/mandos/trunk : revision 505.1.2

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

61

62

import functools

62

63

import cPickle as pickle

63

64

import multiprocessing

65

import types

64

66

65

67

import dbus

66

68

import dbus.service

81

83

SO_BINDTODEVICE = None

82

84

83

85

84

version = "1.0.14"

86

version = "1.3.1"

85

87

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

88

90

syslogger = (logging.handlers.SysLogHandler

89

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

90

address = "/dev/log"))

92

address = str("/dev/log")))

91

93

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

94

96

logger.addHandler(syslogger)

95

97

96

98

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

100

102

logger.addHandler(console)

101

103

102

104

class AvahiError(Exception):

119

121

Attributes:

120

122

interface: integer; avahi.IF_UNSPEC or an interface index.

121

123

Used to optionally bind to the specified interface.

122

123

type: string; Example: u'_mandos._tcp'.

124

125

type: string; Example: '_mandos._tcp'.

124

126

See <http://www.dns-sd.org/ServiceTypes.html>

125

127

port: integer; what port to announce

126

128

TXT: list of strings; TXT record for the service

135

137

"""

136

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

137

139

servicetype = None, port = None, TXT = None,

138

domain = u"", host = u"", max_renames = 32768,

140

domain = "", host = "", max_renames = 32768,

139

141

protocol = avahi.PROTO_UNSPEC, bus = None):

140

142

self.interface = interface

141

143

self.name = name

150

152

self.group = None # our entry group

151

153

self.server = None

152

154

self.bus = bus

155

self.entry_group_state_changed_match = None

153

156

def rename(self):

154

157

"""Derived from the Avahi example code"""

155

158

if self.rename_count >= self.max_renames:

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

158

161

self.rename_count)

159

raise AvahiServiceError(u"Too many renames")

162

raise AvahiServiceError("Too many renames")

160

163

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

164

logger.info("Changing Zeroconf service name to %r ...",

162

165

self.name)

163

166

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

167

('Mandos (%s) [%%(process)d]:'

168

' %%(levelname)s: %%(message)s'

166

169

% self.name))

167

170

self.remove()

168

171

try:

169

172

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

173

except dbus.exceptions.DBusException as error:

174

logger.critical("DBusException: %s", error)

172

175

self.cleanup()

173

176

os._exit(1)

174

177

self.rename_count += 1

175

178

def remove(self):

176

179

"""Derived from the Avahi example code"""

180

if self.entry_group_state_changed_match is not None:

181

self.entry_group_state_changed_match.remove()

182

self.entry_group_state_changed_match = None

177

183

if self.group is not None:

178

184

self.group.Reset()

179

185

def add(self):

180

186

"""Derived from the Avahi example code"""

187

self.remove()

181

188

if self.group is None:

182

189

self.group = dbus.Interface(

183

190

self.bus.get_object(avahi.DBUS_NAME,

184

191

self.server.EntryGroupNew()),

185

192

avahi.DBUS_INTERFACE_ENTRY_GROUP)

186

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

193

self.entry_group_state_changed_match = (

194

self.group.connect_to_signal(

195

'StateChanged', self .entry_group_state_changed))

196

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

190

197

self.name, self.type)

191

198

self.group.AddService(

192

199

self.interface,

199

206

self.group.Commit()

200

207

def entry_group_state_changed(self, state, error):

201

208

"""Derived from the Avahi example code"""

202

logger.debug(u"Avahi entry group state change: %i", state)

209

logger.debug("Avahi entry group state change: %i", state)

203

210

204

211

if state == avahi.ENTRY_GROUP_ESTABLISHED:

205

logger.debug(u"Zeroconf service established.")

212

logger.debug("Zeroconf service established.")

206

213

elif state == avahi.ENTRY_GROUP_COLLISION:

207

logger.warning(u"Zeroconf service name collision.")

214

logger.info("Zeroconf service name collision.")

208

215

self.rename()

209

216

elif state == avahi.ENTRY_GROUP_FAILURE:

210

logger.critical(u"Avahi: Error in group state changed %s",

217

logger.critical("Avahi: Error in group state changed %s",

211

218

unicode(error))

212

raise AvahiGroupError(u"State changed: %s"

219

raise AvahiGroupError("State changed: %s"

213

220

% unicode(error))

214

221

def cleanup(self):

215

222

"""Derived from the Avahi example code"""

216

223

if self.group is not None:

217

self.group.Free()

224

try:

225

self.group.Free()

226

except (dbus.exceptions.UnknownMethodException,

227

dbus.exceptions.DBusException) as e:

228

pass

218

229

self.group = None

219

def server_state_changed(self, state):

230

self.remove()

231

def server_state_changed(self, state, error=None):

220

232

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

222

if state == avahi.SERVER_COLLISION:

223

logger.error(u"Zeroconf server name collision")

224

self.remove()

233

logger.debug("Avahi server state change: %i", state)

234

bad_states = { avahi.SERVER_INVALID:

235

"Zeroconf server invalid",

236

avahi.SERVER_REGISTERING: None,

237

avahi.SERVER_COLLISION:

238

"Zeroconf server name collision",

239

avahi.SERVER_FAILURE:

240

"Zeroconf server failure" }

241

if state in bad_states:

242

if bad_states[state] is not None:

243

if error is None:

244

logger.error(bad_states[state])

245

else:

246

logger.error(bad_states[state] + ": %r", error)

247

self.cleanup()

225

248

elif state == avahi.SERVER_RUNNING:

226

249

self.add()

250

else:

251

if error is None:

252

logger.debug("Unknown state: %r", state)

253

else:

254

logger.debug("Unknown state: %r: %r", state, error)

227

255

def activate(self):

228

256

"""Derived from the Avahi example code"""

229

257

if self.server is None:

230

258

self.server = dbus.Interface(

231

259

self.bus.get_object(avahi.DBUS_NAME,

232

avahi.DBUS_PATH_SERVER),

260

avahi.DBUS_PATH_SERVER,

261

follow_name_owner_changes=True),

233

262

avahi.DBUS_INTERFACE_SERVER)

234

self.server.connect_to_signal(u"StateChanged",

263

self.server.connect_to_signal("StateChanged",

235

264

self.server_state_changed)

236

265

self.server_state_changed(self.server.GetState())

237

266

238

267

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

273

239

274

class Client(object):

240

275

"""A representation of a client host served by this server.

241

276

242

277

Attributes:

243

244

D-Bus identifiers

278

_approved: bool(); 'None' if not yet approved/disapproved

279

approval_delay: datetime.timedelta(); Time to wait for approval

280

approval_duration: datetime.timedelta(); Duration of one approval

281

checker: subprocess.Popen(); a running checker process used

282

to see if the client lives.

283

'None' if no process is running.

284

checker_callback_tag: a gobject event source tag, or None

285

checker_command: string; External command which is run to check

286

if client lives. %() expansions are done at

287

runtime with vars(self) as dict, so that for

288

instance %(name)s can be used in the command.

289

checker_initiator_tag: a gobject event source tag, or None

290

created: datetime.datetime(); (UTC) object creation

291

current_checker_command: string; current running checker_command

292

disable_hook: If set, called by disable() as disable_hook(self)

293

disable_initiator_tag: a gobject event source tag, or None

294

enabled: bool()

245

295

fingerprint: string (40 or 32 hexadecimal digits); used to

246

296

uniquely identify the client

247

secret: bytestring; sent verbatim (over TLS) to client

248

297

host: string; available for use by the checker command

249

created: datetime.datetime(); (UTC) object creation

298

interval: datetime.timedelta(); How often to start a new checker

299

last_approval_request: datetime.datetime(); (UTC) or None

300

last_checked_ok: datetime.datetime(); (UTC) or None

250

301

last_enabled: datetime.datetime(); (UTC)

251

enabled: bool()

252

last_checked_ok: datetime.datetime(); (UTC) or None

302

303

D-Bus identifiers

304

secret: bytestring; sent verbatim (over TLS) to client

253

305

timeout: datetime.timedelta(); How long from last_checked_ok

254

306

until this client is disabled

255

interval: datetime.timedelta(); How often to start a new checker

256

disable_hook: If set, called by disable() as disable_hook(self)

257

checker: subprocess.Popen(); a running checker process used

258

to see if the client lives.

259

'None' if no process is running.

260

checker_initiator_tag: a gobject event source tag, or None

261

disable_initiator_tag: - '' -

262

checker_callback_tag: - '' -

263

checker_command: string; External command which is run to check if

264

client lives. %() expansions are done at

265

runtime with vars(self) as dict, so that for

266

instance %(name)s can be used in the command.

267

current_checker_command: string; current running checker_command

268

approval_delay: datetime.timedelta(); Time to wait for approval

269

_approved: bool(); 'None' if not yet approved/disapproved

270

approval_duration: datetime.timedelta(); Duration of one approval

307

extended_timeout: extra long timeout when password has been sent

308

runtime_expansions: Allowed attributes for runtime expansion.

309

expires: datetime.datetime(); time (UTC) when a client will be

310

disabled, or None

271

311

"""

272

312

273

@staticmethod

274

def _timedelta_to_milliseconds(td):

275

"Convert a datetime.timedelta() to milliseconds"

276

return ((td.days * 24 * 60 * 60 * 1000)

277

+ (td.seconds * 1000)

278

+ (td.microseconds // 1000))

313

runtime_expansions = ("approval_delay", "approval_duration",

314

"created", "enabled", "fingerprint",

315

"host", "interval", "last_checked_ok",

316

"last_enabled", "name", "timeout")

279

317

280

318

def timeout_milliseconds(self):

281

319

"Return the 'timeout' attribute in milliseconds"

282

return self._timedelta_to_milliseconds(self.timeout)

320

return _timedelta_to_milliseconds(self.timeout)

321

322

def extended_timeout_milliseconds(self):

323

"Return the 'extended_timeout' attribute in milliseconds"

324

return _timedelta_to_milliseconds(self.extended_timeout)

283

325

284

326

def interval_milliseconds(self):

285

327

"Return the 'interval' attribute in milliseconds"

286

return self._timedelta_to_milliseconds(self.interval)

287

328

return _timedelta_to_milliseconds(self.interval)

329

288

330

def approval_delay_milliseconds(self):

289

return self._timedelta_to_milliseconds(self.approval_delay)

331

return _timedelta_to_milliseconds(self.approval_delay)

290

332

291

333

def __init__(self, name = None, disable_hook=None, config=None):

292

334

"""Note: the 'checker' key in 'config' sets the

295

337

self.name = name

296

338

if config is None:

297

339

config = {}

298

logger.debug(u"Creating client %r", self.name)

340

logger.debug("Creating client %r", self.name)

