/mandos/trunk : revision 505.1.8

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

61

62

import functools

62

63

import cPickle as pickle

63

64

import multiprocessing

65

import types

64

66

65

67

import dbus

66

68

import dbus.service

81

83

SO_BINDTODEVICE = None

82

84

83

85

84

version = "1.0.14"

86

version = "1.3.1"

85

87

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

88

90

syslogger = (logging.handlers.SysLogHandler

89

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

90

address = "/dev/log"))

92

address = str("/dev/log")))

91

93

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

94

96

logger.addHandler(syslogger)

95

97

96

98

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

100

102

logger.addHandler(console)

101

103

102

104

class AvahiError(Exception):

119

121

Attributes:

120

122

interface: integer; avahi.IF_UNSPEC or an interface index.

121

123

Used to optionally bind to the specified interface.

122

123

type: string; Example: u'_mandos._tcp'.

124

125

type: string; Example: '_mandos._tcp'.

124

126

See <http://www.dns-sd.org/ServiceTypes.html>

125

127

port: integer; what port to announce

126

128

TXT: list of strings; TXT record for the service

135

137

"""

136

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

137

139

servicetype = None, port = None, TXT = None,

138

domain = u"", host = u"", max_renames = 32768,

140

domain = "", host = "", max_renames = 32768,

139

141

protocol = avahi.PROTO_UNSPEC, bus = None):

140

142

self.interface = interface

141

143

self.name = name

150

152

self.group = None # our entry group

151

153

self.server = None

152

154

self.bus = bus

155

self.entry_group_state_changed_match = None

153

156

def rename(self):

154

157

"""Derived from the Avahi example code"""

155

158

if self.rename_count >= self.max_renames:

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

158

161

self.rename_count)

159

raise AvahiServiceError(u"Too many renames")

160

self.name = unicode(self.server.GetAlternativeServiceName(self.name))

161

logger.info(u"Changing Zeroconf service name to %r ...",

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server

164

.GetAlternativeServiceName(self.name))

165

logger.info("Changing Zeroconf service name to %r ...",

162

166

self.name)

163

167

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

166

170

% self.name))

167

171

self.remove()

168

172

try:

169

173

self.add()

170

except dbus.exceptions.DBusException, error:

171

logger.critical(u"DBusException: %s", error)

174

except dbus.exceptions.DBusException as error:

175

logger.critical("DBusException: %s", error)

172

176

self.cleanup()

173

177

os._exit(1)

174

178

self.rename_count += 1

175

179

def remove(self):

176

180

"""Derived from the Avahi example code"""

181

if self.entry_group_state_changed_match is not None:

182

self.entry_group_state_changed_match.remove()

183

self.entry_group_state_changed_match = None

177

184

if self.group is not None:

178

185

self.group.Reset()

179

186

def add(self):

180

187

"""Derived from the Avahi example code"""

188

self.remove()

181

189

if self.group is None:

182

190

self.group = dbus.Interface(

183

191

self.bus.get_object(avahi.DBUS_NAME,

184

192

self.server.EntryGroupNew()),

185

193

avahi.DBUS_INTERFACE_ENTRY_GROUP)

186

self.group.connect_to_signal('StateChanged',

187

self

188

.entry_group_state_changed)

189

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

194

self.entry_group_state_changed_match = (

195

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

190

198

self.name, self.type)

191

199

self.group.AddService(

192

200

self.interface,

199

207

self.group.Commit()

200

208

def entry_group_state_changed(self, state, error):

201

209

"""Derived from the Avahi example code"""

202

logger.debug(u"Avahi entry group state change: %i", state)

210

logger.debug("Avahi entry group state change: %i", state)

203

211

204

212

if state == avahi.ENTRY_GROUP_ESTABLISHED:

205

logger.debug(u"Zeroconf service established.")

213

logger.debug("Zeroconf service established.")

206

214

elif state == avahi.ENTRY_GROUP_COLLISION:

207

logger.warning(u"Zeroconf service name collision.")

215

logger.info("Zeroconf service name collision.")

208

216

self.rename()

209

217

elif state == avahi.ENTRY_GROUP_FAILURE:

210

logger.critical(u"Avahi: Error in group state changed %s",

218

logger.critical("Avahi: Error in group state changed %s",

211

219

unicode(error))

212

raise AvahiGroupError(u"State changed: %s"

220

raise AvahiGroupError("State changed: %s"

213

221

% unicode(error))

214

222

def cleanup(self):

215

223

"""Derived from the Avahi example code"""

216

224

if self.group is not None:

217

self.group.Free()

225

try:

226

self.group.Free()

227

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

229

pass

218

230

self.group = None

219

def server_state_changed(self, state):

231

self.remove()

232

def server_state_changed(self, state, error=None):

220

233

"""Derived from the Avahi example code"""

221

logger.debug(u"Avahi server state change: %i", state)

222

if state == avahi.SERVER_COLLISION:

223

logger.error(u"Zeroconf server name collision")

224

self.remove()

234

logger.debug("Avahi server state change: %i", state)

235

bad_states = { avahi.SERVER_INVALID:

236

"Zeroconf server invalid",

237

avahi.SERVER_REGISTERING: None,

238

avahi.SERVER_COLLISION:

239

"Zeroconf server name collision",

240

avahi.SERVER_FAILURE:

241

"Zeroconf server failure" }

242

if state in bad_states:

243

if bad_states[state] is not None:

244

if error is None:

245

logger.error(bad_states[state])

246

else:

247

logger.error(bad_states[state] + ": %r", error)

248

self.cleanup()

225

249

elif state == avahi.SERVER_RUNNING:

226

250

self.add()

251

else:

252

if error is None:

253

logger.debug("Unknown state: %r", state)

254

else:

255

logger.debug("Unknown state: %r: %r", state, error)

227

256

def activate(self):

228

257

"""Derived from the Avahi example code"""

229

258

if self.server is None:

230

259

self.server = dbus.Interface(

231

260

self.bus.get_object(avahi.DBUS_NAME,

232

avahi.DBUS_PATH_SERVER),

261

avahi.DBUS_PATH_SERVER,

262

follow_name_owner_changes=True),

233

263

avahi.DBUS_INTERFACE_SERVER)

234

self.server.connect_to_signal(u"StateChanged",

264

self.server.connect_to_signal("StateChanged",

235

265

self.server_state_changed)

236

266

self.server_state_changed(self.server.GetState())

237

267

238

268

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

274

239

275

class Client(object):

240

276

"""A representation of a client host served by this server.

241

277

242

278

Attributes:

243

244

D-Bus identifiers

279

_approved: bool(); 'None' if not yet approved/disapproved

280

approval_delay: datetime.timedelta(); Time to wait for approval

281

approval_duration: datetime.timedelta(); Duration of one approval

282

checker: subprocess.Popen(); a running checker process used

283

to see if the client lives.

284

'None' if no process is running.

285

checker_callback_tag: a gobject event source tag, or None

286

checker_command: string; External command which is run to check

287

if client lives. %() expansions are done at

288

runtime with vars(self) as dict, so that for

289

instance %(name)s can be used in the command.

290

checker_initiator_tag: a gobject event source tag, or None

291

created: datetime.datetime(); (UTC) object creation

292

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

294

disable_initiator_tag: a gobject event source tag, or None

295

enabled: bool()

245

296

fingerprint: string (40 or 32 hexadecimal digits); used to

246

297

uniquely identify the client

247

secret: bytestring; sent verbatim (over TLS) to client

248

298

host: string; available for use by the checker command

249

created: datetime.datetime(); (UTC) object creation

299

interval: datetime.timedelta(); How often to start a new checker

300

last_approval_request: datetime.datetime(); (UTC) or None

301

last_checked_ok: datetime.datetime(); (UTC) or None

250

302

last_enabled: datetime.datetime(); (UTC)

251

enabled: bool()

252

last_checked_ok: datetime.datetime(); (UTC) or None

303

304

D-Bus identifiers

305

secret: bytestring; sent verbatim (over TLS) to client

253

306

timeout: datetime.timedelta(); How long from last_checked_ok

254

307

until this client is disabled

255

interval: datetime.timedelta(); How often to start a new checker

256

disable_hook: If set, called by disable() as disable_hook(self)

257

checker: subprocess.Popen(); a running checker process used

258

to see if the client lives.

259

'None' if no process is running.

260

checker_initiator_tag: a gobject event source tag, or None

261

disable_initiator_tag: - '' -

262

checker_callback_tag: - '' -

263

checker_command: string; External command which is run to check if

264

client lives. %() expansions are done at

265

runtime with vars(self) as dict, so that for

266

instance %(name)s can be used in the command.

267

current_checker_command: string; current running checker_command

268

approved_delay: datetime.timedelta(); Time to wait for approval

269

_approved: bool(); 'None' if not yet approved/disapproved

270

approved_duration: datetime.timedelta(); Duration of one approval

308

extended_timeout: extra long timeout when password has been sent

309

runtime_expansions: Allowed attributes for runtime expansion.

310

expires: datetime.datetime(); time (UTC) when a client will be

311

disabled, or None

271

312

"""

272

313

273

@staticmethod

274

def _timedelta_to_milliseconds(td):

275

"Convert a datetime.timedelta() to milliseconds"

276

return ((td.days * 24 * 60 * 60 * 1000)

277

+ (td.seconds * 1000)

278

+ (td.microseconds // 1000))

314

runtime_expansions = ("approval_delay", "approval_duration",

315

"created", "enabled", "fingerprint",

316

"host", "interval", "last_checked_ok",

317

"last_enabled", "name", "timeout")

279

318

280

319

def timeout_milliseconds(self):

281

320

"Return the 'timeout' attribute in milliseconds"

282

return self._timedelta_to_milliseconds(self.timeout)

321

return _timedelta_to_milliseconds(self.timeout)

322

323

def extended_timeout_milliseconds(self):

324

"Return the 'extended_timeout' attribute in milliseconds"

325

return _timedelta_to_milliseconds(self.extended_timeout)

283

326

284

327

def interval_milliseconds(self):

285

328

"Return the 'interval' attribute in milliseconds"

286

return self._timedelta_to_milliseconds(self.interval)

287

288

def approved_delay_milliseconds(self):

289

return self._timedelta_to_milliseconds(self.approved_delay)

329

return _timedelta_to_milliseconds(self.interval)

330

331

def approval_delay_milliseconds(self):

332

return _timedelta_to_milliseconds(self.approval_delay)

290

333

291

334

def __init__(self, name = None, disable_hook=None, config=None):

292

335

"""Note: the 'checker' key in 'config' sets the

295

338

self.name = name

296

339

if config is None:

297

340

config = {}

298

logger.debug(u"Creating client %r", self.name)

341

logger.debug("Creating client %r", self.name)

299

342

# Uppercase and remove spaces from fingerprint for later

300

343

# comparison purposes with return value from the fingerprint()

301

344

# function

302

self.fingerprint = (config[u"fingerprint"].upper()

303

.replace(u" ", u""))

304

logger.debug(u" Fingerprint: %s", self.fingerprint)

305

if u"secret" in config:

306

self.secret = config[u"secret"].decode(u"base64")

307

elif u"secfile" in config:

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

347

logger.debug(" Fingerprint: %s", self.fingerprint)

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

308

351

with open(os.path.expanduser(os.path.expandvars

309

(config[u"secfile"])),

352

(config["secfile"])),

310

353

"rb") as secfile:

311

354

self.secret = secfile.read()

312

355

else:

313

raise TypeError(u"No secret or secfile for client %s"

356

raise TypeError("No secret or secfile for client %s"

314

357

% self.name)

315

self.host = config.get(u"host", u"")

358

self.host = config.get("host", "")

316

359

self.created = datetime.datetime.utcnow()

317

360

self.enabled = False

361

self.last_approval_request = None

318

362

self.last_enabled = None

319

363

self.last_checked_ok = None

320

self.timeout = string_to_delta(config[u"timeout"])

321

self.interval = string_to_delta(config[u"interval"])

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

322

368

self.disable_hook = disable_hook

323

369

self.checker = None

324

370

self.checker_initiator_tag = None

325

371

self.disable_initiator_tag = None

372

self.expires = None

326

373

self.checker_callback_tag = None

327

self.checker_command = config[u"checker"]

374

self.checker_command = config["checker"]

328

375

self.current_checker_command = None

329

376

self.last_connect = None

330

377

self._approved = None

331

self.approved_by_default = config.get(u"approved_by_default",

378

self.approved_by_default = config.get("approved_by_default",

332

379

True)

333

380

self.approvals_pending = 0

334

self.approved_delay = string_to_delta(

335

config[u"approved_delay"])

336

self.approved_duration = string_to_delta(

337

config[u"approved_duration"])

338

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

381

self.approval_delay = string_to_delta(

382

config["approval_delay"])

383

self.approval_duration = string_to_delta(

384

config["approval_duration"])

385

self.changedstate = (multiprocessing_manager

386

.Condition(multiprocessing_manager

387

.Lock()))

339

388

340

389

def send_changedstate(self):

341

390

self.changedstate.acquire()

342

391

self.changedstate.notify_all()

343

392

self.changedstate.release()

344

393

345

394

def enable(self):

346

395

"""Start this client's checker and timeout hooks"""

347

if getattr(self, u"enabled", False):

396

if getattr(self, "enabled", False):

348

397

# Already enabled

349

398

return

350

399

self.send_changedstate()

351

self.last_enabled = datetime.datetime.utcnow()

352

400

# Schedule a new checker to be started an 'interval' from now,

353

401

# and every interval from then on.

354

402

self.checker_initiator_tag = (gobject.timeout_add

355

403

(self.interval_milliseconds(),

356

404

self.start_checker))

357

405

# Schedule a disable() when 'timeout' has passed

406

self.expires = datetime.datetime.utcnow() + self.timeout

358

407

self.disable_initiator_tag = (gobject.timeout_add

359

408

(self.timeout_milliseconds(),

360

409

self.disable))

361

410

self.enabled = True

411

self.last_enabled = datetime.datetime.utcnow()

362

412

# Also start a new checker *right now*.

363

413

self.start_checker()

364

414

369

419

if not quiet:

370

420

self.send_changedstate()

371

421

if not quiet:

372

logger.info(u"Disabling client %s", self.name)

373

if getattr(self, u"disable_initiator_tag", False):

422

logger.info("Disabling client %s", self.name)

423

if getattr(self, "disable_initiator_tag", False):

374

424

gobject.source_remove(self.disable_initiator_tag)

375

425

self.disable_initiator_tag = None

376

if getattr(self, u"checker_initiator_tag", False):

426

self.expires = None

427

if getattr(self, "checker_initiator_tag", False):

377

428

gobject.source_remove(self.checker_initiator_tag)

378

429

self.checker_initiator_tag = None

379

430

self.stop_checker()

394

445

if os.WIFEXITED(condition):

395

446

exitstatus = os.WEXITSTATUS(condition)

396

447

if exitstatus == 0:

397

logger.info(u"Checker for %(name)s succeeded",

448

logger.info("Checker for %(name)s succeeded",

398

449

vars(self))

399

450

self.checked_ok()

400

451

else:

401

logger.info(u"Checker for %(name)s failed",

452

logger.info("Checker for %(name)s failed",

402

453

vars(self))

403

454

else:

404

logger.warning(u"Checker for %(name)s crashed?",

455

logger.warning("Checker for %(name)s crashed?",

405

456

vars(self))

406

457

407

def checked_ok(self):

458

def checked_ok(self, timeout=None):

408

459

"""Bump up the timeout for this client.

409

460

410

461

This should only be called when the client has been seen,

411

462

alive and well.

412

463

"""

464

if timeout is None:

465

timeout = self.timeout

413

466

self.last_checked_ok = datetime.datetime.utcnow()

414

467

gobject.source_remove(self.disable_initiator_tag)

468

self.expires = datetime.datetime.utcnow() + timeout

415

469

self.disable_initiator_tag = (gobject.timeout_add

416

(self.timeout_milliseconds(),

417

self.disable))

470

(_timedelta_to_milliseconds

471

(timeout), self.disable))

472

473

def need_approval(self):

474

self.last_approval_request = datetime.datetime.utcnow()

418

475

419

476

def start_checker(self):

420

477

"""Start a new checker subprocess if one is not running.

433

490

# If a checker exists, make sure it is not a zombie

434

491

try:

435

492

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

436

except (AttributeError, OSError), error:

493

except (AttributeError, OSError) as error:

437

494

if (isinstance(error, OSError)

438

495

and error.errno != errno.ECHILD):

439

496

raise error

440

497

else:

441

498

if pid:

442

logger.warning(u"Checker was a zombie")

499

logger.warning("Checker was a zombie")

443

500

gobject.source_remove(self.checker_callback_tag)

444

501

self.checker_callback(pid, status,

445

502

self.current_checker_command)

450

507

command = self.checker_command % self.host

451

508

except TypeError:

452

509

# Escape attributes for the shell

453

escaped_attrs = dict((key,

454

re.escape(unicode(str(val),

455

errors=

456

u'replace')))

457

for key, val in

458

vars(self).iteritems())

510

escaped_attrs = dict(

511

(attr,

512

re.escape(unicode(str(getattr(self, attr, "")),

513

errors=

514

'replace')))

515

for attr in

516

self.runtime_expansions)

517

459

518

try:

460

519

command = self.checker_command % escaped_attrs

461

except TypeError, error:

462

logger.error(u'Could not format string "%s":'

463

u' %s', self.checker_command, error)

520

except TypeError as error:

521

logger.error('Could not format string "%s":'

522

' %s', self.checker_command, error)

464

523

return True # Try again later

465

524

self.current_checker_command = command

466

525

try:

467

logger.info(u"Starting checker %r for %s",

526

logger.info("Starting checker %r for %s",

468

527

command, self.name)

469

528

# We don't need to redirect stdout and stderr, since

470

529

# in normal mode, that is already done by daemon(),

472

531

# always replaced by /dev/null.)

473

532

self.checker = subprocess.Popen(command,

474

533

close_fds=True,

475

shell=True, cwd=u"/")

534

shell=True, cwd="/")

476

535

self.checker_callback_tag = (gobject.child_watch_add

477

536

(self.checker.pid,

478

537

self.checker_callback,

483

542

if pid:

484

543

gobject.source_remove(self.checker_callback_tag)

485

544

self.checker_callback(pid, status, command)

486

except OSError, error:

487

logger.error(u"Failed to start subprocess: %s",

545

except OSError as error:

546

logger.error("Failed to start subprocess: %s",

488

547

error)

489

548

# Re-run this periodically if run by gobject.timeout_add

490

549

return True

494

553

if self.checker_callback_tag:

495

554

gobject.source_remove(self.checker_callback_tag)

496

555

self.checker_callback_tag = None

497

if getattr(self, u"checker", None) is None:

556

if getattr(self, "checker", None) is None:

498

557

return

499

logger.debug(u"Stopping checker for %(name)s", vars(self))

558

logger.debug("Stopping checker for %(name)s", vars(self))

500

559

try:

501

560

os.kill(self.checker.pid, signal.SIGTERM)

502

561

#time.sleep(0.5)

503

562

#if self.checker.poll() is None:

504

563

# os.kill(self.checker.pid, signal.SIGKILL)

505

except OSError, error:

564

except OSError as error:

506

565

if error.errno != errno.ESRCH: # No such process

507

566

raise

508

567

self.checker = None

509

568

510

def dbus_service_property(dbus_interface, signature=u"v",

511

access=u"readwrite", byte_arrays=False):

569

570

def dbus_service_property(dbus_interface, signature="v",

571

access="readwrite", byte_arrays=False):

512

572

"""Decorators for marking methods of a DBusObjectWithProperties to

513

573

become properties on the D-Bus.

514

574

521

581

"""

522

582

# Encoding deeply encoded byte arrays is not supported yet by the

523

583

# "Set" method, so we fail early here:

524

if byte_arrays and signature != u"ay":

525

raise ValueError(u"Byte arrays not supported for non-'ay'"

526

u" signature %r" % signature)

584

if byte_arrays and signature != "ay":

585

raise ValueError("Byte arrays not supported for non-'ay'"

586

" signature %r" % signature)

527

587

def decorator(func):

528

588

func._dbus_is_property = True

529

589

func._dbus_interface = dbus_interface

530

590

func._dbus_signature = signature

531

591

func._dbus_access = access

532

592

func._dbus_name = func.__name__

533

if func._dbus_name.endswith(u"_dbus_property"):

593

if func._dbus_name.endswith("_dbus_property"):

534

594

func._dbus_name = func._dbus_name[:-14]

535

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

595

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

536

596

return func

537

597

return decorator

538

598

558

618

559

619

class DBusObjectWithProperties(dbus.service.Object):

560

620

"""A D-Bus object with properties.

561

621

562

622

Classes inheriting from this can use the dbus_service_property

563

623

decorator to expose methods as D-Bus properties. It exposes the

564

624

standard Get(), Set(), and GetAll() methods on the D-Bus.

566

626

567

627

@staticmethod

568

628

def _is_dbus_property(obj):

569

return getattr(obj, u"_dbus_is_property", False)

629

return getattr(obj, "_dbus_is_property", False)

570

630

571

631

def _get_all_dbus_properties(self):

572

632

"""Returns a generator of (name, attribute) pairs

573

633

"""

574

return ((prop._dbus_name, prop)

634

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

635

for cls in self.__class__.__mro__

575

636

for name, prop in

576

inspect.getmembers(self, self._is_dbus_property))

637

inspect.getmembers(cls, self._is_dbus_property))

577

638

578

639

def _get_dbus_property(self, interface_name, property_name):

579

640

"""Returns a bound method if one exists which is a D-Bus

580

641

property with the specified name and interface.

581

642

"""

582

for name in (property_name,

583

property_name + u"_dbus_property"):

584

prop = getattr(self, name, None)

585

if (prop is None

586

or not self._is_dbus_property(prop)

587

or prop._dbus_name != property_name

588

or (interface_name and prop._dbus_interface

589

and interface_name != prop._dbus_interface)):

590

continue

591

return prop

643

for cls in self.__class__.__mro__:

644

for name, value in (inspect.getmembers

645

(cls, self._is_dbus_property)):

646

if (value._dbus_name == property_name

647

and value._dbus_interface == interface_name):

648

return value.__get__(self)

649

592

650

# No such property

593

raise DBusPropertyNotFound(self.dbus_object_path + u":"

594

+ interface_name + u"."

651

raise DBusPropertyNotFound(self.dbus_object_path + ":"

652

+ interface_name + "."

