signature,

825

attribute._dbus_out_signature)

826

(types.FunctionType

827

(attribute.func_code,

828

attribute.func_globals,

829

attribute.func_name,

830

attribute.func_defaults,

831

attribute.func_closure)))

832

# Is this a D-Bus property?

833

elif getattr(attribute, "_dbus_is_property", False):

834

# Create a new, but exactly alike, function

835

# object, and decorate it to be a new D-Bus

836

# property with the alternate D-Bus interface

837

# name. Add it to the class.

838

attr[attrname] = (dbus_service_property

839

(alt_interface,

840

attribute._dbus_signature,

841

attribute._dbus_access,

842

attribute

843

._dbus_get_args_options

844

["byte_arrays"])

845

(types.FunctionType

846

(attribute.func_code,

847

attribute.func_globals,

848

attribute.func_name,

849

attribute.func_defaults,

850

attribute.func_closure)))

851

return type.__new__(mcs, name, bases, attr)

852

699

853

class ClientDBus(Client, DBusObjectWithProperties):

700

854

"""A Client class using D-Bus

701

855

703

857

dbus_object_path: dbus.ObjectPath

704

858

bus: dbus.SystemBus()

705

859

"""

860

861

runtime_expansions = (Client.runtime_expansions

862

+ ("dbus_object_path",))

863

706

864

# dbus.service.Object doesn't use super(), so we can't either.

707

865

708

866

def __init__(self, bus = None, *args, **kwargs):

711

869

Client.__init__(self, *args, **kwargs)

712

870

# Only now, when this client is initialized, can it show up on

713

871

# the D-Bus

872

client_object_name = unicode(self.name).translate(

873

{ord("."): ord("_"),

874

ord("-"): ord("_")})

714

875

self.dbus_object_path = (dbus.ObjectPath

715

(u"/clients/"

716

+ self.name.replace(u".", u"_")))

876

("/clients/" + client_object_name))

717

877

DBusObjectWithProperties.__init__(self, self.bus,

718

878

self.dbus_object_path)

719

720

def _get_approvals_pending(self):

721

return self._approvals_pending

722

def _set_approvals_pending(self, value):

723

old_value = self._approvals_pending

724

self._approvals_pending = value

725

bval = bool(value)

726

if (hasattr(self, "dbus_object_path")

727

and bval is not bool(old_value)):

728

dbus_bool = dbus.Boolean(bval, variant_level=1)

729

self.PropertyChanged(dbus.String(u"approved_pending"),

730

dbus_bool)

731

732

approvals_pending = property(_get_approvals_pending,

733

_set_approvals_pending)

734

del _get_approvals_pending, _set_approvals_pending

735

736

@staticmethod

737

def _datetime_to_dbus(dt, variant_level=0):

738

"""Convert a UTC datetime.datetime() to a D-Bus type."""

739

return dbus.String(dt.isoformat(),

740

variant_level=variant_level)

741

742

def enable(self):

743

oldstate = getattr(self, u"enabled", False)

744

r = Client.enable(self)

745

if oldstate != self.enabled:

746

# Emit D-Bus signals

747

self.PropertyChanged(dbus.String(u"enabled"),

748

dbus.Boolean(True, variant_level=1))

749

self.PropertyChanged(

750

dbus.String(u"last_enabled"),

751

self._datetime_to_dbus(self.last_enabled,

752

variant_level=1))

753

return r

754

755

def disable(self, quiet = False):

756

oldstate = getattr(self, u"enabled", False)

757

r = Client.disable(self, quiet=quiet)

758

if not quiet and oldstate != self.enabled:

759

# Emit D-Bus signal

760

self.PropertyChanged(dbus.String(u"enabled"),

761

dbus.Boolean(False, variant_level=1))

762

return r

879

880

def notifychangeproperty(transform_func,

881

dbus_name, type_func=lambda x: x,

882

variant_level=1):

883

""" Modify a variable so that it's a property which announces

884

its changes to DBus.

885

886

transform_fun: Function that takes a value and transforms it

887

to a D-Bus type.

888

dbus_name: D-Bus name of the variable

889

type_func: Function that transform the value before sending it

890

to the D-Bus. Default: no transform

891

variant_level: D-Bus variant level. Default: 1

892

"""

893

real_value = [None,]

894

def setter(self, value):

895

old_value = real_value[0]

896

real_value[0] = value

897

if hasattr(self, "dbus_object_path"):

898

if type_func(old_value) != type_func(real_value[0]):

899

dbus_value = transform_func(type_func(real_value[0]),

900

variant_level)

901

self.PropertyChanged(dbus.String(dbus_name),

902

dbus_value)

903

904

return property(lambda self: real_value[0], setter)

905

906

907

expires = notifychangeproperty(datetime_to_dbus, "Expires")

908

approvals_pending = notifychangeproperty(dbus.Boolean,

909

"ApprovalPending",

910

type_func = bool)

911

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

912

last_enabled = notifychangeproperty(datetime_to_dbus,

913

"LastEnabled")

914

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

915

type_func = lambda checker: checker is not None)

916

last_checked_ok = notifychangeproperty(datetime_to_dbus,

917

"LastCheckedOK")

918

last_approval_request = notifychangeproperty(datetime_to_dbus,

919

"LastApprovalRequest")

920

approved_by_default = notifychangeproperty(dbus.Boolean,

921

"ApprovedByDefault")

922

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

923

type_func = _timedelta_to_milliseconds)

924

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

925

type_func = _timedelta_to_milliseconds)

926

host = notifychangeproperty(dbus.String, "Host")

927

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

928

type_func = _timedelta_to_milliseconds)

929

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

930

type_func = _timedelta_to_milliseconds)

931

interval = notifychangeproperty(dbus.UInt16, "Interval",

932

type_func = _timedelta_to_milliseconds)

933

checker_command = notifychangeproperty(dbus.String, "Checker")

934

935

del notifychangeproperty

763

936

764

937

def __del__(self, *args, **kwargs):

765

938

try:

766

939

self.remove_from_connection()

767

940

except LookupError:

768

941

pass

769

if hasattr(DBusObjectWithProperties, u"__del__"):

942

if hasattr(DBusObjectWithProperties, "__del__"):

770

943

DBusObjectWithProperties.__del__(self, *args, **kwargs)

771

944

Client.__del__(self, *args, **kwargs)

772

945

774

947

*args, **kwargs):

775

948

self.checker_callback_tag = None

776

949

self.checker = None

777

# Emit D-Bus signal

778

self.PropertyChanged(dbus.String(u"checker_running"),

779

dbus.Boolean(False, variant_level=1))

780

950

if os.WIFEXITED(condition):

781

951

exitstatus = os.WEXITSTATUS(condition)

782

952

# Emit D-Bus signal

792

962

return Client.checker_callback(self, pid, condition, command,

793

963

*args, **kwargs)

794

964

795

def checked_ok(self, *args, **kwargs):

796

r = Client.checked_ok(self, *args, **kwargs)

797

# Emit D-Bus signal

798

self.PropertyChanged(

799

dbus.String(u"last_checked_ok"),

800

(self._datetime_to_dbus(self.last_checked_ok,

801

variant_level=1)))

