/mandos/trunk : revision 505.3.10

11

# "AvahiService" class, and some lines in "main".

12

#

13

# Everything else is

14

15

14

15

16

#

17

# This program is free software: you can redistribute it and/or modify

18

# it under the terms of the GNU General Public License as published by

28

# along with this program. If not, see

29

# <http://www.gnu.org/licenses/>.

30

#

31

# Contact the authors at <mandos@fukt.bsnet.se>.

31

# Contact the authors at <mandos@recompile.se>.

32

#

33

34

from __future__ import division, with_statement, absolute_import

34

from __future__ import (division, absolute_import, print_function,

35

unicode_literals)

35

36

37

import SocketServer as socketserver

37

38

import socket

38

import optparse

39

import argparse

39

40

import datetime

40

41

import errno

41

42

import gnutls.crypto

61

62

import functools

62

63

import cPickle as pickle

63

64

import multiprocessing

65

import types

64

66

65

67

import dbus

66

68

import dbus.service

81

83

SO_BINDTODEVICE = None

82

84

83

85

84

version = "1.0.14"

86

version = "1.4.1"

85

87

86

#logger = logging.getLogger(u'mandos')

87

logger = logging.Logger(u'mandos')

88

#logger = logging.getLogger('mandos')

89

logger = logging.Logger('mandos')

88

90

syslogger = (logging.handlers.SysLogHandler

89

91

(facility = logging.handlers.SysLogHandler.LOG_DAEMON,

90

address = "/dev/log"))

92

address = str("/dev/log")))

91

93

syslogger.setFormatter(logging.Formatter

92

(u'Mandos [%(process)d]: %(levelname)s:'

93

u' %(message)s'))

94

('Mandos [%(process)d]: %(levelname)s:'

95

' %(message)s'))

94

96

logger.addHandler(syslogger)

95

97

96

98

console = logging.StreamHandler()

97

console.setFormatter(logging.Formatter(u'%(name)s [%(process)d]:'

98

u' %(levelname)s:'

99

u' %(message)s'))

99

console.setFormatter(logging.Formatter('%(name)s [%(process)d]:'

100

' %(levelname)s:'

101

' %(message)s'))

100

102

logger.addHandler(console)

101

103

102

104

class AvahiError(Exception):

119

121

Attributes:

120

122

interface: integer; avahi.IF_UNSPEC or an interface index.

121

123

Used to optionally bind to the specified interface.

122

123

type: string; Example: u'_mandos._tcp'.

124

125

type: string; Example: '_mandos._tcp'.

124

126

See <http://www.dns-sd.org/ServiceTypes.html>

125

127

port: integer; what port to announce

126

128

TXT: list of strings; TXT record for the service

135

137

"""

136

138

def __init__(self, interface = avahi.IF_UNSPEC, name = None,

137

139

servicetype = None, port = None, TXT = None,

138

domain = u"", host = u"", max_renames = 32768,

140

domain = "", host = "", max_renames = 32768,

139

141

protocol = avahi.PROTO_UNSPEC, bus = None):

140

142

self.interface = interface

141

143

self.name = name

150

152

self.group = None # our entry group

151

153

self.server = None

152

154

self.bus = bus

155

self.entry_group_state_changed_match = None

153

156

def rename(self):

154

157

"""Derived from the Avahi example code"""

155

158

if self.rename_count >= self.max_renames:

156

logger.critical(u"No suitable Zeroconf service name found"

157

u" after %i retries, exiting.",

159

logger.critical("No suitable Zeroconf service name found"

160

" after %i retries, exiting.",

158

161

self.rename_count)

159

raise AvahiServiceError(u"Too many renames")

160

self.name = self.server.GetAlternativeServiceName(self.name)

161

logger.info(u"Changing Zeroconf service name to %r ...",

162

unicode(self.name))

162

raise AvahiServiceError("Too many renames")

163

self.name = unicode(self.server

164

.GetAlternativeServiceName(self.name))

165

logger.info("Changing Zeroconf service name to %r ...",

166

self.name)

163

167

syslogger.setFormatter(logging.Formatter

164

(u'Mandos (%s) [%%(process)d]:'

165

u' %%(levelname)s: %%(message)s'

168

('Mandos (%s) [%%(process)d]:'

169

' %%(levelname)s: %%(message)s'

166

170

% self.name))

167

171

self.remove()

168

self.add()

172

try:

173

self.add()

174

except dbus.exceptions.DBusException as error:

175

logger.critical("DBusException: %s", error)

176

self.cleanup()

177

os._exit(1)

169

178

self.rename_count += 1

170

179

def remove(self):

171

180

"""Derived from the Avahi example code"""

181

if self.entry_group_state_changed_match is not None:

182

self.entry_group_state_changed_match.remove()

183

self.entry_group_state_changed_match = None

172

184

if self.group is not None:

173

185

self.group.Reset()

174

186

def add(self):

175

187

"""Derived from the Avahi example code"""

188

self.remove()

176

189

if self.group is None:

177

190

self.group = dbus.Interface(

178

191

self.bus.get_object(avahi.DBUS_NAME,

179

192

self.server.EntryGroupNew()),

180

193

avahi.DBUS_INTERFACE_ENTRY_GROUP)

181

self.group.connect_to_signal('StateChanged',

182

self

183

.entry_group_state_changed)

184

logger.debug(u"Adding Zeroconf service '%s' of type '%s' ...",

194

self.entry_group_state_changed_match = (

195

self.group.connect_to_signal(

196

'StateChanged', self .entry_group_state_changed))

197

logger.debug("Adding Zeroconf service '%s' of type '%s' ...",

185

198

self.name, self.type)

186

199

self.group.AddService(

187

200

self.interface,

194

207

self.group.Commit()

195

208

def entry_group_state_changed(self, state, error):

196

209

"""Derived from the Avahi example code"""

197

logger.debug(u"Avahi state change: %i", state)

210

logger.debug("Avahi entry group state change: %i", state)

198

211

199

212

if state == avahi.ENTRY_GROUP_ESTABLISHED:

200

logger.debug(u"Zeroconf service established.")

213

logger.debug("Zeroconf service established.")

201

214

elif state == avahi.ENTRY_GROUP_COLLISION:

202

logger.warning(u"Zeroconf service name collision.")

215

logger.info("Zeroconf service name collision.")

203

216

self.rename()

204

217

elif state == avahi.ENTRY_GROUP_FAILURE:

205

logger.critical(u"Avahi: Error in group state changed %s",

218

logger.critical("Avahi: Error in group state changed %s",

206

219

unicode(error))

207

raise AvahiGroupError(u"State changed: %s"

220

raise AvahiGroupError("State changed: %s"

208

221

% unicode(error))

209

222

def cleanup(self):

210

223

"""Derived from the Avahi example code"""

211

224

if self.group is not None:

212

self.group.Free()

225

try:

226

self.group.Free()

227

except (dbus.exceptions.UnknownMethodException,

228

dbus.exceptions.DBusException) as e:

229

pass

213

230

self.group = None

214

def server_state_changed(self, state):

231

self.remove()

232

def server_state_changed(self, state, error=None):

215

233

"""Derived from the Avahi example code"""

216

if state == avahi.SERVER_COLLISION:

217

logger.error(u"Zeroconf server name collision")

218

self.remove()

234

logger.debug("Avahi server state change: %i", state)

235

bad_states = { avahi.SERVER_INVALID:

236

"Zeroconf server invalid",

237

avahi.SERVER_REGISTERING: None,

238

avahi.SERVER_COLLISION:

239

"Zeroconf server name collision",

240

avahi.SERVER_FAILURE:

241

"Zeroconf server failure" }

242

if state in bad_states:

243

if bad_states[state] is not None:

244

if error is None:

245

logger.error(bad_states[state])

246

else:

247

logger.error(bad_states[state] + ": %r", error)

248

self.cleanup()

219

249

elif state == avahi.SERVER_RUNNING:

220

250

self.add()

251

else:

252

if error is None:

253

logger.debug("Unknown state: %r", state)

254

else:

255

logger.debug("Unknown state: %r: %r", state, error)

221

256

def activate(self):

222

257

"""Derived from the Avahi example code"""

223

258

if self.server is None:

224

259

self.server = dbus.Interface(

225

260

self.bus.get_object(avahi.DBUS_NAME,

226

avahi.DBUS_PATH_SERVER),

261

avahi.DBUS_PATH_SERVER,

262

follow_name_owner_changes=True),

227

263

avahi.DBUS_INTERFACE_SERVER)

228

self.server.connect_to_signal(u"StateChanged",

264

self.server.connect_to_signal("StateChanged",

229

265

self.server_state_changed)

230

266

self.server_state_changed(self.server.GetState())

231

267

232

268

269

def _timedelta_to_milliseconds(td):

270

"Convert a datetime.timedelta() to milliseconds"

271

return ((td.days * 24 * 60 * 60 * 1000)

272

+ (td.seconds * 1000)

273

+ (td.microseconds // 1000))

274

233

275

class Client(object):

234

276

"""A representation of a client host served by this server.

235

277

236

278

Attributes:

237

238

D-Bus identifiers

279

_approved: bool(); 'None' if not yet approved/disapproved

280

approval_delay: datetime.timedelta(); Time to wait for approval

281

approval_duration: datetime.timedelta(); Duration of one approval

282

checker: subprocess.Popen(); a running checker process used

283

to see if the client lives.

284

'None' if no process is running.

285

checker_callback_tag: a gobject event source tag, or None

286

checker_command: string; External command which is run to check

287

if client lives. %() expansions are done at

288

runtime with vars(self) as dict, so that for

289

instance %(name)s can be used in the command.

290

checker_initiator_tag: a gobject event source tag, or None

291

created: datetime.datetime(); (UTC) object creation

292

current_checker_command: string; current running checker_command

293

disable_hook: If set, called by disable() as disable_hook(self)

294

disable_initiator_tag: a gobject event source tag, or None

295

enabled: bool()

239

296

fingerprint: string (40 or 32 hexadecimal digits); used to

240

297

uniquely identify the client

241

secret: bytestring; sent verbatim (over TLS) to client

242

298

host: string; available for use by the checker command

243

created: datetime.datetime(); (UTC) object creation

299

interval: datetime.timedelta(); How often to start a new checker

300

last_approval_request: datetime.datetime(); (UTC) or None

301

last_checked_ok: datetime.datetime(); (UTC) or None

244

302

last_enabled: datetime.datetime(); (UTC)

245

enabled: bool()

246

last_checked_ok: datetime.datetime(); (UTC) or None

303

304

D-Bus identifiers

305

secret: bytestring; sent verbatim (over TLS) to client

247

306

timeout: datetime.timedelta(); How long from last_checked_ok

248

307

until this client is disabled

249

interval: datetime.timedelta(); How often to start a new checker

250

disable_hook: If set, called by disable() as disable_hook(self)

251

checker: subprocess.Popen(); a running checker process used

252

to see if the client lives.

253

'None' if no process is running.

254

checker_initiator_tag: a gobject event source tag, or None

255

disable_initiator_tag: - '' -

256

checker_callback_tag: - '' -

257

checker_command: string; External command which is run to check if

258

client lives. %() expansions are done at

259

runtime with vars(self) as dict, so that for

260

instance %(name)s can be used in the command.

261

current_checker_command: string; current running checker_command

262

approved_delay: datetime.timedelta(); Time to wait for approval

263

_approved: bool(); 'None' if not yet approved/disapproved

264

approved_duration: datetime.timedelta(); Duration of one approval

308

extended_timeout: extra long timeout when password has been sent

309

runtime_expansions: Allowed attributes for runtime expansion.

