/mandos/trunk : revision 505.1.2

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

55

56

import logging

56

57

import logging.handlers

57

58

import pwd

58

from contextlib import closing

59

import contextlib

59

60

import struct

60

61

import fcntl

61

62

import functools

63

import cPickle as pickle

64

import multiprocessing

65

import types

62

66

63

67

import dbus

64

68

import dbus.service

79

83

SO_BINDTODEVICE = None

80

84

81

85

82

version = "1.0.14"

86

version = "1.3.1"

83

87

84

logger = logging.Logger(u'mandos')

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

85

90

syslogger = (logging.handlers.SysLogHandler

86

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

87

address = "/dev/log"))

92

address = str("/dev/log")))

88

93

syslogger.setFormatter(logging.Formatter

89

(u'Mandos [%(process)d]: %(levelname)s:'

90

u' %(message)s'))

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

91

96

logger.addHandler(syslogger)

92

97

93

98

console = logging.StreamHandler()

94

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

95

u' %(levelname)s:'

96

u' %(message)s'))

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

97

102

logger.addHandler(console)

98

103

99

104

class AvahiError(Exception):

116

121

Attributes:

117

122

interface: integer; avahi.IF_UNSPEC or an interface index.

118

123

Used to optionally bind to the specified interface.

119

120

type: string; Example: u'_mandos._tcp'.

124

125

type: string; Example: '_mandos._tcp'.

121

126

See <http://www.dns-sd.org/ServiceTypes.html>

122

127

port: integer; what port to announce

123

128

TXT: list of strings; TXT record for the service

132

137

"""

133

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

134

139

servicetype = None, port = None, TXT = None,

135

domain = u"", host = u"", max_renames = 32768,

140

domain = "", host = "", max_renames = 32768,

136

141

protocol = avahi.PROTO_UNSPEC, bus = None):

137

142

self.interface = interface

138

143

self.name = name

147

152

self.group = None # our entry group

148

153

self.server = None

149

154

self.bus = bus

155

self.entry_group_state_changed_match = None

150

156

def rename(self):

151

157

"""Derived from the Avahi example code"""

152

158

if self.rename_count >= self.max_renames:

153

logger.critical(u"No suitable Zeroconf service name found"

154

u" after %i retries, exiting.",

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

155

161

self.rename_count)

156

raise AvahiServiceError(u"Too many renames")

157

self.name = self.server.GetAlternativeServiceName(self.name)

158

logger.info(u"Changing Zeroconf service name to %r ...",

159

unicode(self.name))

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

164

logger.info("Changing Zeroconf service name to %r ...",

165

self.name)

160

166

syslogger.setFormatter(logging.Formatter

161

(u'Mandos (%s) [%%(process)d]:'

162

u' %%(levelname)s: %%(message)s'

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

163

169

% self.name))

164

170

self.remove()

165

self.add()

171

try:

172

self.add()

173

except dbus.exceptions.DBusException as error:

174

logger.critical("DBusException: %s", error)

175

self.cleanup()

176

os._exit(1)

166

177

self.rename_count += 1

167

178

def remove(self):

168

179

"""Derived from the Avahi example code"""

180

if self.entry_group_state_changed_match is not None:

181

self.entry_group_state_changed_match.remove()

182

self.entry_group_state_changed_match = None

169

183

if self.group is not None:

170

184

self.group.Reset()

171

185

def add(self):

172

186

"""Derived from the Avahi example code"""

187

self.remove()

173

188

if self.group is None:

174

189

self.group = dbus.Interface(

175

190

self.bus.get_object(avahi.DBUS_NAME,

176

191

self.server.EntryGroupNew()),

177

192

avahi.DBUS_INTERFACE_ENTRY_GROUP)

178

self.group.connect_to_signal('StateChanged',

179

self

180

.entry_group_state_changed)

181

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

193

self.entry_group_state_changed_match = (

194

self.group.connect_to_signal(

195

'StateChanged', self .entry_group_state_changed))

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

182

197

self.name, self.type)

183

198

self.group.AddService(

184

199

self.interface,

191

206

self.group.Commit()

192

207

def entry_group_state_changed(self, state, error):

193

208

"""Derived from the Avahi example code"""

194

logger.debug(u"Avahi state change: %i", state)

209

logger.debug("Avahi entry group state change: %i", state)

195

210

196

211

if state == avahi.ENTRY_GROUP_ESTABLISHED:

197

logger.debug(u"Zeroconf service established.")

212

logger.debug("Zeroconf service established.")

198

213

elif state == avahi.ENTRY_GROUP_COLLISION:

199

logger.warning(u"Zeroconf service name collision.")

214

logger.info("Zeroconf service name collision.")

200

215

self.rename()

201

216

elif state == avahi.ENTRY_GROUP_FAILURE:

202

logger.critical(u"Avahi: Error in group state changed %s",

217

logger.critical("Avahi: Error in group state changed %s",

203

218

unicode(error))

204

raise AvahiGroupError(u"State changed: %s"

219

raise AvahiGroupError("State changed: %s"

205

220

% unicode(error))

206

221

def cleanup(self):

207

222

"""Derived from the Avahi example code"""

208

223

if self.group is not None:

209

self.group.Free()

224

try:

225

self.group.Free()

226

except (dbus.exceptions.UnknownMethodException,

227

dbus.exceptions.DBusException) as e:

228

pass

210

229

self.group = None

211

def server_state_changed(self, state):

230

self.remove()

231

def server_state_changed(self, state, error=None):

212

232

"""Derived from the Avahi example code"""

213

if state == avahi.SERVER_COLLISION:

214

logger.error(u"Zeroconf server name collision")

215

self.remove()

233

logger.debug("Avahi server state change: %i", state)

234

bad_states = { avahi.SERVER_INVALID:

235

"Zeroconf server invalid",

236

avahi.SERVER_REGISTERING: None,

237

avahi.SERVER_COLLISION:

238

"Zeroconf server name collision",

239

avahi.SERVER_FAILURE:

240

"Zeroconf server failure" }

241

if state in bad_states:

242

if bad_states[state] is not None:

243

if error is None:

244

logger.error(bad_states[state])

245

else:

246

logger.error(bad_states[state] + ": %r", error)

247

self.cleanup()

216

248

elif state == avahi.SERVER_RUNNING:

217

249

self.add()

250

else:

251

if error is None:

252

logger.debug("Unknown state: %r", state)

253

else:

254

logger.debug("Unknown state: %r: %r", state, error)

218

255

def activate(self):

219

256

"""Derived from the Avahi example code"""

220

257

if self.server is None:

221

258

self.server = dbus.Interface(

222

259

self.bus.get_object(avahi.DBUS_NAME,

223

avahi.DBUS_PATH_SERVER),

260

avahi.DBUS_PATH_SERVER,

261

follow_name_owner_changes=True),

224

262

avahi.DBUS_INTERFACE_SERVER)

225

self.server.connect_to_signal(u"StateChanged",

263

self.server.connect_to_signal("StateChanged",

226

264

self.server_state_changed)

227

265

self.server_state_changed(self.server.GetState())

228

266

229

267

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

230

274

class Client(object):

231

275

"""A representation of a client host served by this server.

232

276

233

277

Attributes:

234

235

D-Bus identifiers

236

fingerprint: string (40 or 32 hexadecimal digits); used to

237

uniquely identify the client

238

secret: bytestring; sent verbatim (over TLS) to client

239

host: string; available for use by the checker command

240

created: datetime.datetime(); (UTC) object creation

241

last_enabled: datetime.datetime(); (UTC)

242

enabled: bool()

243

last_checked_ok: datetime.datetime(); (UTC) or None

244

timeout: datetime.timedelta(); How long from last_checked_ok

245

until this client is invalid

246

interval: datetime.timedelta(); How often to start a new checker

247

disable_hook: If set, called by disable() as disable_hook(self)

278

_approved: bool(); 'None' if not yet approved/disapproved

279

approval_delay: datetime.timedelta(); Time to wait for approval

280

approval_duration: datetime.timedelta(); Duration of one approval

248

281

checker: subprocess.Popen(); a running checker process used

249

282

to see if the client lives.

250

283

'None' if no process is running.

251

checker_initiator_tag: a gobject event source tag, or None

252

disable_initiator_tag: - '' -

253

checker_callback_tag: - '' -

254

checker_command: string; External command which is run to check if

255

client lives. %() expansions are done at

284

checker_callback_tag: a gobject event source tag, or None

285

checker_command: string; External command which is run to check

286

if client lives. %() expansions are done at

256

287

runtime with vars(self) as dict, so that for

257

288

instance %(name)s can be used in the command.

289

checker_initiator_tag: a gobject event source tag, or None

290

created: datetime.datetime(); (UTC) object creation

258

291

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

293

disable_initiator_tag: a gobject event source tag, or None

294

enabled: bool()

295

fingerprint: string (40 or 32 hexadecimal digits); used to

296

uniquely identify the client

297

host: string; available for use by the checker command

298

interval: datetime.timedelta(); How often to start a new checker

299

last_approval_request: datetime.datetime(); (UTC) or None

300

last_checked_ok: datetime.datetime(); (UTC) or None

301

last_enabled: datetime.datetime(); (UTC)

302

303

D-Bus identifiers

304

secret: bytestring; sent verbatim (over TLS) to client

305

timeout: datetime.timedelta(); How long from last_checked_ok

306

until this client is disabled

307

extended_timeout: extra long timeout when password has been sent

308

runtime_expansions: Allowed attributes for runtime expansion.

309

expires: datetime.datetime(); time (UTC) when a client will be

310

disabled, or None

259

311

"""

260

312

261

@staticmethod

262

def _timedelta_to_milliseconds(td):

263

"Convert a datetime.timedelta() to milliseconds"

264

return ((td.days * 24 * 60 * 60 * 1000)

265

+ (td.seconds * 1000)

266

+ (td.microseconds // 1000))

313

runtime_expansions = ("approval_delay", "approval_duration",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

316

"last_enabled", "name", "timeout")

267

317

268

318

def timeout_milliseconds(self):

269

319

"Return the 'timeout' attribute in milliseconds"

270

return self._timedelta_to_milliseconds(self.timeout)

320

return _timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

271

325

272

326

def interval_milliseconds(self):

273

327

"Return the 'interval' attribute in milliseconds"

274

return self._timedelta_to_milliseconds(self.interval)

328

return _timedelta_to_milliseconds(self.interval)

329

330

def approval_delay_milliseconds(self):

331

return _timedelta_to_milliseconds(self.approval_delay)

275

332

276

333

def __init__(self, name = None, disable_hook=None, config=None):

277

334

"""Note: the 'checker' key in 'config' sets the

280

337

self.name = name

281

338

if config is None:

282

339

config = {}

283

logger.debug(u"Creating client %r", self.name)

340

logger.debug("Creating client %r", self.name)

284

341

# Uppercase and remove spaces from fingerprint for later

285

342

# comparison purposes with return value from the fingerprint()

286

343

# function

287

self.fingerprint = (config[u"fingerprint"].upper()

288

.replace(u" ", u""))

289

logger.debug(u" Fingerprint: %s", self.fingerprint)

290

if u"secret" in config:

291

self.secret = config[u"secret"].decode(u"base64")

292

elif u"secfile" in config:

293

with closing(open(os.path.expanduser

294

(os.path.expandvars

295

(config[u"secfile"])),

296

"rb")) as secfile:

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

350

with open(os.path.expanduser(os.path.expandvars

351

(config["secfile"])),

352

"rb") as secfile:

297

353

self.secret = secfile.read()

298

354

else:

299

raise TypeError(u"No secret or secfile for client %s"

355

raise TypeError("No secret or secfile for client %s"

300

356

% self.name)

301

self.host = config.get(u"host", u"")

357

self.host = config.get("host", "")

302

358

self.created = datetime.datetime.utcnow()

303

359

self.enabled = False

360

self.last_approval_request = None

304

361

self.last_enabled = None

305

362

self.last_checked_ok = None

306

self.timeout = string_to_delta(config[u"timeout"])

307

self.interval = string_to_delta(config[u"interval"])

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

308

366

self.disable_hook = disable_hook

309

367

self.checker = None

310

368

self.checker_initiator_tag = None

311

369

self.disable_initiator_tag = None

370

self.expires = None

312

371

self.checker_callback_tag = None

313

self.checker_command = config[u"checker"]

372

self.checker_command = config["checker"]

314

373

self.current_checker_command = None

315

374

self.last_connect = None

375

self._approved = None

376

self.approved_by_default = config.get("approved_by_default",

377

True)

378

self.approvals_pending = 0

379

self.approval_delay = string_to_delta(

380

config["approval_delay"])

381

self.approval_duration = string_to_delta(

382

config["approval_duration"])

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

316

384

385

def send_changedstate(self):

386

self.changedstate.acquire()

387

self.changedstate.notify_all()

388

self.changedstate.release()

389

317

390

def enable(self):

318

391

"""Start this client's checker and timeout hooks"""

319

if getattr(self, u"enabled", False):

392

if getattr(self, "enabled", False):

320

393

# Already enabled

321

394

return

322

self.last_enabled = datetime.datetime.utcnow()

395

self.send_changedstate()

323

396

# Schedule a new checker to be started an 'interval' from now,

324

397

# and every interval from then on.

325

398

self.checker_initiator_tag = (gobject.timeout_add

326

399

(self.interval_milliseconds(),

327

400

self.start_checker))

328

401

# Schedule a disable() when 'timeout' has passed

402

self.expires = datetime.datetime.utcnow() + self.timeout

329

403

self.disable_initiator_tag = (gobject.timeout_add

330

404

(self.timeout_milliseconds(),

331

405

self.disable))

332

406

self.enabled = True

407

self.last_enabled = datetime.datetime.utcnow()

333

408

# Also start a new checker *right now*.

334

409

self.start_checker()

335

410

336

def disable(self, log=True):

411

def disable(self, quiet=True):

337

412

"""Disable this client."""

338

413

if not getattr(self, "enabled", False):

339

414

return False

340

if log:

341

logger.info(u"Disabling client %s", self.name)

342

if getattr(self, u"disable_initiator_tag", False):

415

if not quiet:

416

self.send_changedstate()

417

if not quiet:

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

343

420

gobject.source_remove(self.disable_initiator_tag)

344

421

self.disable_initiator_tag = None

345

if getattr(self, u"checker_initiator_tag", False):

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

346

424

gobject.source_remove(self.checker_initiator_tag)

347

425

self.checker_initiator_tag = None

348

426

self.stop_checker()

363

441

if os.WIFEXITED(condition):

364

442

exitstatus = os.WEXITSTATUS(condition)

365

443

if exitstatus == 0:

366

logger.info(u"Checker for %(name)s succeeded",

444

logger.info("Checker for %(name)s succeeded",

367

445

vars(self))

368

446

self.checked_ok()

369

447

else:

370

logger.info(u"Checker for %(name)s failed",

448

logger.info("Checker for %(name)s failed",

371

449

vars(self))

372

450

else:

373

logger.warning(u"Checker for %(name)s crashed?",

451

logger.warning("Checker for %(name)s crashed?",

374

452

vars(self))

375

453

376

def checked_ok(self):

454

def checked_ok(self, timeout=None):

377

455

"""Bump up the timeout for this client.

378

456

379

457

This should only be called when the client has been seen,

380

458

alive and well.

381

459

"""

460

if timeout is None:

461

timeout = self.timeout

382

462

self.last_checked_ok = datetime.datetime.utcnow()

383

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

384

465

self.disable_initiator_tag = (gobject.timeout_add

385

(self.timeout_milliseconds(),

466

(_timedelta_to_milliseconds(timeout),

386

467

self.disable))

387

468

469

def need_approval(self):

470

self.last_approval_request = datetime.datetime.utcnow()

471

388

472

def start_checker(self):

389

473

"""Start a new checker subprocess if one is not running.

390

474

396

480

# client would inevitably timeout, since no checker would get

397

481

# a chance to run to completion. If we instead leave running

398

482

# checkers alone, the checker would have to take more time

399

# than 'timeout' for the client to be declared invalid, which

400

# is as it should be.

483

# than 'timeout' for the client to be disabled, which is as it

484

# should be.

401

485

402

486

# If a checker exists, make sure it is not a zombie

403

487

try:

404

488

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

405

except (AttributeError, OSError), error:

489

except (AttributeError, OSError) as error:

406

490

if (isinstance(error, OSError)

407

491

and error.errno != errno.ECHILD):

408

492

raise error

409

493

else:

410

494

if pid:

411

logger.warning(u"Checker was a zombie")

495

logger.warning("Checker was a zombie")

412

496

gobject.source_remove(self.checker_callback_tag)

413

497

self.checker_callback(pid, status,

414

498

self.current_checker_command)

419

503

command = self.checker_command % self.host

420

504

except TypeError:

421

505

# Escape attributes for the shell

422

escaped_attrs = dict((key,

423

re.escape(unicode(str(val),

424

errors=

425

u'replace')))

426

for key, val in

427

vars(self).iteritems())

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

428

514

try:

429

515

command = self.checker_command % escaped_attrs

430

except TypeError, error:

431

logger.error(u'Could not format string "%s":'

432

u' %s', self.checker_command, error)

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

433

519

return True # Try again later

434

520

self.current_checker_command = command

435

521

try:

436

logger.info(u"Starting checker %r for %s",

522

logger.info("Starting checker %r for %s",

437

523

command, self.name)

438

524

# We don't need to redirect stdout and stderr, since

439

525

# in normal mode, that is already done by daemon(),

441

527

# always replaced by /dev/null.)

442

528

self.checker = subprocess.Popen(command,

443

529

close_fds=True,

444

shell=True, cwd=u"/")

530

shell=True, cwd="/")

445

531

self.checker_callback_tag = (gobject.child_watch_add

446

532

(self.checker.pid,

447

533

self.checker_callback,

452

538

if pid:

453

539

gobject.source_remove(self.checker_callback_tag)

454

540

self.checker_callback(pid, status, command)

455

except OSError, error:

456

logger.error(u"Failed to start subprocess: %s",

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

457

543

error)

458

544

# Re-run this periodically if run by gobject.timeout_add

459

545

return True

463

549

if self.checker_callback_tag:

464

550

gobject.source_remove(self.checker_callback_tag)

465

551

self.checker_callback_tag = None

466

if getattr(self, u"checker", None) is None:

552

if getattr(self, "checker", None) is None:

467

553

return

468

logger.debug(u"Stopping checker for %(name)s", vars(self))

554

logger.debug("Stopping checker for %(name)s", vars(self))

469

555

try:

470

556

os.kill(self.checker.pid, signal.SIGTERM)

471

557

#time.sleep(0.5)

472

558

#if self.checker.poll() is None:

473

559

# os.kill(self.checker.pid, signal.SIGKILL)

474

except OSError, error:

560

except OSError as error:

475

561

if error.errno != errno.ESRCH: # No such process

476

562

raise

477

563

self.checker = None

478

479

def still_valid(self):

480

"""Has the timeout not yet passed for this client?"""

481

if not getattr(self, u"enabled", False):

482

return False

483

now = datetime.datetime.utcnow()

484

if self.last_checked_ok is None:

485

return now < (self.created + self.timeout)

486

else:

487

return now < (self.last_checked_ok + self.timeout)

488

489

490

def dbus_service_property(dbus_interface, signature=u"v",

491

access=u"readwrite", byte_arrays=False):

564

565

566

def dbus_service_property(dbus_interface, signature="v",

567

access="readwrite", byte_arrays=False):

492

568

"""Decorators for marking methods of a DBusObjectWithProperties to

493

569

become properties on the D-Bus.

494

570

499

575

dbus.service.method, except there is only "signature", since the

500

576

type from Get() and the type sent to Set() is the same.

501

577

"""

578

# Encoding deeply encoded byte arrays is not supported yet by the

579

# "Set" method, so we fail early here:

580

if byte_arrays and signature != "ay":

581

raise ValueError("Byte arrays not supported for non-'ay'"

582

" signature %r" % signature)

502

583

def decorator(func):

503

584

func._dbus_is_property = True

504

585

func._dbus_interface = dbus_interface

505

586

func._dbus_signature = signature

506

587

func._dbus_access = access

507

588

func._dbus_name = func.__name__

508

if func._dbus_name.endswith(u"_dbus_property"):

589

if func._dbus_name.endswith("_dbus_property"):

509

590

func._dbus_name = func._dbus_name[:-14]

510

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

591

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

511

592

return func

512

593

return decorator

513

594

533

614

534

615

class DBusObjectWithProperties(dbus.service.Object):

535

616

"""A D-Bus object with properties.

536

617

537

618

Classes inheriting from this can use the dbus_service_property

538

619

decorator to expose methods as D-Bus properties. It exposes the

539

620

standard Get(), Set(), and GetAll() methods on the D-Bus.

541

622

542

623

@staticmethod

543

624

def _is_dbus_property(obj):

544

return getattr(obj, u"_dbus_is_property", False)

625

return getattr(obj, "_dbus_is_property", False)

545

626

546

627

def _get_all_dbus_properties(self):

547

628

"""Returns a generator of (name, attribute) pairs

548

629

"""

549

return ((prop._dbus_name, prop)

550

for name, prop in

551

inspect.getmembers(self, self._is_dbus_property))

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

631

for cls in self.__class__.__mro__

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

552

633

553

634

def _get_dbus_property(self, interface_name, property_name):

554

635

"""Returns a bound method if one exists which is a D-Bus

555

636

property with the specified name and interface.

556

637

"""

557

for name in (property_name,

558

property_name + u"_dbus_property"):

559

prop = getattr(self, name, None)

560

if (prop is None

561

or not self._is_dbus_property(prop)

562

or prop._dbus_name != property_name

563

or (interface_name and prop._dbus_interface

564

and interface_name != prop._dbus_interface)):

565

continue

566

return prop

638

for cls in self.__class__.__mro__:

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

641

return value.__get__(self)

642

567

643

# No such property

568

raise DBusPropertyNotFound(self.dbus_object_path + u":"

569

+ interface_name + u"."

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

645

+ interface_name + "."

570

646

+ property_name)

571

647

572

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

573

out_signature=u"v")

648

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

649

out_signature="v")

574

650

def Get(self, interface_name, property_name):

575

651

"""Standard D-Bus property Get() method, see D-Bus standard.

576

652

"""

577

653

prop = self._get_dbus_property(interface_name, property_name)

578

if prop._dbus_access == u"write":

654

if prop._dbus_access == "write":

579

655

raise DBusPropertyAccessException(property_name)

580

656

value = prop()

581

if not hasattr(value, u"variant_level"):

657

if not hasattr(value, "variant_level"):

582

658

return value

583

659

return type(value)(value, variant_level=value.variant_level+1)

584

660

585

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

661

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

586

662

def Set(self, interface_name, property_name, value):

587

663

"""Standard D-Bus property Set() method, see D-Bus standard.