802

return r

803

804

965

def start_checker(self, *args, **kwargs):

805

966

old_checker = self.checker

806

967

if self.checker is not None:

813

974

and old_checker_pid != self.checker.pid):

814

975

# Emit D-Bus signal

815

976

self.CheckerStarted(self.current_checker_command)

816

self.PropertyChanged(

817

dbus.String(u"checker_running"),

818

dbus.Boolean(True, variant_level=1))

819

977

return r

820

978

821

def stop_checker(self, *args, **kwargs):

822

old_checker = getattr(self, u"checker", None)

823

r = Client.stop_checker(self, *args, **kwargs)

824

if (old_checker is not None

825

and getattr(self, u"checker", None) is None):

826

self.PropertyChanged(dbus.String(u"checker_running"),

827

dbus.Boolean(False, variant_level=1))

828

return r

829

830

979

def _reset_approved(self):

831

980

self._approved = None

832

981

return False

834

983

def approve(self, value=True):

835

984

self.send_changedstate()

836

985

self._approved = value

837

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),

986

gobject.timeout_add(_timedelta_to_milliseconds

987

(self.approval_duration),

838

988

self._reset_approved)

839

989

840

990

841

991

## D-Bus methods, signals & properties

842

_interface = u"se.bsnet.fukt.Mandos.Client"

992

_interface = "se.recompile.Mandos.Client"

843

993

844

994

## Signals

845

995

846

996

# CheckerCompleted - signal

847

@dbus.service.signal(_interface, signature=u"nxs")

997

@dbus.service.signal(_interface, signature="nxs")

848

998

def CheckerCompleted(self, exitcode, waitstatus, command):

849

999

"D-Bus signal"

850

1000

pass

851

1001

852

1002

# CheckerStarted - signal

853

@dbus.service.signal(_interface, signature=u"s")

1003

@dbus.service.signal(_interface, signature="s")

854

1004

def CheckerStarted(self, command):

855

1005

"D-Bus signal"

856

1006

pass

857

1007

858

1008

# PropertyChanged - signal

859

@dbus.service.signal(_interface, signature=u"sv")

1009

@dbus.service.signal(_interface, signature="sv")

860

1010

def PropertyChanged(self, property, value):

861

1011

"D-Bus signal"

862

1012

pass

871

1021

pass

872

1022

873

1023

# Rejected - signal

874

@dbus.service.signal(_interface, signature=u"s")

1024

@dbus.service.signal(_interface, signature="s")

875

1025

def Rejected(self, reason):

876

1026

"D-Bus signal"

877

1027

pass

878

1028

879

1029

# NeedApproval - signal

880

@dbus.service.signal(_interface, signature=u"db")

1030

@dbus.service.signal(_interface, signature="tb")

881

1031

def NeedApproval(self, timeout, default):

882

1032

"D-Bus signal"

883

pass

1033

return self.need_approval()

884

1034

885

1035

## Methods

886

1036

887

1037

# Approve - method

888

@dbus.service.method(_interface, in_signature=u"b")

1038

@dbus.service.method(_interface, in_signature="b")

889

1039

def Approve(self, value):

890

1040

self.approve(value)

891

1041

892

1042

# CheckedOK - method

893

1043

@dbus.service.method(_interface)

894

1044

def CheckedOK(self):

895

return self.checked_ok()

1045

self.checked_ok()

896

1046

897

1047

# Enable - method

898

1048

@dbus.service.method(_interface)

919

1069

920

1070

## Properties

921

1071

922

# approved_pending - property

923

@dbus_service_property(_interface, signature=u"b", access=u"read")

924

def approved_pending_dbus_property(self):

1072

# ApprovalPending - property

1073

@dbus_service_property(_interface, signature="b", access="read")

1074

def ApprovalPending_dbus_property(self):

925

1075

return dbus.Boolean(bool(self.approvals_pending))

926

1076

927

# approved_by_default - property

928

@dbus_service_property(_interface, signature=u"b",

929

access=u"readwrite")

930

def approved_by_default_dbus_property(self):

931

return dbus.Boolean(self.approved_by_default)

932

933

# approved_delay - property

934

@dbus_service_property(_interface, signature=u"t",

935

access=u"readwrite")

936

def approved_delay_dbus_property(self):

937

return dbus.UInt64(self.approved_delay_milliseconds())

938

939

# approved_duration - property

940

@dbus_service_property(_interface, signature=u"t",

941

access=u"readwrite")

942

def approved_duration_dbus_property(self):

943

return dbus.UInt64(self._timedelta_to_milliseconds(

944

self.approved_duration))

945

946

# name - property

947

@dbus_service_property(_interface, signature=u"s", access=u"read")

948

def name_dbus_property(self):

1077

# ApprovedByDefault - property

1078

@dbus_service_property(_interface, signature="b",

1079

access="readwrite")

1080

def ApprovedByDefault_dbus_property(self, value=None):

1081

if value is None: # get

1082

return dbus.Boolean(self.approved_by_default)

1083

self.approved_by_default = bool(value)

1084

1085

# ApprovalDelay - property

1086

@dbus_service_property(_interface, signature="t",

1087

access="readwrite")

1088

def ApprovalDelay_dbus_property(self, value=None):

1089

if value is None: # get

1090

return dbus.UInt64(self.approval_delay_milliseconds())

1091

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1092

1093

# ApprovalDuration - property

1094

@dbus_service_property(_interface, signature="t",

1095

access="readwrite")

1096

def ApprovalDuration_dbus_property(self, value=None):

1097

if value is None: # get

1098

return dbus.UInt64(_timedelta_to_milliseconds(

1099

self.approval_duration))

1100

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1101

1102

# Name - property

1103

@dbus_service_property(_interface, signature="s", access="read")

1104

def Name_dbus_property(self):

949

1105

return dbus.String(self.name)

950

1106

951

# fingerprint - property

952

@dbus_service_property(_interface, signature=u"s", access=u"read")

953

def fingerprint_dbus_property(self):

1107

# Fingerprint - property

1108

@dbus_service_property(_interface, signature="s", access="read")

1109

def Fingerprint_dbus_property(self):

954

1110

return dbus.String(self.fingerprint)

955

1111

956

# host - property

957

@dbus_service_property(_interface, signature=u"s",

958

access=u"readwrite")

959

def host_dbus_property(self, value=None):

1112

# Host - property

1113

@dbus_service_property(_interface, signature="s",

1114

access="readwrite")

1115

def Host_dbus_property(self, value=None):

960

1116

if value is None: # get

961

1117

return dbus.String(self.host)

962

1118

self.host = value

963

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"host"),

965

dbus.String(value, variant_level=1))

966

967

# created - property

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

969

def created_dbus_property(self):

970

return dbus.String(self._datetime_to_dbus(self.created))

971

972

# last_enabled - property

973

@dbus_service_property(_interface, signature=u"s", access=u"read")

974

def last_enabled_dbus_property(self):

975

if self.last_enabled is None:

976

return dbus.String(u"")

977

return dbus.String(self._datetime_to_dbus(self.last_enabled))

978

979

# enabled - property

980

@dbus_service_property(_interface, signature=u"b",

981

access=u"readwrite")

982

def enabled_dbus_property(self, value=None):