299

341

# Uppercase and remove spaces from fingerprint for later

300

342

# comparison purposes with return value from the fingerprint()

301

343

# function

302

self.fingerprint = (config[u"fingerprint"].upper()

303

.replace(u" ", u""))

304

logger.debug(u" Fingerprint: %s", self.fingerprint)

305

if u"secret" in config:

306

self.secret = config[u"secret"].decode(u"base64")

307

elif u"secfile" in config:

344

self.fingerprint = (config["fingerprint"].upper()

345

.replace(" ", ""))

346

logger.debug(" Fingerprint: %s", self.fingerprint)

347

if "secret" in config:

348

self.secret = config["secret"].decode("base64")

349

elif "secfile" in config:

308

350

with open(os.path.expanduser(os.path.expandvars

309

(config[u"secfile"])),

351

(config["secfile"])),

310

352

"rb") as secfile:

311

353

self.secret = secfile.read()

312

354

else:

313

raise TypeError(u"No secret or secfile for client %s"

355

raise TypeError("No secret or secfile for client %s"

314

356

% self.name)

315

self.host = config.get(u"host", u"")

357

self.host = config.get("host", "")

316

358

self.created = datetime.datetime.utcnow()

317

359

self.enabled = False

360

self.last_approval_request = None

318

361

self.last_enabled = None

319

362

self.last_checked_ok = None

320

self.timeout = string_to_delta(config[u"timeout"])

321

self.interval = string_to_delta(config[u"interval"])

363

self.timeout = string_to_delta(config["timeout"])

364

self.extended_timeout = string_to_delta(config["extended_timeout"])

365

self.interval = string_to_delta(config["interval"])

322

366

self.disable_hook = disable_hook

323

367

self.checker = None

324

368

self.checker_initiator_tag = None

325

369

self.disable_initiator_tag = None

370

self.expires = None

326

371

self.checker_callback_tag = None

327

self.checker_command = config[u"checker"]

372

self.checker_command = config["checker"]

328

373

self.current_checker_command = None

329

374

self.last_connect = None

330

375

self._approved = None

331

self.approved_by_default = config.get(u"approved_by_default",

376

self.approved_by_default = config.get("approved_by_default",

332

377

True)

333

378

self.approvals_pending = 0

334

379

self.approval_delay = string_to_delta(

335

config[u"approval_delay"])

380

config["approval_delay"])

336

381

self.approval_duration = string_to_delta(

337

config[u"approval_duration"])

382

config["approval_duration"])

338

383

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

339

384

340

385

def send_changedstate(self):

344

389

345

390

def enable(self):

346

391

"""Start this client's checker and timeout hooks"""

347

if getattr(self, u"enabled", False):

392

if getattr(self, "enabled", False):

348

393

# Already enabled

349

394

return

350

395

self.send_changedstate()

351

self.last_enabled = datetime.datetime.utcnow()

352

396

# Schedule a new checker to be started an 'interval' from now,

353

397

# and every interval from then on.

354

398

self.checker_initiator_tag = (gobject.timeout_add

355

399

(self.interval_milliseconds(),

356

400

self.start_checker))

357

401

# Schedule a disable() when 'timeout' has passed

402

self.expires = datetime.datetime.utcnow() + self.timeout

358

403

self.disable_initiator_tag = (gobject.timeout_add

359

404

(self.timeout_milliseconds(),

360

405

self.disable))

361

406

self.enabled = True

407

self.last_enabled = datetime.datetime.utcnow()

362

408

# Also start a new checker *right now*.

363

409

self.start_checker()

364

410

369

415

if not quiet:

370

416

self.send_changedstate()

371

417

if not quiet:

372

logger.info(u"Disabling client %s", self.name)

373

if getattr(self, u"disable_initiator_tag", False):

418

logger.info("Disabling client %s", self.name)

419

if getattr(self, "disable_initiator_tag", False):

374

420

gobject.source_remove(self.disable_initiator_tag)

375

421

self.disable_initiator_tag = None

376

if getattr(self, u"checker_initiator_tag", False):

422

self.expires = None

423

if getattr(self, "checker_initiator_tag", False):

377

424

gobject.source_remove(self.checker_initiator_tag)

378

425

self.checker_initiator_tag = None

379

426

self.stop_checker()

394

441

if os.WIFEXITED(condition):

395

442

exitstatus = os.WEXITSTATUS(condition)

396

443

if exitstatus == 0:

397

logger.info(u"Checker for %(name)s succeeded",

444

logger.info("Checker for %(name)s succeeded",

398

445

vars(self))

399

446

self.checked_ok()

400

447

else:

401

logger.info(u"Checker for %(name)s failed",

448

logger.info("Checker for %(name)s failed",

402

449

vars(self))

403

450

else:

404

logger.warning(u"Checker for %(name)s crashed?",

451

logger.warning("Checker for %(name)s crashed?",

405

452

vars(self))

406

453

407

def checked_ok(self):

454

def checked_ok(self, timeout=None):

408

455

"""Bump up the timeout for this client.

409

456

410

457

This should only be called when the client has been seen,

411

458

alive and well.

412

459

"""

460

if timeout is None:

461

timeout = self.timeout

413

462

self.last_checked_ok = datetime.datetime.utcnow()

414

463

gobject.source_remove(self.disable_initiator_tag)

464

self.expires = datetime.datetime.utcnow() + timeout

415

465

self.disable_initiator_tag = (gobject.timeout_add

416

(self.timeout_milliseconds(),

466

(_timedelta_to_milliseconds(timeout),

417

467

self.disable))

418

468

469

def need_approval(self):

470

self.last_approval_request = datetime.datetime.utcnow()

471

419

472

def start_checker(self):

420

473

"""Start a new checker subprocess if one is not running.

421

474

433

486

# If a checker exists, make sure it is not a zombie

434

487

try:

435

488

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

436

except (AttributeError, OSError), error:

489

except (AttributeError, OSError) as error:

437

490

if (isinstance(error, OSError)

438

491

and error.errno != errno.ECHILD):

439

492

raise error

440

493

else:

441

494

if pid:

442

logger.warning(u"Checker was a zombie")

495

logger.warning("Checker was a zombie")

443

496

gobject.source_remove(self.checker_callback_tag)

444

497

self.checker_callback(pid, status,

445

498

self.current_checker_command)

450

503

command = self.checker_command % self.host

451

504

except TypeError:

452

505

# Escape attributes for the shell

453

escaped_attrs = dict((key,

454

re.escape(unicode(str(val),

455

errors=

456

u'replace')))

457

for key, val in

458

vars(self).iteritems())

506

escaped_attrs = dict(

507

(attr,

508

re.escape(unicode(str(getattr(self, attr, "")),

509

errors=

510

'replace')))

511

for attr in

512

self.runtime_expansions)

513

459

514

try:

460

515

command = self.checker_command % escaped_attrs

461

except TypeError, error:

462

logger.error(u'Could not format string "%s":'

463

u' %s', self.checker_command, error)

516

except TypeError as error:

517

logger.error('Could not format string "%s":'

518

' %s', self.checker_command, error)

464

519

return True # Try again later

465

520

self.current_checker_command = command

466

521

try:

467

logger.info(u"Starting checker %r for %s",

522

logger.info("Starting checker %r for %s",

468

523

command, self.name)

469

524

# We don't need to redirect stdout and stderr, since

470

525

# in normal mode, that is already done by daemon(),

472

527

# always replaced by /dev/null.)

473

528

self.checker = subprocess.Popen(command,

474

529

close_fds=True,

475

shell=True, cwd=u"/")

530

shell=True, cwd="/")

476

531

self.checker_callback_tag = (gobject.child_watch_add

477

532

(self.checker.pid,

478

533

self.checker_callback,

483

538

if pid:

484

539

gobject.source_remove(self.checker_callback_tag)

485

540

self.checker_callback(pid, status, command)

486

except OSError, error:

487

logger.error(u"Failed to start subprocess: %s",

541

except OSError as error:

542

logger.error("Failed to start subprocess: %s",

488

543

error)

489

544

# Re-run this periodically if run by gobject.timeout_add

490

545

return True

494

549

if self.checker_callback_tag:

495

550

gobject.source_remove(self.checker_callback_tag)

496

551

self.checker_callback_tag = None

497

if getattr(self, u"checker", None) is None:

552

if getattr(self, "checker", None) is None:

498

553

return

499

logger.debug(u"Stopping checker for %(name)s", vars(self))

554

logger.debug("Stopping checker for %(name)s", vars(self))

500

555

try:

501

556

os.kill(self.checker.pid, signal.SIGTERM)

502

557

#time.sleep(0.5)

503

558

#if self.checker.poll() is None:

504

559

# os.kill(self.checker.pid, signal.SIGKILL)

505

except OSError, error:

560

except OSError as error:

506

561

if error.errno != errno.ESRCH: # No such process

507

562

raise

508

563

self.checker = None

509

564

510

def dbus_service_property(dbus_interface, signature=u"v",

511

access=u"readwrite", byte_arrays=False):

565

566

def dbus_service_property(dbus_interface, signature="v",

567

access="readwrite", byte_arrays=False):

512

568

"""Decorators for marking methods of a DBusObjectWithProperties to

513

569

become properties on the D-Bus.

514

570

521

577

"""

522

578

# Encoding deeply encoded byte arrays is not supported yet by the

523

579

# "Set" method, so we fail early here:

524

if byte_arrays and signature != u"ay":

525

raise ValueError(u"Byte arrays not supported for non-'ay'"

526

u" signature %r" % signature)

580

if byte_arrays and signature != "ay":

581

raise ValueError("Byte arrays not supported for non-'ay'"

582

" signature %r" % signature)

527

583

def decorator(func):

528

584

func._dbus_is_property = True

529

585

func._dbus_interface = dbus_interface

530

586

func._dbus_signature = signature

531

587

func._dbus_access = access

532

588

func._dbus_name = func.__name__

533

if func._dbus_name.endswith(u"_dbus_property"):

589

if func._dbus_name.endswith("_dbus_property"):

534

590

func._dbus_name = func._dbus_name[:-14]

535

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

591

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

536

592

return func

537

593

return decorator

538

594

558

614

559

615

class DBusObjectWithProperties(dbus.service.Object):

560

616

"""A D-Bus object with properties.

561

617

562

618

Classes inheriting from this can use the dbus_service_property

563

619

decorator to expose methods as D-Bus properties. It exposes the

564

620

standard Get(), Set(), and GetAll() methods on the D-Bus.