310

expires: datetime.datetime(); time (UTC) when a client will be

311

disabled, or None

265

312

"""

266

313

267

@staticmethod

268

def _timedelta_to_milliseconds(td):

269

"Convert a datetime.timedelta() to milliseconds"

270

return ((td.days * 24 * 60 * 60 * 1000)

271

+ (td.seconds * 1000)

272

+ (td.microseconds // 1000))

314

runtime_expansions = ("approval_delay", "approval_duration",

315

"created", "enabled", "fingerprint",

316

"host", "interval", "last_checked_ok",

317

"last_enabled", "name", "timeout")

273

318

274

319

def timeout_milliseconds(self):

275

320

"Return the 'timeout' attribute in milliseconds"

276

return self._timedelta_to_milliseconds(self.timeout)

321

return _timedelta_to_milliseconds(self.timeout)

322

323

def extended_timeout_milliseconds(self):

324

"Return the 'extended_timeout' attribute in milliseconds"

325

return _timedelta_to_milliseconds(self.extended_timeout)

277

326

278

327

def interval_milliseconds(self):

279

328

"Return the 'interval' attribute in milliseconds"

280

return self._timedelta_to_milliseconds(self.interval)

281

282

def approved_delay_milliseconds(self):

283

return self._timedelta_to_milliseconds(self.approved_delay)

329

return _timedelta_to_milliseconds(self.interval)

330

331

def approval_delay_milliseconds(self):

332

return _timedelta_to_milliseconds(self.approval_delay)

284

333

285

334

def __init__(self, name = None, disable_hook=None, config=None):

286

335

"""Note: the 'checker' key in 'config' sets the

289

338

self.name = name

290

339

if config is None:

291

340

config = {}

292

logger.debug(u"Creating client %r", self.name)

341

logger.debug("Creating client %r", self.name)

293

342

# Uppercase and remove spaces from fingerprint for later

294

343

# comparison purposes with return value from the fingerprint()

295

344

# function

296

self.fingerprint = (config[u"fingerprint"].upper()

297

.replace(u" ", u""))

298

logger.debug(u" Fingerprint: %s", self.fingerprint)

299

if u"secret" in config:

300

self.secret = config[u"secret"].decode(u"base64")

301

elif u"secfile" in config:

345

self.fingerprint = (config["fingerprint"].upper()

346

.replace(" ", ""))

347

logger.debug(" Fingerprint: %s", self.fingerprint)

348

if "secret" in config:

349

self.secret = config["secret"].decode("base64")

350

elif "secfile" in config:

302

351

with open(os.path.expanduser(os.path.expandvars

303

(config[u"secfile"])),

352

(config["secfile"])),

304

353

"rb") as secfile:

305

354

self.secret = secfile.read()

306

355

else:

307

#XXX Need to allow secret on demand!

308

raise TypeError(u"No secret or secfile for client %s"

356

raise TypeError("No secret or secfile for client %s"

309

357

% self.name)

310

self.host = config.get(u"host", u"")

358

self.host = config.get("host", "")

311

359

self.created = datetime.datetime.utcnow()

312

360

self.enabled = False

361

self.last_approval_request = None

313

362

self.last_enabled = None

314

363

self.last_checked_ok = None

315

self.timeout = string_to_delta(config[u"timeout"])

316

self.interval = string_to_delta(config[u"interval"])

364

self.timeout = string_to_delta(config["timeout"])

365

self.extended_timeout = string_to_delta(config

366

["extended_timeout"])

367

self.interval = string_to_delta(config["interval"])

317

368

self.disable_hook = disable_hook

318

369

self.checker = None

319

370

self.checker_initiator_tag = None

320

371

self.disable_initiator_tag = None

372

self.expires = None

321

373

self.checker_callback_tag = None

322

self.checker_command = config[u"checker"]

374

self.checker_command = config["checker"]

323

375

self.current_checker_command = None

324

376

self.last_connect = None

325

377

self._approved = None

326

self.approved_by_default = config.get(u"approved_by_default",

378

self.approved_by_default = config.get("approved_by_default",

327

379

True)

328

380

self.approvals_pending = 0

329

self.approved_delay = string_to_delta(

330

config[u"approved_delay"])

331

self.approved_duration = string_to_delta(

332

config[u"approved_duration"])

333

self.changedstate = multiprocessing_manager.Condition(multiprocessing_manager.Lock())

381

self.approval_delay = string_to_delta(

382

config["approval_delay"])

383

self.approval_duration = string_to_delta(

384

config["approval_duration"])

385

self.changedstate = (multiprocessing_manager

386

.Condition(multiprocessing_manager

387

.Lock()))

334

388

335

389

def send_changedstate(self):

336

390

self.changedstate.acquire()

337

391

self.changedstate.notify_all()

338

392

self.changedstate.release()

339

393

340

394

def enable(self):

341

395

"""Start this client's checker and timeout hooks"""

342

if getattr(self, u"enabled", False):

396

if getattr(self, "enabled", False):

343

397

# Already enabled

344

398

return

345

399

self.send_changedstate()

346

self.last_enabled = datetime.datetime.utcnow()

347

400

# Schedule a new checker to be started an 'interval' from now,

348

401

# and every interval from then on.

349

402

self.checker_initiator_tag = (gobject.timeout_add

350

403

(self.interval_milliseconds(),

351

404

self.start_checker))

352

405

# Schedule a disable() when 'timeout' has passed

406

self.expires = datetime.datetime.utcnow() + self.timeout

353

407

self.disable_initiator_tag = (gobject.timeout_add

354

408

(self.timeout_milliseconds(),

355

409

self.disable))

356

410

self.enabled = True

411

self.last_enabled = datetime.datetime.utcnow()

357

412

# Also start a new checker *right now*.

358

413

self.start_checker()

359

414

364

419

if not quiet:

365

420

self.send_changedstate()

366

421

if not quiet:

367

logger.info(u"Disabling client %s", self.name)

368

if getattr(self, u"disable_initiator_tag", False):

422

logger.info("Disabling client %s", self.name)

423

if getattr(self, "disable_initiator_tag", False):

369

424

gobject.source_remove(self.disable_initiator_tag)

370

425

self.disable_initiator_tag = None

371

if getattr(self, u"checker_initiator_tag", False):

426

self.expires = None

427

if getattr(self, "checker_initiator_tag", False):

372

428

gobject.source_remove(self.checker_initiator_tag)

373

429

self.checker_initiator_tag = None

374

430

self.stop_checker()

389

445

if os.WIFEXITED(condition):

390

446

exitstatus = os.WEXITSTATUS(condition)

391

447

if exitstatus == 0:

392

logger.info(u"Checker for %(name)s succeeded",

448

logger.info("Checker for %(name)s succeeded",

393

449

vars(self))

394

450

self.checked_ok()

395

451

else:

396

logger.info(u"Checker for %(name)s failed",

452

logger.info("Checker for %(name)s failed",

397

453

vars(self))

398

454

else:

399

logger.warning(u"Checker for %(name)s crashed?",

455

logger.warning("Checker for %(name)s crashed?",

400

456

vars(self))

401

457

402

def checked_ok(self):

458

def checked_ok(self, timeout=None):

403

459

"""Bump up the timeout for this client.

404

460

405

461

This should only be called when the client has been seen,

406

462

alive and well.

407

463

"""

464

if timeout is None:

465

timeout = self.timeout

408

466

self.last_checked_ok = datetime.datetime.utcnow()

409

gobject.source_remove(self.disable_initiator_tag)

410

self.disable_initiator_tag = (gobject.timeout_add

411

(self.timeout_milliseconds(),

412

self.disable))

467

if self.disable_initiator_tag is not None:

468

gobject.source_remove(self.disable_initiator_tag)

469

if getattr(self, "enabled", False):

470

self.disable_initiator_tag = (gobject.timeout_add

471

(_timedelta_to_milliseconds

472

(timeout), self.disable))

473

self.expires = datetime.datetime.utcnow() + timeout

474

475

def need_approval(self):

476

self.last_approval_request = datetime.datetime.utcnow()

413

477

414

478

def start_checker(self):

415

479

"""Start a new checker subprocess if one is not running.

428

492

# If a checker exists, make sure it is not a zombie

429

493

try:

430

494

pid, status = os.waitpid(self.checker.pid, os.WNOHANG)

431

except (AttributeError, OSError), error:

495

except (AttributeError, OSError) as error:

432

496

if (isinstance(error, OSError)

433

497

and error.errno != errno.ECHILD):

434

498

raise error

435

499

else:

436

500

if pid:

437

logger.warning(u"Checker was a zombie")

501

logger.warning("Checker was a zombie")

438

502

gobject.source_remove(self.checker_callback_tag)

439

503

self.checker_callback(pid, status,

440

504

self.current_checker_command)

445

509

command = self.checker_command % self.host

446

510

except TypeError:

447

511

# Escape attributes for the shell

448

escaped_attrs = dict((key,

449

re.escape(unicode(str(val),

450

errors=

451

u'replace')))

452

for key, val in

453

vars(self).iteritems())

512

escaped_attrs = dict(

513

(attr,

514

re.escape(unicode(str(getattr(self, attr, "")),

515

errors=

516

'replace')))

517

for attr in

518

self.runtime_expansions)

519

454

520

try:

455

521

command = self.checker_command % escaped_attrs

456

except TypeError, error:

457

logger.error(u'Could not format string "%s":'

458

u' %s', self.checker_command, error)

522

except TypeError as error:

523

logger.error('Could not format string "%s":'

524

' %s', self.checker_command, error)

459

525

return True # Try again later

460

526

self.current_checker_command = command

461

527

try:

462

logger.info(u"Starting checker %r for %s",

528

logger.info("Starting checker %r for %s",

463

529

command, self.name)

464

530

# We don't need to redirect stdout and stderr, since

465

531

# in normal mode, that is already done by daemon(),

467

533

# always replaced by /dev/null.)

468

534

self.checker = subprocess.Popen(command,

469

535

close_fds=True,

470

shell=True, cwd=u"/")

536

shell=True, cwd="/")

471

537

self.checker_callback_tag = (gobject.child_watch_add

472

538

(self.checker.pid,

473

539

self.checker_callback,

478

544

if pid:

479

545

gobject.source_remove(self.checker_callback_tag)

480

546

self.checker_callback(pid, status, command)

481

except OSError, error:

482

logger.error(u"Failed to start subprocess: %s",

547

except OSError as error:

548

logger.error("Failed to start subprocess: %s",

483

549

error)

484

550

# Re-run this periodically if run by gobject.timeout_add

485

551

return True

489

555

if self.checker_callback_tag:

490

556

gobject.source_remove(self.checker_callback_tag)

491

557

self.checker_callback_tag = None

492

if getattr(self, u"checker", None) is None:

558

if getattr(self, "checker", None) is None:

493

559

return

494

logger.debug(u"Stopping checker for %(name)s", vars(self))

560

logger.debug("Stopping checker for %(name)s", vars(self))

495

561

try:

496

562

os.kill(self.checker.pid, signal.SIGTERM)

497

563

#time.sleep(0.5)

498

564

#if self.checker.poll() is None:

499

565

# os.kill(self.checker.pid, signal.SIGKILL)

500

except OSError, error:

566

except OSError as error:

501

567

if error.errno != errno.ESRCH: # No such process

502

568

raise

503

569

self.checker = None

504

570

505

def dbus_service_property(dbus_interface, signature=u"v",

506

access=u"readwrite", byte_arrays=False):

571

572

def dbus_service_property(dbus_interface, signature="v",

573

access="readwrite", byte_arrays=False):

507

574

"""Decorators for marking methods of a DBusObjectWithProperties to

508

575

become properties on the D-Bus.

509

576

516

583

"""

517

584

# Encoding deeply encoded byte arrays is not supported yet by the

518

585

# "Set" method, so we fail early here:

519

if byte_arrays and signature != u"ay":

520

raise ValueError(u"Byte arrays not supported for non-'ay'"

521

u" signature %r" % signature)

586

if byte_arrays and signature != "ay":

587

raise ValueError("Byte arrays not supported for non-'ay'"

588

" signature %r" % signature)

522

589

def decorator(func):

523

590

func._dbus_is_property = True

524

591

func._dbus_interface = dbus_interface

525

592

func._dbus_signature = signature

526

593

func._dbus_access = access

527

594

func._dbus_name = func.__name__

528

if func._dbus_name.endswith(u"_dbus_property"):

595

if func._dbus_name.endswith("_dbus_property"):

529

596

func._dbus_name = func._dbus_name[:-14]

530

func._dbus_get_args_options = {u'byte_arrays': byte_arrays }

597

func._dbus_get_args_options = {'byte_arrays': byte_arrays }

531

598

return func

532

599

return decorator

533

600

553

620

554

621

class DBusObjectWithProperties(dbus.service.Object):

555

622

"""A D-Bus object with properties.

556

623

557

624

Classes inheriting from this can use the dbus_service_property

558

625

decorator to expose methods as D-Bus properties. It exposes the

559

626

standard Get(), Set(), and GetAll() methods on the D-Bus.