1119

1120

# Created - property

1121

@dbus_service_property(_interface, signature="s", access="read")

1122

def Created_dbus_property(self):

1123

return dbus.String(datetime_to_dbus(self.created))

1124

1125

# LastEnabled - property

1126

@dbus_service_property(_interface, signature="s", access="read")

1127

def LastEnabled_dbus_property(self):

1128

return datetime_to_dbus(self.last_enabled)

1129

1130

# Enabled - property

1131

@dbus_service_property(_interface, signature="b",

1132

access="readwrite")

1133

def Enabled_dbus_property(self, value=None):

983

1134

if value is None: # get

984

1135

return dbus.Boolean(self.enabled)

985

1136

if value:

987

1138

else:

988

1139

self.disable()

989

1140

990

# last_checked_ok - property

991

@dbus_service_property(_interface, signature=u"s",

992

access=u"readwrite")

993

def last_checked_ok_dbus_property(self, value=None):

1141

# LastCheckedOK - property

1142

@dbus_service_property(_interface, signature="s",

1143

access="readwrite")

1144

def LastCheckedOK_dbus_property(self, value=None):

994

1145

if value is not None:

995

1146

self.checked_ok()

996

1147

return

997

if self.last_checked_ok is None:

998

return dbus.String(u"")

999

return dbus.String(self._datetime_to_dbus(self

1000

.last_checked_ok))

1001

1002

# timeout - property

1003

@dbus_service_property(_interface, signature=u"t",

1004

access=u"readwrite")

1005

def timeout_dbus_property(self, value=None):

1148

return datetime_to_dbus(self.last_checked_ok)

1149

1150

# Expires - property

1151

@dbus_service_property(_interface, signature="s", access="read")

1152

def Expires_dbus_property(self):

1153

return datetime_to_dbus(self.expires)

1154

1155

# LastApprovalRequest - property

1156

@dbus_service_property(_interface, signature="s", access="read")

1157

def LastApprovalRequest_dbus_property(self):

1158

return datetime_to_dbus(self.last_approval_request)

1159

1160

# Timeout - property

1161

@dbus_service_property(_interface, signature="t",

1162

access="readwrite")

1163

def Timeout_dbus_property(self, value=None):

1006

1164

if value is None: # get

1007

1165

return dbus.UInt64(self.timeout_milliseconds())

1008

1166

self.timeout = datetime.timedelta(0, 0, 0, value)

1009

# Emit D-Bus signal

1010

self.PropertyChanged(dbus.String(u"timeout"),

1011

dbus.UInt64(value, variant_level=1))

1012

if getattr(self, u"disable_initiator_tag", None) is None:

1167

if getattr(self, "disable_initiator_tag", None) is None:

1013

1168

return

1014

1169

# Reschedule timeout

1015

1170

gobject.source_remove(self.disable_initiator_tag)

1016

1171

self.disable_initiator_tag = None

1172

self.expires = None

1017

1173

time_to_die = (self.

1018

1174

_timedelta_to_milliseconds((self

1019

1175

.last_checked_ok

1024

1180

# The timeout has passed

1025

1181

self.disable()

1026

1182

else:

1183

self.expires = (datetime.datetime.utcnow()

1184

+ datetime.timedelta(milliseconds = time_to_die))

1027

1185

self.disable_initiator_tag = (gobject.timeout_add

1028

1186

(time_to_die, self.disable))

1029

1187

1030

# interval - property

1031

@dbus_service_property(_interface, signature=u"t",

1032

access=u"readwrite")

1033

def interval_dbus_property(self, value=None):

1188

# ExtendedTimeout - property

1189

@dbus_service_property(_interface, signature="t",

1190

access="readwrite")

1191

def ExtendedTimeout_dbus_property(self, value=None):

1192

if value is None: # get

1193

return dbus.UInt64(self.extended_timeout_milliseconds())

1194

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1195

1196

# Interval - property

1197

@dbus_service_property(_interface, signature="t",

1198

access="readwrite")

1199

def Interval_dbus_property(self, value=None):

1034

1200

if value is None: # get

1035

1201

return dbus.UInt64(self.interval_milliseconds())

1036

1202

self.interval = datetime.timedelta(0, 0, 0, value)

1037

# Emit D-Bus signal

1038

self.PropertyChanged(dbus.String(u"interval"),

1039

dbus.UInt64(value, variant_level=1))

1040

if getattr(self, u"checker_initiator_tag", None) is None:

1203

if getattr(self, "checker_initiator_tag", None) is None:

1041

1204

return

1042

1205

# Reschedule checker run

1043

1206

gobject.source_remove(self.checker_initiator_tag)

1044

1207

self.checker_initiator_tag = (gobject.timeout_add

1045

1208

(value, self.start_checker))

1046

1209

self.start_checker() # Start one now, too

1047

1048

# checker - property

1049

@dbus_service_property(_interface, signature=u"s",

1050

access=u"readwrite")

1051

def checker_dbus_property(self, value=None):

1210

1211

# Checker - property

1212

@dbus_service_property(_interface, signature="s",

1213

access="readwrite")

1214

def Checker_dbus_property(self, value=None):

1052

1215

if value is None: # get

1053

1216

return dbus.String(self.checker_command)

1054

1217

self.checker_command = value

1055

# Emit D-Bus signal

1056

self.PropertyChanged(dbus.String(u"checker"),

1057

dbus.String(self.checker_command,

1058

variant_level=1))

1059

1218

1060

# checker_running - property

1061

@dbus_service_property(_interface, signature=u"b",

1062

access=u"readwrite")

1063

def checker_running_dbus_property(self, value=None):

1219

# CheckerRunning - property

1220

@dbus_service_property(_interface, signature="b",

1221

access="readwrite")

1222

def CheckerRunning_dbus_property(self, value=None):

1064

1223

if value is None: # get

1065

1224

return dbus.Boolean(self.checker is not None)

1066

1225

if value:

1068

1227

else:

1069

1228

self.stop_checker()

1070

1229

1071

# object_path - property

1072

@dbus_service_property(_interface, signature=u"o", access=u"read")

1073

def object_path_dbus_property(self):

1230

# ObjectPath - property

1231

@dbus_service_property(_interface, signature="o", access="read")

1232

def ObjectPath_dbus_property(self):

1074

1233

return self.dbus_object_path # is already a dbus.ObjectPath

1075

1234

1076

# secret = property

1077

@dbus_service_property(_interface, signature=u"ay",

1078

access=u"write", byte_arrays=True)

1079

def secret_dbus_property(self, value):

1235

# Secret = property

1236

@dbus_service_property(_interface, signature="ay",

1237

access="write", byte_arrays=True)

1238

def Secret_dbus_property(self, value):

1080

1239

self.secret = str(value)

1081

1240

1082

1241

del _interface

1088

1247

self._pipe.send(('init', fpr, address))

1089

1248

if not self._pipe.recv():

1090

1249

raise KeyError()

1091

1250

1092

1251

def __getattribute__(self, name):

1093

1252

if(name == '_pipe'):

1094

1253

return super(ProxyClient, self).__getattribute__(name)

1101

1260

self._pipe.send(('funcall', name, args, kwargs))

1102

1261

return self._pipe.recv()[1]

1103

1262

return func

1104

1263

1105

1264

def __setattr__(self, name, value):

1106

1265

if(name == '_pipe'):

1107

1266

return super(ProxyClient, self).__setattr__(name, value)

1108

1267

self._pipe.send(('setattr', name, value))

1109

1268

1269

class ClientDBusTransitional(ClientDBus):

1270

__metaclass__ = AlternateDBusNamesMetaclass

1110

1271

1111

1272

class ClientHandler(socketserver.BaseRequestHandler, object):

1112

1273

"""A class to handle client connections.

