/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release
3 by Björn Påhlsson
Python based server
1
#!/usr/bin/python
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2
# -*- mode: python; coding: utf-8 -*-
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
3
# 
4
# Mandos server - give out binary blobs to connecting clients.
5
# 
6
# This program is partly derived from an example program for an Avahi
7
# service publisher, downloaded from
8
# <http://avahi.org/wiki/PythonPublishExample>.  This includes the
237.2.99 by Teddy Hogeborn
Code cleanup.
9
# methods "add", "remove", "server_state_changed",
10
# "entry_group_state_changed", "cleanup", and "activate" in the
11
# "AvahiService" class, and some lines in "main".
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
12
# 
28 by Teddy Hogeborn
* server.conf: New file.
13
# Everything else is
237.7.92 by Teddy Hogeborn
Updated year in copyright notices.
14
# Copyright © 2008-2012 Teddy Hogeborn
15
# Copyright © 2008-2012 Björn Påhlsson
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
16
# 
17
# This program is free software: you can redistribute it and/or modify
18
# it under the terms of the GNU General Public License as published by
19
# the Free Software Foundation, either version 3 of the License, or
20
# (at your option) any later version.
21
#
22
#     This program is distributed in the hope that it will be useful,
23
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
24
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
25
#     GNU General Public License for more details.
26
# 
27
# You should have received a copy of the GNU General Public License
109 by Teddy Hogeborn
* .bzrignore: New.
28
# along with this program.  If not, see
29
# <http://www.gnu.org/licenses/>.
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
30
# 
237.11.2 by Teddy Hogeborn
Change "fukt.bsnet.se" to "recompile.se" throughout.
31
# Contact the authors at <mandos@recompile.se>.
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
32
# 
3 by Björn Påhlsson
Python based server
33
237.8.5 by teddy at bsnet
* mandos: Use unicode string literals.
34
from __future__ import (division, absolute_import, print_function,
35
                        unicode_literals)
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
36
237.7.127 by Teddy Hogeborn
* mandos: Use all new builtins.
37
from future_builtins import *
38
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
39
import SocketServer as socketserver
3 by Björn Påhlsson
Python based server
40
import socket
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
41
import argparse
3 by Björn Påhlsson
Python based server
42
import datetime
43
import errno
44
import gnutls.crypto
45
import gnutls.connection
46
import gnutls.errors
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
47
import gnutls.library.functions
48
import gnutls.library.constants
49
import gnutls.library.types
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
50
import ConfigParser as configparser
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
51
import sys
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
52
import re
53
import os
54
import signal
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
55
import subprocess
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
56
import atexit
57
import stat
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
58
import logging
59
import logging.handlers
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
60
import pwd
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
61
import contextlib
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
62
import struct
63
import fcntl
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
64
import functools
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
65
import cPickle as pickle
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
66
import multiprocessing
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
67
import types
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
68
import binascii
69
import tempfile
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
70
import itertools
5 by Teddy Hogeborn
* server.py (server_metaclass): New.
71
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
72
import dbus
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
73
import dbus.service
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
74
import gobject
75
import avahi
76
from dbus.mainloop.glib import DBusGMainLoop
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
77
import ctypes
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
78
import ctypes.util
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
79
import xml.dom.minidom
80
import inspect
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
81
import GnuPGInterface
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
82
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
83
try:
84
    SO_BINDTODEVICE = socket.SO_BINDTODEVICE
85
except AttributeError:
86
    try:
87
        from IN import SO_BINDTODEVICE
88
    except ImportError:
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
89
        SO_BINDTODEVICE = None
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
90
301 by Teddy Hogeborn
* Makefile (version): Changed to "1.5.5".
91
version = "1.5.5"
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
92
stored_state_file = "clients.pickle"
13 by Björn Påhlsson
Added following support:
93
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
94
logger = logging.getLogger()
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
95
syslogger = (logging.handlers.SysLogHandler
96
             (facility = logging.handlers.SysLogHandler.LOG_DAEMON,
237.8.6 by teddy at bsnet
* mandos: Bug fix: pass str("/dev/log") to logging.SysLogHandler(),
97
              address = str("/dev/log")))
13 by Björn Påhlsson
Added following support:
98
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
99
try:
100
    if_nametoindex = (ctypes.cdll.LoadLibrary
101
                      (ctypes.util.find_library("c"))
102
                      .if_nametoindex)
103
except (OSError, AttributeError):
104
    def if_nametoindex(interface):
105
        "Get an interface index the hard way, i.e. using fcntl()"
106
        SIOCGIFINDEX = 0x8933  # From /usr/include/linux/sockios.h
107
        with contextlib.closing(socket.socket()) as s:
108
            ifreq = fcntl.ioctl(s, SIOCGIFINDEX,
109
                                struct.pack(str("16s16x"),
110
                                            interface))
111
        interface_index = struct.unpack(str("I"),
112
                                        ifreq[16:20])[0]
113
        return interface_index
114
115
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
116
def initlogger(debug, level=logging.WARNING):
237.12.4 by Björn Påhlsson
restructured logger
117
    """init logger and add loglevel"""
118
    
119
    syslogger.setFormatter(logging.Formatter
120
                           ('Mandos [%(process)d]: %(levelname)s:'
121
                            ' %(message)s'))
122
    logger.addHandler(syslogger)
123
    
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
124
    if debug:
125
        console = logging.StreamHandler()
126
        console.setFormatter(logging.Formatter('%(asctime)s %(name)s'
127
                                               ' [%(process)d]:'
128
                                               ' %(levelname)s:'
129
                                               ' %(message)s'))
130
        logger.addHandler(console)
237.12.4 by Björn Påhlsson
restructured logger
131
    logger.setLevel(level)
28 by Teddy Hogeborn
* server.conf: New file.
132
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
133
237.12.9 by Björn Påhlsson
renamed variables
134
class PGPError(Exception):
135
    """Exception if encryption/decryption fails"""
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
136
    pass
137
138
237.12.9 by Björn Påhlsson
renamed variables
139
class PGPEngine(object):
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
140
    """A simple class for OpenPGP symmetric encryption & decryption"""
141
    def __init__(self):
142
        self.gnupg = GnuPGInterface.GnuPG()
143
        self.tempdir = tempfile.mkdtemp(prefix="mandos-")
144
        self.gnupg = GnuPGInterface.GnuPG()
145
        self.gnupg.options.meta_interactive = False
146
        self.gnupg.options.homedir = self.tempdir
147
        self.gnupg.options.extra_args.extend(['--force-mdc',
237.7.88 by Teddy Hogeborn
* mandos (PGPEngine.__init__): Add "--no-use-agent" to gpg options.
148
                                              '--quiet',
149
                                              '--no-use-agent'])
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
150
    
151
    def __enter__(self):
152
        return self
153
    
237.7.135 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
154
    def __exit__(self, exc_type, exc_value, traceback):
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
155
        self._cleanup()
156
        return False
157
    
158
    def __del__(self):
159
        self._cleanup()
160
    
161
    def _cleanup(self):
162
        if self.tempdir is not None:
163
            # Delete contents of tempdir
164
            for root, dirs, files in os.walk(self.tempdir,
165
                                             topdown = False):
166
                for filename in files:
167
                    os.remove(os.path.join(root, filename))
168
                for dirname in dirs:
169
                    os.rmdir(os.path.join(root, dirname))
170
            # Remove tempdir
171
            os.rmdir(self.tempdir)
172
            self.tempdir = None
173
    
174
    def password_encode(self, password):
175
        # Passphrase can not be empty and can not contain newlines or
176
        # NUL bytes.  So we prefix it and hex encode it.
177
        return b"mandos" + binascii.hexlify(password)
178
    
179
    def encrypt(self, data, password):
180
        self.gnupg.passphrase = self.password_encode(password)
237.18.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
181
        with open(os.devnull, "w") as devnull:
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
182
            try:
183
                proc = self.gnupg.run(['--symmetric'],
184
                                      create_fhs=['stdin', 'stdout'],
185
                                      attach_fhs={'stderr': devnull})
186
                with contextlib.closing(proc.handles['stdin']) as f:
187
                    f.write(data)
188
                with contextlib.closing(proc.handles['stdout']) as f:
189
                    ciphertext = f.read()
190
                proc.wait()
191
            except IOError as e:
237.12.9 by Björn Påhlsson
renamed variables
192
                raise PGPError(e)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
193
        self.gnupg.passphrase = None
194
        return ciphertext
195
    
196
    def decrypt(self, data, password):
197
        self.gnupg.passphrase = self.password_encode(password)
237.18.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
198
        with open(os.devnull, "w") as devnull:
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
199
            try:
200
                proc = self.gnupg.run(['--decrypt'],
201
                                      create_fhs=['stdin', 'stdout'],
202
                                      attach_fhs={'stderr': devnull})
237.18.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
203
                with contextlib.closing(proc.handles['stdin']) as f:
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
204
                    f.write(data)
205
                with contextlib.closing(proc.handles['stdout']) as f:
206
                    decrypted_plaintext = f.read()
207
                proc.wait()
208
            except IOError as e:
237.12.9 by Björn Påhlsson
renamed variables
209
                raise PGPError(e)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
210
        self.gnupg.passphrase = None
211
        return decrypted_plaintext
212
213
28 by Teddy Hogeborn
* server.conf: New file.
214
class AvahiError(Exception):
237.2.5 by Teddy Hogeborn
* mandos (AvahiError): Converted to use unicode. All users changed.
215
    def __init__(self, value, *args, **kwargs):
28 by Teddy Hogeborn
* server.conf: New file.
216
        self.value = value
237.2.5 by Teddy Hogeborn
* mandos (AvahiError): Converted to use unicode. All users changed.
217
        super(AvahiError, self).__init__(value, *args, **kwargs)
218
    def __unicode__(self):
219
        return unicode(repr(self.value))
28 by Teddy Hogeborn
* server.conf: New file.
220
221
class AvahiServiceError(AvahiError):
222
    pass
223
224
class AvahiGroupError(AvahiError):
225
    pass
226
227
228
class AvahiService(object):
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
229
    """An Avahi (Zeroconf) service.
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
230
    
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
231
    Attributes:
28 by Teddy Hogeborn
* server.conf: New file.
232
    interface: integer; avahi.IF_UNSPEC or an interface index.
233
               Used to optionally bind to the specified interface.
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
234
    name: string; Example: 'Mandos'
235
    type: string; Example: '_mandos._tcp'.
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
236
                  See <http://www.dns-sd.org/ServiceTypes.html>
237
    port: integer; what port to announce
238
    TXT: list of strings; TXT record for the service
239
    domain: string; Domain to publish on, default to .local if empty.
240
    host: string; Host to publish records for, default is localhost
241
    max_renames: integer; maximum number of renames
242
    rename_count: integer; counter so we only rename after collisions
243
                  a sensible number of times
237.2.99 by Teddy Hogeborn
Code cleanup.
244
    group: D-Bus Entry Group
245
    server: D-Bus Server
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
246
    bus: dbus.SystemBus()
28 by Teddy Hogeborn
* server.conf: New file.
247
    """
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
248
    
28 by Teddy Hogeborn
* server.conf: New file.
249
    def __init__(self, interface = avahi.IF_UNSPEC, name = None,
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
250
                 servicetype = None, port = None, TXT = None,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
251
                 domain = "", host = "", max_renames = 32768,
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
252
                 protocol = avahi.PROTO_UNSPEC, bus = None):
28 by Teddy Hogeborn
* server.conf: New file.
253
        self.interface = interface
254
        self.name = name
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
255
        self.type = servicetype
28 by Teddy Hogeborn
* server.conf: New file.
256
        self.port = port
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
257
        self.TXT = TXT if TXT is not None else []
28 by Teddy Hogeborn
* server.conf: New file.
258
        self.domain = domain
259
        self.host = host
260
        self.rename_count = 0
76 by Teddy Hogeborn
* plugins.d/password-request.c (init_gnutls_global): Renamed
261
        self.max_renames = max_renames
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
262
        self.protocol = protocol
237.2.99 by Teddy Hogeborn
Code cleanup.
263
        self.group = None       # our entry group
264
        self.server = None
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
265
        self.bus = bus
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
266
        self.entry_group_state_changed_match = None
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
267
    
28 by Teddy Hogeborn
* server.conf: New file.
268
    def rename(self):
269
        """Derived from the Avahi example code"""
270
        if self.rename_count >= self.max_renames:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
271
            logger.critical("No suitable Zeroconf service name found"
272
                            " after %i retries, exiting.",
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
273
                            self.rename_count)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
274
            raise AvahiServiceError("Too many renames")
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
275
        self.name = unicode(self.server
276
                            .GetAlternativeServiceName(self.name))
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
277
        logger.info("Changing Zeroconf service name to %r ...",
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
278
                    self.name)
28 by Teddy Hogeborn
* server.conf: New file.
279
        self.remove()
24.1.160 by Björn Påhlsson
fixed bug with local name collisions after a non-local name collision
280
        try:
281
            self.add()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
282
        except dbus.exceptions.DBusException as error:
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
283
            logger.critical("D-Bus Exception", exc_info=error)
24.1.160 by Björn Påhlsson
fixed bug with local name collisions after a non-local name collision
284
            self.cleanup()
285
            os._exit(1)
28 by Teddy Hogeborn
* server.conf: New file.
286
        self.rename_count += 1
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
287
    
28 by Teddy Hogeborn
* server.conf: New file.
288
    def remove(self):
289
        """Derived from the Avahi example code"""
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
290
        if self.entry_group_state_changed_match is not None:
291
            self.entry_group_state_changed_match.remove()
292
            self.entry_group_state_changed_match = None
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
293
        if self.group is not None:
294
            self.group.Reset()
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
295
    
28 by Teddy Hogeborn
* server.conf: New file.
296
    def add(self):
297
        """Derived from the Avahi example code"""
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
298
        self.remove()
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
299
        if self.group is None:
300
            self.group = dbus.Interface(
301
                self.bus.get_object(avahi.DBUS_NAME,
302
                                    self.server.EntryGroupNew()),
303
                avahi.DBUS_INTERFACE_ENTRY_GROUP)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
304
        self.entry_group_state_changed_match = (
305
            self.group.connect_to_signal(
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
306
                'StateChanged', self.entry_group_state_changed))
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
307
        logger.debug("Adding Zeroconf service '%s' of type '%s' ...",
237.2.99 by Teddy Hogeborn
Code cleanup.
308
                     self.name, self.type)
309
        self.group.AddService(
310
            self.interface,
311
            self.protocol,
312
            dbus.UInt32(0),     # flags
313
            self.name, self.type,
314
            self.domain, self.host,
315
            dbus.UInt16(self.port),
316
            avahi.string_array_to_txt_array(self.TXT))
317
        self.group.Commit()
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
318
    
237.2.99 by Teddy Hogeborn
Code cleanup.
319
    def entry_group_state_changed(self, state, error):
320
        """Derived from the Avahi example code"""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
321
        logger.debug("Avahi entry group state change: %i", state)
237.2.99 by Teddy Hogeborn
Code cleanup.
322
        
323
        if state == avahi.ENTRY_GROUP_ESTABLISHED:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
324
            logger.debug("Zeroconf service established.")
237.2.99 by Teddy Hogeborn
Code cleanup.
325
        elif state == avahi.ENTRY_GROUP_COLLISION:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
326
            logger.info("Zeroconf service name collision.")
237.2.99 by Teddy Hogeborn
Code cleanup.
327
            self.rename()
328
        elif state == avahi.ENTRY_GROUP_FAILURE:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
329
            logger.critical("Avahi: Error in group state changed %s",
237.2.99 by Teddy Hogeborn
Code cleanup.
330
                            unicode(error))
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
331
            raise AvahiGroupError("State changed: {0!s}"
332
                                  .format(error))
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
333
    
237.2.99 by Teddy Hogeborn
Code cleanup.
334
    def cleanup(self):
335
        """Derived from the Avahi example code"""
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
336
        if self.group is not None:
337
            try:
338
                self.group.Free()
339
            except (dbus.exceptions.UnknownMethodException,
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
340
                    dbus.exceptions.DBusException):
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
341
                pass
342
            self.group = None
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
343
        self.remove()
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
344
    