595

653

+ property_name)

596

654

597

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

598

out_signature=u"v")

655

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

656

out_signature="v")

599

657

def Get(self, interface_name, property_name):

600

658

"""Standard D-Bus property Get() method, see D-Bus standard.

601

659

"""

602

660

prop = self._get_dbus_property(interface_name, property_name)

603

if prop._dbus_access == u"write":

661

if prop._dbus_access == "write":

604

662

raise DBusPropertyAccessException(property_name)

605

663

value = prop()

606

if not hasattr(value, u"variant_level"):

664

if not hasattr(value, "variant_level"):

607

665

return value

608

666

return type(value)(value, variant_level=value.variant_level+1)

609

667

610

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

668

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

611

669

def Set(self, interface_name, property_name, value):

612

670

"""Standard D-Bus property Set() method, see D-Bus standard.

613

671

"""

614

672

prop = self._get_dbus_property(interface_name, property_name)

615

if prop._dbus_access == u"read":

673

if prop._dbus_access == "read":

616

674

raise DBusPropertyAccessException(property_name)

617

if prop._dbus_get_args_options[u"byte_arrays"]:

675

if prop._dbus_get_args_options["byte_arrays"]:

618

676

# The byte_arrays option is not supported yet on

619

677

# signatures other than "ay".

620

if prop._dbus_signature != u"ay":

678

if prop._dbus_signature != "ay":

621

679

raise ValueError

622

680

value = dbus.ByteArray(''.join(unichr(byte)

623

681

for byte in value))

624

682

prop(value)

625

683

626

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

627

out_signature=u"a{sv}")

684

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

685

out_signature="a{sv}")

628

686

def GetAll(self, interface_name):

629

687

"""Standard D-Bus property GetAll() method, see D-Bus

630

688

standard.

631

689

632

690

Note: Will not include properties with access="write".

633

691

"""

634

692

all = {}

638

696

# Interface non-empty but did not match

639

697

continue

640

698

# Ignore write-only properties

641

if prop._dbus_access == u"write":

699

if prop._dbus_access == "write":

642

700

continue

643

701

value = prop()

644

if not hasattr(value, u"variant_level"):

702

if not hasattr(value, "variant_level"):

645

703

all[name] = value

646

704

continue

647

705

all[name] = type(value)(value, variant_level=

648

706

value.variant_level+1)

649

return dbus.Dictionary(all, signature=u"sv")

707

return dbus.Dictionary(all, signature="sv")

650

708

651

709

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

652

out_signature=u"s",

710

out_signature="s",

653

711

path_keyword='object_path',

654

712

connection_keyword='connection')

655

713

def Introspect(self, object_path, connection):

660

718

try:

661

719

document = xml.dom.minidom.parseString(xmlstring)

662

720

def make_tag(document, name, prop):

663

e = document.createElement(u"property")

664

e.setAttribute(u"name", name)

665

e.setAttribute(u"type", prop._dbus_signature)

666

e.setAttribute(u"access", prop._dbus_access)

721

e = document.createElement("property")

722

e.setAttribute("name", name)

723

e.setAttribute("type", prop._dbus_signature)

724

e.setAttribute("access", prop._dbus_access)

667

725

return e

668

for if_tag in document.getElementsByTagName(u"interface"):

726

for if_tag in document.getElementsByTagName("interface"):

669

727

for tag in (make_tag(document, name, prop)

670

728

for name, prop

671

729

in self._get_all_dbus_properties()

672

730

if prop._dbus_interface

673

== if_tag.getAttribute(u"name")):

731

== if_tag.getAttribute("name")):

674

732

if_tag.appendChild(tag)

675

733

# Add the names to the return values for the

676

734

# "org.freedesktop.DBus.Properties" methods

677

if (if_tag.getAttribute(u"name")

678

== u"org.freedesktop.DBus.Properties"):

679

for cn in if_tag.getElementsByTagName(u"method"):

680

if cn.getAttribute(u"name") == u"Get":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"value")

685

elif cn.getAttribute(u"name") == u"GetAll":

686

for arg in cn.getElementsByTagName(u"arg"):

687

if (arg.getAttribute(u"direction")

688

== u"out"):

689

arg.setAttribute(u"name", u"props")

690

xmlstring = document.toxml(u"utf-8")

735

if (if_tag.getAttribute("name")

736

== "org.freedesktop.DBus.Properties"):

737

for cn in if_tag.getElementsByTagName("method"):

738

if cn.getAttribute("name") == "Get":

739

for arg in cn.getElementsByTagName("arg"):

740

if (arg.getAttribute("direction")

741

== "out"):

742

arg.setAttribute("name", "value")

743

elif cn.getAttribute("name") == "GetAll":

744

for arg in cn.getElementsByTagName("arg"):

745

if (arg.getAttribute("direction")

746

== "out"):

747

arg.setAttribute("name", "props")

748

xmlstring = document.toxml("utf-8")

691

749

document.unlink()

692

750

except (AttributeError, xml.dom.DOMException,

693

xml.parsers.expat.ExpatError), error:

694

logger.error(u"Failed to override Introspection method",

751

xml.parsers.expat.ExpatError) as error:

752

logger.error("Failed to override Introspection method",

695

753

error)

696

754

return xmlstring

697

755

698

756

757

def datetime_to_dbus (dt, variant_level=0):

758

"""Convert a UTC datetime.datetime() to a D-Bus type."""

759

if dt is None:

760

return dbus.String("", variant_level = variant_level)

761

return dbus.String(dt.isoformat(),

762

variant_level=variant_level)

763

764

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

765

.__metaclass__):

766

"""Applied to an empty subclass of a D-Bus object, this metaclass

767

will add additional D-Bus attributes matching a certain pattern.

768

"""

769

def __new__(mcs, name, bases, attr):

770

# Go through all the base classes which could have D-Bus

771

# methods, signals, or properties in them

772

for base in (b for b in bases

773

if issubclass(b, dbus.service.Object)):

774

# Go though all attributes of the base class

775

for attrname, attribute in inspect.getmembers(base):

776

# Ignore non-D-Bus attributes, and D-Bus attributes

777

# with the wrong interface name

778

if (not hasattr(attribute, "_dbus_interface")

779

or not attribute._dbus_interface

780

.startswith("se.recompile.Mandos")):

781

continue

782

# Create an alternate D-Bus interface name based on

783

# the current name

784

alt_interface = (attribute._dbus_interface

785

.replace("se.recompile.Mandos",

786

"se.bsnet.fukt.Mandos"))

787

# Is this a D-Bus signal?

788

if getattr(attribute, "_dbus_is_signal", False):

789

# Extract the original non-method function by

790

# black magic

791

nonmethod_func = (dict(

792

zip(attribute.func_code.co_freevars,

793

attribute.__closure__))["func"]

794

.cell_contents)

795

# Create a new, but exactly alike, function

796

# object, and decorate it to be a new D-Bus signal

797

# with the alternate D-Bus interface name

798

new_function = (dbus.service.signal

799

(alt_interface,

800

attribute._dbus_signature)

801

(types.FunctionType(

802

nonmethod_func.func_code,

803

nonmethod_func.func_globals,

804

nonmethod_func.func_name,

805

nonmethod_func.func_defaults,

806

nonmethod_func.func_closure)))

807

# Define a creator of a function to call both the

808

# old and new functions, so both the old and new

809

# signals gets sent when the function is called

810

def fixscope(func1, func2):

811

"""This function is a scope container to pass

812

func1 and func2 to the "call_both" function

813

outside of its arguments"""

814

def call_both(*args, **kwargs):

815

"""This function will emit two D-Bus

816

signals by calling func1 and func2"""

817

func1(*args, **kwargs)

818

func2(*args, **kwargs)

819

return call_both

820

# Create the "call_both" function and add it to

821

# the class

822

attr[attrname] = fixscope(attribute,

823

new_function)

824

# Is this a D-Bus method?

825

elif getattr(attribute, "_dbus_is_method", False):

826

# Create a new, but exactly alike, function

827

# object. Decorate it to be a new D-Bus method

828

# with the alternate D-Bus interface name. Add it

829

# to the class.

830

attr[attrname] = (dbus.service.method

831

(alt_interface,

832

attribute._dbus_in_signature,

833

attribute._dbus_out_signature)

834

(types.FunctionType

835

(attribute.func_code,

836

attribute.func_globals,

837

attribute.func_name,

838

attribute.func_defaults,

839

attribute.func_closure)))

840

# Is this a D-Bus property?

841

elif getattr(attribute, "_dbus_is_property", False):

842

# Create a new, but exactly alike, function

843

# object, and decorate it to be a new D-Bus

844

# property with the alternate D-Bus interface

845

# name. Add it to the class.

846

attr[attrname] = (dbus_service_property

847

(alt_interface,

848

attribute._dbus_signature,

849

attribute._dbus_access,

850

attribute

851

._dbus_get_args_options

852

["byte_arrays"])

853

(types.FunctionType

854

(attribute.func_code,

855

attribute.func_globals,

856

attribute.func_name,

857

attribute.func_defaults,

858

attribute.func_closure)))

859

return type.__new__(mcs, name, bases, attr)

860

699

861

class ClientDBus(Client, DBusObjectWithProperties):

700

862

"""A Client class using D-Bus

701

863

703

865

dbus_object_path: dbus.ObjectPath

704

866

bus: dbus.SystemBus()

705

867

"""

868

869

runtime_expansions = (Client.runtime_expansions

870

+ ("dbus_object_path",))

871

706

872

# dbus.service.Object doesn't use super(), so we can't either.

707

873

708

874

def __init__(self, bus = None, *args, **kwargs):

711

877

Client.__init__(self, *args, **kwargs)

712

878

# Only now, when this client is initialized, can it show up on

713

879

# the D-Bus

880

client_object_name = unicode(self.name).translate(

881

{ord("."): ord("_"),

882

ord("-"): ord("_")})

714

883

self.dbus_object_path = (dbus.ObjectPath

715

(u"/clients/"

716

+ self.name.replace(u".", u"_")))

884

("/clients/" + client_object_name))

717

885

DBusObjectWithProperties.__init__(self, self.bus,

718

886

self.dbus_object_path)

719

720

def _get_approvals_pending(self):

721

return self._approvals_pending

722

def _set_approvals_pending(self, value):

723

old_value = self._approvals_pending

724

self._approvals_pending = value

725

bval = bool(value)

726

if (hasattr(self, "dbus_object_path")

727

and bval is not bool(old_value)):

728

dbus_bool = dbus.Boolean(bval, variant_level=1)

729

self.PropertyChanged(dbus.String(u"approved_pending"),

730

dbus_bool)

731

732

approvals_pending = property(_get_approvals_pending,

733

_set_approvals_pending)

734

del _get_approvals_pending, _set_approvals_pending

735

736

@staticmethod

737

def _datetime_to_dbus(dt, variant_level=0):

738

"""Convert a UTC datetime.datetime() to a D-Bus type."""