588

664

"""

589

665

prop = self._get_dbus_property(interface_name, property_name)

590

if prop._dbus_access == u"read":

666

if prop._dbus_access == "read":

591

667

raise DBusPropertyAccessException(property_name)

592

if prop._dbus_get_args_options[u"byte_arrays"]:

668

if prop._dbus_get_args_options["byte_arrays"]:

669

# The byte_arrays option is not supported yet on

670

# signatures other than "ay".

671

if prop._dbus_signature != "ay":

672

raise ValueError

593

673

value = dbus.ByteArray(''.join(unichr(byte)

594

674

for byte in value))

595

675

prop(value)

596

676

597

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

598

out_signature=u"a{sv}")

677

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

678

out_signature="a{sv}")

599

679

def GetAll(self, interface_name):

600

680

"""Standard D-Bus property GetAll() method, see D-Bus

601

681

standard.

602

682

603

683

Note: Will not include properties with access="write".

604

684

"""

605

685

all = {}

609

689

# Interface non-empty but did not match

610

690

continue

611

691

# Ignore write-only properties

612

if prop._dbus_access == u"write":

692

if prop._dbus_access == "write":

613

693

continue

614

694

value = prop()

615

if not hasattr(value, u"variant_level"):

695

if not hasattr(value, "variant_level"):

616

696

all[name] = value

617

697

continue

618

698

all[name] = type(value)(value, variant_level=

619

699

value.variant_level+1)

620

return dbus.Dictionary(all, signature=u"sv")

700

return dbus.Dictionary(all, signature="sv")

621

701

622

702

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

623

out_signature=u"s",

703

out_signature="s",

624

704

path_keyword='object_path',

625

705

connection_keyword='connection')

626

706

def Introspect(self, object_path, connection):

631

711

try:

632

712

document = xml.dom.minidom.parseString(xmlstring)

633

713

def make_tag(document, name, prop):

634

e = document.createElement(u"property")

635

e.setAttribute(u"name", name)

636

e.setAttribute(u"type", prop._dbus_signature)

637

e.setAttribute(u"access", prop._dbus_access)

714

e = document.createElement("property")

715

e.setAttribute("name", name)

716

e.setAttribute("type", prop._dbus_signature)

717

e.setAttribute("access", prop._dbus_access)

638

718

return e

639

for if_tag in document.getElementsByTagName(u"interface"):

719

for if_tag in document.getElementsByTagName("interface"):

640

720

for tag in (make_tag(document, name, prop)

641

721

for name, prop

642

722

in self._get_all_dbus_properties()

643

723

if prop._dbus_interface

644

== if_tag.getAttribute(u"name")):

724

== if_tag.getAttribute("name")):

645

725

if_tag.appendChild(tag)

646

726

# Add the names to the return values for the

647

727

# "org.freedesktop.DBus.Properties" methods

648

if (if_tag.getAttribute(u"name")

649

== u"org.freedesktop.DBus.Properties"):

650

for cn in if_tag.getElementsByTagName(u"method"):

651

if cn.getAttribute(u"name") == u"Get":

652

for arg in cn.getElementsByTagName(u"arg"):

653

if (arg.getAttribute(u"direction")

654

== u"out"):

655

arg.setAttribute(u"name", u"value")

656

elif cn.getAttribute(u"name") == u"GetAll":

657

for arg in cn.getElementsByTagName(u"arg"):

658

if (arg.getAttribute(u"direction")

659

== u"out"):

660

arg.setAttribute(u"name", u"props")

661

xmlstring = document.toxml(u"utf-8")

728

if (if_tag.getAttribute("name")

729

== "org.freedesktop.DBus.Properties"):

730

for cn in if_tag.getElementsByTagName("method"):

731

if cn.getAttribute("name") == "Get":

732

for arg in cn.getElementsByTagName("arg"):

733

if (arg.getAttribute("direction")

734

== "out"):

735

arg.setAttribute("name", "value")

736

elif cn.getAttribute("name") == "GetAll":

737

for arg in cn.getElementsByTagName("arg"):

738

if (arg.getAttribute("direction")

739

== "out"):

740

arg.setAttribute("name", "props")

741

xmlstring = document.toxml("utf-8")

662

742

document.unlink()

663

743

except (AttributeError, xml.dom.DOMException,

664

xml.parsers.expat.ExpatError), error:

665

logger.error(u"Failed to override Introspection method",

744

xml.parsers.expat.ExpatError) as error:

745

logger.error("Failed to override Introspection method",

666

746

error)

667

747

return xmlstring

668

748

669

749

750

def datetime_to_dbus (dt, variant_level=0):

751

"""Convert a UTC datetime.datetime() to a D-Bus type."""

752

if dt is None:

753

return dbus.String("", variant_level = variant_level)

754

return dbus.String(dt.isoformat(),

755

variant_level=variant_level)

756

757

class AlternateDBusNamesMetaclass(DBusObjectWithProperties.__metaclass__):

758

"""Applied to an empty subclass of a D-Bus object, this metaclass

759

will add additional D-Bus attributes matching a certain pattern.

760

"""

761

def __new__(mcs, name, bases, attr):

762

# Go through all the base classes which could have D-Bus

763

# methods, signals, or properties in them

764

for base in (b for b in bases

765

if issubclass(b, dbus.service.Object)):

766

# Go though all attributes of the base class

767

for attrname, attribute in inspect.getmembers(base):

768

# Ignore non-D-Bus attributes, and D-Bus attributes

769

# with the wrong interface name

770

if (not hasattr(attribute, "_dbus_interface")

771

or not attribute._dbus_interface

772

.startswith("se.recompile.Mandos")):

773

continue

774

# Create an alternate D-Bus interface name based on

775

# the current name

776

alt_interface = (attribute._dbus_interface

777

.replace("se.recompile.Mandos",

778

"se.bsnet.fukt.Mandos"))

779

# Is this a D-Bus signal?

780

if getattr(attribute, "_dbus_is_signal", False):

781

# Extract the original non-method function by

782

# black magic

783

nonmethod_func = (dict(

784

zip(attribute.func_code.co_freevars,

785

attribute.__closure__))["func"]

786

.cell_contents)

787

# Create a new, but exactly alike, function

788

# object, and decorate it to be a new D-Bus signal

789

# with the alternate D-Bus interface name

790

new_function = (dbus.service.signal

791

(alt_interface,

792

attribute._dbus_signature)

793

(types.FunctionType(

794

nonmethod_func.func_code,

795

nonmethod_func.func_globals,

796

nonmethod_func.func_name,

797

nonmethod_func.func_defaults,

798

nonmethod_func.func_closure)))

799

# Define a creator of a function to call both the

800

# old and new functions, so both the old and new

801

# signals gets sent when the function is called

802

def fixscope(func1, func2):

803

"""This function is a scope container to pass

804

func1 and func2 to the "call_both" function

805

outside of its arguments"""

806

def call_both(*args, **kwargs):

807

"""This function will emit two D-Bus

808

signals by calling func1 and func2"""

809

func1(*args, **kwargs)

810

func2(*args, **kwargs)

811

return call_both

812

# Create the "call_both" function and add it to

813

# the class

814

attr[attrname] = fixscope(attribute,

815

new_function)

816

# Is this a D-Bus method?

817

elif getattr(attribute, "_dbus_is_method", False):

818

# Create a new, but exactly alike, function

819

# object. Decorate it to be a new D-Bus method

820

# with the alternate D-Bus interface name. Add it

821

# to the class.

822

attr[attrname] = (dbus.service.method

823

(alt_interface,

824

attribute._dbus_in_signature,

825

attribute._dbus_out_signature)

826

(types.FunctionType

827

(attribute.func_code,

828

attribute.func_globals,

829

attribute.func_name,

830

attribute.func_defaults,

831

attribute.func_closure)))

832

# Is this a D-Bus property?

833

elif getattr(attribute, "_dbus_is_property", False):

834

# Create a new, but exactly alike, function

835

# object, and decorate it to be a new D-Bus

836

# property with the alternate D-Bus interface

837

# name. Add it to the class.

838

attr[attrname] = (dbus_service_property

839

(alt_interface,

840

attribute._dbus_signature,

841

attribute._dbus_access,

842

attribute

843

._dbus_get_args_options

844

["byte_arrays"])

845

(types.FunctionType

846

(attribute.func_code,

847

attribute.func_globals,

848

attribute.func_name,

849

attribute.func_defaults,

850

attribute.func_closure)))

851

return type.__new__(mcs, name, bases, attr)

852

670

853

class ClientDBus(Client, DBusObjectWithProperties):

671

854

"""A Client class using D-Bus

672

855

674

857

dbus_object_path: dbus.ObjectPath

675

858

bus: dbus.SystemBus()

676

859

"""

860

861

runtime_expansions = (Client.runtime_expansions

862

+ ("dbus_object_path",))

863

677

864

# dbus.service.Object doesn't use super(), so we can't either.

678

865

679

866

def __init__(self, bus = None, *args, **kwargs):

867

self._approvals_pending = 0

680

868

self.bus = bus

681

869

Client.__init__(self, *args, **kwargs)

682

870

# Only now, when this client is initialized, can it show up on

683

871

# the D-Bus

872

client_object_name = unicode(self.name).translate(

873

{ord("."): ord("_"),

874

ord("-"): ord("_")})

684

875

self.dbus_object_path = (dbus.ObjectPath

685

(u"/clients/"

686

+ self.name.replace(u".", u"_")))

876

("/clients/" + client_object_name))

687

877

DBusObjectWithProperties.__init__(self, self.bus,

688

878

self.dbus_object_path)

689

690

@staticmethod

691

def _datetime_to_dbus(dt, variant_level=0):

692

"""Convert a UTC datetime.datetime() to a D-Bus type."""

693

return dbus.String(dt.isoformat(),

694

variant_level=variant_level)

695

696

def enable(self):

697

oldstate = getattr(self, u"enabled", False)

698

r = Client.enable(self)

699

if oldstate != self.enabled:

700

# Emit D-Bus signals

701

self.PropertyChanged(dbus.String(u"enabled"),

702

dbus.Boolean(True, variant_level=1))

703

self.PropertyChanged(

704

dbus.String(u"last_enabled"),

705

self._datetime_to_dbus(self.last_enabled,

706

variant_level=1))

707

return r

708

709

def disable(self, signal = True):

710

oldstate = getattr(self, u"enabled", False)

711

r = Client.disable(self, log=signal)

712

if signal and oldstate != self.enabled:

713

# Emit D-Bus signal

714

self.PropertyChanged(dbus.String(u"enabled"),

715

dbus.Boolean(False, variant_level=1))

716

return r

879

880

def notifychangeproperty(transform_func,

881

dbus_name, type_func=lambda x: x,

882

variant_level=1):

883

""" Modify a variable so that it's a property which announces

884

its changes to DBus.

885

886

transform_fun: Function that takes a value and transforms it

887

to a D-Bus type.