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
345
    def server_state_changed(self, state, error=None):
237.2.99 by Teddy Hogeborn
Code cleanup.
346
        """Derived from the Avahi example code"""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
347
        logger.debug("Avahi server state change: %i", state)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
348
        bad_states = { avahi.SERVER_INVALID:
349
                           "Zeroconf server invalid",
350
                       avahi.SERVER_REGISTERING: None,
351
                       avahi.SERVER_COLLISION:
352
                           "Zeroconf server name collision",
353
                       avahi.SERVER_FAILURE:
354
                           "Zeroconf server failure" }
355
        if state in bad_states:
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
356
            if bad_states[state] is not None:
357
                if error is None:
358
                    logger.error(bad_states[state])
359
                else:
360
                    logger.error(bad_states[state] + ": %r", error)
361
            self.cleanup()
237.2.99 by Teddy Hogeborn
Code cleanup.
362
        elif state == avahi.SERVER_RUNNING:
363
            self.add()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
364
        else:
237.7.31 by Teddy Hogeborn
* mandos: Never call .Reset() on a defunct Avahi entry group.
365
            if error is None:
366
                logger.debug("Unknown state: %r", state)
367
            else:
368
                logger.debug("Unknown state: %r: %r", state, error)
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
369
    
237.2.99 by Teddy Hogeborn
Code cleanup.
370
    def activate(self):
371
        """Derived from the Avahi example code"""
372
        if self.server is None:
373
            self.server = dbus.Interface(
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
374
                self.bus.get_object(avahi.DBUS_NAME,
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
375
                                    avahi.DBUS_PATH_SERVER,
376
                                    follow_name_owner_changes=True),
237.2.99 by Teddy Hogeborn
Code cleanup.
377
                avahi.DBUS_INTERFACE_SERVER)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
378
        self.server.connect_to_signal("StateChanged",
237.2.99 by Teddy Hogeborn
Code cleanup.
379
                                 self.server_state_changed)
380
        self.server_state_changed(self.server.GetState())
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
381
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
382
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
383
class AvahiServiceToSyslog(AvahiService):
384
    def rename(self):
385
        """Add the new name to the syslog messages"""
386
        ret = AvahiService.rename(self)
387
        syslogger.setFormatter(logging.Formatter
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
388
                               ('Mandos ({0}) [%(process)d]:'
389
                                ' %(levelname)s: %(message)s'
390
                                .format(self.name)))
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
391
        return ret
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
392
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
393
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
394
def timedelta_to_milliseconds(td):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
395
    "Convert a datetime.timedelta() to milliseconds"
396
    return ((td.days * 24 * 60 * 60 * 1000)
397
            + (td.seconds * 1000)
398
            + (td.microseconds // 1000))
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
399
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
400
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
401
class Client(object):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
402
    """A representation of a client host served by this server.
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
403
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
404
    Attributes:
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
405
    approved:   bool(); 'None' if not yet approved/disapproved
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
406
    approval_delay: datetime.timedelta(); Time to wait for approval
407
    approval_duration: datetime.timedelta(); Duration of one approval
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
408
    checker:    subprocess.Popen(); a running checker process used
409
                                    to see if the client lives.
410
                                    'None' if no process is running.
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
411
    checker_callback_tag: a gobject event source tag, or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
412
    checker_command: string; External command which is run to check
413
                     if client lives.  %() expansions are done at
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
414
                     runtime with vars(self) as dict, so that for
415
                     instance %(name)s can be used in the command.
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
416
    checker_initiator_tag: a gobject event source tag, or None
417
    created:    datetime.datetime(); (UTC) object creation
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
418
    client_structure: Object describing what attributes a client has
419
                      and is used for storing the client at exit
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
420
    current_checker_command: string; current running checker_command
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
421
    disable_initiator_tag: a gobject event source tag, or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
422
    enabled:    bool()
423
    fingerprint: string (40 or 32 hexadecimal digits); used to
424
                 uniquely identify the client
425
    host:       string; available for use by the checker command
426
    interval:   datetime.timedelta(); How often to start a new checker
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
427
    last_approval_request: datetime.datetime(); (UTC) or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
428
    last_checked_ok: datetime.datetime(); (UTC) or None
237.7.69 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
429
    last_checker_status: integer between 0 and 255 reflecting exit
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
430
                         status of last checker. -1 reflects crashed
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
431
                         checker, -2 means no checker completed yet.
237.14.3 by Teddy Hogeborn
Make "enabled" a client config option.
432
    last_enabled: datetime.datetime(); (UTC) or None
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
433
    name:       string; from the config file, used in log messages and
434
                        D-Bus identifiers
435
    secret:     bytestring; sent verbatim (over TLS) to client
436
    timeout:    datetime.timedelta(); How long from last_checked_ok
437
                                      until this client is disabled
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
438
    extended_timeout:   extra long timeout when secret has been sent
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
439
    runtime_expansions: Allowed attributes for runtime expansion.
237.7.45 by Teddy Hogeborn
* DBUS-API: Document new "Expires" and "ExtendedTimeout" properties.
440
    expires:    datetime.datetime(); time (UTC) when a client will be
24.1.179 by Björn Påhlsson
New feature:
441
                disabled, or None
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
442
    """
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
443
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
444
    runtime_expansions = ("approval_delay", "approval_duration",
237.7.132 by Teddy Hogeborn
* mandos (Client.runtime_expansions): Add "expires" and (bug fix)
445
                          "created", "enabled", "expires",
446
                          "fingerprint", "host", "interval",
447
                          "last_approval_request", "last_checked_ok",
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
448
                          "last_enabled", "name", "timeout")
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
449
    client_defaults = { "timeout": "5m",
450
                        "extended_timeout": "15m",
451
                        "interval": "2m",
452
                        "checker": "fping -q -- %%(host)s",
453
                        "host": "",
454
                        "approval_delay": "0s",
455
                        "approval_duration": "1s",
456
                        "approved_by_default": "True",
457
                        "enabled": "True",
458
                        }
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
459
    
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
460
    def timeout_milliseconds(self):
461
        "Return the 'timeout' attribute in milliseconds"
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
462
        return timedelta_to_milliseconds(self.timeout)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
463
    
24.1.179 by Björn Påhlsson
New feature:
464
    def extended_timeout_milliseconds(self):
465
        "Return the 'extended_timeout' attribute in milliseconds"
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
466
        return timedelta_to_milliseconds(self.extended_timeout)
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
467
    
468
    def interval_milliseconds(self):
469
        "Return the 'interval' attribute in milliseconds"
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
470
        return timedelta_to_milliseconds(self.interval)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
471
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
472
    def approval_delay_milliseconds(self):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
473
        return timedelta_to_milliseconds(self.approval_delay)
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
474
    
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
475
    @staticmethod
476
    def config_parser(config):
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
477
        """Construct a new dict of client settings of this form:
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
478
        { client_name: {setting_name: value, ...}, ...}
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
479
        with exceptions for any special settings as defined above.
480
        NOTE: Must be a pure function. Must return the same result
481
        value given the same arguments.
482
        """
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
483
        settings = {}
484
        for client_name in config.sections():
485
            section = dict(config.items(client_name))
486
            client = settings[client_name] = {}
487
            
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
488
            client["host"] = section["host"]
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
489
            # Reformat values from string types to Python types
490
            client["approved_by_default"] = config.getboolean(
491
                client_name, "approved_by_default")
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
492
            client["enabled"] = config.getboolean(client_name,
493
                                                  "enabled")
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
494
            
495
            client["fingerprint"] = (section["fingerprint"].upper()
496
                                     .replace(" ", ""))
497
            if "secret" in section:
498
                client["secret"] = section["secret"].decode("base64")
499
            elif "secfile" in section:
500
                with open(os.path.expanduser(os.path.expandvars
501
                                             (section["secfile"])),
502
                          "rb") as secfile:
503
                    client["secret"] = secfile.read()
504
            else:
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
505
                raise TypeError("No secret or secfile for section {0}"
506
                                .format(section))
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
507
            client["timeout"] = string_to_delta(section["timeout"])
508
            client["extended_timeout"] = string_to_delta(
509
                section["extended_timeout"])
510
            client["interval"] = string_to_delta(section["interval"])
511
            client["approval_delay"] = string_to_delta(
512
                section["approval_delay"])
513
            client["approval_duration"] = string_to_delta(
514
                section["approval_duration"])
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
515
            client["checker_command"] = section["checker"]
516
            client["last_approval_request"] = None
517
            client["last_checked_ok"] = None
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
518
            client["last_checker_status"] = -2
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
519
        
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
520
        return settings
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
521
    
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
522
    def __init__(self, settings, name = None):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
523
        self.name = name
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
524
        # adding all client settings
525
        for setting, value in settings.iteritems():
526
            setattr(self, setting, value)
527
        
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
528
        if self.enabled:
529
            if not hasattr(self, "last_enabled"):
530
                self.last_enabled = datetime.datetime.utcnow()
531
            if not hasattr(self, "expires"):
532
                self.expires = (datetime.datetime.utcnow()
533
                                + self.timeout)
534
        else:
535
            self.last_enabled = None
536
            self.expires = None
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
537
        
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
538
        logger.debug("Creating client %r", self.name)
45 by Teddy Hogeborn
* server.py: Cosmetic changes.
539
        # Uppercase and remove spaces from fingerprint for later
540
        # comparison purposes with return value from the fingerprint()
541
        # function
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
542
        logger.debug("  Fingerprint: %s", self.fingerprint)
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
543
        self.created = settings.get("created",
544
                                    datetime.datetime.utcnow())
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
545
        
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
546
        # attributes specific for this server instance
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
547
        self.checker = None
548
        self.checker_initiator_tag = None
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
549
        self.disable_initiator_tag = None
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
550
        self.checker_callback_tag = None
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
551
        self.current_checker_command = None
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
552
        self.approved = None
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
553
        self.approvals_pending = 0
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
554
        self.changedstate = (multiprocessing_manager
555
                             .Condition(multiprocessing_manager
556
                                        .Lock()))
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
557
        self.client_structure = [attr for attr in
558
                                 self.__dict__.iterkeys()
237.7.69 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
559
                                 if not attr.startswith("_")]
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
560
        self.client_structure.append("client_structure")
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
561
        
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
562
        for name, t in inspect.getmembers(type(self),
237.7.69 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
563
                                          lambda obj:
564
                                              isinstance(obj,
565
                                                         property)):
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
566
            if not name.startswith("_"):
567
                self.client_structure.append(name)
568
    
237.7.68 by Björn Påhlsson
merge persistent state
569
    # Send notice to process children that client state has changed
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
570
    def send_changedstate(self):
237.7.68 by Björn Påhlsson
merge persistent state
571
        with self.changedstate:
572
            self.changedstate.notify_all()
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
573
    
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
574
    def enable(self):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
575
        """Start this client's checker and timeout hooks"""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
576
        if getattr(self, "enabled", False):
237.2.104 by Teddy Hogeborn
Code cleanup and one bug fix.
577
            # Already enabled
578
            return
24.1.179 by Björn Påhlsson
New feature:
579
        self.expires = datetime.datetime.utcnow() + self.timeout
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
580
        self.enabled = True
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
581
        self.last_enabled = datetime.datetime.utcnow()
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
582
        self.init_checker()
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
583
        self.send_changedstate()
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
584
    
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
585
    def disable(self, quiet=True):
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
586
        """Disable this client."""
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
587
        if not getattr(self, "enabled", False):
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
588
            return False
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
589
        if not quiet:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
590
            logger.info("Disabling client %s", self.name)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
591
        if getattr(self, "disable_initiator_tag", None) is not None:
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
592
            gobject.source_remove(self.disable_initiator_tag)
593
            self.disable_initiator_tag = None
24.1.179 by Björn Påhlsson
New feature:
594
        self.expires = None
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
595
        if getattr(self, "checker_initiator_tag", None) is not None:
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
596
            gobject.source_remove(self.checker_initiator_tag)
597
            self.checker_initiator_tag = None
598
        self.stop_checker()
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
599
        self.enabled = False
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
600
        if not quiet:
601
            self.send_changedstate()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
602
        # Do not run this again if called by a gobject.timeout_add
603
        return False
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
604
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
605
    def __del__(self):
237.2.2 by Teddy Hogeborn
* mandos (_datetime_to_dbus_struct): Renamed to "_datetime_to_dbus";
606
        self.disable()
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
607
    
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
608
    def init_checker(self):
609
        # Schedule a new checker to be started an 'interval' from now,
610
        # and every interval from then on.
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
611
        if self.checker_initiator_tag is not None:
612
            gobject.source_remove(self.checker_initiator_tag)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
613
        self.checker_initiator_tag = (gobject.timeout_add
614
                                      (self.interval_milliseconds(),
615
                                       self.start_checker))
616
        # Schedule a disable() when 'timeout' has passed
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
617
        if self.disable_initiator_tag is not None:
618
            gobject.source_remove(self.disable_initiator_tag)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
619
        self.disable_initiator_tag = (gobject.timeout_add
620
                                   (self.timeout_milliseconds(),
621
                                    self.disable))
622
        # Also start a new checker *right now*.
623
        self.start_checker()
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
624
    
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
625
    def checker_callback(self, pid, condition, command):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
626
        """The checker has completed, so take appropriate actions."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
627
        self.checker_callback_tag = None
628
        self.checker = None
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
629
        if os.WIFEXITED(condition):
237.14.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
630
            self.last_checker_status = os.WEXITSTATUS(condition)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
631
            if self.last_checker_status == 0:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
632
                logger.info("Checker for %(name)s succeeded",
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
633
                            vars(self))
237.2.44 by Teddy Hogeborn
* mandos (Client.bump_timeout): Renamed to "checked_ok". All callers
634
                self.checked_ok()
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
635
            else:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
636
                logger.info("Checker for %(name)s failed",
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
637
                            vars(self))
638
        else:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
639
            self.last_checker_status = -1
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
640
            logger.warning("Checker for %(name)s crashed?",
13 by Björn Påhlsson
Added following support:
641
                           vars(self))
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
642
    
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
643
    def checked_ok(self):
644
        """Assert that the client has been seen, alive and well."""
645
        self.last_checked_ok = datetime.datetime.utcnow()
646
        self.last_checker_status = 0
647
        self.bump_timeout()
648
    
649
    def bump_timeout(self, timeout=None):
650
        """Bump up the timeout for this client."""
24.1.179 by Björn Påhlsson
New feature:
651
        if timeout is None:
652
            timeout = self.timeout
237.11.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
653
        if self.disable_initiator_tag is not None:
654
            gobject.source_remove(self.disable_initiator_tag)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
655
            self.disable_initiator_tag = None
237.11.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
656
        if getattr(self, "enabled", False):
657
            self.disable_initiator_tag = (gobject.timeout_add
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
658
                                          (timedelta_to_milliseconds
237.11.17 by Teddy Hogeborn
* mandos (Client.checked_ok): Bug fix: Handle disabled client.
659
                                           (timeout), self.disable))
660
            self.expires = datetime.datetime.utcnow() + timeout
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
661
    
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
662
    def need_approval(self):
663
        self.last_approval_request = datetime.datetime.utcnow()
664
    
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
665
    def start_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
666
        """Start a new checker subprocess if one is not running.
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
667
        
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
668
        If a checker already exists, leave it running and do
669
        nothing."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
670
        # The reason for not killing a running checker is that if we
237.7.125 by Teddy Hogeborn
* mandos (Client.start_checker): Reworded comment.
671
        # did that, and if a checker (for some reason) started running
672
        # slowly and taking more than 'interval' time, then the client
673
        # would inevitably timeout, since no checker would get a
674
        # chance to run to completion.  If we instead leave running
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
675
        # checkers alone, the checker would have to take more time
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
676
        # than 'timeout' for the client to be disabled, which is as it
677
        # should be.
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
678
        