739

return dbus.String(dt.isoformat(),

740

variant_level=variant_level)

741

742

def enable(self):

743

oldstate = getattr(self, u"enabled", False)

744

r = Client.enable(self)

745

if oldstate != self.enabled:

746

# Emit D-Bus signals

747

self.PropertyChanged(dbus.String(u"enabled"),

748

dbus.Boolean(True, variant_level=1))

749

self.PropertyChanged(

750

dbus.String(u"last_enabled"),

751

self._datetime_to_dbus(self.last_enabled,

752

variant_level=1))

753

return r

754

755

def disable(self, quiet = False):

756

oldstate = getattr(self, u"enabled", False)

757

r = Client.disable(self, quiet=quiet)

758

if not quiet and oldstate != self.enabled:

759

# Emit D-Bus signal

760

self.PropertyChanged(dbus.String(u"enabled"),

761

dbus.Boolean(False, variant_level=1))

762

return r

887

888

def notifychangeproperty(transform_func,

889

dbus_name, type_func=lambda x: x,

890

variant_level=1):

891

""" Modify a variable so that it's a property which announces

892

its changes to DBus.

893

894

transform_fun: Function that takes a value and transforms it

895

to a D-Bus type.

896

dbus_name: D-Bus name of the variable

897

type_func: Function that transform the value before sending it

898

to the D-Bus. Default: no transform

899

variant_level: D-Bus variant level. Default: 1

900

"""

901

attrname = "_{0}".format(dbus_name)

902

def setter(self, value):

903

if hasattr(self, "dbus_object_path"):

904

if (not hasattr(self, attrname) or

905

type_func(getattr(self, attrname, None))

906

!= type_func(value)):

907

dbus_value = transform_func(type_func(value),

908

variant_level)

909

self.PropertyChanged(dbus.String(dbus_name),

910

dbus_value)

911

setattr(self, attrname, value)

912

913

return property(lambda self: getattr(self, attrname), setter)

914

915

916

expires = notifychangeproperty(datetime_to_dbus, "Expires")

917

approvals_pending = notifychangeproperty(dbus.Boolean,

918

"ApprovalPending",

919

type_func = bool)

920

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

921

last_enabled = notifychangeproperty(datetime_to_dbus,

922

"LastEnabled")

923

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

924

type_func = lambda checker:

925

checker is not None)

926

last_checked_ok = notifychangeproperty(datetime_to_dbus,

927

"LastCheckedOK")

928

last_approval_request = notifychangeproperty(

929

datetime_to_dbus, "LastApprovalRequest")

930

approved_by_default = notifychangeproperty(dbus.Boolean,

931

"ApprovedByDefault")

932

approval_delay = notifychangeproperty(dbus.UInt16,

933

"ApprovalDelay",

934

type_func =

935

_timedelta_to_milliseconds)

936

approval_duration = notifychangeproperty(

937

dbus.UInt16, "ApprovalDuration",

938

type_func = _timedelta_to_milliseconds)

939

host = notifychangeproperty(dbus.String, "Host")

940

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

941

type_func =

942

_timedelta_to_milliseconds)

943

extended_timeout = notifychangeproperty(

944

dbus.UInt16, "ExtendedTimeout",

945

type_func = _timedelta_to_milliseconds)

946

interval = notifychangeproperty(dbus.UInt16,

947

"Interval",

948

type_func =

949

_timedelta_to_milliseconds)

950

checker_command = notifychangeproperty(dbus.String, "Checker")

951

952

del notifychangeproperty

763

953

764

954

def __del__(self, *args, **kwargs):

765

955

try:

766

956

self.remove_from_connection()

767

957

except LookupError:

768

958

pass

769

if hasattr(DBusObjectWithProperties, u"__del__"):

959

if hasattr(DBusObjectWithProperties, "__del__"):

770

960

DBusObjectWithProperties.__del__(self, *args, **kwargs)

771

961

Client.__del__(self, *args, **kwargs)

772

962

774

964

*args, **kwargs):

775

965

self.checker_callback_tag = None

776

966

self.checker = None

777

# Emit D-Bus signal

778

self.PropertyChanged(dbus.String(u"checker_running"),

779

dbus.Boolean(False, variant_level=1))

780

967

if os.WIFEXITED(condition):

781

968

exitstatus = os.WEXITSTATUS(condition)

782

969

# Emit D-Bus signal

792

979

return Client.checker_callback(self, pid, condition, command,

793

980

*args, **kwargs)

794

981

795

def checked_ok(self, *args, **kwargs):

796

r = Client.checked_ok(self, *args, **kwargs)

797

# Emit D-Bus signal

798

self.PropertyChanged(

799

dbus.String(u"last_checked_ok"),

800

(self._datetime_to_dbus(self.last_checked_ok,

801

variant_level=1)))

802

return r

803

804

982

def start_checker(self, *args, **kwargs):

805

983

old_checker = self.checker

806

984

if self.checker is not None:

813

991

and old_checker_pid != self.checker.pid):

814

992

# Emit D-Bus signal

815

993

self.CheckerStarted(self.current_checker_command)

816

self.PropertyChanged(

817

dbus.String(u"checker_running"),

818

dbus.Boolean(True, variant_level=1))

819

994

return r

820

995

821

def stop_checker(self, *args, **kwargs):

822

old_checker = getattr(self, u"checker", None)

823

r = Client.stop_checker(self, *args, **kwargs)

824

if (old_checker is not None

825

and getattr(self, u"checker", None) is None):

826

self.PropertyChanged(dbus.String(u"checker_running"),

827

dbus.Boolean(False, variant_level=1))

828

return r

829

830

996

def _reset_approved(self):

831

997

self._approved = None

832

998

return False

834

1000

def approve(self, value=True):

835

1001

self.send_changedstate()

836

1002

self._approved = value

837

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),

1003

gobject.timeout_add(_timedelta_to_milliseconds

1004

(self.approval_duration),

838

1005

self._reset_approved)

839

1006

840

1007

841

1008

## D-Bus methods, signals & properties

842

_interface = u"se.bsnet.fukt.Mandos.Client"

1009

_interface = "se.recompile.Mandos.Client"

843

1010

844

1011

## Signals

845

1012

846

1013

# CheckerCompleted - signal

847

@dbus.service.signal(_interface, signature=u"nxs")

1014

@dbus.service.signal(_interface, signature="nxs")

848

1015

def CheckerCompleted(self, exitcode, waitstatus, command):

849

1016

"D-Bus signal"

850

1017

pass

851

1018

852

1019

# CheckerStarted - signal

853

@dbus.service.signal(_interface, signature=u"s")

1020

@dbus.service.signal(_interface, signature="s")

854

1021

def CheckerStarted(self, command):

855

1022

"D-Bus signal"

856

1023

pass

857

1024

858

1025

# PropertyChanged - signal

859

@dbus.service.signal(_interface, signature=u"sv")

1026

@dbus.service.signal(_interface, signature="sv")

860

1027

def PropertyChanged(self, property, value):

861

1028

"D-Bus signal"

862

1029

pass

871

1038

pass

872

1039

873

1040

# Rejected - signal

874

@dbus.service.signal(_interface, signature=u"s")

1041

@dbus.service.signal(_interface, signature="s")

875

1042

def Rejected(self, reason):

876

1043

"D-Bus signal"

877

1044

pass

878

1045

879

1046

# NeedApproval - signal

880

@dbus.service.signal(_interface, signature=u"db")

1047

@dbus.service.signal(_interface, signature="tb")

881

1048

def NeedApproval(self, timeout, default):

882

1049

"D-Bus signal"

883

pass

1050

return self.need_approval()

884

1051

885

1052

## Methods

886

1053

887

1054

# Approve - method

888

@dbus.service.method(_interface, in_signature=u"b")

1055

@dbus.service.method(_interface, in_signature="b")

889

1056

def Approve(self, value):

890

1057

self.approve(value)

891

1058

892

1059

# CheckedOK - method

893

1060

@dbus.service.method(_interface)

894

1061

def CheckedOK(self):

895

return self.checked_ok()

1062

self.checked_ok()

896

1063

897

1064

# Enable - method

898

1065

@dbus.service.method(_interface)

919

1086

920

1087

## Properties

921

1088

922

# approved_pending - property

923

@dbus_service_property(_interface, signature=u"b", access=u"read")

924

def approved_pending_dbus_property(self):

1089

# ApprovalPending - property

1090

@dbus_service_property(_interface, signature="b", access="read")

1091

def ApprovalPending_dbus_property(self):

925

1092

return dbus.Boolean(bool(self.approvals_pending))

926

1093

927

# approved_by_default - property

928

@dbus_service_property(_interface, signature=u"b",

929

access=u"readwrite")

930

def approved_by_default_dbus_property(self):

931

return dbus.Boolean(self.approved_by_default)

932

933

# approved_delay - property

934

@dbus_service_property(_interface, signature=u"t",

935

access=u"readwrite")

936

def approved_delay_dbus_property(self):

937

return dbus.UInt64(self.approved_delay_milliseconds())

938

939

# approved_duration - property

940

@dbus_service_property(_interface, signature=u"t",

941

access=u"readwrite")

942

def approved_duration_dbus_property(self):

943

return dbus.UInt64(self._timedelta_to_milliseconds(

944

self.approved_duration))

945

946

# name - property

947

@dbus_service_property(_interface, signature=u"s", access=u"read")

948

def name_dbus_property(self):

1094

# ApprovedByDefault - property

1095

@dbus_service_property(_interface, signature="b",

1096

access="readwrite")

1097

def ApprovedByDefault_dbus_property(self, value=None):

1098

if value is None: # get

1099

return dbus.Boolean(self.approved_by_default)

1100

self.approved_by_default = bool(value)

1101

1102

# ApprovalDelay - property

1103

@dbus_service_property(_interface, signature="t",

1104

access="readwrite")

1105

def ApprovalDelay_dbus_property(self, value=None):

1106

if value is None: # get

1107

return dbus.UInt64(self.approval_delay_milliseconds())

1108

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1109

1110

# ApprovalDuration - property

1111

@dbus_service_property(_interface, signature="t",

1112

access="readwrite")

1113

def ApprovalDuration_dbus_property(self, value=None):

1114

if value is None: # get

1115

return dbus.UInt64(_timedelta_to_milliseconds(

1116

self.approval_duration))

1117

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1118

1119

# Name - property

1120

@dbus_service_property(_interface, signature="s", access="read")

1121

def Name_dbus_property(self):

949

1122

return dbus.String(self.name)

950

1123

951

# fingerprint - property

952

@dbus_service_property(_interface, signature=u"s", access=u"read")

953

def fingerprint_dbus_property(self):

1124

# Fingerprint - property

1125

@dbus_service_property(_interface, signature="s", access="read")

1126

def Fingerprint_dbus_property(self):

954

1127

return dbus.String(self.fingerprint)

955

1128

956

# host - property

957

@dbus_service_property(_interface, signature=u"s",

958

access=u"readwrite")

959

def host_dbus_property(self, value=None):

1129

# Host - property

1130

@dbus_service_property(_interface, signature="s",

1131

access="readwrite")

1132

def Host_dbus_property(self, value=None):

960

1133

if value is None: # get

961

1134

return dbus.String(self.host)

962

1135

self.host = value

963

# Emit D-Bus signal

964

self.PropertyChanged(dbus.String(u"host"),

965

dbus.String(value, variant_level=1))

966

967

# created - property

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

969

def created_dbus_property(self):

970

return dbus.String(self._datetime_to_dbus(self.created))

971

972

# last_enabled - property

973

@dbus_service_property(_interface, signature=u"s", access=u"read")

974

def last_enabled_dbus_property(self):

975

if self.last_enabled is None:

976

return dbus.String(u"")