566

622

567

623

@staticmethod

568

624

def _is_dbus_property(obj):

569

return getattr(obj, u"_dbus_is_property", False)

625

return getattr(obj, "_dbus_is_property", False)

570

626

571

627

def _get_all_dbus_properties(self):

572

628

"""Returns a generator of (name, attribute) pairs

573

629

"""

574

return ((prop._dbus_name, prop)

575

for name, prop in

576

inspect.getmembers(self, self._is_dbus_property))

630

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

631

for cls in self.__class__.__mro__

632

for name, prop in inspect.getmembers(cls, self._is_dbus_property))

577

633

578

634

def _get_dbus_property(self, interface_name, property_name):

579

635

"""Returns a bound method if one exists which is a D-Bus

580

636

property with the specified name and interface.

581

637

"""

582

for name in (property_name,

583

property_name + u"_dbus_property"):

584

prop = getattr(self, name, None)

585

if (prop is None

586

or not self._is_dbus_property(prop)

587

or prop._dbus_name != property_name

588

or (interface_name and prop._dbus_interface

589

and interface_name != prop._dbus_interface)):

590

continue

591

return prop

638

for cls in self.__class__.__mro__:

639

for name, value in inspect.getmembers(cls, self._is_dbus_property):

640

if value._dbus_name == property_name and value._dbus_interface == interface_name:

641

return value.__get__(self)

642

592

643

# No such property

593

raise DBusPropertyNotFound(self.dbus_object_path + u":"

594

+ interface_name + u"."

644

raise DBusPropertyNotFound(self.dbus_object_path + ":"

645

+ interface_name + "."

595

646

+ property_name)

596

647

597

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

598

out_signature=u"v")

648

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

649

out_signature="v")

599

650

def Get(self, interface_name, property_name):

600

651

"""Standard D-Bus property Get() method, see D-Bus standard.

601

652

"""

602

653

prop = self._get_dbus_property(interface_name, property_name)

603

if prop._dbus_access == u"write":

654

if prop._dbus_access == "write":

604

655

raise DBusPropertyAccessException(property_name)

605

656

value = prop()

606

if not hasattr(value, u"variant_level"):

657

if not hasattr(value, "variant_level"):

607

658

return value

608

659

return type(value)(value, variant_level=value.variant_level+1)

609

660

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

661

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

611

662

def Set(self, interface_name, property_name, value):

612

663

"""Standard D-Bus property Set() method, see D-Bus standard.

613

664

"""

614

665

prop = self._get_dbus_property(interface_name, property_name)

615

if prop._dbus_access == u"read":

666

if prop._dbus_access == "read":

616

667

raise DBusPropertyAccessException(property_name)

617

if prop._dbus_get_args_options[u"byte_arrays"]:

668

if prop._dbus_get_args_options["byte_arrays"]:

618

669

# The byte_arrays option is not supported yet on

619

670

# signatures other than "ay".

620

if prop._dbus_signature != u"ay":

671

if prop._dbus_signature != "ay":

621

672

raise ValueError

622

673

value = dbus.ByteArray(''.join(unichr(byte)

623

674

for byte in value))

624

675

prop(value)

625

676

626

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

627

out_signature=u"a{sv}")

677

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

678

out_signature="a{sv}")

628

679

def GetAll(self, interface_name):

629

680

"""Standard D-Bus property GetAll() method, see D-Bus

630

681

standard.

631

682

632

683

Note: Will not include properties with access="write".

633

684

"""

634

685

all = {}

638

689

# Interface non-empty but did not match

639

690

continue

640

691

# Ignore write-only properties

641

if prop._dbus_access == u"write":

692

if prop._dbus_access == "write":

642

693

continue

643

694

value = prop()

644

if not hasattr(value, u"variant_level"):

695

if not hasattr(value, "variant_level"):

645

696

all[name] = value

646

697

continue

647

698

all[name] = type(value)(value, variant_level=

648

699

value.variant_level+1)

649

return dbus.Dictionary(all, signature=u"sv")

700

return dbus.Dictionary(all, signature="sv")

650

701

651

702

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

652

out_signature=u"s",

703

out_signature="s",

653

704

path_keyword='object_path',

654

705

connection_keyword='connection')

655

706

def Introspect(self, object_path, connection):

660

711

try:

661

712

document = xml.dom.minidom.parseString(xmlstring)

662

713

def make_tag(document, name, prop):

663

e = document.createElement(u"property")

664

e.setAttribute(u"name", name)

665

e.setAttribute(u"type", prop._dbus_signature)

666

e.setAttribute(u"access", prop._dbus_access)

714

e = document.createElement("property")

715

e.setAttribute("name", name)

716

e.setAttribute("type", prop._dbus_signature)

717

e.setAttribute("access", prop._dbus_access)

667

718

return e

668

for if_tag in document.getElementsByTagName(u"interface"):

719

for if_tag in document.getElementsByTagName("interface"):

669

720

for tag in (make_tag(document, name, prop)

670

721

for name, prop

671

722

in self._get_all_dbus_properties()

672

723

if prop._dbus_interface

673

== if_tag.getAttribute(u"name")):

724

== if_tag.getAttribute("name")):

674

725

if_tag.appendChild(tag)

675

726

# Add the names to the return values for the

676

727

# "org.freedesktop.DBus.Properties" methods

677

if (if_tag.getAttribute(u"name")

678

== u"org.freedesktop.DBus.Properties"):

679

for cn in if_tag.getElementsByTagName(u"method"):

680

if cn.getAttribute(u"name") == u"Get":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"value")

685

elif cn.getAttribute(u"name") == u"GetAll":

686

for arg in cn.getElementsByTagName(u"arg"):

687

if (arg.getAttribute(u"direction")

688

== u"out"):

689

arg.setAttribute(u"name", u"props")

690

xmlstring = document.toxml(u"utf-8")

728

if (if_tag.getAttribute("name")

729

== "org.freedesktop.DBus.Properties"):

730

for cn in if_tag.getElementsByTagName("method"):

731

if cn.getAttribute("name") == "Get":

732

for arg in cn.getElementsByTagName("arg"):

733

if (arg.getAttribute("direction")

734

== "out"):

735

arg.setAttribute("name", "value")

736

elif cn.getAttribute("name") == "GetAll":

737

for arg in cn.getElementsByTagName("arg"):

738

if (arg.getAttribute("direction")

739

== "out"):

740

arg.setAttribute("name", "props")

741

xmlstring = document.toxml("utf-8")

691

742

document.unlink()

692

743

except (AttributeError, xml.dom.DOMException,

693

xml.parsers.expat.ExpatError), error:

694

logger.error(u"Failed to override Introspection method",

744

xml.parsers.expat.ExpatError) as error:

745

logger.error("Failed to override Introspection method",

695

746

error)

696

747

return xmlstring

697

748

698

749

750

def datetime_to_dbus (dt, variant_level=0):

751

"""Convert a UTC datetime.datetime() to a D-Bus type."""

752

if dt is None:

753

return dbus.String("", variant_level = variant_level)

754

return dbus.String(dt.isoformat(),

755

variant_level=variant_level)

756

757

class AlternateDBusNamesMetaclass(DBusObjectWithProperties.__metaclass__):

758

"""Applied to an empty subclass of a D-Bus object, this metaclass

759

will add additional D-Bus attributes matching a certain pattern.

760

"""

761

def __new__(mcs, name, bases, attr):

762

# Go through all the base classes which could have D-Bus

763

# methods, signals, or properties in them

764

for base in (b for b in bases

765

if issubclass(b, dbus.service.Object)):

766

# Go though all attributes of the base class

767

for attrname, attribute in inspect.getmembers(base):

768

# Ignore non-D-Bus attributes, and D-Bus attributes

769

# with the wrong interface name

770

if (not hasattr(attribute, "_dbus_interface")

771

or not attribute._dbus_interface

772

.startswith("se.recompile.Mandos")):

773

continue

774

# Create an alternate D-Bus interface name based on

775

# the current name

776

alt_interface = (attribute._dbus_interface

777

.replace("se.recompile.Mandos",

778

"se.bsnet.fukt.Mandos"))

779

# Is this a D-Bus signal?

780

if getattr(attribute, "_dbus_is_signal", False):

781

# Extract the original non-method function by

782

# black magic

783

nonmethod_func = (dict(

784

zip(attribute.func_code.co_freevars,

785

attribute.__closure__))["func"]

786

.cell_contents)

787

# Create a new, but exactly alike, function

788

# object, and decorate it to be a new D-Bus signal

789

# with the alternate D-Bus interface name

790

new_function = (dbus.service.signal

791

(alt_interface,

792

attribute._dbus_signature)

793

(types.FunctionType(

794

nonmethod_func.func_code,

795

nonmethod_func.func_globals,

796

nonmethod_func.func_name,

797

nonmethod_func.func_defaults,

798

nonmethod_func.func_closure)))

799

# Define a creator of a function to call both the

800

# old and new functions, so both the old and new

801

# signals gets sent when the function is called

802

def fixscope(func1, func2):

803

"""This function is a scope container to pass

804

func1 and func2 to the "call_both" function

805

outside of its arguments"""

806

def call_both(*args, **kwargs):

807

"""This function will emit two D-Bus

808

signals by calling func1 and func2"""

809

func1(*args, **kwargs)

810

func2(*args, **kwargs)

811

return call_both

812

# Create the "call_both" function and add it to

813

# the class

814

attr[attrname] = fixscope(attribute,

815

new_function)

816

# Is this a D-Bus method?

817

elif getattr(attribute, "_dbus_is_method", False):

818

# Create a new, but exactly alike, function

819

# object. Decorate it to be a new D-Bus method

820

# with the alternate D-Bus interface name. Add it

821

# to the class.

822

attr[attrname] = (dbus.service.method

823

(alt_interface,

824

attribute._dbus_in_signature,

825

attribute._dbus_out_signature)

826

(types.FunctionType

827

(attribute.func_code,

828

attribute.func_globals,

829

attribute.func_name,

830

attribute.func_defaults,

831

attribute.func_closure)))

832

# Is this a D-Bus property?

833

elif getattr(attribute, "_dbus_is_property", False):

834

# Create a new, but exactly alike, function

835

# object, and decorate it to be a new D-Bus

836

# property with the alternate D-Bus interface

837

# name. Add it to the class.

838

attr[attrname] = (dbus_service_property

839

(alt_interface,

840

attribute._dbus_signature,

841

attribute._dbus_access,

842

attribute

843

._dbus_get_args_options

844

["byte_arrays"])

845

(types.FunctionType

846

(attribute.func_code,

847

attribute.func_globals,

848

attribute.func_name,

849

attribute.func_defaults,

850

attribute.func_closure)))

851

return type.__new__(mcs, name, bases, attr)

852

699

853

class ClientDBus(Client, DBusObjectWithProperties):

700

854

"""A Client class using D-Bus

701

855

703

857

dbus_object_path: dbus.ObjectPath

704

858

bus: dbus.SystemBus()

705

859

"""

860

861

runtime_expansions = (Client.runtime_expansions

862

+ ("dbus_object_path",))

863

706

864

# dbus.service.Object doesn't use super(), so we can't either.

707

865

708

866

def __init__(self, bus = None, *args, **kwargs):

711

869

Client.__init__(self, *args, **kwargs)

712

870

# Only now, when this client is initialized, can it show up on

713

871

# the D-Bus

872

client_object_name = unicode(self.name).translate(

873

{ord("."): ord("_"),

874

ord("-"): ord("_")})

714

875

self.dbus_object_path = (dbus.ObjectPath

715

(u"/clients/"

716

+ self.name.replace(u".", u"_")))

876

("/clients/" + client_object_name))

717

877

DBusObjectWithProperties.__init__(self, self.bus,

718

878

self.dbus_object_path)

719

879

720

def _get_approvals_pending(self):

721

return self._approvals_pending

722

def _set_approvals_pending(self, value):

723

old_value = self._approvals_pending

724

self._approvals_pending = value

725

bval = bool(value)

726

if (hasattr(self, "dbus_object_path")

727

and bval is not bool(old_value)):

728

dbus_bool = dbus.Boolean(bval, variant_level=1)

729

self.PropertyChanged(dbus.String(u"ApprovalPending"),

730

dbus_bool)

880

def notifychangeproperty(transform_func,

881

dbus_name, type_func=lambda x: x,

882

variant_level=1):

883

""" Modify a variable so that it's a property which announces

884

its changes to DBus.