679
        # If a checker exists, make sure it is not a zombie
237.2.146 by Teddy Hogeborn
* mandos (Client.start_checker): Bug fix: Fix race condition with
680
        try:
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
681
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
682
        except (AttributeError, OSError) as error:
237.2.146 by Teddy Hogeborn
* mandos (Client.start_checker): Bug fix: Fix race condition with
683
            if (isinstance(error, OSError)
684
                and error.errno != errno.ECHILD):
685
                raise error
686
        else:
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
687
            if pid:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
688
                logger.warning("Checker was a zombie")
237.2.78 by Teddy Hogeborn
* mandos (Client.current_checker_command): New attribute.
689
                gobject.source_remove(self.checker_callback_tag)
690
                self.checker_callback(pid, status,
691
                                      self.current_checker_command)
692
        # Start a new checker if needed
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
693
        if self.checker is None:
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
694
            # Escape attributes for the shell
695
            escaped_attrs = dict(
696
                (attr, re.escape(unicode(getattr(self, attr))))
697
                for attr in
698
                self.runtime_expansions)
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
699
            try:
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
700
                command = self.checker_command % escaped_attrs
701
            except TypeError as error:
702
                logger.error('Could not format string "%s"',
703
                             self.checker_command, exc_info=error)
704
                return True # Try again later
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
705
            self.current_checker_command = command
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
706
            try:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
707
                logger.info("Starting checker %r for %s",
44 by Teddy Hogeborn
* ca.pem: Removed.
708
                            command, self.name)
94 by Teddy Hogeborn
* clients.conf ([DEFAULT]/checker): Update to new default value.
709
                # We don't need to redirect stdout and stderr, since
710
                # in normal mode, that is already done by daemon(),
711
                # and in debug mode we don't want to.  (Stdin is
712
                # always replaced by /dev/null.)
28 by Teddy Hogeborn
* server.conf: New file.
713
                self.checker = subprocess.Popen(command,
714
                                                close_fds=True,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
715
                                                shell=True, cwd="/")
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
716
            except OSError as error:
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
717
                logger.error("Failed to start subprocess",
718
                             exc_info=error)
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
719
            self.checker_callback_tag = (gobject.child_watch_add
720
                                         (self.checker.pid,
721
                                          self.checker_callback,
722
                                          data=command))
723
            # The checker may have completed before the gobject
724
            # watch was added.  Check for this.
725
            pid, status = os.waitpid(self.checker.pid, os.WNOHANG)
726
            if pid:
727
                gobject.source_remove(self.checker_callback_tag)
728
                self.checker_callback(pid, status, command)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
729
        # Re-run this periodically if run by gobject.timeout_add
730
        return True
237.1.1 by Teddy Hogeborn
First steps of a D-Bus interface to the server.
731
    
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
732
    def stop_checker(self):
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
733
        """Force the checker process, if any, to stop."""
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
734
        if self.checker_callback_tag:
735
            gobject.source_remove(self.checker_callback_tag)
736
            self.checker_callback_tag = None
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
737
        if getattr(self, "checker", None) is None:
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
738
            return
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
739
        logger.debug("Stopping checker for %(name)s", vars(self))
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
740
        try:
237.7.112 by Teddy Hogeborn
* mandos (Client.stop_checker): Use new Popen.terminate() method.
741
            self.checker.terminate()
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
742
            #time.sleep(0.5)
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
743
            #if self.checker.poll() is None:
237.7.112 by Teddy Hogeborn
* mandos (Client.stop_checker): Use new Popen.terminate() method.
744
            #    self.checker.kill()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
745
        except OSError as error:
28 by Teddy Hogeborn
* server.conf: New file.
746
            if error.errno != errno.ESRCH: # No such process
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
747
                raise
9 by Teddy Hogeborn
* client.cpp (main): Get t_old early since it is used on error exits.
748
        self.checker = None
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
749
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
750
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
751
def dbus_service_property(dbus_interface, signature="v",
752
                          access="readwrite", byte_arrays=False):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
753
    """Decorators for marking methods of a DBusObjectWithProperties to
754
    become properties on the D-Bus.
755
    
756
    The decorated method will be called with no arguments by "Get"
757
    and with one argument by "Set".
758
    
759
    The parameters, where they are supported, are the same as
760
    dbus.service.method, except there is only "signature", since the
761
    type from Get() and the type sent to Set() is the same.
762
    """
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
763
    # Encoding deeply encoded byte arrays is not supported yet by the
764
    # "Set" method, so we fail early here:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
765
    if byte_arrays and signature != "ay":
766
        raise ValueError("Byte arrays not supported for non-'ay'"
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
767
                         " signature {0!r}".format(signature))
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
768
    def decorator(func):
769
        func._dbus_is_property = True
770
        func._dbus_interface = dbus_interface
771
        func._dbus_signature = signature
772
        func._dbus_access = access
773
        func._dbus_name = func.__name__
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
774
        if func._dbus_name.endswith("_dbus_property"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
775
            func._dbus_name = func._dbus_name[:-14]
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
776
        func._dbus_get_args_options = {'byte_arrays': byte_arrays }
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
777
        return func
778
    return decorator
779
780
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
781
def dbus_interface_annotations(dbus_interface):
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
782
    """Decorator for marking functions returning interface annotations
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
783
    
784
    Usage:
785
    
786
    @dbus_interface_annotations("org.example.Interface")
787
    def _foo(self):  # Function name does not matter
788
        return {"org.freedesktop.DBus.Deprecated": "true",
789
                "org.freedesktop.DBus.Property.EmitsChangedSignal":
790
                    "false"}
791
    """
792
    def decorator(func):
793
        func._dbus_is_interface = True
794
        func._dbus_interface = dbus_interface
795
        func._dbus_name = dbus_interface
796
        return func
797
    return decorator
798
799
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
800
def dbus_annotations(annotations):
801
    """Decorator to annotate D-Bus methods, signals or properties
802
    Usage:
803
    
804
    @dbus_service_property("org.example.Interface", signature="b",
805
                           access="r")
806
    @dbus_annotations({{"org.freedesktop.DBus.Deprecated": "true",
807
                        "org.freedesktop.DBus.Property."
808
                        "EmitsChangedSignal": "false"})
809
    def Property_dbus_property(self):
810
        return dbus.Boolean(False)
811
    """
812
    def decorator(func):
813
        func._dbus_annotations = annotations
814
        return func
815
    return decorator
816
817
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
818
class DBusPropertyException(dbus.exceptions.DBusException):
819
    """A base class for D-Bus property-related exceptions
820
    """
821
    def __unicode__(self):
822
        return unicode(str(self))
823
824
825
class DBusPropertyAccessException(DBusPropertyException):
826
    """A property's access permissions disallows an operation.
827
    """
828
    pass
829
830
831
class DBusPropertyNotFound(DBusPropertyException):
832
    """An attempt was made to access a non-existing property.
833
    """
834
    pass
835
836
837
class DBusObjectWithProperties(dbus.service.Object):
838
    """A D-Bus object with properties.
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
839
    
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
840
    Classes inheriting from this can use the dbus_service_property
841
    decorator to expose methods as D-Bus properties.  It exposes the
842
    standard Get(), Set(), and GetAll() methods on the D-Bus.
843
    """
844
    
845
    @staticmethod
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
846
    def _is_dbus_thing(thing):
847
        """Returns a function testing if an attribute is a D-Bus thing
848
        
849
        If called like _is_dbus_thing("method") it returns a function
850
        suitable for use as predicate to inspect.getmembers().
851
        """
852
        return lambda obj: getattr(obj, "_dbus_is_{0}".format(thing),
853
                                   False)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
854
    
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
855
    def _get_all_dbus_things(self, thing):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
856
        """Returns a generator of (name, attribute) pairs
857
        """
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
858
        return ((getattr(athing.__get__(self), "_dbus_name",
859
                         name),
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
860
                 athing.__get__(self))
24.1.186 by Björn Påhlsson
transitional stuff actually working
861
                for cls in self.__class__.__mro__
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
862
                for name, athing in
863
                inspect.getmembers(cls,
864
                                   self._is_dbus_thing(thing)))
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
865
    
866
    def _get_dbus_property(self, interface_name, property_name):
867
        """Returns a bound method if one exists which is a D-Bus
868
        property with the specified name and interface.
869
        """
24.1.186 by Björn Påhlsson
transitional stuff actually working
870
        for cls in  self.__class__.__mro__:
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
871
            for name, value in (inspect.getmembers
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
872
                                (cls,
873
                                 self._is_dbus_thing("property"))):
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
874
                if (value._dbus_name == property_name
875
                    and value._dbus_interface == interface_name):
24.1.186 by Björn Påhlsson
transitional stuff actually working
876
                    return value.__get__(self)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
877
        
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
878
        # No such property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
879
        raise DBusPropertyNotFound(self.dbus_object_path + ":"
880
                                   + interface_name + "."
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
881
                                   + property_name)
882
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
883
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ss",
884
                         out_signature="v")
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
885
    def Get(self, interface_name, property_name):
886
        """Standard D-Bus property Get() method, see D-Bus standard.
887
        """
888
        prop = self._get_dbus_property(interface_name, property_name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
889
        if prop._dbus_access == "write":
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
890
            raise DBusPropertyAccessException(property_name)
891
        value = prop()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
892
        if not hasattr(value, "variant_level"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
893
            return value
894
        return type(value)(value, variant_level=value.variant_level+1)
895
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
896
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="ssv")
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
897
    def Set(self, interface_name, property_name, value):
898
        """Standard D-Bus property Set() method, see D-Bus standard.
899
        """
900
        prop = self._get_dbus_property(interface_name, property_name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
901
        if prop._dbus_access == "read":
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
902
            raise DBusPropertyAccessException(property_name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
903
        if prop._dbus_get_args_options["byte_arrays"]:
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
904
            # The byte_arrays option is not supported yet on
905
            # signatures other than "ay".
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
906
            if prop._dbus_signature != "ay":
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
907
                raise ValueError
237.7.94 by Teddy Hogeborn
* debian/rules (binary-common): Exclude network-hooks.d from
908
            value = dbus.ByteArray(b''.join(chr(byte)
909
                                            for byte in value))
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
910
        prop(value)
911
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
912
    @dbus.service.method(dbus.PROPERTIES_IFACE, in_signature="s",
913
                         out_signature="a{sv}")
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
914
    def GetAll(self, interface_name):
915
        """Standard D-Bus property GetAll() method, see D-Bus
916
        standard.
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
917
        
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
918
        Note: Will not include properties with access="write".
919
        """
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
920
        properties = {}
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
921
        for name, prop in self._get_all_dbus_things("property"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
922
            if (interface_name
923
                and interface_name != prop._dbus_interface):
924
                # Interface non-empty but did not match
925
                continue
926
            # Ignore write-only properties
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
927
            if prop._dbus_access == "write":
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
928
                continue
929
            value = prop()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
930
            if not hasattr(value, "variant_level"):
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
931
                properties[name] = value
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
932
                continue
237.12.5 by Björn Påhlsson
First run of python-lint. Fixed some *obviously* bad code and turned
933
            properties[name] = type(value)(value, variant_level=
934
                                           value.variant_level+1)
935
        return dbus.Dictionary(properties, signature="sv")
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
936
    
937
    @dbus.service.method(dbus.INTROSPECTABLE_IFACE,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
938
                         out_signature="s",
939
                         path_keyword='object_path',
940
                         connection_keyword='connection')
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
941
    def Introspect(self, object_path, connection):
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
942
        """Overloading of standard D-Bus method.
943
        
944
        Inserts property tags and interface annotation tags.
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
945
        """
946
        xmlstring = dbus.service.Object.Introspect(self, object_path,
237.2.149 by Teddy Hogeborn
* mandos (DBusObjectWithProperties.Introspect): Add the name
947
                                                   connection)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
948
        try:
949
            document = xml.dom.minidom.parseString(xmlstring)
950
            def make_tag(document, name, prop):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
951
                e = document.createElement("property")
952
                e.setAttribute("name", name)
953
                e.setAttribute("type", prop._dbus_signature)
954
                e.setAttribute("access", prop._dbus_access)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
955
                return e
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
956
            for if_tag in document.getElementsByTagName("interface"):
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
957
                # Add property tags
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
958
                for tag in (make_tag(document, name, prop)
959
                            for name, prop
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
960
                            in self._get_all_dbus_things("property")
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
961
                            if prop._dbus_interface
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
962
                            == if_tag.getAttribute("name")):
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
963
                    if_tag.appendChild(tag)
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
964
                # Add annotation tags
965
                for typ in ("method", "signal", "property"):
966
                    for tag in if_tag.getElementsByTagName(typ):
967
                        annots = dict()
968
                        for name, prop in (self.
969
                                           _get_all_dbus_things(typ)):
970
                            if (name == tag.getAttribute("name")
971
                                and prop._dbus_interface
972
                                == if_tag.getAttribute("name")):
973
                                annots.update(getattr
974
                                              (prop,
975
                                               "_dbus_annotations",
976
                                               {}))
977
                        for name, value in annots.iteritems():
978
                            ann_tag = document.createElement(
979
                                "annotation")
980
                            ann_tag.setAttribute("name", name)
981
                            ann_tag.setAttribute("value", value)
982
                            tag.appendChild(ann_tag)
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
983
                # Add interface annotation tags
984
                for annotation, value in dict(
237.7.124 by Teddy Hogeborn
* mandos (DBusObjectWithProperties.Introspect): Use
985
                    itertools.chain.from_iterable(
986
                        annotations().iteritems()
987
                        for name, annotations in
988
                        self._get_all_dbus_things("interface")
989
                        if name == if_tag.getAttribute("name")
990
                        )).iteritems():
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
991
                    ann_tag = document.createElement("annotation")
992
                    ann_tag.setAttribute("name", annotation)
993
                    ann_tag.setAttribute("value", value)
994
                    if_tag.appendChild(ann_tag)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
995
                # Add the names to the return values for the
996
                # "org.freedesktop.DBus.Properties" methods
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
997
                if (if_tag.getAttribute("name")
998
                    == "org.freedesktop.DBus.Properties"):
999
                    for cn in if_tag.getElementsByTagName("method"):
1000
                        if cn.getAttribute("name") == "Get":
1001
                            for arg in cn.getElementsByTagName("arg"):
1002
                                if (arg.getAttribute("direction")
1003
                                    == "out"):
1004
                                    arg.setAttribute("name", "value")
1005
                        elif cn.getAttribute("name") == "GetAll":
1006
                            for arg in cn.getElementsByTagName("arg"):
1007
                                if (arg.getAttribute("direction")
1008
                                    == "out"):
1009
                                    arg.setAttribute("name", "props")
1010
            xmlstring = document.toxml("utf-8")
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1011
            document.unlink()
1012
        except (AttributeError, xml.dom.DOMException,
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1013
                xml.parsers.expat.ExpatError) as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1014
            logger.error("Failed to override Introspection method",
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
1015
                         exc_info=error)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1016
        return xmlstring
1017
1018
237.7.135 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1019
def datetime_to_dbus(dt, variant_level=0):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1020
    """Convert a UTC datetime.datetime() to a D-Bus type."""
1021
    if dt is None:
1022
        return dbus.String("", variant_level = variant_level)
1023
    return dbus.String(dt.isoformat(),
1024
                       variant_level=variant_level)
1025
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1026
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1027
def alternate_dbus_interfaces(alt_interface_names, deprecate=True):
1028
    """A class decorator; applied to a subclass of
1029
    dbus.service.Object, it will add alternate D-Bus attributes with
1030
    interface names according to the "alt_interface_names" mapping.
1031
    Usage:
1032
    
237.7.135 by Teddy Hogeborn
* Makefile (DOCBOOKTOMAN): Only run man --warnings if both "man" and
1033
    @alternate_dbus_interfaces({"org.example.Interface":
1034
                                    "net.example.AlternateInterface"})
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1035
    class SampleDBusObject(dbus.service.Object):
1036
        @dbus.service.method("org.example.Interface")
1037
        def SampleDBusMethod():
1038
            pass
1039
    
1040
    The above "SampleDBusMethod" on "SampleDBusObject" will be
1041
    reachable via two interfaces: "org.example.Interface" and
1042
    "net.example.AlternateInterface", the latter of which will have
1043
    its D-Bus annotation "org.freedesktop.DBus.Deprecated" set to
1044
    "true", unless "deprecate" is passed with a False value.
1045
    