561

628

562

629

@staticmethod

563

630

def _is_dbus_property(obj):

564

return getattr(obj, u"_dbus_is_property", False)

631

return getattr(obj, "_dbus_is_property", False)

565

632

566

633

def _get_all_dbus_properties(self):

567

634

"""Returns a generator of (name, attribute) pairs

568

635

"""

569

return ((prop._dbus_name, prop)

636

return ((prop.__get__(self)._dbus_name, prop.__get__(self))

637

for cls in self.__class__.__mro__

570

638

for name, prop in

571

inspect.getmembers(self, self._is_dbus_property))

639

inspect.getmembers(cls, self._is_dbus_property))

572

640

573

641

def _get_dbus_property(self, interface_name, property_name):

574

642

"""Returns a bound method if one exists which is a D-Bus

575

643

property with the specified name and interface.

576

644

"""

577

for name in (property_name,

578

property_name + u"_dbus_property"):

579

prop = getattr(self, name, None)

580

if (prop is None

581

or not self._is_dbus_property(prop)

582

or prop._dbus_name != property_name

583

or (interface_name and prop._dbus_interface

584

and interface_name != prop._dbus_interface)):

585

continue

586

return prop

645

for cls in self.__class__.__mro__:

646

for name, value in (inspect.getmembers

647

(cls, self._is_dbus_property)):

648

if (value._dbus_name == property_name

649

and value._dbus_interface == interface_name):

650

return value.__get__(self)

651

587

652

# No such property

588

raise DBusPropertyNotFound(self.dbus_object_path + u":"

589

+ interface_name + u"."

653

raise DBusPropertyNotFound(self.dbus_object_path + ":"

654

+ interface_name + "."

590

655

+ property_name)

591

656

592

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ss",

593

out_signature=u"v")

657

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",

658

out_signature="v")

594

659

def Get(self, interface_name, property_name):

595

660

"""Standard D-Bus property Get() method, see D-Bus standard.

596

661

"""

597

662

prop = self._get_dbus_property(interface_name, property_name)

598

if prop._dbus_access == u"write":

663

if prop._dbus_access == "write":

599

664

raise DBusPropertyAccessException(property_name)

600

665

value = prop()

601

if not hasattr(value, u"variant_level"):

666

if not hasattr(value, "variant_level"):

602

667

return value

603

668

return type(value)(value, variant_level=value.variant_level+1)

604

669

605

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"ssv")

670

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")

606

671

def Set(self, interface_name, property_name, value):

607

672

"""Standard D-Bus property Set() method, see D-Bus standard.

608

673

"""

609

674

prop = self._get_dbus_property(interface_name, property_name)

610

if prop._dbus_access == u"read":

675

if prop._dbus_access == "read":

611

676

raise DBusPropertyAccessException(property_name)

612

if prop._dbus_get_args_options[u"byte_arrays"]:

677

if prop._dbus_get_args_options["byte_arrays"]:

613

678

# The byte_arrays option is not supported yet on

614

679

# signatures other than "ay".

615

if prop._dbus_signature != u"ay":

680

if prop._dbus_signature != "ay":

616

681

raise ValueError

617

682

value = dbus.ByteArray(''.join(unichr(byte)

618

683

for byte in value))

619

684

prop(value)

620

685

621

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature=u"s",

622

out_signature=u"a{sv}")

686

@dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",

687

out_signature="a{sv}")

623

688

def GetAll(self, interface_name):

624

689

"""Standard D-Bus property GetAll() method, see D-Bus

625

690

standard.

626

691

627

692

Note: Will not include properties with access="write".

628

693

"""

629

694

all = {}

633

698

# Interface non-empty but did not match

634

699

continue

635

700

# Ignore write-only properties

636

if prop._dbus_access == u"write":

701

if prop._dbus_access == "write":

637

702

continue

638

703

value = prop()

639

if not hasattr(value, u"variant_level"):

704

if not hasattr(value, "variant_level"):

640

705

all[name] = value

641

706

continue

642

707

all[name] = type(value)(value, variant_level=

643

708

value.variant_level+1)

644

return dbus.Dictionary(all, signature=u"sv")

709

return dbus.Dictionary(all, signature="sv")

645

710

646

711

@dbus.service.method(dbus.INTROSPECTABLE_IFACE,

647

out_signature=u"s",

712

out_signature="s",

648

713

path_keyword='object_path',

649

714

connection_keyword='connection')

650

715

def Introspect(self, object_path, connection):

655

720

try:

656

721

document = xml.dom.minidom.parseString(xmlstring)

657

722

def make_tag(document, name, prop):

658

e = document.createElement(u"property")

659

e.setAttribute(u"name", name)

660

e.setAttribute(u"type", prop._dbus_signature)

661

e.setAttribute(u"access", prop._dbus_access)

723

e = document.createElement("property")

724

e.setAttribute("name", name)

725

e.setAttribute("type", prop._dbus_signature)

726

e.setAttribute("access", prop._dbus_access)

662

727

return e

663

for if_tag in document.getElementsByTagName(u"interface"):

728

for if_tag in document.getElementsByTagName("interface"):

664

729

for tag in (make_tag(document, name, prop)

665

730

for name, prop

666

731

in self._get_all_dbus_properties()

667

732

if prop._dbus_interface

668

== if_tag.getAttribute(u"name")):

733

== if_tag.getAttribute("name")):

669

734

if_tag.appendChild(tag)

670

735

# Add the names to the return values for the

671

736

# "org.freedesktop.DBus.Properties" methods

672

if (if_tag.getAttribute(u"name")

673

== u"org.freedesktop.DBus.Properties"):

674

for cn in if_tag.getElementsByTagName(u"method"):

675

if cn.getAttribute(u"name") == u"Get":

676

for arg in cn.getElementsByTagName(u"arg"):

677

if (arg.getAttribute(u"direction")

678

== u"out"):

679

arg.setAttribute(u"name", u"value")

680

elif cn.getAttribute(u"name") == u"GetAll":

681

for arg in cn.getElementsByTagName(u"arg"):

682

if (arg.getAttribute(u"direction")

683

== u"out"):

684

arg.setAttribute(u"name", u"props")

685

xmlstring = document.toxml(u"utf-8")

737

if (if_tag.getAttribute("name")

738

== "org.freedesktop.DBus.Properties"):

739

for cn in if_tag.getElementsByTagName("method"):

740

if cn.getAttribute("name") == "Get":

741

for arg in cn.getElementsByTagName("arg"):

742

if (arg.getAttribute("direction")

743

== "out"):

744

arg.setAttribute("name", "value")

745

elif cn.getAttribute("name") == "GetAll":

746

for arg in cn.getElementsByTagName("arg"):

747

if (arg.getAttribute("direction")

748

== "out"):

749

arg.setAttribute("name", "props")

750

xmlstring = document.toxml("utf-8")

686

751

document.unlink()

687

752

except (AttributeError, xml.dom.DOMException,

688

xml.parsers.expat.ExpatError), error:

689

logger.error(u"Failed to override Introspection method",

753

xml.parsers.expat.ExpatError) as error:

754

logger.error("Failed to override Introspection method",

690

755

error)

691

756

return xmlstring

692

757

693

758

759

def datetime_to_dbus (dt, variant_level=0):

760

"""Convert a UTC datetime.datetime() to a D-Bus type."""

761

if dt is None:

762

return dbus.String("", variant_level = variant_level)

763

return dbus.String(dt.isoformat(),

764

variant_level=variant_level)

765

766

class AlternateDBusNamesMetaclass(DBusObjectWithProperties

767

.__metaclass__):

768

"""Applied to an empty subclass of a D-Bus object, this metaclass

769

will add additional D-Bus attributes matching a certain pattern.

770

"""

771

def __new__(mcs, name, bases, attr):

772

# Go through all the base classes which could have D-Bus

773

# methods, signals, or properties in them

774

for base in (b for b in bases

775

if issubclass(b, dbus.service.Object)):

776

# Go though all attributes of the base class

777

for attrname, attribute in inspect.getmembers(base):

778

# Ignore non-D-Bus attributes, and D-Bus attributes

779

# with the wrong interface name

780

if (not hasattr(attribute, "_dbus_interface")

781

or not attribute._dbus_interface

782

.startswith("se.recompile.Mandos")):

783

continue

784

# Create an alternate D-Bus interface name based on

785

# the current name

786

alt_interface = (attribute._dbus_interface

787

.replace("se.recompile.Mandos",

788

"se.bsnet.fukt.Mandos"))

789

# Is this a D-Bus signal?

790

if getattr(attribute, "_dbus_is_signal", False):

791

# Extract the original non-method function by

792

# black magic

793

nonmethod_func = (dict(

794

zip(attribute.func_code.co_freevars,

795

attribute.__closure__))["func"]

796

.cell_contents)

797

# Create a new, but exactly alike, function

798

# object, and decorate it to be a new D-Bus signal

799

# with the alternate D-Bus interface name

800

new_function = (dbus.service.signal

801

(alt_interface,

802

attribute._dbus_signature)

803

(types.FunctionType(

804

nonmethod_func.func_code,

805

nonmethod_func.func_globals,

806

nonmethod_func.func_name,

807

nonmethod_func.func_defaults,

808

nonmethod_func.func_closure)))

809

# Define a creator of a function to call both the

810

# old and new functions, so both the old and new

811

# signals gets sent when the function is called

812

def fixscope(func1, func2):

813

"""This function is a scope container to pass

814

func1 and func2 to the "call_both" function

815

outside of its arguments"""

816

def call_both(*args, **kwargs):

817

"""This function will emit two D-Bus

818

signals by calling func1 and func2"""

819

func1(*args, **kwargs)

820

func2(*args, **kwargs)

821

return call_both

822

# Create the "call_both" function and add it to

823

# the class

824

attr[attrname] = fixscope(attribute,

825

new_function)

826

# Is this a D-Bus method?

827

elif getattr(attribute, "_dbus_is_method", False):

828

# Create a new, but exactly alike, function

829

# object. Decorate it to be a new D-Bus method

830

# with the alternate D-Bus interface name. Add it

831

# to the class.

832

attr[attrname] = (dbus.service.method

833

(alt_interface,

834

attribute._dbus_in_signature,

835

attribute._dbus_out_signature)

836

(types.FunctionType

837

(attribute.func_code,

838

attribute.func_globals,

839

attribute.func_name,

840

attribute.func_defaults,

841

attribute.func_closure)))

842

# Is this a D-Bus property?

843

elif getattr(attribute, "_dbus_is_property", False):

844

# Create a new, but exactly alike, function

845

# object, and decorate it to be a new D-Bus

846

# property with the alternate D-Bus interface

847

# name. Add it to the class.

848

attr[attrname] = (dbus_service_property

849

(alt_interface,

850

attribute._dbus_signature,

851

attribute._dbus_access,

852

attribute

853

._dbus_get_args_options

854

["byte_arrays"])

855

(types.FunctionType

856

(attribute.func_code,

857

attribute.func_globals,

858

attribute.func_name,

859

attribute.func_defaults,

860

attribute.func_closure)))

861

return type.__new__(mcs, name, bases, attr)

862

694

863

class ClientDBus(Client, DBusObjectWithProperties):

695

864

"""A Client class using D-Bus

696

865

698

867

dbus_object_path: dbus.ObjectPath

699

868

bus: dbus.SystemBus()

700

869

"""

870

871

runtime_expansions = (Client.runtime_expansions

872

+ ("dbus_object_path",))

873

701

874

# dbus.service.Object doesn't use super(), so we can't either.

702

875

703

876

def __init__(self, bus = None, *args, **kwargs):

706

879

Client.__init__(self, *args, **kwargs)

707

880

# Only now, when this client is initialized, can it show up on

708

881

# the D-Bus

882

client_object_name = unicode(self.name).translate(

883

{ord("."): ord("_"),

884

ord("-"): ord("_")})

709

885

self.dbus_object_path = (dbus.ObjectPath

710

(u"/clients/"

711

+ self.name.replace(u".", u"_")))

886

("/clients/" + client_object_name))

712

887

DBusObjectWithProperties.__init__(self, self.bus,

713

888

self.dbus_object_path)

714

715

#Could possible return a bool(self._approvals_pending),

716

#but this could mess up approvals_pending += 1 XXX

717

def _get_approvals_pending(self):

718

return self._approvals_pending

719

def _set_approvals_pending(self, value):

720

old_value = self._approvals_pending

721

self._approvals_pending = value

722

bval = bool(value)

723

if (hasattr(self, "dbus_object_path")

724

and bval is not bool(old_value)):

725

dbus_bool = dbus.Boolean(bval, variant_level=1)

726

self.PropertyChanged(dbus.String(u"approved_pending"),

727

dbus_bool)

728

729

approvals_pending = property(_get_approvals_pending,

730

_set_approvals_pending)

731

del _get_approvals_pending, _set_approvals_pending

732

733

@staticmethod

734

def _datetime_to_dbus(dt, variant_level=0):

735

"""Convert a UTC datetime.datetime() to a D-Bus type."""