888

dbus_name: D-Bus name of the variable

889

type_func: Function that transform the value before sending it

890

to the D-Bus. Default: no transform

891

variant_level: D-Bus variant level. Default: 1

892

"""

893

real_value = [None,]

894

def setter(self, value):

895

old_value = real_value[0]

896

real_value[0] = value

897

if hasattr(self, "dbus_object_path"):

898

if type_func(old_value) != type_func(real_value[0]):

899

dbus_value = transform_func(type_func(real_value[0]),

900

variant_level)

901

self.PropertyChanged(dbus.String(dbus_name),

902

dbus_value)

903

904

return property(lambda self: real_value[0], setter)

905

906

907

expires = notifychangeproperty(datetime_to_dbus, "Expires")

908

approvals_pending = notifychangeproperty(dbus.Boolean,

909

"ApprovalPending",

910

type_func = bool)

911

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

912

last_enabled = notifychangeproperty(datetime_to_dbus,

913

"LastEnabled")

914

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

915

type_func = lambda checker: checker is not None)

916

last_checked_ok = notifychangeproperty(datetime_to_dbus,

917

"LastCheckedOK")

918

last_approval_request = notifychangeproperty(datetime_to_dbus,

919

"LastApprovalRequest")

920

approved_by_default = notifychangeproperty(dbus.Boolean,

921

"ApprovedByDefault")

922

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

923

type_func = _timedelta_to_milliseconds)

924

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

925

type_func = _timedelta_to_milliseconds)

926

host = notifychangeproperty(dbus.String, "Host")

927

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

928

type_func = _timedelta_to_milliseconds)

929

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

930

type_func = _timedelta_to_milliseconds)

931

interval = notifychangeproperty(dbus.UInt16, "Interval",

932

type_func = _timedelta_to_milliseconds)

933

checker_command = notifychangeproperty(dbus.String, "Checker")

934

935

del notifychangeproperty

717

936

718

937

def __del__(self, *args, **kwargs):

719

938

try:

720

939

self.remove_from_connection()

721

940

except LookupError:

722

941

pass

723

if hasattr(DBusObjectWithProperties, u"__del__"):

942

if hasattr(DBusObjectWithProperties, "__del__"):

724

943

DBusObjectWithProperties.__del__(self, *args, **kwargs)

725

944

Client.__del__(self, *args, **kwargs)

726

945

728

947

*args, **kwargs):

729

948

self.checker_callback_tag = None

730

949

self.checker = None

731

# Emit D-Bus signal

732

self.PropertyChanged(dbus.String(u"checker_running"),

733

dbus.Boolean(False, variant_level=1))

734

950

if os.WIFEXITED(condition):

735

951

exitstatus = os.WEXITSTATUS(condition)

736

952

# Emit D-Bus signal

746

962

return Client.checker_callback(self, pid, condition, command,

747

963

*args, **kwargs)

748

964

749

def checked_ok(self, *args, **kwargs):

750

r = Client.checked_ok(self, *args, **kwargs)

751

# Emit D-Bus signal

752

self.PropertyChanged(

753

dbus.String(u"last_checked_ok"),

754

(self._datetime_to_dbus(self.last_checked_ok,

755

variant_level=1)))

756

return r

757

758

965

def start_checker(self, *args, **kwargs):

759

966

old_checker = self.checker

760

967

if self.checker is not None:

767

974

and old_checker_pid != self.checker.pid):

768

975

# Emit D-Bus signal

769

976

self.CheckerStarted(self.current_checker_command)

770

self.PropertyChanged(

771

dbus.String(u"checker_running"),

772

dbus.Boolean(True, variant_level=1))

773

return r

774

775

def stop_checker(self, *args, **kwargs):

776

old_checker = getattr(self, u"checker", None)

777

r = Client.stop_checker(self, *args, **kwargs)

778

if (old_checker is not None

779

and getattr(self, u"checker", None) is None):

780

self.PropertyChanged(dbus.String(u"checker_running"),

781

dbus.Boolean(False, variant_level=1))

782

return r

783

784

## D-Bus methods & signals

785

_interface = u"se.bsnet.fukt.Mandos.Client"

786

787

# CheckedOK - method

788

@dbus.service.method(_interface)

789

def CheckedOK(self):

790

return self.checked_ok()

977

return r

978

979

def _reset_approved(self):

980

self._approved = None

981

return False

982

983

def approve(self, value=True):

984

self.send_changedstate()

985

self._approved = value

986

gobject.timeout_add(_timedelta_to_milliseconds

987

(self.approval_duration),

988

self._reset_approved)

989

990

991

## D-Bus methods, signals & properties

992

_interface = "se.recompile.Mandos.Client"

993

994

## Signals

791

995

792

996

# CheckerCompleted - signal

793

@dbus.service.signal(_interface, signature=u"nxs")

997

@dbus.service.signal(_interface, signature="nxs")

794

998

def CheckerCompleted(self, exitcode, waitstatus, command):

795

999

"D-Bus signal"

796

1000

pass

797

1001

798

1002

# CheckerStarted - signal

799

@dbus.service.signal(_interface, signature=u"s")

1003

@dbus.service.signal(_interface, signature="s")

800

1004

def CheckerStarted(self, command):

801

1005

"D-Bus signal"

802

1006

pass

803

1007

804

1008

# PropertyChanged - signal

805

@dbus.service.signal(_interface, signature=u"sv")

1009

@dbus.service.signal(_interface, signature="sv")

806

1010

def PropertyChanged(self, property, value):

807

1011

"D-Bus signal"

808

1012

pass

810

1014

# GotSecret - signal

811

1015

@dbus.service.signal(_interface)

812

1016

def GotSecret(self):

813

"D-Bus signal"

1017

"""D-Bus signal

1018

Is sent after a successful transfer of secret from the Mandos

1019

server to mandos-client

1020

"""

814

1021

pass

815

1022

816

1023

# Rejected - signal

817

@dbus.service.signal(_interface)

818

def Rejected(self):

1024

@dbus.service.signal(_interface, signature="s")

1025

def Rejected(self, reason):

819

1026

"D-Bus signal"

820

1027

pass

821

1028

1029

# NeedApproval - signal

1030

@dbus.service.signal(_interface, signature="tb")

1031

def NeedApproval(self, timeout, default):

1032

"D-Bus signal"

1033

return self.need_approval()

1034

1035

## Methods

1036

1037

# Approve - method

1038

@dbus.service.method(_interface, in_signature="b")

1039

def Approve(self, value):

1040

self.approve(value)

1041

1042

# CheckedOK - method

1043

@dbus.service.method(_interface)

1044

def CheckedOK(self):

1045

self.checked_ok()

1046

822

1047

# Enable - method

823

1048

@dbus.service.method(_interface)

824

1049

def Enable(self):

842

1067

def StopChecker(self):

843

1068

self.stop_checker()

844

1069

845

# name - property

846

@dbus_service_property(_interface, signature=u"s", access=u"read")

847

def name_dbus_property(self):

1070

## Properties

1071

1072

# ApprovalPending - property

1073

@dbus_service_property(_interface, signature="b", access="read")

1074

def ApprovalPending_dbus_property(self):

1075

return dbus.Boolean(bool(self.approvals_pending))

1076

1077

# ApprovedByDefault - property

1078

@dbus_service_property(_interface, signature="b",

1079

access="readwrite")

1080

def ApprovedByDefault_dbus_property(self, value=None):

1081

if value is None: # get

1082

return dbus.Boolean(self.approved_by_default)

1083

self.approved_by_default = bool(value)

1084

1085

# ApprovalDelay - property

1086

@dbus_service_property(_interface, signature="t",

1087

access="readwrite")

1088

def ApprovalDelay_dbus_property(self, value=None):

1089

if value is None: # get

1090

return dbus.UInt64(self.approval_delay_milliseconds())

1091

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1092

1093

# ApprovalDuration - property

1094

@dbus_service_property(_interface, signature="t",

1095

access="readwrite")

1096

def ApprovalDuration_dbus_property(self, value=None):

1097

if value is None: # get

1098

return dbus.UInt64(_timedelta_to_milliseconds(

1099

self.approval_duration))

1100

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1101

1102

# Name - property

1103

@dbus_service_property(_interface, signature="s", access="read")

1104

def Name_dbus_property(self):

848

1105

return dbus.String(self.name)

849

1106

850

# fingerprint - property

851

@dbus_service_property(_interface, signature=u"s", access=u"read")

852

def fingerprint_dbus_property(self):

1107

# Fingerprint - property

1108

@dbus_service_property(_interface, signature="s", access="read")

1109

def Fingerprint_dbus_property(self):

853

1110

return dbus.String(self.fingerprint)

854

1111

855

# host - property

856

@dbus_service_property(_interface, signature=u"s",

857

access=u"readwrite")

858

def host_dbus_property(self, value=None):

1112

# Host - property

1113

@dbus_service_property(_interface, signature="s",

1114

access="readwrite")

1115

def Host_dbus_property(self, value=None):

859

1116

if value is None: # get

860

1117

return dbus.String(self.host)

861

1118

self.host = value

862

# Emit D-Bus signal

863

self.PropertyChanged(dbus.String(u"host"),

864

dbus.String(value, variant_level=1))

865

866

# created - property

867

@dbus_service_property(_interface, signature=u"s", access=u"read")

868

def created_dbus_property(self):

869

return dbus.String(self._datetime_to_dbus(self.created))

870

871

# last_enabled - property

872

@dbus_service_property(_interface, signature=u"s", access=u"read")

873

def last_enabled_dbus_property(self):

874

if self.last_enabled is None:

875

return dbus.String(u"")

876

return dbus.String(self._datetime_to_dbus(self.last_enabled))

877

878

# enabled - property

879

@dbus_service_property(_interface, signature=u"b",

880

access=u"readwrite")

881

def enabled_dbus_property(self, value=None):

1119

1120

# Created - property

1121

@dbus_service_property(_interface, signature="s", access="read")

1122

def Created_dbus_property(self):

1123

return dbus.String(datetime_to_dbus(self.created))

1124

1125

# LastEnabled - property

1126

@dbus_service_property(_interface, signature="s", access="read")

1127

def LastEnabled_dbus_property(self):

1128

return datetime_to_dbus(self.last_enabled)

1129

1130

# Enabled - property

1131

@dbus_service_property(_interface, signature="b",

1132

access="readwrite")

1133

def Enabled_dbus_property(self, value=None):

882

1134

if value is None: # get

883

1135

return dbus.Boolean(self.enabled)

884

1136

if value:

886

1138

else:

887

1139

self.disable()

888

1140

889

# last_checked_ok - property

890

@dbus_service_property(_interface, signature=u"s",

891

access=u"readwrite")

892

def last_checked_ok_dbus_property(self, value=None):

1141

# LastCheckedOK - property

1142

@dbus_service_property(_interface, signature="s",

1143

access="readwrite")

1144

def LastCheckedOK_dbus_property(self, value=None):

893

1145

if value is not None:

894

1146

self.checked_ok()

895

1147

return

896

if self.last_checked_ok is None:

897

return dbus.String(u"")

898

return dbus.String(self._datetime_to_dbus(self

899

.last_checked_ok))

900

901

# timeout - property

902

@dbus_service_property(_interface, signature=u"t",

903

access=u"readwrite")

904

def timeout_dbus_property(self, value=None):

1148

return datetime_to_dbus(self.last_checked_ok)

1149

1150

# Expires - property

1151

@dbus_service_property(_interface, signature="s", access="read")

1152

def Expires_dbus_property(self):

1153

return datetime_to_dbus(self.expires)

1154

1155

# LastApprovalRequest - property

1156

@dbus_service_property(_interface, signature="s", access="read")

1157

def LastApprovalRequest_dbus_property(self):

1158

return datetime_to_dbus(self.last_approval_request)

1159

1160

# Timeout - property

1161

@dbus_service_property(_interface, signature="t",

1162

access="readwrite")

1163

def Timeout_dbus_property(self, value=None):

905

1164

if value is None: # get

906

1165

return dbus.UInt64(self.timeout_milliseconds())

907

1166

self.timeout = datetime.timedelta(0, 0, 0, value)

908

# Emit D-Bus signal

909

self.PropertyChanged(dbus.String(u"timeout"),

910

dbus.UInt64(value, variant_level=1))

911

if getattr(self, u"disable_initiator_tag", None) is None:

1167

if getattr(self, "disable_initiator_tag", None) is None:

912

1168

return

913

1169

# Reschedule timeout

914

1170

gobject.source_remove(self.disable_initiator_tag)

915

1171

self.disable_initiator_tag = None

1172

self.expires = None

916

1173

time_to_die = (self.