1116

1277

1117

1278

def handle(self):

1118

1279

with contextlib.closing(self.server.child_pipe) as child_pipe:

1119

logger.info(u"TCP connection from: %s",

1280

logger.info("TCP connection from: %s",

1120

1281

unicode(self.client_address))

1121

logger.debug(u"Pipe FD: %d",

1282

logger.debug("Pipe FD: %d",

1122

1283

self.server.child_pipe.fileno())

1123

1284

1124

1285

session = (gnutls.connection

1125

1286

.ClientSession(self.request,

1126

1287

gnutls.connection

1127

1288

.X509Credentials()))

1128

1289

1129

1290

# Note: gnutls.connection.X509Credentials is really a

1130

1291

# generic GnuTLS certificate credentials object so long as

1131

1292

# no X.509 keys are added to it. Therefore, we can use it

1132

1293

# here despite using OpenPGP certificates.

1133

1134

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1135

# u"+AES-256-CBC", u"+SHA1",

1136

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1137

# u"+DHE-DSS"))

1294

1295

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1296

# "+AES-256-CBC", "+SHA1",

1297

# "+COMP-NULL", "+CTYPE-OPENPGP",

1298

# "+DHE-DSS"))

1138

1299

# Use a fallback default, since this MUST be set.

1139

1300

priority = self.server.gnutls_priority

1140

1301

if priority is None:

1141

priority = u"NORMAL"

1302

priority = "NORMAL"

1142

1303

(gnutls.library.functions

1143

1304

.gnutls_priority_set_direct(session._c_object,

1144

1305

priority, None))

1145

1306

1146

1307

# Start communication using the Mandos protocol

1147

1308

# Get protocol number

1148

1309

line = self.request.makefile().readline()

1149

logger.debug(u"Protocol version: %r", line)

1310

logger.debug("Protocol version: %r", line)

1150

1311

try:

1151

1312

if int(line.strip().split()[0]) > 1:

1152

1313

raise RuntimeError

1153

except (ValueError, IndexError, RuntimeError), error:

1154

logger.error(u"Unknown protocol version: %s", error)

1314

except (ValueError, IndexError, RuntimeError) as error:

1315

logger.error("Unknown protocol version: %s", error)

1155

1316

return

1156

1317

1157

1318

# Start GnuTLS connection

1158

1319

try:

1159

1320

session.handshake()

1160

except gnutls.errors.GNUTLSError, error:

1161

logger.warning(u"Handshake failed: %s", error)

1321

except gnutls.errors.GNUTLSError as error:

1322

logger.warning("Handshake failed: %s", error)

1162

1323

# Do not run session.bye() here: the session is not

1163

1324

# established. Just abandon the request.

1164

1325

return

1165

logger.debug(u"Handshake succeeded")

1166

1326

logger.debug("Handshake succeeded")

1327

1167

1328

approval_required = False

1168

1329

try:

1169

1330

try:

1170

1331

fpr = self.fingerprint(self.peer_certificate

1171

1332

(session))

1172

except (TypeError, gnutls.errors.GNUTLSError), error:

1173

logger.warning(u"Bad certificate: %s", error)

1333

except (TypeError,

1334

gnutls.errors.GNUTLSError) as error:

1335

logger.warning("Bad certificate: %s", error)

1174

1336

return

1175

logger.debug(u"Fingerprint: %s", fpr)

1176

1337

logger.debug("Fingerprint: %s", fpr)

1338

1177

1339

try:

1178

1340

client = ProxyClient(child_pipe, fpr,

1179

1341

self.client_address)

1180

1342

except KeyError:

1181

1343

return

1182

1344

1183

if client.approved_delay:

1184

delay = client.approved_delay

1345

if client.approval_delay:

1346

delay = client.approval_delay

1185

1347

client.approvals_pending += 1

1186

1348

approval_required = True

1187

1349

1188

1350

while True:

1189

1351

if not client.enabled:

1190

logger.warning(u"Client %s is disabled",

1352

logger.info("Client %s is disabled",

1191

1353

client.name)

1192

1354

if self.server.use_dbus:

1193

1355

# Emit D-Bus signal

1194

1356

client.Rejected("Disabled")

1195

1357

return

1196

1358

1197

if client._approved or not client.approved_delay:

1359

if client._approved or not client.approval_delay:

1198

1360

#We are approved or approval is disabled

1199

1361

break

1200

1362

elif client._approved is None:

1201

logger.info(u"Client %s need approval",

1363

logger.info("Client %s needs approval",

1202

1364

client.name)

1203

1365

if self.server.use_dbus:

1204

1366

# Emit D-Bus signal

1205

1367

client.NeedApproval(

1206

client.approved_delay_milliseconds(),

1368

client.approval_delay_milliseconds(),

1207

1369

client.approved_by_default)

1208

1370

else:

1209

logger.warning(u"Client %s was not approved",

1371

logger.warning("Client %s was not approved",

1210

1372

client.name)

1211

1373

if self.server.use_dbus:

1212

1374

# Emit D-Bus signal

1213

client.Rejected("Disapproved")

1375

client.Rejected("Denied")

1214

1376

return

1215

1377

1216

1378

#wait until timeout or approved

1227

1389

client.name)

1228

1390

if self.server.use_dbus:

1229

1391

# Emit D-Bus signal

1230

client.Rejected("Time out")

1392

client.Rejected("Approval timed out")

1231

1393

return

1232

1394

else:

1233

1395

break

1238

1400

while sent_size < len(client.secret):

1239

1401

try:

1240

1402

sent = session.send(client.secret[sent_size:])

1241

except (gnutls.errors.GNUTLSError), error:

1403

except gnutls.errors.GNUTLSError as error:

1242

1404

logger.warning("gnutls send failed")

1243

1405

return

1244

logger.debug(u"Sent: %d, remaining: %d",

1406

logger.debug("Sent: %d, remaining: %d",

1245

1407

sent, len(client.secret)

1246

1408

- (sent_size + sent))

1247

1409

sent_size += sent

1248

1249

logger.info(u"Sending secret to %s", client.name)

1410

1411

logger.info("Sending secret to %s", client.name)

1250

1412

# bump the timeout as if seen

1251

client.checked_ok()

1413

client.checked_ok(client.extended_timeout)

1252

1414

if self.server.use_dbus:

1253

1415

# Emit D-Bus signal

1254

1416

client.GotSecret()

1258

1420

client.approvals_pending -= 1

1259

1421

try:

1260

1422

session.bye()

1261

except (gnutls.errors.GNUTLSError), error:

1262

logger.warning("gnutls bye failed")

1423

except gnutls.errors.GNUTLSError as error:

1424

logger.warning("GnuTLS bye failed")