731

885

732

approvals_pending = property(_get_approvals_pending,

733

_set_approvals_pending)

734

del _get_approvals_pending, _set_approvals_pending

735

736

@staticmethod

737

def _datetime_to_dbus(dt, variant_level=0):

738

"""Convert a UTC datetime.datetime() to a D-Bus type."""

739

return dbus.String(dt.isoformat(),

740

variant_level=variant_level)

741

742

def enable(self):

743

oldstate = getattr(self, u"enabled", False)

744

r = Client.enable(self)

745

if oldstate != self.enabled:

746

# Emit D-Bus signals

747

self.PropertyChanged(dbus.String(u"Enabled"),

748

dbus.Boolean(True, variant_level=1))

749

self.PropertyChanged(

750

dbus.String(u"LastEnabled"),

751

self._datetime_to_dbus(self.last_enabled,

752

variant_level=1))

753

return r

754

755

def disable(self, quiet = False):

756

oldstate = getattr(self, u"enabled", False)

757

r = Client.disable(self, quiet=quiet)

758

if not quiet and oldstate != self.enabled:

759

# Emit D-Bus signal

760

self.PropertyChanged(dbus.String(u"Enabled"),

761

dbus.Boolean(False, variant_level=1))

762

return r

886

transform_fun: Function that takes a value and transforms it

887

to a D-Bus type.

888

dbus_name: D-Bus name of the variable

889

type_func: Function that transform the value before sending it

890

to the D-Bus. Default: no transform

891

variant_level: D-Bus variant level. Default: 1

892

"""

893

real_value = [None,]

894

def setter(self, value):

895

old_value = real_value[0]

896

real_value[0] = value

897

if hasattr(self, "dbus_object_path"):

898

if type_func(old_value) != type_func(real_value[0]):

899

dbus_value = transform_func(type_func(real_value[0]),

900

variant_level)

901

self.PropertyChanged(dbus.String(dbus_name),

902

dbus_value)

903

904

return property(lambda self: real_value[0], setter)

905

906

907

expires = notifychangeproperty(datetime_to_dbus, "Expires")

908

approvals_pending = notifychangeproperty(dbus.Boolean,

909

"ApprovalPending",

910

type_func = bool)

911

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

912

last_enabled = notifychangeproperty(datetime_to_dbus,

913

"LastEnabled")

914

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

915

type_func = lambda checker: checker is not None)

916

last_checked_ok = notifychangeproperty(datetime_to_dbus,

917

"LastCheckedOK")

918

last_approval_request = notifychangeproperty(datetime_to_dbus,

919

"LastApprovalRequest")

920

approved_by_default = notifychangeproperty(dbus.Boolean,

921

"ApprovedByDefault")

922

approval_delay = notifychangeproperty(dbus.UInt16, "ApprovalDelay",

923

type_func = _timedelta_to_milliseconds)

924

approval_duration = notifychangeproperty(dbus.UInt16, "ApprovalDuration",

925

type_func = _timedelta_to_milliseconds)

926

host = notifychangeproperty(dbus.String, "Host")

927

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

928

type_func = _timedelta_to_milliseconds)

929

extended_timeout = notifychangeproperty(dbus.UInt16, "ExtendedTimeout",

930

type_func = _timedelta_to_milliseconds)

931

interval = notifychangeproperty(dbus.UInt16, "Interval",

932

type_func = _timedelta_to_milliseconds)

933

checker_command = notifychangeproperty(dbus.String, "Checker")

934

935

del notifychangeproperty

763

936

764

937

def __del__(self, *args, **kwargs):

765

938

try:

766

939

self.remove_from_connection()

767

940

except LookupError:

768

941

pass

769

if hasattr(DBusObjectWithProperties, u"__del__"):

942

if hasattr(DBusObjectWithProperties, "__del__"):

770

943

DBusObjectWithProperties.__del__(self, *args, **kwargs)

771

944

Client.__del__(self, *args, **kwargs)

772

945

774

947

*args, **kwargs):

775

948

self.checker_callback_tag = None

776

949

self.checker = None

777

# Emit D-Bus signal

778

self.PropertyChanged(dbus.String(u"CheckerRunning"),

779

dbus.Boolean(False, variant_level=1))

780

950

if os.WIFEXITED(condition):

781

951

exitstatus = os.WEXITSTATUS(condition)

782

952

# Emit D-Bus signal

792

962

return Client.checker_callback(self, pid, condition, command,

793

963

*args, **kwargs)

794

964

795

def checked_ok(self, *args, **kwargs):

796

r = Client.checked_ok(self, *args, **kwargs)

797

# Emit D-Bus signal

798

self.PropertyChanged(

799

dbus.String(u"LastCheckedOK"),

800

(self._datetime_to_dbus(self.last_checked_ok,

801

variant_level=1)))

802

return r

803

804

965

def start_checker(self, *args, **kwargs):

805

966

old_checker = self.checker

806

967

if self.checker is not None:

813

974

and old_checker_pid != self.checker.pid):

814

975

# Emit D-Bus signal

815

976

self.CheckerStarted(self.current_checker_command)

816

self.PropertyChanged(

817

dbus.String(u"CheckerRunning"),

818

dbus.Boolean(True, variant_level=1))

819

977

return r

820

978

821

def stop_checker(self, *args, **kwargs):

822

old_checker = getattr(self, u"checker", None)

823

r = Client.stop_checker(self, *args, **kwargs)

824

if (old_checker is not None

825

and getattr(self, u"checker", None) is None):

826

self.PropertyChanged(dbus.String(u"CheckerRunning"),

827

dbus.Boolean(False, variant_level=1))

828

return r

829

830

979

def _reset_approved(self):

831

980

self._approved = None

832

981

return False

834

983

def approve(self, value=True):

835

984

self.send_changedstate()

836

985

self._approved = value

837

gobject.timeout_add(self._timedelta_to_milliseconds

986

gobject.timeout_add(_timedelta_to_milliseconds

838

987

(self.approval_duration),

839

988

self._reset_approved)

840

989

841

990

842

991

## D-Bus methods, signals & properties

843

_interface = u"se.bsnet.fukt.Mandos.Client"

992

_interface = "se.recompile.Mandos.Client"

844

993

845

994

## Signals

846

995

847

996

# CheckerCompleted - signal

848

@dbus.service.signal(_interface, signature=u"nxs")

997

@dbus.service.signal(_interface, signature="nxs")

849

998

def CheckerCompleted(self, exitcode, waitstatus, command):

850

999

"D-Bus signal"

851

1000

pass

852

1001

853

1002

# CheckerStarted - signal

854

@dbus.service.signal(_interface, signature=u"s")

1003

@dbus.service.signal(_interface, signature="s")

855

1004

def CheckerStarted(self, command):

856

1005

"D-Bus signal"

857

1006

pass

858

1007

859

1008

# PropertyChanged - signal

860

@dbus.service.signal(_interface, signature=u"sv")

1009

@dbus.service.signal(_interface, signature="sv")

861

1010

def PropertyChanged(self, property, value):

862

1011

"D-Bus signal"

863

1012

pass

872

1021

pass

873

1022

874

1023

# Rejected - signal

875

@dbus.service.signal(_interface, signature=u"s")

1024

@dbus.service.signal(_interface, signature="s")

876

1025

def Rejected(self, reason):

877

1026

"D-Bus signal"

878

1027

pass

879

1028

880

1029

# NeedApproval - signal

881

@dbus.service.signal(_interface, signature=u"tb")

1030

@dbus.service.signal(_interface, signature="tb")

882

1031

def NeedApproval(self, timeout, default):

883

1032

"D-Bus signal"

884

pass

1033

return self.need_approval()

885

1034

886

1035

## Methods

887

1036

888

1037

# Approve - method

889

@dbus.service.method(_interface, in_signature=u"b")

1038

@dbus.service.method(_interface, in_signature="b")

890

1039

def Approve(self, value):

891

1040

self.approve(value)

892

1041

893

1042

# CheckedOK - method

894

1043

@dbus.service.method(_interface)

895

1044

def CheckedOK(self):

896

return self.checked_ok()

1045

self.checked_ok()

897

1046

898

1047

# Enable - method

899

1048

@dbus.service.method(_interface)

921

1070

## Properties

922

1071

923

1072

# ApprovalPending - property

924

@dbus_service_property(_interface, signature=u"b", access=u"read")

1073

@dbus_service_property(_interface, signature="b", access="read")

925

1074

def ApprovalPending_dbus_property(self):

926

1075

return dbus.Boolean(bool(self.approvals_pending))

927

1076

928

1077

# ApprovedByDefault - property

929

@dbus_service_property(_interface, signature=u"b",

930

access=u"readwrite")

1078

@dbus_service_property(_interface, signature="b",

1079

access="readwrite")

931

1080

def ApprovedByDefault_dbus_property(self, value=None):

932

1081

if value is None: # get

933

1082

return dbus.Boolean(self.approved_by_default)

934

1083

self.approved_by_default = bool(value)

935

# Emit D-Bus signal

936

self.PropertyChanged(dbus.String(u"ApprovedByDefault"),

937

dbus.Boolean(value, variant_level=1))

938

1084

939

1085

# ApprovalDelay - property

940

@dbus_service_property(_interface, signature=u"t",

941

access=u"readwrite")

1086

@dbus_service_property(_interface, signature="t",

1087

access="readwrite")