736

return dbus.String(dt.isoformat(),

737

variant_level=variant_level)

738

739

def enable(self):

740

oldstate = getattr(self, u"enabled", False)

741

r = Client.enable(self)

742

if oldstate != self.enabled:

743

# Emit D-Bus signals

744

self.PropertyChanged(dbus.String(u"enabled"),

745

dbus.Boolean(True, variant_level=1))

746

self.PropertyChanged(

747

dbus.String(u"last_enabled"),

748

self._datetime_to_dbus(self.last_enabled,

749

variant_level=1))

750

return r

751

752

def disable(self, quiet = False):

753

oldstate = getattr(self, u"enabled", False)

754

r = Client.disable(self, quiet=quiet)

755

if not quiet and oldstate != self.enabled:

756

# Emit D-Bus signal

757

self.PropertyChanged(dbus.String(u"enabled"),

758

dbus.Boolean(False, variant_level=1))

759

return r

889

890

def notifychangeproperty(transform_func,

891

dbus_name, type_func=lambda x: x,

892

variant_level=1):

893

""" Modify a variable so that it's a property which announces

894

its changes to DBus.

895

896

transform_fun: Function that takes a value and a variant_level

897

and transforms it to a D-Bus type.

898

dbus_name: D-Bus name of the variable

899

type_func: Function that transform the value before sending it

900

to the D-Bus. Default: no transform

901

variant_level: D-Bus variant level. Default: 1

902

"""

903

attrname = "_{0}".format(dbus_name)

904

def setter(self, value):

905

if hasattr(self, "dbus_object_path"):

906

if (not hasattr(self, attrname) or

907

type_func(getattr(self, attrname, None))

908

!= type_func(value)):

909

dbus_value = transform_func(type_func(value),

910

variant_level

911

=variant_level)

912

self.PropertyChanged(dbus.String(dbus_name),

913

dbus_value)

914

setattr(self, attrname, value)

915

916

return property(lambda self: getattr(self, attrname), setter)

917

918

919

expires = notifychangeproperty(datetime_to_dbus, "Expires")

920

approvals_pending = notifychangeproperty(dbus.Boolean,

921

"ApprovalPending",

922

type_func = bool)

923

enabled = notifychangeproperty(dbus.Boolean, "Enabled")

924

last_enabled = notifychangeproperty(datetime_to_dbus,

925

"LastEnabled")

926

checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",

927

type_func = lambda checker:

928

checker is not None)

929

last_checked_ok = notifychangeproperty(datetime_to_dbus,

930

"LastCheckedOK")

931

last_approval_request = notifychangeproperty(

932

datetime_to_dbus, "LastApprovalRequest")

933

approved_by_default = notifychangeproperty(dbus.Boolean,

934

"ApprovedByDefault")

935

approval_delay = notifychangeproperty(dbus.UInt16,

936

"ApprovalDelay",

937

type_func =

938

_timedelta_to_milliseconds)

939

approval_duration = notifychangeproperty(

940

dbus.UInt16, "ApprovalDuration",

941

type_func = _timedelta_to_milliseconds)

942

host = notifychangeproperty(dbus.String, "Host")

943

timeout = notifychangeproperty(dbus.UInt16, "Timeout",

944

type_func =

945

_timedelta_to_milliseconds)

946

extended_timeout = notifychangeproperty(

947

dbus.UInt16, "ExtendedTimeout",

948

type_func = _timedelta_to_milliseconds)

949

interval = notifychangeproperty(dbus.UInt16,

950

"Interval",

951

type_func =

952

_timedelta_to_milliseconds)

953

checker_command = notifychangeproperty(dbus.String, "Checker")

954

955

del notifychangeproperty

760

956

761

957

def __del__(self, *args, **kwargs):

762

958

try:

763

959

self.remove_from_connection()

764

960

except LookupError:

765

961

pass

766

if hasattr(DBusObjectWithProperties, u"__del__"):

962

if hasattr(DBusObjectWithProperties, "__del__"):

767

963

DBusObjectWithProperties.__del__(self, *args, **kwargs)

768

964

Client.__del__(self, *args, **kwargs)

769

965

771

967

*args, **kwargs):

772

968

self.checker_callback_tag = None

773

969

self.checker = None

774

# Emit D-Bus signal

775

self.PropertyChanged(dbus.String(u"checker_running"),

776

dbus.Boolean(False, variant_level=1))

777

970

if os.WIFEXITED(condition):

778

971

exitstatus = os.WEXITSTATUS(condition)

779

972

# Emit D-Bus signal

789

982

return Client.checker_callback(self, pid, condition, command,

790

983

*args, **kwargs)

791

984

792

def checked_ok(self, *args, **kwargs):

793

r = Client.checked_ok(self, *args, **kwargs)

794

# Emit D-Bus signal

795

self.PropertyChanged(

796

dbus.String(u"last_checked_ok"),

797

(self._datetime_to_dbus(self.last_checked_ok,

798

variant_level=1)))

799

return r

800

801

985

def start_checker(self, *args, **kwargs):

802

986

old_checker = self.checker

803

987

if self.checker is not None:

810

994

and old_checker_pid != self.checker.pid):

811

995

# Emit D-Bus signal

812

996

self.CheckerStarted(self.current_checker_command)

813

self.PropertyChanged(

814

dbus.String(u"checker_running"),

815

dbus.Boolean(True, variant_level=1))

816

997

return r

817

998

818

def stop_checker(self, *args, **kwargs):

819

old_checker = getattr(self, u"checker", None)

820

r = Client.stop_checker(self, *args, **kwargs)

821

if (old_checker is not None

822

and getattr(self, u"checker", None) is None):

823

self.PropertyChanged(dbus.String(u"checker_running"),

824

dbus.Boolean(False, variant_level=1))

825

return r

826

827

999

def _reset_approved(self):

828

1000

self._approved = None

829

1001

return False

831

1003

def approve(self, value=True):

832

1004

self.send_changedstate()

833

1005

self._approved = value

834

gobject.timeout_add(self._timedelta_to_milliseconds(self.approved_duration),

1006

gobject.timeout_add(_timedelta_to_milliseconds

1007

(self.approval_duration),

835

1008

self._reset_approved)

836

1009

837

1010

838

1011

## D-Bus methods, signals & properties

839

_interface = u"se.bsnet.fukt.Mandos.Client"

1012

_interface = "se.recompile.Mandos.Client"

840

1013

841

1014

## Signals

842

1015

843

1016

# CheckerCompleted - signal

844

@dbus.service.signal(_interface, signature=u"nxs")

1017

@dbus.service.signal(_interface, signature="nxs")

845

1018

def CheckerCompleted(self, exitcode, waitstatus, command):

846

1019

"D-Bus signal"

847

1020

pass

848

1021

849

1022

# CheckerStarted - signal

850

@dbus.service.signal(_interface, signature=u"s")

1023

@dbus.service.signal(_interface, signature="s")

851

1024

def CheckerStarted(self, command):

852

1025

"D-Bus signal"

853

1026

pass

854

1027

855

1028

# PropertyChanged - signal

856

@dbus.service.signal(_interface, signature=u"sv")

1029

@dbus.service.signal(_interface, signature="sv")

857

1030

def PropertyChanged(self, property, value):

858

1031

"D-Bus signal"

859

1032

pass

860

1033

861

1034

# GotSecret - signal

862

# XXXTEDDY Is sent after succesfull transfer of secret from mandos-server to mandos-client

863

1035

@dbus.service.signal(_interface)

864

1036

def GotSecret(self):

865

"D-Bus signal"

1037

"""D-Bus signal

1038

Is sent after a successful transfer of secret from the Mandos

1039

server to mandos-client

1040

"""

866

1041

pass

867

1042

868

1043

# Rejected - signal

869

@dbus.service.signal(_interface, signature=u"s")

1044

@dbus.service.signal(_interface, signature="s")

870

1045

def Rejected(self, reason):

871

1046

"D-Bus signal"

872

1047

pass

873

1048

874

1049

# NeedApproval - signal

875

@dbus.service.signal(_interface, signature=u"db")

1050

@dbus.service.signal(_interface, signature="tb")

876

1051

def NeedApproval(self, timeout, default):

877

1052

"D-Bus signal"

878

pass

1053

return self.need_approval()

879

1054

880

1055

## Methods

881

1056

882

1057

# Approve - method

883

@dbus.service.method(_interface, in_signature=u"b")

1058

@dbus.service.method(_interface, in_signature="b")

884

1059

def Approve(self, value):

885

1060

self.approve(value)

886

1061

887

1062

# CheckedOK - method

888

1063

@dbus.service.method(_interface)

889

1064

def CheckedOK(self):

890

return self.checked_ok()

1065

self.checked_ok()

891

1066

892

1067

# Enable - method

893

1068

@dbus.service.method(_interface)

914

1089

915

1090

## Properties

916

1091

917

# approved_pending - property

918

@dbus_service_property(_interface, signature=u"b", access=u"read")

919

def approved_pending_dbus_property(self):

1092

# ApprovalPending - property

1093

@dbus_service_property(_interface, signature="b", access="read")

1094

def ApprovalPending_dbus_property(self):

920

1095

return dbus.Boolean(bool(self.approvals_pending))

921

1096

922

# approved_by_default - property

923

@dbus_service_property(_interface, signature=u"b",

924

access=u"readwrite")

925

def approved_by_default_dbus_property(self):

926

return dbus.Boolean(self.approved_by_default)

927

928

# approved_delay - property

929

@dbus_service_property(_interface, signature=u"t",

930

access=u"readwrite")

931

def approved_delay_dbus_property(self):

932

return dbus.UInt64(self.approved_delay_milliseconds())

933

934

# approved_duration - property

935

@dbus_service_property(_interface, signature=u"t",

936

access=u"readwrite")

937

def approved_duration_dbus_property(self):

938

return dbus.UInt64(self._timedelta_to_milliseconds(

939

self.approved_duration))

940

941

# name - property

942

@dbus_service_property(_interface, signature=u"s", access=u"read")

943

def name_dbus_property(self):

1097

# ApprovedByDefault - property

1098

@dbus_service_property(_interface, signature="b",

1099

access="readwrite")

1100

def ApprovedByDefault_dbus_property(self, value=None):

1101

if value is None: # get

1102

return dbus.Boolean(self.approved_by_default)

1103

self.approved_by_default = bool(value)

1104

1105

# ApprovalDelay - property

1106

@dbus_service_property(_interface, signature="t",

1107

access="readwrite")

1108

def ApprovalDelay_dbus_property(self, value=None):

1109

if value is None: # get

1110

return dbus.UInt64(self.approval_delay_milliseconds())

1111

self.approval_delay = datetime.timedelta(0, 0, 0, value)

1112

1113

# ApprovalDuration - property

1114

@dbus_service_property(_interface, signature="t",

1115

access="readwrite")

1116

def ApprovalDuration_dbus_property(self, value=None):

1117

if value is None: # get

1118

return dbus.UInt64(_timedelta_to_milliseconds(

1119

self.approval_duration))

1120

self.approval_duration = datetime.timedelta(0, 0, 0, value)

1121

1122

# Name - property

1123

@dbus_service_property(_interface, signature="s", access="read")

1124

def Name_dbus_property(self):

944

1125

return dbus.String(self.name)

945

1126

946

# fingerprint - property

947

@dbus_service_property(_interface, signature=u"s", access=u"read")

948

def fingerprint_dbus_property(self):

1127

# Fingerprint - property

1128

@dbus_service_property(_interface, signature="s", access="read")

1129

def Fingerprint_dbus_property(self):

949

1130

return dbus.String(self.fingerprint)

950

1131

951

# host - property

952

@dbus_service_property(_interface, signature=u"s",

953

access=u"readwrite")

954

def host_dbus_property(self, value=None):

1132

# Host - property

1133

@dbus_service_property(_interface, signature="s",

1134

access="readwrite")