977

return dbus.String(self._datetime_to_dbus(self.last_enabled))

978

979

# enabled - property

980

@dbus_service_property(_interface, signature=u"b",

981

access=u"readwrite")

982

def enabled_dbus_property(self, value=None):

1136

1137

# Created - property

1138

@dbus_service_property(_interface, signature="s", access="read")

1139

def Created_dbus_property(self):

1140

return dbus.String(datetime_to_dbus(self.created))

1141

1142

# LastEnabled - property

1143

@dbus_service_property(_interface, signature="s", access="read")

1144

def LastEnabled_dbus_property(self):

1145

return datetime_to_dbus(self.last_enabled)

1146

1147

# Enabled - property

1148

@dbus_service_property(_interface, signature="b",

1149

access="readwrite")

1150

def Enabled_dbus_property(self, value=None):

983

1151

if value is None: # get

984

1152

return dbus.Boolean(self.enabled)

985

1153

if value:

987

1155

else:

988

1156

self.disable()

989

1157

990

# last_checked_ok - property

991

@dbus_service_property(_interface, signature=u"s",

992

access=u"readwrite")

993

def last_checked_ok_dbus_property(self, value=None):

1158

# LastCheckedOK - property

1159

@dbus_service_property(_interface, signature="s",

1160

access="readwrite")

1161

def LastCheckedOK_dbus_property(self, value=None):

994

1162

if value is not None:

995

1163

self.checked_ok()

996

1164

return

997

if self.last_checked_ok is None:

998

return dbus.String(u"")

999

return dbus.String(self._datetime_to_dbus(self

1000

.last_checked_ok))

1001

1002

# timeout - property

1003

@dbus_service_property(_interface, signature=u"t",

1004

access=u"readwrite")

1005

def timeout_dbus_property(self, value=None):

1165

return datetime_to_dbus(self.last_checked_ok)

1166

1167

# Expires - property

1168

@dbus_service_property(_interface, signature="s", access="read")

1169

def Expires_dbus_property(self):

1170

return datetime_to_dbus(self.expires)

1171

1172

# LastApprovalRequest - property

1173

@dbus_service_property(_interface, signature="s", access="read")

1174

def LastApprovalRequest_dbus_property(self):

1175

return datetime_to_dbus(self.last_approval_request)

1176

1177

# Timeout - property

1178

@dbus_service_property(_interface, signature="t",

1179

access="readwrite")

1180

def Timeout_dbus_property(self, value=None):

1006

1181

if value is None: # get

1007

1182

return dbus.UInt64(self.timeout_milliseconds())

1008

1183

self.timeout = datetime.timedelta(0, 0, 0, value)

1009

# Emit D-Bus signal

1010

self.PropertyChanged(dbus.String(u"timeout"),

1011

dbus.UInt64(value, variant_level=1))

1012

if getattr(self, u"disable_initiator_tag", None) is None:

1184

if getattr(self, "disable_initiator_tag", None) is None:

1013

1185

return

1014

1186

# Reschedule timeout

1015

1187

gobject.source_remove(self.disable_initiator_tag)

1016

1188

self.disable_initiator_tag = None

1189

self.expires = None

1017

1190

time_to_die = (self.

1018

1191

_timedelta_to_milliseconds((self

1019

1192

.last_checked_ok

1024

1197

# The timeout has passed

1025

1198

self.disable()

1026

1199

else:

1200

self.expires = (datetime.datetime.utcnow()

1201

+ datetime.timedelta(milliseconds =

1202

time_to_die))

1027

1203

self.disable_initiator_tag = (gobject.timeout_add

1028

1204

(time_to_die, self.disable))

1029

1205

1030

# interval - property

1031

@dbus_service_property(_interface, signature=u"t",

1032

access=u"readwrite")

1033

def interval_dbus_property(self, value=None):

1206

# ExtendedTimeout - property

1207

@dbus_service_property(_interface, signature="t",

1208

access="readwrite")

1209

def ExtendedTimeout_dbus_property(self, value=None):

1210

if value is None: # get

1211

return dbus.UInt64(self.extended_timeout_milliseconds())

1212

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1213

1214

# Interval - property

1215

@dbus_service_property(_interface, signature="t",

1216

access="readwrite")

1217

def Interval_dbus_property(self, value=None):

1034

1218

if value is None: # get

1035

1219

return dbus.UInt64(self.interval_milliseconds())

1036

1220

self.interval = datetime.timedelta(0, 0, 0, value)

1037

# Emit D-Bus signal

1038

self.PropertyChanged(dbus.String(u"interval"),

1039

dbus.UInt64(value, variant_level=1))

1040

if getattr(self, u"checker_initiator_tag", None) is None:

1221

if getattr(self, "checker_initiator_tag", None) is None:

1041

1222

return

1042

1223

# Reschedule checker run

1043

1224

gobject.source_remove(self.checker_initiator_tag)

1044

1225

self.checker_initiator_tag = (gobject.timeout_add

1045

1226

(value, self.start_checker))

1046

1227

self.start_checker() # Start one now, too

1047

1048

# checker - property

1049

@dbus_service_property(_interface, signature=u"s",

1050

access=u"readwrite")

1051

def checker_dbus_property(self, value=None):

1228

1229

# Checker - property

1230

@dbus_service_property(_interface, signature="s",

1231

access="readwrite")

1232

def Checker_dbus_property(self, value=None):

1052

1233

if value is None: # get

1053

1234

return dbus.String(self.checker_command)

1054

1235

self.checker_command = value

1055

# Emit D-Bus signal

1056

self.PropertyChanged(dbus.String(u"checker"),

1057

dbus.String(self.checker_command,

1058

variant_level=1))

1059

1236

1060

# checker_running - property

1061

@dbus_service_property(_interface, signature=u"b",

1062

access=u"readwrite")

1063

def checker_running_dbus_property(self, value=None):

1237

# CheckerRunning - property

1238

@dbus_service_property(_interface, signature="b",

1239

access="readwrite")

1240

def CheckerRunning_dbus_property(self, value=None):

1064

1241

if value is None: # get

1065

1242

return dbus.Boolean(self.checker is not None)

1066

1243

if value:

1068

1245

else:

1069

1246

self.stop_checker()

1070

1247

1071

# object_path - property

1072

@dbus_service_property(_interface, signature=u"o", access=u"read")

1073

def object_path_dbus_property(self):

1248

# ObjectPath - property

1249

@dbus_service_property(_interface, signature="o", access="read")

1250

def ObjectPath_dbus_property(self):

1074

1251

return self.dbus_object_path # is already a dbus.ObjectPath

1075

1252

1076

# secret = property

1077

@dbus_service_property(_interface, signature=u"ay",

1078

access=u"write", byte_arrays=True)

1079

def secret_dbus_property(self, value):

1253

# Secret = property

1254

@dbus_service_property(_interface, signature="ay",

1255

access="write", byte_arrays=True)

1256

def Secret_dbus_property(self, value):

1080

1257

self.secret = str(value)

1081

1258

1082

1259

del _interface

1088

1265

self._pipe.send(('init', fpr, address))

1089

1266

if not self._pipe.recv():

1090

1267

raise KeyError()

1091

1268

1092

1269

def __getattribute__(self, name):

1093

1270

if(name == '_pipe'):

1094

1271

return super(ProxyClient, self).__getattribute__(name)

1101

1278

self._pipe.send(('funcall', name, args, kwargs))

1102

1279

return self._pipe.recv()[1]

1103

1280

return func

1104

1281

1105

1282

def __setattr__(self, name, value):

1106

1283

if(name == '_pipe'):

1107

1284

return super(ProxyClient, self).__setattr__(name, value)

1108

1285

self._pipe.send(('setattr', name, value))

1109

1286

1287

class ClientDBusTransitional(ClientDBus):

1288

__metaclass__ = AlternateDBusNamesMetaclass

1110

1289

1111

1290

class ClientHandler(socketserver.BaseRequestHandler, object):

1112

1291

"""A class to handle client connections.

1116

1295

1117

1296

def handle(self):

1118

1297

with contextlib.closing(self.server.child_pipe) as child_pipe:

1119

logger.info(u"TCP connection from: %s",

1298

logger.info("TCP connection from: %s",

1120

1299

unicode(self.client_address))

1121

logger.debug(u"Pipe FD: %d",

1300

logger.debug("Pipe FD: %d",

1122

1301

self.server.child_pipe.fileno())

1123

1302

1124

1303

session = (gnutls.connection

1125

1304

.ClientSession(self.request,

1126

1305

gnutls.connection

1127

1306

.X509Credentials()))

1128

1307

1129

1308

# Note: gnutls.connection.X509Credentials is really a

1130

1309

# generic GnuTLS certificate credentials object so long as

1131

1310

# no X.509 keys are added to it. Therefore, we can use it

1132

1311

# here despite using OpenPGP certificates.

1133

1134

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1135

# u"+AES-256-CBC", u"+SHA1",

1136

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1137

# u"+DHE-DSS"))

1312

1313

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1314

# "+AES-256-CBC", "+SHA1",

1315

# "+COMP-NULL", "+CTYPE-OPENPGP",

1316

# "+DHE-DSS"))

1138

1317

# Use a fallback default, since this MUST be set.

1139

1318

priority = self.server.gnutls_priority

1140

1319

if priority is None:

1141

priority = u"NORMAL"

1320

priority = "NORMAL"

1142

1321

(gnutls.library.functions

1143

1322

.gnutls_priority_set_direct(session._c_object,

1144

1323

priority, None))

1145

1324

1146

1325

# Start communication using the Mandos protocol

1147

1326

# Get protocol number

1148

1327

line = self.request.makefile().readline()

1149

logger.debug(u"Protocol version: %r", line)

1328

logger.debug("Protocol version: %r", line)

1150

1329

try:

1151

1330

if int(line.strip().split()[0]) > 1:

1152

1331

raise RuntimeError

1153

except (ValueError, IndexError, RuntimeError), error:

1154

logger.error(u"Unknown protocol version: %s", error)

1332

except (ValueError, IndexError, RuntimeError) as error:

1333

logger.error("Unknown protocol version: %s", error)

1155

1334

return

1156

1335

1157

1336

# Start GnuTLS connection

1158

1337

try:

1159

1338

session.handshake()

1160

except gnutls.errors.GNUTLSError, error:

1161

logger.warning(u"Handshake failed: %s", error)

1339

except gnutls.errors.GNUTLSError as error:

1340

logger.warning("Handshake failed: %s", error)

1162

1341

# Do not run session.bye() here: the session is not

1163

1342

# established. Just abandon the request.

1164

1343

return

1165

logger.debug(u"Handshake succeeded")

1166

1344

logger.debug("Handshake succeeded")

1345

1167

1346

approval_required = False

1168

1347

try:

1169

1348

try:

1170

1349

fpr = self.fingerprint(self.peer_certificate

1171

1350

(session))

1172

except (TypeError, gnutls.errors.GNUTLSError), error:

1173

logger.warning(u"Bad certificate: %s", error)

1351

except (TypeError,

1352

gnutls.errors.GNUTLSError) as error:

1353

logger.warning("Bad certificate: %s", error)

1174

1354

return

1175

logger.debug(u"Fingerprint: %s", fpr)

1176

1355

logger.debug("Fingerprint: %s", fpr)

1356

1177

1357

try:

1178

1358

client = ProxyClient(child_pipe, fpr,

1179

1359

self.client_address)

1180

1360

except KeyError:

1181

1361

return

1182

1362

1183

if client.approved_delay:

1184

delay = client.approved_delay

1363

if client.approval_delay:

1364

delay = client.approval_delay

1185

1365

client.approvals_pending += 1

1186

1366

approval_required = True

1187

1367

1188

1368

while True:

1189

1369

if not client.enabled:

1190

logger.warning(u"Client %s is disabled",

1370

logger.info("Client %s is disabled",

1191

1371

client.name)

1192

1372

if self.server.use_dbus:

1193

1373

# Emit D-Bus signal

1194

client.Rejected("Disabled")

1374

client.Rejected("Disabled")

1195

1375

return

1196

1376

1197

if client._approved or not client.approved_delay:

1377

if client._approved or not client.approval_delay:

1198

1378

#We are approved or approval is disabled

1199

1379

break

1200

1380

elif client._approved is None:

1201

logger.info(u"Client %s need approval",

1381

logger.info("Client %s needs approval",

1202

1382

client.name)

1203

1383

if self.server.use_dbus:

1204

1384

# Emit D-Bus signal

1205

1385

client.NeedApproval(

1206

client.approved_delay_milliseconds(),

1386

client.approval_delay_milliseconds(),

1207

1387

client.approved_by_default)

1208

1388

else:

1209

logger.warning(u"Client %s was not approved",

1389

logger.warning("Client %s was not approved",

1210

1390

client.name)

1211

1391

if self.server.use_dbus:

1212

1392

# Emit D-Bus signal

1213

client.Rejected("Disapproved")

1393

client.Rejected("Denied")

1214

1394

return

1215

1395

1216

1396

#wait until timeout or approved

1217

#x = float(client._timedelta_to_milliseconds(delay))

1397

#x = float(client

1398

# ._timedelta_to_milliseconds(delay))

1218

1399

time = datetime.datetime.now()

1219

1400

client.changedstate.acquire()

1220

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1401

(client.changedstate.wait

1402

(float(client._timedelta_to_milliseconds(delay)

1403

/ 1000)))

1221

1404

client.changedstate.release()

1222

1405

time2 = datetime.datetime.now()

1223

1406

if (time2 - time) >= delay:

1227

1410

client.name)

1228

1411

if self.server.use_dbus:

1229

1412

# Emit D-Bus signal

1230

client.Rejected("Time out")

1413

client.Rejected("Approval timed out")

1231

1414

return

1232

1415

else:

1233

1416

break

1238

1421

while sent_size < len(client.secret):

1239

1422

try:

1240

1423

sent = session.send(client.secret[sent_size:])

1241

except (gnutls.errors.GNUTLSError), error:

1424

except gnutls.errors.GNUTLSError as error:

1242

1425

logger.warning("gnutls send failed")

1243

1426

return

1244

logger.debug(u"Sent: %d, remaining: %d",

1427

logger.debug("Sent: %d, remaining: %d",

1245

1428

sent, len(client.secret)

1246

1429

- (sent_size + sent))

1247

1430

sent_size += sent

1248

1249

logger.info(u"Sending secret to %s", client.name)

1431

1432

logger.info("Sending secret to %s", client.name)

1250

1433

# bump the timeout as if seen

1251

client.checked_ok()

1434

client.checked_ok(client.extended_timeout)

1252

1435

if self.server.use_dbus:

1253

1436

# Emit D-Bus signal

1254

1437

client.GotSecret()

1258

1441

client.approvals_pending -= 1

1259

1442

try:

1260

1443

session.bye()

1261

except (gnutls.errors.GNUTLSError), error:

1262

logger.warning("gnutls bye failed")

1444

except gnutls.errors.GNUTLSError as error:

1445

logger.warning("GnuTLS bye failed")

1263

1446

1264

1447

@staticmethod

1265

1448

def peer_certificate(session):

1275

1458

.gnutls_certificate_get_peers

1276

1459

(session._c_object, ctypes.byref(list_size)))

1277

1460

if not bool(cert_list) and list_size.value != 0:

1278

raise gnutls.errors.GNUTLSError(u"error getting peer"

1279

u" certificate")

1461

raise gnutls.errors.GNUTLSError("error getting peer"

1462

" certificate")

1280

1463

if list_size.value == 0:

1281

1464

return None

1282

1465

cert = cert_list[0]

1308

1491

if crtverify.value != 0:

1309

1492

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1310

1493

raise (gnutls.errors.CertificateSecurityError

1311

(u"Verify failed"))

1494

("Verify failed"))

1312

1495

# New buffer for the fingerprint

1313

1496

buf = ctypes.create_string_buffer(20)

1314

1497

buf_len = ctypes.c_size_t()

1321

1504

# Convert the buffer to a Python bytestring

1322

1505

fpr = ctypes.string_at(buf, buf_len.value)

1323

1506

# Convert the bytestring to hexadecimal notation

1324

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1325

1508

return hex_fpr

1326

1509

1327

1510

1339

1522

multiprocessing.Process(target = self.sub_process_main,

1340

1523

args = (request, address)).start()

1341

1524

1525

1342

1526

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1343

1527

""" adds a pipe to the MixIn """

1344

1528

def process_request(self, request, client_address):

1347

1531

This function creates a new pipe in self.pipe

1348

1532

"""

1349

1533

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1350

1534

1351

1535

super(MultiprocessingMixInWithPipe,

1352

1536

self).process_request(request, client_address)

1353

1537

self.child_pipe.close()

1354

1538

self.add_pipe(parent_pipe)

1355

1539

1356

1540

def add_pipe(self, parent_pipe):

1357

1541

"""Dummy function; override as necessary"""

1358

pass

1542

raise NotImplementedError

1543

1359

1544

1360

1545

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1361

1546

socketserver.TCPServer, object):

1379

1564

bind to an address or port if they were not specified."""

1380

1565

if self.interface is not None:

1381

1566

if SO_BINDTODEVICE is None:

1382

logger.error(u"SO_BINDTODEVICE does not exist;"

1383

u" cannot bind to interface %s",

1567

logger.error("SO_BINDTODEVICE does not exist;"

1568

" cannot bind to interface %s",

1384

1569

self.interface)

1385

1570

else:

1386

1571

try:

1387

1572

self.socket.setsockopt(socket.SOL_SOCKET,

1388

1573

SO_BINDTODEVICE,

1389

1574

str(self.interface

1390

+ u'\0'))

1391

except socket.error, error:

1575

+ '\0'))

1576

except socket.error as error:

1392

1577

if error[0] == errno.EPERM:

1393

logger.error(u"No permission to"

1394

u" bind to interface %s",

1578

logger.error("No permission to"

1579

" bind to interface %s",

1395

1580

self.interface)

1396

1581

elif error[0] == errno.ENOPROTOOPT:

1397

logger.error(u"SO_BINDTODEVICE not available;"

1398

u" cannot bind to interface %s",

1582

logger.error("SO_BINDTODEVICE not available;"

1583

" cannot bind to interface %s",

1399

1584

self.interface)

1400

1585

else:

1401

1586

raise

1403

1588

if self.server_address[0] or self.server_address[1]:

1404

1589

if not self.server_address[0]:

1405

1590

if self.address_family == socket.AF_INET6:

1406

any_address = u"::" # in6addr_any

1591

any_address = "::" # in6addr_any

1407

1592

else:

1408

1593

any_address = socket.INADDR_ANY

1409

1594

self.server_address = (any_address,

1453

1638

gobject.io_add_watch(parent_pipe.fileno(),

1454

1639

gobject.IO_IN | gobject.IO_HUP,

1455

1640

functools.partial(self.handle_ipc,

1456

parent_pipe = parent_pipe))

1641

parent_pipe =

1642

parent_pipe))

1457

1643

1458

1644

def handle_ipc(self, source, condition, parent_pipe=None,

1459

1645

client_object=None):

1460

1646

condition_names = {

1461

gobject.IO_IN: u"IN", # There is data to read.

1462

gobject.IO_OUT: u"OUT", # Data can be written (without

1647

gobject.IO_IN: "IN", # There is data to read.

1648

gobject.IO_OUT: "OUT", # Data can be written (without

1463

1649

# blocking).

1464

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1465

gobject.IO_ERR: u"ERR", # Error condition.

1466

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1650

gobject.IO_PRI: "PRI", # There is urgent data to read.

1651

gobject.IO_ERR: "ERR", # Error condition.

1652

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1467

1653

# broken, usually for pipes and

1468

1654

# sockets).

1469

1655

}

1471

1657

for cond, name in

1472

1658

condition_names.iteritems()

1473

1659

if cond & condition)

1474

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1475

conditions_string)

1476

1477

1660

# error or the other end of multiprocessing.Pipe has closed

1478

1661

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1479

1662

return False

1480

1663

1481

1664

# Read a request from the child

1482

1665

request = parent_pipe.recv()

1483

logger.debug(u"IPC request: %s", repr(request))

1484

1666

command = request[0]

1485

1667

1486

1668

if command == 'init':

1492

1674

client = c

1493

1675

break

1494

1676

else:

1495

logger.warning(u"Client not found for fingerprint: %s, ad"

1496

u"dress: %s", fpr, address)

1677

logger.info("Client not found for fingerprint: %s, ad"

1678

"dress: %s", fpr, address)

1497

1679

if self.use_dbus:

1498

1680

# Emit D-Bus signal

1499

mandos_dbus_service.ClientNotFound(fpr, address)

1681

mandos_dbus_service.ClientNotFound(fpr,

1682

address[0])

1500

1683

parent_pipe.send(False)

1501

1684

return False

1502

1685

1503

1686

gobject.io_add_watch(parent_pipe.fileno(),

1504

1687

gobject.IO_IN | gobject.IO_HUP,

1505

1688

functools.partial(self.handle_ipc,

1506

parent_pipe = parent_pipe,

1507

client_object = client))

1689

parent_pipe =

1690

parent_pipe,

1691

client_object =

1692

client))

1508

1693

parent_pipe.send(True)

1509

# remove the old hook in favor of the new above hook on same fileno

1694

# remove the old hook in favor of the new above hook on

1695

# same fileno

1510

1696

return False

1511

1697

if command == 'funcall':

1512

1698

funcname = request[1]

1513

1699

args = request[2]

1514

1700

kwargs = request[3]

1515

1701

1516

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1517

1702

parent_pipe.send(('data', getattr(client_object,

1703

funcname)(*args,

1704

**kwargs)))

1705

1518

1706

if command == 'getattr':

1519

1707

attrname = request[1]

1520

1708

if callable(client_object.__getattribute__(attrname)):

1521

1709

parent_pipe.send(('function',))

1522

1710

else:

1523

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1711

parent_pipe.send(('data', client_object

1712

.__getattribute__(attrname)))

1524

1713

1525

1714

if command == 'setattr':

1526

1715

attrname = request[1]

1527

1716

value = request[2]

1528

1717

setattr(client_object, attrname, value)

1529

1718

1530

1719

return True

1531

1720

1532

1721

1533

1722

def string_to_delta(interval):

1534

1723

"""Parse a string and return a datetime.timedelta

1535

1724

1536

>>> string_to_delta(u'7d')

1725

>>> string_to_delta('7d')

1537

1726

datetime.timedelta(7)

1538

>>> string_to_delta(u'60s')