942

1088

def ApprovalDelay_dbus_property(self, value=None):

943

1089

if value is None: # get

944

1090

return dbus.UInt64(self.approval_delay_milliseconds())

945

1091

self.approval_delay = datetime.timedelta(0, 0, 0, value)

946

# Emit D-Bus signal

947

self.PropertyChanged(dbus.String(u"ApprovalDelay"),

948

dbus.UInt64(value, variant_level=1))

949

1092

950

1093

# ApprovalDuration - property

951

@dbus_service_property(_interface, signature=u"t",

952

access=u"readwrite")

1094

@dbus_service_property(_interface, signature="t",

1095

access="readwrite")

953

1096

def ApprovalDuration_dbus_property(self, value=None):

954

1097

if value is None: # get

955

return dbus.UInt64(self._timedelta_to_milliseconds(

1098

return dbus.UInt64(_timedelta_to_milliseconds(

956

1099

self.approval_duration))

957

1100

self.approval_duration = datetime.timedelta(0, 0, 0, value)

958

# Emit D-Bus signal

959

self.PropertyChanged(dbus.String(u"ApprovalDuration"),

960

dbus.UInt64(value, variant_level=1))

961

1101

962

1102

# Name - property

963

@dbus_service_property(_interface, signature=u"s", access=u"read")

1103

@dbus_service_property(_interface, signature="s", access="read")

964

1104

def Name_dbus_property(self):

965

1105

return dbus.String(self.name)

966

1106

967

1107

# Fingerprint - property

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

1108

@dbus_service_property(_interface, signature="s", access="read")

969

1109

def Fingerprint_dbus_property(self):

970

1110

return dbus.String(self.fingerprint)

971

1111

972

1112

# Host - property

973

@dbus_service_property(_interface, signature=u"s",

974

access=u"readwrite")

1113

@dbus_service_property(_interface, signature="s",

1114

access="readwrite")

975

1115

def Host_dbus_property(self, value=None):

976

1116

if value is None: # get

977

1117

return dbus.String(self.host)

978

1118

self.host = value

979

# Emit D-Bus signal

980

self.PropertyChanged(dbus.String(u"Host"),

981

dbus.String(value, variant_level=1))

982

1119

983

1120

# Created - property

984

@dbus_service_property(_interface, signature=u"s", access=u"read")

1121

@dbus_service_property(_interface, signature="s", access="read")

985

1122

def Created_dbus_property(self):

986

return dbus.String(self._datetime_to_dbus(self.created))

1123

return dbus.String(datetime_to_dbus(self.created))

987

1124

988

1125

# LastEnabled - property

989

@dbus_service_property(_interface, signature=u"s", access=u"read")

1126

@dbus_service_property(_interface, signature="s", access="read")

990

1127

def LastEnabled_dbus_property(self):

991

if self.last_enabled is None:

992

return dbus.String(u"")

993

return dbus.String(self._datetime_to_dbus(self.last_enabled))

1128

return datetime_to_dbus(self.last_enabled)

994

1129

995

1130

# Enabled - property

996

@dbus_service_property(_interface, signature=u"b",

997

access=u"readwrite")

1131

@dbus_service_property(_interface, signature="b",

1132

access="readwrite")

998

1133

def Enabled_dbus_property(self, value=None):

999

1134

if value is None: # get

1000

1135

return dbus.Boolean(self.enabled)

1004

1139

self.disable()

1005

1140

1006

1141

# LastCheckedOK - property

1007

@dbus_service_property(_interface, signature=u"s",

1008

access=u"readwrite")

1142

@dbus_service_property(_interface, signature="s",

1143

access="readwrite")

1009

1144

def LastCheckedOK_dbus_property(self, value=None):

1010

1145

if value is not None:

1011

1146

self.checked_ok()

1012

1147

return

1013

if self.last_checked_ok is None:

1014

return dbus.String(u"")

1015

return dbus.String(self._datetime_to_dbus(self

1016

.last_checked_ok))

1148

return datetime_to_dbus(self.last_checked_ok)

1149

1150

# Expires - property

1151

@dbus_service_property(_interface, signature="s", access="read")

1152

def Expires_dbus_property(self):

1153

return datetime_to_dbus(self.expires)

1154

1155

# LastApprovalRequest - property

1156

@dbus_service_property(_interface, signature="s", access="read")

1157

def LastApprovalRequest_dbus_property(self):

1158

return datetime_to_dbus(self.last_approval_request)

1017

1159

1018

1160

# Timeout - property

1019

@dbus_service_property(_interface, signature=u"t",

1020

access=u"readwrite")

1161

@dbus_service_property(_interface, signature="t",

1162

access="readwrite")

1021

1163

def Timeout_dbus_property(self, value=None):

1022

1164

if value is None: # get

1023

1165

return dbus.UInt64(self.timeout_milliseconds())

1024

1166

self.timeout = datetime.timedelta(0, 0, 0, value)

1025

# Emit D-Bus signal

1026

self.PropertyChanged(dbus.String(u"Timeout"),

1027

dbus.UInt64(value, variant_level=1))

1028

if getattr(self, u"disable_initiator_tag", None) is None:

1167

if getattr(self, "disable_initiator_tag", None) is None:

1029

1168

return

1030

1169

# Reschedule timeout

1031

1170

gobject.source_remove(self.disable_initiator_tag)

1032

1171

self.disable_initiator_tag = None

1172

self.expires = None

1033

1173

time_to_die = (self.

1034

1174

_timedelta_to_milliseconds((self

1035

1175

.last_checked_ok

1040

1180

# The timeout has passed

1041

1181

self.disable()

1042

1182

else:

1183

self.expires = (datetime.datetime.utcnow()

1184

+ datetime.timedelta(milliseconds = time_to_die))

1043

1185

self.disable_initiator_tag = (gobject.timeout_add

1044

1186

(time_to_die, self.disable))

1045

1187

1188

# ExtendedTimeout - property

1189

@dbus_service_property(_interface, signature="t",

1190

access="readwrite")

1191

def ExtendedTimeout_dbus_property(self, value=None):

1192

if value is None: # get

1193

return dbus.UInt64(self.extended_timeout_milliseconds())

1194

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1195

1046

1196

# Interval - property

1047

@dbus_service_property(_interface, signature=u"t",

1048

access=u"readwrite")

1197

@dbus_service_property(_interface, signature="t",

1198

access="readwrite")

1049

1199

def Interval_dbus_property(self, value=None):

1050

1200

if value is None: # get

1051

1201

return dbus.UInt64(self.interval_milliseconds())

1052

1202

self.interval = datetime.timedelta(0, 0, 0, value)

1053

# Emit D-Bus signal

1054

self.PropertyChanged(dbus.String(u"Interval"),

1055

dbus.UInt64(value, variant_level=1))

1056

if getattr(self, u"checker_initiator_tag", None) is None:

1203

if getattr(self, "checker_initiator_tag", None) is None:

1057

1204

return

1058

1205

# Reschedule checker run

1059

1206

gobject.source_remove(self.checker_initiator_tag)

1060

1207

self.checker_initiator_tag = (gobject.timeout_add

1061

1208

(value, self.start_checker))

1062

1209

self.start_checker() # Start one now, too

1063

1210

1064

1211

# Checker - property

1065

@dbus_service_property(_interface, signature=u"s",

1066

access=u"readwrite")

1212

@dbus_service_property(_interface, signature="s",

1213

access="readwrite")

1067

1214

def Checker_dbus_property(self, value=None):

1068

1215

if value is None: # get

1069

1216

return dbus.String(self.checker_command)

1070

1217

self.checker_command = value

1071

# Emit D-Bus signal

1072

self.PropertyChanged(dbus.String(u"Checker"),

1073

dbus.String(self.checker_command,

1074

variant_level=1))

1075

1218

1076

1219

# CheckerRunning - property

1077

@dbus_service_property(_interface, signature=u"b",

1078

access=u"readwrite")

1220

@dbus_service_property(_interface, signature="b",

1221

access="readwrite")

1079

1222

def CheckerRunning_dbus_property(self, value=None):

1080

1223

if value is None: # get

1081

1224

return dbus.Boolean(self.checker is not None)

1085

1228

self.stop_checker()

1086

1229

1087

1230

# ObjectPath - property

1088

@dbus_service_property(_interface, signature=u"o", access=u"read")

1231

@dbus_service_property(_interface, signature="o", access="read")

1089

1232

def ObjectPath_dbus_property(self):

1090

1233

return self.dbus_object_path # is already a dbus.ObjectPath

1091

1234

1092

1235

# Secret = property

1093

@dbus_service_property(_interface, signature=u"ay",

1094

access=u"write", byte_arrays=True)

1236

@dbus_service_property(_interface, signature="ay",

1237

access="write", byte_arrays=True)

1095

1238

def Secret_dbus_property(self, value):

1096

1239

self.secret = str(value)

1097

1240

1104

1247

self._pipe.send(('init', fpr, address))

1105

1248

if not self._pipe.recv():

1106

1249

raise KeyError()

1107

1250

1108

1251

def __getattribute__(self, name):

1109

1252

if(name == '_pipe'):

1110

1253

return super(ProxyClient, self).__getattribute__(name)

1117

1260

self._pipe.send(('funcall', name, args, kwargs))

1118

1261

return self._pipe.recv()[1]

1119

1262

return func

1120

1263

1121

1264

def __setattr__(self, name, value):

1122

1265

if(name == '_pipe'):

1123

1266

return super(ProxyClient, self).__setattr__(name, value)

1124

1267

self._pipe.send(('setattr', name, value))

1125

1268

1269

class ClientDBusTransitional(ClientDBus):

1270

__metaclass__ = AlternateDBusNamesMetaclass

1126

1271

1127

1272

class ClientHandler(socketserver.BaseRequestHandler, object):

1128

1273

"""A class to handle client connections.