1135

def Host_dbus_property(self, value=None):

955

1136

if value is None: # get

956

1137

return dbus.String(self.host)

957

1138

self.host = value

958

# Emit D-Bus signal

959

self.PropertyChanged(dbus.String(u"host"),

960

dbus.String(value, variant_level=1))

961

962

# created - property

963

@dbus_service_property(_interface, signature=u"s", access=u"read")

964

def created_dbus_property(self):

965

return dbus.String(self._datetime_to_dbus(self.created))

966

967

# last_enabled - property

968

@dbus_service_property(_interface, signature=u"s", access=u"read")

969

def last_enabled_dbus_property(self):

970

if self.last_enabled is None:

971

return dbus.String(u"")

972

return dbus.String(self._datetime_to_dbus(self.last_enabled))

973

974

# enabled - property

975

@dbus_service_property(_interface, signature=u"b",

976

access=u"readwrite")

977

def enabled_dbus_property(self, value=None):

1139

1140

# Created - property

1141

@dbus_service_property(_interface, signature="s", access="read")

1142

def Created_dbus_property(self):

1143

return dbus.String(datetime_to_dbus(self.created))

1144

1145

# LastEnabled - property

1146

@dbus_service_property(_interface, signature="s", access="read")

1147

def LastEnabled_dbus_property(self):

1148

return datetime_to_dbus(self.last_enabled)

1149

1150

# Enabled - property

1151

@dbus_service_property(_interface, signature="b",

1152

access="readwrite")

1153

def Enabled_dbus_property(self, value=None):

978

1154

if value is None: # get

979

1155

return dbus.Boolean(self.enabled)

980

1156

if value:

982

1158

else:

983

1159

self.disable()

984

1160

985

# last_checked_ok - property

986

@dbus_service_property(_interface, signature=u"s",

987

access=u"readwrite")

988

def last_checked_ok_dbus_property(self, value=None):

1161

# LastCheckedOK - property

1162

@dbus_service_property(_interface, signature="s",

1163

access="readwrite")

1164

def LastCheckedOK_dbus_property(self, value=None):

989

1165

if value is not None:

990

1166

self.checked_ok()

991

1167

return

992

if self.last_checked_ok is None:

993

return dbus.String(u"")

994

return dbus.String(self._datetime_to_dbus(self

995

.last_checked_ok))

996

997

# timeout - property

998

@dbus_service_property(_interface, signature=u"t",

999

access=u"readwrite")

1000

def timeout_dbus_property(self, value=None):

1168

return datetime_to_dbus(self.last_checked_ok)

1169

1170

# Expires - property

1171

@dbus_service_property(_interface, signature="s", access="read")

1172

def Expires_dbus_property(self):

1173

return datetime_to_dbus(self.expires)

1174

1175

# LastApprovalRequest - property

1176

@dbus_service_property(_interface, signature="s", access="read")

1177

def LastApprovalRequest_dbus_property(self):

1178

return datetime_to_dbus(self.last_approval_request)

1179

1180

# Timeout - property

1181

@dbus_service_property(_interface, signature="t",

1182

access="readwrite")

1183

def Timeout_dbus_property(self, value=None):

1001

1184

if value is None: # get

1002

1185

return dbus.UInt64(self.timeout_milliseconds())

1003

1186

self.timeout = datetime.timedelta(0, 0, 0, value)

1004

# Emit D-Bus signal

1005

self.PropertyChanged(dbus.String(u"timeout"),

1006

dbus.UInt64(value, variant_level=1))

1007

if getattr(self, u"disable_initiator_tag", None) is None:

1187

if getattr(self, "disable_initiator_tag", None) is None:

1008

1188

return

1009

1189

# Reschedule timeout

1010

1190

gobject.source_remove(self.disable_initiator_tag)

1011

1191

self.disable_initiator_tag = None

1012

time_to_die = (self.

1013

_timedelta_to_milliseconds((self

1014

.last_checked_ok

1015

+ self.timeout)

1016

- datetime.datetime

1017

.utcnow()))

1192

self.expires = None

1193

time_to_die = _timedelta_to_milliseconds((self

1194

.last_checked_ok

1195

+ self.timeout)

1196

- datetime.datetime

1197

.utcnow())

1018

1198

if time_to_die <= 0:

1019

1199

# The timeout has passed

1020

1200

self.disable()

1021

1201

else:

1202

self.expires = (datetime.datetime.utcnow()

1203

+ datetime.timedelta(milliseconds =

1204

time_to_die))

1022

1205

self.disable_initiator_tag = (gobject.timeout_add

1023

1206

(time_to_die, self.disable))

1024

1207

1025

# interval - property

1026

@dbus_service_property(_interface, signature=u"t",

1027

access=u"readwrite")

1028

def interval_dbus_property(self, value=None):

1208

# ExtendedTimeout - property

1209

@dbus_service_property(_interface, signature="t",

1210

access="readwrite")

1211

def ExtendedTimeout_dbus_property(self, value=None):

1212

if value is None: # get

1213

return dbus.UInt64(self.extended_timeout_milliseconds())

1214

self.extended_timeout = datetime.timedelta(0, 0, 0, value)

1215

1216

# Interval - property

1217

@dbus_service_property(_interface, signature="t",

1218

access="readwrite")

1219

def Interval_dbus_property(self, value=None):

1029

1220

if value is None: # get

1030

1221

return dbus.UInt64(self.interval_milliseconds())

1031

1222

self.interval = datetime.timedelta(0, 0, 0, value)

1032

# Emit D-Bus signal

1033

self.PropertyChanged(dbus.String(u"interval"),

1034

dbus.UInt64(value, variant_level=1))

1035

if getattr(self, u"checker_initiator_tag", None) is None:

1223

if getattr(self, "checker_initiator_tag", None) is None:

1036

1224

return

1037

1225

# Reschedule checker run

1038

1226

gobject.source_remove(self.checker_initiator_tag)

1039

1227

self.checker_initiator_tag = (gobject.timeout_add

1040

1228

(value, self.start_checker))

1041

1229

self.start_checker() # Start one now, too

1042

1043

# checker - property

1044

@dbus_service_property(_interface, signature=u"s",

1045

access=u"readwrite")

1046

def checker_dbus_property(self, value=None):

1230

1231

# Checker - property

1232

@dbus_service_property(_interface, signature="s",

1233

access="readwrite")

1234

def Checker_dbus_property(self, value=None):

1047

1235

if value is None: # get

1048

1236

return dbus.String(self.checker_command)

1049

1237

self.checker_command = value

1050

# Emit D-Bus signal

1051

self.PropertyChanged(dbus.String(u"checker"),

1052

dbus.String(self.checker_command,

1053

variant_level=1))

1054

1238

1055

# checker_running - property

1056

@dbus_service_property(_interface, signature=u"b",

1057

access=u"readwrite")

1058

def checker_running_dbus_property(self, value=None):

1239

# CheckerRunning - property

1240

@dbus_service_property(_interface, signature="b",

1241

access="readwrite")

1242

def CheckerRunning_dbus_property(self, value=None):

1059

1243

if value is None: # get

1060

1244

return dbus.Boolean(self.checker is not None)

1061

1245

if value:

1063

1247

else:

1064

1248

self.stop_checker()

1065

1249

1066

# object_path - property

1067

@dbus_service_property(_interface, signature=u"o", access=u"read")

1068

def object_path_dbus_property(self):

1250

# ObjectPath - property

1251

@dbus_service_property(_interface, signature="o", access="read")

1252

def ObjectPath_dbus_property(self):

1069

1253

return self.dbus_object_path # is already a dbus.ObjectPath

1070

1254

1071

# secret = property

1072

@dbus_service_property(_interface, signature=u"ay",

1073

access=u"write", byte_arrays=True)

1074

def secret_dbus_property(self, value):

1255

# Secret = property

1256

@dbus_service_property(_interface, signature="ay",

1257

access="write", byte_arrays=True)

1258

def Secret_dbus_property(self, value):

1075

1259

self.secret = str(value)

1076

1260

1077

1261

del _interface

1083

1267

self._pipe.send(('init', fpr, address))

1084

1268

if not self._pipe.recv():

1085

1269

raise KeyError()

1086

1270

1087

1271

def __getattribute__(self, name):

1088

1272

if(name == '_pipe'):

1089

1273

return super(ProxyClient, self).__getattribute__(name)

1096

1280

self._pipe.send(('funcall', name, args, kwargs))

1097

1281

return self._pipe.recv()[1]

1098

1282

return func

1099

1283

1100

1284

def __setattr__(self, name, value):

1101

1285

if(name == '_pipe'):

1102

1286

return super(ProxyClient, self).__setattr__(name, value)

1103

1287

self._pipe.send(('setattr', name, value))

1104

1288

1289

class ClientDBusTransitional(ClientDBus):

1290

__metaclass__ = AlternateDBusNamesMetaclass

1105

1291

1106

1292

class ClientHandler(socketserver.BaseRequestHandler, object):

1107

1293

"""A class to handle client connections.

1111

1297

1112

1298

def handle(self):

1113

1299

with contextlib.closing(self.server.child_pipe) as child_pipe:

1114

logger.info(u"TCP connection from: %s",

1300

logger.info("TCP connection from: %s",

1115

1301

unicode(self.client_address))

1116

logger.debug(u"Pipe FD: %d",

1302

logger.debug("Pipe FD: %d",

1117

1303

self.server.child_pipe.fileno())

1118

1304

1119

1305

session = (gnutls.connection

1120

1306

.ClientSession(self.request,

1121

1307

gnutls.connection

1122

1308

.X509Credentials()))

1123

1309

1124

1310

# Note: gnutls.connection.X509Credentials is really a

1125

1311

# generic GnuTLS certificate credentials object so long as

1126

1312

# no X.509 keys are added to it. Therefore, we can use it

1127

1313

# here despite using OpenPGP certificates.

1128

1129

#priority = u':'.join((u"NONE", u"+VERS-TLS1.1",

1130

# u"+AES-256-CBC", u"+SHA1",

1131

# u"+COMP-NULL", u"+CTYPE-OPENPGP",

1132

# u"+DHE-DSS"))

1314

1315

#priority = ':'.join(("NONE", "+VERS-TLS1.1",

1316

# "+AES-256-CBC", "+SHA1",

1317

# "+COMP-NULL", "+CTYPE-OPENPGP",

1318

# "+DHE-DSS"))

1133

1319

# Use a fallback default, since this MUST be set.

1134

1320

priority = self.server.gnutls_priority

1135

1321

if priority is None:

1136

priority = u"NORMAL"

1322

priority = "NORMAL"

1137

1323

(gnutls.library.functions

1138

1324

.gnutls_priority_set_direct(session._c_object,

1139

1325

priority, None))

1140

1326

1141

1327

# Start communication using the Mandos protocol

1142

1328

# Get protocol number

1143

1329

line = self.request.makefile().readline()

1144

logger.debug(u"Protocol version: %r", line)

1330

logger.debug("Protocol version: %r", line)

1145

1331

try:

1146

1332

if int(line.strip().split()[0]) > 1:

1147

1333

raise RuntimeError

1148

except (ValueError, IndexError, RuntimeError), error:

1149

logger.error(u"Unknown protocol version: %s", error)

1334

except (ValueError, IndexError, RuntimeError) as error:

1335

logger.error("Unknown protocol version: %s", error)

1150

1336

return

1151

1337

1152

1338

# Start GnuTLS connection

1153

1339

try:

1154

1340

session.handshake()

1155

except gnutls.errors.GNUTLSError, error:

1156

logger.warning(u"Handshake failed: %s", error)

1341

except gnutls.errors.GNUTLSError as error:

1342

logger.warning("Handshake failed: %s", error)

1157

1343

# Do not run session.bye() here: the session is not

1158

1344

# established. Just abandon the request.

1159

1345

return

1160

logger.debug(u"Handshake succeeded")

1161

1346

logger.debug("Handshake succeeded")

1347

1162

1348

approval_required = False

1163

1349

try:

1164

1350

try:

1165

1351

fpr = self.fingerprint(self.peer_certificate

1166

1352

(session))

1167

except (TypeError, gnutls.errors.GNUTLSError), error:

1168

logger.warning(u"Bad certificate: %s", error)

1353

except (TypeError,

1354

gnutls.errors.GNUTLSError) as error:

1355

logger.warning("Bad certificate: %s", error)