1046
    This works for methods and signals, and also for D-Bus properties
1047
    (from DBusObjectWithProperties) and interfaces (from the
1048
    dbus_interface_annotations decorator).
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1049
    """
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1050
    def wrapper(cls):
1051
        for orig_interface_name, alt_interface_name in (
1052
            alt_interface_names.iteritems()):
1053
            attr = {}
1054
            interface_names = set()
1055
            # Go though all attributes of the class
1056
            for attrname, attribute in inspect.getmembers(cls):
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1057
                # Ignore non-D-Bus attributes, and D-Bus attributes
1058
                # with the wrong interface name
1059
                if (not hasattr(attribute, "_dbus_interface")
1060
                    or not attribute._dbus_interface
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1061
                    .startswith(orig_interface_name)):
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1062
                    continue
1063
                # Create an alternate D-Bus interface name based on
1064
                # the current name
1065
                alt_interface = (attribute._dbus_interface
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1066
                                 .replace(orig_interface_name,
1067
                                          alt_interface_name))
1068
                interface_names.add(alt_interface)
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1069
                # Is this a D-Bus signal?
1070
                if getattr(attribute, "_dbus_is_signal", False):
1071
                    # Extract the original non-method function by
1072
                    # black magic
1073
                    nonmethod_func = (dict(
1074
                            zip(attribute.func_code.co_freevars,
1075
                                attribute.__closure__))["func"]
1076
                                      .cell_contents)
1077
                    # Create a new, but exactly alike, function
1078
                    # object, and decorate it to be a new D-Bus signal
1079
                    # with the alternate D-Bus interface name
1080
                    new_function = (dbus.service.signal
1081
                                    (alt_interface,
1082
                                     attribute._dbus_signature)
1083
                                    (types.FunctionType(
1084
                                nonmethod_func.func_code,
1085
                                nonmethod_func.func_globals,
1086
                                nonmethod_func.func_name,
1087
                                nonmethod_func.func_defaults,
1088
                                nonmethod_func.func_closure)))
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1089
                    # Copy annotations, if any
1090
                    try:
1091
                        new_function._dbus_annotations = (
1092
                            dict(attribute._dbus_annotations))
1093
                    except AttributeError:
1094
                        pass
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1095
                    # Define a creator of a function to call both the
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1096
                    # original and alternate functions, so both the
1097
                    # original and alternate signals gets sent when
1098
                    # the function is called
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1099
                    def fixscope(func1, func2):
1100
                        """This function is a scope container to pass
1101
                        func1 and func2 to the "call_both" function
1102
                        outside of its arguments"""
1103
                        def call_both(*args, **kwargs):
1104
                            """This function will emit two D-Bus
1105
                            signals by calling func1 and func2"""
1106
                            func1(*args, **kwargs)
1107
                            func2(*args, **kwargs)
1108
                        return call_both
1109
                    # Create the "call_both" function and add it to
1110
                    # the class
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1111
                    attr[attrname] = fixscope(attribute, new_function)
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1112
                # Is this a D-Bus method?
1113
                elif getattr(attribute, "_dbus_is_method", False):
1114
                    # Create a new, but exactly alike, function
1115
                    # object.  Decorate it to be a new D-Bus method
1116
                    # with the alternate D-Bus interface name.  Add it
1117
                    # to the class.
1118
                    attr[attrname] = (dbus.service.method
1119
                                      (alt_interface,
1120
                                       attribute._dbus_in_signature,
1121
                                       attribute._dbus_out_signature)
1122
                                      (types.FunctionType
1123
                                       (attribute.func_code,
1124
                                        attribute.func_globals,
1125
                                        attribute.func_name,
1126
                                        attribute.func_defaults,
1127
                                        attribute.func_closure)))
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1128
                    # Copy annotations, if any
1129
                    try:
1130
                        attr[attrname]._dbus_annotations = (
1131
                            dict(attribute._dbus_annotations))
1132
                    except AttributeError:
1133
                        pass
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1134
                # Is this a D-Bus property?
1135
                elif getattr(attribute, "_dbus_is_property", False):
1136
                    # Create a new, but exactly alike, function
1137
                    # object, and decorate it to be a new D-Bus
1138
                    # property with the alternate D-Bus interface
1139
                    # name.  Add it to the class.
1140
                    attr[attrname] = (dbus_service_property
1141
                                      (alt_interface,
1142
                                       attribute._dbus_signature,
1143
                                       attribute._dbus_access,
1144
                                       attribute
1145
                                       ._dbus_get_args_options
1146
                                       ["byte_arrays"])
1147
                                      (types.FunctionType
1148
                                       (attribute.func_code,
1149
                                        attribute.func_globals,
1150
                                        attribute.func_name,
1151
                                        attribute.func_defaults,
1152
                                        attribute.func_closure)))
237.19.1 by Teddy Hogeborn
Add D-Bus annotations support to methods, signals and properties.
1153
                    # Copy annotations, if any
1154
                    try:
1155
                        attr[attrname]._dbus_annotations = (
1156
                            dict(attribute._dbus_annotations))
1157
                    except AttributeError:
1158
                        pass
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1159
                # Is this a D-Bus interface?
1160
                elif getattr(attribute, "_dbus_is_interface", False):
1161
                    # Create a new, but exactly alike, function
1162
                    # object.  Decorate it to be a new D-Bus interface
1163
                    # with the alternate D-Bus interface name.  Add it
1164
                    # to the class.
1165
                    attr[attrname] = (dbus_interface_annotations
1166
                                      (alt_interface)
1167
                                      (types.FunctionType
1168
                                       (attribute.func_code,
1169
                                        attribute.func_globals,
1170
                                        attribute.func_name,
1171
                                        attribute.func_defaults,
1172
                                        attribute.func_closure)))
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
1173
            if deprecate:
1174
                # Deprecate all alternate interfaces
1175
                iname="_AlternateDBusNames_interface_annotation{0}"
1176
                for interface_name in interface_names:
1177
                    @dbus_interface_annotations(interface_name)
1178
                    def func(self):
1179
                        return { "org.freedesktop.DBus.Deprecated":
1180
                                     "true" }
1181
                    # Find an unused name
1182
                    for aname in (iname.format(i)
1183
                                  for i in itertools.count()):
1184
                        if aname not in attr:
1185
                            attr[aname] = func
1186
                            break
1187
            if interface_names:
1188
                # Replace the class with a new subclass of it with
1189
                # methods, signals, etc. as created above.
1190
                cls = type(b"{0}Alternate".format(cls.__name__),
1191
                           (cls,), attr)
1192
        return cls
1193
    return wrapper
1194
1195
1196
@alternate_dbus_interfaces({"se.recompile.Mandos":
1197
                                "se.bsnet.fukt.Mandos"})
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1198
class ClientDBus(Client, DBusObjectWithProperties):
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1199
    """A Client class using D-Bus
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1200
    
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1201
    Attributes:
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1202
    dbus_object_path: dbus.ObjectPath
1203
    bus: dbus.SystemBus()
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1204
    """
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
1205
    
1206
    runtime_expansions = (Client.runtime_expansions
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1207
                          + ("dbus_object_path",))
237.2.201 by Teddy Hogeborn
* mandos (Client.runtime_expansions): New attribute containing the
1208
    
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1209
    # dbus.service.Object doesn't use super(), so we can't either.
1210
    
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
1211
    def __init__(self, bus = None, *args, **kwargs):
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
1212
        self.bus = bus
1213
        Client.__init__(self, *args, **kwargs)
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1214
        # Only now, when this client is initialized, can it show up on
1215
        # the D-Bus
237.2.204 by Teddy Hogeborn
* mandos (ClientDBus.__init__): Bug fix: Translate "-" in client names
1216
        client_object_name = unicode(self.name).translate(
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1217
            {ord("."): ord("_"),
1218
             ord("-"): ord("_")})
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1219
        self.dbus_object_path = (dbus.ObjectPath
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1220
                                 ("/clients/" + client_object_name))
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1221
        DBusObjectWithProperties.__init__(self, self.bus,
1222
                                          self.dbus_object_path)
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1223
    
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1224
    def notifychangeproperty(transform_func,
1225
                             dbus_name, type_func=lambda x: x,
1226
                             variant_level=1):
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1227
        """ Modify a variable so that it's a property which announces
1228
        its changes to DBus.
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1229
        
237.11.15 by Teddy Hogeborn
Bug fix: Make D-Bus properties settable again.
1230
        transform_fun: Function that takes a value and a variant_level
1231
                       and transforms it to a D-Bus type.
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1232
        dbus_name: D-Bus name of the variable
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1233
        type_func: Function that transform the value before sending it
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1234
                   to the D-Bus.  Default: no transform
1235
        variant_level: D-Bus variant level.  Default: 1
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1236
        """
237.11.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1237
        attrname = "_{0}".format(dbus_name)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1238
        def setter(self, value):
1239
            if hasattr(self, "dbus_object_path"):
237.11.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1240
                if (not hasattr(self, attrname) or
1241
                    type_func(getattr(self, attrname, None))
1242
                    != type_func(value)):
1243
                    dbus_value = transform_func(type_func(value),
237.11.15 by Teddy Hogeborn
Bug fix: Make D-Bus properties settable again.
1244
                                                variant_level
1245
                                                =variant_level)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1246
                    self.PropertyChanged(dbus.String(dbus_name),
1247
                                         dbus_value)
237.11.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1248
            setattr(self, attrname, value)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1249
        
237.11.6 by Teddy Hogeborn
* mandos (ClientDBus.notifychangeproperty): Bug fix: Use instance
1250
        return property(lambda self: getattr(self, attrname), setter)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1251
    
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1252
    expires = notifychangeproperty(datetime_to_dbus, "Expires")
1253
    approvals_pending = notifychangeproperty(dbus.Boolean,
1254
                                             "ApprovalPending",
1255
                                             type_func = bool)
1256
    enabled = notifychangeproperty(dbus.Boolean, "Enabled")
1257
    last_enabled = notifychangeproperty(datetime_to_dbus,
1258
                                        "LastEnabled")
1259
    checker = notifychangeproperty(dbus.Boolean, "CheckerRunning",
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1260
                                   type_func = lambda checker:
1261
                                       checker is not None)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1262
    last_checked_ok = notifychangeproperty(datetime_to_dbus,
1263
                                           "LastCheckedOK")
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1264
    last_checker_status = notifychangeproperty(dbus.Int16,
1265
                                               "LastCheckerStatus")
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1266
    last_approval_request = notifychangeproperty(
1267
        datetime_to_dbus, "LastApprovalRequest")
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1268
    approved_by_default = notifychangeproperty(dbus.Boolean,
1269
                                               "ApprovedByDefault")
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1270
    approval_delay = notifychangeproperty(dbus.UInt64,
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1271
                                          "ApprovalDelay",
1272
                                          type_func =
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1273
                                          timedelta_to_milliseconds)
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1274
    approval_duration = notifychangeproperty(
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1275
        dbus.UInt64, "ApprovalDuration",
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1276
        type_func = timedelta_to_milliseconds)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1277
    host = notifychangeproperty(dbus.String, "Host")
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1278
    timeout = notifychangeproperty(dbus.UInt64, "Timeout",
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1279
                                   type_func =
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1280
                                   timedelta_to_milliseconds)
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1281
    extended_timeout = notifychangeproperty(
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1282
        dbus.UInt64, "ExtendedTimeout",
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1283
        type_func = timedelta_to_milliseconds)
237.14.9 by Teddy Hogeborn
* mandos (ClientDBus.approval_delay, ClientDBus.approval_duration,
1284
    interval = notifychangeproperty(dbus.UInt64,
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1285
                                    "Interval",
1286
                                    type_func =
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1287
                                    timedelta_to_milliseconds)
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1288
    checker_command = notifychangeproperty(dbus.String, "Checker")
1289
    
1290
    del notifychangeproperty
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1291
    
1292
    def __del__(self, *args, **kwargs):
1293
        try:
1294
            self.remove_from_connection()
237.2.92 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1295
        except LookupError:
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1296
            pass
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1297
        if hasattr(DBusObjectWithProperties, "__del__"):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1298
            DBusObjectWithProperties.__del__(self, *args, **kwargs)
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1299
        Client.__del__(self, *args, **kwargs)
1300
    
1301
    def checker_callback(self, pid, condition, command,
1302
                         *args, **kwargs):
1303
        self.checker_callback_tag = None
1304
        self.checker = None
1305
        if os.WIFEXITED(condition):
1306
            exitstatus = os.WEXITSTATUS(condition)
1307
            # Emit D-Bus signal
1308
            self.CheckerCompleted(dbus.Int16(exitstatus),
1309
                                  dbus.Int64(condition),
1310
                                  dbus.String(command))
1311
        else:
1312
            # Emit D-Bus signal
1313
            self.CheckerCompleted(dbus.Int16(-1),
1314
                                  dbus.Int64(condition),
1315
                                  dbus.String(command))
1316
        
1317
        return Client.checker_callback(self, pid, condition, command,
1318
                                       *args, **kwargs)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1319
    
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1320
    def start_checker(self, *args, **kwargs):
1321
        old_checker = self.checker
1322
        if self.checker is not None:
1323
            old_checker_pid = self.checker.pid
1324
        else:
1325
            old_checker_pid = None
1326
        r = Client.start_checker(self, *args, **kwargs)
237.2.92 by Teddy Hogeborn
* mandos (ClientDBus.__del__): Bug fix: Correct mispasted code, and do
1327
        # Only if new checker process was started
1328
        if (self.checker is not None
1329
            and old_checker_pid != self.checker.pid):
1330
            # Emit D-Bus signal
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
1331
            self.CheckerStarted(self.current_checker_command)
1332
        return r
1333
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1334
    def _reset_approved(self):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1335
        self.approved = None
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1336
        return False
1337
    
1338
    def approve(self, value=True):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1339
        self.approved = value
1340
        gobject.timeout_add(timedelta_to_milliseconds
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1341
                            (self.approval_duration),
24.1.154 by Björn Påhlsson
merge
1342
                            self._reset_approved)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1343
        self.send_changedstate()
24.2.1 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-urwid".
1344
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1345
    ## D-Bus methods, signals & properties
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
1346
    _interface = "se.recompile.Mandos.Client"
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1347
    
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
1348
    ## Interfaces
1349
    
1350
    @dbus_interface_annotations(_interface)
1351
    def _foo(self):
1352
        return { "org.freedesktop.DBus.Property.EmitsChangedSignal":
1353
                     "false"}
1354
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1355
    ## Signals
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1356
    
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1357
    # CheckerCompleted - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1358
    @dbus.service.signal(_interface, signature="nxs")
237.2.43 by Teddy Hogeborn
* mandos (Client.CheckerCompleted): Changed signature to "nxs"; return
1359
    def CheckerCompleted(self, exitcode, waitstatus, command):
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1360
        "D-Bus signal"
1361
        pass
1362
    
1363
    # CheckerStarted - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1364
    @dbus.service.signal(_interface, signature="s")
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1365
    def CheckerStarted(self, command):
1366
        "D-Bus signal"
1367
        pass
1368
    
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1369
    # PropertyChanged - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1370
    @dbus.service.signal(_interface, signature="sv")
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
1371
    def PropertyChanged(self, property, value):
1372
        "D-Bus signal"
1373
        pass
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1374
    
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1375
    # GotSecret - signal
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
1376
    @dbus.service.signal(_interface)
237.2.150 by Teddy Hogeborn
* mandos (ClientDBus.ReceivedSecret): Renamed to "GotSecret". All
1377
    def GotSecret(self):
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1378
        """D-Bus signal
1379
        Is sent after a successful transfer of secret from the Mandos
1380
        server to mandos-client
1381
        """
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1382
        pass
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
1383
    
1384
    # Rejected - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1385
    @dbus.service.signal(_interface, signature="s")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1386
    def Rejected(self, reason):
1387
        "D-Bus signal"
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1388
        pass
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1389
    
1390
    # NeedApproval - signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1391
    @dbus.service.signal(_interface, signature="tb")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1392
    def NeedApproval(self, timeout, default):
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
1393
        "D-Bus signal"
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1394
        return self.need_approval()
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
1395
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1396
    ## Methods
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1397
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1398
    # Approve - method
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1399
    @dbus.service.method(_interface, in_signature="b")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1400
    def Approve(self, value):
1401
        self.approve(value)
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1402
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1403
    # CheckedOK - method
1404
    @dbus.service.method(_interface)
1405
    def CheckedOK(self):
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1406
        self.checked_ok()
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1407
    
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1408
    # Enable - method
1409
    @dbus.service.method(_interface)
1410
    def Enable(self):
1411
        "D-Bus method"
1412
        self.enable()
1413
    
1414
    # StartChecker - method
1415
    @dbus.service.method(_interface)
1416
    def StartChecker(self):
1417
        "D-Bus method"
1418
        self.start_checker()
1419
    