1132

1277

1133

1278

def handle(self):

1134

1279

with contextlib.closing(self.server.child_pipe) as child_pipe:

1135

logger.info(u"TCP connection from: %s",

1280

logger.info("TCP connection from: %s",

1136

1281

unicode(self.client_address))

1137

logger.debug(u"Pipe FD: %d",

1282

logger.debug("Pipe FD: %d",

1138

1283

self.server.child_pipe.fileno())

1139

1284

1140

1285

session = (gnutls.connection

1141

1286

.ClientSession(self.request,

1142

1287

gnutls.connection

1143

1288

.X509Credentials()))

1144

1289

1145

1290

# Note: gnutls.connection.X509Credentials is really a

1146

1291

# generic GnuTLS certificate credentials object so long as

1147

1292

# no X.509 keys are added to it. Therefore, we can use it

1148

1293

# here despite using OpenPGP certificates.

1149

1150

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1151

# u"+AES-256-CBC", u"+SHA1",

1152

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1153

# u"+DHE-DSS"))

1294

1295

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1296

# "+AES-256-CBC", "+SHA1",

1297

# "+COMP-NULL", "+CTYPE-OPENPGP",

1298

# "+DHE-DSS"))

1154

1299

# Use a fallback default, since this MUST be set.

1155

1300

priority = self.server.gnutls_priority

1156

1301

if priority is None:

1157

priority = u"NORMAL"

1302

priority = "NORMAL"

1158

1303

(gnutls.library.functions

1159

1304

.gnutls_priority_set_direct(session._c_object,

1160

1305

priority, None))

1161

1306

1162

1307

# Start communication using the Mandos protocol

1163

1308

# Get protocol number

1164

1309

line = self.request.makefile().readline()

1165

logger.debug(u"Protocol version: %r", line)

1310

logger.debug("Protocol version: %r", line)

1166

1311

try:

1167

1312

if int(line.strip().split()[0]) > 1:

1168

1313

raise RuntimeError

1169

except (ValueError, IndexError, RuntimeError), error:

1170

logger.error(u"Unknown protocol version: %s", error)

1314

except (ValueError, IndexError, RuntimeError) as error:

1315

logger.error("Unknown protocol version: %s", error)

1171

1316

return

1172

1317

1173

1318

# Start GnuTLS connection

1174

1319

try:

1175

1320

session.handshake()

1176

except gnutls.errors.GNUTLSError, error:

1177

logger.warning(u"Handshake failed: %s", error)

1321

except gnutls.errors.GNUTLSError as error:

1322

logger.warning("Handshake failed: %s", error)

1178

1323

# Do not run session.bye() here: the session is not

1179

1324

# established. Just abandon the request.

1180

1325

return

1181

logger.debug(u"Handshake succeeded")

1182

1326

logger.debug("Handshake succeeded")

1327

1183

1328

approval_required = False

1184

1329

try:

1185

1330

try:

1186

1331

fpr = self.fingerprint(self.peer_certificate

1187

1332

(session))

1188

except (TypeError, gnutls.errors.GNUTLSError), error:

1189

logger.warning(u"Bad certificate: %s", error)

1333

except (TypeError,

1334

gnutls.errors.GNUTLSError) as error:

1335

logger.warning("Bad certificate: %s", error)

1190

1336

return

1191

logger.debug(u"Fingerprint: %s", fpr)

1192

1337

logger.debug("Fingerprint: %s", fpr)

1338

1193

1339

try:

1194

1340

client = ProxyClient(child_pipe, fpr,

1195

1341

self.client_address)

1203

1349

1204

1350

while True:

1205

1351

if not client.enabled:

1206

logger.warning(u"Client %s is disabled",

1352

logger.info("Client %s is disabled",

1207

1353

client.name)

1208

1354

if self.server.use_dbus:

1209

1355

# Emit D-Bus signal

1214

1360

#We are approved or approval is disabled

1215

1361

break

1216

1362

elif client._approved is None:

1217

logger.info(u"Client %s needs approval",

1363

logger.info("Client %s needs approval",

1218

1364

client.name)

1219

1365

if self.server.use_dbus:

1220

1366

# Emit D-Bus signal

1222

1368

client.approval_delay_milliseconds(),

1223

1369

client.approved_by_default)

1224

1370

else:

1225

logger.warning(u"Client %s was not approved",

1371

logger.warning("Client %s was not approved",

1226

1372

client.name)

1227

1373

if self.server.use_dbus:

1228

1374

# Emit D-Bus signal

1254

1400

while sent_size < len(client.secret):

1255

1401

try:

1256

1402

sent = session.send(client.secret[sent_size:])

1257

except (gnutls.errors.GNUTLSError), error:

1403

except gnutls.errors.GNUTLSError as error:

1258

1404

logger.warning("gnutls send failed")

1259

1405

return

1260

logger.debug(u"Sent: %d, remaining: %d",

1406

logger.debug("Sent: %d, remaining: %d",

1261

1407

sent, len(client.secret)

1262

1408

- (sent_size + sent))

1263

1409

sent_size += sent

1264

1265

logger.info(u"Sending secret to %s", client.name)

1410

1411

logger.info("Sending secret to %s", client.name)

1266

1412

# bump the timeout as if seen

1267

client.checked_ok()

1413

client.checked_ok(client.extended_timeout)

1268

1414

if self.server.use_dbus:

1269

1415

# Emit D-Bus signal

1270

1416

client.GotSecret()

1274

1420

client.approvals_pending -= 1

1275

1421

try:

1276

1422

session.bye()

1277

except (gnutls.errors.GNUTLSError), error:

1423

except gnutls.errors.GNUTLSError as error:

1278

1424

logger.warning("GnuTLS bye failed")

1279

1425

1280

1426

@staticmethod

1291

1437

.gnutls_certificate_get_peers

1292

1438

(session._c_object, ctypes.byref(list_size)))

1293

1439

if not bool(cert_list) and list_size.value != 0:

1294

raise gnutls.errors.GNUTLSError(u"error getting peer"

1295

u" certificate")

1440

raise gnutls.errors.GNUTLSError("error getting peer"

1441

" certificate")

1296

1442

if list_size.value == 0:

1297

1443

return None

1298

1444

cert = cert_list[0]

1324

1470

if crtverify.value != 0:

1325

1471

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1326

1472

raise (gnutls.errors.CertificateSecurityError

1327

(u"Verify failed"))

1473

("Verify failed"))

1328

1474

# New buffer for the fingerprint

1329

1475

buf = ctypes.create_string_buffer(20)

1330

1476

buf_len = ctypes.c_size_t()

1337

1483

# Convert the buffer to a Python bytestring

1338

1484

fpr = ctypes.string_at(buf, buf_len.value)

1339

1485

# Convert the bytestring to hexadecimal notation

1340

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1486

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1341

1487

return hex_fpr

1342

1488

1343

1489

1355

1501

multiprocessing.Process(target = self.sub_process_main,

1356

1502

args = (request, address)).start()

1357

1503

1504

1358

1505

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1359

1506

""" adds a pipe to the MixIn """

1360

1507

def process_request(self, request, client_address):

1363

1510

This function creates a new pipe in self.pipe

1364

1511

"""

1365

1512

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1366

1513

1367

1514

super(MultiprocessingMixInWithPipe,

1368

1515

self).process_request(request, client_address)

1369

1516

self.child_pipe.close()

1370

1517

self.add_pipe(parent_pipe)

1371

1518

1372

1519

def add_pipe(self, parent_pipe):

1373

1520

"""Dummy function; override as necessary"""

1374

pass

1521

raise NotImplementedError

1522

1375

1523

1376

1524

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1377

1525

socketserver.TCPServer, object):

1395

1543

bind to an address or port if they were not specified."""

1396

1544

if self.interface is not None:

1397

1545

if SO_BINDTODEVICE is None:

1398

logger.error(u"SO_BINDTODEVICE does not exist;"

1399

u" cannot bind to interface %s",

1546

logger.error("SO_BINDTODEVICE does not exist;"

1547

" cannot bind to interface %s",

1400

1548

self.interface)

1401

1549

else:

1402

1550

try:

1403

1551

self.socket.setsockopt(socket.SOL_SOCKET,

1404

1552

SO_BINDTODEVICE,

1405

1553

str(self.interface

1406

+ u'\0'))

1407

except socket.error, error:

1554

+ '\0'))

1555

except socket.error as error:

1408

1556

if error[0] == errno.EPERM:

1409

logger.error(u"No permission to"

1410

u" bind to interface %s",

1557

logger.error("No permission to"

1558

" bind to interface %s",

1411

1559

self.interface)

1412

1560

elif error[0] == errno.ENOPROTOOPT:

1413

logger.error(u"SO_BINDTODEVICE not available;"

1414

u" cannot bind to interface %s",

1561

logger.error("SO_BINDTODEVICE not available;"

1562

" cannot bind to interface %s",

1415

1563

self.interface)

1416

1564

else:

1417

1565

raise

1419

1567

if self.server_address[0] or self.server_address[1]:

1420

1568

if not self.server_address[0]:

1421

1569

if self.address_family == socket.AF_INET6:

1422

any_address = u"::" # in6addr_any

1570

any_address = "::" # in6addr_any

1423

1571

else:

1424

1572

any_address = socket.INADDR_ANY

1425

1573

self.server_address = (any_address,

1474

1622

def handle_ipc(self, source, condition, parent_pipe=None,

1475

1623

client_object=None):

1476

1624

condition_names = {

1477

gobject.IO_IN: u"IN", # There is data to read.

1478

gobject.IO_OUT: u"OUT", # Data can be written (without

1625

gobject.IO_IN: "IN", # There is data to read.

1626

gobject.IO_OUT: "OUT", # Data can be written (without

1479

1627

# blocking).

1480

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1481

gobject.IO_ERR: u"ERR", # Error condition.

1482

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1628

gobject.IO_PRI: "PRI", # There is urgent data to read.

1629

gobject.IO_ERR: "ERR", # Error condition.

1630

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1483

1631

# broken, usually for pipes and

1484

1632

# sockets).

1485

1633

}

1504

1652

client = c

1505

1653

break

1506

1654

else:

1507

logger.warning(u"Client not found for fingerprint: %s, ad"

1508

u"dress: %s", fpr, address)

1655

logger.info("Client not found for fingerprint: %s, ad"

1656

"dress: %s", fpr, address)

1509

1657

if self.use_dbus:

1510

1658

# Emit D-Bus signal

1511

mandos_dbus_service.ClientNotFound(fpr, address)

1659

mandos_dbus_service.ClientNotFound(fpr, address[0])

1512

1660

parent_pipe.send(False)

1513

1661

return False

1514

1662

1526

1674

kwargs = request[3]

1527

1675

1528

1676

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1529

1677

1530

1678

if command == 'getattr':

1531

1679

attrname = request[1]

1532

1680

if callable(client_object.__getattribute__(attrname)):

1538

1686

attrname = request[1]

1539

1687

value = request[2]

1540

1688

setattr(client_object, attrname, value)

1541

1689

1542

1690

return True

1543

1691

1544

1692

1545

1693

def string_to_delta(interval):

1546

1694

"""Parse a string and return a datetime.timedelta

1547

1695

1548

>>> string_to_delta(u'7d')

1696

>>> string_to_delta('7d')

1549

1697

datetime.timedelta(7)

1550

>>> string_to_delta(u'60s')

1698

>>> string_to_delta('60s')

1551

1699

datetime.timedelta(0, 60)

1552

>>> string_to_delta(u'60m')

1700

>>> string_to_delta('60m')

1553

1701

datetime.timedelta(0, 3600)

1554

>>> string_to_delta(u'24h')