1169

1356

return

1170

logger.debug(u"Fingerprint: %s", fpr)

1171

1357

logger.debug("Fingerprint: %s", fpr)

1358

1172

1359

try:

1173

1360

client = ProxyClient(child_pipe, fpr,

1174

1361

self.client_address)

1175

1362

except KeyError:

1176

1363

return

1177

1364

1178

if client.approved_delay:

1179

delay = client.approved_delay

1365

if client.approval_delay:

1366

delay = client.approval_delay

1180

1367

client.approvals_pending += 1

1181

1368

approval_required = True

1182

1369

1183

1370

while True:

1184

1371

if not client.enabled:

1185

logger.warning(u"Client %s is disabled",

1372

logger.info("Client %s is disabled",

1186

1373

client.name)

1187

1374

if self.server.use_dbus:

1188

1375

# Emit D-Bus signal

1189

client.Rejected("Disabled")

1376

client.Rejected("Disabled")

1190

1377

return

1191

1378

1192

if client._approved or not client.approved_delay:

1379

if client._approved or not client.approval_delay:

1193

1380

#We are approved or approval is disabled

1194

1381

break

1195

1382

elif client._approved is None:

1196

logger.info(u"Client %s need approval",

1383

logger.info("Client %s needs approval",

1197

1384

client.name)

1198

1385

if self.server.use_dbus:

1199

1386

# Emit D-Bus signal

1200

1387

client.NeedApproval(

1201

client.approved_delay_milliseconds(),

1388

client.approval_delay_milliseconds(),

1202

1389

client.approved_by_default)

1203

1390

else:

1204

logger.warning(u"Client %s was not approved",

1391

logger.warning("Client %s was not approved",

1205

1392

client.name)

1206

1393

if self.server.use_dbus:

1207

1394

# Emit D-Bus signal

1208

client.Rejected("Disapproved")

1395

client.Rejected("Denied")

1209

1396

return

1210

1397

1211

1398

#wait until timeout or approved

1212

#x = float(client._timedelta_to_milliseconds(delay))

1213

1399

time = datetime.datetime.now()

1214

1400

client.changedstate.acquire()

1215

client.changedstate.wait(float(client._timedelta_to_milliseconds(delay) / 1000))

1401

(client.changedstate.wait

1402

(float(client._timedelta_to_milliseconds(delay)

1403

/ 1000)))

1216

1404

client.changedstate.release()

1217

1405

time2 = datetime.datetime.now()

1218

1406

if (time2 - time) >= delay:

1222

1410

client.name)

1223

1411

if self.server.use_dbus:

1224

1412

# Emit D-Bus signal

1225

client.Rejected("Time out")

1413

client.Rejected("Approval timed out")

1226

1414

return

1227

1415

else:

1228

1416

break

1231

1419

1232

1420

sent_size = 0

1233

1421

while sent_size < len(client.secret):

1234

# XXX handle session exception

1235

sent = session.send(client.secret[sent_size:])

1236

logger.debug(u"Sent: %d, remaining: %d",

1422

try:

1423

sent = session.send(client.secret[sent_size:])

1424

except gnutls.errors.GNUTLSError as error:

1425

logger.warning("gnutls send failed")

1426

return

1427

logger.debug("Sent: %d, remaining: %d",

1237

1428

sent, len(client.secret)

1238

1429

- (sent_size + sent))

1239

1430

sent_size += sent

1240

1241

logger.info(u"Sending secret to %s", client.name)

1242

# bump the timeout as if seen

1243

client.checked_ok()

1431

1432

logger.info("Sending secret to %s", client.name)

1433

# bump the timeout using extended_timeout

1434

client.checked_ok(client.extended_timeout)

1244

1435

if self.server.use_dbus:

1245

1436

# Emit D-Bus signal

1246

1437

client.GotSecret()

1248

1439

finally:

1249

1440

if approval_required:

1250

1441

client.approvals_pending -= 1

1251

session.bye()

1442

try:

1443

session.bye()

1444

except gnutls.errors.GNUTLSError as error:

1445

logger.warning("GnuTLS bye failed")

1252

1446

1253

1447

@staticmethod

1254

1448

def peer_certificate(session):

1264

1458

.gnutls_certificate_get_peers

1265

1459

(session._c_object, ctypes.byref(list_size)))

1266

1460

if not bool(cert_list) and list_size.value != 0:

1267

raise gnutls.errors.GNUTLSError(u"error getting peer"

1268

u" certificate")

1461

raise gnutls.errors.GNUTLSError("error getting peer"

1462

" certificate")

1269

1463

if list_size.value == 0:

1270

1464

return None

1271

1465

cert = cert_list[0]

1297

1491

if crtverify.value != 0:

1298

1492

gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)

1299

1493

raise (gnutls.errors.CertificateSecurityError

1300

(u"Verify failed"))

1494

("Verify failed"))

1301

1495

# New buffer for the fingerprint

1302

1496

buf = ctypes.create_string_buffer(20)

1303

1497

buf_len = ctypes.c_size_t()

1310

1504

# Convert the buffer to a Python bytestring

1311

1505

fpr = ctypes.string_at(buf, buf_len.value)

1312

1506

# Convert the bytestring to hexadecimal notation

1313

hex_fpr = u''.join(u"%02X" % ord(char) for char in fpr)

1507

hex_fpr = ''.join("%02X" % ord(char) for char in fpr)

1314

1508

return hex_fpr

1315

1509

1316

1510

1322

1516

except:

1323

1517

self.handle_error(request, address)

1324

1518

self.close_request(request)

1325

1519

1326

1520

def process_request(self, request, address):

1327

1521

"""Start a new process to process the request."""

1328

multiprocessing.Process(target = self.sub_process_main,

1329

args = (request, address)).start()

1522

proc = multiprocessing.Process(target = self.sub_process_main,

1523

args = (request,

1524

address))

1525

proc.start()

1526

return proc

1527

1330

1528

1331

1529

class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):

1332

1530

""" adds a pipe to the MixIn """

1336

1534

This function creates a new pipe in self.pipe

1337

1535

"""

1338

1536

parent_pipe, self.child_pipe = multiprocessing.Pipe()

1339

1340

super(MultiprocessingMixInWithPipe,

1341

self).process_request(request, client_address)

1537

1538

proc = MultiprocessingMixIn.process_request(self, request,

1539

client_address)

1342

1540

self.child_pipe.close()

1343

self.add_pipe(parent_pipe)

1344

1345

def add_pipe(self, parent_pipe):

1541

self.add_pipe(parent_pipe, proc)

1542

1543

def add_pipe(self, parent_pipe, proc):

1346

1544

"""Dummy function; override as necessary"""

1347

pass

1545

raise NotImplementedError

1546

1348

1547

1349

1548

class IPv6_TCPServer(MultiprocessingMixInWithPipe,

1350

1549

socketserver.TCPServer, object):

1368

1567

bind to an address or port if they were not specified."""

1369

1568

if self.interface is not None:

1370

1569

if SO_BINDTODEVICE is None:

1371

logger.error(u"SO_BINDTODEVICE does not exist;"

1372

u" cannot bind to interface %s",

1570

logger.error("SO_BINDTODEVICE does not exist;"

1571

" cannot bind to interface %s",

1373

1572

self.interface)

1374

1573

else:

1375

1574

try:

1376

1575

self.socket.setsockopt(socket.SOL_SOCKET,

1377

1576

SO_BINDTODEVICE,

1378

1577

str(self.interface

1379

+ u'\0'))

1380

except socket.error, error:

1578

+ '\0'))

1579

except socket.error as error:

1381

1580

if error[0] == errno.EPERM:

1382

logger.error(u"No permission to"

1383

u" bind to interface %s",

1581

logger.error("No permission to"

1582

" bind to interface %s",

1384

1583

self.interface)

1385

1584

elif error[0] == errno.ENOPROTOOPT:

1386

logger.error(u"SO_BINDTODEVICE not available;"

1387

u" cannot bind to interface %s",

1585

logger.error("SO_BINDTODEVICE not available;"

1586

" cannot bind to interface %s",

1388

1587

self.interface)

1389

1588

else:

1390

1589

raise

1392

1591

if self.server_address[0] or self.server_address[1]:

1393

1592

if not self.server_address[0]:

1394

1593

if self.address_family == socket.AF_INET6:

1395

any_address = u"::" # in6addr_any

1594

any_address = "::" # in6addr_any

1396

1595

else:

1397

1596

any_address = socket.INADDR_ANY

1398

1597

self.server_address = (any_address,

1435

1634

def server_activate(self):

1436

1635

if self.enabled:

1437

1636

return socketserver.TCPServer.server_activate(self)

1637

1438

1638

def enable(self):

1439

1639

self.enabled = True

1440

def add_pipe(self, parent_pipe):

1640

1641

def add_pipe(self, parent_pipe, proc):

1441

1642

# Call "handle_ipc" for both data and EOF events

1442

1643

gobject.io_add_watch(parent_pipe.fileno(),

1443

1644

gobject.IO_IN | gobject.IO_HUP,

1444

1645

functools.partial(self.handle_ipc,

1445

parent_pipe = parent_pipe))

1446

1646

parent_pipe =

1647

parent_pipe,

1648

proc = proc))

1649

1447

1650

def handle_ipc(self, source, condition, parent_pipe=None,

1448

client_object=None):

1651

proc = None, client_object=None):

1449

1652

condition_names = {

1450

gobject.IO_IN: u"IN", # There is data to read.

1451

gobject.IO_OUT: u"OUT", # Data can be written (without

1653

gobject.IO_IN: "IN", # There is data to read.

1654

gobject.IO_OUT: "OUT", # Data can be written (without

1452

1655

# blocking).

1453

gobject.IO_PRI: u"PRI", # There is urgent data to read.

1454

gobject.IO_ERR: u"ERR", # Error condition.

1455

gobject.IO_HUP: u"HUP" # Hung up (the connection has been

1656

gobject.IO_PRI: "PRI", # There is urgent data to read.

1657

gobject.IO_ERR: "ERR", # Error condition.

1658

gobject.IO_HUP: "HUP" # Hung up (the connection has been

1456

1659

# broken, usually for pipes and

1457

1660

# sockets).

1458

1661

}

1460

1663

for cond, name in

1461

1664

condition_names.iteritems()

1462

1665

if cond & condition)

1463

logger.debug(u"Handling IPC: FD = %d, condition = %s", source,

1464

conditions_string)

1465

1466

# XXXTEDDY error or the other end of multiprocessing.Pipe has closed

1467

if condition & gobject.IO_HUP or condition & gobject.IO_ERR:

1666

# error, or the other end of multiprocessing.Pipe has closed

1667

if condition & (gobject.IO_ERR | condition & gobject.IO_HUP):

1668

# Wait for other process to exit

1669

proc.join()

1468

1670

return False

1469

1671

1470

1672

# Read a request from the child

1471

1673

request = parent_pipe.recv()

1472

logger.debug(u"IPC request: %s", repr(request))

1473

1674

command = request[0]

1474

1675

1475

1676

if command == 'init':

1481

1682

client = c

1482

1683

break

1483

1684

else:

1484

logger.warning(u"Client not found for fingerprint: %s, ad"

1485

u"dress: %s", fpr, address)

1685

logger.info("Client not found for fingerprint: %s, ad"

1686

"dress: %s", fpr, address)

1486

1687

if self.use_dbus:

1487

1688

# Emit D-Bus signal

1488

mandos_dbus_service.ClientNotFound(fpr, address)

1689

mandos_dbus_service.ClientNotFound(fpr,

1690

address[0])

1489

1691

parent_pipe.send(False)

1490

1692

return False

1491

1693

1492

1694

gobject.io_add_watch(parent_pipe.fileno(),

1493

1695

gobject.IO_IN | gobject.IO_HUP,

1494

1696

functools.partial(self.handle_ipc,

1495

parent_pipe = parent_pipe,

1496

client_object = client))

1697

parent_pipe =

1698

parent_pipe,

1699

proc = proc,

1700

client_object =

1701

client))

1497

1702

parent_pipe.send(True)

1498

# remove the old hook in favor of the new above hook on same fileno

1703

# remove the old hook in favor of the new above hook on

1704

# same fileno

1499

1705

return False

1500

1706

if command == 'funcall':

1501

1707

funcname = request[1]

1502

1708

args = request[2]

1503

1709

kwargs = request[3]