1420
    # Disable - method
1421
    @dbus.service.method(_interface)
1422
    def Disable(self):
1423
        "D-Bus method"
1424
        self.disable()
1425
    
1426
    # StopChecker - method
1427
    @dbus.service.method(_interface)
1428
    def StopChecker(self):
1429
        self.stop_checker()
1430
    
24.1.147 by Björn Påhlsson
The IPC pipes are now file objects, not file descriptors:
1431
    ## Properties
1432
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1433
    # ApprovalPending - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1434
    @dbus_service_property(_interface, signature="b", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1435
    def ApprovalPending_dbus_property(self):
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
1436
        return dbus.Boolean(bool(self.approvals_pending))
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1437
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1438
    # ApprovedByDefault - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1439
    @dbus_service_property(_interface, signature="b",
1440
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1441
    def ApprovedByDefault_dbus_property(self, value=None):
1442
        if value is None:       # get
1443
            return dbus.Boolean(self.approved_by_default)
1444
        self.approved_by_default = bool(value)
1445
    
1446
    # ApprovalDelay - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1447
    @dbus_service_property(_interface, signature="t",
1448
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1449
    def ApprovalDelay_dbus_property(self, value=None):
1450
        if value is None:       # get
1451
            return dbus.UInt64(self.approval_delay_milliseconds())
1452
        self.approval_delay = datetime.timedelta(0, 0, 0, value)
1453
    
1454
    # ApprovalDuration - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1455
    @dbus_service_property(_interface, signature="t",
1456
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1457
    def ApprovalDuration_dbus_property(self, value=None):
1458
        if value is None:       # get
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1459
            return dbus.UInt64(timedelta_to_milliseconds(
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1460
                    self.approval_duration))
1461
        self.approval_duration = datetime.timedelta(0, 0, 0, value)
1462
    
1463
    # Name - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1464
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1465
    def Name_dbus_property(self):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1466
        return dbus.String(self.name)
1467
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1468
    # Fingerprint - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1469
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1470
    def Fingerprint_dbus_property(self):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1471
        return dbus.String(self.fingerprint)
1472
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1473
    # Host - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1474
    @dbus_service_property(_interface, signature="s",
1475
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1476
    def Host_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1477
        if value is None:       # get
1478
            return dbus.String(self.host)
237.14.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
1479
        self.host = unicode(value)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1480
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1481
    # Created - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1482
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1483
    def Created_dbus_property(self):
237.14.3 by Teddy Hogeborn
Make "enabled" a client config option.
1484
        return datetime_to_dbus(self.created)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1485
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1486
    # LastEnabled - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1487
    @dbus_service_property(_interface, signature="s", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1488
    def LastEnabled_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1489
        return datetime_to_dbus(self.last_enabled)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1490
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1491
    # Enabled - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1492
    @dbus_service_property(_interface, signature="b",
1493
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1494
    def Enabled_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1495
        if value is None:       # get
1496
            return dbus.Boolean(self.enabled)
1497
        if value:
1498
            self.enable()
1499
        else:
1500
            self.disable()
1501
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1502
    # LastCheckedOK - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1503
    @dbus_service_property(_interface, signature="s",
1504
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1505
    def LastCheckedOK_dbus_property(self, value=None):
237.2.144 by Teddy Hogeborn
Restore some poor D-Bus methods who got a bit hastily deleted. Enable
1506
        if value is not None:
1507
            self.checked_ok()
1508
            return
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1509
        return datetime_to_dbus(self.last_checked_ok)
24.1.179 by Björn Påhlsson
New feature:
1510
    
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1511
    # LastCheckerStatus - property
1512
    @dbus_service_property(_interface, signature="n",
1513
                           access="read")
1514
    def LastCheckerStatus_dbus_property(self):
1515
        return dbus.Int16(self.last_checker_status)
1516
    
24.1.179 by Björn Påhlsson
New feature:
1517
    # Expires - property
1518
    @dbus_service_property(_interface, signature="s", access="read")
1519
    def Expires_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1520
        return datetime_to_dbus(self.expires)
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1521
    
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1522
    # LastApprovalRequest - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1523
    @dbus_service_property(_interface, signature="s", access="read")
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1524
    def LastApprovalRequest_dbus_property(self):
24.1.182 by Björn Påhlsson
Refactoring code related to PropertyChanged dbus signal. Made sending
1525
        return datetime_to_dbus(self.last_approval_request)
237.2.205 by Teddy Hogeborn
* DBUS-API: Document new "LastApprovalRequest" client property.
1526
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1527
    # Timeout - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1528
    @dbus_service_property(_interface, signature="t",
1529
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1530
    def Timeout_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1531
        if value is None:       # get
1532
            return dbus.UInt64(self.timeout_milliseconds())
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1533
        old_timeout = self.timeout
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1534
        self.timeout = datetime.timedelta(0, 0, 0, value)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1535
        # Reschedule disabling
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
1536
        if self.enabled:
1537
            now = datetime.datetime.utcnow()
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1538
            self.expires += self.timeout - old_timeout
1539
            if self.expires <= now:
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
1540
                # The timeout has passed
1541
                self.disable()
1542
            else:
1543
                if (getattr(self, "disable_initiator_tag", None)
1544
                    is None):
1545
                    return
1546
                gobject.source_remove(self.disable_initiator_tag)
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1547
                self.disable_initiator_tag = (
1548
                    gobject.timeout_add(
1549
                        timedelta_to_milliseconds(self.expires - now),
1550
                        self.disable))
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1551
    
24.1.179 by Björn Påhlsson
New feature:
1552
    # ExtendedTimeout - property
1553
    @dbus_service_property(_interface, signature="t",
1554
                           access="readwrite")
1555
    def ExtendedTimeout_dbus_property(self, value=None):
1556
        if value is None:       # get
1557
            return dbus.UInt64(self.extended_timeout_milliseconds())
1558
        self.extended_timeout = datetime.timedelta(0, 0, 0, value)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1559
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1560
    # Interval - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1561
    @dbus_service_property(_interface, signature="t",
1562
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1563
    def Interval_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1564
        if value is None:       # get
1565
            return dbus.UInt64(self.interval_milliseconds())
1566
        self.interval = datetime.timedelta(0, 0, 0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1567
        if getattr(self, "checker_initiator_tag", None) is None:
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1568
            return
237.14.3 by Teddy Hogeborn
Make "enabled" a client config option.
1569
        if self.enabled:
1570
            # Reschedule checker run
1571
            gobject.source_remove(self.checker_initiator_tag)
1572
            self.checker_initiator_tag = (gobject.timeout_add
1573
                                          (value, self.start_checker))
1574
            self.start_checker()    # Start one now, too
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1575
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1576
    # Checker - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1577
    @dbus_service_property(_interface, signature="s",
1578
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1579
    def Checker_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1580
        if value is None:       # get
1581
            return dbus.String(self.checker_command)
237.14.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
1582
        self.checker_command = unicode(value)
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1583
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1584
    # CheckerRunning - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1585
    @dbus_service_property(_interface, signature="b",
1586
                           access="readwrite")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1587
    def CheckerRunning_dbus_property(self, value=None):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1588
        if value is None:       # get
1589
            return dbus.Boolean(self.checker is not None)
1590
        if value:
1591
            self.start_checker()
1592
        else:
1593
            self.stop_checker()
1594
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1595
    # ObjectPath - property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1596
    @dbus_service_property(_interface, signature="o", access="read")
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1597
    def ObjectPath_dbus_property(self):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1598
        return self.dbus_object_path # is already a dbus.ObjectPath
1599
    
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1600
    # Secret = property
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1601
    @dbus_service_property(_interface, signature="ay",
1602
                           access="write", byte_arrays=True)
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1603
    def Secret_dbus_property(self, value):
237.2.143 by Teddy Hogeborn
Use D-Bus properties instead of our own methods.
1604
        self.secret = str(value)
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
1605
    
1606
    del _interface
3 by Björn Påhlsson
Python based server
1607
1608
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1609
class ProxyClient(object):
1610
    def __init__(self, child_pipe, fpr, address):
1611
        self._pipe = child_pipe
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1612
        self._pipe.send(('init', fpr, address))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1613
        if not self._pipe.recv():
1614
            raise KeyError()
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1615
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1616
    def __getattribute__(self, name):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1617
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1618
            return super(ProxyClient, self).__getattribute__(name)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1619
        self._pipe.send(('getattr', name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1620
        data = self._pipe.recv()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1621
        if data[0] == 'data':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1622
            return data[1]
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1623
        if data[0] == 'function':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1624
            def func(*args, **kwargs):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1625
                self._pipe.send(('funcall', name, args, kwargs))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1626
                return self._pipe.recv()[1]
1627
            return func
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1628
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1629
    def __setattr__(self, name, value):
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1630
        if name == '_pipe':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1631
            return super(ProxyClient, self).__setattr__(name, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1632
        self._pipe.send(('setattr', name, value))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1633
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
1634
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1635
class ClientHandler(socketserver.BaseRequestHandler, object):
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1636
    """A class to handle client connections.
1637
    
1638
    Instantiated once for each connection to handle it.
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1639
    Note: This will run in its own forked process."""
12 by Teddy Hogeborn
* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
1640
    
3 by Björn Påhlsson
Python based server
1641
    def handle(self):
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1642
        with contextlib.closing(self.server.child_pipe) as child_pipe:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1643
            logger.info("TCP connection from: %s",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1644
                        unicode(self.client_address))
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1645
            logger.debug("Pipe FD: %d",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1646
                         self.server.child_pipe.fileno())
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1647
            
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1648
            session = (gnutls.connection
1649
                       .ClientSession(self.request,
1650
                                      gnutls.connection
1651
                                      .X509Credentials()))
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1652
            
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1653
            # Note: gnutls.connection.X509Credentials is really a
1654
            # generic GnuTLS certificate credentials object so long as
1655
            # no X.509 keys are added to it.  Therefore, we can use it
1656
            # here despite using OpenPGP certificates.
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1657
            
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1658
            #priority = ':'.join(("NONE", "+VERS-TLS1.1",
1659
            #                      "+AES-256-CBC", "+SHA1",
1660
            #                      "+COMP-NULL", "+CTYPE-OPENPGP",
1661
            #                      "+DHE-DSS"))
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1662
            # Use a fallback default, since this MUST be set.
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1663
            priority = self.server.gnutls_priority
1664
            if priority is None:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1665
                priority = "NORMAL"
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1666
            (gnutls.library.functions
1667
             .gnutls_priority_set_direct(session._c_object,
1668
                                         priority, None))
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1669
            
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1670
            # Start communication using the Mandos protocol
1671
            # Get protocol number
1672
            line = self.request.makefile().readline()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1673
            logger.debug("Protocol version: %r", line)
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1674
            try:
1675
                if int(line.strip().split()[0]) > 1:
1676
                    raise RuntimeError
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1677
            except (ValueError, IndexError, RuntimeError) as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1678
                logger.error("Unknown protocol version: %s", error)
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1679
                return
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1680
            
237.5.2 by Teddy Hogeborn
* mandos (ClientHandler.handle): Set up the GnuTLS session object
1681
            # Start GnuTLS connection
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1682
            try:
1683
                session.handshake()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1684
            except gnutls.errors.GNUTLSError as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1685
                logger.warning("Handshake failed: %s", error)
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1686
                # Do not run session.bye() here: the session is not
1687
                # established.  Just abandon the request.
1688
                return
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1689
            logger.debug("Handshake succeeded")
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1690
            
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1691
            approval_required = False
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1692
            try:
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1693
                try:
1694
                    fpr = self.fingerprint(self.peer_certificate
1695
                                           (session))
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1696
                except (TypeError,
1697
                        gnutls.errors.GNUTLSError) as error:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1698
                    logger.warning("Bad certificate: %s", error)
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1699
                    return
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1700
                logger.debug("Fingerprint: %s", fpr)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1701
                
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1702
                try:
1703
                    client = ProxyClient(child_pipe, fpr,
1704
                                         self.client_address)
1705
                except KeyError:
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1706
                    return
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1707
                
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1708
                if client.approval_delay:
1709
                    delay = client.approval_delay
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1710
                    client.approvals_pending += 1
1711
                    approval_required = True
1712
                
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
1713
                while True:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1714
                    if not client.enabled:
24.1.174 by Björn Påhlsson
* Makefile (CFLAGS): Added "-lrt" to include real time library.
1715
                        logger.info("Client %s is disabled",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1716
                                       client.name)
1717
                        if self.server.use_dbus:
1718
                            # Emit D-Bus signal
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
1719
                            client.Rejected("Disabled")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1720
                        return
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1721
                    
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1722
                    if client.approved or not client.approval_delay:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1723
                        #We are approved or approval is disabled
1724
                        break
237.14.4 by Teddy Hogeborn
* mandos (_timedelta_to_milliseconds): Renamed to
1725
                    elif client.approved is None:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1726
                        logger.info("Client %s needs approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1727
                                    client.name)
1728
                        if self.server.use_dbus:
1729
                            # Emit D-Bus signal
1730
                            client.NeedApproval(
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
1731
                                client.approval_delay_milliseconds(),
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1732
                                client.approved_by_default)
1733
                    else:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1734
                        logger.warning("Client %s was not approved",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1735
                                       client.name)
1736
                        if self.server.use_dbus:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1737
                            # Emit D-Bus signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1738
                            client.Rejected("Denied")
24.1.148 by Björn Påhlsson
half working on-demand password and approved code
1739
                        return
1740
                    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1741
                    #wait until timeout or approved
1742
                    time = datetime.datetime.now()
1743
                    client.changedstate.acquire()
237.7.129 by Teddy Hogeborn
* mandos (Client.enable, Client.disable, ClientDBus.approve): Call
1744
                    client.changedstate.wait(
1745
                        float(timedelta_to_milliseconds(delay)
1746
                              / 1000))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1747
                    client.changedstate.release()
1748
                    time2 = datetime.datetime.now()
1749
                    if (time2 - time) >= delay:
1750
                        if not client.approved_by_default:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1751
                            logger.warning("Client %s timed out while"
1752
                                           " waiting for approval",
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1753
                                           client.name)
1754
                            if self.server.use_dbus:
1755
                                # Emit D-Bus signal
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1756
                                client.Rejected("Approval timed out")
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1757
                            return
1758
                        else:
1759
                            break
1760
                    else:
1761
                        delay -= time2 - time
1762
                
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1763
                sent_size = 0
1764
                while sent_size < len(client.secret):
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1765
                    try:
1766
                        sent = session.send(client.secret[sent_size:])
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1767
                    except gnutls.errors.GNUTLSError as error:
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1768
                        logger.warning("gnutls send failed",
1769
                                       exc_info=error)
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1770
                        return
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1771
                    logger.debug("Sent: %d, remaining: %d",
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1772
                                 sent, len(client.secret)
1773
                                 - (sent_size + sent))
1774
                    sent_size += sent
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1775
                
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1776
                logger.info("Sending secret to %s", client.name)
237.11.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
1777
                # bump the timeout using extended_timeout
237.7.104 by Teddy Hogeborn
* DBUS-API (se.recompile.Mandos.Client.LastCheckerStatus): New
1778
                client.bump_timeout(client.extended_timeout)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1779
                if self.server.use_dbus:
1780
                    # Emit D-Bus signal
1781
                    client.GotSecret()
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1782
            
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
1783
            finally:
24.1.150 by Björn Påhlsson
* mandos: Added ClientDBus.approve_pending property. Exposed
1784
                if approval_required:
1785
                    client.approvals_pending -= 1
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
1786
                try:
1787
                    session.bye()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1788
                except gnutls.errors.GNUTLSError as error:
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
1789
                    logger.warning("GnuTLS bye failed",
1790
                                   exc_info=error)
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1791
    
1792
    @staticmethod
1793
    def peer_certificate(session):
1794
        "Return the peer's OpenPGP certificate as a bytestring"
1795
        # If not an OpenPGP certificate...
1796
        if (gnutls.library.functions
1797
            .gnutls_certificate_type_get(session._c_object)
1798
            != gnutls.library.constants.GNUTLS_CRT_OPENPGP):
1799
            # ...do the normal thing
1800
            return session.peer_certificate
1801
        list_size = ctypes.c_uint(1)
1802
        cert_list = (gnutls.library.functions
1803
                     .gnutls_certificate_get_peers
1804
                     (session._c_object, ctypes.byref(list_size)))
1805
        if not bool(cert_list) and list_size.value != 0:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1806
            raise gnutls.errors.GNUTLSError("error getting peer"
1807
                                            " certificate")
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1808
        if list_size.value == 0:
1809
            return None
1810
        cert = cert_list[0]
1811
        return ctypes.string_at(cert.data, cert.size)
1812
    