1702

>>> string_to_delta('24h')

1555

1703

datetime.timedelta(1)

1556

>>> string_to_delta(u'1w')

1704

>>> string_to_delta('1w')

1557

1705

datetime.timedelta(7)

1558

>>> string_to_delta(u'5m 30s')

1706

>>> string_to_delta('5m 30s')

1559

1707

datetime.timedelta(0, 330)

1560

1708

"""

1561

1709

timevalue = datetime.timedelta(0)

1563

1711

try:

1564

1712

suffix = unicode(s[-1])

1565

1713

value = int(s[:-1])

1566

if suffix == u"d":

1714

if suffix == "d":

1567

1715

delta = datetime.timedelta(value)

1568

elif suffix == u"s":

1716

elif suffix == "s":

1569

1717

delta = datetime.timedelta(0, value)

1570

elif suffix == u"m":

1718

elif suffix == "m":

1571

1719

delta = datetime.timedelta(0, 0, 0, 0, value)

1572

elif suffix == u"h":

1720

elif suffix == "h":

1573

1721

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1574

elif suffix == u"w":

1722

elif suffix == "w":

1575

1723

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1576

1724

else:

1577

raise ValueError(u"Unknown suffix %r" % suffix)

1578

except (ValueError, IndexError), e:

1579

raise ValueError(e.message)

1725

raise ValueError("Unknown suffix %r" % suffix)

1726

except (ValueError, IndexError) as e:

1727

raise ValueError(*(e.args))

1580

1728

timevalue += delta

1581

1729

return timevalue

1582

1730

1588

1736

global if_nametoindex

1589

1737

try:

1590

1738

if_nametoindex = (ctypes.cdll.LoadLibrary

1591

(ctypes.util.find_library(u"c"))

1739

(ctypes.util.find_library("c"))

1592

1740

.if_nametoindex)

1593

1741

except (OSError, AttributeError):

1594

logger.warning(u"Doing if_nametoindex the hard way")

1742

logger.warning("Doing if_nametoindex the hard way")

1595

1743

def if_nametoindex(interface):

1596

1744

"Get an interface index the hard way, i.e. using fcntl()"

1597

1745

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1598

1746

with contextlib.closing(socket.socket()) as s:

1599

1747

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1600

struct.pack(str(u"16s16x"),

1748

struct.pack(str("16s16x"),

1601

1749

interface))

1602

interface_index = struct.unpack(str(u"I"),

1750

interface_index = struct.unpack(str("I"),

1603

1751

ifreq[16:20])[0]

1604

1752

return interface_index

1605

1753

return if_nametoindex(interface)

1613

1761

sys.exit()

1614

1762

os.setsid()

1615

1763

if not nochdir:

1616

os.chdir(u"/")

1764

os.chdir("/")

1617

1765

if os.fork():

1618

1766

sys.exit()

1619

1767

if not noclose:

1621

1769

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1622

1770

if not stat.S_ISCHR(os.fstat(null).st_mode):

1623

1771

raise OSError(errno.ENODEV,

1624

u"%s not a character device"

1772

"%s not a character device"

1625

1773

% os.path.devnull)

1626

1774

os.dup2(null, sys.stdin.fileno())

1627

1775

os.dup2(null, sys.stdout.fileno())

1635

1783

##################################################################

1636

1784

# Parsing of options, both command line and config file

1637

1785

1638

parser = optparse.OptionParser(version = "%%prog %s" % version)

1639

parser.add_option("-i", u"--interface", type=u"string",

1640

metavar="IF", help=u"Bind to interface IF")

1641

parser.add_option("-a", u"--address", type=u"string",

1642

help=u"Address to listen for requests on")

1643

parser.add_option("-p", u"--port", type=u"int",

1644

help=u"Port number to receive requests on")

1645

parser.add_option("--check", action=u"store_true",

1646

help=u"Run self-test")

1647

parser.add_option("--debug", action=u"store_true",

1648

help=u"Debug mode; run in foreground and log to"

1649

u" terminal")

1650

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1651

help=u"Debug level for stdout output")

1652

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1653

u" priority string (see GnuTLS documentation)")

1654

parser.add_option("--servicename", type=u"string",

1655

metavar=u"NAME", help=u"Zeroconf service name")

1656

parser.add_option("--configdir", type=u"string",

1657

default=u"/etc/mandos", metavar=u"DIR",

1658

help=u"Directory to search for configuration"

1659

u" files")

1660

parser.add_option("--no-dbus", action=u"store_false",

1661

dest=u"use_dbus", help=u"Do not provide D-Bus"

1662

u" system bus interface")

1663

parser.add_option("--no-ipv6", action=u"store_false",

1664

dest=u"use_ipv6", help=u"Do not use IPv6")

1665

options = parser.parse_args()[0]

1786

parser = argparse.ArgumentParser()

1787

parser.add_argument("-v", "--version", action="version",

1788

version = "%%(prog)s %s" % version,

1789

help="show version number and exit")

1790

parser.add_argument("-i", "--interface", metavar="IF",

1791

help="Bind to interface IF")

1792

parser.add_argument("-a", "--address",

1793

help="Address to listen for requests on")

1794

parser.add_argument("-p", "--port", type=int,

1795

help="Port number to receive requests on")

1796

parser.add_argument("--check", action="store_true",

1797

help="Run self-test")

1798

parser.add_argument("--debug", action="store_true",

1799

help="Debug mode; run in foreground and log"

1800

" to terminal")

1801

parser.add_argument("--debuglevel", metavar="LEVEL",

1802

help="Debug level for stdout output")

1803

parser.add_argument("--priority", help="GnuTLS"

1804

" priority string (see GnuTLS documentation)")

1805

parser.add_argument("--servicename",

1806

metavar="NAME", help="Zeroconf service name")

1807

parser.add_argument("--configdir",

1808

default="/etc/mandos", metavar="DIR",

1809

help="Directory to search for configuration"

1810

" files")

1811

parser.add_argument("--no-dbus", action="store_false",

1812

dest="use_dbus", help="Do not provide D-Bus"

1813

" system bus interface")

1814

parser.add_argument("--no-ipv6", action="store_false",

1815

dest="use_ipv6", help="Do not use IPv6")

1816

options = parser.parse_args()

1666

1817

1667

1818

if options.check:

1668

1819

import doctest

1670

1821

sys.exit()

1671

1822

1672

1823

# Default values for config file for server-global settings

1673

server_defaults = { u"interface": u"",

1674

u"address": u"",

1675

u"port": u"",

1676

u"debug": u"False",

1677

u"priority":

1678

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1679

u"servicename": u"Mandos",

1680

u"use_dbus": u"True",

1681

u"use_ipv6": u"True",

1682

u"debuglevel": u"",

1824

server_defaults = { "interface": "",

1825

"address": "",

1826

"port": "",

1827

"debug": "False",

1828

"priority":

1829

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1830

"servicename": "Mandos",

1831

"use_dbus": "True",

1832

"use_ipv6": "True",

1833

"debuglevel": "",

1683

1834

}

1684

1835

1685

1836

# Parse config file for server-global settings

1686

1837

server_config = configparser.SafeConfigParser(server_defaults)

1687

1838

del server_defaults

1688

1839

server_config.read(os.path.join(options.configdir,

1689

u"mandos.conf"))

1840

"mandos.conf"))

1690

1841

# Convert the SafeConfigParser object to a dict

1691

1842

server_settings = server_config.defaults()

1692

1843

# Use the appropriate methods on the non-string config options

1693

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1694

server_settings[option] = server_config.getboolean(u"DEFAULT",

1844

for option in ("debug", "use_dbus", "use_ipv6"):

1845

server_settings[option] = server_config.getboolean("DEFAULT",

1695

1846

option)

1696

1847

if server_settings["port"]:

1697

server_settings["port"] = server_config.getint(u"DEFAULT",

1698

u"port")

1848

server_settings["port"] = server_config.getint("DEFAULT",

1849

"port")

1699

1850

del server_config

1700

1851

1701

1852

# Override the settings from the config file with command line

1702

1853

# options, if set.

1703

for option in (u"interface", u"address", u"port", u"debug",

1704

u"priority", u"servicename", u"configdir",

1705

u"use_dbus", u"use_ipv6", u"debuglevel"):

1854

for option in ("interface", "address", "port", "debug",

1855

"priority", "servicename", "configdir",

1856

"use_dbus", "use_ipv6", "debuglevel"):

1706

1857

value = getattr(options, option)

1707

1858

if value is not None:

1708

1859

server_settings[option] = value

1716

1867

##################################################################

1717

1868

1718

1869

# For convenience

1719

debug = server_settings[u"debug"]

1720

debuglevel = server_settings[u"debuglevel"]

1721

use_dbus = server_settings[u"use_dbus"]

1722

use_ipv6 = server_settings[u"use_ipv6"]

1723

1724

if server_settings[u"servicename"] != u"Mandos":

1870

debug = server_settings["debug"]

1871

debuglevel = server_settings["debuglevel"]

1872

use_dbus = server_settings["use_dbus"]

1873

use_ipv6 = server_settings["use_ipv6"]

1874

1875

if server_settings["servicename"] != "Mandos":

1725

1876

syslogger.setFormatter(logging.Formatter

1726

(u'Mandos (%s) [%%(process)d]:'

1727

u' %%(levelname)s: %%(message)s'

1728

% server_settings[u"servicename"]))

1877

('Mandos (%s) [%%(process)d]:'

1878

' %%(levelname)s: %%(message)s'

1879

% server_settings["servicename"]))

1729

1880

1730

1881

# Parse config file with clients

1731

client_defaults = { u"timeout": u"1h",

1732

u"interval": u"5m",

1733

u"checker": u"fping -q -- %%(host)s",

1734

u"host": u"",

1735

u"approval_delay": u"0s",

1736

u"approval_duration": u"1s",

1882

client_defaults = { "timeout": "5m",

1883

"extended_timeout": "15m",

1884

"interval": "2m",

1885

"checker": "fping -q -- %%(host)s",

1886

"host": "",

1887

"approval_delay": "0s",

1888

"approval_duration": "1s",

1737

1889

}

1738

1890

client_config = configparser.SafeConfigParser(client_defaults)

1739

client_config.read(os.path.join(server_settings[u"configdir"],

1740

u"clients.conf"))

1891

client_config.read(os.path.join(server_settings["configdir"],

1892

"clients.conf"))

1741

1893

1742

1894

global mandos_dbus_service

1743

1895

mandos_dbus_service = None

1744

1896

1745

tcp_server = MandosServer((server_settings[u"address"],

1746

server_settings[u"port"]),

1897

tcp_server = MandosServer((server_settings["address"],

1898

server_settings["port"]),

1747

1899

ClientHandler,

1748

interface=(server_settings[u"interface"]