1263

1425

1264

1426

@staticmethod

1265

1427

def peer_certificate(session):

1275

1437

.gnutls_certificate_get_peers

1276

1438

(session._c_object, ctypes.byref(list_size)))

1277

1439

if not bool(cert_list) and list_size.value != 0:

1278

raise gnutls.errors.GNUTLSError(u"error getting peer"

1279

u" certificate")

1440

raise gnutls.errors.GNUTLSError("error getting peer"

1441

" certificate")

1280

1442

if list_size.value == 0:

1281

1443

return None

1282

1444

cert = cert_list[0]

1308

1470

if crtverify.value != 0:

1309

1471

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1310

1472

raise (gnutls.errors.CertificateSecurityError

1311

(u"Verify failed"))

1473

("Verify failed"))

1312

1474

# New buffer for the fingerprint

1313

1475

buf = ctypes.create_string_buffer(20)

1314

1476

buf_len = ctypes.c_size_t()

1321

1483

# Convert the buffer to a Python bytestring

1322

1484

fpr = ctypes.string_at(buf, buf_len.value)

1323

1485

# Convert the bytestring to hexadecimal notation

1324

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1486

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1325

1487

return hex_fpr

1326

1488

1327

1489

1339

1501

multiprocessing.Process(target = self.sub_process_main,

1340

1502

args = (request, address)).start()

1341

1503

1504

1342

1505

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1343

1506

""" adds a pipe to the MixIn """

1344

1507

def process_request(self, request, client_address):

1347

1510

This function creates a new pipe in self.pipe

1348

1511

"""

1349

1512

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1350

1513

1351

1514

super(MultiprocessingMixInWithPipe,

1352

1515

self).process_request(request, client_address)

1353

1516

self.child_pipe.close()

1354

1517

self.add_pipe(parent_pipe)

1355

1518

1356

1519

def add_pipe(self, parent_pipe):

1357

1520

"""Dummy function; override as necessary"""

1358

pass

1521

raise NotImplementedError

1522

1359

1523

1360

1524

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1361

1525

socketserver.TCPServer, object):

1379

1543

bind to an address or port if they were not specified."""

1380

1544

if self.interface is not None:

1381

1545

if SO_BINDTODEVICE is None:

1382

logger.error(u"SO_BINDTODEVICE does not exist;"

1383

u" cannot bind to interface %s",

1546

logger.error("SO_BINDTODEVICE does not exist;"

1547

" cannot bind to interface %s",

1384

1548

self.interface)

1385

1549

else:

1386

1550

try:

1387

1551

self.socket.setsockopt(socket.SOL_SOCKET,

1388

1552

SO_BINDTODEVICE,

1389

1553

str(self.interface

1390

+ u'\0'))

1391

except socket.error, error:

1554

+ '\0'))

1555

except socket.error as error:

1392

1556

if error[0] == errno.EPERM:

1393

logger.error(u"No permission to"

1394

u" bind to interface %s",

1557

logger.error("No permission to"

1558

" bind to interface %s",

1395

1559

self.interface)

1396

1560

elif error[0] == errno.ENOPROTOOPT:

1397

logger.error(u"SO_BINDTODEVICE not available;"

1398

u" cannot bind to interface %s",

1561

logger.error("SO_BINDTODEVICE not available;"

1562

" cannot bind to interface %s",

1399

1563

self.interface)

1400

1564

else:

1401

1565

raise

1403

1567

if self.server_address[0] or self.server_address[1]:

1404

1568

if not self.server_address[0]:

1405

1569

if self.address_family == socket.AF_INET6:

1406

any_address = u"::" # in6addr_any

1570

any_address = "::" # in6addr_any

1407

1571

else:

1408

1572

any_address = socket.INADDR_ANY

1409

1573

self.server_address = (any_address,

1458

1622

def handle_ipc(self, source, condition, parent_pipe=None,

1459

1623

client_object=None):

1460

1624

condition_names = {

1461

gobject.IO_IN: u"IN", # There is data to read.

1462

gobject.IO_OUT: u"OUT", # Data can be written (without

1625

gobject.IO_IN: "IN", # There is data to read.

1626

gobject.IO_OUT: "OUT", # Data can be written (without

1463

1627

# blocking).

1464

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1465

gobject.IO_ERR: u"ERR", # Error condition.

1466

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1628

gobject.IO_PRI: "PRI", # There is urgent data to read.

1629

gobject.IO_ERR: "ERR", # Error condition.

1630

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1467

1631

# broken, usually for pipes and

1468

1632

# sockets).

1469

1633

}

1471

1635

for cond, name in

1472

1636

condition_names.iteritems()

1473

1637

if cond & condition)

1474

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1475

conditions_string)

1476

1477

1638

# error or the other end of multiprocessing.Pipe has closed

1478

1639

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1479

1640

return False

1480

1641

1481

1642

# Read a request from the child

1482

1643

request = parent_pipe.recv()

1483

logger.debug(u"IPC request: %s", repr(request))

1484

1644

command = request[0]

1485

1645

1486

1646

if command == 'init':

1492

1652

client = c

1493

1653

break

1494

1654

else:

1495

logger.warning(u"Client not found for fingerprint: %s, ad"

1496

u"dress: %s", fpr, address)

1655

logger.info("Client not found for fingerprint: %s, ad"

1656

"dress: %s", fpr, address)

1497

1657

if self.use_dbus:

1498

1658

# Emit D-Bus signal

1499

mandos_dbus_service.ClientNotFound(fpr, address)

1659

mandos_dbus_service.ClientNotFound(fpr, address[0])

1500

1660

parent_pipe.send(False)

1501

1661

return False

1502

1662

1514

1674

kwargs = request[3]

1515

1675

1516

1676

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1517

1677

1518

1678

if command == 'getattr':

1519

1679

attrname = request[1]

1520

1680

if callable(client_object.__getattribute__(attrname)):

1526

1686

attrname = request[1]

1527

1687

value = request[2]

1528

1688

setattr(client_object, attrname, value)

1529

1689

1530

1690

return True

1531

1691

1532

1692

1533

1693

def string_to_delta(interval):

1534

1694

"""Parse a string and return a datetime.timedelta

1535

1695

1536

>>> string_to_delta(u'7d')

1696

>>> string_to_delta('7d')

1537

1697

datetime.timedelta(7)

1538

>>> string_to_delta(u'60s')

1698

>>> string_to_delta('60s')

1539

1699

datetime.timedelta(0, 60)

1540

>>> string_to_delta(u'60m')

1700

>>> string_to_delta('60m')

1541

1701

datetime.timedelta(0, 3600)

1542

>>> string_to_delta(u'24h')

1702

>>> string_to_delta('24h')

1543

1703

datetime.timedelta(1)

1544

>>> string_to_delta(u'1w')

1704

>>> string_to_delta('1w')

1545

1705

datetime.timedelta(7)

1546

>>> string_to_delta(u'5m 30s')

1706

>>> string_to_delta('5m 30s')

1547

1707

datetime.timedelta(0, 330)

1548

1708

"""

1549

1709

timevalue = datetime.timedelta(0)

1551

1711

try:

1552

1712

suffix = unicode(s[-1])

1553

1713

value = int(s[:-1])