1813
    @staticmethod
1814
    def fingerprint(openpgp):
1815
        "Convert an OpenPGP bytestring to a hexdigit fingerprint"
1816
        # New GnuTLS "datum" with the OpenPGP public key
1817
        datum = (gnutls.library.types
1818
                 .gnutls_datum_t(ctypes.cast(ctypes.c_char_p(openpgp),
1819
                                             ctypes.POINTER
1820
                                             (ctypes.c_ubyte)),
1821
                                 ctypes.c_uint(len(openpgp))))
1822
        # New empty GnuTLS certificate
1823
        crt = gnutls.library.types.gnutls_openpgp_crt_t()
1824
        (gnutls.library.functions
1825
         .gnutls_openpgp_crt_init(ctypes.byref(crt)))
1826
        # Import the OpenPGP public key into the certificate
1827
        (gnutls.library.functions
1828
         .gnutls_openpgp_crt_import(crt, ctypes.byref(datum),
1829
                                    gnutls.library.constants
1830
                                    .GNUTLS_OPENPGP_FMT_RAW))
1831
        # Verify the self signature in the key
1832
        crtverify = ctypes.c_uint()
1833
        (gnutls.library.functions
1834
         .gnutls_openpgp_crt_verify_self(crt, 0,
1835
                                         ctypes.byref(crtverify)))
1836
        if crtverify.value != 0:
1837
            gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1838
            raise (gnutls.errors.CertificateSecurityError
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1839
                   ("Verify failed"))
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1840
        # New buffer for the fingerprint
1841
        buf = ctypes.create_string_buffer(20)
1842
        buf_len = ctypes.c_size_t()
1843
        # Get the fingerprint from the certificate into the buffer
1844
        (gnutls.library.functions
1845
         .gnutls_openpgp_crt_get_fingerprint(crt, ctypes.byref(buf),
1846
                                             ctypes.byref(buf_len)))
1847
        # Deinit the certificate
1848
        gnutls.library.functions.gnutls_openpgp_crt_deinit(crt)
1849
        # Convert the buffer to a Python bytestring
1850
        fpr = ctypes.string_at(buf, buf_len.value)
1851
        # Convert the bytestring to hexadecimal notation
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
1852
        hex_fpr = binascii.hexlify(fpr).upper()
237.2.93 by Teddy Hogeborn
* mandos (peer_certificate, fingerprint): Moved into "TCP_handler"
1853
        return hex_fpr
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1854
1855
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1856
class MultiprocessingMixIn(object):
1857
    """Like socketserver.ThreadingMixIn, but with multiprocessing"""
1858
    def sub_process_main(self, request, address):
1859
        try:
1860
            self.finish_request(request, address)
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
1861
        except Exception:
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1862
            self.handle_error(request, address)
1863
        self.close_request(request)
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1864
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1865
    def process_request(self, request, address):
1866
        """Start a new process to process the request."""
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1867
        proc = multiprocessing.Process(target = self.sub_process_main,
237.7.127 by Teddy Hogeborn
* mandos: Use all new builtins.
1868
                                       args = (request, address))
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1869
        proc.start()
1870
        return proc
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1871
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1872
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1873
class MultiprocessingMixInWithPipe(MultiprocessingMixIn, object):
1874
    """ adds a pipe to the MixIn """
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1875
    def process_request(self, request, client_address):
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1876
        """Overrides and wraps the original process_request().
1877
        
237.2.118 by Teddy Hogeborn
* mandos: White-space fixes only.
1878
        This function creates a new pipe in self.pipe
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1879
        """
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1880
        parent_pipe, self.child_pipe = multiprocessing.Pipe()
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1881
        
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1882
        proc = MultiprocessingMixIn.process_request(self, request,
1883
                                                    client_address)
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
1884
        self.child_pipe.close()
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1885
        self.add_pipe(parent_pipe, proc)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1886
    
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
1887
    def add_pipe(self, parent_pipe, proc):
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
1888
        """Dummy function; override as necessary"""
237.7.12 by Teddy Hogeborn
* debian/mandos-client.postrm (purge): Bug fix: update initramfs also
1889
        raise NotImplementedError
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1890
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
1891
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
1892
class IPv6_TCPServer(MultiprocessingMixInWithPipe,
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1893
                     socketserver.TCPServer, object):
250 by Teddy Hogeborn
Merge from trunk. Notable changes:
1894
    """IPv6-capable TCP server.  Accepts 'None' as address and/or port
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1895
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1896
    Attributes:
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1897
        enabled:        Boolean; whether this server is activated yet
1898
        interface:      None or a network interface name (string)
1899
        use_ipv6:       Boolean; to use IPv6 or not
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1900
    """
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1901
    def __init__(self, server_address, RequestHandlerClass,
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
1902
                 interface=None, use_ipv6=True, socketfd=None):
1903
        """If socketfd is set, use that file descriptor instead of
1904
        creating a new one with socket.socket().
1905
        """
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1906
        self.interface = interface
1907
        if use_ipv6:
1908
            self.address_family = socket.AF_INET6
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
1909
        if socketfd is not None:
1910
            # Save the file descriptor
1911
            self.socketfd = socketfd
1912
            # Save the original socket.socket() function
1913
            self.socket_socket = socket.socket
1914
            # To implement --socket, we monkey patch socket.socket.
1915
            # 
1916
            # (When socketserver.TCPServer is a new-style class, we
1917
            # could make self.socket into a property instead of monkey
1918
            # patching socket.socket.)
1919
            # 
1920
            # Create a one-time-only replacement for socket.socket()
1921
            @functools.wraps(socket.socket)
1922
            def socket_wrapper(*args, **kwargs):
1923
                # Restore original function so subsequent calls are
1924
                # not affected.
1925
                socket.socket = self.socket_socket
1926
                del self.socket_socket
1927
                # This time only, return a new socket object from the
1928
                # saved file descriptor.
1929
                return socket.fromfd(self.socketfd, *args, **kwargs)
1930
            # Replace socket.socket() function with wrapper
1931
            socket.socket = socket_wrapper
1932
        # The socketserver.TCPServer.__init__ will call
1933
        # socket.socket(), which might be our replacement,
1934
        # socket_wrapper(), if socketfd was set.
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1935
        socketserver.TCPServer.__init__(self, server_address,
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1936
                                        RequestHandlerClass)
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
1937
    
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1938
    def server_bind(self):
1939
        """This overrides the normal server_bind() function
1940
        to bind to an interface if one was specified, and also NOT to
1941
        bind to an address or port if they were not specified."""
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1942
        if self.interface is not None:
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1943
            if SO_BINDTODEVICE is None:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1944
                logger.error("SO_BINDTODEVICE does not exist;"
1945
                             " cannot bind to interface %s",
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1946
                             self.interface)
1947
            else:
1948
                try:
1949
                    self.socket.setsockopt(socket.SOL_SOCKET,
1950
                                           SO_BINDTODEVICE,
1951
                                           str(self.interface
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1952
                                               + '\0'))
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
1953
                except socket.error as error:
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
1954
                    if error.errno == errno.EPERM:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1955
                        logger.error("No permission to"
1956
                                     " bind to interface %s",
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1957
                                     self.interface)
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
1958
                    elif error.errno == errno.ENOPROTOOPT:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1959
                        logger.error("SO_BINDTODEVICE not available;"
1960
                                     " cannot bind to interface %s",
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1961
                                     self.interface)
237.7.130 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: handle non-existing
1962
                    elif error.errno == errno.ENODEV:
1963
                        logger.error("Interface %s does not"
1964
                                     " exist, cannot bind",
1965
                                     self.interface)
237.2.101 by Teddy Hogeborn
* mandos: Minor doc string fixes.
1966
                    else:
1967
                        raise
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1968
        # Only bind(2) the socket if we really need to.
1969
        if self.server_address[0] or self.server_address[1]:
1970
            if not self.server_address[0]:
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
1971
                if self.address_family == socket.AF_INET6:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
1972
                    any_address = "::" # in6addr_any
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
1973
                else:
1974
                    any_address = socket.INADDR_ANY
1975
                self.server_address = (any_address,
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1976
                                       self.server_address[1])
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
1977
            elif not self.server_address[1]:
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
1978
                self.server_address = (self.server_address[0],
1979
                                       0)
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1980
#                 if self.interface:
49 by Teddy Hogeborn
* mandos (IPv6_TCPServer.server_bind): Bug fix: allow port to be empty
1981
#                     self.server_address = (self.server_address[0],
1982
#                                            0, # port
1983
#                                            0, # flowinfo
1984
#                                            if_nametoindex
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
1985
#                                            (self.interface))
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
1986
            return socketserver.TCPServer.server_bind(self)
237.2.102 by Teddy Hogeborn
Code cleanup.
1987
1988
1989
class MandosServer(IPv6_TCPServer):
1990
    """Mandos server.
1991
    
1992
    Attributes:
1993
        clients:        set of Client objects
1994
        gnutls_priority GnuTLS priority string
1995
        use_dbus:       Boolean; to emit D-Bus signals or not
237.2.103 by Teddy Hogeborn
Code cleanup.
1996
    
1997
    Assumes a gobject.MainLoop event loop.
237.2.102 by Teddy Hogeborn
Code cleanup.
1998
    """
1999
    def __init__(self, server_address, RequestHandlerClass,
2000
                 interface=None, use_ipv6=True, clients=None,
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2001
                 gnutls_priority=None, use_dbus=True, socketfd=None):
237.2.102 by Teddy Hogeborn
Code cleanup.
2002
        self.enabled = False
2003
        self.clients = clients
237.2.104 by Teddy Hogeborn
Code cleanup and one bug fix.
2004
        if self.clients is None:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2005
            self.clients = {}
237.2.102 by Teddy Hogeborn
Code cleanup.
2006
        self.use_dbus = use_dbus
2007
        self.gnutls_priority = gnutls_priority
2008
        IPv6_TCPServer.__init__(self, server_address,
2009
                                RequestHandlerClass,
2010
                                interface = interface,
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2011
                                use_ipv6 = use_ipv6,
2012
                                socketfd = socketfd)
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2013
    def server_activate(self):
2014
        if self.enabled:
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2015
            return socketserver.TCPServer.server_activate(self)
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2016
    
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2017
    def enable(self):
2018
        self.enabled = True
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2019
    
2020
    def add_pipe(self, parent_pipe, proc):
237.2.103 by Teddy Hogeborn
Code cleanup.
2021
        # Call "handle_ipc" for both data and EOF events
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2022
        gobject.io_add_watch(parent_pipe.fileno(),
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2023
                             gobject.IO_IN | gobject.IO_HUP,
2024
                             functools.partial(self.handle_ipc,
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2025
                                               parent_pipe =
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2026
                                               parent_pipe,
2027
                                               proc = proc))
237.11.9 by Teddy Hogeborn
Whitespace
2028
    
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2029
    def handle_ipc(self, source, condition, parent_pipe=None,
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2030
                   proc = None, client_object=None):
237.11.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2031
        # error, or the other end of multiprocessing.Pipe has closed
237.7.125 by Teddy Hogeborn
* mandos (Client.start_checker): Reworded comment.
2032
        if condition & (gobject.IO_ERR | gobject.IO_HUP):
237.11.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
2033
            # Wait for other process to exit
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2034
            proc.join()
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2035
            return False
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2036
        
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2037
        # Read a request from the child
2038
        request = parent_pipe.recv()
2039
        command = request[0]
2040
        
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2041
        if command == 'init':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2042
            fpr = request[1]
2043
            address = request[2]
2044
            
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2045
            for c in self.clients.itervalues():
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2046
                if c.fingerprint == fpr:
2047
                    client = c
2048
                    break
2049
            else:
24.1.174 by Björn Påhlsson
* Makefile (CFLAGS): Added "-lrt" to include real time library.
2050
                logger.info("Client not found for fingerprint: %s, ad"
2051
                            "dress: %s", fpr, address)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2052
                if self.use_dbus:
2053
                    # Emit D-Bus signal
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2054
                    mandos_dbus_service.ClientNotFound(fpr,
2055
                                                       address[0])
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2056
                parent_pipe.send(False)
2057
                return False
2058
            
2059
            gobject.io_add_watch(parent_pipe.fileno(),
2060
                                 gobject.IO_IN | gobject.IO_HUP,
2061
                                 functools.partial(self.handle_ipc,
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2062
                                                   parent_pipe =
2063
                                                   parent_pipe,
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2064
                                                   proc = proc,
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2065
                                                   client_object =
2066
                                                   client))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2067
            parent_pipe.send(True)
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2068
            # remove the old hook in favor of the new above hook on
2069
            # same fileno
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2070
            return False
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2071
        if command == 'funcall':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2072
            funcname = request[1]
2073
            args = request[2]
2074
            kwargs = request[3]
2075
            
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2076
            parent_pipe.send(('data', getattr(client_object,
2077
                                              funcname)(*args,
2078
                                                         **kwargs)))
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2079
        
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2080
        if command == 'getattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2081
            attrname = request[1]
2082
            if callable(client_object.__getattribute__(attrname)):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2083
                parent_pipe.send(('function',))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2084
            else:
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2085
                parent_pipe.send(('data', client_object
2086
                                  .__getattribute__(attrname)))
24.2.4 by teddy at bsnet
* mandos (ClientDBus.approvals_pending): Changed to be a property
2087
        
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2088
        if command == 'setattr':
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2089
            attrname = request[1]
2090
            value = request[2]
2091
            setattr(client_object, attrname, value)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2092
        
237.4.1 by Teddy Hogeborn
Start of new pipe-based IPC mechanism.
2093
        return True
10 by Teddy Hogeborn
* server.py: Bug fix: Do "from __future__ import division".
2094
3 by Björn Påhlsson
Python based server
2095
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2096
def string_to_delta(interval):
2097
    """Parse a string and return a datetime.timedelta
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2098
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2099
    >>> string_to_delta('7d')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2100
    datetime.timedelta(7)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2101
    >>> string_to_delta('60s')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2102
    datetime.timedelta(0, 60)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2103
    >>> string_to_delta('60m')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2104
    datetime.timedelta(0, 3600)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2105
    >>> string_to_delta('24h')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2106
    datetime.timedelta(1)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2107
    >>> string_to_delta('1w')
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2108
    datetime.timedelta(7)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2109
    >>> string_to_delta('5m 30s')
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2110
    datetime.timedelta(0, 330)
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2111
    """
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2112
    timevalue = datetime.timedelta(0)
2113
    for s in interval.split():
2114
        try:
215 by Teddy Hogeborn
* mandos: Remove unused "select" module. Import "ctypes.util".
2115
            suffix = unicode(s[-1])
2116
            value = int(s[:-1])
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2117
            if suffix == "d":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2118
                delta = datetime.timedelta(value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2119
            elif suffix == "s":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2120
                delta = datetime.timedelta(0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2121
            elif suffix == "m":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2122
                delta = datetime.timedelta(0, 0, 0, 0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2123
            elif suffix == "h":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2124
                delta = datetime.timedelta(0, 0, 0, 0, 0, value)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2125
            elif suffix == "w":
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2126
                delta = datetime.timedelta(0, 0, 0, 0, 0, 0, value)
2127
            else:
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2128
                raise ValueError("Unknown suffix {0!r}"
2129
                                 .format(suffix))
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2130
        except (ValueError, IndexError) as e:
237.7.12 by Teddy Hogeborn
* debian/mandos-client.postrm (purge): Bug fix: update initramfs also
2131
            raise ValueError(*(e.args))
93 by Teddy Hogeborn
* mandos (string_to_delta): Accept a whitespace-separated sequence of
2132
        timevalue += delta
2133
    return timevalue
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2134
8 by Teddy Hogeborn
* Makefile (client_debug): Bug fix; add quotes and / to CERT_ROOT.
2135
47 by Teddy Hogeborn
* plugbasedclient.c: Renamed to "mandos-client.c". All users changed.
2136
def daemon(nochdir = False, noclose = False):
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2137
    """See daemon(3).  Standard BSD Unix function.
237.2.94 by Teddy Hogeborn
Minor code cleanup, and a bug fix.
2138
    