1900

interface=(server_settings["interface"]

1749

1901

or None),

1750

1902

use_ipv6=use_ipv6,

1751

1903

gnutls_priority=

1752

server_settings[u"priority"],

1904

server_settings["priority"],

1753

1905

use_dbus=use_dbus)

1754

pidfilename = u"/var/run/mandos.pid"

1755

try:

1756

pidfile = open(pidfilename, u"w")

1757

except IOError:

1758

logger.error(u"Could not open file %r", pidfilename)

1906

if not debug:

1907

pidfilename = "/var/run/mandos.pid"

1908

try:

1909

pidfile = open(pidfilename, "w")

1910

except IOError:

1911

logger.error("Could not open file %r", pidfilename)

1759

1912

1760

1913

try:

1761

uid = pwd.getpwnam(u"_mandos").pw_uid

1762

gid = pwd.getpwnam(u"_mandos").pw_gid

1914

uid = pwd.getpwnam("_mandos").pw_uid

1915

gid = pwd.getpwnam("_mandos").pw_gid

1763

1916

except KeyError:

1764

1917

try:

1765

uid = pwd.getpwnam(u"mandos").pw_uid

1766

gid = pwd.getpwnam(u"mandos").pw_gid

1918

uid = pwd.getpwnam("mandos").pw_uid

1919

gid = pwd.getpwnam("mandos").pw_gid

1767

1920

except KeyError:

1768

1921

try:

1769

uid = pwd.getpwnam(u"nobody").pw_uid

1770

gid = pwd.getpwnam(u"nobody").pw_gid

1922

uid = pwd.getpwnam("nobody").pw_uid

1923

gid = pwd.getpwnam("nobody").pw_gid

1771

1924

except KeyError:

1772

1925

uid = 65534

1773

1926

gid = 65534

1774

1927

try:

1775

1928

os.setgid(gid)

1776

1929

os.setuid(uid)

1777

except OSError, error:

1930

except OSError as error:

1778

1931

if error[0] != errno.EPERM:

1779

1932

raise error

1780

1933

1785

1938

level = getattr(logging, debuglevel.upper())

1786

1939

syslogger.setLevel(level)

1787

1940

console.setLevel(level)

1788

1941

1789

1942

if debug:

1790

1943

# Enable all possible GnuTLS debugging

1791

1944

1795

1948

1796

1949

@gnutls.library.types.gnutls_log_func

1797

1950

def debug_gnutls(level, string):

1798

logger.debug(u"GnuTLS: %s", string[:-1])

1951

logger.debug("GnuTLS: %s", string[:-1])

1799

1952

1800

1953

(gnutls.library.functions

1801

1954

.gnutls_global_set_log_function(debug_gnutls))

1809

1962

# No console logging

1810

1963

logger.removeHandler(console)

1811

1964

1965

# Need to fork before connecting to D-Bus

1966

if not debug:

1967

# Close all input and output, do double fork, etc.

1968

daemon()

1812

1969

1813

1970

global main_loop

1814

1971

# From the Avahi example code

1818

1975

# End of Avahi example code

1819

1976

if use_dbus:

1820

1977

try:

1821

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

1978

bus_name = dbus.service.BusName("se.recompile.Mandos",

1822

1979

bus, do_not_queue=True)

1823

except dbus.exceptions.NameExistsException, e:

1824

logger.error(unicode(e) + u", disabling D-Bus")

1980

old_bus_name = dbus.service.BusName("se.bsnet.fukt.Mandos",

1981

bus, do_not_queue=True)

1982

except dbus.exceptions.NameExistsException as e:

1983

logger.error(unicode(e) + ", disabling D-Bus")

1825

1984

use_dbus = False

1826

server_settings[u"use_dbus"] = False

1985

server_settings["use_dbus"] = False

1827

1986

tcp_server.use_dbus = False

1828

1987

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1829

service = AvahiService(name = server_settings[u"servicename"],

1830

servicetype = u"_mandos._tcp",

1988

service = AvahiService(name = server_settings["servicename"],

1989

servicetype = "_mandos._tcp",

1831

1990

protocol = protocol, bus = bus)

1832

1991

if server_settings["interface"]:

1833

1992

service.interface = (if_nametoindex

1834

(str(server_settings[u"interface"])))

1835

1836

if not debug:

1837

# Close all input and output, do double fork, etc.

1838

daemon()

1839

1993

(str(server_settings["interface"])))

1994

1840

1995

global multiprocessing_manager

1841

1996

multiprocessing_manager = multiprocessing.Manager()

1842

1997

1843

1998

client_class = Client

1844

1999

if use_dbus:

1845

client_class = functools.partial(ClientDBus, bus = bus)

2000

client_class = functools.partial(ClientDBusTransitional, bus = bus)

1846

2001

def client_config_items(config, section):

1847

2002

special_settings = {

1848

2003

"approved_by_default":

1861

2016

client_config, section)))

1862

2017

for section in client_config.sections()))

1863

2018

if not tcp_server.clients:

1864

logger.warning(u"No clients defined")

2019

logger.warning("No clients defined")

1865

2020

1866

try:

1867

with pidfile:

1868

pid = os.getpid()

1869

pidfile.write(str(pid) + "\n")

1870

del pidfile

1871

except IOError:

1872

logger.error(u"Could not write to file %r with PID %d",

1873

pidfilename, pid)

1874

except NameError:

1875

# "pidfile" was never created

1876

pass

1877

del pidfilename

1878

1879

2021

if not debug:

2022

try:

2023

with pidfile:

2024

pid = os.getpid()

2025

pidfile.write(str(pid) + "\n".encode("utf-8"))

2026

del pidfile

2027

except IOError:

2028

logger.error("Could not write to file %r with PID %d",

2029

pidfilename, pid)

2030

except NameError:

2031

# "pidfile" was never created

2032

pass

2033

del pidfilename

2034

1880

2035

signal.signal(signal.SIGINT, signal.SIG_IGN)

2036

1881

2037

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1882

2038

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1883

2039

1885

2041

class MandosDBusService(dbus.service.Object):

1886

2042

"""A D-Bus proxy object"""

1887

2043

def __init__(self):

1888

dbus.service.Object.__init__(self, bus, u"/")

1889

_interface = u"se.bsnet.fukt.Mandos"

2044

dbus.service.Object.__init__(self, bus, "/")

2045

_interface = "se.recompile.Mandos"

1890

2046

1891

@dbus.service.signal(_interface, signature=u"o")

2047

@dbus.service.signal(_interface, signature="o")

1892

2048

def ClientAdded(self, objpath):

1893

2049

"D-Bus signal"

1894

2050

pass

1895

2051

1896

@dbus.service.signal(_interface, signature=u"ss")

2052

@dbus.service.signal(_interface, signature="ss")

1897

2053

def ClientNotFound(self, fingerprint, address):

1898

2054

"D-Bus signal"

1899

2055

pass

1900

2056

1901

@dbus.service.signal(_interface, signature=u"os")

2057

@dbus.service.signal(_interface, signature="os")

1902

2058

def ClientRemoved(self, objpath, name):

1903

2059

"D-Bus signal"

1904

2060

pass

1905

2061

1906

@dbus.service.method(_interface, out_signature=u"ao")

2062

@dbus.service.method(_interface, out_signature="ao")

1907

2063

def GetAllClients(self):

1908

2064

"D-Bus method"

1909

2065

return dbus.Array(c.dbus_object_path

1910

2066

for c in tcp_server.clients)

1911

2067

1912

2068

@dbus.service.method(_interface,

1913

out_signature=u"a{oa{sv}}")

2069

out_signature="a{oa{sv}}")

1914

2070

def GetAllClientsWithProperties(self):

1915

2071

"D-Bus method"

1916

2072

return dbus.Dictionary(

1917

((c.dbus_object_path, c.GetAll(u""))

2073

((c.dbus_object_path, c.GetAll(""))

1918

2074

for c in tcp_server.clients),

1919

signature=u"oa{sv}")

2075

signature="oa{sv}")

1920

2076

1921

@dbus.service.method(_interface, in_signature=u"o")

2077

@dbus.service.method(_interface, in_signature="o")

1922

2078

def RemoveClient(self, object_path):

1923

2079

"D-Bus method"

1924

2080

for c in tcp_server.clients:

1934

2090

1935

2091

del _interface

1936

2092

1937

mandos_dbus_service = MandosDBusService()

2093

class MandosDBusServiceTransitional(MandosDBusService):

2094

__metaclass__ = AlternateDBusNamesMetaclass

2095

mandos_dbus_service = MandosDBusServiceTransitional()

1938

2096

1939

2097

def cleanup():

1940

2098

"Cleanup function; run on exit"

1966

2124

# Find out what port we got

1967

2125

service.port = tcp_server.socket.getsockname()[1]

1968

2126

if use_ipv6:

1969

logger.info(u"Now listening on address %r, port %d,"

2127

logger.info("Now listening on address %r, port %d,"

1970

2128

" flowinfo %d, scope_id %d"

1971

2129

% tcp_server.socket.getsockname())

1972

2130

else: # IPv4

1973

logger.info(u"Now listening on address %r, port %d"

2131

logger.info("Now listening on address %r, port %d"

1974

2132

% tcp_server.socket.getsockname())

1975

2133

1976

2134

#service.interface = tcp_server.socket.getsockname()[3]

1979

2137

# From the Avahi example code

1980

2138

try:

1981

2139

service.activate()

1982

except dbus.exceptions.DBusException, error:

1983

logger.critical(u"DBusException: %s", error)

2140

except dbus.exceptions.DBusException as error:

2141

logger.critical("DBusException: %s", error)

1984

2142

cleanup()

1985

2143

sys.exit(1)

1986

2144

# End of Avahi example code

1990

2148

(tcp_server.handle_request

1991

2149

(*args[2:], **kwargs) or True))

1992

2150

1993

logger.debug(u"Starting main loop")

2151

logger.debug("Starting main loop")

1994

2152

main_loop.run()

1995

except AvahiError, error:

1996

logger.critical(u"AvahiError: %s", error)

2153

except AvahiError as error:

2154

logger.critical("AvahiError: %s", error)

1997

2155

cleanup()

1998

2156

sys.exit(1)

1999

2157

except KeyboardInterrupt:

2000

2158

if debug:

2001

print >> sys.stderr

2002

logger.debug(u"Server received KeyboardInterrupt")

2003

logger.debug(u"Server exiting")

2159

print("", file=sys.stderr)

2160

logger.debug("Server received KeyboardInterrupt")

2161

logger.debug("Server exiting")

2004

2162

# Must run before the D-Bus bus name gets deregistered

2005

2163

cleanup()

2006

2164

2165

2007

2166

if __name__ == '__main__':

2008

2167

main()