917

1174

_timedelta_to_milliseconds((self

918

1175

.last_checked_ok

923

1180

# The timeout has passed

924

1181

self.disable()

925

1182

else:

1183

self.expires = (datetime.datetime.utcnow()

1184

+ datetime.timedelta(milliseconds = time_to_die))

926

1185

self.disable_initiator_tag = (gobject.timeout_add

927

1186

(time_to_die, self.disable))

928

1187

929

# interval - property

930

@dbus_service_property(_interface, signature=u"t",

931

access=u"readwrite")

932

def interval_dbus_property(self, value=None):

1188

# ExtendedTimeout - property

1189

@dbus_service_property(_interface, signature="t",

1190

access="readwrite")

1191

def ExtendedTimeout_dbus_property(self, value=None):

1192

if value is None: # get

1193

return dbus.UInt64(self.extended_timeout_milliseconds())

1194

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1195

1196

# Interval - property

1197

@dbus_service_property(_interface, signature="t",

1198

access="readwrite")

1199

def Interval_dbus_property(self, value=None):

933

1200

if value is None: # get

934

1201

return dbus.UInt64(self.interval_milliseconds())

935

1202

self.interval = datetime.timedelta(0, 0, 0, value)

936

# Emit D-Bus signal

937

self.PropertyChanged(dbus.String(u"interval"),

938

dbus.UInt64(value, variant_level=1))

939

if getattr(self, u"checker_initiator_tag", None) is None:

1203

if getattr(self, "checker_initiator_tag", None) is None:

940

1204

return

941

1205

# Reschedule checker run

942

1206

gobject.source_remove(self.checker_initiator_tag)

943

1207

self.checker_initiator_tag = (gobject.timeout_add

944

1208

(value, self.start_checker))

945

1209

self.start_checker() # Start one now, too

946

947

# checker - property

948

@dbus_service_property(_interface, signature=u"s",

949

access=u"readwrite")

950

def checker_dbus_property(self, value=None):

1210

1211

# Checker - property

1212

@dbus_service_property(_interface, signature="s",

1213

access="readwrite")

1214

def Checker_dbus_property(self, value=None):

951

1215

if value is None: # get

952

1216

return dbus.String(self.checker_command)

953

1217

self.checker_command = value

954

# Emit D-Bus signal

955

self.PropertyChanged(dbus.String(u"checker"),

956

dbus.String(self.checker_command,

957

variant_level=1))

958

1218

959

# checker_running - property

960

@dbus_service_property(_interface, signature=u"b",

961

access=u"readwrite")

962

def checker_running_dbus_property(self, value=None):

1219

# CheckerRunning - property

1220

@dbus_service_property(_interface, signature="b",

1221

access="readwrite")

1222

def CheckerRunning_dbus_property(self, value=None):

963

1223

if value is None: # get

964

1224

return dbus.Boolean(self.checker is not None)

965

1225

if value:

967

1227

else:

968

1228

self.stop_checker()

969

1229

970

# object_path - property

971

@dbus_service_property(_interface, signature=u"o", access=u"read")

972

def object_path_dbus_property(self):

1230

# ObjectPath - property

1231

@dbus_service_property(_interface, signature="o", access="read")

1232

def ObjectPath_dbus_property(self):

973

1233

return self.dbus_object_path # is already a dbus.ObjectPath

974

1234

975

# secret = property

976

@dbus_service_property(_interface, signature=u"ay",

977

access=u"write", byte_arrays=True)

978

def secret_dbus_property(self, value):

1235

# Secret = property

1236

@dbus_service_property(_interface, signature="ay",

1237

access="write", byte_arrays=True)

1238

def Secret_dbus_property(self, value):

979

1239

self.secret = str(value)

980

1240

981

1241

del _interface

982

1242

983

1243

1244

class ProxyClient(object):

1245

def __init__(self, child_pipe, fpr, address):

1246

self._pipe = child_pipe

1247

self._pipe.send(('init', fpr, address))

1248

if not self._pipe.recv():

1249

raise KeyError()

1250

1251

def __getattribute__(self, name):

1252

if(name == '_pipe'):

1253

return super(ProxyClient, self).__getattribute__(name)

1254

self._pipe.send(('getattr', name))

1255

data = self._pipe.recv()

1256

if data[0] == 'data':

1257

return data[1]

1258

if data[0] == 'function':

1259

def func(*args, **kwargs):

1260

self._pipe.send(('funcall', name, args, kwargs))

1261

return self._pipe.recv()[1]

1262

return func

1263

1264

def __setattr__(self, name, value):

1265

if(name == '_pipe'):

1266

return super(ProxyClient, self).__setattr__(name, value)

1267

self._pipe.send(('setattr', name, value))

1268

1269

class ClientDBusTransitional(ClientDBus):

1270

__metaclass__ = AlternateDBusNamesMetaclass

1271

984

1272

class ClientHandler(socketserver.BaseRequestHandler, object):

985

1273

"""A class to handle client connections.

986

1274

988

1276

Note: This will run in its own forked process."""

989

1277

990

1278

def handle(self):

991

logger.info(u"TCP connection from: %s",

992

unicode(self.client_address))

993

logger.debug(u"IPC Pipe FD: %d", self.server.pipe[1])

994

# Open IPC pipe to parent process

995

with closing(os.fdopen(self.server.pipe[1], u"w", 1)) as ipc:

1279

with contextlib.closing(self.server.child_pipe) as child_pipe:

1280

logger.info("TCP connection from: %s",

1281

unicode(self.client_address))

1282

logger.debug("Pipe FD: %d",

1283

self.server.child_pipe.fileno())

1284

996

1285

session = (gnutls.connection

997

1286

.ClientSession(self.request,

998

1287

gnutls.connection

999

1288

.X509Credentials()))

1000

1289

1001

line = self.request.makefile().readline()

1002

logger.debug(u"Protocol version: %r", line)

1003

try:

1004

if int(line.strip().split()[0]) > 1:

1005

raise RuntimeError

1006

except (ValueError, IndexError, RuntimeError), error:

1007

logger.error(u"Unknown protocol version: %s", error)

1008

return

1009

1010

1290

# Note: gnutls.connection.X509Credentials is really a

1011

1291

# generic GnuTLS certificate credentials object so long as

1012

1292

# no X.509 keys are added to it. Therefore, we can use it

1013

1293

# here despite using OpenPGP certificates.

1014

1294

1015

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1016

# u"+AES-256-CBC", u"+SHA1",

1017

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1018

# u"+DHE-DSS"))

1295

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1296

# "+AES-256-CBC", "+SHA1",

1297

# "+COMP-NULL", "+CTYPE-OPENPGP",

1298

# "+DHE-DSS"))

1019

1299

# Use a fallback default, since this MUST be set.

1020

1300

priority = self.server.gnutls_priority

1021

1301

if priority is None:

1022

priority = u"NORMAL"

1302

priority = "NORMAL"

1023

1303

(gnutls.library.functions

1024

1304

.gnutls_priority_set_direct(session._c_object,

1025

1305

priority, None))

1026

1306

1307

# Start communication using the Mandos protocol

1308

# Get protocol number

1309

line = self.request.makefile().readline()

1310

logger.debug("Protocol version: %r", line)

1311

try:

1312

if int(line.strip().split()[0]) > 1:

1313

raise RuntimeError

1314

except (ValueError, IndexError, RuntimeError) as error:

1315

logger.error("Unknown protocol version: %s", error)

1316

return

1317

1318

# Start GnuTLS connection

1027

1319

try:

1028

1320

session.handshake()

1029

except gnutls.errors.GNUTLSError, error:

1030

logger.warning(u"Handshake failed: %s", error)

1321

except gnutls.errors.GNUTLSError as error:

1322

logger.warning("Handshake failed: %s", error)

1031

1323

# Do not run session.bye() here: the session is not

1032

1324

# established. Just abandon the request.

1033

1325

return

1034

logger.debug(u"Handshake succeeded")

1326

logger.debug("Handshake succeeded")

1327

1328

approval_required = False

1035

1329

try:

1036

fpr = self.fingerprint(self.peer_certificate(session))

1037

except (TypeError, gnutls.errors.GNUTLSError), error:

1038

logger.warning(u"Bad certificate: %s", error)

1039

session.bye()

1040

return

1041

logger.debug(u"Fingerprint: %s", fpr)

1330

try:

1331

fpr = self.fingerprint(self.peer_certificate

1332

(session))

1333

except (TypeError,

1334

gnutls.errors.GNUTLSError) as error:

1335

logger.warning("Bad certificate: %s", error)

1336

return

1337

logger.debug("Fingerprint: %s", fpr)

1338

1339

try:

1340

client = ProxyClient(child_pipe, fpr,

1341

self.client_address)

1342

except KeyError:

1343

return

1344

1345

if client.approval_delay:

1346

delay = client.approval_delay

1347

client.approvals_pending += 1

1348

approval_required = True

1349

1350

while True:

1351

if not client.enabled:

1352

logger.info("Client %s is disabled",

1353

client.name)

1354

if self.server.use_dbus:

1355

# Emit D-Bus signal

1356

client.Rejected("Disabled")

1357

return

1358

1359

if client._approved or not client.approval_delay:

1360

#We are approved or approval is disabled

1361

break

1362

elif client._approved is None:

1363

logger.info("Client %s needs approval",

1364

client.name)

1365

if self.server.use_dbus:

1366

# Emit D-Bus signal

1367

client.NeedApproval(

1368

client.approval_delay_milliseconds(),

1369

client.approved_by_default)

1370

else:

1371

logger.warning("Client %s was not approved",

1372

client.name)

1373

if self.server.use_dbus:

1374

# Emit D-Bus signal

1375

client.Rejected("Denied")

1376

return

1377

1378

#wait until timeout or approved

1379

#x = float(client._timedelta_to_milliseconds(delay))

1380

time = datetime.datetime.now()

1381

client.changedstate.acquire()

1382

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1383

client.changedstate.release()

1384

time2 = datetime.datetime.now()

1385

if (time2 - time) >= delay:

1386

if not client.approved_by_default:

1387

logger.warning("Client %s timed out while"

1388

" waiting for approval",

1389

client.name)

1390

if self.server.use_dbus:

1391

# Emit D-Bus signal

1392

client.Rejected("Approval timed out")

1393

return

1394

else:

1395

break

1396

else:

1397

delay -= time2 - time

1398

1399

sent_size = 0

1400

while sent_size < len(client.secret):

1401

try:

1402

sent = session.send(client.secret[sent_size:])

1403

except gnutls.errors.GNUTLSError as error:

1404

logger.warning("gnutls send failed")

1405

return

1406

logger.debug("Sent: %d, remaining: %d",

1407

sent, len(client.secret)

1408

- (sent_size + sent))

1409

sent_size += sent

1410

1411

logger.info("Sending secret to %s", client.name)

1412

# bump the timeout as if seen

1413

client.checked_ok(client.extended_timeout)

1414

if self.server.use_dbus:

1415

# Emit D-Bus signal

1416

client.GotSecret()

1042

1417

1043

for c in self.server.clients:

1044

if c.fingerprint == fpr:

1045

client = c

1046

break

1047

else:

1048

ipc.write(u"NOTFOUND %s %s\n"

1049

% (fpr, unicode(self.client_address)))