1727

>>> string_to_delta('60s')

1539

1728

datetime.timedelta(0, 60)

1540

>>> string_to_delta(u'60m')

1729

>>> string_to_delta('60m')

1541

1730

datetime.timedelta(0, 3600)

1542

>>> string_to_delta(u'24h')

1731

>>> string_to_delta('24h')

1543

1732

datetime.timedelta(1)

1544

>>> string_to_delta(u'1w')

1733

>>> string_to_delta('1w')

1545

1734

datetime.timedelta(7)

1546

>>> string_to_delta(u'5m 30s')

1735

>>> string_to_delta('5m 30s')

1547

1736

datetime.timedelta(0, 330)

1548

1737

"""

1549

1738

timevalue = datetime.timedelta(0)

1551

1740

try:

1552

1741

suffix = unicode(s[-1])

1553

1742

value = int(s[:-1])

1554

if suffix == u"d":

1743

if suffix == "d":

1555

1744

delta = datetime.timedelta(value)

1556

elif suffix == u"s":

1745

elif suffix == "s":

1557

1746

delta = datetime.timedelta(0, value)

1558

elif suffix == u"m":

1747

elif suffix == "m":

1559

1748

delta = datetime.timedelta(0, 0, 0, 0, value)

1560

elif suffix == u"h":

1749

elif suffix == "h":

1561

1750

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1562

elif suffix == u"w":

1751

elif suffix == "w":

1563

1752

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1564

1753

else:

1565

raise ValueError(u"Unknown suffix %r" % suffix)

1566

except (ValueError, IndexError), e:

1567

raise ValueError(e.message)

1754

raise ValueError("Unknown suffix %r" % suffix)

1755

except (ValueError, IndexError) as e:

1756

raise ValueError(*(e.args))

1568

1757

timevalue += delta

1569

1758

return timevalue

1570

1759

1576

1765

global if_nametoindex

1577

1766

try:

1578

1767

if_nametoindex = (ctypes.cdll.LoadLibrary

1579

(ctypes.util.find_library(u"c"))

1768

(ctypes.util.find_library("c"))

1580

1769

.if_nametoindex)

1581

1770

except (OSError, AttributeError):

1582

logger.warning(u"Doing if_nametoindex the hard way")

1771

logger.warning("Doing if_nametoindex the hard way")

1583

1772

def if_nametoindex(interface):

1584

1773

"Get an interface index the hard way, i.e. using fcntl()"

1585

1774

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1586

1775

with contextlib.closing(socket.socket()) as s:

1587

1776

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1588

struct.pack(str(u"16s16x"),

1777

struct.pack(str("16s16x"),

1589

1778

interface))

1590

interface_index = struct.unpack(str(u"I"),

1779

interface_index = struct.unpack(str("I"),

1591

1780

ifreq[16:20])[0]

1592

1781

return interface_index

1593

1782

return if_nametoindex(interface)

1601

1790

sys.exit()

1602

1791

os.setsid()

1603

1792

if not nochdir:

1604

os.chdir(u"/")

1793

os.chdir("/")

1605

1794

if os.fork():

1606

1795

sys.exit()

1607

1796

if not noclose:

1609

1798

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1610

1799

if not stat.S_ISCHR(os.fstat(null).st_mode):

1611

1800

raise OSError(errno.ENODEV,

1612

u"%s not a character device"

1801

"%s not a character device"

1613

1802

% os.path.devnull)

1614

1803

os.dup2(null, sys.stdin.fileno())

1615

1804

os.dup2(null, sys.stdout.fileno())

1623

1812

##################################################################

1624

1813

# Parsing of options, both command line and config file

1625

1814

1626

parser = optparse.OptionParser(version = "%%prog %s" % version)

1627

parser.add_option("-i", u"--interface", type=u"string",

1628

metavar="IF", help=u"Bind to interface IF")

1629

parser.add_option("-a", u"--address", type=u"string",

1630

help=u"Address to listen for requests on")

1631

parser.add_option("-p", u"--port", type=u"int",

1632

help=u"Port number to receive requests on")

1633

parser.add_option("--check", action=u"store_true",

1634

help=u"Run self-test")

1635

parser.add_option("--debug", action=u"store_true",

1636

help=u"Debug mode; run in foreground and log to"

1637

u" terminal")

1638

parser.add_option("--debuglevel", type=u"string", metavar="Level",

1639

help=u"Debug level for stdout output")

1640

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1641

u" priority string (see GnuTLS documentation)")

1642

parser.add_option("--servicename", type=u"string",

1643

metavar=u"NAME", help=u"Zeroconf service name")

1644

parser.add_option("--configdir", type=u"string",

1645

default=u"/etc/mandos", metavar=u"DIR",

1646

help=u"Directory to search for configuration"

1647

u" files")

1648

parser.add_option("--no-dbus", action=u"store_false",

1649

dest=u"use_dbus", help=u"Do not provide D-Bus"

1650

u" system bus interface")

1651

parser.add_option("--no-ipv6", action=u"store_false",

1652

dest=u"use_ipv6", help=u"Do not use IPv6")

1653

options = parser.parse_args()[0]

1815

parser = argparse.ArgumentParser()

1816

parser.add_argument("-v", "--version", action="version",

1817

version = "%%(prog)s %s" % version,

1818

help="show version number and exit")

1819

parser.add_argument("-i", "--interface", metavar="IF",

1820

help="Bind to interface IF")

1821

parser.add_argument("-a", "--address",

1822

help="Address to listen for requests on")

1823

parser.add_argument("-p", "--port", type=int,

1824

help="Port number to receive requests on")

1825

parser.add_argument("--check", action="store_true",

1826

help="Run self-test")

1827

parser.add_argument("--debug", action="store_true",

1828

help="Debug mode; run in foreground and log"

1829

" to terminal")

1830

parser.add_argument("--debuglevel", metavar="LEVEL",

1831

help="Debug level for stdout output")

1832

parser.add_argument("--priority", help="GnuTLS"

1833

" priority string (see GnuTLS documentation)")

1834

parser.add_argument("--servicename",

1835

metavar="NAME", help="Zeroconf service name")

1836

parser.add_argument("--configdir",

1837

default="/etc/mandos", metavar="DIR",

1838

help="Directory to search for configuration"

1839

" files")

1840

parser.add_argument("--no-dbus", action="store_false",

1841

dest="use_dbus", help="Do not provide D-Bus"

1842

" system bus interface")

1843

parser.add_argument("--no-ipv6", action="store_false",

1844

dest="use_ipv6", help="Do not use IPv6")

1845

options = parser.parse_args()

1654

1846

1655

1847

if options.check:

1656

1848

import doctest

1658

1850

sys.exit()

1659

1851

1660

1852

# Default values for config file for server-global settings

1661

server_defaults = { u"interface": u"",

1662

u"address": u"",

1663

u"port": u"",

1664

u"debug": u"False",

1665

u"priority":

1666

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1667

u"servicename": u"Mandos",

1668

u"use_dbus": u"True",

1669

u"use_ipv6": u"True",

1670

u"debuglevel": u"",

1853

server_defaults = { "interface": "",

1854

"address": "",

1855

"port": "",

1856

"debug": "False",

1857

"priority":

1858

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1859

"servicename": "Mandos",

1860

"use_dbus": "True",

1861

"use_ipv6": "True",

1862

"debuglevel": "",

1671

1863

}

1672

1864

1673

1865

# Parse config file for server-global settings

1674

1866

server_config = configparser.SafeConfigParser(server_defaults)

1675

1867

del server_defaults

1676

1868

server_config.read(os.path.join(options.configdir,

1677

u"mandos.conf"))

1869

"mandos.conf"))

1678

1870

# Convert the SafeConfigParser object to a dict

1679

1871

server_settings = server_config.defaults()

1680

1872

# Use the appropriate methods on the non-string config options

1681

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1682

server_settings[option] = server_config.getboolean(u"DEFAULT",

1873

for option in ("debug", "use_dbus", "use_ipv6"):

1874

server_settings[option] = server_config.getboolean("DEFAULT",

1683

1875

option)

1684

1876

if server_settings["port"]:

1685

server_settings["port"] = server_config.getint(u"DEFAULT",

1686

u"port")

1877

server_settings["port"] = server_config.getint("DEFAULT",

1878

"port")

1687

1879

del server_config

1688

1880

1689

1881

# Override the settings from the config file with command line

1690

1882

# options, if set.

1691

for option in (u"interface", u"address", u"port", u"debug",

1692

u"priority", u"servicename", u"configdir",

1693

u"use_dbus", u"use_ipv6", u"debuglevel"):

1883

for option in ("interface", "address", "port", "debug",

1884

"priority", "servicename", "configdir",

1885

"use_dbus", "use_ipv6", "debuglevel"):

1694

1886

value = getattr(options, option)

1695

1887

if value is not None:

1696

1888

server_settings[option] = value

1704

1896

##################################################################

1705

1897

1706

1898

# For convenience

1707

debug = server_settings[u"debug"]

1708

debuglevel = server_settings[u"debuglevel"]

1709

use_dbus = server_settings[u"use_dbus"]

1710

use_ipv6 = server_settings[u"use_ipv6"]

1711

1712

if server_settings[u"servicename"] != u"Mandos":

1899

debug = server_settings["debug"]

1900

debuglevel = server_settings["debuglevel"]

1901

use_dbus = server_settings["use_dbus"]

1902

use_ipv6 = server_settings["use_ipv6"]

1903

1904

if server_settings["servicename"] != "Mandos":

1713

1905

syslogger.setFormatter(logging.Formatter

1714

(u'Mandos (%s) [%%(process)d]:'

1715

u' %%(levelname)s: %%(message)s'

1716

% server_settings[u"servicename"]))

1906

('Mandos (%s) [%%(process)d]:'

1907

' %%(levelname)s: %%(message)s'

1908

% server_settings["servicename"]))

1717

1909

1718

1910

# Parse config file with clients

1719

client_defaults = { u"timeout": u"1h",

1720

u"interval": u"5m",

1721

u"checker": u"fping -q -- %%(host)s",

1722

u"host": u"",

1723

u"approved_delay": u"0s",

1724

u"approved_duration": u"1s",

1911

client_defaults = { "timeout": "5m",

1912

"extended_timeout": "15m",

1913

"interval": "2m",

1914

"checker": "fping -q -- %%(host)s",

1915

"host": "",

1916

"approval_delay": "0s",

1917

"approval_duration": "1s",

1725

1918

}

1726

1919

client_config = configparser.SafeConfigParser(client_defaults)

1727

client_config.read(os.path.join(server_settings[u"configdir"],

1728

u"clients.conf"))

1920

client_config.read(os.path.join(server_settings["configdir"],

1921

"clients.conf"))

1729

1922

1730

1923

global mandos_dbus_service

1731

1924

mandos_dbus_service = None

1732

1925

1733

tcp_server = MandosServer((server_settings[u"address"],

1734

server_settings[u"port"]),

1926

tcp_server = MandosServer((server_settings["address"],

1927

server_settings["port"]),

1735

1928

ClientHandler,

1736

interface=server_settings[u"interface"],

1929

interface=(server_settings["interface"]

1930

or None),

1737

1931

use_ipv6=use_ipv6,

1738

1932

gnutls_priority=

1739

server_settings[u"priority"],

1933

server_settings["priority"],

1740

1934

use_dbus=use_dbus)