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2139
    This should really exist as os.daemon, but it doesn't (yet)."""
2140
    if os.fork():
2141
        sys.exit()
2142
    os.setsid()
2143
    if not nochdir:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2144
        os.chdir("/")
46 by Teddy Hogeborn
* network-protocol.txt: New.
2145
    if os.fork():
2146
        sys.exit()
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2147
    if not noclose:
2148
        # Close all standard open file descriptors
237.18.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2149
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2150
        if not stat.S_ISCHR(os.fstat(null).st_mode):
2151
            raise OSError(errno.ENODEV,
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2152
                          "{0} not a character device"
2153
                          .format(os.devnull))
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2154
        os.dup2(null, sys.stdin.fileno())
2155
        os.dup2(null, sys.stdout.fileno())
2156
        os.dup2(null, sys.stderr.fileno())
2157
        if null > 2:
2158
            os.close(null)
2159
2160
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2161
def main():
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2162
    
237.2.142 by Teddy Hogeborn
* mandos: Fix line lengths.
2163
    ##################################################################
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2164
    # Parsing of options, both command line and config file
2165
    
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2166
    parser = argparse.ArgumentParser()
2167
    parser.add_argument("-v", "--version", action="version",
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2168
                        version = "%(prog)s {0}".format(version),
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2169
                        help="show version number and exit")
2170
    parser.add_argument("-i", "--interface", metavar="IF",
2171
                        help="Bind to interface IF")
2172
    parser.add_argument("-a", "--address",
2173
                        help="Address to listen for requests on")
2174
    parser.add_argument("-p", "--port", type=int,
2175
                        help="Port number to receive requests on")
2176
    parser.add_argument("--check", action="store_true",
2177
                        help="Run self-test")
2178
    parser.add_argument("--debug", action="store_true",
2179
                        help="Debug mode; run in foreground and log"
2180
                        " to terminal")
2181
    parser.add_argument("--debuglevel", metavar="LEVEL",
2182
                        help="Debug level for stdout output")
2183
    parser.add_argument("--priority", help="GnuTLS"
2184
                        " priority string (see GnuTLS documentation)")
2185
    parser.add_argument("--servicename",
2186
                        metavar="NAME", help="Zeroconf service name")
2187
    parser.add_argument("--configdir",
2188
                        default="/etc/mandos", metavar="DIR",
2189
                        help="Directory to search for configuration"
2190
                        " files")
2191
    parser.add_argument("--no-dbus", action="store_false",
2192
                        dest="use_dbus", help="Do not provide D-Bus"
2193
                        " system bus interface")
2194
    parser.add_argument("--no-ipv6", action="store_false",
2195
                        dest="use_ipv6", help="Do not use IPv6")
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2196
    parser.add_argument("--no-restore", action="store_false",
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
2197
                        dest="restore", help="Do not restore stored"
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2198
                        " state")
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2199
    parser.add_argument("--socket", type=int,
2200
                        help="Specify a file descriptor to a network"
2201
                        " socket to use instead of creating one")
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2202
    parser.add_argument("--statedir", metavar="DIR",
2203
                        help="Directory to save/restore state in")
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2204
    
237.7.22 by teddy at bsnet
* mandos: Use the new argparse library instead of optparse.
2205
    options = parser.parse_args()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2206
    
4 by Teddy Hogeborn
* server.py (Client.created, Client.next_check): New.
2207
    if options.check:
2208
        import doctest
2209
        doctest.testmod()
2210
        sys.exit()
3 by Björn Påhlsson
Python based server
2211
    
28 by Teddy Hogeborn
* server.conf: New file.
2212
    # Default values for config file for server-global settings
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2213
    server_defaults = { "interface": "",
2214
                        "address": "",
2215
                        "port": "",
2216
                        "debug": "False",
2217
                        "priority":
2218
                        "SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP",
2219
                        "servicename": "Mandos",
2220
                        "use_dbus": "True",
2221
                        "use_ipv6": "True",
2222
                        "debuglevel": "",
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2223
                        "restore": "True",
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2224
                        "socket": "",
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2225
                        "statedir": "/var/lib/mandos"
28 by Teddy Hogeborn
* server.conf: New file.
2226
                        }
2227
    
2228
    # Parse config file for server-global settings
237.2.98 by Teddy Hogeborn
* mandos: Import "SocketServer" as "socketserver" and "ConfigParser"
2229
    server_config = configparser.SafeConfigParser(server_defaults)
28 by Teddy Hogeborn
* server.conf: New file.
2230
    del server_defaults
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2231
    server_config.read(os.path.join(options.configdir,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2232
                                    "mandos.conf"))
28 by Teddy Hogeborn
* server.conf: New file.
2233
    # Convert the SafeConfigParser object to a dict
89 by Teddy Hogeborn
* Makefile: Bug fix: fixed creation of man pages for section 5 pages.
2234
    server_settings = server_config.defaults()
237.2.45 by Teddy Hogeborn
* mandos (main): Bug fix: use "getint" on the "port" config file
2235
    # Use the appropriate methods on the non-string config options
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2236
    for option in ("debug", "use_dbus", "use_ipv6"):
2237
        server_settings[option] = server_config.getboolean("DEFAULT",
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2238
                                                           option)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2239
    if server_settings["port"]:
2240
        server_settings["port"] = server_config.getint("DEFAULT",
2241
                                                       "port")
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2242
    if server_settings["socket"]:
2243
        server_settings["socket"] = server_config.getint("DEFAULT",
2244
                                                         "socket")
237.7.139 by Teddy Hogeborn
Merge "--socket" option for server.
2245
        # Later, stdin will, and stdout and stderr might, be dup'ed
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2246
        # over with an opened os.devnull.  But we don't want this to
2247
        # happen with a supplied network socket.
2248
        if 0 <= server_settings["socket"] <= 2:
2249
            server_settings["socket"] = os.dup(server_settings
2250
                                               ["socket"])
28 by Teddy Hogeborn
* server.conf: New file.
2251
    del server_config
2252
    
2253
    # Override the settings from the config file with command line
2254
    # options, if set.
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2255
    for option in ("interface", "address", "port", "debug",
2256
                   "priority", "servicename", "configdir",
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2257
                   "use_dbus", "use_ipv6", "debuglevel", "restore",
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2258
                   "statedir", "socket"):
28 by Teddy Hogeborn
* server.conf: New file.
2259
        value = getattr(options, option)
2260
        if value is not None:
2261
            server_settings[option] = value
2262
    del options
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2263
    # Force all strings to be unicode
2264
    for option in server_settings.keys():
2265
        if type(server_settings[option]) is str:
2266
            server_settings[option] = unicode(server_settings[option])
28 by Teddy Hogeborn
* server.conf: New file.
2267
    # Now we have our good server settings in "server_settings"
2268
    
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2269
    ##################################################################
2270
    
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2271
    # For convenience
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2272
    debug = server_settings["debug"]
2273
    debuglevel = server_settings["debuglevel"]
2274
    use_dbus = server_settings["use_dbus"]
2275
    use_ipv6 = server_settings["use_ipv6"]
237.14.2 by Teddy Hogeborn
Directory with persistent state can now be changed with the "statedir"
2276
    stored_state_path = os.path.join(server_settings["statedir"],
2277
                                     stored_state_file)
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2278
    
237.12.4 by Björn Påhlsson
restructured logger
2279
    if debug:
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2280
        initlogger(debug, logging.DEBUG)
237.12.4 by Björn Påhlsson
restructured logger
2281
    else:
2282
        if not debuglevel:
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2283
            initlogger(debug)
237.12.4 by Björn Påhlsson
restructured logger
2284
        else:
2285
            level = getattr(logging, debuglevel.upper())
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2286
            initlogger(debug, level)
237.12.4 by Björn Påhlsson
restructured logger
2287
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2288
    if server_settings["servicename"] != "Mandos":
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2289
        syslogger.setFormatter(logging.Formatter
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2290
                               ('Mandos ({0}) [%(process)d]:'
2291
                                ' %(levelname)s: %(message)s'
2292
                                .format(server_settings
2293
                                        ["servicename"])))
52 by Teddy Hogeborn
* mandos: Make syslog use "/dev/log" instead of UDP to localhost.
2294
    
28 by Teddy Hogeborn
* server.conf: New file.
2295
    # Parse config file with clients
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
2296
    client_config = configparser.SafeConfigParser(Client
2297
                                                  .client_defaults)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2298
    client_config.read(os.path.join(server_settings["configdir"],
2299
                                    "clients.conf"))
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2300
    
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2301
    global mandos_dbus_service
2302
    mandos_dbus_service = None
28 by Teddy Hogeborn
* server.conf: New file.
2303
    
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2304
    tcp_server = MandosServer((server_settings["address"],
2305
                               server_settings["port"]),
237.2.102 by Teddy Hogeborn
Code cleanup.
2306
                              ClientHandler,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2307
                              interface=(server_settings["interface"]
269.1.3 by teddy at bsnet
* mandos (main): Bug fix: Don't try to bind to an empty string
2308
                                         or None),
237.2.102 by Teddy Hogeborn
Code cleanup.
2309
                              use_ipv6=use_ipv6,
2310
                              gnutls_priority=
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2311
                              server_settings["priority"],
237.21.1 by Teddy Hogeborn
* mandos: Implement "--socket" option.
2312
                              use_dbus=use_dbus,
2313
                              socketfd=(server_settings["socket"]
2314
                                        or None))
237.2.202 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
2315
    if not debug:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2316
        pidfilename = "/var/run/mandos.pid"
237.2.202 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
2317
        try:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2318
            pidfile = open(pidfilename, "w")
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2319
        except IOError as e:
2320
            logger.error("Could not open file %r", pidfilename,
2321
                         exc_info=e)
164 by Teddy Hogeborn
* mandos: Open the PID file before daemonizing, but write to it
2322
    
237.7.114 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
2323
    for name in ("_mandos", "mandos", "nobody"):
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
2324
        try:
237.7.114 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
2325
            uid = pwd.getpwnam(name).pw_uid
2326
            gid = pwd.getpwnam(name).pw_gid
2327
            break
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
2328
        except KeyError:
237.7.114 by Teddy Hogeborn
* mandos (main): Simplify and shorten code selecting user and group ID
2329
            continue
2330
    else:
2331
        uid = 65534
2332
        gid = 65534
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2333
    try:
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2334
        os.setgid(gid)
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2335
        os.setuid(uid)
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2336
    except OSError as error:
237.7.131 by Teddy Hogeborn
* mandos (Client.start_checker): Remove undocumented support for "%%s"
2337
        if error.errno != errno.EPERM:
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2338
            raise error
164 by Teddy Hogeborn
* mandos: Open the PID file before daemonizing, but write to it
2339
    
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2340
    if debug:
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2341
        # Enable all possible GnuTLS debugging
2342
        
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2343
        # "Use a log level over 10 to enable all debugging options."
2344
        # - GnuTLS manual
2345
        gnutls.library.functions.gnutls_global_set_log_level(11)
2346
        
2347
        @gnutls.library.types.gnutls_log_func
2348
        def debug_gnutls(level, string):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2349
            logger.debug("GnuTLS: %s", string[:-1])
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2350
        
2351
        (gnutls.library.functions
2352
         .gnutls_global_set_log_function(debug_gnutls))
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2353
        
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
2354
        # Redirect stdin so all checkers get /dev/null
237.18.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2355
        null = os.open(os.devnull, os.O_NOCTTY | os.O_RDWR)
24.1.155 by Björn Påhlsson
mandos server: Added debuglevel that adjust at what level information
2356
        os.dup2(null, sys.stdin.fileno())
2357
        if null > 2:
2358
            os.close(null)
237.2.185 by Teddy Hogeborn
Rename all D-Bus properties to conform to D-Bus naming conventions;
2359
    
237.7.6 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
2360
    # Need to fork before connecting to D-Bus
2361
    if not debug:
2362
        # Close all input and output, do double fork, etc.
2363
        daemon()
237.2.53 by Teddy Hogeborn
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
2364
    
237.7.138 by Teddy Hogeborn
* mandos: Change comment.
2365
    # multiprocessing will use threads, so before we use gobject we
2366
    # need to inform gobject that threads will be used.
237.14.11 by Teddy Hogeborn
* mandos (main): Tell gobject we're (or, rather, multiprocessing is)
2367
    gobject.threads_init()
2368
    
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2369
    global main_loop
2370
    # From the Avahi example code
237.18.1 by teddy at recompile
* mandos: Use os.devnull instead of os.path.devnull. Fix some white
2371
    DBusGMainLoop(set_as_default=True)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2372
    main_loop = gobject.MainLoop()
2373
    bus = dbus.SystemBus()
2374
    # End of Avahi example code
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2375
    if use_dbus:
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2376
        try:
237.7.53 by Björn Påhlsson
The domain name has changed, so the D-Bus bus and interface names must
2377
            bus_name = dbus.service.BusName("se.recompile.Mandos",
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2378
                                            bus, do_not_queue=True)
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2379
            old_bus_name = (dbus.service.BusName
2380
                            ("se.bsnet.fukt.Mandos", bus,
2381
                             do_not_queue=True))
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2382
        except dbus.exceptions.NameExistsException as e:
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2383
            logger.error("Disabling D-Bus:", exc_info=e)
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2384
            use_dbus = False
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2385
            server_settings["use_dbus"] = False
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2386
            tcp_server.use_dbus = False
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
2387
    protocol = avahi.PROTO_INET6 if use_ipv6 else avahi.PROTO_INET
237.11.20 by Teddy Hogeborn
* Makefile (run-server): Remove obsolete warning.
2388
    service = AvahiServiceToSyslog(name =
2389
                                   server_settings["servicename"],
2390
                                   servicetype = "_mandos._tcp",
2391
                                   protocol = protocol, bus = bus)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2392
    if server_settings["interface"]:
237.2.100 by Teddy Hogeborn
Code cleanup. Move some global stuff into main.
2393
        service.interface = (if_nametoindex
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2394
                             (str(server_settings["interface"])))
237.7.6 by teddy at bsnet
* mandos (main): Bug fix: Fork before connecting to D-Bus.
2395
    
24.1.152 by Björn Påhlsson
bug fixes that prevent problems when runing server as root
2396
    global multiprocessing_manager
2397
    multiprocessing_manager = multiprocessing.Manager()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2398
    
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
2399
    client_class = Client
2400
    if use_dbus:
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
2401
        client_class = functools.partial(ClientDBus, bus = bus)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2402
    
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2403
    client_settings = Client.config_parser(client_config)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2404
    old_client_settings = {}
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2405
    clients_data = {}
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2406
    
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
2407
    # Get client data and settings from last running state.
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2408
    if server_settings["restore"]:
2409
        try:
2410
            with open(stored_state_path, "rb") as stored_state:
237.12.7 by Teddy Hogeborn
* mandos: Break long lines and fix some more white space.
2411
                clients_data, old_client_settings = (pickle.load
2412
                                                     (stored_state))
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2413
            os.remove(stored_state_path)
2414
        except IOError as e:
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2415
            if e.errno == errno.ENOENT:
2416
                logger.warning("Could not load persistent state: {0}"
2417
                                .format(os.strerror(e.errno)))
2418
            else:
2419
                logger.critical("Could not load persistent state:",
2420
                                exc_info=e)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2421
                raise
237.11.23 by Teddy Hogeborn
* mandos (main): Handle EOFError when reading state file.
2422
        except EOFError as e:
2423
            logger.warning("Could not load persistent state: "
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2424
                           "EOFError:", exc_info=e)
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2425
    
237.12.9 by Björn Påhlsson
renamed variables
2426
    with PGPEngine() as pgp:
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2427
        for client_name, client in clients_data.iteritems():
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2428
            # Decide which value to use after restoring saved state.
2429
            # We have three different values: Old config file,
2430
            # new config file, and saved state.
2431
            # New config value takes precedence if it differs from old
2432
            # config value, otherwise use saved state.
2433
            for name, value in client_settings[client_name].items():
2434
                try:
2435
                    # For each value in new config, check if it
2436
                    # differs from the old config value (Except for
2437
                    # the "secret" attribute)
2438
                    if (name != "secret" and
2439
                        value != old_client_settings[client_name]
2440
                        [name]):
237.14.10 by Teddy Hogeborn
* mandos (main): Bug fix: Syntax fix when restoring settings.
2441
                        client[name] = value
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2442
                except KeyError:
2443
                    pass
2444
            