1504

1710

1505

parent_pipe.send(('data', getattr(client_object, funcname)(*args, **kwargs)))

1506

1711

parent_pipe.send(('data', getattr(client_object,

1712

funcname)(*args,

1713

**kwargs)))

1714

1507

1715

if command == 'getattr':

1508

1716

attrname = request[1]

1509

1717

if callable(client_object.__getattribute__(attrname)):

1510

1718

parent_pipe.send(('function',))

1511

1719

else:

1512

parent_pipe.send(('data', client_object.__getattribute__(attrname)))

1720

parent_pipe.send(('data', client_object

1721

.__getattribute__(attrname)))

1513

1722

1514

1723

if command == 'setattr':

1515

1724

attrname = request[1]

1516

1725

value = request[2]

1517

1726

setattr(client_object, attrname, value)

1518

1727

1519

1728

return True

1520

1729

1521

1730

1522

1731

def string_to_delta(interval):

1523

1732

"""Parse a string and return a datetime.timedelta

1524

1733

1525

>>> string_to_delta(u'7d')

1734

>>> string_to_delta('7d')

1526

1735

datetime.timedelta(7)

1527

>>> string_to_delta(u'60s')

1736

>>> string_to_delta('60s')

1528

1737

datetime.timedelta(0, 60)

1529

>>> string_to_delta(u'60m')

1738

>>> string_to_delta('60m')

1530

1739

datetime.timedelta(0, 3600)

1531

>>> string_to_delta(u'24h')

1740

>>> string_to_delta('24h')

1532

1741

datetime.timedelta(1)

1533

>>> string_to_delta(u'1w')

1742

>>> string_to_delta('1w')

1534

1743

datetime.timedelta(7)

1535

>>> string_to_delta(u'5m 30s')

1744

>>> string_to_delta('5m 30s')

1536

1745

datetime.timedelta(0, 330)

1537

1746

"""

1538

1747

timevalue = datetime.timedelta(0)

1540

1749

try:

1541

1750

suffix = unicode(s[-1])

1542

1751

value = int(s[:-1])

1543

if suffix == u"d":

1752

if suffix == "d":

1544

1753

delta = datetime.timedelta(value)

1545

elif suffix == u"s":

1754

elif suffix == "s":

1546

1755

delta = datetime.timedelta(0, value)

1547

elif suffix == u"m":

1756

elif suffix == "m":

1548

1757

delta = datetime.timedelta(0, 0, 0, 0, value)

1549

elif suffix == u"h":

1758

elif suffix == "h":

1550

1759

delta = datetime.timedelta(0, 0, 0, 0, 0, value)

1551

elif suffix == u"w":

1760

elif suffix == "w":

1552

1761

delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)

1553

1762

else:

1554

raise ValueError(u"Unknown suffix %r" % suffix)

1555

except (ValueError, IndexError), e:

1556

raise ValueError(e.message)

1763

raise ValueError("Unknown suffix %r" % suffix)

1764

except (ValueError, IndexError) as e:

1765

raise ValueError(*(e.args))

1557

1766

timevalue += delta

1558

1767

return timevalue

1559

1768

1565

1774

global if_nametoindex

1566

1775

try:

1567

1776

if_nametoindex = (ctypes.cdll.LoadLibrary

1568

(ctypes.util.find_library(u"c"))

1777

(ctypes.util.find_library("c"))

1569

1778

.if_nametoindex)

1570

1779

except (OSError, AttributeError):

1571

logger.warning(u"Doing if_nametoindex the hard way")

1780

logger.warning("Doing if_nametoindex the hard way")

1572

1781

def if_nametoindex(interface):

1573

1782

"Get an interface index the hard way, i.e. using fcntl()"

1574

1783

SIOCGIFINDEX = 0x8933 # From /usr/include/linux/sockios.h

1575

1784

with contextlib.closing(socket.socket()) as s:

1576

1785

ifreq = fcntl.ioctl(s, SIOCGIFINDEX,

1577

struct.pack(str(u"16s16x"),

1786

struct.pack(str("16s16x"),

1578

1787

interface))

1579

interface_index = struct.unpack(str(u"I"),

1788

interface_index = struct.unpack(str("I"),

1580

1789

ifreq[16:20])[0]

1581

1790

return interface_index

1582

1791

return if_nametoindex(interface)

1590

1799

sys.exit()

1591

1800

os.setsid()

1592

1801

if not nochdir:

1593

os.chdir(u"/")

1802

os.chdir("/")

1594

1803

if os.fork():

1595

1804

sys.exit()

1596

1805

if not noclose:

1598

1807

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1599

1808

if not stat.S_ISCHR(os.fstat(null).st_mode):

1600

1809

raise OSError(errno.ENODEV,

1601

u"%s not a character device"

1810

"%s not a character device"

1602

1811

% os.path.devnull)

1603

1812

os.dup2(null, sys.stdin.fileno())

1604

1813

os.dup2(null, sys.stdout.fileno())

1612

1821

##################################################################

1613

1822

# Parsing of options, both command line and config file

1614

1823

1615

parser = optparse.OptionParser(version = "%%prog %s" % version)

1616

parser.add_option("-i", u"--interface", type=u"string",

1617

metavar="IF", help=u"Bind to interface IF")

1618

parser.add_option("-a", u"--address", type=u"string",

1619

help=u"Address to listen for requests on")

1620

parser.add_option("-p", u"--port", type=u"int",

1621

help=u"Port number to receive requests on")

1622

parser.add_option("--check", action=u"store_true",

1623

help=u"Run self-test")

1624

parser.add_option("--debug", action=u"store_true",

1625

help=u"Debug mode; run in foreground and log to"

1626

u" terminal")

1627

parser.add_option("--priority", type=u"string", help=u"GnuTLS"

1628

u" priority string (see GnuTLS documentation)")

1629

parser.add_option("--servicename", type=u"string",

1630

metavar=u"NAME", help=u"Zeroconf service name")

1631

parser.add_option("--configdir", type=u"string",

1632

default=u"/etc/mandos", metavar=u"DIR",

1633

help=u"Directory to search for configuration"

1634

u" files")

1635

parser.add_option("--no-dbus", action=u"store_false",

1636

dest=u"use_dbus", help=u"Do not provide D-Bus"

1637

u" system bus interface")

1638

parser.add_option("--no-ipv6", action=u"store_false",

1639

dest=u"use_ipv6", help=u"Do not use IPv6")

1640

options = parser.parse_args()[0]

1824

parser = argparse.ArgumentParser()

1825

parser.add_argument("-v", "--version", action="version",

1826

version = "%%(prog)s %s" % version,

1827

help="show version number and exit")

1828

parser.add_argument("-i", "--interface", metavar="IF",

1829

help="Bind to interface IF")

1830

parser.add_argument("-a", "--address",

1831

help="Address to listen for requests on")

1832

parser.add_argument("-p", "--port", type=int,

1833

help="Port number to receive requests on")

1834

parser.add_argument("--check", action="store_true",

1835

help="Run self-test")

1836

parser.add_argument("--debug", action="store_true",

1837

help="Debug mode; run in foreground and log"

1838

" to terminal")

1839

parser.add_argument("--debuglevel", metavar="LEVEL",

1840

help="Debug level for stdout output")

1841

parser.add_argument("--priority", help="GnuTLS"

1842

" priority string (see GnuTLS documentation)")

1843

parser.add_argument("--servicename",

1844

metavar="NAME", help="Zeroconf service name")

1845

parser.add_argument("--configdir",

1846

default="/etc/mandos", metavar="DIR",

1847

help="Directory to search for configuration"

1848

" files")

1849

parser.add_argument("--no-dbus", action="store_false",

1850

dest="use_dbus", help="Do not provide D-Bus"

1851

" system bus interface")

1852

parser.add_argument("--no-ipv6", action="store_false",

1853

dest="use_ipv6", help="Do not use IPv6")

1854

options = parser.parse_args()

1641

1855

1642

1856

if options.check:

1643

1857

import doctest

1645

1859

sys.exit()

1646

1860

1647

1861

# Default values for config file for server-global settings

1648

server_defaults = { u"interface": u"",

1649

u"address": u"",

1650

u"port": u"",

1651

u"debug": u"False",

1652

u"priority":

1653

u"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1654

u"servicename": u"Mandos",

1655

u"use_dbus": u"True",

1656

u"use_ipv6": u"True",

1862

server_defaults = { "interface": "",

1863

"address": "",

1864

"port": "",

1865

"debug": "False",

1866

"priority":

1867

"SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",

1868

"servicename": "Mandos",

1869

"use_dbus": "True",

1870

"use_ipv6": "True",

1871

"debuglevel": "",

1657

1872

}

1658

1873

1659

1874

# Parse config file for server-global settings

1660

1875

server_config = configparser.SafeConfigParser(server_defaults)

1661

1876

del server_defaults

1662

1877

server_config.read(os.path.join(options.configdir,

1663

u"mandos.conf"))

1878

"mandos.conf"))

1664

1879

# Convert the SafeConfigParser object to a dict

1665

1880

server_settings = server_config.defaults()

1666

1881

# Use the appropriate methods on the non-string config options

1667

for option in (u"debug", u"use_dbus", u"use_ipv6"):

1668

server_settings[option] = server_config.getboolean(u"DEFAULT",

1882

for option in ("debug", "use_dbus", "use_ipv6"):

1883

server_settings[option] = server_config.getboolean("DEFAULT",

1669

1884

option)

1670

1885

if server_settings["port"]:

1671

server_settings["port"] = server_config.getint(u"DEFAULT",

1672

u"port")

1886

server_settings["port"] = server_config.getint("DEFAULT",

1887

"port")

1673

1888

del server_config

1674

1889

1675

1890

# Override the settings from the config file with command line

1676

1891

# options, if set.

1677

for option in (u"interface", u"address", u"port", u"debug",

1678

u"priority", u"servicename", u"configdir",

1679

u"use_dbus", u"use_ipv6"):

1892

for option in ("interface", "address", "port", "debug",

1893

"priority", "servicename", "configdir",

1894

"use_dbus", "use_ipv6", "debuglevel"):

1680

1895

value = getattr(options, option)

1681

1896

if value is not None:

1682

1897

server_settings[option] = value

1690

1905

##################################################################

1691

1906

1692

1907

# For convenience

1693

debug = server_settings[u"debug"]

1694

use_dbus = server_settings[u"use_dbus"]

1695

use_ipv6 = server_settings[u"use_ipv6"]

1696

1697

if not debug:

1698

syslogger.setLevel(logging.WARNING)

1699

console.setLevel(logging.WARNING)

1700

1701

if server_settings[u"servicename"] != u"Mandos":

1908

debug = server_settings["debug"]

1909

debuglevel = server_settings["debuglevel"]

1910

use_dbus = server_settings["use_dbus"]

1911

use_ipv6 = server_settings["use_ipv6"]

1912

1913

if server_settings["servicename"] != "Mandos":

1702

1914

syslogger.setFormatter(logging.Formatter

1703

(u'Mandos (%s) [%%(process)d]:'

1704

u' %%(levelname)s: %%(message)s'

1705

% server_settings[u"servicename"]))

1915

('Mandos (%s) [%%(process)d]:'

1916

' %%(levelname)s: %%(message)s'

1917

% server_settings["servicename"]))

1706

1918

1707

1919

# Parse config file with clients

1708

client_defaults = { u"timeout": u"1h",

1709

u"interval": u"5m",

1710

u"checker": u"fping -q -- %%(host)s",

1711

u"host": u"",

1712

u"approved_delay": u"0s",

1713

u"approved_duration": u"1s",

1920

client_defaults = { "timeout": "5m",

1921

"extended_timeout": "15m",

1922

"interval": "2m",

1923

"checker": "fping -q -- %%(host)s",

1924

"host": "",

1925

"approval_delay": "0s",

1926

"approval_duration": "1s",

1714

1927

}

1715

1928

client_config = configparser.SafeConfigParser(client_defaults)

1716

client_config.read(os.path.join(server_settings[u"configdir"],

1717

u"clients.conf"))

1929

client_config.read(os.path.join(server_settings["configdir"],

1930

"clients.conf"))

1718

1931

1719

1932

global mandos_dbus_service

1720

1933

mandos_dbus_service = None

1721

1934

1722

tcp_server = MandosServer((server_settings[u"address"],

1723

server_settings[u"port"]),

1935

tcp_server = MandosServer((server_settings["address"],

1936

server_settings["port"]),

1724

1937

ClientHandler,

1725

interface=server_settings[u"interface"],

1938

interface=(server_settings["interface"]