1050

session.bye()

1051

return

1052

# Have to check if client.still_valid(), since it is

1053

# possible that the client timed out while establishing

1054

# the GnuTLS session.

1055

if not client.still_valid():

1056

ipc.write(u"INVALID %s\n" % client.name)

1057

session.bye()

1058

return

1059

ipc.write(u"SENDING %s\n" % client.name)

1060

sent_size = 0

1061

while sent_size < len(client.secret):

1062

sent = session.send(client.secret[sent_size:])

1063

logger.debug(u"Sent: %d, remaining: %d",

1064

sent, len(client.secret)

1065

- (sent_size + sent))

1066

sent_size += sent

1067

session.bye()

1418

finally:

1419

if approval_required:

1420

client.approvals_pending -= 1

1421

try:

1422

session.bye()

1423

except gnutls.errors.GNUTLSError as error:

1424

logger.warning("GnuTLS bye failed")

1068

1425

1069

1426

@staticmethod

1070

1427

def peer_certificate(session):

1080

1437

.gnutls_certificate_get_peers

1081

1438

(session._c_object, ctypes.byref(list_size)))

1082

1439

if not bool(cert_list) and list_size.value != 0:

1083

raise gnutls.errors.GNUTLSError(u"error getting peer"

1084

u" certificate")

1440

raise gnutls.errors.GNUTLSError("error getting peer"

1441

" certificate")

1085

1442

if list_size.value == 0:

1086

1443

return None

1087

1444

cert = cert_list[0]

1113

1470

if crtverify.value != 0:

1114

1471

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1115

1472

raise (gnutls.errors.CertificateSecurityError

1116

(u"Verify failed"))

1473

("Verify failed"))

1117

1474

# New buffer for the fingerprint

1118

1475

buf = ctypes.create_string_buffer(20)

1119

1476

buf_len = ctypes.c_size_t()

1126

1483

# Convert the buffer to a Python bytestring

1127

1484

fpr = ctypes.string_at(buf, buf_len.value)

1128

1485

# Convert the bytestring to hexadecimal notation

1129

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1486

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1130

1487

return hex_fpr

1131

1488

1132

1489

1133

class ForkingMixInWithPipe(socketserver.ForkingMixIn, object):

1134

"""Like socketserver.ForkingMixIn, but also pass a pipe."""

1490

class MultiprocessingMixIn(object):

1491

"""Like socketserver.ThreadingMixIn, but with multiprocessing"""

1492

def sub_process_main(self, request, address):

1493

try:

1494

self.finish_request(request, address)

1495

except:

1496

self.handle_error(request, address)

1497

self.close_request(request)

1498

1499

def process_request(self, request, address):

1500

"""Start a new process to process the request."""

1501

multiprocessing.Process(target = self.sub_process_main,

1502

args = (request, address)).start()

1503

1504

1505

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1506

""" adds a pipe to the MixIn """

1135

1507

def process_request(self, request, client_address):

1136

1508

"""Overrides and wraps the original process_request().

1137

1509

1138

1510

This function creates a new pipe in self.pipe

1139

1511

"""

1140

self.pipe = os.pipe()

1141

super(ForkingMixInWithPipe,

1512

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1513

1514

super(MultiprocessingMixInWithPipe,

1142

1515

self).process_request(request, client_address)

1143

os.close(self.pipe[1]) # close write end

1144

self.add_pipe(self.pipe[0])

1145

def add_pipe(self, pipe):

1516

self.child_pipe.close()

1517

self.add_pipe(parent_pipe)

1518

1519

def add_pipe(self, parent_pipe):

1146

1520

"""Dummy function; override as necessary"""

1147

os.close(pipe)

1148

1149

1150

class IPv6_TCPServer(ForkingMixInWithPipe,

1521

raise NotImplementedError

1522

1523

1524

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1151

1525

socketserver.TCPServer, object):

1152

1526

"""IPv6-capable TCP server. Accepts 'None' as address and/or port

1153

1527

1169

1543

bind to an address or port if they were not specified."""

1170

1544

if self.interface is not None:

1171

1545

if SO_BINDTODEVICE is None:

1172

logger.error(u"SO_BINDTODEVICE does not exist;"

1173

u" cannot bind to interface %s",

1546

logger.error("SO_BINDTODEVICE does not exist;"

1547

" cannot bind to interface %s",

1174

1548

self.interface)

1175

1549

else:

1176

1550

try:

1177

1551

self.socket.setsockopt(socket.SOL_SOCKET,

1178

1552

SO_BINDTODEVICE,

1179

1553

str(self.interface

1180

+ u'\0'))

1181

except socket.error, error:

1554

+ '\0'))

1555

except socket.error as error:

1182

1556

if error[0] == errno.EPERM:

1183

logger.error(u"No permission to"

1184

u" bind to interface %s",

1557

logger.error("No permission to"

1558

" bind to interface %s",

1185

1559

self.interface)

1186

1560

elif error[0] == errno.ENOPROTOOPT:

1187

logger.error(u"SO_BINDTODEVICE not available;"

1188

u" cannot bind to interface %s",

1561

logger.error("SO_BINDTODEVICE not available;"

1562

" cannot bind to interface %s",

1189

1563

self.interface)

1190

1564

else:

1191

1565

raise

1193

1567

if self.server_address[0] or self.server_address[1]:

1194

1568

if not self.server_address[0]:

1195

1569

if self.address_family == socket.AF_INET6:

1196

any_address = u"::" # in6addr_any

1570

any_address = "::" # in6addr_any

1197

1571

else:

1198

1572

any_address = socket.INADDR_ANY

1199

1573

self.server_address = (any_address,

1238

1612

return socketserver.TCPServer.server_activate(self)

1239

1613

def enable(self):

1240

1614

self.enabled = True

1241

def add_pipe(self, pipe):

1615

def add_pipe(self, parent_pipe):

1242

1616

# Call "handle_ipc" for both data and EOF events

1243

gobject.io_add_watch(pipe, gobject.IO_IN | gobject.IO_HUP,

1244

self.handle_ipc)

1245

def handle_ipc(self, source, condition, file_objects={}):

1617

gobject.io_add_watch(parent_pipe.fileno(),

1618

gobject.IO_IN | gobject.IO_HUP,

1619

functools.partial(self.handle_ipc,

1620

parent_pipe = parent_pipe))

1621

1622

def handle_ipc(self, source, condition, parent_pipe=None,

1623

client_object=None):

1246

1624

condition_names = {

1247

gobject.IO_IN: u"IN", # There is data to read.

1248

gobject.IO_OUT: u"OUT", # Data can be written (without

1625

gobject.IO_IN: "IN", # There is data to read.

1626

gobject.IO_OUT: "OUT", # Data can be written (without

1249

1627

# blocking).

1250

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1251

gobject.IO_ERR: u"ERR", # Error condition.

1252

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1628

gobject.IO_PRI: "PRI", # There is urgent data to read.

1629

gobject.IO_ERR: "ERR", # Error condition.

1630

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1253

1631

# broken, usually for pipes and

1254

1632

# sockets).

1255

1633

}

1257

1635

for cond, name in

1258

1636

condition_names.iteritems()

1259

1637

if cond & condition)

1260

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1261

conditions_string)

1262

1263

# Turn the pipe file descriptor into a Python file object

1264

if source not in file_objects:

1265

file_objects[source] = os.fdopen(source, u"r", 1)

1266

1267

# Read a line from the file object

1268

cmdline = file_objects[source].readline()

1269

if not cmdline: # Empty line means end of file

1270

# close the IPC pipe

1271

file_objects[source].close()

1272

del file_objects[source]

1273

1274

# Stop calling this function

1275

return False

1276

1277

logger.debug(u"IPC command: %r", cmdline)

1278

1279

# Parse and act on command

1280

cmd, args = cmdline.rstrip(u"\r\n").split(None, 1)

1281

1282

if cmd == u"NOTFOUND":

1283

logger.warning(u"Client not found for fingerprint: %s",

1284

args)

1285

if self.use_dbus:

1286

# Emit D-Bus signal

1287

mandos_dbus_service.ClientNotFound(args)

1288

elif cmd == u"INVALID":

1289

for client in self.clients:

1290

if client.name == args:

1291

logger.warning(u"Client %s is invalid", args)

1292

if self.use_dbus:

1293

# Emit D-Bus signal

1294

client.Rejected()

1295

break

1296

else:

1297

logger.error(u"Unknown client %s is invalid", args)

1298

elif cmd == u"SENDING":

1299

for client in self.clients:

1300

if client.name == args:

1301

logger.info(u"Sending secret to %s", client.name)

1302

client.checked_ok()

1303

if self.use_dbus:

1304

# Emit D-Bus signal

1305

client.GotSecret()

1306

break

1307

else:

1308

logger.error(u"Sending secret to unknown client %s",

1309

args)

1310

else:

1311

logger.error(u"Unknown IPC command: %r", cmdline)

1312

1313

# Keep calling this function

1638

# error or the other end of multiprocessing.Pipe has closed

1639

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1640

return False

1641

1642

# Read a request from the child

1643

request = parent_pipe.recv()

1644

command = request[0]

1645

1646

if command == 'init':

1647

fpr = request[1]

1648

address = request[2]

1649

1650

for c in self.clients:

1651

if c.fingerprint == fpr:

1652

client = c

1653

break

1654

else:

1655

logger.info("Client not found for fingerprint: %s, ad"

1656

"dress: %s", fpr, address)

1657

if self.use_dbus:

1658

# Emit D-Bus signal

1659

mandos_dbus_service.ClientNotFound(fpr, address[0])

1660

parent_pipe.send(False)

1661

return False

1662

1663

gobject.io_add_watch(parent_pipe.fileno(),

1664

gobject.IO_IN | gobject.IO_HUP,

1665

functools.partial(self.handle_ipc,

1666

parent_pipe = parent_pipe,

1667

client_object = client))

1668

parent_pipe.send(True)

1669

# remove the old hook in favor of the new above hook on same fileno

1670

return False

1671

if command == 'funcall':

1672

funcname = request[1]

1673

args = request[2]

1674

kwargs = request[3]

1675

1676

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1677

1678

if command == 'getattr':

1679

attrname = request[1]

1680

if callable(client_object.__getattribute__(attrname)):

1681

parent_pipe.send(('function',))

1682

else:

1683

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1684

1685

if command == 'setattr':

1686

attrname = request[1]

1687

value = request[2]

1688

setattr(client_object, attrname, value)

1689

1314

1690

return True

1315

1691

1316

1692

1317

1693

def string_to_delta(interval):

1318

1694

"""Parse a string and return a datetime.timedelta

1319

1695

1320

>>> string_to_delta(u'7d')

1696

>>> string_to_delta('7d')

1321

1697

datetime.timedelta(7)

1322

>>> string_to_delta(u'60s')

1698

>>> string_to_delta('60s')

1323

1699

datetime.timedelta(0, 60)

1324

>>> string_to_delta(u'60m')

1700

>>> string_to_delta('60m')

1325

1701

datetime.timedelta(0, 3600)

1326

>>> string_to_delta(u'24h')

1702

>>> string_to_delta('24h')

1327

1703

datetime.timedelta(1)

1328

>>> string_to_delta(u'1w')

1704

>>> string_to_delta('1w')

1329

1705

datetime.timedelta(7)

1330

>>> string_to_delta(u'5m 30s')

1706

>>> string_to_delta('5m 30s')

1331

1707

datetime.timedelta(0, 330)

1332

1708

"""

1333

1709

timevalue = datetime.timedelta(0)

1335

1711

try:

1336

1712

suffix = unicode(s[-1])

1337

1713

value = int(s[:-1])

1338

if suffix == u"d":

1714

if suffix == "d":

1339

1715

delta = datetime.timedelta(value)

1340

elif suffix == u"s":

1716

elif suffix == "s":

1341

1717

delta = datetime.timedelta(0, value)

1342

elif suffix == u"m":

1718

elif suffix == "m":

1343

1719

delta = datetime.timedelta(0, 0, 0, 0, value)

1344

elif suffix == u"h":

1720

elif suffix == "h":

1345

1721

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1346

elif suffix == u"w":

1722

elif suffix == "w":

1347

1723

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1348

1724

else:

1349

raise ValueError(u"Unknown suffix %r" % suffix)

1350

except (ValueError, IndexError), e:

1351

raise ValueError(e.message)

1725

raise ValueError("Unknown suffix %r" % suffix)

1726

except (ValueError, IndexError) as e:

1727

raise ValueError(*(e.args))

1352

1728

timevalue += delta

1353

1729

return timevalue

1354

1730

1360

1736

global if_nametoindex

1361

1737

try:

1362

1738

if_nametoindex = (ctypes.cdll.LoadLibrary

1363

(ctypes.util.find_library(u"c"))

1739

(ctypes.util.find_library("c"))

1364

1740

.if_nametoindex)

1365

1741

except (OSError, AttributeError):

1366

logger.warning(u"Doing if_nametoindex the hard way")

1742

logger.warning("Doing if_nametoindex the hard way")

1367

1743

def if_nametoindex(interface):

1368

1744

"Get an interface index the hard way, i.e. using fcntl()"

1369

1745

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1370

with closing(socket.socket()) as s:

1746

with contextlib.closing(socket.socket()) as s:

1371

1747

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1372

struct.pack(str(u"16s16x"),

1748

struct.pack(str("16s16x"),

1373

1749

interface))

1374

interface_index = struct.unpack(str(u"I"),

1750

interface_index = struct.unpack(str("I"),

1375

1751

ifreq[16:20])[0]

1376

1752

return interface_index

1377

1753

return if_nametoindex(interface)

1385

1761

sys.exit()

1386

1762

os.setsid()

1387

1763

if not nochdir:

1388

os.chdir(u"/")

1764

os.chdir("/")

1389

1765

if os.fork():

1390

1766

sys.exit()

1391

1767

if not noclose:

1393

1769

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1394

1770

if not stat.S_ISCHR(os.fstat(null).st_mode):

1395

1771

raise OSError(errno.ENODEV,

1396

u"%s not a character device"

1772

"%s not a character device"

1397

1773

% os.path.devnull)

1398

1774

os.dup2(null, sys.stdin.fileno())

1399

1775

os.dup2(null, sys.stdout.fileno())

1407

1783

##################################################################

1408

1784

# Parsing of options, both command line and config file

1409

1785

1410

parser = optparse.OptionParser(version = "%%prog %s" % version)

1411

parser.add_option("-i", u"--interface", type=u"string",

1412

metavar="IF", help=u"Bind to interface IF")

1413

parser.add_option("-a", u"--address", type=u"string",

1414

help=u"Address to listen for requests on")

1415

parser.add_option("-p", u"--port", type=u"int",

1416

help=u"Port number to receive requests on")

1417

parser.add_option("--check", action=u"store_true",

1418

help=u"Run self-test")

1419

parser.add_option("--debug", action=u"store_true",

1420

help=u"Debug mode; run in foreground and log to"

1421

u" terminal")

1422

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1423

u" priority string (see GnuTLS documentation)")

1424

parser.add_option("--servicename", type=u"string",

1425

metavar=u"NAME", help=u"Zeroconf service name")

1426

parser.add_option("--configdir", type=u"string",

1427

default=u"/etc/mandos", metavar=u"DIR",

1428

help=u"Directory to search for configuration"

1429

u" files")

1430

parser.add_option("--no-dbus", action=u"store_false",

1431

dest=u"use_dbus", help=u"Do not provide D-Bus"

1432

u" system bus interface")

1433

parser.add_option("--no-ipv6", action=u"store_false",

1434

dest=u"use_ipv6", help=u"Do not use IPv6")

1435

options = parser.parse_args()[0]

1786

parser = argparse.ArgumentParser()

1787

parser.add_argument("-v", "--version", action="version",

1788

version = "%%(prog)s %s" % version,

1789

help="show version number and exit")

1790

parser.add_argument("-i", "--interface", metavar="IF",

1791

help="Bind to interface IF")

1792

parser.add_argument("-a", "--address",

1793

help="Address to listen for requests on")

1794

parser.add_argument("-p", "--port", type=int,

1795

help="Port number to receive requests on")

1796

parser.add_argument("--check", action="store_true",

1797

help="Run self-test")

1798

parser.add_argument("--debug", action="store_true",

1799

help="Debug mode; run in foreground and log"

1800

" to terminal")

1801

parser.add_argument("--debuglevel", metavar="LEVEL",

1802

help="Debug level for stdout output")

1803

parser.add_argument("--priority", help="GnuTLS"

1804

" priority string (see GnuTLS documentation)")

1805

parser.add_argument("--servicename",

1806

metavar="NAME", help="Zeroconf service name")

1807

parser.add_argument("--configdir",

1808

default="/etc/mandos", metavar="DIR",

1809

help="Directory to search for configuration"

1810

" files")

1811

parser.add_argument("--no-dbus", action="store_false",

1812

dest="use_dbus", help="Do not provide D-Bus"

1813

" system bus interface")

1814

parser.add_argument("--no-ipv6", action="store_false",

1815

dest="use_ipv6", help="Do not use IPv6")

1816

options = parser.parse_args()

1436

1817

1437

1818

if options.check:

1438

1819

import doctest

1440

1821

sys.exit()

1441

1822

1442

1823

# Default values for config file for server-global settings

1443

server_defaults = { u"interface": u"",

1444

u"address": u"",

1445

u"port": u"",

1446

u"debug": u"False",

1447

u"priority":

1448

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1449

u"servicename": u"Mandos",

1450

u"use_dbus": u"True",

1451

u"use_ipv6": u"True",

1824

server_defaults = { "interface": "",

1825

"address": "",

1826

"port": "",

1827

"debug": "False",

1828

"priority":

1829

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1830

"servicename": "Mandos",

1831

"use_dbus": "True",

1832

"use_ipv6": "True",

1833

"debuglevel": "",

1452

1834

}

1453

1835

1454

1836

# Parse config file for server-global settings

1455

1837

server_config = configparser.SafeConfigParser(server_defaults)

1456

1838

del server_defaults

1457

1839

server_config.read(os.path.join(options.configdir,

1458

u"mandos.conf"))

1840

"mandos.conf"))

1459

1841

# Convert the SafeConfigParser object to a dict

1460

1842

server_settings = server_config.defaults()

1461

1843

# Use the appropriate methods on the non-string config options

1462

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1463

server_settings[option] = server_config.getboolean(u"DEFAULT",

1844

for option in ("debug", "use_dbus", "use_ipv6"):

1845

server_settings[option] = server_config.getboolean("DEFAULT",

1464

1846

option)

1465

1847

if server_settings["port"]:

1466

server_settings["port"] = server_config.getint(u"DEFAULT",

1467

u"port")

1848

server_settings["port"] = server_config.getint("DEFAULT",

1849

"port")

1468

1850

del server_config

1469

1851

1470

1852

# Override the settings from the config file with command line

1471

1853

# options, if set.

1472

for option in (u"interface", u"address", u"port", u"debug",

1473

u"priority", u"servicename", u"configdir",

1474

u"use_dbus", u"use_ipv6"):

1854

for option in ("interface", "address", "port", "debug",

1855

"priority", "servicename", "configdir",

1856

"use_dbus", "use_ipv6", "debuglevel"):

1475

1857

value = getattr(options, option)

1476

1858

if value is not None:

1477

1859

server_settings[option] = value

1485

1867

##################################################################

1486

1868

1487

1869

# For convenience

1488

debug = server_settings[u"debug"]

1489

use_dbus = server_settings[u"use_dbus"]

1490

use_ipv6 = server_settings[u"use_ipv6"]

1491

1492

if not debug:

1493

syslogger.setLevel(logging.WARNING)

1494

console.setLevel(logging.WARNING)

1495

1496

if server_settings[u"servicename"] != u"Mandos":

1870

debug = server_settings["debug"]

1871

debuglevel = server_settings["debuglevel"]

1872

use_dbus = server_settings["use_dbus"]

1873

use_ipv6 = server_settings["use_ipv6"]

1874

1875

if server_settings["servicename"] != "Mandos":

1497

1876

syslogger.setFormatter(logging.Formatter

1498

(u'Mandos (%s) [%%(process)d]:'

1499

u' %%(levelname)s: %%(message)s'

1500

% server_settings[u"servicename"]))

1877

('Mandos (%s) [%%(process)d]:'

1878

' %%(levelname)s: %%(message)s'

1879

% server_settings["servicename"]))

1501

1880

1502

1881

# Parse config file with clients

1503

client_defaults = { u"timeout": u"1h",

1504

u"interval": u"5m",

1505

u"checker": u"fping -q -- %%(host)s",

1506

u"host": u"",

1882

client_defaults = { "timeout": "5m",

1883

"extended_timeout": "15m",

1884

"interval": "2m",

1885

"checker": "fping -q -- %%(host)s",

1886

"host": "",

1887

"approval_delay": "0s",

1888

"approval_duration": "1s",

1507

1889

}

1508

1890

client_config = configparser.SafeConfigParser(client_defaults)

1509

client_config.read(os.path.join(server_settings[u"configdir"],

1510

u"clients.conf"))

1891

client_config.read(os.path.join(server_settings["configdir"],

1892

"clients.conf"))

1511

1893

1512

1894

global mandos_dbus_service

1513

1895

mandos_dbus_service = None

1514

1896

1515

tcp_server = MandosServer((server_settings[u"address"],

1516

server_settings[u"port"]),

1897

tcp_server = MandosServer((server_settings["address"],

1898

server_settings["port"]),

1517

1899

ClientHandler,

1518

interface=server_settings[u"interface"],

1900

interface=(server_settings["interface"]

1901

or None),

1519

1902

use_ipv6=use_ipv6,

1520

1903

gnutls_priority=

1521

server_settings[u"priority"],

1904

server_settings["priority"],

1522

1905

use_dbus=use_dbus)

1523

pidfilename = u"/var/run/mandos.pid"

1524

try:

1525

pidfile = open(pidfilename, u"w")

1526

except IOError:

1527

logger.error(u"Could not open file %r", pidfilename)

1906

if not debug:

1907

pidfilename = "/var/run/mandos.pid"

1908

try:

1909

pidfile = open(pidfilename, "w")

1910

except IOError:

1911

logger.error("Could not open file %r", pidfilename)

1528

1912

1529

1913

try:

1530

uid = pwd.getpwnam(u"_mandos").pw_uid

1531

gid = pwd.getpwnam(u"_mandos").pw_gid

1914

uid = pwd.getpwnam("_mandos").pw_uid

1915

gid = pwd.getpwnam("_mandos").pw_gid

1532

1916

except KeyError:

1533

1917

try:

1534

uid = pwd.getpwnam(u"mandos").pw_uid

1535

gid = pwd.getpwnam(u"mandos").pw_gid

1918

uid = pwd.getpwnam("mandos").pw_uid

1919

gid = pwd.getpwnam("mandos").pw_gid

1536

1920

except KeyError:

1537

1921

try:

1538

uid = pwd.getpwnam(u"nobody").pw_uid

1539

gid = pwd.getpwnam(u"nobody").pw_gid

1922

uid = pwd.getpwnam("nobody").pw_uid

1923

gid = pwd.getpwnam("nobody").pw_gid

1540

1924

except KeyError:

1541

1925

uid = 65534

1542

1926

gid = 65534

1543

1927

try:

1544

1928

os.setgid(gid)

1545

1929

os.setuid(uid)

1546

except OSError, error:

1930

except OSError as error:

1547

1931

if error[0] != errno.EPERM:

1548

1932

raise error

1549

1933

1550

# Enable all possible GnuTLS debugging

1934

if not debug and not debuglevel:

1935

syslogger.setLevel(logging.WARNING)

1936

console.setLevel(logging.WARNING)

1937

if debuglevel:

1938

level = getattr(logging, debuglevel.upper())

1939

syslogger.setLevel(level)

1940

console.setLevel(level)

1941

1551

1942

if debug:

1943

# Enable all possible GnuTLS debugging

1944

1552

1945

# "Use a log level over 10 to enable all debugging options."

1553

1946

# - GnuTLS manual

1554

1947

gnutls.library.functions.gnutls_global_set_log_level(11)

1555

1948

1556

1949

@gnutls.library.types.gnutls_log_func

1557

1950

def debug_gnutls(level, string):

1558

logger.debug(u"GnuTLS: %s", string[:-1])

1951

logger.debug("GnuTLS: %s", string[:-1])

1559

1952

1560

1953

(gnutls.library.functions

1561

1954

.gnutls_global_set_log_function(debug_gnutls))

1955

1956

# Redirect stdin so all checkers get /dev/null

1957

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1958

os.dup2(null, sys.stdin.fileno())

1959

if null > 2:

1960

os.close(null)

1961

else:

1962

# No console logging

1963

logger.removeHandler(console)

1964

1965

# Need to fork before connecting to D-Bus

1966

if not debug:

1967

# Close all input and output, do double fork, etc.

1968

daemon()

1562

1969

1563

1970

global main_loop

1564

1971

# From the Avahi example code

1567

1974

bus = dbus.SystemBus()

1568

1975

# End of Avahi example code

1569

1976

if use_dbus:

1570

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos", bus)

1977

try:

1978

bus_name = dbus.service.BusName("se.recompile.Mandos",

1979

bus, do_not_queue=True)

1980

old_bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1981

bus, do_not_queue=True)

1982

except dbus.exceptions.NameExistsException as e:

1983

logger.error(unicode(e) + ", disabling D-Bus")

1984

use_dbus = False

1985

server_settings["use_dbus"] = False

1986

tcp_server.use_dbus = False

1571

1987

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1572

service = AvahiService(name = server_settings[u"servicename"],

1573

servicetype = u"_mandos._tcp",

1988

service = AvahiService(name = server_settings["servicename"],

1989

servicetype = "_mandos._tcp",

1574

1990

protocol = protocol, bus = bus)

1575

1991

if server_settings["interface"]:

1576

1992

service.interface = (if_nametoindex

1577

(str(server_settings[u"interface"])))

1993

(str(server_settings["interface"])))

1994

1995

global multiprocessing_manager

1996

multiprocessing_manager = multiprocessing.Manager()

1578

1997

1579

1998

client_class = Client

1580

1999

if use_dbus:

1581

client_class = functools.partial(ClientDBus, bus = bus)

2000

client_class = functools.partial(ClientDBusTransitional, bus = bus)

2001

def client_config_items(config, section):

2002

special_settings = {

2003

"approved_by_default":

2004

lambda: config.getboolean(section,

2005

"approved_by_default"),

2006

}

2007

for name, value in config.items(section):

2008

try:

2009

yield (name, special_settings[name]())

2010

except KeyError:

2011

yield (name, value)

2012

1582

2013

tcp_server.clients.update(set(

1583

2014

client_class(name = section,

1584

config= dict(client_config.items(section)))

2015

config= dict(client_config_items(

2016

client_config, section)))

1585

2017

for section in client_config.sections()))

1586

2018

if not tcp_server.clients:

1587

logger.warning(u"No clients defined")

1588

1589

if debug:

1590

# Redirect stdin so all checkers get /dev/null

1591

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1592

os.dup2(null, sys.stdin.fileno())

1593

if null > 2:

1594

os.close(null)

1595

else:

1596

# No console logging

1597

logger.removeHandler(console)

1598

# Close all input and output, do double fork, etc.

1599

daemon()

1600

1601

try:

1602

with closing(pidfile):

1603

pid = os.getpid()

1604

pidfile.write(str(pid) + "\n")

1605

del pidfile

1606

except IOError:

1607

logger.error(u"Could not write to file %r with PID %d",

1608

pidfilename, pid)

1609

except NameError:

1610

# "pidfile" was never created

1611

pass

1612

del pidfilename

1613

2019

logger.warning("No clients defined")

2020

1614

2021

if not debug:

2022

try:

2023

with pidfile:

2024

pid = os.getpid()

2025

pidfile.write(str(pid) + "\n".encode("utf-8"))

2026

del pidfile

2027

except IOError:

2028

logger.error("Could not write to file %r with PID %d",

2029

pidfilename, pid)

2030

except NameError:

2031

# "pidfile" was never created

2032

pass

2033

del pidfilename

2034

1615

2035

signal.signal(signal.SIGINT, signal.SIG_IGN)

2036

1616

2037

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1617

2038

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1618

2039

1620

2041

class MandosDBusService(dbus.service.Object):

1621

2042

"""A D-Bus proxy object"""

1622

2043

def __init__(self):

1623

dbus.service.Object.__init__(self, bus, u"/")

1624

_interface = u"se.bsnet.fukt.Mandos"

1625

1626

@dbus.service.signal(_interface, signature=u"oa{sv}")

1627

def ClientAdded(self, objpath, properties):

1628

"D-Bus signal"

1629

pass

1630

1631

@dbus.service.signal(_interface, signature=u"s")

1632

def ClientNotFound(self, fingerprint):

1633

"D-Bus signal"

1634

pass

1635

1636

@dbus.service.signal(_interface, signature=u"os")

2044

dbus.service.Object.__init__(self, bus, "/")

2045

_interface = "se.recompile.Mandos"

2046

2047

@dbus.service.signal(_interface, signature="o")

2048

def ClientAdded(self, objpath):

2049

"D-Bus signal"

2050

pass

2051

2052

@dbus.service.signal(_interface, signature="ss")

2053

def ClientNotFound(self, fingerprint, address):

2054

"D-Bus signal"

2055

pass

2056

2057

@dbus.service.signal(_interface, signature="os")

1637

2058

def ClientRemoved(self, objpath, name):

1638

2059

"D-Bus signal"

1639

2060

pass

1640

2061

1641

@dbus.service.method(_interface, out_signature=u"ao")

2062

@dbus.service.method(_interface, out_signature="ao")

1642

2063

def GetAllClients(self):

1643

2064

"D-Bus method"

1644

2065

return dbus.Array(c.dbus_object_path

1645

2066

for c in tcp_server.clients)

1646

2067

1647

2068

@dbus.service.method(_interface,

1648

out_signature=u"a{oa{sv}}")

2069

out_signature="a{oa{sv}}")

1649

2070

def GetAllClientsWithProperties(self):

1650

2071

"D-Bus method"

1651

2072

return dbus.Dictionary(

1652

((c.dbus_object_path, c.GetAll(u""))

2073

((c.dbus_object_path, c.GetAll(""))

1653

2074

for c in tcp_server.clients),

1654

signature=u"oa{sv}")

2075

signature="oa{sv}")

1655

2076

1656

@dbus.service.method(_interface, in_signature=u"o")

2077

@dbus.service.method(_interface, in_signature="o")

1657

2078

def RemoveClient(self, object_path):

1658

2079

"D-Bus method"

1659

2080

for c in tcp_server.clients:

1661

2082

tcp_server.clients.remove(c)

1662

2083

c.remove_from_connection()

1663

2084

# Don't signal anything except ClientRemoved

1664

c.disable(signal=False)

2085

c.disable(quiet=True)

1665

2086

# Emit D-Bus signal

1666

2087

self.ClientRemoved(object_path, c.name)

1667

2088

return

1669

2090

1670

2091

del _interface

1671

2092

1672

mandos_dbus_service = MandosDBusService()

2093

class MandosDBusServiceTransitional(MandosDBusService):

2094

__metaclass__ = AlternateDBusNamesMetaclass

2095

mandos_dbus_service = MandosDBusServiceTransitional()

1673

2096

1674

2097

def cleanup():

1675

2098

"Cleanup function; run on exit"

1677

2100

1678

2101

while tcp_server.clients:

1679

2102

client = tcp_server.clients.pop()

1680

client.remove_from_connection()

2103

if use_dbus:

2104

client.remove_from_connection()

1681

2105

client.disable_hook = None

1682

2106

# Don't signal anything except ClientRemoved

1683

client.disable(signal=False)

2107

client.disable(quiet=True)

1684

2108

if use_dbus:

1685

2109

# Emit D-Bus signal

1686

2110

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

1691

2115

for client in tcp_server.clients:

1692

2116

if use_dbus:

1693

2117

# Emit D-Bus signal

1694

mandos_dbus_service.ClientAdded(client.dbus_object_path,

1695

client.GetAll(u""))

2118

mandos_dbus_service.ClientAdded(client.dbus_object_path)

1696

2119

client.enable()

1697

2120

1698

2121

tcp_server.enable()

1701

2124

# Find out what port we got

1702

2125

service.port = tcp_server.socket.getsockname()[1]

1703

2126

if use_ipv6:

1704

logger.info(u"Now listening on address %r, port %d,"

2127

logger.info("Now listening on address %r, port %d,"

1705

2128

" flowinfo %d, scope_id %d"

1706

2129

% tcp_server.socket.getsockname())

1707

2130

else: # IPv4

1708

logger.info(u"Now listening on address %r, port %d"

2131

logger.info("Now listening on address %r, port %d"

1709

2132

% tcp_server.socket.getsockname())

1710

2133

1711

2134

#service.interface = tcp_server.socket.getsockname()[3]

1714

2137

# From the Avahi example code

1715

2138

try:

1716

2139

service.activate()

1717

except dbus.exceptions.DBusException, error:

1718

logger.critical(u"DBusException: %s", error)

2140

except dbus.exceptions.DBusException as error:

2141

logger.critical("DBusException: %s", error)

1719

2142

cleanup()

1720

2143

sys.exit(1)

1721

2144

# End of Avahi example code

1725

2148

(tcp_server.handle_request

1726

2149

(*args[2:], **kwargs) or True))

1727

2150

1728

logger.debug(u"Starting main loop")

2151

logger.debug("Starting main loop")

1729

2152

main_loop.run()

1730

except AvahiError, error:

1731

logger.critical(u"AvahiError: %s", error)

2153

except AvahiError as error:

2154

logger.critical("AvahiError: %s", error)

1732

2155

cleanup()

1733

2156

sys.exit(1)

1734

2157

except KeyboardInterrupt:

1735

2158

if debug:

1736

print >> sys.stderr

1737

logger.debug(u"Server received KeyboardInterrupt")

1738

logger.debug(u"Server exiting")

2159

print("", file=sys.stderr)

2160

logger.debug("Server received KeyboardInterrupt")

2161

logger.debug("Server exiting")

1739

2162

# Must run before the D-Bus bus name gets deregistered

1740

2163

cleanup()

1741

2164

2165

1742

2166

if __name__ == '__main__':

1743

2167

main()