2445
            # Clients who has passed its expire date can still be
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2446
            # enabled if its last checker was successful.  Clients
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
2447
            # whose checker succeeded before we stored its state is
2448
            # assumed to have successfully run all checkers during
2449
            # downtime.
237.14.8 by Teddy Hogeborn
* mandos (ClientDBus.Host_dbus_property,
2450
            if client["enabled"]:
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2451
                if datetime.datetime.utcnow() >= client["expires"]:
2452
                    if not client["last_checked_ok"]:
2453
                        logger.warning(
2454
                            "disabling client {0} - Client never "
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
2455
                            "performed a successful checker"
2456
                            .format(client_name))
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2457
                        client["enabled"] = False
2458
                    elif client["last_checker_status"] != 0:
2459
                        logger.warning(
2460
                            "disabling client {0} - Client "
2461
                            "last checker failed with error code {1}"
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
2462
                            .format(client_name,
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2463
                                    client["last_checker_status"]))
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2464
                        client["enabled"] = False
2465
                    else:
2466
                        client["expires"] = (datetime.datetime
2467
                                             .utcnow()
2468
                                             + client["timeout"])
237.7.90 by Björn Påhlsson
fixed bug with bad stored config state for expires and last_checked_ok.
2469
                        logger.debug("Last checker succeeded,"
2470
                                     " keeping {0} enabled"
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
2471
                                     .format(client_name))
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2472
            try:
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2473
                client["secret"] = (
2474
                    pgp.decrypt(client["encrypted_secret"],
237.12.9 by Björn Påhlsson
renamed variables
2475
                                client_settings[client_name]
2476
                                ["secret"]))
2477
            except PGPError:
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2478
                # If decryption fails, we use secret from new settings
237.12.10 by Björn Påhlsson
added warning text when failing to decrypt old state
2479
                logger.debug("Failed to decrypt {0} old secret"
2480
                             .format(client_name))
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2481
                client["secret"] = (
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2482
                    client_settings[client_name]["secret"])
2483
    
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2484
    # Add/remove clients based on new changes made to config
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
2485
    for client_name in (set(old_client_settings)
2486
                        - set(client_settings)):
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2487
        del clients_data[client_name]
237.7.91 by Teddy Hogeborn
* mandos: Break some long lines.
2488
    for client_name in (set(client_settings)
2489
                        - set(old_client_settings)):
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2490
        clients_data[client_name] = client_settings[client_name]
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2491
    
237.7.100 by teddy at recompile
* mandos: Consistent terminology; use the term "secret" for the
2492
    # Create all client objects
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2493
    for client_name, client in clients_data.iteritems():
2494
        tcp_server.clients[client_name] = client_class(
2495
            name = client_name, settings = client)
24.1.149 by Björn Påhlsson
Changed ForkingMixIn in favor of multiprocessing
2496
    
237.2.104 by Teddy Hogeborn
Code cleanup and one bug fix.
2497
    if not tcp_server.clients:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2498
        logger.warning("No clients defined")
237.7.121 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2499
    
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2500
    if not debug:
237.2.202 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
2501
        try:
2502
            with pidfile:
2503
                pid = os.getpid()
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2504
                pidfile.write(str(pid) + "\n".encode("utf-8"))
237.2.202 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
2505
            del pidfile
2506
        except IOError:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2507
            logger.error("Could not write to file %r with PID %d",
237.2.202 by Teddy Hogeborn
* mandos: Do not write pid file if --debug is passed.
2508
                         pidfilename, pid)
2509
        except NameError:
2510
            # "pidfile" was never created
2511
            pass
2512
        del pidfilename
24.1.185 by Björn Påhlsson
working transition code for going between se.bsnet.fukt to se.recompile
2513
    
28 by Teddy Hogeborn
* server.conf: New file.
2514
    signal.signal(signal.SIGHUP, lambda signum, frame: sys.exit())
2515
    signal.signal(signal.SIGTERM, lambda signum, frame: sys.exit())
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2516
    
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2517
    if use_dbus:
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
2518
        @alternate_dbus_interfaces({"se.recompile.Mandos":
2519
                                        "se.bsnet.fukt.Mandos"})
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
2520
        class MandosDBusService(DBusObjectWithProperties):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2521
            """A D-Bus proxy object"""
2522
            def __init__(self):
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2523
                dbus.service.Object.__init__(self, bus, "/")
237.11.1 by Teddy Hogeborn
* mandos (transitional_dbus_metaclass): Renamed to
2524
            _interface = "se.recompile.Mandos"
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2525
            
237.18.2 by teddy at recompile
Add facilities for D-Bus interface annotations and use them to mark
2526
            @dbus_interface_annotations(_interface)
2527
            def _foo(self):
2528
                return { "org.freedesktop.DBus.Property"
2529
                         ".EmitsChangedSignal":
2530
                             "false"}
2531
            
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2532
            @dbus.service.signal(_interface, signature="o")
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2533
            def ClientAdded(self, objpath):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2534
                "D-Bus signal"
2535
                pass
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2536
            
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2537
            @dbus.service.signal(_interface, signature="ss")
237.2.172 by Teddy Hogeborn
* mandos (MandosServer.handle_ipc): Better log message.
2538
            def ClientNotFound(self, fingerprint, address):
237.2.90 by Teddy Hogeborn
Merge from pipe IPC branch.
2539
                "D-Bus signal"
2540
                pass
2541
            
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2542
            @dbus.service.signal(_interface, signature="os")
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2543
            def ClientRemoved(self, objpath, name):
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2544
                "D-Bus signal"
2545
                pass
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2546
            
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2547
            @dbus.service.method(_interface, out_signature="ao")
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2548
            def GetAllClients(self):
237.2.46 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
2549
                "D-Bus method"
237.2.104 by Teddy Hogeborn
Code cleanup and one bug fix.
2550
                return dbus.Array(c.dbus_object_path
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2551
                                  for c in
2552
                                  tcp_server.clients.itervalues())
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2553
            
237.2.96 by Teddy Hogeborn
Minor code cleanup; one minor bug fix.
2554
            @dbus.service.method(_interface,
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2555
                                 out_signature="a{oa{sv}}")
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2556
            def GetAllClientsWithProperties(self):
237.2.46 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
2557
                "D-Bus method"
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2558
                return dbus.Dictionary(
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2559
                    ((c.dbus_object_path, c.GetAll(""))
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2560
                     for c in tcp_server.clients.itervalues()),
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2561
                    signature="oa{sv}")
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2562
            
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2563
            @dbus.service.method(_interface, in_signature="o")
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2564
            def RemoveClient(self, object_path):
237.2.46 by Teddy Hogeborn
* mandos (peer_certificate): Handle NULL pointer from
2565
                "D-Bus method"
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2566
                for c in tcp_server.clients.itervalues():
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2567
                    if c.dbus_object_path == object_path:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2568
                        del tcp_server.clients[c.name]
237.2.91 by Teddy Hogeborn
* mandos (Client): Move all D-Bus code to new "ClientDBus" class.
2569
                        c.remove_from_connection()
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2570
                        # Don't signal anything except ClientRemoved
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2571
                        c.disable(quiet=True)
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2572
                        # Emit D-Bus signal
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2573
                        self.ClientRemoved(object_path, c.name)
2574
                        return
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2575
                raise KeyError(object_path)
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2576
            
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2577
            del _interface
237.2.41 by Teddy Hogeborn
* mandos (Client.GetAllProperties): Also send Client.dbus_object_path
2578
        
237.7.123 by Teddy Hogeborn
* mandos: Use a class decorator instead of a metaclass to provide
2579
        mandos_dbus_service = MandosDBusService()
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
2580
    
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2581
    def cleanup():
2582
        "Cleanup function; run on exit"
2583
        service.cleanup()
2584
        
237.11.11 by Teddy Hogeborn
* mandos (Client.checked_ok): Set "expires" after setting timeout.
2585
        multiprocessing.active_children()
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2586
        if not (tcp_server.clients or client_settings):
2587
            return
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2588
        
237.7.69 by teddy at bsnet
* debian/control (mandos/Depends): Added "python-crypto".
2589
        # Store client before exiting. Secrets are encrypted with key
2590
        # based on what config file has. If config file is
2591
        # removed/edited, old secret will thus be unrecovable.
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2592
        clients = {}
237.12.9 by Björn Påhlsson
renamed variables
2593
        with PGPEngine() as pgp:
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2594
            for client in tcp_server.clients.itervalues():
2595
                key = client_settings[client.name]["secret"]
237.12.9 by Björn Påhlsson
renamed variables
2596
                client.encrypted_secret = pgp.encrypt(client.secret,
2597
                                                      key)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2598
                client_dict = {}
2599
                
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2600
                # A list of attributes that can not be pickled
2601
                # + secret.
237.12.14 by Björn Påhlsson
Mandos: refactoring the code handling settings from config files.
2602
                exclude = set(("bus", "changedstate", "secret",
2603
                               "checker"))
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2604
                for name, typ in (inspect.getmembers
2605
                                  (dbus.service.Object)):
2606
                    exclude.add(name)
2607
                
2608
                client_dict["encrypted_secret"] = (client
2609
                                                   .encrypted_secret)
2610
                for attr in client.client_structure:
2611
                    if attr not in exclude:
2612
                        client_dict[attr] = getattr(client, attr)
2613
                
237.12.15 by Björn Påhlsson
more refactoring in regards to how clients get created
2614
                clients[client.name] = client_dict
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2615
                del client_settings[client.name]["secret"]
2616
        
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2617
        try:
237.7.126 by Teddy Hogeborn
* mandos (main.cleanup): Use tempfile.NamedTemporaryFile() instead of
2618
            with (tempfile.NamedTemporaryFile
2619
                  (mode='wb', suffix=".pickle", prefix='clients-',
2620
                   dir=os.path.dirname(stored_state_path),
2621
                   delete=False)) as stored_state:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2622
                pickle.dump((clients, client_settings), stored_state)
237.7.126 by Teddy Hogeborn
* mandos (main.cleanup): Use tempfile.NamedTemporaryFile() instead of
2623
                tempname=stored_state.name
237.11.26 by teddy at bsnet
* mandos (main/cleanup): Write new file, then rename. Use
2624
            os.rename(tempname, stored_state_path)
237.14.1 by Teddy Hogeborn
Use GPG to encrypt instead of AES.
2625
        except (IOError, OSError) as e:
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2626
            if not debug:
2627
                try:
2628
                    os.remove(tempname)
2629
                except NameError:
2630
                    pass
237.7.122 by Teddy Hogeborn
* mandos: White space and other misc. format fixes only.
2631
            if e.errno in (errno.ENOENT, errno.EACCES, errno.EEXIST):
2632
                logger.warning("Could not save persistent state: {0}"
2633
                               .format(os.strerror(e.errno)))
2634
            else:
2635
                logger.warning("Could not save persistent state:",
2636
                               exc_info=e)
237.7.78 by teddy at bsnet
* mandos (initlogger): Take new "debug" argument; all callers changed.
2637
                raise e
237.12.6 by Teddy Hogeborn
* mandos: Fix whitespace.
2638
        
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2639
        # Delete all clients, and settings from config
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2640
        while tcp_server.clients:
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2641
            name, client = tcp_server.clients.popitem()
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2642
            if use_dbus:
2643
                client.remove_from_connection()
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2644
            # Don't signal anything except ClientRemoved
237.2.165 by Teddy Hogeborn
* mandos (Client.disable): Rename keyword argument "log" to "quiet",
2645
            client.disable(quiet=True)
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2646
            if use_dbus:
2647
                # Emit D-Bus signal
237.11.3 by Teddy Hogeborn
* mandos: Break long lines.
2648
                mandos_dbus_service.ClientRemoved(client
2649
                                                  .dbus_object_path,
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2650
                                                  client.name)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2651
        client_settings.clear()
237.2.163 by Teddy Hogeborn
* mandos (Client.enable): Bug fix: Start new immediate checker last to
2652
    
2653
    atexit.register(cleanup)
2654
    
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2655
    for client in tcp_server.clients.itervalues():
237.2.6 by Teddy Hogeborn
* mandos (Client.timeout, Client.interval): Changed from being a
2656
        if use_dbus:
2657
            # Emit D-Bus signal
237.2.174 by Teddy Hogeborn
More consistent terminology: Clients are no longer "invalid" - they
2658
            mandos_dbus_service.ClientAdded(client.dbus_object_path)
237.12.1 by Björn Påhlsson
Persistent state: New feature. Client state is now stored when mandos
2659
        # Need to initiate checking of clients
2660
        if client.enabled:
2661
            client.init_checker()
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2662
    
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
2663
    tcp_server.enable()
2664
    tcp_server.server_activate()
2665
    
28 by Teddy Hogeborn
* server.conf: New file.
2666
    # Find out what port we got
2667
    service.port = tcp_server.socket.getsockname()[1]
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
2668
    if use_ipv6:
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2669
        logger.info("Now listening on address %r, port %d,"
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2670
                    " flowinfo %d, scope_id %d",
2671
                    *tcp_server.socket.getsockname())
237.2.77 by Teddy Hogeborn
Support not using IPv6 in server:
2672
    else:                       # IPv4
237.7.116 by Teddy Hogeborn
* mandos-monitor: Use new string format method.
2673
        logger.info("Now listening on address %r, port %d",
2674
                    *tcp_server.socket.getsockname())
28 by Teddy Hogeborn
* server.conf: New file.
2675
    
29 by Teddy Hogeborn
* plugins.d/mandosclient.c (start_mandos_communication): Changed
2676
    #service.interface = tcp_server.socket.getsockname()[3]
28 by Teddy Hogeborn
* server.conf: New file.
2677
    
2678
    try:
2679
        # From the Avahi example code
2680
        try:
237.2.99 by Teddy Hogeborn
Code cleanup.
2681
            service.activate()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2682
        except dbus.exceptions.DBusException as error:
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
2683
            logger.critical("D-Bus Exception", exc_info=error)
237.2.164 by Teddy Hogeborn
* README (FAQ): Fix typo.
2684
            cleanup()
28 by Teddy Hogeborn
* server.conf: New file.
2685
            sys.exit(1)
2686
        # End of Avahi example code
2687
        
2688
        gobject.io_add_watch(tcp_server.fileno(), gobject.IO_IN,
2689
                             lambda *args, **kwargs:
237.1.2 by Teddy Hogeborn
Further steps towards a D-Bus server interface, plus minor syntax
2690
                             (tcp_server.handle_request
2691
                              (*args[2:], **kwargs) or True))
28 by Teddy Hogeborn
* server.conf: New file.
2692
        
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2693
        logger.debug("Starting main loop")
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2694
        main_loop.run()
237.7.30 by Teddy Hogeborn
* mandos: Tolerate restarting Avahi servers. Also Changed to new
2695
    except AvahiError as error:
237.7.113 by Teddy Hogeborn
* mandos (AvahiService.rename, Client.start_checker,
2696
        logger.critical("Avahi Error", exc_info=error)
237.2.164 by Teddy Hogeborn
* README (FAQ): Fix typo.
2697
        cleanup()
28 by Teddy Hogeborn
* server.conf: New file.
2698
        sys.exit(1)
11 by Teddy Hogeborn
* server.py: Rewritten to use Zeroconf (mDNS/DNS-SD) in place of the
2699
    except KeyboardInterrupt:
15 by Teddy Hogeborn
* mandos-clients.conf ([foo]): Uncommented.
2700
        if debug:
237.8.5 by teddy at bsnet
* mandos: Use unicode string literals.
2701
            print("", file=sys.stderr)
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2702
        logger.debug("Server received KeyboardInterrupt")
2703
    logger.debug("Server exiting")
237.2.164 by Teddy Hogeborn
* README (FAQ): Fix typo.
2704
    # Must run before the D-Bus bus name gets deregistered
2705
    cleanup()
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2706
237.8.4 by teddy at bsnet
* mandos: Use unicode string literals.
2707
if __name__ == '__main__':
16 by Teddy Hogeborn
* Makefile: Include targets for all binaries.
2708
    main()