1939

or None),

1726

1940

use_ipv6=use_ipv6,

1727

1941

gnutls_priority=

1728

server_settings[u"priority"],

1942

server_settings["priority"],

1729

1943

use_dbus=use_dbus)

1730

pidfilename = u"/var/run/mandos.pid"

1731

try:

1732

pidfile = open(pidfilename, u"w")

1733

except IOError:

1734

logger.error(u"Could not open file %r", pidfilename)

1944

if not debug:

1945

pidfilename = "/var/run/mandos.pid"

1946

try:

1947

pidfile = open(pidfilename, "w")

1948

except IOError:

1949

logger.error("Could not open file %r", pidfilename)

1735

1950

1736

1951

try:

1737

uid = pwd.getpwnam(u"_mandos").pw_uid

1738

gid = pwd.getpwnam(u"_mandos").pw_gid

1952

uid = pwd.getpwnam("_mandos").pw_uid

1953

gid = pwd.getpwnam("_mandos").pw_gid

1739

1954

except KeyError:

1740

1955

try:

1741

uid = pwd.getpwnam(u"mandos").pw_uid

1742

gid = pwd.getpwnam(u"mandos").pw_gid

1956

uid = pwd.getpwnam("mandos").pw_uid

1957

gid = pwd.getpwnam("mandos").pw_gid

1743

1958

except KeyError:

1744

1959

try:

1745

uid = pwd.getpwnam(u"nobody").pw_uid

1746

gid = pwd.getpwnam(u"nobody").pw_gid

1960

uid = pwd.getpwnam("nobody").pw_uid

1961

gid = pwd.getpwnam("nobody").pw_gid

1747

1962

except KeyError:

1748

1963

uid = 65534

1749

1964

gid = 65534

1750

1965

try:

1751

1966

os.setgid(gid)

1752

1967

os.setuid(uid)

1753

except OSError, error:

1968

except OSError as error:

1754

1969

if error[0] != errno.EPERM:

1755

1970

raise error

1756

1971

1757

# Enable all possible GnuTLS debugging

1972

if not debug and not debuglevel:

1973

syslogger.setLevel(logging.WARNING)

1974

console.setLevel(logging.WARNING)

1975

if debuglevel:

1976

level = getattr(logging, debuglevel.upper())

1977

syslogger.setLevel(level)

1978

console.setLevel(level)

1979

1758

1980

if debug:

1981

# Enable all possible GnuTLS debugging

1982

1759

1983

# "Use a log level over 10 to enable all debugging options."

1760

1984

# - GnuTLS manual

1761

1985

gnutls.library.functions.gnutls_global_set_log_level(11)

1762

1986

1763

1987

@gnutls.library.types.gnutls_log_func

1764

1988

def debug_gnutls(level, string):

1765

logger.debug(u"GnuTLS: %s", string[:-1])

1989

logger.debug("GnuTLS: %s", string[:-1])

1766

1990

1767

1991

(gnutls.library.functions

1768

1992

.gnutls_global_set_log_function(debug_gnutls))

1993

1994

# Redirect stdin so all checkers get /dev/null

1995

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1996

os.dup2(null, sys.stdin.fileno())

1997

if null > 2:

1998

os.close(null)

1999

else:

2000

# No console logging

2001

logger.removeHandler(console)

2002

2003

# Need to fork before connecting to D-Bus

2004

if not debug:

2005

# Close all input and output, do double fork, etc.

2006

daemon()

1769

2007

1770

2008

global main_loop

1771

2009

# From the Avahi example code

1775

2013

# End of Avahi example code

1776

2014

if use_dbus:

1777

2015

try:

1778

bus_name = dbus.service.BusName(u"se.bsnet.fukt.Mandos",

2016

bus_name = dbus.service.BusName("se.recompile.Mandos",

1779

2017

bus, do_not_queue=True)

1780

except dbus.exceptions.NameExistsException, e:

1781

logger.error(unicode(e) + u", disabling D-Bus")

2018

old_bus_name = (dbus.service.BusName

2019

("se.bsnet.fukt.Mandos", bus,

2020

do_not_queue=True))

2021

except dbus.exceptions.NameExistsException as e:

2022

logger.error(unicode(e) + ", disabling D-Bus")

1782

2023

use_dbus = False

1783

server_settings[u"use_dbus"] = False

2024

server_settings["use_dbus"] = False

1784

2025

tcp_server.use_dbus = False

1785

2026

protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET

1786

service = AvahiService(name = server_settings[u"servicename"],

1787

servicetype = u"_mandos._tcp",

2027

service = AvahiService(name = server_settings["servicename"],

2028

servicetype = "_mandos._tcp",

1788

2029

protocol = protocol, bus = bus)

1789

2030

if server_settings["interface"]:

1790

2031

service.interface = (if_nametoindex

1791

(str(server_settings[u"interface"])))

1792

2032

(str(server_settings["interface"])))

2033

1793

2034

global multiprocessing_manager

1794

2035

multiprocessing_manager = multiprocessing.Manager()

1795

2036

1796

2037

client_class = Client

1797

2038

if use_dbus:

1798

client_class = functools.partial(ClientDBus, bus = bus)

2039

client_class = functools.partial(ClientDBusTransitional,

2040

bus = bus)

1799

2041

def client_config_items(config, section):

1800

2042

special_settings = {

1801

2043

"approved_by_default":

1814

2056

client_config, section)))

1815

2057

for section in client_config.sections()))

1816

2058

if not tcp_server.clients:

1817

logger.warning(u"No clients defined")

1818

1819

if debug:

1820

# Redirect stdin so all checkers get /dev/null

1821

null = os.open(os.path.devnull, os.O_NOCTTY | os.O_RDWR)

1822

os.dup2(null, sys.stdin.fileno())

1823

if null > 2:

1824

os.close(null)

1825

else:

1826

# No console logging

1827

logger.removeHandler(console)

1828

# Close all input and output, do double fork, etc.

1829

daemon()

1830

1831

try:

1832

with pidfile:

1833

pid = os.getpid()

1834

pidfile.write(str(pid) + "\n")

1835

del pidfile

1836

except IOError:

1837

logger.error(u"Could not write to file %r with PID %d",

1838

pidfilename, pid)

1839

except NameError:

1840

# "pidfile" was never created

1841

pass

1842

del pidfilename

1843

2059

logger.warning("No clients defined")

2060

1844

2061

if not debug:

2062

try:

2063

with pidfile:

2064

pid = os.getpid()

2065

pidfile.write(str(pid) + "\n".encode("utf-8"))

2066

del pidfile

2067

except IOError:

2068

logger.error("Could not write to file %r with PID %d",

2069

pidfilename, pid)

2070

except NameError:

2071

# "pidfile" was never created

2072

pass

2073

del pidfilename

2074

1845

2075

signal.signal(signal.SIGINT, signal.SIG_IGN)

2076

1846

2077

signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())

1847

2078

signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())

1848

2079

1850

2081

class MandosDBusService(dbus.service.Object):

1851

2082

"""A D-Bus proxy object"""

1852

2083

def __init__(self):

1853

dbus.service.Object.__init__(self, bus, u"/")

1854

_interface = u"se.bsnet.fukt.Mandos"

2084

dbus.service.Object.__init__(self, bus, "/")

2085

_interface = "se.recompile.Mandos"

1855

2086

1856

@dbus.service.signal(_interface, signature=u"o")

2087

@dbus.service.signal(_interface, signature="o")

1857

2088

def ClientAdded(self, objpath):

1858

2089

"D-Bus signal"

1859

2090

pass

1860

2091

1861

@dbus.service.signal(_interface, signature=u"ss")

2092

@dbus.service.signal(_interface, signature="ss")

1862

2093

def ClientNotFound(self, fingerprint, address):

1863

2094

"D-Bus signal"

1864

2095

pass

1865

2096

1866

@dbus.service.signal(_interface, signature=u"os")

2097

@dbus.service.signal(_interface, signature="os")

1867

2098

def ClientRemoved(self, objpath, name):

1868

2099

"D-Bus signal"

1869

2100

pass

1870

2101

1871

@dbus.service.method(_interface, out_signature=u"ao")

2102

@dbus.service.method(_interface, out_signature="ao")

1872

2103

def GetAllClients(self):

1873

2104

"D-Bus method"

1874

2105

return dbus.Array(c.dbus_object_path

1875

2106

for c in tcp_server.clients)

1876

2107

1877

2108

@dbus.service.method(_interface,

1878

out_signature=u"a{oa{sv}}")

2109

out_signature="a{oa{sv}}")

1879

2110

def GetAllClientsWithProperties(self):

1880

2111

"D-Bus method"

1881

2112

return dbus.Dictionary(

1882

((c.dbus_object_path, c.GetAll(u""))

2113

((c.dbus_object_path, c.GetAll(""))

1883

2114

for c in tcp_server.clients),

1884

signature=u"oa{sv}")

2115

signature="oa{sv}")

1885

2116

1886

@dbus.service.method(_interface, in_signature=u"o")

2117

@dbus.service.method(_interface, in_signature="o")

1887

2118

def RemoveClient(self, object_path):

1888

2119

"D-Bus method"

1889

2120

for c in tcp_server.clients:

1899

2130

1900

2131

del _interface

1901

2132

1902

mandos_dbus_service = MandosDBusService()

2133

class MandosDBusServiceTransitional(MandosDBusService):

2134

__metaclass__ = AlternateDBusNamesMetaclass

2135

mandos_dbus_service = MandosDBusServiceTransitional()

1903

2136

1904

2137

def cleanup():

1905

2138

"Cleanup function; run on exit"

1906

2139

service.cleanup()

1907

2140

2141

multiprocessing.active_children()

1908

2142

while tcp_server.clients:

1909

2143

client = tcp_server.clients.pop()

1910

2144

if use_dbus:

1914

2148

client.disable(quiet=True)

1915

2149

if use_dbus:

1916

2150

# Emit D-Bus signal

1917

mandos_dbus_service.ClientRemoved(client.dbus_object_path,

2151

mandos_dbus_service.ClientRemoved(client

2152

.dbus_object_path,

1918

2153

client.name)

1919

2154

1920

2155

atexit.register(cleanup)

1931

2166

# Find out what port we got

1932

2167

service.port = tcp_server.socket.getsockname()[1]

1933

2168

if use_ipv6:

1934

logger.info(u"Now listening on address %r, port %d,"

2169

logger.info("Now listening on address %r, port %d,"

1935

2170

" flowinfo %d, scope_id %d"

1936

2171

% tcp_server.socket.getsockname())

1937

2172

else: # IPv4

1938

logger.info(u"Now listening on address %r, port %d"

2173

logger.info("Now listening on address %r, port %d"

1939

2174

% tcp_server.socket.getsockname())

1940

2175

1941

2176

#service.interface = tcp_server.socket.getsockname()[3]

1944

2179

# From the Avahi example code

1945

2180

try:

1946

2181

service.activate()

1947

except dbus.exceptions.DBusException, error:

1948

logger.critical(u"DBusException: %s", error)

2182

except dbus.exceptions.DBusException as error:

2183

logger.critical("DBusException: %s", error)

1949

2184

cleanup()

1950

2185

sys.exit(1)

1951

2186

# End of Avahi example code

1955

2190

(tcp_server.handle_request

1956

2191

(*args[2:], **kwargs) or True))

1957

2192

1958

logger.debug(u"Starting main loop")

2193

logger.debug("Starting main loop")

1959

2194

main_loop.run()

1960

except AvahiError, error:

1961

logger.critical(u"AvahiError: %s", error)

2195

except AvahiError as error:

2196

logger.critical("AvahiError: %s", error)

1962

2197

cleanup()

1963

2198

sys.exit(1)

1964

2199

except KeyboardInterrupt:

1965

2200

if debug:

1966

print >> sys.stderr

1967

logger.debug(u"Server received KeyboardInterrupt")

1968

logger.debug(u"Server exiting")

2201

print("", file=sys.stderr)

2202

logger.debug("Server received KeyboardInterrupt")

2203

logger.debug("Server exiting")

1969

2204

# Must run before the D-Bus bus name gets deregistered

1970

2205

cleanup()

1971

2206

2207

1972

2208

if __name__ == '__main__':

1973

2209

main()