1741

pidfilename = u"/var/run/mandos.pid"

1742

try:

1743

pidfile = open(pidfilename, u"w")

1744

except IOError:

1745

logger.error(u"Could not open file %r", pidfilename)

1935

if not debug:

1936

pidfilename = "/var/run/mandos.pid"

1937

try:

1938

pidfile = open(pidfilename, "w")

1939

except IOError:

1940

logger.error("Could not open file %r", pidfilename)

1746

1941

1747

1942

try:

1748

uid = pwd.getpwnam(u"_mandos").pw_uid

1749

gid = pwd.getpwnam(u"_mandos").pw_gid

1943

uid = pwd.getpwnam("_mandos").pw_uid

1944

gid = pwd.getpwnam("_mandos").pw_gid

1750

1945

except KeyError:

1751

1946

try:

1752

uid = pwd.getpwnam(u"mandos").pw_uid

1753

gid = pwd.getpwnam(u"mandos").pw_gid

1947

uid = pwd.getpwnam("mandos").pw_uid

1948

gid = pwd.getpwnam("mandos").pw_gid

1754

1949

except KeyError:

1755

1950

try:

1756

uid = pwd.getpwnam(u"nobody").pw_uid

1757

gid = pwd.getpwnam(u"nobody").pw_gid

1951

uid = pwd.getpwnam("nobody").pw_uid

1952

gid = pwd.getpwnam("nobody").pw_gid

1758

1953

except KeyError:

1759

1954

uid = 65534

1760

1955

gid = 65534

1761

1956

try:

1762

1957

os.setgid(gid)

1763

1958

os.setuid(uid)

1764

except OSError, error:

1959

except OSError as error:

1765

1960

if error[0] != errno.EPERM:

1766

1961

raise error

1767

1962

1768

# Enable all possible GnuTLS debugging

1769

1770

1771

1963

if not debug and not debuglevel:

1772

1964

syslogger.setLevel(logging.WARNING)

1773

1965

console.setLevel(logging.WARNING)

1775

1967

level = getattr(logging, debuglevel.upper())

1776

1968

syslogger.setLevel(level)

1777

1969

console.setLevel(level)

1778

1970

1779

1971

if debug:

1972

# Enable all possible GnuTLS debugging

1973

1780

1974

# "Use a log level over 10 to enable all debugging options."

1781

1975

# - GnuTLS manual

1782

1976

gnutls.library.functions.gnutls_global_set_log_level(11)

1783

1977

1784

1978

@gnutls.library.types.gnutls_log_func

1785

1979

def debug_gnutls(level, string):

1786

logger.debug(u"GnuTLS: %s", string[:-1])

1980

logger.debug("GnuTLS: %s", string[:-1])

1787

1981

1788

1982

(gnutls.library.functions

1789

1983

.gnutls_global_set_log_function(debug_gnutls))

1790

1984

1791

1985

# Redirect stdin so all checkers get /dev/null

1792

1986

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1793

1987

os.dup2(null, sys.stdin.fileno())

1796

1990

else:

1797

1991

# No console logging

1798

1992

logger.removeHandler(console)

1799

1993

1994

# Need to fork before connecting to D-Bus

1995

if not debug:

1996

# Close all input and output, do double fork, etc.

1997

daemon()

1800

1998

1801

1999

global main_loop

1802

2000

# From the Avahi example code

1806

2004

# End of Avahi example code

1807

2005

if use_dbus:

1808

2006

try:

1809

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2007

bus_name = dbus.service.BusName("se.recompile.Mandos",

1810

2008

bus, do_not_queue=True)

1811

except dbus.exceptions.NameExistsException, e:

1812

logger.error(unicode(e) + u", disabling D-Bus")

2009

old_bus_name = (dbus.service.BusName

2010

("se.bsnet.fukt.Mandos", bus,

2011

do_not_queue=True))

2012

except dbus.exceptions.NameExistsException as e:

2013

logger.error(unicode(e) + ", disabling D-Bus")

1813

2014

use_dbus = False

1814

server_settings[u"use_dbus"] = False

2015

server_settings["use_dbus"] = False

1815

2016

tcp_server.use_dbus = False

1816

2017

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1817

service = AvahiService(name = server_settings[u"servicename"],

1818

servicetype = u"_mandos._tcp",

2018

service = AvahiService(name = server_settings["servicename"],

2019

servicetype = "_mandos._tcp",

1819

2020

protocol = protocol, bus = bus)

1820

2021

if server_settings["interface"]:

1821

2022

service.interface = (if_nametoindex

1822

(str(server_settings[u"interface"])))

1823

1824

if not debug:

1825

# Close all input and output, do double fork, etc.

1826

daemon()

1827

2023

(str(server_settings["interface"])))

2024

1828

2025

global multiprocessing_manager

1829

2026

multiprocessing_manager = multiprocessing.Manager()

1830

2027

1831

2028

client_class = Client

1832

2029

if use_dbus:

1833

client_class = functools.partial(ClientDBus, bus = bus)

2030

client_class = functools.partial(ClientDBusTransitional,

2031

bus = bus)

1834

2032

def client_config_items(config, section):

1835

2033

special_settings = {

1836

2034

"approved_by_default":

1849

2047

client_config, section)))

1850

2048

for section in client_config.sections()))

1851

2049

if not tcp_server.clients:

1852

logger.warning(u"No clients defined")

2050

logger.warning("No clients defined")

1853

2051

1854

try:

1855

with pidfile:

1856

pid = os.getpid()

1857

pidfile.write(str(pid) + "\n")

1858

del pidfile

1859

except IOError:

1860

logger.error(u"Could not write to file %r with PID %d",

1861

pidfilename, pid)

1862

except NameError:

1863

# "pidfile" was never created

1864

pass

1865

del pidfilename

1866

1867

2052

if not debug:

2053

try:

2054

with pidfile:

2055

pid = os.getpid()

2056

pidfile.write(str(pid) + "\n".encode("utf-8"))

2057

del pidfile

2058

except IOError:

2059

logger.error("Could not write to file %r with PID %d",

2060

pidfilename, pid)

2061

except NameError:

2062

# "pidfile" was never created

2063

pass

2064

del pidfilename

2065

1868

2066

signal.signal(signal.SIGINT, signal.SIG_IGN)

2067

1869

2068

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1870

2069

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1871

2070

1873

2072

class MandosDBusService(dbus.service.Object):

1874

2073

"""A D-Bus proxy object"""

1875

2074

def __init__(self):

1876

dbus.service.Object.__init__(self, bus, u"/")

1877

_interface = u"se.bsnet.fukt.Mandos"

2075

dbus.service.Object.__init__(self, bus, "/")

2076

_interface = "se.recompile.Mandos"

1878

2077

1879

@dbus.service.signal(_interface, signature=u"o")

2078

@dbus.service.signal(_interface, signature="o")

1880

2079

def ClientAdded(self, objpath):

1881

2080

"D-Bus signal"

1882

2081

pass

1883

2082

1884

@dbus.service.signal(_interface, signature=u"ss")

2083

@dbus.service.signal(_interface, signature="ss")

1885

2084

def ClientNotFound(self, fingerprint, address):

1886

2085

"D-Bus signal"

1887

2086

pass

1888

2087

1889

@dbus.service.signal(_interface, signature=u"os")

2088

@dbus.service.signal(_interface, signature="os")

1890

2089

def ClientRemoved(self, objpath, name):

1891

2090

"D-Bus signal"

1892

2091

pass

1893

2092

1894

@dbus.service.method(_interface, out_signature=u"ao")

2093

@dbus.service.method(_interface, out_signature="ao")

1895

2094

def GetAllClients(self):

1896

2095

"D-Bus method"

1897

2096

return dbus.Array(c.dbus_object_path

1898

2097

for c in tcp_server.clients)

1899

2098

1900

2099

@dbus.service.method(_interface,

1901

out_signature=u"a{oa{sv}}")

2100

out_signature="a{oa{sv}}")

1902

2101

def GetAllClientsWithProperties(self):

1903

2102

"D-Bus method"

1904

2103

return dbus.Dictionary(

1905

((c.dbus_object_path, c.GetAll(u""))

2104

((c.dbus_object_path, c.GetAll(""))

1906

2105

for c in tcp_server.clients),

1907

signature=u"oa{sv}")

2106

signature="oa{sv}")

1908

2107

1909

@dbus.service.method(_interface, in_signature=u"o")

2108

@dbus.service.method(_interface, in_signature="o")

1910

2109

def RemoveClient(self, object_path):

1911

2110

"D-Bus method"

1912

2111

for c in tcp_server.clients:

1922

2121

1923

2122

del _interface

1924

2123

1925

mandos_dbus_service = MandosDBusService()

2124

class MandosDBusServiceTransitional(MandosDBusService):

2125

__metaclass__ = AlternateDBusNamesMetaclass

2126

mandos_dbus_service = MandosDBusServiceTransitional()

1926

2127

1927

2128

def cleanup():

1928

2129

"Cleanup function; run on exit"

1937

2138

client.disable(quiet=True)

1938

2139

if use_dbus:

1939

2140

# Emit D-Bus signal

1940

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2141

mandos_dbus_service.ClientRemoved(client

2142

.dbus_object_path,

1941

2143

client.name)

1942

2144

1943

2145

atexit.register(cleanup)

1954

2156

# Find out what port we got

1955

2157

service.port = tcp_server.socket.getsockname()[1]

1956

2158

if use_ipv6:

1957

logger.info(u"Now listening on address %r, port %d,"

2159

logger.info("Now listening on address %r, port %d,"

1958

2160

" flowinfo %d, scope_id %d"

1959

2161

% tcp_server.socket.getsockname())

1960

2162

else: # IPv4

1961

logger.info(u"Now listening on address %r, port %d"

2163

logger.info("Now listening on address %r, port %d"

1962

2164

% tcp_server.socket.getsockname())

1963

2165

1964

2166

#service.interface = tcp_server.socket.getsockname()[3]

1967

2169

# From the Avahi example code

1968

2170

try:

1969

2171

service.activate()

1970

except dbus.exceptions.DBusException, error:

1971

logger.critical(u"DBusException: %s", error)

2172

except dbus.exceptions.DBusException as error:

2173

logger.critical("DBusException: %s", error)

1972

2174

cleanup()

1973

2175

sys.exit(1)

1974

2176

# End of Avahi example code

1978

2180

(tcp_server.handle_request

1979

2181

(*args[2:], **kwargs) or True))

1980

2182

1981

logger.debug(u"Starting main loop")

2183

logger.debug("Starting main loop")

1982

2184

main_loop.run()

1983

except AvahiError, error:

1984

logger.critical(u"AvahiError: %s", error)

2185

except AvahiError as error:

2186

logger.critical("AvahiError: %s", error)

1985

2187

cleanup()

1986

2188

sys.exit(1)

1987

2189

except KeyboardInterrupt:

1988

2190

if debug:

1989

print >> sys.stderr

1990

logger.debug(u"Server received KeyboardInterrupt")

1991

logger.debug(u"Server exiting")

2191

print("", file=sys.stderr)

2192

logger.debug("Server received KeyboardInterrupt")

2193

logger.debug("Server exiting")

1992

2194

# Must run before the D-Bus bus name gets deregistered

1993

2195

cleanup()

1994

2196

2197

1995

2198

if __name__ == '__main__':

1996

2199

main()