1554

if suffix == u"d":

1714

if suffix == "d":

1555

1715

delta = datetime.timedelta(value)

1556

elif suffix == u"s":

1716

elif suffix == "s":

1557

1717

delta = datetime.timedelta(0, value)

1558

elif suffix == u"m":

1718

elif suffix == "m":

1559

1719

delta = datetime.timedelta(0, 0, 0, 0, value)

1560

elif suffix == u"h":

1720

elif suffix == "h":

1561

1721

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1562

elif suffix == u"w":

1722

elif suffix == "w":

1563

1723

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1564

1724

else:

1565

raise ValueError(u"Unknown suffix %r" % suffix)

1566

except (ValueError, IndexError), e:

1567

raise ValueError(e.message)

1725

raise ValueError("Unknown suffix %r" % suffix)

1726

except (ValueError, IndexError) as e:

1727

raise ValueError(*(e.args))

1568

1728

timevalue += delta

1569

1729

return timevalue

1570

1730

1576

1736

global if_nametoindex

1577

1737

try:

1578

1738

if_nametoindex = (ctypes.cdll.LoadLibrary

1579

(ctypes.util.find_library(u"c"))

1739

(ctypes.util.find_library("c"))

1580

1740

.if_nametoindex)

1581

1741

except (OSError, AttributeError):

1582

logger.warning(u"Doing if_nametoindex the hard way")

1742

logger.warning("Doing if_nametoindex the hard way")

1583

1743

def if_nametoindex(interface):

1584

1744

"Get an interface index the hard way, i.e. using fcntl()"

1585

1745

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1586

1746

with contextlib.closing(socket.socket()) as s:

1587

1747

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1588

struct.pack(str(u"16s16x"),

1748

struct.pack(str("16s16x"),

1589

1749

interface))

1590

interface_index = struct.unpack(str(u"I"),

1750

interface_index = struct.unpack(str("I"),

1591

1751

ifreq[16:20])[0]

1592

1752

return interface_index

1593

1753

return if_nametoindex(interface)

1601

1761

sys.exit()

1602

1762

os.setsid()

1603

1763

if not nochdir:

1604

os.chdir(u"/")

1764

os.chdir("/")

1605

1765

if os.fork():

1606

1766

sys.exit()

1607

1767

if not noclose:

1609

1769

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1610

1770

if not stat.S_ISCHR(os.fstat(null).st_mode):

1611

1771

raise OSError(errno.ENODEV,

1612

u"%s not a character device"

1772

"%s not a character device"

1613

1773

% os.path.devnull)

1614

1774

os.dup2(null, sys.stdin.fileno())

1615

1775

os.dup2(null, sys.stdout.fileno())

1623

1783

##################################################################

1624

1784

# Parsing of options, both command line and config file

1625

1785

1626

parser = optparse.OptionParser(version = "%%prog %s" % version)

1627

parser.add_option("-i", u"--interface", type=u"string",

1628

metavar="IF", help=u"Bind to interface IF")

1629

parser.add_option("-a", u"--address", type=u"string",

1630

help=u"Address to listen for requests on")

1631

parser.add_option("-p", u"--port", type=u"int",

1632

help=u"Port number to receive requests on")

1633

parser.add_option("--check", action=u"store_true",

1634

help=u"Run self-test")

1635

parser.add_option("--debug", action=u"store_true",

1636

help=u"Debug mode; run in foreground and log to"

1637

u" terminal")

1638

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1639

help=u"Debug level for stdout output")

1640

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1641

u" priority string (see GnuTLS documentation)")

1642

parser.add_option("--servicename", type=u"string",

1643

metavar=u"NAME", help=u"Zeroconf service name")

1644

parser.add_option("--configdir", type=u"string",

1645

default=u"/etc/mandos", metavar=u"DIR",

1646

help=u"Directory to search for configuration"

1647

u" files")

1648

parser.add_option("--no-dbus", action=u"store_false",

1649

dest=u"use_dbus", help=u"Do not provide D-Bus"

1650

u" system bus interface")

1651

parser.add_option("--no-ipv6", action=u"store_false",

1652

dest=u"use_ipv6", help=u"Do not use IPv6")

1653

options = parser.parse_args()[0]

1786

parser = argparse.ArgumentParser()

1787

parser.add_argument("-v", "--version", action="version",

1788

version = "%%(prog)s %s" % version,

1789

help="show version number and exit")

1790

parser.add_argument("-i", "--interface", metavar="IF",

1791

help="Bind to interface IF")

1792

parser.add_argument("-a", "--address",

1793

help="Address to listen for requests on")

1794

parser.add_argument("-p", "--port", type=int,

1795

help="Port number to receive requests on")

1796

parser.add_argument("--check", action="store_true",

1797

help="Run self-test")

1798

parser.add_argument("--debug", action="store_true",

1799

help="Debug mode; run in foreground and log"

1800

" to terminal")

1801

parser.add_argument("--debuglevel", metavar="LEVEL",

1802

help="Debug level for stdout output")

1803

parser.add_argument("--priority", help="GnuTLS"

1804

" priority string (see GnuTLS documentation)")

1805

parser.add_argument("--servicename",

1806

metavar="NAME", help="Zeroconf service name")

1807

parser.add_argument("--configdir",

1808

default="/etc/mandos", metavar="DIR",

1809

help="Directory to search for configuration"

1810

" files")

1811

parser.add_argument("--no-dbus", action="store_false",

1812

dest="use_dbus", help="Do not provide D-Bus"

1813

" system bus interface")

1814

parser.add_argument("--no-ipv6", action="store_false",

1815

dest="use_ipv6", help="Do not use IPv6")

1816

options = parser.parse_args()

1654

1817

1655

1818

if options.check:

1656

1819

import doctest

1658

1821

sys.exit()

1659

1822

1660

1823

# Default values for config file for server-global settings

1661

server_defaults = { u"interface": u"",

1662

u"address": u"",

1663

u"port": u"",

1664

u"debug": u"False",

1665

u"priority":

1666

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1667

u"servicename": u"Mandos",

1668

u"use_dbus": u"True",

1669

u"use_ipv6": u"True",

1670

u"debuglevel": u"",

1824

server_defaults = { "interface": "",

1825

"address": "",

1826

"port": "",

1827

"debug": "False",

1828

"priority":

1829

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1830

"servicename": "Mandos",

1831

"use_dbus": "True",

1832

"use_ipv6": "True",

1833

"debuglevel": "",

1671

1834

}

1672

1835

1673

1836

# Parse config file for server-global settings

1674

1837

server_config = configparser.SafeConfigParser(server_defaults)

1675

1838

del server_defaults

1676

1839

server_config.read(os.path.join(options.configdir,

1677

u"mandos.conf"))

1840

"mandos.conf"))

1678

1841

# Convert the SafeConfigParser object to a dict

1679

1842

server_settings = server_config.defaults()

1680

1843

# Use the appropriate methods on the non-string config options

1681

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1682

server_settings[option] = server_config.getboolean(u"DEFAULT",

1844

for option in ("debug", "use_dbus", "use_ipv6"):

1845

server_settings[option] = server_config.getboolean("DEFAULT",

1683

1846

option)

1684

1847

if server_settings["port"]:

1685

server_settings["port"] = server_config.getint(u"DEFAULT",

1686

u"port")

1848

server_settings["port"] = server_config.getint("DEFAULT",

1849

"port")

1687

1850

del server_config

1688

1851

1689

1852

# Override the settings from the config file with command line

1690

1853

# options, if set.

1691

for option in (u"interface", u"address", u"port", u"debug",

1692

u"priority", u"servicename", u"configdir",

1693

u"use_dbus", u"use_ipv6", u"debuglevel"):

1854

for option in ("interface", "address", "port", "debug",

1855

"priority", "servicename", "configdir",

1856

"use_dbus", "use_ipv6", "debuglevel"):

1694

1857

value = getattr(options, option)

1695

1858

if value is not None:

1696

1859

server_settings[option] = value

1704

1867

##################################################################

1705

1868

1706

1869

# For convenience

1707

debug = server_settings[u"debug"]

1708

debuglevel = server_settings[u"debuglevel"]

1709

use_dbus = server_settings[u"use_dbus"]

1710

use_ipv6 = server_settings[u"use_ipv6"]

1711

1712

if server_settings[u"servicename"] != u"Mandos":

1870

debug = server_settings["debug"]

1871

debuglevel = server_settings["debuglevel"]

1872

use_dbus = server_settings["use_dbus"]

1873

use_ipv6 = server_settings["use_ipv6"]

1874

1875

if server_settings["servicename"] != "Mandos":

1713

1876

syslogger.setFormatter(logging.Formatter

1714

(u'Mandos (%s) [%%(process)d]:'

1715

u' %%(levelname)s: %%(message)s'

1716

% server_settings[u"servicename"]))

1877

('Mandos (%s) [%%(process)d]:'

1878

' %%(levelname)s: %%(message)s'

1879

% server_settings["servicename"]))

1717

1880

1718

1881

# Parse config file with clients

1719

client_defaults = { u"timeout": u"1h",

1720

u"interval": u"5m",

1721

u"checker": u"fping -q -- %%(host)s",

1722

u"host": u"",

1723

u"approved_delay": u"0s",

1724

u"approved_duration": u"1s",

1882

client_defaults = { "timeout": "5m",

1883

"extended_timeout": "15m",

1884

"interval": "2m",

1885

"checker": "fping -q -- %%(host)s",

1886

"host": "",

1887

"approval_delay": "0s",

1888

"approval_duration": "1s",

1725

1889

}

1726

1890

client_config = configparser.SafeConfigParser(client_defaults)

1727

client_config.read(os.path.join(server_settings[u"configdir"],

1728

u"clients.conf"))

1891

client_config.read(os.path.join(server_settings["configdir"],

1892

"clients.conf"))

1729

1893

1730

1894

global mandos_dbus_service

1731

1895

mandos_dbus_service = None

1732

1896

1733

tcp_server = MandosServer((server_settings[u"address"],

1734

server_settings[u"port"]),

1897

tcp_server = MandosServer((server_settings["address"],

1898

server_settings["port"]),

1735

1899

ClientHandler,

1736

interface=(server_settings[u"interface"]

1900

interface=(server_settings["interface"]

1737

1901

or None),

1738

1902

use_ipv6=use_ipv6,

1739

1903

gnutls_priority=

1740

server_settings[u"priority"],

1904

server_settings["priority"],

1741

1905

use_dbus=use_dbus)

1742

pidfilename = u"/var/run/mandos.pid"

1743

try:

1744

pidfile = open(pidfilename, u"w")

1745

except IOError:

1746

logger.error(u"Could not open file %r", pidfilename)

1906

if not debug:

1907

pidfilename = "/var/run/mandos.pid"

1908

try:

1909

pidfile = open(pidfilename, "w")

1910

except IOError:

1911

logger.error("Could not open file %r", pidfilename)

1747

1912

1748

1913

try:

1749

uid = pwd.getpwnam(u"_mandos").pw_uid

1750

gid = pwd.getpwnam(u"_mandos").pw_gid

1914

uid = pwd.getpwnam("_mandos").pw_uid

1915

gid = pwd.getpwnam("_mandos").pw_gid

1751

1916

except KeyError:

1752

1917

try:

1753

uid = pwd.getpwnam(u"mandos").pw_uid

1754

gid = pwd.getpwnam(u"mandos").pw_gid

1918

uid = pwd.getpwnam("mandos").pw_uid

1919

gid = pwd.getpwnam("mandos").pw_gid

1755

1920

except KeyError:

1756

1921

try:

1757

uid = pwd.getpwnam(u"nobody").pw_uid

1758

gid = pwd.getpwnam(u"nobody").pw_gid

1922

uid = pwd.getpwnam("nobody").pw_uid

1923

gid = pwd.getpwnam("nobody").pw_gid

1759

1924

except KeyError:

1760

1925

uid = 65534

1761

1926

gid = 65534

1762

1927

try:

1763

1928

os.setgid(gid)

1764

1929

os.setuid(uid)

1765

except OSError, error:

1930

except OSError as error:

1766

1931

if error[0] != errno.EPERM:

1767

1932

raise error

1768

1933

1769

# Enable all possible GnuTLS debugging

1770

1771

1772

1934

if not debug and not debuglevel:

1773

1935

syslogger.setLevel(logging.WARNING)

1774

1936

console.setLevel(logging.WARNING)

1776

1938

level = getattr(logging, debuglevel.upper())

1777

1939

syslogger.setLevel(level)

1778

1940

console.setLevel(level)

1779

1941

1780

1942

if debug:

1943

# Enable all possible GnuTLS debugging

1944

1781

1945

# "Use a log level over 10 to enable all debugging options."

1782

1946

# - GnuTLS manual

1783

1947

gnutls.library.functions.gnutls_global_set_log_level(11)

1784

1948

1785

1949

@gnutls.library.types.gnutls_log_func

1786

1950

def debug_gnutls(level, string):

1787

logger.debug(u"GnuTLS: %s", string[:-1])

1951

logger.debug("GnuTLS: %s", string[:-1])

1788

1952

1789

1953

(gnutls.library.functions

1790

1954

.gnutls_global_set_log_function(debug_gnutls))

1791

1955

1792

1956

# Redirect stdin so all checkers get /dev/null

1793

1957

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1794

1958

os.dup2(null, sys.stdin.fileno())

1797

1961

else:

1798

1962

# No console logging

1799

1963

logger.removeHandler(console)

1800

1964

1965

# Need to fork before connecting to D-Bus

1966

if not debug:

1967

# Close all input and output, do double fork, etc.

1968

daemon()

1801

1969

1802

1970

global main_loop

1803

1971

# From the Avahi example code

1807

1975

# End of Avahi example code

1808

1976

if use_dbus:

1809

1977

try:

1810

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1978

bus_name = dbus.service.BusName("se.recompile.Mandos",

1811

1979

bus, do_not_queue=True)

1812

except dbus.exceptions.NameExistsException, e:

1813

logger.error(unicode(e) + u", disabling D-Bus")

1980

old_bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1981

bus, do_not_queue=True)

1982

except dbus.exceptions.NameExistsException as e:

1983

logger.error(unicode(e) + ", disabling D-Bus")

1814

1984

use_dbus = False

1815

server_settings[u"use_dbus"] = False

1985

server_settings["use_dbus"] = False

1816

1986

tcp_server.use_dbus = False

1817

1987

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1818

service = AvahiService(name = server_settings[u"servicename"],

1819

servicetype = u"_mandos._tcp",

1988

service = AvahiService(name = server_settings["servicename"],

1989

servicetype = "_mandos._tcp",

1820

1990

protocol = protocol, bus = bus)

1821

1991

if server_settings["interface"]:

1822

1992

service.interface = (if_nametoindex

1823

(str(server_settings[u"interface"])))

1824

1825

if not debug:

1826

# Close all input and output, do double fork, etc.

1827

daemon()

1828

1993

(str(server_settings["interface"])))

1994

1829

1995

global multiprocessing_manager

1830

1996

multiprocessing_manager = multiprocessing.Manager()

1831

1997

1832

1998

client_class = Client

1833

1999

if use_dbus:

1834

client_class = functools.partial(ClientDBus, bus = bus)

2000

client_class = functools.partial(ClientDBusTransitional, bus = bus)

1835

2001

def client_config_items(config, section):

1836

2002

special_settings = {

1837

2003

"approved_by_default":

1850

2016

client_config, section)))

1851

2017

for section in client_config.sections()))

1852

2018

if not tcp_server.clients:

1853

logger.warning(u"No clients defined")

2019

logger.warning("No clients defined")

1854

2020

1855

try:

1856

with pidfile:

1857

pid = os.getpid()

1858

pidfile.write(str(pid) + "\n")

1859

del pidfile

1860

except IOError:

1861

logger.error(u"Could not write to file %r with PID %d",

1862

pidfilename, pid)

1863

except NameError:

1864

# "pidfile" was never created

1865

pass

1866

del pidfilename

1867

1868

2021

if not debug:

2022

try:

2023

with pidfile:

2024

pid = os.getpid()

2025

pidfile.write(str(pid) + "\n".encode("utf-8"))

2026

del pidfile

2027

except IOError:

2028

logger.error("Could not write to file %r with PID %d",

2029

pidfilename, pid)

2030

except NameError:

2031

# "pidfile" was never created

2032

pass

2033

del pidfilename

2034

1869

2035

signal.signal(signal.SIGINT, signal.SIG_IGN)

2036

1870

2037

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1871

2038

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1872

2039

1874

2041

class MandosDBusService(dbus.service.Object):

1875

2042

"""A D-Bus proxy object"""

1876

2043

def __init__(self):

1877

dbus.service.Object.__init__(self, bus, u"/")

1878

_interface = u"se.bsnet.fukt.Mandos"

2044

dbus.service.Object.__init__(self, bus, "/")

2045

_interface = "se.recompile.Mandos"

1879

2046

1880

@dbus.service.signal(_interface, signature=u"o")

2047

@dbus.service.signal(_interface, signature="o")

1881

2048

def ClientAdded(self, objpath):

1882

2049

"D-Bus signal"

1883

2050

pass

1884

2051

1885

@dbus.service.signal(_interface, signature=u"ss")

2052

@dbus.service.signal(_interface, signature="ss")

1886

2053

def ClientNotFound(self, fingerprint, address):

1887

2054

"D-Bus signal"

1888

2055

pass

1889

2056

1890

@dbus.service.signal(_interface, signature=u"os")

2057

@dbus.service.signal(_interface, signature="os")

1891

2058

def ClientRemoved(self, objpath, name):

1892

2059

"D-Bus signal"

1893

2060

pass

1894

2061

1895

@dbus.service.method(_interface, out_signature=u"ao")

2062

@dbus.service.method(_interface, out_signature="ao")

1896

2063

def GetAllClients(self):

1897

2064

"D-Bus method"

1898

2065

return dbus.Array(c.dbus_object_path

1899

2066

for c in tcp_server.clients)

1900

2067

1901

2068

@dbus.service.method(_interface,

1902

out_signature=u"a{oa{sv}}")

2069

out_signature="a{oa{sv}}")

1903

2070

def GetAllClientsWithProperties(self):

1904

2071

"D-Bus method"

1905

2072

return dbus.Dictionary(

1906

((c.dbus_object_path, c.GetAll(u""))

2073

((c.dbus_object_path, c.GetAll(""))

1907

2074

for c in tcp_server.clients),

1908

signature=u"oa{sv}")

2075

signature="oa{sv}")

1909

2076

1910

@dbus.service.method(_interface, in_signature=u"o")

2077

@dbus.service.method(_interface, in_signature="o")

1911

2078

def RemoveClient(self, object_path):

1912

2079

"D-Bus method"

1913

2080

for c in tcp_server.clients:

1923

2090

1924

2091

del _interface

1925

2092

1926

mandos_dbus_service = MandosDBusService()

2093

class MandosDBusServiceTransitional(MandosDBusService):

2094

__metaclass__ = AlternateDBusNamesMetaclass

2095

mandos_dbus_service = MandosDBusServiceTransitional()

1927

2096

1928

2097

def cleanup():

1929

2098

"Cleanup function; run on exit"

1955

2124

# Find out what port we got

1956

2125

service.port = tcp_server.socket.getsockname()[1]

1957

2126

if use_ipv6:

1958

logger.info(u"Now listening on address %r, port %d,"

2127

logger.info("Now listening on address %r, port %d,"

1959

2128

" flowinfo %d, scope_id %d"

1960

2129

% tcp_server.socket.getsockname())

1961

2130

else: # IPv4

1962

logger.info(u"Now listening on address %r, port %d"

2131

logger.info("Now listening on address %r, port %d"

1963

2132

% tcp_server.socket.getsockname())

1964

2133

1965

2134

#service.interface = tcp_server.socket.getsockname()[3]

1968

2137

# From the Avahi example code

1969

2138

try:

1970

2139

service.activate()

1971

except dbus.exceptions.DBusException, error:

1972

logger.critical(u"DBusException: %s", error)

2140

except dbus.exceptions.DBusException as error:

2141

logger.critical("DBusException: %s", error)

1973

2142

cleanup()

1974

2143

sys.exit(1)

1975

2144

# End of Avahi example code

1979

2148

(tcp_server.handle_request

1980

2149

(*args[2:], **kwargs) or True))

1981

2150

1982

logger.debug(u"Starting main loop")

2151

logger.debug("Starting main loop")

1983

2152

main_loop.run()

1984

except AvahiError, error:

1985

logger.critical(u"AvahiError: %s", error)

2153

except AvahiError as error:

2154

logger.critical("AvahiError: %s", error)

1986

2155

cleanup()

1987

2156

sys.exit(1)

1988

2157

except KeyboardInterrupt:

1989

2158

if debug:

1990

print >> sys.stderr

1991

logger.debug(u"Server received KeyboardInterrupt")

1992

logger.debug(u"Server exiting")

2159

print("", file=sys.stderr)

2160

logger.debug("Server received KeyboardInterrupt")

2161

logger.debug("Server exiting")

1993

2162

# Must run before the D-Bus bus name gets deregistered

1994

2163

cleanup()

1995

2164

2165

1996

2166

if __name__ == '__main__':

1997

2167

main()